Function at 0x140087410
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov rbp, rsp
mov r9, rdx
mov rsi, rcx
mov eax, dword [0x141dcea28]
xor edx, edx
div dword [0x141dcea2c]
imul eax, eax, 0xb873d5e0
add eax, 0x474be3d0
cmp eax, 0xd6cf25a6
jb 0x140087486
mov ecx, dword [0x141dcea30]
add ecx, dword [0x141dcea34]
and ecx, 0x88e3aefb
xor ecx, 0x4a89f108
add ecx, 0xfec66341
xor eax, eax
call fcn.1400ef3b0
sub rsp, rax
mov r15, rsp
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov rdi, rsp
cmp ecx, 0x1d31a095
jae 0x14008749f
xor eax, eax
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
jmp 0x140087443
mov eax, dword [0x141dcea38]
sub eax, dword [0x141dcea3c]
imul eax, eax, 0x9da197f2
cmp eax, 0x78a6981a
je 0x140087512
mov eax, dword [0x141dcea40]
xor edx, edx
div dword [0x141dcea44]
imul ecx, eax, 0x2396c007
xor ecx, 0xfd6c6c78
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov r14, rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov r12, rsp
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
movups xmm0, xmmword [0x141db9420]
movups xmmword [r12], xmm0
cmp ecx, 0xdc181dab
jae 0x14008753e
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov rax, rsp
movups xmm0, xmmword [0x141db9420]
movups xmmword [rax], xmm0
jmp 0x1400874b8
sub rsp, 0x50
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r12
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
add rsp, 0x50
mov ebx, eax
cmp eax, 0x103
jne 0x1400875b5
sub rsp, 0x20
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x20
mov ebx, dword [r12]
mov eax, dword [0x141dcea48]
sub eax, dword [0x141dcea4c]
imul eax, eax, 0xa80a0f93
cmp eax, 0x8545cd21
je 0x140087590
cmp ebx, 0x103
je 0x140087691
mov eax, 0x847e31db
nop word [rax + rax]
mov ecx, dword [0x141dcea50]
sub ecx, dword [0x141dcea54]
imul ecx, ecx, 0xac106f4c
add ecx, 0x9dbf296c
mov rdx, rcx
imul rdx, rax
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1d
cmp ecx, 0xf3136e48
je 0x1400875c0
test ebx, ebx
js 0x140087689
nop dword [rax]
mov eax, dword [0x141dcea60]
imul eax, dword [0x141dcea64]
or eax, 0xfe3eefdd
cmp eax, 0xb9f83dca
je 0x140087600
mov eax, dword [0x141dcea68]
xor edx, edx
div dword [str._E_L_b]
nop word [rax + rax]
mov eax, dword [0x141dcea70]
imul eax, dword [0x141dcea74]
and eax, 0xd3f5776f
xor eax, 0x8817a0ee
imul eax, eax, 0x6426cbee
cmp eax, 0x14aab1c2
jb 0x140087630
mov rcx, qword [r12 + 8]
xor r8d, r8d
nop dword [rax]
mov eax, dword [0x141dcea78]
xor edx, edx
div dword [0x141dcea7c]
xor eax, 0x3706f376
add eax, 0x82f51583
or eax, 0xc1accbf1
cmp eax, 0xcf225c31
jb 0x140087660
jmp 0x140087730
xor eax, eax
test al, al
je 0x1400876de
jmp 0x140087702
mov dword [r14], 0
mov byte [r14 + 4], 0
lea rax, [0x141db9480]
mov qword [rdi], rax
mov qword [rdi + 8], 1
mov qword [rdi + 0x10], r15
xorps xmm0, xmm0
movups xmmword [rdi + 0x18], xmm0
sub rsp, 0x20
mov rcx, r14
mov rdx, rdi
call fcn.140087f00
mov rcx, rax
call fcn.140088360
add rsp, 0x20
mov ecx, 7
int 0x29
ud2
mov esi, dword [0x141dcea58]
add esi, dword [0x141dcea5c]
sub rsp, 0x20
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
add rsp, 0x20
cmp esi, 0x6d9485f3
jne 0x140087714
sub rsp, 0x20
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
add rsp, 0x20
jmp 0x1400876de
mov ecx, eax
shl rcx, 0x20
or rcx, 2
mov r8d, 1
nop word cs:[rax + rax]
mov eax, dword [0x141dcea80]
imul eax, dword [0x141dcea84]
add eax, 0x9e2d0fa1
or eax, 0xe4dd2cd
add eax, 0x42b2dc60
cmp eax, 0xc49935b
jb 0x140087730
mov rax, r8
mov rdx, rcx
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret