Function at 0x180009ff0
Capabilities:
Encode data using xor
Get file size
Hash data with crc32
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x2c0
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov rax, qword [0x1800f7050]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rdi, r8
mov r12, rdx
mov rsi, rcx
test rdx, rdx
je 0x18000a802
cmp word [rdx], 0
je 0x18000a802
test r8, r8
jne 0x18000a04b
mov eax, 0x80070057
jmp 0x18000a807
mov qword [rsp + 0xa0], r8
mov rax, qword [r8]
mov rcx, r8
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov rax, qword [rdi]
lea r8, [rsp + 0x40]
lea rdx, [0x1800d86c8]
mov rcx, rdi
call qword [rax]
mov ebp, eax
test eax, eax
js 0x18000a7e4
cmp eax, 1
je 0x18000a7e4
cmp qword [rsp + 0x40], rbx
jne 0x18000a0a5
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov eax, 0x80004005
jmp 0x18000a807
mov rcx, qword [rsi + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x18000a0b5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi + 0x380]
test rcx, rcx
je 0x18000a0cd
call fcn.1800626bc
mov qword [rsi + 0x380], rbx
mov edx, 0xc0000000
mov r13d, 0x80000000
cmp dword [rsi + 0x24], 0
cmovne edx, r13d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
lea r8d, [r9 + 1]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi + 0x70], rax
cmp rax, 0xffffffffffffffff
jne 0x18000a1c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 5
je 0x18000a164
cmp eax, 0x20
je 0x18000a164
cmp eax, 0xa7
je 0x18000a164
cmp eax, 0x21
je 0x18000a164
cmp eax, 0x13
je 0x18000a164
test eax, eax
jle 0x18000a143
movzx ebp, ax
or ebp, 0x80070000
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18000a154
mov rdx, qword [rcx]
call qword [rdx + 0x10]
nop
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x10]
mov eax, ebp
jmp 0x18000a807
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, r13d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi + 0x70], rax
cmp rax, 0xffffffffffffffff
jne 0x18000a1ba
call fcn.1800030e0
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18000a1aa
mov rdx, qword [rcx]
call qword [rdx + 0x10]
nop
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x10]
mov eax, ebx
jmp 0x18000a807
mov dword [rsi + 0x24], 1
mov byte [rsp + 0xb0], 0
xor edx, edx
mov r8d, 0x1ff
lea rcx, [rsp + 0xb1]
call fcn.1800644c0
mov r13, qword [rsi + 0x70]
cmp r13, 0xffffffffffffffff
je 0x18000a7c1
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov r12d, 0x200
test eax, eax
jne 0x18000a214
call fcn.1800030e0
mov ebp, eax
jmp 0x18000a2b7
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x48]
mov r8d, r12d
lea rdx, [rsp + 0xb0]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18000a2c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 0x6f8
je 0x18000a263
cmp eax, 0x3e6
je 0x18000a263
test eax, eax
jle 0x18000a2b7
movzx ebp, ax
or ebp, 0x80070000
jmp 0x18000a2b7
mov edx, r12d
lea rcx, [rsi + 0x10]
call fcn.180003cc0
mov ebp, eax
test eax, eax
js 0x18000a2b7
cmp eax, 1
je 0x18000a2b7
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x48]
mov r8d, r12d
mov rdx, qword [rsi + 0x10]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18000a2a1
call fcn.1800030e0
mov ebp, eax
jmp 0x18000a2b7
mov r8, r12
mov rdx, qword [rsi + 0x10]
lea rcx, [rsp + 0xb0]
call fcn.180063290
jmp 0x18000a2c8
test ebp, ebp
js 0x18000a7c6
cmp ebp, 1
je 0x18000a7c6
cmp dword [rsp + 0xb0], 0x5120372
je 0x18000a2f9
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18000a2e6
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov eax, 0xe00e1001
jmp 0x18000a807
lea rdx, [rsp + 0x60]
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x18000a334
call fcn.1800030e0
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18000a324
mov rdx, qword [rcx]
call qword [rdx + 0x10]
nop
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x10]
mov eax, ebx
jmp 0x18000a807
mov rax, qword [rsp + 0x60]
cqo
and edx, 0x1ff
add rax, rdx
mov rcx, rax
and eax, 0x1ff
sar rcx, 9
cmp rax, rdx
je 0x18000a379
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18000a366
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov eax, 0xe0037001
jmp 0x18000a807
mov qword [rsp + 0x60], rcx
mov dword [rsi + 0x80], ecx
mov dword [rsi + 0x88], ebx
mov eax, dword [rsp + 0xb4]
test eax, eax
jne 0x18000a3ec
mov dword [rsi + 0x78], ebx
mov edx, dword [rsp + 0xc0]
mov dword [rsi + 0x84], edx
mov eax, dword [rsp + 0xcc]
shl rax, 9
mov qword [rsi + 0x30], rax
mov rcx, rsi
call fcn.18000c370
mov ebp, eax
test eax, eax
js 0x18000a3cb
cmp eax, 1
jne 0x18000a62b
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18000a3dc
mov rdx, qword [rcx]
call qword [rdx + 0x10]
nop
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov eax, ebp
jmp 0x18000a807
cmp eax, 1
jne 0x18000a4ed
mov r8d, ebx
mov rcx, rbx
nop dword [rax + rax]
movzx eax, byte [rsp + rcx + 0xb0]
add r8d, eax
inc rcx
cmp rcx, r12
jl 0x18000a400
mov edx, dword [rsp + 0xc8]
mov eax, edx
shr eax, 0x10
movzx ecx, al
mov eax, edx
shr eax, 8
movzx eax, al
add ecx, eax
movzx eax, dl
add ecx, eax
mov eax, edx
shr eax, 0x18
add ecx, eax
sub r8d, ecx
cmp edx, r8d
je 0x18000a464
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18000a451
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov eax, 0xe0037001
jmp 0x18000a807
mov dword [rsi + 0x78], 1
mov eax, dword [rsp + 0xc0]
mov dword [rsi + 0x370], eax
shr eax, 9
mov dword [rsi + 0x374], eax
mov eax, dword [rsp + 0xc4]
mov dword [rsi + 0x378], eax
mov eax, dword [rsp + 0xcc]
shl rax, 9
mov qword [rsi + 0x30], rax
mov rcx, rsi
call fcn.18000c090
mov ebp, eax
test eax, eax
js 0x18000a4cc
cmp eax, 1
je 0x18000a4cc
mov rcx, rsi
call fcn.18000a830
test eax, eax
jne 0x18000a62b
mov dword [rsi + 0x24], 1
jmp 0x18000a62b
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18000a4dd
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov eax, ebp
jmp 0x18000a807
cmp eax, 2
jne 0x18000a7a0
mov r10d, dword [rsp + 0xbc]
mov dword [rsp + 0xbc], ebx
lea r9, [rsp + 0xb0]
or r8d, 0xffffffff
lea r11, [0x1800fd2d0]
nop dword [rax + rax]
mov ecx, r8d
movzx eax, byte [r9]
xor rcx, rax
movzx edx, cl
mov eax, r8d
shr eax, 8
mov r8d, dword [r11 + rdx*4]
xor r8d, eax
inc r9
sub r12d, 1
jne 0x18000a520
not r8d
cmp r10d, r8d
je 0x18000a56f
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18000a55c
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov eax, 0xe0037001
jmp 0x18000a807
mov dword [rsi + 0x78], 2
test byte [rsp + 0xb8], 1
je 0x18000a5cb
mov dword [rsi + 0x88], 1
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call fcn.18000af90
mov ebp, eax
test eax, eax
js 0x18000a5aa
cmp eax, 1
jne 0x18000a618
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18000a5bb
mov rdx, qword [rcx]
call qword [rdx + 0x10]
nop
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov eax, ebp
jmp 0x18000a807
mov eax, dword [rsp + 0xc0]
mov dword [rsi + 0x370], eax
shr eax, 9
mov dword [rsi + 0x374], eax
mov eax, dword [rsp + 0xc4]
mov dword [rsi + 0x378], eax
mov eax, dword [rsp + 0xcc]
shl rax, 9
mov qword [rsi + 0x30], rax
mov rcx, rsi
call fcn.18000c090
mov ebp, eax
test eax, eax
js 0x18000a782
cmp eax, 1
je 0x18000a782
mov rcx, rsi
call fcn.18000a830
test eax, eax
jne 0x18000a62b
mov dword [rsi + 0x24], 1
mov ecx, 8
call fcn.180062408
test rax, rax
je 0x18000a644
lea rcx, [rsp + 0x68]
mov qword [rax], rcx
jmp 0x18000a647
mov rax, rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rbx
xor eax, eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x54], ebx
mov rax, qword [rsi + 0x30]
shr rax, 9
mov dword [rsp + 0x58], eax
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.18000c1d0
mov ebp, eax
test eax, eax
js 0x18000a72c
cmp eax, 1
je 0x18000a72c
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x68]
call fcn.180006950
mov r9d, 1
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x68]
mov rcx, rsi
call fcn.1800034b0
mov ebp, eax
test eax, eax
jne 0x18000a6d6
mov dword [rsi + 0x28], 1
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x18000a6e8
call fcn.1800620e0
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rbx
mov rcx, qword [rsp + 0x68]
call fcn.1800620e0
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18000a71c
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov eax, ebp
jmp 0x18000a807
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x18000a73e
call fcn.1800620e0
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rbx
mov rcx, qword [rsp + 0x68]
call fcn.1800620e0
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18000a772
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov eax, ebp
jmp 0x18000a807
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18000a793
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov eax, ebp
jmp 0x18000a807
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18000a7b1
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov eax, 0xe0037000
jmp 0x18000a807
mov ebp, 0x80070057
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18000a7d7
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov eax, ebp
jmp 0x18000a807
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18000a7f5
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov eax, ebp
jmp 0x18000a807
mov eax, 0xe00e1001
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.180062100
add rsp, 0x2c0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret