Function at 0x140001ea4
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rsi, qword [rsp + 0xb0]
lea ebx, [rcx - 0x1f5]
mov r14d, ecx
mov dword [rsp + 0x90], ebx
xor r14d, 0xb26
lea r15d, [rcx - 0x14bf]
mov r11d, r8d
lea ebp, [r8 - 0x1324]
cmp dword [rsi + 0x4c], 0xe3fb
lea r13d, [rcx + 0x285]
mov r9d, ecx
lea r12d, [rcx - 0xb96]
ja 0x140001f10
lea rax, [0x140a9d7d0]
mov qword [rsi + 0xa8], rax
sub r14d, 0x19a1
xor r10d, r10d
mov eax, dword [rsi + 0xc0]
xor eax, 0x5d
sub dword [rsi + 0x24], eax
mov rcx, qword [section..data]
mov eax, dword [rsi + 0xa0]
sub eax, dword [rcx + 0x98]
xor dword [rcx + 0x5c], eax
mov eax, dword [rsi + 0x6c]
mov ecx, dword [rsi + 0xa4]
sub eax, 0x1cda23
add dword [rsi + 0xdc], eax
inc ecx
mov eax, dword [rsi + 0x44]
imul eax, ecx
mov dword [rsi + 0x44], eax
movsxd rcx, dword [0x140de4078]
mov rax, qword [0x140de40b8]
mov r8d, dword [r10 + rax]
add r10, 4
mov rax, qword [section..data]
imul r8d, dword [rax + 0x60]
mov rax, qword [rsi + 0xb0]
mov edx, r8d
shr edx, 0x18
mov byte [rcx + rax], dl
mov edx, r8d
inc dword [0x140de4078]
mov eax, dword [rsi + 0xdc]
shr edx, 0x10
lea ecx, [rax + 0x198f40]
xor ecx, eax
mov dword [rsi + 0xdc], ecx
mov rax, qword [section..data]
movsxd rcx, dword [rax + 0x68]
mov rax, qword [rax + 0xb0]
mov byte [rcx + rax], dl
mov edx, r8d
mov rax, qword [section..data]
shr edx, 8
inc dword [rax + 0x68]
mov rax, qword [section..data]
movsxd rcx, dword [rax + 0x68]
mov rax, qword [0x140de40c0]
mov byte [rcx + rax], dl
mov rax, qword [section..data]
inc dword [rax + 0x68]
movsxd rcx, dword [rsi + 0x68]
mov rax, qword [rsi + 0xb0]
mov byte [rcx + rax], r8b
inc dword [rsi + 0x68]
cmp r10, 0x325b6c
jl 0x140001f1a
lea eax, [r9 - 0xef7]
cmp r12d, eax
jle 0x1400022a5
lea eax, [r15 + 0x16fe]
cmp r13d, eax
jl 0x14000207b
mov eax, dword [0x140de40dc]
lea r9d, [rbp + 0x2cc5]
xor eax, 0xf0f0f0ad
mov qword [rsp + 0x28], rsi
mov dword [rsi + 0x60], eax
lea edx, [rbx - 0xbfc]
xor r12d, 0xf69
lea eax, [rbp + 0x3130]
mov r8d, r11d
mov dword [rsp + 0x20], eax
mov ecx, r12d
call fcn.1400026c0
lea rax, [0x140e03560]
mov qword [rsi + 0xa8], rax
jmp 0x1400022a5
mov eax, ebp
mov dword [rsp + 0xa0], r15d
imul eax, r15d
cmp r15d, eax
jle 0x1400022a5
mov r8d, r13d
mov ecx, r14d
imul r8d, r14d
xor ecx, 0x2a22
mov eax, r14d
mov dword [rsp + 0xb0], ecx
add r8d, 0x2a68
or eax, 0x2fef
mov dword [rsp + 0x44], r8d
mov dword [rsp + 0x40], eax
mov r9d, dword [rsi + 0xdc]
sub r12d, ecx
or r9d, dword [0x140de4038]
mov edx, r15d
and edx, dword [rsi + 0x84]
imul ecx, dword [rsi + 0x48], 0x19f2
and edx, 0x19f2
add r9d, dword [rsi + 8]
mov dword [rsp + 0x28], r8d
lea r8, [0x140de4010]
mov dword [rsp + 0x20], eax
call fcn.14000d7c4
mov rcx, qword [section..data]
mov edx, dword [rsp + 0x90]
mov ebx, dword [rsi + 0x4c]
mov r8d, dword [rsi + 0xdc]
sub ebx, r13d
mov r9d, dword [rcx + 0xc0]
mov r10d, dword [rsi + 0x5c]
add ebx, dword [rsi + 8]
sub r10d, 0x15e2
imul ecx, dword [rcx + 0xa0], 0x2011
movsxd rdi, eax
mov eax, dword [rsi + 0xd0]
or r8d, edi
or r9, rax
imul edx, r15d
mov eax, 0x2fef
mov qword [rsp + 0x30], rdi
xor r9, rax
mov dword [rsp + 0x28], ebx
add r8d, eax
mov dword [rsp + 0x20], r10d
xor edx, r14d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r10d, dword [rsi + 0xa4]
mov ecx, 0x2a68
mov r8d, dword [rsi + 0xc0]
add r10d, ecx
and r8d, ecx
mov eax, r15d
mov ecx, dword [0x140de4120]
xor r10, rax
sub ecx, dword [rsi + 0xf8]
add r8d, r13d
movsxd rax, r14d
add ecx, edi
movsxd r9, r12d
xor r9, rax
mov qword [rsp + 0x20], r10
mov rax, qword [section..data]
imul edx, dword [rax + 0x74], 0x3fa96c0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [section..data]
lea r8, [0x140de4010]
mov r9d, dword [rsi + 0x80]
add r9d, 0xffffd5de
add r9d, ebp
mov edx, dword [rcx + 0x110]
mov eax, dword [rcx + 0x5c]
lea ecx, [rbp - 0x1324]
imul edx, dword [rsp + 0x90]
or eax, ebp
xor eax, r15d
mov dword [rsp + 0x20], eax
and edx, 0x1324
call fcn.14000e73c
mov edx, dword [0x140de410c]
mov ecx, edi
mov r10d, dword [rsi + 0xa4]
xor edx, edi
mov r8d, dword [rsi + 0x110]
xor r10d, 0x25ee
imul r9d, dword [0x140de40e0], 0x1c4d
sub edx, 0x1c4d
and ecx, dword [rsi + 0x2c]
and r8d, edi
mov dword [rsp + 0x28], r10d
mov r15d, eax
mov qword [rsp + 0x20], rsi
call fcn.1400025e0
mov edx, dword [rsp + 0x90]
mov ecx, dword [rsi + 0x84]
imul edx, eax
add ecx, 0x2fef
or edx, dword [0x140de4054]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov eax, dword [rsp + 0xa0]
mov ecx, ebp
mov r8d, dword [rsp + 0x44]
add eax, 2
imul ecx, r15d
mov dword [rsp + 0xa0], eax
cmp eax, ecx
mov ecx, dword [rsp + 0xb0]
mov eax, dword [rsp + 0x40]
jg 0x1400020c1
mov rbx, qword [rsp + 0x98]
xor ebp, 0x27e3
mov eax, ebp
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret