Function at 0x1801436e0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rbx
push rdi
push r13
lea rbp, [rax - 0x258]
sub rsp, 0x338
movdqa xmm0, xmmword [0x1801617f0]
mov rdi, rdx
movdqa xmm1, xmmword [0x180160dd0]
lea rdx, [rsp + 0x78]
mov qword [rax - 0x28], r12
mov qword [rax - 0x30], r14
mov qword [rax - 0x38], r15
mov r15, rcx
xor eax, eax
mov byte [rbp - 0x48], 0x7e
mov dword [rbp - 0x47], eax
lea rcx, [rbp - 0x28]
mov word [rbp - 0x43], ax
mov byte [rbp - 0x41], al
movabs rax, 0xf437ff3808c16f2b
mov qword [rbp - 0x40], rax
movabs rax, 0xfb4a7a0673c6fd48
mov qword [rbp - 0x38], rax
movabs rax, 0x4c5c20cc98ebc85
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x30], rax
movdqa xmm0, xmmword [0x1801613e0]
movdqu xmmword [rbp - 0x78], xmm1
movdqa xmm1, xmmword [0x180161cb0]
movdqu xmmword [rbp - 0x68], xmm0
movdqu xmmword [rbp - 0x58], xmm1
call fcn.18000cb60
mov r14, 0xffffffffffffffff
movups xmm2, xmmword [rax]
movups xmmword [rsp + 0x30], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rsp + 0x60], xmm0
movzx eax, word [rax + 0x40]
mov word [rsp + 0x70], ax
nop dword [rax]
inc r14
cmp byte [r15 + r14], 0
jne 0x1801437c0
xor edx, edx
lea rcx, [rbp + 0x21]
mov r8d, 0x1ff
xor r12d, r12d
call fcn.18014b5d0
xor r13d, r13d
mov byte [rbp + 0x20], r12b
test r14, r14
je 0x180143a2d
xor edi, edi
mov qword [rsp + 0x360], rsi
nop dword [rax + rax]
movzx ebx, byte [r15]
dec r14
cmp bl, 0x3d
je 0x18014390c
mov ecx, ebx
call fcn.180115bb0
test eax, eax
jne 0x180143827
sub bl, 0x2b
test bl, 0xfb
jne 0x18014390c
movzx eax, byte [r15]
inc r12d
mov byte [rbp + rdi + 0x270], al
inc r15
inc rdi
cmp rdi, 4
jne 0x180143903
movzx edx, byte [rbp + 0x270]
lea rcx, [rsp + 0x30]
lea r12, [rsp + 0x30]
call fcn.18010aba4
movzx edx, byte [rbp + 0x271]
lea rcx, [rsp + 0x30]
mov rbx, rax
sub bl, r12b
mov byte [rbp + 0x270], bl
call fcn.18010aba4
movzx edx, byte [rbp + 0x272]
lea rcx, [rsp + 0x30]
mov rdi, rax
sub dil, r12b
mov byte [rbp + 0x271], dil
call fcn.18010aba4
movzx edx, byte [rbp + 0x273]
lea rcx, [rsp + 0x30]
mov rsi, rax
sub sil, r12b
mov byte [rbp + 0x272], sil
call fcn.18010aba4
sub al, r12b
shl bl, 2
movzx edx, sil
mov byte [rbp + 0x273], al
movzx ecx, dil
shr dl, 2
shr cl, 4
and dl, 0xf
shl sil, 6
and cl, 3
add sil, al
shl dil, 4
lea eax, [r13 + 1]
add dl, dil
add cl, bl
mov byte [rbp + rax + 0x20], dl
lea eax, [r13 + 2]
mov byte [rbp + r13 + 0x20], cl
add r13d, 3
mov byte [rbp + rax + 0x20], sil
xor r12d, r12d
xor edi, edi
test r14, r14
jne 0x180143800
test r12d, r12d
je 0x180143a1e
cmp r12d, 4
jge 0x18014393a
mov eax, 4
lea rcx, [rbp + 0x270]
sub eax, r12d
xor edx, edx
movsxd r8, eax
movsxd rax, r12d
add rcx, rax
call fcn.18014b5d0
movzx edx, byte [rbp + 0x270]
lea rcx, [rsp + 0x30]
lea r14, [rsp + 0x30]
call fcn.18010aba4
movzx edx, byte [rbp + 0x271]
lea rcx, [rsp + 0x30]
mov rbx, rax
sub bl, r14b
mov byte [rbp + 0x270], bl
call fcn.18010aba4
movzx edx, byte [rbp + 0x272]
lea rcx, [rsp + 0x30]
mov rsi, rax
sub sil, r14b
mov byte [rbp + 0x271], sil
call fcn.18010aba4
movzx edx, byte [rbp + 0x273]
lea rcx, [rsp + 0x30]
mov rdi, rax
sub dil, r14b
mov byte [rbp + 0x272], dil
call fcn.18010aba4
sub al, r14b
shl bl, 2
movzx ecx, sil
mov byte [rbp + 0x273], al
shr cl, 4
and cl, 3
shl sil, 4
add cl, bl
mov byte [rbp + 0x270], cl
movzx ecx, dil
shr cl, 2
shl dil, 6
and cl, 0xf
add dil, al
add cl, sil
lea eax, [r12 - 1]
mov byte [rbp + 0x272], dil
mov byte [rbp + 0x271], cl
movsxd rdi, eax
test eax, eax
jle 0x180143a1e
mov eax, r13d
lea rcx, [rbp + 0x20]
add rcx, rax
lea rdx, [rbp + 0x270]
xor ebx, ebx
mov r8, rdi
call fcn.18014af30
inc r13d
inc rbx
cmp rbx, rdi
jl 0x180143a13
mov rdi, qword [rbp + 0x268]
mov rsi, qword [rsp + 0x360]
lea ebx, [r13 + 1]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, qword [rsp + 0x320]
mov rbx, rax
mov r14, qword [rsp + 0x328]
mov r12, qword [rsp + 0x330]
test rax, rax
jne 0x180143b8b
movdqa xmm0, xmmword [0x180161840]
movabs rcx, 0x595121b5db376926
movdqa xmm1, xmmword [str.__v0]
movabs r9, 0x587f9cbbfb40fa25
movdqu xmmword [rsp + 0x78], xmm0
movabs r8, 0x4cd26b1c7cbe127c
mov qword [rbp - 0x48], r9
movdqa xmm0, xmmword [0x180162450]
xor edx, edx
movdqu xmmword [rbp - 0x78], xmm1
mov rax, rcx
mov qword [rbp - 0x40], r8
movdqa xmm1, xmmword [0x180160540]
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x38], rcx
movdqu xmmword [rbp - 0x58], xmm1
imul rax, rcx
add r8, r9
add rax, r8
mov rcx, rax
shl rax, 0x20
shr rcx, 0x20
or rcx, rax
movzx eax, cl
xor al, byte [rsp + rdx + 0x78]
mov byte [rbp + rdx - 0x28], al
inc rdx
mov rax, rcx
cmp rdx, 0x3d
jb 0x180143ad0
movups xmm0, xmmword [rbp - 0x28]
mov eax, dword [rbp + 0x10]
lea r8, [rsp + 0x30]
movups xmm1, xmmword [rbp - 0x18]
mov dword [rsp + 0x68], eax
mov edx, 0x100000
movups xmmword [rsp + 0x30], xmm0
mov byte [rbp + 0x15], 0
lea rcx, [0x18017bd90]
movups xmm0, xmmword [rbp - 8]
movzx eax, word [rbp + 0x14]
movups xmmword [rsp + 0x40], xmm1
mov word [rsp + 0x6c], ax
movsd xmm1, qword [rbp + 8]
movups xmmword [rsp + 0x50], xmm0
movsd qword [rsp + 0x60], xmm1
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
add rsp, 0x338
pop r13
pop rdi
pop rbx
pop rbp
ret
mov r8d, r13d
lea rdx, [rbp + 0x20]
mov rcx, rbx
call fcn.18014af30
mov rax, rbx
mov dword [rdi], r13d
add rsp, 0x338
pop r13
pop rdi
pop rbx
pop rbp
ret