Function at 0x1400d1510
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x1403f80a0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r15, r8
movzx ebx, dl
mov r14, rcx
mov qword [rbp - 0x39], rcx
mov qword [rbp - 0x31], r8
xor edi, edi
mov qword [rcx], rdi
mov qword [rcx + 8], 0xffffffffffffffff
add rcx, 0x10
lea edx, [rdi + 2]
call fcn.14012da60
nop
mov qword [r14 + 0x60], rdi
mov qword [r14 + 0x68], rdi
mov qword [r14 + 0x70], rdi
lea rsi, [r14 + 0x78]
xor edx, edx
mov r8d, 0x102
mov rcx, rsi
call fcn.140133080
mov eax, 7
mov word [r14 + 0x17a], ax
mov byte [r14 + 0x17c], WSAGetLastError
mov word [r14 + 0x17e], ax
mov byte [r14 + 0x180], dil
mov eax, 0xa
mov word [r14 + 0x182], ax
mov byte [r14 + 0x184], Ordinal_46
mov word [r14 + 0x186], ax
mov byte [r14 + 0x188], dil
mov eax, recv
mov word [r14 + 0x18a], ax
mov byte [r14 + 0x18c], reloc.WLDAP32.dll_Ordinal_33
mov word [r14 + 0x18e], ax
mov byte [r14 + 0x190], dil
mov eax, recv
mov word [r14 + 0x192], ax
mov byte [r14 + 0x194], Ordinal_46
mov word [r14 + 0x196], ax
mov byte [r14 + 0x198], dil
test bl, bl
je 0x1400d163c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [r14], rax
test rax, rax
jne 0x1400d163c
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [r14], rax
test r15, r15
je 0x1400d1938
xor r8d, r8d
lea rdx, [rbp - 0x31]
lea rcx, [rbp + 7]
call fcn.1400cfce0
nop
lea r10, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae r10, qword [rbp + 7]
mov rax, qword [rbp + 0x17]
lea rdx, [r10 + rax*2]
mov rcx, r10
call fcn.1400d13f0
cmp rax, rdx
je 0x1400d16dc
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x1400d1688
cmp cx, 0x2f
jne 0x1400d1690
add rax, 2
jmp 0x1400d1674
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x1400d16ae
cmp cx, 0x2f
je 0x1400d16ae
mov rdx, r8
cmp rax, r8
je 0x1400d16dc
jmp 0x1400d1690
cmp rax, rdx
je 0x1400d16dc
nop dword [rax]
nop word [rax + rax]
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x1400d16d4
cmp cx, 0x2f
jne 0x1400d16dc
mov rdx, r8
cmp rax, r8
jne 0x1400d16c0
mov qword [rbp - 0x31], r10
sub rdx, r10
sar rdx, 1
mov qword [rbp - 0x29], rdx
xor r8d, r8d
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x21]
call fcn.1400d13a0
nop
lea rcx, [rbp - 0x21]
call fcn.1400cfe00
movzx ebx, al
lea rcx, [rbp - 0x21]
call fcn.1400d9090
test bl, bl
jne 0x1400d17e8
lea r10, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae r10, qword [rbp + 7]
mov rax, qword [rbp + 0x17]
lea rdx, [r10 + rax*2]
mov rcx, r10
call fcn.1400d13f0
cmp rax, rdx
je 0x1400d179c
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x1400d174a
cmp cx, 0x2f
jne 0x1400d1750
add rax, 2
jmp 0x1400d1736
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x1400d176e
cmp cx, 0x2f
je 0x1400d176e
mov rdx, r8
cmp rax, r8
je 0x1400d179c
jmp 0x1400d1750
cmp rax, rdx
je 0x1400d179c
nop dword [rax]
nop word [rax + rax]
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x1400d1794
cmp cx, 0x2f
jne 0x1400d179c
mov rdx, r8
cmp rax, r8
jne 0x1400d1780
mov qword [rbp - 0x31], r10
sub rdx, r10
sar rdx, 1
mov qword [rbp - 0x29], rdx
xor r8d, r8d
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x21]
call fcn.1400d13a0
nop
mov qword [rbp - 0x31], rdi
call fcn.1400d0740
mov qword [rbp - 0x29], rax
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x21]
call fcn.1400d0270
cmp dword [rbp - 0x31], 0
jne 0x1400d195e
lea rcx, [rbp - 0x21]
call fcn.1400d9090
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r14 + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1400d192e
mov dword [rbp - 0x21], 0x76707670
lea r9, [rbp - 0x19]
movabs r10, 0x8080808080808081
nop word [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
mov r8, rax
mov rax, r10
mul r8
shr rdx, 7
imul rcx, rdx, 0xff
sub r8, rcx
mov byte [r9], r8b
inc r9
lea rax, [rbp + 7]
cmp r9, rax
jne 0x1400d1840
mov rcx, qword [r14 + 8]
cmp rcx, 0xffffffffffffffff
je 0x1400d189f
mov dword [rbp - 0x31], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x31]
mov r8d, Ordinal_41
lea rdx, [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, rdi
lea rcx, [0x1403bc340]
nop dword [rax]
movdqu xmm1, xmmword [rax + rcx]
movdqu xmm0, xmmword [rbp + rax - 0x19]
pxor xmm1, xmm0
movdqu xmmword [rbp + rax - 0x19], xmm1
add rax, 0x10
cmp rax, 0x20
jb 0x1400d18b0
mov rax, rsi
mov r9d, 0x100
nop dword [rax + rax]
mov byte [rax], dil
inc edi
lea rax, [rax + 1]
cmp edi, r9d
jb 0x1400d18e0
mov word [rsi + 0x100], 0
xor r10b, r10b
mov r8, rsi
nop dword [rax]
movzx edx, byte [r8]
mov rcx, r8
sub rcx, rsi
and ecx, 0x1f
movzx eax, dl
add al, byte [rbp + rcx - 0x19]
add r10b, al
movzx eax, r10b
movzx ecx, byte [rax + rsi]
mov byte [r8], cl
mov byte [rax + rsi], dl
inc r8
sub r9, 1
jne 0x1400d1900
lea rcx, [rbp + 7]
call fcn.1400d9090
nop
mov rax, r14
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1401304f0
mov rbx, qword [rsp + 0xe8]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea r8, [rbp - 0x21]
lea rdx, [rbp - 0x31]
lea rcx, str.create_directories
call fcn.1400d12d0
int3