Function at 0x14008d490
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rdx
mov rsi, rcx
mov eax, dword [0x141f3bcb0]
or eax, dword [0x141f3bcb4]
add eax, 0x161b5a6b
or eax, 0x147a9a99
mov ecx, 0xba9d85ad
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0xa42ffd0f
ja 0x14008d50a
mov eax, dword [0x141f3bcb8]
and eax, dword [0x141f3bcbc]
add eax, 0xa0aaeb4
or eax, 0xb3b49609
xor eax, 0xae62016c
mov r14d, 0xffffffff
cmp r8, r14
cmovb r14, r8
movups xmm0, xmmword [0x141f258e8]
movaps xmmword [rsp + 0x60], xmm0
cmp eax, 0xdb34e292
jbe 0x14008d518
movups xmm0, xmmword [0x141f258e8]
movaps xmmword [rsp + 0x60], xmm0
jmp 0x14008d4cf
mov eax, dword [0x141f3bcc0]
and eax, dword [0x141f3bcc4]
or eax, 0xbfc641c2
add eax, 0x40f0468f
xor eax, 0xcaa12f1c
cmp eax, 0x38edea8
jb 0x14008d56f
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r15d, r15d
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
test r15b, r15b
je 0x14008d59e
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
jmp 0x14008d53a
mov ebx, eax
cmp eax, 0x103
jne 0x14008d64b
mov eax, dword [0x141f3bcc8]
sub eax, dword [0x141f3bccc]
add eax, 0x4687b097
or eax, 0x4759cff2
cmp eax, 0x24b1ef98
je 0x14008d5dc
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
test al, al
je 0x14008d5f0
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x14008d5c8
mov eax, dword [0x141f3bcd0]
sub eax, dword [0x141f3bcd4]
imul eax, eax, 0x8f21b0d5
add eax, 0x8f3b9298
and eax, 0xf9130694
cmp eax, 0x166a077a
jb 0x14008d5f0
mov ebx, dword [rsp + 0x60]
nop word [rax + rax]
mov eax, dword [0x141f3bcd8]
xor eax, dword [0x141f3bcdc]
imul rax, rax, 0x10729141
shr rax, 0x3b
or eax, 0x16052f01
cmp eax, 0xcc041343
ja 0x14008d620
cmp ebx, 0x103
je 0x14008d6b0
xor eax, eax
nop dword [rax]
test al, al
jne 0x14008d650
test ebx, ebx
js 0x14008d687
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
mov eax, dword [0x141f3bd00]
or eax, dword [0x141f3bd04]
xor eax, 0x1b118b24
and eax, 0x1fb58b3c
xor eax, 0x735f87d8
cmp eax, 0x304a34c1
jb 0x14008d660
jmp 0x14008d7f0
mov eax, dword [0x141f3bcf0]
xor edx, edx
div dword [0x141f3bcf4]
imul eax, eax, 0xc214601c
add eax, 0x975789c8
cmp eax, 0xe49e0218
jbe 0x14008d78d
jmp 0x14008d7bf
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x141f25948]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
mov eax, dword [0x141f3bce0]
add eax, dword [0x141f3bce4]
mov qword [rsp + 0x90], 0
imul eax, eax, 0xe0c5bd25
and eax, 0x88210200
cmp eax, 0x91d4d607
ja 0x14008d74f
mov eax, dword [0x141f3bce8]
xor edx, edx
div dword [0x141f3bcec]
imul esi, eax, 0xacba09bc
lea rax, [rsp + 0x50]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x70]
call fcn.14008e020
mov rcx, rax
call fcn.14008e440
mov ecx, 7
int 0x29
cmp esi, 0x69f97927
jne 0x14008d78b
lea rax, [rsp + 0x50]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x70]
call fcn.14008e020
mov rcx, rax
call fcn.14008e440
mov ecx, 7
int 0x29
jmp 0x14008d6fc
ud2
mov eax, dword [0x141f3bcf8]
add eax, dword [0x141f3bcfc]
imul eax, eax, 0x7e1dd1bb
add eax, 0xb61a5cc7
imul rsi, rax, 0x1b174789
shr rsi, 0x3c
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp esi, 0x6588d240
jbe 0x14008d7c9
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
jmp 0x14008d78d
movsxd rcx, eax
shl rcx, 0x20
or rcx, 2
mov al, 1
nop word cs:[rax + rax]
test al, al
je 0x14008d7e0
mov r8d, 1
nop word [rax + rax]
mov eax, dword [0x141f3bd08]
xor edx, edx
div dword [0x141f3bd0c]
or eax, 0x5a9b7807
cmp eax, 0x6953deac
je 0x14008d7f0
mov rax, r8
mov rdx, rcx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret