Function at 0x180002f70
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x180030040]
xor rax, rsp
mov qword [rbp + 0x68], rax
mov rsi, r8
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x180002fbc
mov rdx, qword [r8]
lea rcx, str._detect_report___s_n
call fcn.180001be0
movdqa xmm0, xmmword [0x18002bab0]
movdqu xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x70], 0x666a7663
mov dword [rbp - 0x6c], 0x7a626e
xor edi, edi
mov edx, edi
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x80]
add rcx, rax
lea eax, [rdx - 0xe]
xor byte [rcx], al
inc edx
cmp edx, 0x17
jb 0x180002ff0
mov byte [rbp - 0x69], dil
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x180003577
mov dword [rsp + 0x50], 0x94909480
mov dword [rsp + 0x54], 0xd6c28d8f
mov dword [rsp + 0x58], 0x8e998fd5
mov word [rsp + 0x5c], 0xd08a
xor eax, eax
mov byte [rsp + 0x5e], al
mov edx, edi
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x50]
add rcx, rax
lea eax, [rdx - 0xe]
xor byte [rcx], al
inc edx
cmp edx, 0xe
jb 0x180003070
mov byte [rsp + 0x5e], dil
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x38]
call fcn.180005f00
mov dword [rsp + 0x40], 0x89d3d0
mov edx, edi
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx - 0xe]
xor byte [rcx], al
inc edx
cmp edx, 3
jb 0x1800030b0
mov byte [rsp + 0x43], dil
mov dword [rsp + 0x50], 0x9cd6d3de
mov dword [rsp + 0x54], 0xdb979198
mov word [rsp + 0x58], 0xd9c0
xor eax, eax
mov byte [rsp + 0x5a], al
mov edx, edi
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x50]
add rcx, rax
lea eax, [rdx - 0xe]
xor byte [rcx], al
inc edx
cmp edx, 0xa
jb 0x1800030f0
mov byte [rsp + 0x5a], dil
mov edx, 0xe74
lea rcx, [rbp + 0x28]
call fcn.1800061f0
movdqa xmm0, xmmword [0x18002ba70]
movdqu xmmword [rbp - 0x48], xmm0
mov edx, edi
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp - 0x48]
add rcx, rax
lea eax, [rdx - 0xe]
xor byte [rcx], al
inc edx
cmp edx, 0xf
jb 0x180003130
mov byte [rbp - 0x39], dil
lea r8, [rbp + 0x28]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 8]
call fcn.180006520
lea rcx, [rsp + 0x50]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rcx + r8], dil
jne 0x180003170
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.180006160
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], dil
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.180005e30
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], dil
lea rax, [rsp + 0x40]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], dil
jne 0x180003200
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.180006160
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x48], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x58], xmm6
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], dil
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x180003270
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000326b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003605
call fcn.180009a2c
movdqa xmm0, xmmword [0x18002ba30]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], dil
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1800032be
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800032b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003605
call fcn.180009a2c
movdqa xmm0, xmmword [0x18002ba30]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], dil
mov rdx, qword [rbp + 0x20]
cmp rdx, 0xf
jbe 0x18000330c
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003307
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003605
call fcn.180009a2c
movdqa xmm0, xmmword [0x18002ba30]
movdqu xmmword [rbp + 0x18], xmm0
mov byte [rbp + 8], dil
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x180003358
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003353
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003605
call fcn.180009a2c
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
lea r12, [rbp + 0x48]
movq r15, xmm7
movdqa xmm0, xmm6
psrldq xmm0, 8
movq r13, xmm0
cmp r13, 0xf
cmova r12, r15
movabs rdi, 0x7fffffffffffffff
movq r14, xmm6
cmp r14, rdi
ja 0x18000360b
cmp r14, 0xf
ja 0x1800033ba
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 0xf
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x60], xmm0
jmp 0x18000344d
mov rax, r14
or rax, 0xf
cmp rax, rdi
jbe 0x1800033f6
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180009680
mov rcx, rax
test rax, rax
je 0x1800035f3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18000342f
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x180003421
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800035f9
jmp 0x1800033d4
test rcx, rcx
je 0x18000342d
call fcn.180009680
jmp 0x18000342f
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rdi
lea r8, [r14 + 1]
mov rdx, r12
mov rcx, rax
call fcn.1800204a0
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x18]
call fcn.180001e50
lea rdx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 8]
lea rcx, [rbp - 0x38]
call fcn.180006160
lea rax, [rbp - 0x38]
mov rcx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x20]
cmp r8, 0xf
cmova rax, rcx
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180003490
lea rdx, [rbp - 0x38]
cmp r8, 0xf
cmova rdx, rcx
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x44]
mov r8d, ebx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x180003505
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003500
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800035f3
call fcn.180009a2c
cmp r13, 0xf
jbe 0x18000353c
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x180003534
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800035f3
mov rcx, r15
call fcn.180009a2c
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x180003577
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003572
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800035f3
call fcn.180009a2c
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x1800035ad
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x1800035a8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800035ff
mov rcx, r8
call fcn.180009a2c
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rcx, qword [rbp + 0x68]
xor rcx, rsp
call fcn.180009660
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180010798
int3
call fcn.180001d90
int3
call fcn.180010798
int3
call fcn.180010798
int3
call fcn.180001e30
int3