Function at 0x1401349d0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movaps xmmword [rbp - 0x10], xmm6
mov r11, rdx
mov rbx, rcx
mov eax, dword [0x14159aab8]
or eax, dword [0x14159aabc]
mov ecx, eax
not ecx
and ecx, 0xbc8f4324
mov edx, eax
and edx, 0x4370bcdb
imul edx, ecx
mov ecx, eax
and ecx, 0xbc8f4324
or eax, 0xbc8f4324
imul eax, ecx
add eax, edx
imul eax, eax, 0xd19d6cb6
mov ecx, 0xb385d2fd
imul rcx, rax
shr rcx, 0x3b
cmp ecx, 0x7546b4c
ja 0x140134a98
mov eax, dword [0x14159aac0]
mov ecx, dword [0x14159aac4]
mov edx, ecx
and edx, eax
add eax, ecx
sub eax, edx
imul rax, rax, 0x4f80086d
shr rax, 0x3a
mov ecx, eax
not ecx
or eax, 0x6fe5361e
or ecx, 0x6fe53601
and ecx, eax
xor ecx, 0x36b5e8a2
xor eax, eax
call fcn.14020e090
sub rsp, rax
mov r9, rsp
mov eax, 0x30
call fcn.14020e090
sub rsp, rax
mov r10, rsp
cmp ecx, 0xce63acf
jae 0x140134ab1
xor eax, eax
call fcn.14020e090
sub rsp, rax
mov eax, 0x30
call fcn.14020e090
sub rsp, rax
jmp 0x140134a3d
mov eax, dword [0x14159aac8]
add eax, dword [0x14159aacc]
not eax
or eax, 0x63dfe3e9
and eax, 0x73dfe3f9
cmp eax, 0x81382368
jbe 0x140134af7
mov eax, 0x10
call fcn.14020e090
sub rsp, rax
mov eax, 0x10
call fcn.14020e090
sub rsp, rax
mov rax, rsp
movups xmm0, xmmword [0x141578a80]
movups xmmword [rax], xmm0
mov ecx, 0xffffffff
movups xmm0, xmmword [0x141578a80]
nop word cs:[rax + rax]
mov eax, dword [0x14159aad0]
mov edx, dword [0x14159aad4]
not eax
not edx
and edx, eax
not edx
imul rdx, rdx, 0x1356c1e9
shr rdx, 0x3c
add edx, 0xe4ba8151
mov eax, 0x10
call fcn.14020e090
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.14020e090
sub rsp, rax
mov r13, rsp
cmp r8, rcx
mov r12d, 0xffffffff
cmovb r12, r8
movups xmmword [r13], xmm0
cmp edx, 0xb01ced23
jb 0x140134b10
mov qword [rbp - 0x18], r10
mov qword [rbp - 0x20], r9
xor eax, eax
test al, al
je 0x140134bb3
sub rsp, 0x50
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r13
mov rcx, rbx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov rsi, r11
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov r11, rsi
add rsp, 0x50
xorps xmm6, xmm6
mov rsi, qword [sym.imp.ntdll.dll_NtWriteFile]
nop dword [rax]
mov eax, dword [0x14159aad8]
mov ecx, dword [0x14159aadc]
mov edx, eax
and edx, ecx
not eax
not ecx
or ecx, eax
not ecx
or ecx, edx
add ecx, 0x40da9af
or ecx, 0x37ba058
mov r14d, ecx
xor r14d, 0xef6c3e8c
add r14d, ecx
and ecx, 0x1093c173
sub r14d, ecx
sub rsp, 0x50
movups xmmword [rsp + 0x38], xmm6
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r13
mov rcx, rbx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov r15, r11
call rsi
mov r11, r15
add rsp, 0x50
cmp r14d, 0x905f57f4
jb 0x140134bc0
mov r15d, eax
cmp eax, 0x103
jne 0x140134d20
xor eax, eax
test al, al
jne 0x140134c97
mov eax, dword [0x14159aae0]
sub eax, dword [0x14159aae4]
or eax, 0x9053c790
shr eax, 3
imul rax, rax, 0x10f3057d
shr rax, 0x38
mov ecx, eax
and ecx, 0xfffffffe
add ecx, ecx
neg ecx
lea esi, [rax + rcx]
add esi, 0xbb857daa
sub rsp, 0x20
mov rcx, rbx
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x20
cmp esi, 0x43dc30a
jae 0x140134caf
sub rsp, 0x20
mov rcx, rbx
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x20
jmp 0x140134c48
mov r15d, dword [r13]
nop word cs:[rax + rax]
mov eax, dword [0x14159aae8]
mov ecx, dword [0x14159aaec]
mov edx, eax
and edx, ecx
not eax
not ecx
and ecx, eax
not edx
not ecx
and ecx, edx
add ecx, 0x21bf9df0
mov eax, ecx
and eax, 0x708ff5d4
xor ecx, 0x708ff5d4
lea eax, [rcx + rax*2]
imul rax, rax, 0x4bb41e21
shr rax, 0x3e
cmp eax, 0x4ccb33bc
ja 0x140134cc0
cmp r15d, 0x103
je 0x140134e13
nop word cs:[rax + rax]
mov eax, dword [0x14159ab10]
mov ecx, dword [0x14159ab14]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
and eax, 0x7b29a5f8
add eax, 0xa05b053
mov ecx, eax
not ecx
and ecx, 0xc211eba4
mov edx, eax
and edx, 0x3d2e145b
imul edx, ecx
mov ecx, eax
and ecx, 0xc201e3a0
or eax, 0xc211eba4
imul eax, ecx
add eax, edx
cmp eax, 0x9289d7fc
jb 0x140134d20
test r15d, r15d
js 0x140134dcf
mov rdx, qword [r13 + 8]
xor eax, eax
nop
mov ecx, dword [0x14159ab28]
and ecx, dword [0x14159ab2c]
mov r8d, ecx
xor r8d, 0x409066
and ecx, 0x3f6f99
add ecx, ecx
sub ecx, r8d
or ecx, 0xff8d140b
imul rcx, rcx, 0x2a6c188f
shr rcx, 0x3d
cmp ecx, 0x371a926
ja 0x140134d90
jmp 0x140135010
mov eax, dword [0x14159ab18]
or eax, dword [0x14159ab1c]
mov ecx, eax
not ecx
or eax, 0xf5f1fd2a
or ecx, 0xa0e02d4
and ecx, eax
not ecx
shr ecx, 1
mov eax, 0xa5df9559
imul rax, rcx
shr rax, 0x3d
imul eax, eax, 0x2f7e6ade
cmp eax, 0xac4c0cda
jbe 0x140134f86
jmp 0x140134fdf
mov eax, dword [0x14159aaf4]
mov ecx, eax
xor ecx, eax
not ecx
and ecx, dword [0x14159aaf0]
xor ecx, eax
xor ecx, 0x548e461a
or ecx, 0x233119a5
cmp ecx, 0x78caac67
mov r14, qword [rbp - 0x18]
je 0x140134e79
mov eax, dword [0x14159aaf8]
mov ecx, dword [0x14159aafc]
mov edx, ecx
not edx
and edx, eax
xor ecx, eax
add ecx, eax
sub ecx, edx
or ecx, 0x29de0667
mov dword [rdi], 0
mov byte [rdi + 4], 0
lea rax, [0x141578ae0]
mov qword [r14], rax
cmp ecx, 0xc5cbb540
jne 0x140134e8f
mov dword [rdi], 0
mov byte [rdi + 4], 0
lea rax, [0x141578ae0]
mov qword [r14], rax
jmp 0x140134e3f
mov eax, dword [0x14159ab00]
and eax, dword [0x14159ab04]
mov ecx, eax
not ecx
and ecx, 0x6171c096
mov edx, eax
and edx, 0x9e8e3f69
imul edx, ecx
mov ecx, eax
and ecx, 0x6171c096
or eax, 0x6171c096
imul eax, ecx
add eax, edx
imul eax, eax, 0x94910801
add eax, 0x8157144f
cmp eax, 0xf6c3a911
mov rbx, qword [rbp - 0x20]
ja 0x140134f3d
mov eax, dword [0x14159ab08]
xor edx, edx
div dword [0x14159ab0c]
mov ecx, eax
not ecx
or ecx, 0x534b77f1
lea esi, [rax + rcx]
add esi, 0xa0d99885
or esi, 0x2f0e4ac4
mov qword [r14 + 8], 1
mov qword [r14 + 0x10], rbx
xorps xmm0, xmm0
movups xmmword [r14 + 0x18], xmm0
sub rsp, 0x20
mov rcx, rdi
mov rdx, r14
call fcn.140135e00
mov rcx, rax
call fcn.14020be00
add rsp, 0x20
mov ecx, 7
int 0x29
cmp esi, 0xb7ec5b4b
jbe 0x140134f78
mov qword [r14 + 8], 1
mov qword [r14 + 0x10], rbx
xorps xmm0, xmm0
movups xmmword [r14 + 0x18], xmm0
sub rsp, 0x20
mov rcx, rdi
mov rdx, r14
call fcn.140135e00
mov rcx, rax
call fcn.140136320
add rsp, 0x20
mov ecx, 7
int 0x29
jmp 0x140134ed8
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x140134f80
ud2
mov eax, dword [0x14159ab20]
mov ecx, dword [0x14159ab24]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
mov esi, 0xca47e975
imul rsi, rax
shr rsi, 0x3e
mov eax, esi
and eax, 1
add eax, eax
sub esi, eax
sub rsp, 0x20
mov ecx, r15d
call fcn.14020be20
add rsp, 0x20
cmp esi, 0xbb547d8e
jne 0x140134ff2
sub rsp, 0x20
mov ecx, r15d
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
add rsp, 0x20
jmp 0x140134f86
movsxd rdx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
nop word cs:[rax + rax]
mov ecx, dword [str._b9CADV]
xor ecx, dword [0x14159ab34]
cmp ecx, 0xfa19a2e3
je 0x140135010
movaps xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret