Function at 0x140091c85
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x288
lea rsi, [rsp + 0x80]
mov r8d, 0x208
mov rcx, rsi
xor edx, edx
call fcn.140092ff0
mov rcx, rsi
mov edx, 0x104
call qword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x140091d0c
cmp eax, 0x105
jae 0x140091f94
mov eax, eax
lea rax, [rsp + rax*2]
add rax, 0x80
lea rdx, [rsp + 0x68]
mov qword [rdx], rsi
mov qword [rdx + 8], rax
mov word [rdx + 0x10], 0
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.14009103b
mov rsi, qword [rsi]
test rsi, rsi
je 0x140091d0c
mov rbx, qword [rsp + 0x58]
mov r14, qword [rsp + 0x60]
jmp 0x140091d60
lea rax, [0x14042f268]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
movabs rdi, 0x33a2d4498f2f6d0
xor rdi, qword [rax + 0xf15f]
movzx ebp, word [rax + 0xf167]
xor ebp, 0x4fad
mov r14d, 0xa
mov ecx, 0xa
xor edx, edx
call fcn.14000d520
mov rsi, rax
mov rbx, rdx
mov word [rax + 8], bp
mov qword [rax], rdi
lea rax, [0x14042e3f5]
lea r15, [rsp + 0x80]
mov qword [r15], rax
mov rax, qword [r15]
movabs rcx, 0xbaf04043071207d7
xor rcx, qword [rax + 0xffdc]
mov edx, 0xedf75edf
xor edx, dword [rax + 0xffe4]
mov dword [r15 + 8], edx
mov qword [r15], rcx
mov qword [rsp + 0x20], 0xc
lea rcx, [rsp + 0x38]
mov rdx, rsi
mov r8, r14
mov r9, r15
call fcn.14008a1c1
test rbx, rbx
je 0x140091dca
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x30], rcx
call fcn.140085378
lea rcx, [0x140430012]
mov qword [rsp + 0x68], rcx
mov r8, qword [rsp + 0x68]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
mov r10b, 1
xor ebp, ebp
lea r11, [0x14043e3b0]
movzx r9d, byte [rbp + r11]
mov rcx, rbp
or rcx, 1
movzx ecx, byte [rcx + r11]
mov rdi, rbp
or rdi, 2
movzx r12d, byte [rdi + r11]
mov rdi, rbp
or rdi, 3
movzx r13d, byte [rdi + r11]
mov rdi, rbp
or rdi, 4
movzx ebx, byte [rdi + r11]
mov rdi, rbp
or rdi, 5
movzx edi, byte [rdi + r11]
mov r14, rbp
or r14, 7
mov rsi, rbp
or rsi, 6
movzx esi, byte [rsi + r11]
movzx r14d, byte [r14 + r11]
shl r14, 0x38
shl rsi, 0x30
or rsi, r14
shl rdi, 0x28
shl rbx, 0x20
shl r13, 0x18
shl r12, 0x10
shl rcx, 8
or rcx, r9
or rcx, r12
or rcx, r13
or rcx, rbx
or rcx, rdi
or rcx, rsi
xor rcx, qword [rbp + r8 + 0xe3cb]
mov qword [rsp + rbp + 0x80], rcx
mov ebp, 8
test r10b, 1
mov r10d, 0
jne 0x140091e06
mov ecx, 0x63b1fb59
xor ecx, dword [r8 + 0xe3db]
mov dword [rsp + 0x90], ecx
movzx ecx, byte [r8 + 0xe3e1]
movzx ebp, word [r8 + 0xe3df]
xor ebp, 0x53b4
mov word [rsp + 0x94], bp
xor cl, 0x84
test rax, rax
cmovne r15, rax
mov byte [rsp + 0x96], cl
mov eax, 0x17
cmove rdx, rax
mov rcx, r15
xor r8d, r8d
call fcn.140091f98
cmp rax, 1
jne 0x140091f5a
lea rbx, [rsp + 0x80]
mov qword [rbx], 0
mov rcx, rdx
mov edx, 0xf00ff
mov r8, rbx
call qword [sym.imp.advapi32.dll_OpenProcessToken]
xor edi, edi
test eax, eax
sete dil
mov rbx, qword [rbx]
cmp qword [rsp + 0x40], 0
je 0x140091f7a
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, qword [rsp + 0x30]
call sub.kernel32.dll_HeapFree
jmp 0x140091f7a
cmp qword [rsp + 0x40], 0
je 0x140091f75
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, qword [rsp + 0x30]
call sub.kernel32.dll_HeapFree
mov edi, 1
mov rax, rdi
mov rdx, rbx
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2