Function at 0x18013c6c0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rdx, qword [r8 + 0x20]
mov r12, r9
mov r13, r8
mov r15, rcx
call fcn.18013d150
mov r14, rax
xor ecx, ecx
movabs rax, 0x5f99b71ee9676212
movabs r9, 0x587f9cbbfb40fa25
test r14, r14
jne 0x18013c8ae
movdqa xmm0, xmmword [0x180160a40]
movabs r8, 0xbf0eb0fd095c248e
movdqa xmm1, xmmword [0x180161810]
mov edx, ecx
movdqu xmmword [rbp - 0x10], xmm0
mov rcx, rax
mov dword [rbp + 0x30], 0x3bcdad40
movdqa xmm0, xmmword [0x180162110]
movdqu xmmword [rbp], xmm1
mov dword [rbp + 0x34], 0x1dc903
movdqa xmm1, xmmword [0x180161a00]
movdqu xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x38], r9
movdqu xmmword [rbp + 0x20], xmm1
mov qword [rbp + 0x40], r8
mov qword [rbp + 0x48], rax
nop word [rax + rax]
imul rax, rcx
add r8, r9
add rax, r8
mov rcx, rax
shl rax, 0x20
shr rcx, 0x20
or rcx, rax
movzx eax, cl
xor al, byte [rbp + rdx - 0x10]
mov byte [rsp + rdx + 0x30], al
inc rdx
mov rax, rcx
cmp rdx, 0x47
jb 0x18013c780
movups xmm0, xmmword [rsp + 0x30]
mov byte [rsp + 0x77], 0
lea r8, [rbp - 0x58]
movups xmm1, xmmword [rsp + 0x40]
mov edx, 0x100000
lea rcx, [0x18017bd90]
movups xmmword [rbp - 0x58], xmm0
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp - 0x48], xmm1
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rbp - 0x38], xmm0
movsd xmm0, qword [rsp + 0x70]
movsd qword [rbp - 0x18], xmm0
movups xmmword [rbp - 0x28], xmm1
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rsi, qword [r13 + 0x18]
mov rdx, 0xffffffffffffffff
mov rdi, rdx
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x18013c833
lea ebx, [rdi - 1]
test ebx, ebx
js 0x18013c89a
movsxd rax, ebx
lea rcx, [rsi + rax*2]
nop dword [rax + rax]
movzx eax, word [rcx]
cmp ax, 0x5c
je 0x18013c85f
cmp ax, 0x2f
jne 0x18013c866
cmp edx, 0xffffffff
jne 0x18013c871
mov edx, ebx
sub rcx, 2
sub ebx, 1
jns 0x18013c850
jmp 0x18013c89a
cmp ebx, 0xffffffff
je 0x18013c89a
sub edi, edx
movsxd rax, edx
movsxd rcx, ebx
movsxd r8, edi
lea rdx, [rsi + rax*2]
lea rcx, [rsi + rcx*2]
call fcn.1801159dc
lea eax, [rdi + rbx]
movsxd rcx, eax
xor eax, eax
mov word [rsi + rcx*2], ax
movabs r9, 0x587f9cbbfb40fa25
movabs rax, 0x5f99b71ee9676212
movdqa xmm0, xmmword [0x180160c40]
lea rdx, [rsp + 0x30]
movdqa xmm1, xmmword [0x1801616f0]
movabs rcx, 0xbf0eb0fd095c248e
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x78]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0x1a040a2a
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x54], 0x575731a0
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x68], rax
call fcn.180010980
lea r8, [rbp - 0x58]
mov edx, 0x100000
lea rcx, [0x18017bd90]
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x58], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm0
movsd xmm1, qword [rax + 0x20]
movsd qword [rbp - 0x38], xmm1
movzx eax, byte [rax + 0x28]
mov byte [rbp - 0x30], al
call fcn.1800010e0
xor ecx, ecx
mov dword [0x18017bd84], eax
mov qword [rsp + 0x20], rcx
lea r9, [0x18017bd80]
mov rcx, qword [0x18017bd78]
lea rdx, [0x18017bd90]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rsi, qword [rbp + 0xa0]
mov r9, r12
mov r8, r13
mov qword [rsp + 0x28], r14
mov rcx, r15
mov qword [rsp + 0x20], rsi
call fcn.18013e010
movabs rdx, 0x53a4a43623c65917
movabs rdi, 0x6adadc270a64e80c
movabs rbx, 0xd7a5ce30cb35674b
test eax, eax
jne 0x18013ca5f
movdqa xmm0, xmmword [0x1801612c0]
lea rcx, [rsp + 0x78]
movdqa xmm1, xmmword [0x180160d70]
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x60], rdx
lea rdx, [rsp + 0x30]
movdqa xmm0, xmmword [0x1801604c0]
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x68], rdi
movdqu xmmword [rsp + 0x40], xmm1
mov qword [rsp + 0x70], rbx
call fcn.18000eec0
lea r8, [rbp - 0x58]
mov edx, 0x100000
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x58], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm0
movsd xmm1, qword [rax + 0x20]
movsd qword [rbp - 0x38], xmm1
mov ecx, dword [rax + 0x28]
mov dword [rbp - 0x30], ecx
lea rcx, [0x18017bd90]
movzx eax, byte [rax + 0x2c]
mov byte [rbp - 0x2c], al
call fcn.1800010e0
xor ecx, ecx
mov dword [0x18017bd84], eax
mov qword [rsp + 0x20], rcx
lea r9, [0x18017bd80]
mov rcx, qword [0x18017bd78]
lea rdx, [0x18017bd90]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs rdx, 0x53a4a43623c65917
movdqa xmm0, xmmword [0x180160a00]
xor eax, eax
movdqa xmm1, xmmword [0x180161640]
mov ecx, eax
mov word [rsp + 0x55], ax
mov byte [rsp + 0x57], al
mov rax, rbx
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0xe758207c
movdqu xmmword [rsp + 0x40], xmm1
mov byte [rsp + 0x54], 0x3b
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rbx
nop word [rax + rax]
imul rax, rbx
add rdi, rdx
add rax, rdi
mov rbx, rax
shl rax, 0x20
shr rbx, 0x20
or rbx, rax
movzx eax, bl
xor al, byte [rsp + rcx + 0x30]
mov byte [rsp + rcx + 0x78], al
inc rcx
mov rax, rbx
cmp rcx, 0x25
jb 0x18013cab0
mov eax, dword [rbp - 0x68]
lea r8, [rbp - 0x58]
movups xmm0, xmmword [rsp + 0x78]
mov dword [rbp - 0x38], eax
mov edx, 0x100000
movups xmm1, xmmword [rbp - 0x78]
mov byte [rbp - 0x63], 0
lea rcx, [0x18017bd90]
movzx eax, word [rbp - 0x64]
movups xmmword [rbp - 0x58], xmm0
mov word [rbp - 0x34], ax
movups xmmword [rbp - 0x48], xmm1
call fcn.1800010e0
xor ecx, ecx
mov dword [0x18017bd84], eax
mov qword [rsp + 0x20], rcx
lea r9, [0x18017bd80]
mov rcx, qword [0x18017bd78]
lea rdx, [0x18017bd90]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9, r12
mov qword [rsp + 0x28], r14
mov r8, r13
mov qword [rsp + 0x20], rsi
mov rcx, r15
call fcn.18013ec80
movabs rdi, 0x3166d599c42f3118
movabs rbx, 0xf1084821f64594e9
movabs r9, 0xf5d06b73146ce1d
test eax, eax
jne 0x18013cc71
movdqa xmm0, xmmword [0x180160ed0]
xor eax, eax
movdqa xmm1, xmmword [0x180161580]
mov edx, eax
movdqu xmmword [rsp + 0x30], xmm0
mov rcx, rbx
mov qword [rsp + 0x60], r9
movdqa xmm0, xmmword [str._zYH]
mov rax, rbx
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x68], rdi
mov r8, rdi
movdqu xmmword [rsp + 0x40], xmm1
mov qword [rsp + 0x70], rbx
nop word [rax + rax]
imul rax, rcx
add r8, r9
add rax, r8
mov rcx, rax
shl rax, 0x20
shr rcx, 0x20
or rcx, rax
movzx eax, cl
xor al, byte [rsp + rdx + 0x30]
mov byte [rbp + rdx - 0x58], al
inc rdx
mov rax, rcx
cmp rdx, 0x29
jb 0x18013cbd0
movups xmm0, xmmword [rbp - 0x58]
mov byte [rbp - 0x2f], 0
lea r8, [rsp + 0x78]
movups xmm1, xmmword [rbp - 0x48]
movzx eax, word [rbp - 0x30]
lea rcx, [0x18017bd90]
movups xmmword [rsp + 0x78], xmm0
mov edx, 0x100000
mov word [rbp - 0x60], ax
movsd xmm0, qword [rbp - 0x38]
movsd qword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x78], xmm1
call fcn.1800010e0
xor ecx, ecx
mov dword [0x18017bd84], eax
mov qword [rsp + 0x20], rcx
lea r9, [0x18017bd80]
mov rcx, qword [0x18017bd78]
lea rdx, [0x18017bd90]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs r9, 0xf5d06b73146ce1d
movdqa xmm0, xmmword [0x180160e30]
xor eax, eax
movdqa xmm1, xmmword [0x180160e00]
mov ecx, eax
mov word [rsp + 0x55], ax
mov byte [rsp + 0x57], al
mov rax, rbx
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0x2e3a3529
movdqu xmmword [rsp + 0x40], xmm1
mov byte [rsp + 0x54], 0x8f
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rbx
nop dword [rax]
imul rax, rbx
add rdi, r9
add rax, rdi
mov rbx, rax
shl rax, 0x20
shr rbx, 0x20
or rbx, rax
movzx eax, bl
xor al, byte [rsp + rcx + 0x30]
mov byte [rsp + rcx + 0x78], al
inc rcx
mov rax, rbx
cmp rcx, 0x25
jb 0x18013ccc0
mov eax, dword [rbp - 0x68]
lea r8, [rbp - 0x58]
movups xmm0, xmmword [rsp + 0x78]
mov dword [rbp - 0x38], eax
mov edx, 0x100000
movups xmm1, xmmword [rbp - 0x78]
mov byte [rbp - 0x63], 0
lea rcx, [0x18017bd90]
movzx eax, word [rbp - 0x64]
movups xmmword [rbp - 0x58], xmm0
mov word [rbp - 0x34], ax
movups xmmword [rbp - 0x48], xmm1
call fcn.1800010e0
xor ecx, ecx
mov dword [0x18017bd84], eax
mov qword [rsp + 0x20], rcx
lea r9, [0x18017bd80]
mov rcx, qword [0x18017bd78]
lea rdx, [0x18017bd90]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9, r12
mov r8, r13
mov rcx, r15
call fcn.180140d60
movabs rdi, 0x989f58b5d4fa3bbc
movabs rbx, 0x6dc8d4bcf0e3954a
movabs r9, 0xfb15fb380cc1731b
test eax, eax
jne 0x18013ce71
movdqa xmm0, xmmword [0x180161000]
xor eax, eax
movdqa xmm1, xmmword [0x180161330]
mov edx, eax
movdqu xmmword [rsp + 0x30], xmm0
mov rcx, rbx
mov qword [rsp + 0x60], r9
movdqa xmm0, xmmword [0x1801602e0]
mov rax, rbx
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x68], rdi
mov r8, rdi
movdqu xmmword [rsp + 0x40], xmm1
mov qword [rsp + 0x70], rbx
nop dword [rax]
imul rax, rcx
add r8, r9
add rax, r8
mov rcx, rax
shl rax, 0x20
shr rcx, 0x20
or rcx, rax
movzx eax, cl
xor al, byte [rsp + rdx + 0x30]
mov byte [rbp + rdx - 0x58], al
inc rdx
mov rax, rcx
cmp rdx, 0x29
jb 0x18013cdd0
movups xmm0, xmmword [rbp - 0x58]
mov byte [rbp - 0x2f], 0
lea r8, [rsp + 0x78]
movups xmm1, xmmword [rbp - 0x48]
movzx eax, word [rbp - 0x30]
lea rcx, [0x18017bd90]
movups xmmword [rsp + 0x78], xmm0
mov edx, 0x100000
mov word [rbp - 0x60], ax
movsd xmm0, qword [rbp - 0x38]
movsd qword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x78], xmm1
call fcn.1800010e0
xor ecx, ecx
mov dword [0x18017bd84], eax
mov qword [rsp + 0x20], rcx
lea r9, [0x18017bd80]
mov rcx, qword [0x18017bd78]
lea rdx, [0x18017bd90]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs r9, 0xfb15fb380cc1731b
movdqa xmm0, xmmword [0x180161010]
xor eax, eax
movdqa xmm1, xmmword [0x180160c90]
mov ecx, eax
mov word [rsp + 0x55], ax
mov byte [rsp + 0x57], al
mov rax, rbx
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0x3761cf79
movdqu xmmword [rsp + 0x40], xmm1
mov byte [rsp + 0x54], 0x7f
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rbx
nop dword [rax]
imul rax, rbx
add rdi, r9
add rax, rdi
mov rbx, rax
shl rax, 0x20
shr rbx, 0x20
or rbx, rax
movzx eax, bl
xor al, byte [rsp + rcx + 0x30]
mov byte [rsp + rcx + 0x78], al
inc rcx
mov rax, rbx
cmp rcx, 0x25
jb 0x18013cec0
mov eax, dword [rbp - 0x68]
lea r8, [rbp - 0x58]
movups xmm0, xmmword [rsp + 0x78]
mov dword [rbp - 0x38], eax
mov edx, 0x100000
movups xmm1, xmmword [rbp - 0x78]
mov byte [rbp - 0x63], 0
lea rcx, [0x18017bd90]
movzx eax, word [rbp - 0x64]
movups xmmword [rbp - 0x58], xmm0
mov word [rbp - 0x34], ax
movups xmmword [rbp - 0x48], xmm1
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
xor ebx, ebx
mov dword [0x18017bd84], eax
mov r8d, eax
mov qword [rsp + 0x20], rbx
lea rdx, [0x18017bd90]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8, qword [rbp + 0x88]
mov r9, r13
mov qword [rsp + 0x28], r14
mov rdx, rsi
mov rcx, r15
mov qword [rsp + 0x20], r12
mov r8, qword [r8 + 8]
call fcn.18013d330
test eax, eax
jne 0x18013d043
movdqa xmm0, xmmword [0x180161520]
lea rdx, [rsp + 0x30]
movdqa xmm1, xmmword [0x1801625b0]
lea rcx, [rsp + 0x78]
movabs rax, 0xa8ce5db91a41f821
mov dword [rsp + 0x50], 0x9e314229
mov qword [rsp + 0x58], rax
movabs rax, 0x99bd04a33aa037c8
mov qword [rsp + 0x60], rax
movabs rax, 0x4e0effb15aa2da28
mov qword [rsp + 0x68], rax
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x54], 0xe5f788b1
movdqu xmmword [rsp + 0x40], xmm1
call fcn.180010980
lea r8, [rbp - 0x58]
mov edx, 0x100000
lea rcx, [0x18017bd90]
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x58], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm0
movsd xmm1, qword [rax + 0x20]
movsd qword [rbp - 0x38], xmm1
movzx eax, byte [rax + 0x28]
mov byte [rbp - 0x30], al
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14, r14
je 0x18013d052
mov rcx, r14
call qword [r15 + 0x168]
lea r11, [rsp + 0x150]
mov eax, 1
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret