Function at 0x140011420
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14d, r9d
lea ebp, [rcx - 0x2637]
xor r14d, 0x2096
lea esi, [rdx + 0x8ce]
mov rbx, r8
lea edi, [rdx + 0x4bb]
lea eax, [r14 + 0x23d5]
cmp ebp, eax
jg 0x1400116a6
cmp dword [r8 + 0x90], 0xbb10
ja 0x14001148a
mov eax, dword [r8 + 0x110]
add eax, dword [r8 + 0x68]
xor eax, 0x6ea7d270
sub dword [r8 + 0x60], eax
jmp 0x1400114aa
mov rdx, qword [section..data]
mov ecx, dword [r8 + 0x34]
xor ecx, dword [0x14002b078]
mov eax, dword [rdx + 0xc8]
imul eax, ecx
mov dword [rdx + 0xc8], eax
lea rax, [0x140014990]
xor r10d, r10d
mov qword [r8 + 0xb0], rax
mov eax, 0x12747b
sub eax, dword [0x14002b12c]
add dword [0x14002b020], eax
mov eax, dword [0x14002b078]
sub dword [rbx + 0x14], eax
mov eax, dword [0x14002b088]
sub eax, dword [rbx + 0x128]
mov ecx, dword [rbx + 0x11c]
add eax, 0x41748
add dword [rbx + 0x110], eax
mov rax, qword [rbx + 0xb0]
mov r9d, dword [r10 + rax]
add r10, 4
mov eax, dword [0x14002b0d8]
add eax, 0xffd3f8b4
add ecx, eax
add dword [rbx + 0x78], ecx
mov rax, qword [section..data]
imul r9d, dword [rax + 0x60]
mov ecx, dword [rax + 0xf8]
mov eax, 0x11
sub eax, dword [rbx + 0x54]
add dword [rbx + 0x10], eax
xor ecx, dword [rbx + 0x44]
xor ecx, dword [rbx + 0x110]
mov r8d, r9d
xor ecx, 0xffe54dd1
shr r8d, 0x10
mov dword [rbx + 0x110], ecx
mov rax, qword [section..data]
movsxd rdx, dword [0x14002b080]
mov rcx, qword [rax + 0xb8]
mov byte [rdx + rcx], r8b
mov edx, r9d
inc dword [0x14002b080]
mov rcx, qword [section..data]
mov eax, dword [rbx + 0xe0]
xor eax, 1
shr edx, 8
add dword [rcx + 0x10], eax
movsxd rcx, dword [rbx + 0x70]
mov rax, qword [rbx + 0xb8]
mov byte [rcx + rax], dl
mov eax, 0x1992d1
sub eax, dword [rbx + 0xc8]
add dword [rbx + 0x14], eax
inc dword [rbx + 0x70]
mov rax, qword [0x14002b0c8]
movsxd rcx, dword [rbx + 0x70]
mov byte [rcx + rax], r9b
inc dword [rbx + 0x70]
mov rcx, qword [section..data]
mov eax, dword [rbx + 0x128]
add eax, dword [rbx + 0xc8]
xor eax, 0x34a165
or dword [rcx + 0x78], eax
mov eax, dword [rbx + 0x11c]
mov ecx, dword [rbx + 0x78]
add eax, 0xffd69439
add ecx, eax
or dword [rbx + 0x128], ecx
mov eax, dword [0x14002b138]
add eax, 0xffe4f16c
add dword [rbx + 0xd8], eax
cmp r10, 0xd090
jl 0x1400114bb
mov r8d, edi
lea eax, [rsi + 0x84]
xor r8d, 0x589
mov dword [rsp + 0x20], eax
lea r9d, [rsi - 0x56f]
lea edx, [rdi + 0x6a0]
lea rcx, [0x14002b010]
call fcn.140011b14
cmp dword [0x14002b0d8], 0x14d7f
jb 0x140011642
add dword [rbx + 0x60], 0xfffffe96
mov rax, qword [section..data]
xor edi, 0x6a1
mov ecx, dword [rax + 0x128]
cmp dword [0x14002b010], ecx
je 0x140011664
add dword [rbx + 0x60], 0x38e386ed
mov eax, edi
lea r10d, [rsi - 0x135e]
xor eax, 0xa58
lea r9d, [rsi - 0x111e]
mov dword [rsp + 0x30], eax
lea r8d, [rbp + 0x24db]
mov edx, esi
mov qword [rsp + 0x28], rbx
xor edx, 0x84
mov dword [rsp + 0x20], r10d
lea ecx, [rdi + 0xc41]
call fcn.140001450
jmp 0x140011734
mov ecx, dword [r8 + 0xa0]
add ecx, edi
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
mov rax, qword [section..data]
mov r9d, ebp
mov ecx, dword [rbx + 0x74]
or r9d, 0x16ec
or ecx, dword [0x14002b068]
sub ebp, r14d
mov dword [rsp + 0x20], r9d
mov r9, rbx
mov r8d, dword [rax + 0xe0]
xor r8d, 0x23be
or r8d, dword [rbx + 0x11c]
lea edx, [rbp + 0x23d5]
call fcn.140013654
mov ecx, dword [rbx + 0x14]
and ecx, 0x208
or rcx, 0x2842
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rax, qword [section..data]
mov ecx, dword [rax + 0xe0]
mov edx, dword [rax + 0x14]
or edx, ecx
sub edx, ecx
mov ecx, dword [rbx + 0x68]
imul ecx, dword [0x14002b0e8]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov rbx, qword [rsp + 0x50]
lea eax, [rsi - 0x135e]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret