Function at 0x1800068e0
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x18019d080]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor edi, edi
lea r9, [rbp + 0x27]
xor r8d, r8d
xor edx, edx
lea rcx, [0x180149010]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x180006c12
mov dword [rbp - 0x59], 0x13111307
mov dword [rbp - 0x55], 0x133d1334
mov dword [rbp - 0x51], 0x130f132d
mov dword [rbp - 0x4d], 0x130d1312
mov dword [rbp - 0x49], 0x13101305
mov dword [rbp - 0x45], 0x13311339
mov dword [rbp - 0x41], 0x1306130e
mov dword [rbp - 0x3d], 0x1305130d
mov dword [rbp - 0x39], 0x131f131c
mov dword [rbp - 0x35], 0x133c1331
mov dword [rbp - 0x31], 0x1313130a
mov dword [rbp - 0x2d], 0x131c1314
mov dword [rbp - 0x29], 0x13281307
mov dword [rbp - 0x25], 0x13031336
mov dword [rbp - 0x21], 0x130c1304
mov dword [rbp - 0x1d], 0x13171316
mov dword [rbp - 0x19], 0x1319133f
mov dword [rbp - 0x15], 0x130a130e
mov dword [rbp - 0x11], 0x13ee1316
mov dword [rbp - 0xd], 0x13f613e0
mov dword [rbp - 9], 0x13eb13ea
mov dword [rbp - 5], 0x13f513eb
mov word [rbp - 1], di
mov byte [rbp + 1], 1
movdqa xmm3, xmmword [0x180181860]
mov eax, edi
movdqa xmm4, xmmword [0x1801818b0]
mov edx, 0x1362
nop
movq xmm2, rax
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
movd xmm1, dword [rbp + rax*2 - 0x59]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + rax*2 - 0x59], xmm1
lea rcx, [rdx - 5]
movq xmm2, rcx
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
movd xmm1, dword [rbp + rax*2 - 0x55]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + rax*2 - 0x55], xmm1
lea rcx, [rdx - 3]
movq xmm2, rcx
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
movd xmm1, dword [rbp + rax*2 - 0x51]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + rax*2 - 0x51], xmm1
lea rcx, [rdx - 1]
movq xmm0, rdx
movq xmm2, rcx
punpcklqdq xmm2, xmm0
movd xmm1, dword [rbp + rax*2 - 0x4d]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + rax*2 - 0x4d], xmm1
add rax, 8
add rdx, 8
cmp rdx, 0x138a
jb 0x1800069e0
cmp rax, 0x2c
jae 0x180006ae2
mov edx, 0x135b
lea ecx, [rdx + rax]
xor word [rbp + rax*2 - 0x59], cx
inc rax
cmp rax, 0x2c
jb 0x180006ad1
mov byte [rbp + 1], dil
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
mov rdx, qword [rbp + 0x27]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rdx + r8*2], di
jne 0x180006b03
lea rcx, [rbp + 7]
call fcn.1800172e0
nop
lea rax, [rbp - 0x59]
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180006b20
mov r8, rbx
lea rdx, [rbp - 0x59]
lea rcx, [rbp + 7]
call fcn.180014310
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x3f], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2f], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x3f], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp + 0x1f]
cmp rdx, 7
jbe 0x180006baa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006ba5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180006ba5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180127ffc
movdqa xmm0, xmmword [0x180181880]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], di
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rbp + 0x2f]
call fcn.1800065d0
nop
mov rdx, qword [rbp + 0x47]
cmp rdx, 7
jbe 0x180006c12
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006c0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180006c0d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180127ffc
xor eax, eax
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.180127b60
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret