Function at 0x1400170a0
Capabilities:
Encode data using xor
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
sub rsp, 0x60
mov rax, qword [section..data]
lea rbp, [0x140035010]
mov qword [0x140035148], r8
xor ebx, ebx
mov dword [0x140035020], ebx
mov dword [rsp + 0x80], 0xd43
mov dword [rsp + 0x44], 0xe30
mov dword [rsp + 0x40], ebx
lea esi, [rbx + 1]
mov dword [0x140035014], esi
lea edx, [rbx + 7]
mov dword [rax + 0x18], ebx
lea ecx, [rbx + 0xa]
mov rax, qword [section..data]
mov qword [0x140035040], rbx
mov dword [rsp + 0x4c], 0xbcd
mov dword [rsp + 0x48], ebx
mov dword [rax + 0x38], ecx
mov rax, qword [section..data]
mov dword [rsp + 0x50], ebx
mov dword [rax + 0x3c], edx
mov rax, qword [section..data]
mov dword [rax + 0x44], 0x3c
mov rax, qword [section..data]
mov dword [0x140035060], 3
mov dword [rax + 0x58], esi
mov rax, qword [section..data]
mov dword [0x140035080], 0xc
mov dword [0x140035084], 0x28
mov dword [rax + 0x80], ecx
mov rcx, rbp
mov rax, qword [section..data]
mov dword [0x1400350a0], 6
mov dword [rax + 0x98], esi
mov rax, qword [section..data]
mov dword [rax + 0xa0], ebx
mov rax, qword [section..data]
mov dword [rax + 0xa8], esi
mov rax, qword [section..data]
mov dword [0x1400350c8], ebx
mov dword [rax + 0xbc], edx
mov rax, qword [section..data]
mov dword [0x1400350d0], 0x58
mov dword [rax + 0xd4], 0x10
mov rax, qword [section..data]
mov dword [0x1400350e8], ebx
mov dword [0x1400350fc], ebx
mov dword [rax + 0x100], ebx
mov rax, qword [section..data]
mov dword [rax + 0x108], esi
mov qword [0x14003513c], rdx
mov dword [0x140035128], esi
add dword [rsp + 0x80], 0xfffffdfa
add dword [rsp + 0x44], 0xfffff6c2
mov edx, dword [rsp + 0x80]
mov r8d, dword [rsp + 0x44]
sub edx, 0x79c
mov r9d, dword [rsp + 0x4c]
mov eax, dword [rsp + 0x44]
xor r9d, 0x1b7
xor eax, 0x9b1
mov dword [rsp + 0x20], eax
call fcn.140001ef4
mov dword [rsp + 0x48], eax
mov ecx, dword [rsp + 0x80]
mov edx, dword [rsp + 0x40]
sub ecx, 0xc3
mov r8d, dword [rsp + 0x80]
add edx, 0xe50
mov r10d, dword [rsp + 0x80]
sub r8d, 0x22a
mov eax, dword [rsp + 0x50]
add r10d, 0x395
mov r9, qword [section..data]
xor eax, 0xd1d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r10d
call fcn.1400020f0
mov dword [rsp + 0x48], eax
mov edx, dword [rsp + 0x4c]
mov r8d, dword [rsp + 0x80]
mov r9d, dword [rsp + 0x48]
add r8d, 0x1ec
mov eax, dword [rsp + 0x40]
mov rcx, rbp
add eax, 0xb3d
mov dword [rsp + 0x20], eax
call fcn.140002434
mov dword [rsp + 0x50], eax
mov edx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x50]
add edx, 0x7ec
mov r9d, dword [rsp + 0x48]
xor r8d, 0x7af
mov ecx, dword [rsp + 0x44]
mov eax, dword [rsp + 0x40]
xor eax, 0xe30
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, rbp
call fcn.140018438
mov dword [rsp + 0x50], eax
mov ecx, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x80]
add ecx, 0xcde
mov r9d, dword [rsp + 0x48]
add r8d, 0x1e0
mov r10d, dword [rsp + 0x4c]
sub r9d, 0x151
mov eax, dword [rsp + 0x4c]
sub r10d, 0x82c
mov rdx, qword [section..data]
add eax, 0x111
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r10d
call fcn.14001a300
mov dword [rsp + 0x80], eax
mov rdx, qword [section..data]
mov eax, dword [0x140035140]
dec eax
mov ecx, dword [rdx + 0x58]
add ecx, eax
add dword [rdx + 0xb8], ecx
mov eax, dword [0x1400350a8]
xor eax, dword [0x1400350b8]
mov rcx, qword [section..data]
xor eax, 0x6bc79
or dword [rcx + 0x12c], eax
mov rcx, qword [section..data]
mov rax, qword [rcx + 0x78]
mov r9d, dword [rax + rbx]
add rbx, 4
mov eax, dword [rcx + 0xd8]
add eax, dword [0x140035110]
sub dword [0x1400350b8], eax
movsxd rcx, dword [0x140035064]
imul r9d, dword [0x14003505c]
mov rax, qword [0x1400350c0]
mov edx, r9d
shr edx, 0x18
mov byte [rcx + rax], dl
mov edx, r9d
mov eax, dword [0x140035064]
add eax, esi
shr edx, 0x10
mov dword [0x140035064], eax
movsxd rcx, eax
mov rax, qword [0x1400350c0]
mov byte [rcx + rax], dl
add dword [0x140035064], esi
mov eax, dword [0x140035140]
mov r8, qword [section..data]
mov ecx, dword [r8 + 0x10]
lea edx, [rcx + rax*2]
mov eax, dword [0x140035060]
xor edx, dword [0x140035020]
xor eax, 3
add dword [0x1400350d0], eax
mov dword [0x140035140], edx
add dword [r8 + 0xc0], edx
mov r8d, r9d
mov rax, qword [section..data]
movsxd rdx, dword [0x140035064]
shr r8d, 8
mov rcx, qword [rax + 0xb0]
mov byte [rdx + rcx], r8b
add dword [0x140035064], esi
mov eax, dword [0x14003513c]
mov rcx, qword [section..data]
add eax, 0xfff748f7
add dword [rcx + 0xa8], eax
mov rax, qword [section..data]
movsxd rdx, dword [0x140035064]
mov rcx, qword [rax + 0xb0]
mov byte [rdx + rcx], r9b
mov eax, dword [0x140035080]
mov ecx, dword [0x140035068]
dec eax
add dword [0x140035064], esi
add ecx, eax
mov dword [0x140035080], ecx
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x30]
sub eax, dword [0x1400350fc]
xor eax, 0x143a3b
sub dword [rcx + 0xd8], eax
cmp rbx, 0xa74
jl 0x140017359
mov ecx, dword [rsp + 0x40]
mov eax, dword [rsp + 0x4c]
add ecx, 0xd84
cmp eax, ecx
je 0x140017672
mov ecx, dword [rsp + 0x44]
mov eax, dword [rsp + 0x48]
add ecx, 0x892
cmp eax, ecx
jge 0x140017596
add dword [rsp + 0x40], 0xcde
mov ecx, dword [rsp + 0x80]
mov edx, dword [rsp + 0x48]
sub ecx, 0x111
mov r8d, dword [rsp + 0x50]
add edx, 0x837
mov r9d, dword [rsp + 0x48]
add r8d, 0x6c
mov r10d, dword [rsp + 0x40]
xor r9d, 0xe88
mov eax, dword [rsp + 0x44]
xor r10d, 0x15a
add eax, 0x7ec
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r10d
call fcn.140016404
cmp dword [0x140035084], 0x103a8
mov dword [rsp + 0x50], eax
jbe 0x140017672
mov rcx, qword [section..data]
mov rdx, qword [0x140035148]
mov rcx, qword [rcx + 0x110]
call qword [0x140035070]
mov rcx, qword [section..data]
mov dword [rcx + 0x104], eax
jmp 0x140017672
mov eax, dword [rsp + 0x50]
mov rcx, qword [section..data]
mov edx, dword [rcx + 0x88]
mov ecx, dword [rsp + 0x44]
sub edx, eax
mov rax, qword [section..data]
add ecx, edx
cmp dword [rax + 0x10], ecx
jne 0x140017672
mov ecx, dword [0x140035094]
and ecx, dword [0x140035020]
mov eax, dword [rsp + 0x80]
cmp eax, ecx
jbe 0x140017672
imul eax, dword [0x140035060], 0x3a1
or eax, dword [0x140035020]
sub dword [0x14003504c], eax
mov eax, dword [rsp + 0x4c]
xor eax, dword [0x140035068]
sub dword [0x140035040], eax
mov eax, dword [rsp + 0x4c]
mov r8d, dword [rsp + 0x40]
mov rcx, qword [section..data]
sub r8d, 0xd1d
mov rdx, qword [0x1400350d0]
and edx, 0x331
or rdx, 0x80e
imul eax, dword [rcx + 0xd8]
mov ecx, eax
mov rax, qword [section..data]
mov r9d, dword [rax + 0x38]
mov eax, dword [0x1400350ac]
or r9, rax
movsxd rax, dword [rsp + 0x4c]
movsxd r11, dword [rsp + 0x80]
xor r9, 0xe2e
movsxd r10, dword [rsp + 0x40]
xor r11, rax
or r10, r11
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [0x140035114]
call qword [sym.imp.KERNEL32.dll_ExitProcess]