Function at 0x140012ed8
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
movabs rdi, 0x7ffffffffffffffe
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rax, rdi
sub rax, rcx
cmp rax, 0xc
jb 0x1400136f2
cmp qword [rbx + 0x18], 7
mov r9, rbx
jbe 0x140012f25
mov r9, qword [rbx]
lea rax, str.Local_State
mov qword [rsp + 0x30], 0xc
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x58]
call fcn.140007ea8
cmp qword [rbp - 0x40], 7
lea rdx, [rbp - 0x58]
mov r8, qword [rbp - 0x48]
lea rcx, [rsp + 0x60]
cmova rdx, qword [rbp - 0x58]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
call fcn.140007c88
lea rcx, [rsp + 0x60]
call fcn.140021a10
or r14, 0xffffffffffffffff
xor r13d, r13d
movabs rsi, 0x7fffffffffffffff
lea r12d, [r14 + 0x11]
test al, al
jne 0x1400131ae
mov eax, dword [0x14009ad4c]
mov r15d, 0xff
mov dword [rsp + 0x60], 0xd500a5
mov dword [rsp + 0x64], 0x6400b0
mov dword [rsp + 0x68], 0x5f0056
mov dword [rsp + 0x6c], 0x5b0037
lea ecx, [r15 - 6]
mov dword [rsp + 0x70], 0xff009c
mov dword [rsp + 0x74], 0x2900ac
mov dword [rsp + 0x78], 0x40005d
mov dword [rsp + 0x7c], 0x470008
test al, 1
jne 0x14001302b
movups xmm0, xmmword [rsp + 0x60]
or eax, 1
mov word [0x14009ad80], cx
movups xmm1, xmmword [rsp + 0x70]
lea rcx, [0x14007e29c]
mov dword [0x14009ad4c], eax
movaps xmmword [0x14009ad60], xmm0
movaps xmmword [0x14009ad70], xmm1
mov byte [0x14009ad82], 1
call fcn.140054418
cmp byte [0x14009ad82], r13b
lea r9, [0x14009ad60]
je 0x14001306d
mov r8, r13
mov cl, r8b
movabs rdx, 0x2967333707df99f9
and cl, 7
shl cl, 3
shr rdx, cl
and dx, r15w
xor word [r9 + r8*2], dx
inc r8
cmp r8, 0x11
jb 0x14001303e
mov byte [0x14009ad82], r13b
mov rdx, qword [rbx + 0x10]
mov rcx, r14
inc rcx
cmp word [r9 + rcx*2], r13w
jne 0x140013074
mov rax, rdi
sub rax, rdx
cmp rax, rcx
jb 0x1400136f8
cmp qword [rbx + 0x18], 7
jbe 0x140013097
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], r9
mov r9, rbx
mov qword [rsp + 0x20], rdx
call fcn.140007ea8
lea rcx, [rbp - 0x58]
call fcn.140007a6c
mov r8d, 0x20
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x58]
call fcn.14007c060
movdqa xmm0, xmmword [0x14008cff0]
lea rcx, [rsp + 0x40]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r13w
call fcn.140007a6c
cmp qword [rbp - 0x40], 7
lea r15, [rbp - 0x58]
mov rbx, qword [rbp - 0x48]
xorps xmm0, xmm0
cmova r15, qword [rbp - 0x58]
movups xmmword [rsp + 0x40], xmm0
cmp rbx, rdi
ja 0x1400136fe
cmp rbx, 7
ja 0x14001312a
mov qword [rsp + 0x58], 7
lea rax, [rsp + 0x40]
mov r8, r12
jmp 0x14001318c
mov rax, rbx
or rax, 7
cmp rax, rdi
jbe 0x14001313c
lea rcx, [rsi + rsi]
jmp 0x140013164
mov ecx, 0xa
mov rdi, rax
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, rsi
ja 0x140013704
add rcx, rcx
cmp rcx, 0x1000
jb 0x14001316b
call fcn.1400080f4
jmp 0x14001317a
test rcx, rcx
je 0x140013177
call fcn.1400541b4
jmp 0x14001317a
mov rax, r13
mov qword [rsp + 0x40], rax
lea r8, [rbx*2 + 2]
mov qword [rsp + 0x58], rdi
mov rdx, r15
mov qword [rsp + 0x50], rbx
mov rcx, rax
call fcn.14007c060
lea rcx, [rsp + 0x40]
call fcn.140021a10
test al, al
je 0x140013233
cmp qword [rbp - 0x40], 7
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x30], r13
mov edx, 0x80000000
cmova rcx, qword [rbp - 0x58]
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, r14
je 0x140013233
lea rdx, [rbp + 0x118]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140013204
mov rcx, rdi
jmp 0x14001322d
mov r15d, dword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, r15d
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov rcx, rdi
test rax, rax
jne 0x14001325d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, r13
lea rcx, [rbp - 0x58]
call fcn.140007a6c
mov rax, rbx
mov rbx, qword [rsp + 0x220]
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r9, [rbp + 0x110]
mov qword [rsp + 0x20], r13
mov r8d, r15d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140013292
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400131ff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 8], xmm0
movdqu xmmword [rbp + 0x18], xmm1
inc r14
cmp byte [rbx + r14], r13b
jne 0x1400132aa
mov r8, r14
lea rcx, [rbp + 8]
mov rdx, rbx
call fcn.14000a604
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x14009ad50]
movdqa xmm0, xmmword [0x14008d060]
mov dword [rsp + 0x50], 0x9af1e5a5
mov dword [rsp + 0x54], 0xc5bd540e
test al, 1
jne 0x140013329
movaps xmmword [0x14009ad30], xmm0
lea rcx, [0x14007e288]
movsd xmm0, qword [rsp + 0x50]
or eax, 1
movsd qword [0x14009ad40], xmm0
mov dword [0x14009ad50], eax
mov byte [0x14009ad48], 1
call fcn.140054418
cmp byte [0x14009ad48], r13b
lea rdx, [0x14009ad30]
je 0x140013366
mov r9, r13
mov cl, r9b
movabs r8, 0xc59f7d31b1dfcd87
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + rdx], r8b
inc r9
cmp r9, 0x18
jb 0x14001333c
mov byte [0x14009ad48], r13b
lea rcx, [rbp + 0xa0]
call fcn.140013788
xorps xmm0, xmm0
mov qword [rbp + 0x30], r13
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x40], xmm0
lea r8, [rbp + 0xa0]
movdqa xmmword [rbp + 0x50], xmm1
lea rdx, [rbp + 0x30]
movdqa xmmword [rbp + 0x70], xmm0
lea rcx, [rbp + 8]
mov byte [rbp + 0x38], r13b
mov qword [rbp + 0x60], r13
mov byte [rbp + 0x68], r13b
mov byte [rbp + 0x80], r13b
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x90], r13
mov byte [rbp + 0x98], r13b
call fcn.140013a30
mov rdi, qword [rbp + 0x40]
movabs rcx, 0xaaaaaaaaaaaaaaab
mov r15d, 0xf
test al, al
jne 0x1400133e7
mov rbx, r13
jmp 0x14001364f
mov rax, qword [rbp + 0x48]
sub rax, rdi
sar rax, 3
imul rax, rcx
cmp rax, 1
ja 0x14001340c
lea rcx, [rbp + 0x88]
lea rax, [rbp + 0x98]
jmp 0x140013414
lea rcx, [rdi + 0x18]
lea rax, [rdi + 0x28]
cmp byte [rax], r13b
je 0x14001341e
movups xmm0, xmmword [rcx]
jmp 0x140013421
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov rdx, qword [rsp + 0x40]
mov rbx, r13
mov r8, qword [rsp + 0x48]
xorps xmm0, xmm0
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], r13
movups xmmword [rbp - 0x78], xmm0
cmp rdx, r8
jne 0x140013455
mov rax, r15
mov byte [rbp - 0x78], r13b
mov qword [rbp - 0x60], rax
jmp 0x140013469
sub r8, rdx
lea rcx, [rbp - 0x78]
call fcn.14000a604
mov rax, qword [rbp - 0x60]
mov rbx, qword [rbp - 0x68]
cmp rax, r15
lea r14, [rbp - 0x78]
xorps xmm0, xmm0
cmova r14, qword [rbp - 0x78]
movups xmmword [rsp + 0x40], xmm0
cmp rbx, rsi
ja 0x14001370a
cmp rbx, r15
ja 0x140013497
mov qword [rsp + 0x58], r15
lea rax, [rsp + 0x40]
jmp 0x1400134ee
mov rax, rbx
or rax, r15
cmp rax, rsi
jbe 0x1400134ae
movabs rcx, 0x8000000000000000
jmp 0x1400134ca
mov ecx, 0x16
mov rsi, rax
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1400134d1
call fcn.1400080f4
jmp 0x1400134e0
test rcx, rcx
je 0x1400134dd
call fcn.1400541b4
jmp 0x1400134e0
mov rax, r13
mov qword [rsp + 0x40], rax
lea r12, [rbx + 1]
mov qword [rsp + 0x58], rsi
mov r8, r12
mov qword [rsp + 0x50], rbx
mov rdx, r14
mov rcx, rax
call fcn.14007c060
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x38]
call fcn.14001a1f0
mov eax, dword [rbp - 0x28]
add eax, 0xfffffffb
mov dword [rbp - 0x18], eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, 8
mov r8d, ebx
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp - 0x10], rax
test rax, rax
je 0x1400135b1
cmp qword [rbp - 0x20], r15
lea rdx, [rbp - 0x38]
mov r8d, ebx
mov rcx, rax
cmova rdx, qword [rbp - 0x38]
add rdx, 5
call fcn.14007c060
lea r8, [rbp - 0x18]
lea rdx, [rbp - 8]
call fcn.140012e28
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp - 0x10]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rbp - 8]
test eax, eax
je 0x1400135b1
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1400135b4
mov r8d, dword [rbp - 8]
mov rcx, rax
mov rdx, qword [rbp]
call fcn.14007c060
jmp 0x1400135b4
mov rbx, r13
mov rdx, qword [rbp - 0x20]
cmp rdx, r15
jbe 0x1400135ee
mov rcx, qword [rbp - 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400135e9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400136ec
call fcn.140054430
mov rdx, qword [rbp - 0x60]
movdqa xmm0, xmmword [0x14008d000]
mov byte [rbp - 0x38], r13b
movdqu xmmword [rbp - 0x28], xmm0
cmp rdx, r15
jbe 0x140013639
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013634
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400136ec
call fcn.140054430
mov qword [rbp - 0x68], r13
movabs rcx, 0xaaaaaaaaaaaaaaab
mov qword [rbp - 0x60], r15
mov byte [rbp - 0x78], r13b
test rdi, rdi
je 0x140013694
mov rax, qword [rbp + 0x50]
sub rax, rdi
sar rax, 3
imul rax, rcx
lea rdx, [rax + rax*2]
mov rax, rdi
shl rdx, 3
cmp rdx, 0x1000
jb 0x14001368c
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400136ec
mov rcx, rdi
call fcn.140054430
lea rcx, [rbp + 0xa0]
call fcn.140013710
mov rdx, qword [rbp + 0x20]
cmp rdx, r15
jbe 0x1400136d6
mov rcx, qword [rbp + 8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400136d1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400136ec
call fcn.140054430
movdqa xmm0, xmmword [0x14008d000]
movdqu xmmword [rbp + 0x18], xmm0
mov byte [rbp + 8], r13b
jmp 0x140013236
call fcn.14005af0c
int3
call fcn.140005e1c
int3
call fcn.140005e1c
int3
call fcn.140005e1c
int3
call fcn.140005e04
int3
call fcn.140005e1c
int3