Function at 0x180015b04
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x320]
sub rsp, 0x420
xor r9d, r9d
lea rax, [rbp + 0x210]
mov rsi, rdx
mov qword [rsp + 0x20], rax
mov r12, rcx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x1c]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor r13d, r13d
lea ebx, [r13 + 1]
test eax, eax
js 0x1800161c7
mov rcx, qword [rsi + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, rbx
jb 0x18001623f
cmp qword [rsi + 0x18], 0x10
mov rax, rsi
jb 0x180015b80
mov rax, qword [rsi]
mov dl, byte [rbp + 0x360]
lea r9, [0x18009e258]
mov qword [rsp + 0x30], rcx
mov r8, rsi
mov qword [rsp + 0x28], rax
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rbx
call fcn.180010984
cmp qword [rbp - 0x28], 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x210]
cmovae rdx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x180015bfe
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015bf9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180016245
call fcn.18006b9d0
mov r9d, 0x40
mov dword [rsp + 0x20], ebx
mov r8d, ebx
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x100]
call fcn.1800105a4
cmp qword [rbp + 0x190], r13
jne 0x180015c2f
mov bl, r13b
jmp 0x18001619d
xorps xmm0, xmm0
mov qword [rbp - 0x70], r13
movups xmmword [rbp - 0x80], xmm0
mov byte [rbp - 0x80], r13b
mov qword [rbp - 0x68], 0xf
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x100]
call fcn.1800102fc
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x180016152
cmp qword [rbp - 0x68], 0x10
lea r14, [rbp - 0x80]
mov r15, qword [rbp - 0x70]
cmovae r14, qword [rbp - 0x80]
test r15, r15
je 0x180015c9c
mov r8, r15
mov edx, 0x3d
mov rcx, r14
call fcn.18006e3d0
mov rsi, rax
test rax, rax
je 0x180015c9c
sub rsi, r14
jmp 0x180015ca0
or rsi, 0xffffffffffffffff
cmp rsi, 0xffffffffffffffff
je 0x180015c46
cmp r15, rsi
mov qword [rsp + 0x70], r13
xorps xmm0, xmm0
mov qword [rsp + 0x78], r13
mov r8, rsi
lea rdx, [rbp - 0x80]
cmovb r8, r15
lea rcx, [rsp + 0x60]
cmp qword [rbp - 0x68], 0x10
movups xmmword [rsp + 0x60], xmm0
cmovae rdx, qword [rbp - 0x80]
call fcn.18000f45c
mov rax, qword [rbp - 0x70]
inc rsi
mov qword [rsp + 0x50], r13
xorps xmm0, xmm0
mov qword [rsp + 0x58], r13
movups xmmword [rsp + 0x40], xmm0
cmp rax, rsi
jb 0x180016257
sub rax, rsi
lea rdx, [rbp - 0x80]
or r15, 0xffffffffffffffff
lea rcx, [rsp + 0x40]
cmp rax, r15
mov r8, r15
cmovb r8, rax
cmp qword [rbp - 0x68], 0x10
cmovae rdx, qword [rbp - 0x80]
add rdx, rsi
call fcn.18000f45c
cmp qword [rsp + 0x78], 0x10
lea rsi, [rsp + 0x60]
mov r14, qword [rsp + 0x70]
cmovae rsi, qword [rsp + 0x60]
test r14, r14
je 0x180015d96
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x100
call fcn.18006e010
lea rcx, [0x18009e288]
lea r13, [0x18009e28a]
movzx eax, byte [rcx]
add rcx, rbx
mov byte [rbp + rax], bl
cmp rcx, r13
jne 0x180015d62
xor r13d, r13d
lea rcx, [r14 + rsi]
mov rdx, rsi
cmp rsi, rcx
jae 0x180015d96
movzx eax, byte [rdx]
cmp byte [rbp + rax], r13b
je 0x180015e1f
add rdx, rbx
cmp rdx, rcx
jb 0x180015d80
mov rdx, r15
cmp r14, rdx
lea rcx, [rsp + 0x60]
cmovb rdx, r14
cmp qword [rsp + 0x78], 0x10
cmovae rcx, qword [rsp + 0x60]
sub r14, rdx
add rdx, rcx
lea r8, [r14 + 1]
call fcn.18006ccb0
cmp qword [rsp + 0x78], 0x10
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x70], r14
cmovae rsi, qword [rsp + 0x60]
test r14, r14
je 0x180015e3e
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x100
call fcn.18006e010
lea rcx, [0x18009e288]
lea r13, [0x18009e28a]
movzx eax, byte [rcx]
add rcx, rbx
mov byte [rbp + rax], bl
cmp rcx, r13
jne 0x180015dfa
xor r13d, r13d
lea rax, [r14 - 1]
cmp rax, r15
mov rcx, r15
cmovb rcx, rax
add rcx, rsi
jmp 0x180015e2f
sub rdx, rsi
jmp 0x180015d99
cmp rcx, rsi
je 0x180015e3e
sub rcx, rbx
movzx eax, byte [rcx]
cmp byte [rbp + rax], r13b
jne 0x180015e27
sub rcx, rsi
jmp 0x180015e41
mov rcx, r15
inc rcx
cmp r14, rcx
jb 0x180016257
cmp qword [rsp + 0x78], 0x10
lea rax, [rsp + 0x60]
mov qword [rsp + 0x70], rcx
lea rsi, [rsp + 0x40]
cmovae rax, qword [rsp + 0x60]
mov byte [rax + rcx], r13b
cmp qword [rsp + 0x58], 0x10
mov r14, qword [rsp + 0x50]
cmovae rsi, qword [rsp + 0x40]
test r14, r14
je 0x180015ed5
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x100
call fcn.18006e010
lea rcx, [0x18009e288]
lea r13, [0x18009e28a]
movzx eax, byte [rcx]
add rcx, rbx
mov byte [rbp + rax], bl
cmp rcx, r13
jne 0x180015ea1
xor r13d, r13d
lea rcx, [r14 + rsi]
mov rdx, rsi
cmp rsi, rcx
jae 0x180015ed5
movzx eax, byte [rdx]
cmp byte [rbp + rax], r13b
je 0x180015f5e
add rdx, rbx
cmp rdx, rcx
jb 0x180015ebf
mov rdx, r15
cmp r14, rdx
lea rcx, [rsp + 0x40]
cmovb rdx, r14
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
sub r14, rdx
add rdx, rcx
lea r8, [r14 + 1]
call fcn.18006ccb0
cmp qword [rsp + 0x58], 0x10
lea rsi, [rsp + 0x40]
mov qword [rsp + 0x50], r14
cmovae rsi, qword [rsp + 0x40]
test r14, r14
je 0x180015f7d
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x100
call fcn.18006e010
lea rcx, [0x18009e288]
lea r13, [0x18009e28a]
movzx eax, byte [rcx]
add rcx, rbx
mov byte [rbp + rax], bl
cmp rcx, r13
jne 0x180015f39
xor r13d, r13d
lea rax, [r14 - 1]
cmp rax, r15
mov rcx, r15
cmovb rcx, rax
add rcx, rsi
jmp 0x180015f6e
sub rdx, rsi
jmp 0x180015ed8
cmp rcx, rsi
je 0x180015f7d
sub rcx, rbx
movzx eax, byte [rcx]
cmp byte [rbp + rax], r13b
jne 0x180015f66
sub rcx, rsi
jmp 0x180015f80
mov rcx, r15
inc rcx
cmp r14, rcx
jb 0x180016257
cmp qword [rsp + 0x58], 0x10
lea rax, [rsp + 0x40]
mov qword [rsp + 0x50], rcx
cmovae rax, qword [rsp + 0x40]
mov byte [rax + rcx], r13b
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
mov rdx, qword [rsp + 0x70]
cmovae rcx, qword [rsp + 0x60]
call fcn.18000f788
mov r9, rax
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x20]
mov rcx, r12
call fcn.18000f6e0
cmp qword [rax + 8], r13
jne 0x18001604e
xorps xmm0, xmm0
mov qword [rbp - 0x30], r13
movups xmmword [rbp - 0x40], xmm0
lea r8, [rsp + 0x60]
mov byte [rbp - 0x40], r13b
lea rdx, [rbp - 0x10]
mov qword [rbp - 0x28], 0xf
mov rcx, r12
call fcn.18000fe40
lea rdx, [rbp - 0x40]
mov rcx, qword [rax]
add rcx, 0x30
call fcn.180011140
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x18001604e
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180016049
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001624b
call fcn.18006b9d0
lea r8, [rsp + 0x60]
mov rcx, r12
lea rdx, [rbp - 0x60]
call fcn.18000fe40
mov rcx, qword [rax]
lea rax, [rsp + 0x40]
add rcx, 0x30
cmp rcx, rax
je 0x1800160bc
cmp qword [rsp + 0x58], 0x10
lea r9, [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
cmovae r9, qword [rsp + 0x40]
cmp rsi, qword [rcx + 0x18]
ja 0x1800160b1
cmp qword [rcx + 0x18], 0x10
mov r14, rcx
jb 0x180016099
mov r14, qword [rcx]
mov qword [rcx + 0x10], rsi
mov r8, rsi
mov rcx, r14
mov rdx, r9
call fcn.18006ccb0
mov byte [r14 + rsi], r13b
jmp 0x1800160bc
mov r8b, r13b
mov rdx, rsi
call fcn.18000fa9c
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1800160f9
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800160f4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180016251
call fcn.18006b9d0
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r13b
cmp rdx, 0x10
jb 0x180015c46
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180016148
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180016251
call fcn.18006b9d0
jmp 0x180015c46
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x18001618d
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180016188
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180016239
call fcn.18006b9d0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], r13b
lea rcx, [rbp + 0x1b0]
call fcn.180010fe4
lea rax, vtable.std::ios_base.0
lea rcx, [rbp + 0x1b0]
mov qword [rbp + 0x1b0], rax
call fcn.18006b458
mov al, bl
jmp 0x18001621c
movdqa xmm0, xmmword [0x18009e690]
xor eax, eax
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x46], al
mov edx, r13d
mov dword [rbp - 0x50], 0x988a8e99
mov dword [rbp - 0x4c], 0x919fce8c
mov word [rbp - 0x48], 0x9a85
movsxd rcx, edx
lea eax, [rdx - 0x27]
add edx, ebx
xor byte [rbp + rcx - 0x60], al
cmp edx, 0x1a
jb 0x1800161f0
mov r9d, 0x10
mov byte [rbp - 0x46], r13b
xor r8d, r8d
lea rdx, [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180072534
int3
call fcn.18001b730
int3
call fcn.180072534
int3
call fcn.180072534
int3
call fcn.180072534
int3
call fcn.18001b744
int3