Function at 0x180034530
Capabilities:
Encode data using xor
Get common file path
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r14
push r15
sub rsp, 0x880
mov r14, rcx
lea rdx, [rsp + 0x460]
mov rcx, qword [0x18006c888]
xor esi, esi
mov r8d, 0x100
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r10d, esi
lea r9, [rsp + 0x460]
lea r11, [0x18005b4f8]
nop dword [rax + rax]
movzx ecx, word [r9]
test cx, cx
je 0x1800345de
mov r8, r9
sub r8, r11
nop
mov rax, r11
test cx, cx
je 0x1800345cc
nop dword [rax + rax]
movzx ecx, word [rax]
test cx, cx
je 0x180034750
movzx edx, word [r8 + rax]
movzx ecx, cx
cmp edx, ecx
jne 0x1800345c3
add rax, 2
cmp word [r8 + rax], si
jne 0x1800345a0
cmp word [rax], si
je 0x180034750
movzx ecx, word [r9 + 2]
add r9, 2
add r8, 2
test cx, cx
jne 0x180034590
test r10, r10
je 0x1800345e7
mov word [r10], si
lea rdx, [rsp + 0x670]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, rsi
nop dword [rax]
movzx eax, word [rsp + rcx + 0x460]
mov word [rsp + rcx + 0x40], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180034600
lea rcx, [rsp + 0x40]
sub rcx, 2
nop
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x180034620
movups xmm0, xmmword [str._settings.xml]
mov eax, dword [0x18005b568]
movsd xmm1, qword [0x18005b560]
movups xmmword [rcx], xmm0
movsd qword [rcx + 0x10], xmm1
mov dword [rcx + 0x18], eax
mov rcx, rsi
nop dword [rax]
movzx eax, word [rsp + rcx + 0x670]
mov word [rsp + rcx + 0x250], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180034650
lea rcx, [rsp + 0x250]
sub rcx, 2
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x180034675
movups xmm0, xmmword [0x18005b570]
xor r9d, r9d
mov eax, dword [0x18005b588]
movsd xmm1, qword [0x18005b580]
mov edx, 0x80
movups xmmword [rcx], xmm0
mov qword [rsp + 0x30], rsi
movsd qword [rcx + 0x10], xmm1
lea r8d, [r9 + 3]
mov dword [rcx + 0x18], eax
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x8a0], rdi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
movabs rbp, 0xfffffffeffffffff
mov ebx, esi
mov rcx, rax
mov r15d, 1
inc rax
test rbp, rax
cmovne ebx, r15d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x18003475c
mov qword [rsp + 0x30], rsi
lea edx, [r15 + 0x7f]
mov dword [rsp + 0x28], 0x80
lea r8d, [r15 + 2]
xor r9d, r9d
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18003475c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jle 0x18003475c
lea rcx, [rsp + 0x40]
jmp 0x180034806
mov r10, r9
add r9, 2
jmp 0x180034580
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
lea rcx, [rsp + 0x250]
mov edx, 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
mov ebx, esi
inc rax
test rbp, rax
cmovne ebx, r15d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1800348b8
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x250]
mov edx, 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800348b8
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jle 0x1800348b8
lea rcx, [rsp + 0x250]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
test rax, rax
jne 0x18003484a
mov rbx, rsi
mov edx, esi
mov rcx, rbx
call fcn.180034d30
mov rax, rbx
jmp 0x18003498b
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea ebx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r9, [rsp + 0x8a8]
mov qword [rsp + 0x20], rsi
mov rdx, rax
mov r8d, edi
mov rcx, rbp
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov rcx, rbp
cmovne esi, edi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1800348a6
mov dword [r14], esi
mov edx, esi
mov rcx, rbx
call fcn.180034d30
mov rax, rbx
jmp 0x18003498b
lea rbx, [0x18005d210]
mov rcx, rbx
lea rdx, str._CONFIG
call qword [sym.imp.SHLWAPI.dll_StrStrA]
test rax, rax
jne 0x180034988
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdx, rax
mov r10, rax
sub rdx, rbx
mov ecx, 0x400
movzx eax, byte [rbx]
mov byte [rdx + rbx], al
lea rbx, [rbx + 1]
sub rcx, r15
jne 0x180034900
mov r8d, esi
mov rdx, rsi
mov rcx, r10
cmp byte [rcx], sil
jne 0x180034971
mov rax, rsi
cmp byte [rcx + rax], sil
jne 0x180034971
inc rax
cmp rax, 8
jl 0x180034920
movsxd r9, r8d
add r9, r10
je 0x18003496c
sub r9d, r10d
mov edx, esi
movsxd r8, r9d
test r9d, r9d
jle 0x180034969
mov rcx, r10
nop word [rax + rax]
lea eax, [rdx + 0xd]
xor byte [rcx], al
lea rcx, [rcx + 1]
cmp edx, 3
lea eax, [rdx + 1]
cmovg eax, esi
mov edx, eax
sub r8, r15
jne 0x180034950
mov dword [r14], r9d
mov rax, r10
jmp 0x18003498b
inc r8d
inc rdx
inc rcx
cmp rdx, 0x400
jl 0x180034918
mov rax, r10
jmp 0x18003498b
mov rax, rsi
mov rdi, qword [rsp + 0x8a0]
lea r11, [rsp + 0x880]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rsi
ret