Function at 0x180005380
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x18002f008]
xor rax, rsp
mov qword [rbp + 0x580], rax
movdqa xmm0, xmmword [0x18002ac80]
mov dword [rsp + 0x68], 0x5ffca54c
mov dword [rsp + 0x6c], 0x2bf0b41b
mov word [rsp + 0x70], 0xdb20
mov ecx, dword [0x180030258]
mov rax, qword gs:[0x58]
mov rdi, qword [rax + rcx*8]
mov ecx, 0x6cc
mov eax, dword [rcx + rdi]
test al, 1
jne 0x18000546a
or eax, 1
mov dword [rcx + rdi], eax
mov eax, 0x6d0
mov ebx, eax
lea rcx, [rax + rdi]
mov byte [rcx + 0x1b], 1
lea rax, [rcx + 0x1a]
lea rdx, [rsp + 0x72]
cmp rcx, rdx
ja 0x180005440
lea rdx, [rsp + 0x58]
cmp rax, rdx
jb 0x180005440
movups xmmword [rcx], xmm0
movsd xmm0, qword [rsp + 0x68]
movsd qword [rcx + 0x10], xmm0
movzx eax, word [rsp + 0x70]
mov word [rcx + 0x18], ax
mov byte [rcx + 0x1a], 0x95
jmp 0x18000545b
movups xmmword [rcx], xmm0
movsd xmm0, qword [rsp + 0x68]
movsd qword [rcx + 0x10], xmm0
movzx eax, word [rsp + 0x70]
mov word [rcx + 0x18], ax
mov byte [rcx + 0x1a], 0x95
lea rcx, [0x180021450]
call fcn.1800095b0
nop
jmp 0x18000546f
mov ebx, 0x6d0
lea r8, [rdi + rbx]
xor esi, esi
cmp byte [r8 + 0x1b], sil
je 0x1800054b0
mov edx, esi
movabs r9, 0x5de9a753095d12d
nop word [rax + rax]
movzx ecx, dl
and cl, 7
shl cl, 3
mov rax, r9
shr rax, cl
xor byte [rdx + r8], al
inc rdx
cmp rdx, 0x1b
jb 0x180005490
mov byte [r8 + 0x1b], sil
mov rcx, r8
call fcn.180009270
xorps xmm0, xmm0
call fcn.18000f4d8
cvttsd2si eax, xmm0
mov word [rbp + 0x180], ax
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x182]
call fcn.18000b820
mov qword [rsp + 0x40], rsi
lea r8, [rsp + 0x40]
lea rdx, [0x180009410]
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov rbx, qword [rsp + 0x40]
movsd xmm0, qword [0x18002a668]
call fcn.18000f4d8
cvttsd2si r8d, xmm0
lea rdx, [rbp + 0x180]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x180]
call qword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea r8, str..ini
mov edx, 0x100
lea rcx, [rbp + 0x180]
call fcn.180010274
movdqa xmm0, xmmword [0x18002ab00]
mov dword [rsp + 0x68], 0x7111ab92
mov dword [rsp + 0x6c], 0x4009319
mov ecx, 0x6ec
mov eax, dword [rcx + rdi]
test al, 1
jne 0x1800055cc
or eax, 1
mov dword [rcx + rdi], eax
mov eax, 0x6f0
mov ebx, eax
add rax, rdi
mov byte [rax + 0x19], 1
lea rcx, [rax + 0x18]
lea rdx, [rsp + 0x70]
cmp rax, rdx
ja 0x1800055ab
lea rdx, [rsp + 0x58]
cmp rcx, rdx
jb 0x1800055ab
movups xmmword [rax], xmm0
movsd xmm0, qword [rsp + 0x68]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], 0xfe
jmp 0x1800055bd
movups xmmword [rax], xmm0
movsd xmm0, qword [rsp + 0x68]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], 0xfe
lea rcx, [0x180021420]
call fcn.1800095b0
nop
jmp 0x1800055d1
mov ebx, 0x6f0
lea r8, [rbx + rdi]
cmp byte [r8 + 0x19], 0
je 0x180005611
mov rdx, rsi
movabs r9, 0xe0dc03c512bcefe
nop dword [rax]
movzx ecx, dl
and cl, 7
shl cl, 3
mov rax, r9
shr rax, cl
xor byte [rdx + r8], al
inc rdx
cmp rdx, 0x19
jb 0x1800055f0
mov byte [r8 + 0x19], 0
lea rdx, [rbp + 0x180]
mov rcx, r8
call fcn.180009160
mov ecx, 0x24
call fcn.180009648
mov rbx, rax
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov dword [rbx + 0x20], eax
call fcn.18000f4d8
xorps xmm0, xmm0
call fcn.18000f4d8
cvttsd2si eax, xmm0
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1800056d8
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbx], eax
cmp eax, 0xffffffff
je 0x1800056d8
mov ecx, eax
call fcn.1800094fc
mov qword [rbx + 4], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov r8d, dword [rbx]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800056d8
mov rcx, rbx
call fcn.180001010
mov rcx, rbx
call fcn.180001b20
nop
mov qword [0x180030ed0], rbx
mov ecx, 0x718
mov eax, dword [rcx + rdi]
test al, 1
jne 0x180005721
or eax, 1
mov dword [rcx + rdi], eax
mov eax, 0x720
mov ebx, eax
mov word [rax + rdi + 7], 0x10b
mov dword [rax + rdi], 0x8095649c
mov word [rax + rdi + 4], 0x5d9f
mov byte [rax + rdi + 6], 0xf7
lea rcx, [0x1800213d0]
call fcn.1800095b0
nop
jmp 0x180005726
mov ebx, 0x720
add rbx, rdi
cmp byte [rbx + 8], 0
je 0x180005752
xor byte [rbx], 0xd0
xor byte [rbx + 1], 0xb
xor byte [rbx + 2], 0xf2
xor byte [rbx + 3], 0xc6
xor byte [rbx + 4], 0xf6
xor byte [rbx + 5], 0x31
xor byte [rbx + 6], 0x92
xor byte [rbx + 7], 0xb
mov byte [rbx + 8], 0
mov ecx, 0x70c
mov eax, dword [rcx + rdi]
test al, 1
jne 0x180005789
or eax, 1
mov dword [rcx + rdi], eax
mov eax, 0x710
mov r14d, eax
mov dword [rax + rdi + 2], 0x16f9268
mov word [rax + rdi], 0x2eaf
lea rcx, [0x1800213f0]
call fcn.1800095b0
nop
jmp 0x18000578f
mov r14d, 0x710
lea rdx, [rdi + r14]
cmp byte [rdx + 5], 0
je 0x1800057b0
xor byte [rdx], 0xe2
xor byte [rdx + 1], 0x4f
xor byte [rdx + 2], 1
xor byte [rdx + 3], 0xfc
xor byte [rdx + 4], 0x6f
mov byte [rdx + 5], 0
lea r9, [rbp - 0x80]
mov r8, rbx
mov rcx, qword [0x180030ed0]
call fcn.180002560
test al, al
jne 0x1800059d6
mov qword [rsp + 0x40], rsi
lea r8, [rsp + 0x40]
lea rdx, [0x180009410]
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov rbx, qword [rsp + 0x40]
movsd xmm0, qword [0x18002a668]
call fcn.18000f4d8
cvttsd2si r8d, xmm0
lea r12, str.c:_rdpwrap.txt
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r15, 0xffffffffffffffff
mov r14, r15
nop dword [rax + rax]
inc r14
cmp word [r12 + r14*2], 0
jne 0x180005820
xorps xmm0, xmm0
call fcn.18000f4d8
cvttsd2si eax, xmm0
cmp r14d, eax
jbe 0x180005a46
mov r13d, 0x72c
mov ebx, 0x730
nop dword [rax + rax]
mov eax, dword [rdi + r13]
test al, 1
jne 0x180005877
or eax, 1
mov dword [rdi + r13], eax
mov word [rbx + rdi + 1], 0x189
mov byte [rbx + rdi], 0x48
lea rcx, [0x1800213b0]
call fcn.1800095b0
nop
cmp byte [rbx + rdi + 2], 0
je 0x18000588c
xor byte [rbx + rdi], 0x14
xor byte [rbx + rdi + 1], 0x89
mov byte [rbx + rdi + 2], 0
mov eax, r14d
movzx ecx, word [r12 + rax*2]
movsx eax, byte [rbx + rdi]
cmp ecx, eax
je 0x1800058b5
dec r14d
xorps xmm0, xmm0
call fcn.18000f4d8
cvttsd2si eax, xmm0
cmp r14d, eax
ja 0x180005850
jmp 0x180005a46
movsd xmm0, qword [0x18002a670]
call fcn.18000f4d8
cvttsd2si ebx, xmm0
movsd xmm0, qword [0x18002a510]
call fcn.18000f4d8
cvttsd2si eax, xmm0
sub ebx, eax
sub ebx, r14d
lea eax, [r14 + 1]
lea r14, [r12 + rax*2]
movsd xmm0, qword [0x18002a570]
call fcn.18000f4d8
cvttsd2si eax, xmm0
imul ebx, eax
xorps xmm0, xmm0
call fcn.18000f4d8
cvttsd2si edx, xmm0
mov r8d, ebx
mov rcx, r14
call fcn.18000b820
mov dword [rsp + 0x48], 0x8ebae7
mov dword [rsp + 0x4c], 0x28b8979d
mov dword [rsp + 0x50], 0x778aa6e1
mov ecx, 0x734
mov eax, dword [rcx + rdi]
test al, 1
jne 0x180005967
or eax, 1
mov dword [rcx + rdi], eax
mov eax, 0x738
mov ebx, eax
mov byte [rax + rdi + 0xc], 1
movsd xmm0, qword [rsp + 0x48]
movsd qword [rax + rdi], xmm0
mov eax, dword [rsp + 0x50]
mov dword [rbx + rdi + 8], eax
lea rcx, [0x180021380]
call fcn.1800095b0
nop
jmp 0x18000596c
mov ebx, 0x738
add rbx, rdi
cmp byte [rbx + 0xc], 0
je 0x1800059a0
movabs rdx, 0x6c8f6ef77fede95
nop
movzx ecx, sil
and cl, 7
shl cl, 3
mov rax, rdx
shr rax, cl
xor byte [rsi + rbx], al
inc rsi
cmp rsi, 0xc
jb 0x180005980
mov byte [rbx + 0xc], 0
movsd xmm0, qword [0x18002a580]
call fcn.18000f4d8
cvttsd2si eax, xmm0
movsxd rdx, eax
inc r15
cmp byte [rbx + r15], 0
jne 0x1800059b4
imul r15, rdx
mov r8, r15
lea rdx, str.rdpwrap.txt
mov rcx, r14
call fcn.18000f100
jmp 0x180005a46
movsd xmm0, qword [0x18002a678]
call fcn.18000f4d8
cvttsd2si eax, xmm0
movsxd rbx, eax
xorps xmm0, xmm0
call fcn.18000f4d8
cvttsd2si edx, xmm0
mov r8, rbx
lea rcx, [rbp + 0x380]
call fcn.18000b820
movsd xmm0, qword [0x18002a660]
call fcn.18000f4d8
cvttsd2si eax, xmm0
movsxd r8, eax
lea rdx, [rbp + 0x7f]
lea rcx, [rbp + 0x380]
call fcn.180010258
lea r12, str.c:_rdpwrap.txt
movzx eax, word [rbp + rsi + 0x380]
mov word [rsi + r12], ax
lea rsi, [rsi + 2]
test ax, ax
jne 0x180005a30
mov al, 1
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.180009470
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret