Function at 0x1801412b0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x5e0]
sub rsp, 0x6e0
mov rbx, rcx
mov dword [rbp - 0x58], 0xe7d20140
movabs rdi, 0xa7ec59b91e41e411
mov dword [rbp - 0x54], 0x1e2b2b0a
movabs rsi, 0xf17459dab03b690a
mov qword [rbp + 0x18], rdi
movabs r14, 0xe81b951a5cb892cb
mov qword [rbp + 0x20], rsi
lea rcx, [rsp + 0x30]
mov qword [rbp + 0x28], r14
lea rdx, [rbp - 0x58]
mov dword [rbp - 0x50], 0x29646831
mov dword [rbp - 0x4c], 0xfd86ccb9
mov dword [rbp - 0x48], 0xdde029af
mov dword [rbp - 0x44], 0xa290d4d7
mov dword [rbp - 0x40], 0xa29db63
mov dword [rbp - 0x3c], 0x7b5ab41e
mov dword [rbp - 0x38], 0x5621907
mov dword [rbp - 0x34], 0xe7beb049
mov dword [rbp - 0x30], 0xd38bbe5d
mov dword [rbp - 0x2c], 0xb163ac44
mov dword [rbp - 0x28], 0xf3cdf823
mov dword [rbp - 0x24], 0xef98f73
mov dword [rbp - 0x20], 0x46e98221
mov dword [rbp - 0x1c], 0x1f645e5e
mov dword [rbp - 0x18], 0x18dd7b11
mov dword [rbp - 0x14], 0x2663a428
mov dword [rbp - 0x10], 0x55126089
mov dword [rbp - 0xc], 0x31bea639
mov dword [rbp - 8], 0xd22e7771
mov dword [rbp - 4], 0xe2378574
mov dword [rbp], 0x459e864b
mov dword [rbp + 4], 0x33be1387
mov dword [rbp + 8], 0xa811f6ae
mov dword [rbp + 0xc], 0xba1d6674
mov dword [rbp + 0x10], 0xa15edffc
mov dword [rbp + 0x14], 0xb62cda44
call fcn.18000e400
mov r8d, 0x104
lea rdx, [rbp + 0x3d0]
lea rcx, [rbp + 0x240]
movups xmm2, xmmword [rax]
movups xmmword [rbp + 0x240], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 0x250], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp + 0x260], xmm1
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rbp + 0x270], xmm0
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rbp + 0x280], xmm1
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rbp + 0x290], xmm0
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rbp + 0x2a0], xmm1
movzx eax, word [rax + 0x70]
mov word [rbp + 0x2b0], ax
mov rax, qword [rbx + 0x108]
call rax
test eax, eax
jne 0x18014151f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm0, xmmword [0x180161780]
lea rdx, [rsp + 0x30]
movdqa xmm1, xmmword [0x1801616a0]
lea rcx, [rbp + 0xc8]
movdqu xmmword [rsp + 0x30], xmm0
mov ebx, eax
mov qword [rsp + 0x70], rdi
movdqa xmm0, xmmword [0x180161960]
movdqu xmmword [rsp + 0x40], xmm1
mov qword [rsp + 0x78], rsi
movdqa xmm1, xmmword [0x1801604d0]
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rbp - 0x80], r14
movdqu xmmword [rsp + 0x60], xmm1
call fcn.180009100
mov r9d, ebx
lea r8, [rbp - 0x58]
mov edx, 0x100000
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x58], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 0x38], xmm1
movsd xmm0, qword [rax + 0x30]
movsd qword [rbp - 0x28], xmm0
mov ecx, dword [rax + 0x38]
mov dword [rbp - 0x20], ecx
lea rcx, [0x18017bd90]
movzx eax, byte [rax + 0x3c]
mov byte [rbp - 0x1c], al
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
xor ebx, ebx
mov dword [0x18017bd84], eax
mov r8d, eax
mov qword [rsp + 0x20], rbx
lea rdx, [0x18017bd90]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x180141afe
xor ebx, ebx
lea rcx, [rbp + 0x3d0]
mov qword [rbp + 0x608], rbx
call fcn.180146d30
lea rdx, [rbp + 0x600]
mov rcx, rax
call fcn.180024c40
test eax, eax
je 0x18014166c
mov rcx, qword [rbp + 0x600]
call fcn.1800254c0
movdqa xmm0, xmmword [0x180161400]
movabs rcx, 0x50ec4ddbeb1a236c
movdqa xmm1, xmmword [str.U6_]
movabs r10, 0x53a4a43623c65917
movdqu xmmword [rsp + 0x30], xmm0
movabs rdx, 0x168ea840b0d322fa
mov r9, rax
movdqa xmm0, xmmword [0x1801608b0]
mov r8d, ebx
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r10
mov rax, rcx
movdqu xmmword [rsp + 0x40], xmm1
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rcx
nop word [rax + rax]
imul rcx, rax
add rdx, r10
add rcx, rdx
mov rax, rcx
shr rcx, 0x20
shl rax, 0x20
or rcx, rax
movzx eax, cl
xor al, byte [rsp + r8 + 0x30]
mov byte [rbp + r8 + 0xc8], al
inc r8
mov rax, rcx
cmp r8, 0x2f
jb 0x1801415c0
movups xmm0, xmmword [rbp + 0xc8]
mov byte [rbp + 0xf7], bl
lea r8, [rbp - 0x58]
movups xmm1, xmmword [rbp + 0xd8]
mov edx, 0x100000
lea rcx, [0x18017bd90]
movups xmmword [rbp - 0x58], xmm0
movups xmm0, xmmword [rbp + 0xe8]
movups xmmword [rbp - 0x48], xmm1
movups xmmword [rbp - 0x38], xmm0
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 0x600]
call fcn.180022770
xor eax, eax
jmp 0x180141afe
movdqa xmm0, xmmword [0x180161370]
movabs rcx, 0x50ec4ddbeb1a236c
movdqa xmm1, xmmword [str.Xru]
movabs r10, 0x53a4a43623c65917
movdqu xmmword [rbp + 0x110], xmm0
movabs rdx, 0x168ea840b0d322fa
mov dword [rbp + 0x220], 0x54b9b498
movdqa xmm0, xmmword [0x180160e50]
mov r9, rbx
movdqu xmmword [rbp + 0x130], xmm0
mov rax, rcx
mov dword [rbp + 0x224], 0xd3c49be0
movdqa xmm0, xmmword [0x180161b70]
movdqu xmmword [rbp + 0x120], xmm1
mov qword [rbp + 0x228], r10
movdqa xmm1, xmmword [0x180161e90]
movdqu xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x230], rdx
movdqa xmm0, xmmword [0x180162350]
movdqu xmmword [rbp + 0x140], xmm1
mov qword [rbp + 0x238], rcx
movdqa xmm1, xmmword [0x180162550]
movdqu xmmword [rbp + 0x170], xmm0
movdqa xmm0, xmmword [0x180161920]
movdqu xmmword [rbp + 0x160], xmm1
movdqa xmm1, xmmword [0x180161820]
movdqu xmmword [rbp + 0x190], xmm0
movdqa xmm0, xmmword [0x180162030]
movdqu xmmword [rbp + 0x180], xmm1
movdqa xmm1, xmmword [0x1801615b0]
movdqu xmmword [rbp + 0x1b0], xmm0
movdqa xmm0, xmmword [0x180161e60]
movdqu xmmword [rbp + 0x1a0], xmm1
movdqa xmm1, xmmword [0x180161420]
movdqu xmmword [rbp + 0x1d0], xmm0
movdqa xmm0, xmmword [0x1801624d0]
movdqu xmmword [rbp + 0x1c0], xmm1
movdqa xmm1, xmmword [0x180161da0]
movdqu xmmword [rbp + 0x1f0], xmm0
movdqa xmm0, xmmword [0x180161850]
movdqu xmmword [rbp + 0x1e0], xmm1
movdqa xmm1, xmmword [0x180160fa0]
movdqu xmmword [rbp + 0x210], xmm0
movdqu xmmword [rbp + 0x200], xmm1
nop dword [rax]
imul rax, rcx
add rdx, r10
add rax, rdx
add rdx, r10
mov r8, rax
shl rax, 0x20
shr r8, 0x20
or r8, rax
movzx eax, r8b
xor al, byte [rbp + r9 + 0x110]
mov byte [rbp + r9 - 0x58], al
imul r8, r8
add r8, rdx
mov rcx, r8
shl r8, 0x20
shr rcx, 0x20
or rcx, r8
movzx eax, cl
xor al, byte [rbp + r9 + 0x111]
mov byte [rbp + r9 - 0x57], al
add r9, 2
mov rax, rcx
cmp r9, 0x118
jb 0x1801417d0
mov byte [rbp + 0xc0], bl
lea rcx, [rbp + 0x2b2]
lea rdx, [rbp - 0x58]
mov eax, 2
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x180141850
mov rax, qword [rdx + 0x10]
xor r9d, r9d
movups xmm0, xmmword [rdx]
xor r8d, r8d
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
movzx eax, byte [rdx + 0x18]
lea rdx, [rbp + 0x2b2]
mov byte [rcx + 0x18], al
lea rax, [rbp + 0x608]
mov rcx, qword [rbp + 0x600]
mov qword [rsp + 0x20], rax
call fcn.1800227c0
mov edi, eax
movabs r9, 0x7f02b73546d22d
movabs r8, 0xdfd8f3cdaa3be86a
movabs rcx, 0x266d7feed021e814
test eax, eax
je 0x180141a13
movdqa xmm0, xmmword [0x180161100]
mov rdx, rbx
movdqa xmm1, xmmword [0x180161cd0]
mov rax, rcx
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x70], r9
movdqa xmm0, xmmword [0x180160d10]
movdqu xmmword [rsp + 0x40], xmm1
mov qword [rsp + 0x78], r8
movdqa xmm1, xmmword [0x180160430]
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rbp - 0x80], rcx
movdqu xmmword [rsp + 0x60], xmm1
imul rax, rcx
add r8, r9
add rax, r8
mov rcx, rax
shl rax, 0x20
shr rcx, 0x20
or rcx, rax
movzx eax, cl
xor al, byte [rsp + rdx + 0x30]
mov byte [rbp + rdx - 0x58], al
inc rdx
mov rax, rcx
cmp rdx, 0x3b
jb 0x180141951
movups xmm0, xmmword [rbp - 0x58]
mov r9, qword [rbp + 0x608]
lea r8, [rbp + 0xc8]
movups xmm1, xmmword [rbp - 0x48]
mov byte [rbp - 0x1d], bl
mov edx, 0x100000
mov eax, dword [rbp - 0x20]
lea rcx, [0x18017bd90]
movups xmmword [rbp + 0xc8], xmm0
mov dword [rbp + 0x100], eax
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rbp + 0xd8], xmm1
movsd xmm1, qword [rbp - 0x28]
movups xmmword [rbp + 0xe8], xmm0
movsd qword [rbp + 0xf8], xmm1
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 0x608]
call fcn.180024560
jmp 0x180141aeb
movdqa xmm0, xmmword [0x180160d50]
lea rdx, [rsp + 0x30]
movdqa xmm1, xmmword [0x180162280]
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rbp - 0x78], rcx
lea rcx, [rbp + 0xc8]
movdqa xmm0, xmmword [0x180161530]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x70], 0x17ff6d2e
movdqa xmm1, xmmword [0x180161360]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x74], 0x6a32
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x78], r9
mov qword [rbp - 0x80], r8
call fcn.18000c770
lea r8, [rbp - 0x58]
mov edx, 0x100000
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x58], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 0x38], xmm1
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rbp - 0x28], xmm0
mov ecx, dword [rax + 0x40]
mov dword [rbp - 0x18], ecx
movzx ecx, word [rax + 0x44]
mov word [rbp - 0x14], cx
lea rcx, [0x18017bd90]
movzx eax, byte [rax + 0x46]
mov byte [rbp - 0x12], al
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 0x600]
call fcn.180022770
test edi, edi
sete bl
mov eax, ebx
lea r11, [rsp + 0x6e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret