Function at 0x1800412e0
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r15d, dword [rsp + 0xb8]
lea r11d, [r8 - 0x3a7]
mov esi, dword [rsp + 0xb0]
lea edi, [rdx + 0x2ab]
mov rbx, qword [rsp + 0xc0]
lea r13d, [rcx - 0x9b9]
add r15d, 0x531
mov dword [rsp + 0x90], r11d
mov r12d, ecx
mov ebp, ecx
xor r12d, 0x16b7
xor esi, 0x92a
xor ebp, 0x6c6
mov r14d, ecx
lea eax, [r15 - 0x504]
cmp ebp, eax
je 0x180041504
lea eax, [r15 - 0x38f]
cmp esi, eax
jg 0x1800413dd
mov ecx, dword [0x1800e7090]
cmp dword [0x1800e70f8], ecx
mov rdx, qword [section..data]
jae 0x180041394
mov eax, dword [rdx + 0xa4]
add eax, 0x96de1
imul ecx, eax
mov dword [0x1800e7090], ecx
cmp dword [0x1800e7050], 0x10b8
jae 0x1800413b3
mov eax, dword [rbx + 0xd4]
xor eax, dword [rbx + 0x68]
sub eax, 0x2d857
xor dword [rbx + 0x2c], eax
jmp 0x1800413c1
mov eax, dword [0x1800e70ac]
xor eax, 0x196f5f
sub dword [rdx + 0x2c], eax
mov eax, dword [rbx + 0xd4]
xor eax, dword [0x1800e7068]
add eax, 0x2a866967
mov dword [0x1800e7010], eax
jmp 0x180041504
mov rax, qword [section..data]
mov ecx, dword [rax + 0xc8]
imul ecx, edi
cmp edi, ecx
jbe 0x180041487
mov qword [rsp + 0x50], 0x3d8a
mov edx, 0x1e8b
mov qword [rsp + 0x48], 0x2a85
mov ecx, 0xa70
mov qword [rsp + 0x40], 0x27c0
mov r9d, 0x37db
mov byte [rsp + 0x38], 0x41
mov r8d, 0x3b1e
mov qword [rsp + 0x30], 0x26a7
mov qword [rsp + 0x28], 0x3bd1
mov qword [rsp + 0x20], 0x270d
call fcn.18004176c
mov dword [0x1801c18f0], eax
mov edx, dword [rbx + 0x80]
mov ecx, dword [rbx + 0xd4]
mov eax, ebp
xor ecx, 0x19d3
or rdx, rax
mov eax, r15d
xor rdx, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [0x1800e70e4]
mov r11d, dword [rsp + 0x90]
add eax, 0xffffffd6
add esi, eax
mov rax, qword [section..data]
mov r10d, edi
mov ecx, dword [rax + 0xdc]
add ecx, 0xe2c
cmp edi, ecx
jne 0x180041504
mov r8d, ebp
or r8d, esi
mov r9d, edi
cmp edi, r8d
jle 0x1800414e8
mov rdx, qword [section..data]
add r9d, 4
mov ecx, dword [0x1800e7114]
xor ecx, r14d
mov eax, dword [rdx + 0xd8]
imul eax, ecx
mov dword [rdx + 0xd8], eax
mov eax, dword [0x1800e70b8]
and eax, r15d
imul eax, r14d
imul r13d, eax
cmp r9d, r8d
jg 0x1800414af
mov rax, qword [section..data]
add r10d, 3
mov ecx, dword [rax + 0xdc]
add ecx, 0xe2c
cmp r10d, ecx
je 0x1800414a7
mov r9d, dword [rsp + 0x90]
lea eax, [r11 + 0x60b]
mov rcx, qword [section..data]
lea r11d, [rbp + 0x1171]
mov dword [rsp + 0x30], eax
lea r10d, [r12 + 0x1fd6]
mov dword [rsp + 0x28], r10d
lea r8d, [r13 + 0x1151]
xor ebp, 0xe3e
mov dword [rsp + 0x20], r11d
mov edx, ebp
call fcn.1800420b4
mov rdx, qword [section..data]
lea r11, [rsp + 0x60]
mov ecx, dword [0x1800e703c]
mov r8d, eax
mov rbp, qword [r11 + 0x40]
xor ecx, 0xffe69124
mov rsi, qword [r11 + 0x48]
mov dword [0x1800e7018], ecx
mov ecx, dword [rdx + 0x84]
xor ecx, dword [rdx + 0x68]
sub ecx, 0x58ff427
add dword [rdx + 8], ecx
mov ecx, dword [0x1800e7078]
mov rdx, qword [section..data]
add ecx, 0xf788f139
mov dword [0x1800e702c], ecx
mov eax, dword [rbx + 0x104]
mov rbx, qword [r11 + 0x38]
add eax, 0x3d1d4bb0
mov ecx, dword [rdx + 0x84]
add ecx, eax
lea eax, [r8 + 0xe86]
mov dword [rdx + 0x20], ecx
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret