Function at 0x14021ad20
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8c0]
sub rsp, 0x9c0
xor esi, esi
lea rdi, [0x140548ab0]
mov r14d, 0x4f0d
nop dword [rax]
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x4c0]
mov r8d, 0x1fe
call fcn.1403ccc50
xor edx, edx
lea rcx, [rbp + 0x2c0]
mov r8d, 0x1fe
call fcn.1403ccc50
mov edx, esi
mov dword [rsp + 0x30], 0xb0a6b0af
mov dword [rsp + 0x34], 0xb091b090
mov dword [rsp + 0x38], 0xb08bb09e
mov dword [rsp + 0x3c], 0xb088b08d
mov dword [rsp + 0x40], 0xb0a0b082
mov dword [rsp + 0x44], 0xb09fb0b0
mov dword [rsp + 0x48], 0xb168b09c
mov dword [rsp + 0x4c], 0xb16cb168
mov dword [rsp + 0x50], 0xb158b166
mov dword [rsp + 0x54], 0xb17fb156
mov dword [rsp + 0x58], 0xb17cb174
mov dword [rsp + 0x5c], 0xb167b16c
mov dword [rsp + 0x60], 0xb14fb157
mov dword [rsp + 0x64], 0xb17cb178
mov dword [rsp + 0x68], 0xb175b17d
mov dword [rsp + 0x6c], 0xb166b17f
mov dword [rsp + 0x70], 0xb17bb150
mov dword [rsp + 0x74], 0xb162b17b
mov dword [rsp + 0x78], 0xb177b165
mov dword [rsp + 0x7c], 0xb149b175
mov dword [rbp - 0x80], 0xb168b17e
mov dword [rbp - 0x7c], 0xb14db141
mov dword [rbp - 0x78], 0xb152b17a
mov dword [rbp - 0x74], 0xb14bb157
mov dword [rbp - 0x70], 0xb141b140
mov dword [rbp - 0x6c], 0xb17ab156
mov dword [rbp - 0x68], 0xb15fb102
mov dword [rbp - 0x64], 0xb15a
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r14w
inc edx
xor word [rcx], ax
cmp edx, 0x37
jb 0x14021ae70
mov word [rbp - 0x62], si
mov rcx, rsi
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rsp + rcx + 0x30]
mov word [rbp + rcx + 0x2c0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14021aea0
xor edx, edx
lea rcx, [rbp + 0xc0]
mov r8d, 0x1fe
call fcn.1403ccc50
xor edx, edx
lea rcx, [rbp + 0x6c0]
mov r8d, 0x200
call fcn.1403ccc50
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rdi + r9], sil
jne 0x14021aee5
lea rax, [rbp + 0x6c0]
mov dword [rsp + 0x28], 0x200
mov r8, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbp + rcx + 0x6c0]
mov word [rbp + rcx + 0xc0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14021af20
lea r9, [rbp + 0xc0]
mov edx, 0x1fe
lea r8, [rbp + 0x2c0]
lea rcx, [rbp + 0x4c0]
call fcn.140218fa0
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp - 0x60]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax]
mov rax, qword [0x140548d68]
lea rcx, [rbp - 0x60]
call rax
mov ebx, eax
cmp eax, 0xc000010e
je 0x14021af91
cmp eax, 0xc0000428
jne 0x14021b17b
mov rdx, qword [0x140548b18]
lea rcx, [rbp - 0x60]
call rdx
cmp ebx, 0xc0000428
jne 0x14021af70
cmp eax, 0xc0000034
jne 0x14021af70
mov rcx, qword [0x140548b10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, rdi
call fcn.14021aa60
mov edx, esi
mov dword [rbp + 0x910], 0x80879094
mov word [rbp + 0x914], 0xc4
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp + 0x910]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 5
jb 0x14021afe0
mov byte [rbp + 0x915], sil
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x910]
mov byte [rcx + rdi], al
lea rcx, [rcx + 1]
test al, al
jne 0x14021b010
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x104
call fcn.1403ccc50
mov edx, 0x104
lea rcx, [rbp - 0x50]
call qword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
mov edx, esi
mov word [rbp + 0x900], 0xaf
nop
movsxd rax, edx
lea rcx, [rbp + 0x900]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 1
jb 0x14021b050
lea rcx, [rbp - 0x50]
mov byte [rbp + 0x901], sil
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x14021b080
lea r8, [rbp + 0x900]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14021b0a0
lea rcx, [rbp - 0x50]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x14021b0c0
xor edx, edx
nop dword [rax]
movzx eax, byte [rdi + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14021b0d0
xor eax, eax
mov dword [rbp + 0x908], 0x858c87dd
mov byte [rbp + 0x90c], al
nop dword [rax]
nop word [rax + rax]
movsxd rcx, eax
lea rdx, [rbp + 0x908]
add rdx, rcx
lea ecx, [rax - 0xd]
inc eax
xor byte [rdx], cl
cmp eax, 4
jb 0x14021b100
lea rcx, [rbp - 0x50]
mov byte [rbp + 0x90c], sil
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x14021b130
lea r8, [rbp + 0x908]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14021b150
lea rcx, [rbp - 0x50]
call fcn.140219320
call fcn.14021ab20
mov rcx, rdi
call fcn.14021a380
jmp 0x14021ad60
mov rbx, qword [rsp + 0xa18]
add rsp, 0x9c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret