Function at 0x180018650
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x320]
sub rsp, 0x420
xor r9d, r9d
lea rax, [rbp + 0x210]
mov rsi, rdx
mov qword [rsp + 0x20], rax
mov r12, rcx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x1c]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor r13d, r13d
lea ebx, [r13 + 1]
test eax, eax
js 0x180018d13
mov rcx, qword [rsi + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, rbx
jb 0x180018d8b
cmp qword [rsi + 0x18], 0x10
mov rax, rsi
jb 0x1800186cc
mov rax, qword [rsi]
mov dl, byte [rbp + 0x360]
lea r9, [0x18009e310]
mov qword [rsp + 0x30], rcx
mov r8, rsi
mov qword [rsp + 0x28], rax
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rbx
call fcn.180013078
cmp qword [rbp - 0x28], 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x210]
cmovae rdx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x18001874a
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018745
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018d91
call fcn.18006fd1c
mov r9d, 0x40
mov dword [rsp + 0x20], ebx
mov r8d, ebx
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x100]
call fcn.180012c98
cmp qword [rbp + 0x190], r13
jne 0x18001877b
mov bl, r13b
jmp 0x180018ce9
xorps xmm0, xmm0
mov qword [rbp - 0x70], r13
movups xmmword [rbp - 0x80], xmm0
mov byte [rbp - 0x80], r13b
mov qword [rbp - 0x68], 0xf
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x100]
call fcn.1800129f0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x180018c9e
cmp qword [rbp - 0x68], 0x10
lea r14, [rbp - 0x80]
mov r15, qword [rbp - 0x70]
cmovae r14, qword [rbp - 0x80]
test r15, r15
je 0x1800187e8
mov r8, r15
mov edx, 0x3d
mov rcx, r14
call fcn.180072710
mov rsi, rax
test rax, rax
je 0x1800187e8
sub rsi, r14
jmp 0x1800187ec
or rsi, 0xffffffffffffffff
cmp rsi, 0xffffffffffffffff
je 0x180018792
cmp r15, rsi
mov qword [rsp + 0x70], r13
xorps xmm0, xmm0
mov qword [rsp + 0x78], r13
mov r8, rsi
lea rdx, [rbp - 0x80]
cmovb r8, r15
lea rcx, [rsp + 0x60]
cmp qword [rbp - 0x68], 0x10
movups xmmword [rsp + 0x60], xmm0
cmovae rdx, qword [rbp - 0x80]
call fcn.180011b50
mov rax, qword [rbp - 0x70]
inc rsi
mov qword [rsp + 0x50], r13
xorps xmm0, xmm0
mov qword [rsp + 0x58], r13
movups xmmword [rsp + 0x40], xmm0
cmp rax, rsi
jb 0x180018da3
sub rax, rsi
lea rdx, [rbp - 0x80]
or r15, 0xffffffffffffffff
lea rcx, [rsp + 0x40]
cmp rax, r15
mov r8, r15
cmovb r8, rax
cmp qword [rbp - 0x68], 0x10
cmovae rdx, qword [rbp - 0x80]
add rdx, rsi
call fcn.180011b50
cmp qword [rsp + 0x78], 0x10
lea rsi, [rsp + 0x60]
mov r14, qword [rsp + 0x70]
cmovae rsi, qword [rsp + 0x60]
test r14, r14
je 0x1800188e2
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x100
call fcn.180072350
lea rcx, [0x18009e340]
lea r13, [0x18009e342]
movzx eax, byte [rcx]
add rcx, rbx
mov byte [rbp + rax], bl
cmp rcx, r13
jne 0x1800188ae
xor r13d, r13d
lea rcx, [r14 + rsi]
mov rdx, rsi
cmp rsi, rcx
jae 0x1800188e2
movzx eax, byte [rdx]
cmp byte [rbp + rax], r13b
je 0x18001896b
add rdx, rbx
cmp rdx, rcx
jb 0x1800188cc
mov rdx, r15
cmp r14, rdx
lea rcx, [rsp + 0x60]
cmovb rdx, r14
cmp qword [rsp + 0x78], 0x10
cmovae rcx, qword [rsp + 0x60]
sub r14, rdx
add rdx, rcx
lea r8, [r14 + 1]
call fcn.180070ff0
cmp qword [rsp + 0x78], 0x10
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x70], r14
cmovae rsi, qword [rsp + 0x60]
test r14, r14
je 0x18001898a
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x100
call fcn.180072350
lea rcx, [0x18009e340]
lea r13, [0x18009e342]
movzx eax, byte [rcx]
add rcx, rbx
mov byte [rbp + rax], bl
cmp rcx, r13
jne 0x180018946
xor r13d, r13d
lea rax, [r14 - 1]
cmp rax, r15
mov rcx, r15
cmovb rcx, rax
add rcx, rsi
jmp 0x18001897b
sub rdx, rsi
jmp 0x1800188e5
cmp rcx, rsi
je 0x18001898a
sub rcx, rbx
movzx eax, byte [rcx]
cmp byte [rbp + rax], r13b
jne 0x180018973
sub rcx, rsi
jmp 0x18001898d
mov rcx, r15
inc rcx
cmp r14, rcx
jb 0x180018da3
cmp qword [rsp + 0x78], 0x10
lea rax, [rsp + 0x60]
mov qword [rsp + 0x70], rcx
lea rsi, [rsp + 0x40]
cmovae rax, qword [rsp + 0x60]
mov byte [rax + rcx], r13b
cmp qword [rsp + 0x58], 0x10
mov r14, qword [rsp + 0x50]
cmovae rsi, qword [rsp + 0x40]
test r14, r14
je 0x180018a21
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x100
call fcn.180072350
lea rcx, [0x18009e340]
lea r13, [0x18009e342]
movzx eax, byte [rcx]
add rcx, rbx
mov byte [rbp + rax], bl
cmp rcx, r13
jne 0x1800189ed
xor r13d, r13d
lea rcx, [r14 + rsi]
mov rdx, rsi
cmp rsi, rcx
jae 0x180018a21
movzx eax, byte [rdx]
cmp byte [rbp + rax], r13b
je 0x180018aaa
add rdx, rbx
cmp rdx, rcx
jb 0x180018a0b
mov rdx, r15
cmp r14, rdx
lea rcx, [rsp + 0x40]
cmovb rdx, r14
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
sub r14, rdx
add rdx, rcx
lea r8, [r14 + 1]
call fcn.180070ff0
cmp qword [rsp + 0x58], 0x10
lea rsi, [rsp + 0x40]
mov qword [rsp + 0x50], r14
cmovae rsi, qword [rsp + 0x40]
test r14, r14
je 0x180018ac9
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x100
call fcn.180072350
lea rcx, [0x18009e340]
lea r13, [0x18009e342]
movzx eax, byte [rcx]
add rcx, rbx
mov byte [rbp + rax], bl
cmp rcx, r13
jne 0x180018a85
xor r13d, r13d
lea rax, [r14 - 1]
cmp rax, r15
mov rcx, r15
cmovb rcx, rax
add rcx, rsi
jmp 0x180018aba
sub rdx, rsi
jmp 0x180018a24
cmp rcx, rsi
je 0x180018ac9
sub rcx, rbx
movzx eax, byte [rcx]
cmp byte [rbp + rax], r13b
jne 0x180018ab2
sub rcx, rsi
jmp 0x180018acc
mov rcx, r15
inc rcx
cmp r14, rcx
jb 0x180018da3
cmp qword [rsp + 0x58], 0x10
lea rax, [rsp + 0x40]
mov qword [rsp + 0x50], rcx
cmovae rax, qword [rsp + 0x40]
mov byte [rax + rcx], r13b
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
mov rdx, qword [rsp + 0x70]
cmovae rcx, qword [rsp + 0x60]
call fcn.180011e7c
mov r9, rax
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x20]
mov rcx, r12
call fcn.180011dd4
cmp qword [rax + 8], r13
jne 0x180018b9a
xorps xmm0, xmm0
mov qword [rbp - 0x30], r13
movups xmmword [rbp - 0x40], xmm0
lea r8, [rsp + 0x60]
mov byte [rbp - 0x40], r13b
lea rdx, [rbp - 0x10]
mov qword [rbp - 0x28], 0xf
mov rcx, r12
call fcn.180012534
lea rdx, [rbp - 0x40]
mov rcx, qword [rax]
add rcx, 0x30
call fcn.180013834
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x180018b9a
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018b95
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018d97
call fcn.18006fd1c
lea r8, [rsp + 0x60]
mov rcx, r12
lea rdx, [rbp - 0x60]
call fcn.180012534
mov rcx, qword [rax]
lea rax, [rsp + 0x40]
add rcx, 0x30
cmp rcx, rax
je 0x180018c08
cmp qword [rsp + 0x58], 0x10
lea r9, [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
cmovae r9, qword [rsp + 0x40]
cmp rsi, qword [rcx + 0x18]
ja 0x180018bfd
cmp qword [rcx + 0x18], 0x10
mov r14, rcx
jb 0x180018be5
mov r14, qword [rcx]
mov qword [rcx + 0x10], rsi
mov r8, rsi
mov rcx, r14
mov rdx, r9
call fcn.180070ff0
mov byte [r14 + rsi], r13b
jmp 0x180018c08
mov r8b, r13b
mov rdx, rsi
call fcn.180012190
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180018c45
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018c40
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018d9d
call fcn.18006fd1c
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r13b
cmp rdx, 0x10
jb 0x180018792
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018c94
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018d9d
call fcn.18006fd1c
jmp 0x180018792
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x180018cd9
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018cd4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018d85
call fcn.18006fd1c
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], r13b
lea rcx, [rbp + 0x1b0]
call fcn.1800136d8
lea rax, vtable.std::ios_base.0
lea rcx, [rbp + 0x1b0]
mov qword [rbp + 0x1b0], rax
call fcn.18006f7a4
mov al, bl
jmp 0x180018d68
movdqa xmm0, xmmword [0x18009e7d0]
xor eax, eax
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x46], al
mov edx, r13d
mov dword [rbp - 0x50], 0x27333520
mov dword [rbp - 0x4c], 0x36267535
mov word [rbp - 0x48], 0x312c
movsxd rcx, edx
lea eax, [rdx + 0x40]
add edx, ebx
xor byte [rbp + rcx - 0x60], al
cmp edx, 0x1a
jb 0x180018d3c
mov r9d, 0x10
mov byte [rbp - 0x46], r13b
xor r8d, r8d
lea rdx, [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180076874
int3
call fcn.18001e708
int3
call fcn.180076874
int3
call fcn.180076874
int3
call fcn.180076874
int3
call fcn.18001e71c
int3