Function at 0x1400f4778
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov rax, qword [0x1405f8008]
xor rax, rsp
mov qword [rbp + 0x230], rax
and qword [rsp + 0x50], 0
mov r15, rcx
and qword [rsp + 0x48], 0
lea rcx, [rsp + 0x70]
and qword [rsp + 0x38], 0
xor eax, eax
mov dword [rsp + 0x40], eax
mov r14, r8
mov rdi, rdx
call fcn.1400eda94
test rdi, rdi
je 0x1400f47f8
mov rdx, rdi
lea rcx, str.msft:spp_migrationencryptor_tokenact_1.0
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x1400f47f8
mov ebx, 0x80070057
mov ecx, ebx
call fcn.14003e510
jmp 0x1400f4bc2
lea rsi, [r15 + 0x10]
mov r13d, 0x40
mov edx, r13d
mov rcx, rsi
call fcn.1400c30e8
mov ebx, eax
test eax, eax
jns 0x1400f4817
mov ecx, eax
jmp 0x1400f47ee
lea rcx, [0x1405b4888]
call fcn.140009438
mov rdi, rax
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x50]
mov edx, r13d
mov rcx, rsi
call rdi
mov rcx, rdi
mov ebx, eax
call fcn.140018b88
test ebx, ebx
js 0x1400f47ec
cmp dword [rsp + 0x44], 0x60
je 0x1400f4856
mov ecx, 0x8007000d
mov ebx, ecx
jmp 0x1400f47ee
lea r8, [rsp + 0x48]
xor edx, edx
lea rcx, str.msft:rm_algorithm_hwid_4.0
call fcn.1400bb314
mov ebx, eax
test eax, eax
js 0x1400f4813
mov rdi, qword [rsp + 0x48]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x60]
mov rcx, rbx
call qword [0x1403358c8]
mov rcx, rdi
call rbx
mov ebx, eax
test eax, eax
js 0x1400f4813
mov rax, qword [rdi]
mov rbx, qword [rax + 0x38]
mov rcx, rbx
call qword [0x1403358c8]
lea r8, [rsp + 0x38]
mov rcx, rdi
lea rdx, str.SppBindingEnvironmentData
call rbx
mov ebx, eax
test eax, eax
js 0x1400f4813
mov rax, qword [rsp + 0x38]
cmp dword [rax + 8], 4
jne 0x1400f484d
mov ebx, dword [rax + 0x18]
test ebx, ebx
je 0x1400f484d
mov rdi, qword [rax + 0x10]
lea r9, [0x1400b5740]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, [rsp + 0x58]
lea r8d, [rdx - 0xf]
call fcn.14003c3cc
lea rcx, [rbp + 0x70]
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x60], rdi
call fcn.14003a734
lea rcx, [rbp + 0x100]
call fcn.14003a734
movups xmm0, xmmword [rsi]
xor eax, eax
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbp + 0x1d0], xmm0
lea ecx, [rax + 4]
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rbp + 0x1e0], xmm1
movups xmm1, xmmword [rsi + 0x30]
movups xmmword [rbp + 0x1f0], xmm0
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x200], xmm1
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbp + 0x190], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rbp + 0x1a0], xmm1
movups xmm1, xmmword [rsi + 0x30]
movups xmmword [rbp + 0x1b0], xmm0
movups xmmword [rbp + 0x1c0], xmm1
movdqu xmm0, xmmword [rbp + rax + 0x1d0]
lea rax, [rax + 0x10]
pxor xmm0, xmmword [str.6666666666666666_]
movdqu xmmword [rbp + rax + 0x1c0], xmm0
movdqu xmm0, xmmword [rbp + rax + 0x180]
pxor xmm0, xmmword [0x1403a6320]
movdqu xmmword [rbp + rax + 0x180], xmm0
sub rcx, 1
jne 0x1400f4963
mov r8d, r13d
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x70]
call fcn.14007a5f8
mov ebx, eax
test eax, eax
js 0x1400f4a4d
xor esi, esi
lea rdi, [rsp + 0x60]
mov r8d, dword [rdi - 8]
lea rcx, [rbp + 0x70]
mov rdx, qword [rdi]
call fcn.14007a5f8
mov ebx, eax
test eax, eax
js 0x1400f4a4d
inc esi
add rdi, 0x10
cmp esi, 1
jb 0x1400f49c5
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x70]
call fcn.1400629a8
mov ebx, eax
test eax, eax
js 0x1400f4a4d
mov r8d, r13d
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x100]
call fcn.14007a5f8
mov ebx, eax
test eax, eax
js 0x1400f4a4d
mov r8d, 0x20
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x100]
call fcn.14007a5f8
mov ebx, eax
test eax, eax
js 0x1400f4a4d
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x100]
call fcn.1400629a8
mov ebx, eax
test eax, eax
jns 0x1400f4a54
mov ecx, eax
call fcn.14003e510
xor eax, eax
lea rdi, [rbp + 0x1d0]
mov rcx, r13
rep stosb byte [rdi], al
lea rdi, [rbp + 0x190]
mov rcx, r13
rep stosb byte [rdi], al
mov ecx, ebx
call fcn.14006a5bc
test ebx, ebx
jns 0x1400f4a80
mov ecx, ebx
call fcn.14003e510
mov ecx, ebx
call fcn.14006a5bc
test ebx, ebx
jns 0x1400f4a92
mov ecx, ebx
call fcn.14003e510
mov ecx, ebx
call fcn.14006a5bc
test ebx, ebx
js 0x1400f47ec
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, 4
mov dword [rsp + 0x40], 2
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400f4ae0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14003de94
mov ebx, eax
jmp 0x1400f4813
cmp dword [rsp + 0x30], 4
je 0x1400f4af1
mov ecx, 0x80004005
jmp 0x1400f4852
lea r8, str.spp:migblob_aesencryptor_tokenact
mov edx, 0x78
lea rcx, [rsp + 0x70]
call fcn.140079e34
mov ebx, eax
test eax, eax
js 0x1400f4813
mov rax, qword [rsp + 0x50]
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x70]
mov edi, 0xfc
mov r8d, edi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rbp + 0x18], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x50]
mov rax, qword [rsp + 0x38]
movups xmmword [rbp + 0x38], xmm1
mov ecx, dword [rax + 0x18]
mov dword [rbp + 0x68], ecx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400f4acc
cmp dword [rsp + 0x30], edi
jne 0x1400f4ae7
mov rdx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
mov rcx, r14
mov r8d, dword [rdx + 0x18]
mov rdx, qword [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400f4acc
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 0x18]
cmp dword [rsp + 0x30], ecx
jne 0x1400f4ae7
mov qword [r15 + 8], r14
mov ecx, ebx
call fcn.14006a5bc
lea rcx, [rsp + 0x38]
call fcn.14003b788
lea rcx, [rsp + 0x48]
call fcn.1400b60fc
lea rcx, [rsp + 0x50]
call fcn.14003b754
mov eax, ebx
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.14001af80
add rsp, 0x340
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret