Function at 0x180137ac0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
push rbp
push r12
push r13
push r15
lea rbp, [rsp - 0x88]
sub rsp, 0x188
mov r13, r8
xor eax, eax
mov r8, qword [r8 + 0x28]
mov r12, rcx
mov word [rbp + 6], ax
call fcn.1801380f0
mov r15, rax
test rax, rax
jne 0x180137b0c
add rsp, 0x188
pop r15
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x178], rdi
mov qword [rsp + 0x1b0], rbx
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x170], r14
mov qword [rbp + 0xc0], rax
movdqa xmm0, xmmword [0x180160340]
lea rcx, [rbp + 0x58]
movabs rdx, 0xa3156534c2c75b13
movabs r9, 0x5b38350c23ca8164
mov qword [rsp + 0x40], rdx
movabs r8, 0xfdeeb2fe8adb27a8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x48], r8
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x50], r9
call fcn.18000f800
lea rdx, [rsp + 0x68]
mov rcx, r15
movsd xmm1, qword [rax]
movsd qword [rsp + 0x68], xmm1
movzx eax, word [rax + 8]
mov word [rsp + 0x70], ax
call fcn.18010a9bc
test rax, rax
je 0x180137f92
mov edx, 0x2f
mov rcx, rax
call fcn.18010aba4
mov edx, 0xd
lea rsi, [rax + 1]
mov rcx, rsi
call fcn.18010aba4
mov r15, rax
test rax, rax
je 0x180137f92
mov r14, rax
sub r14, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r14 + 1]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x180137f92
mov r8, r14
mov rdx, rsi
mov rcx, rax
call fcn.18014af30
mov r9, 0xffffffffffffffff
nop
inc r9
cmp byte [rdi + r9], 0
jne 0x180137c10
xor r14d, r14d
mov r8, rdi
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
lea ecx, [rax + 1]
movsxd rbx, ecx
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
lea edx, [r14 + 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x180137c62
mov ebx, r14d
jmp 0x180137c8f
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [rdi + r9], r14b
jne 0x180137c70
mov dword [rsp + 0x28], esi
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x180137d5c
movdqa xmm0, xmmword [0x1801620a0]
lea rdx, [rbp - 0x50]
movdqa xmm1, xmmword [0x180160500]
lea rcx, [rsp + 0x30]
movabs rax, 0x8488351c950cfdf5
mov qword [rbp - 0x30], rax
movabs rax, 0xffd248db3b5cd2f8
mov qword [rbp - 0x28], rax
movabs rax, 0x2b7ae7f98d26cfe2
mov qword [rbp - 0x20], rax
movdqu xmmword [rbp - 0x50], xmm0
movdqu xmmword [rbp - 0x40], xmm1
call fcn.1800084e0
lea r8, [rsp + 0x78]
mov edx, 0x100000
movups xmm1, xmmword [rax]
movups xmmword [rsp + 0x78], xmm1
movsd xmm0, qword [rax + 0x10]
movsd qword [rbp - 0x78], xmm0
mov ecx, dword [rax + 0x18]
mov dword [rbp - 0x70], ecx
lea rcx, [0x18017bd90]
movzx eax, word [rax + 0x1c]
mov word [rbp - 0x6c], ax
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rbx, rbx
je 0x180137f92
movdqa xmm0, xmmword [0x180161bf0]
movabs rsi, 0x39d2d416ffd8b90d
movdqa xmm1, xmmword [0x180161e00]
movabs rdi, 0x587f9cbbfb40fa25
movdqu xmmword [rbp - 0x50], xmm0
movabs r8, 0xeb8e11d65d8cedd6
mov qword [rbp - 0x20], rdi
movdqa xmm0, xmmword [0x180160350]
mov rdx, r14
movdqu xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x18], r8
mov rcx, rsi
movdqu xmmword [rbp - 0x40], xmm1
mov qword [rbp - 0x10], rsi
mov rax, rsi
nop
imul rax, rcx
add r8, rdi
add rax, r8
mov rcx, rax
shl rax, 0x20
shr rcx, 0x20
or rcx, rax
movzx eax, cl
xor al, byte [rbp + rdx - 0x50]
mov byte [rsp + rdx + 0x30], al
inc rdx
mov rax, rcx
cmp rdx, 0x29
jb 0x180137dc0
movups xmm0, xmmword [rsp + 0x30]
mov byte [rsp + 0x59], r14b
mov r9, rbx
movups xmm1, xmmword [rsp + 0x40]
movzx eax, word [rsp + 0x58]
lea r8, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
lea rcx, [0x18017bd90]
mov edx, 0x100000
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x78], xmm1
mov word [rbp - 0x60], ax
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8, qword [r13 + 0x28]
lea rcx, [rbp + 0x20]
mov rdx, rbx
call fcn.180138850
test eax, eax
je 0x180137ece
mov rax, qword [rbp + 0xc8]
lea r8, [rbp + 0x20]
mov rdx, qword [rbp + 0xb8]
mov r9, r13
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.180138320
mov rcx, qword [rbp + 0x38]
call fcn.180146f60
mov rcx, qword [rbp + 0x30]
call fcn.180146f60
mov rcx, qword [rbp + 0x20]
call fcn.180146f60
mov rcx, qword [rbp + 0x28]
call fcn.180146f60
mov rcx, qword [rbp + 0x50]
call fcn.180146f60
mov rcx, qword [rbp + 0x40]
call fcn.180146f60
jmp 0x180137b33
movdqa xmm0, xmmword [0x180161d80]
lea rdx, [rbp - 0x50]
movdqa xmm1, xmmword [0x180161f20]
lea rcx, [rsp + 0x78]
movabs rax, 0x4863e3ae9c06d2f
mov qword [rbp - 0x20], rax
movabs rax, 0x8fbed78038f49ef6
mov qword [rbp - 0x18], rax
movabs rax, 0x567bf83f4def8806
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x10], rax
movdqa xmm0, xmmword [str.t4_a_]
movdqu xmmword [rbp - 0x40], xmm1
movdqu xmmword [rbp - 0x30], xmm0
call fcn.18000aa70
lea r8, [rsp + 0x30]
mov edx, 0x100000
lea rcx, [0x18017bd90]
movups xmm2, xmmword [rax]
movups xmmword [rsp + 0x30], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rsp + 0x50], xmm1
movzx eax, byte [rax + 0x30]
mov byte [rsp + 0x60], al
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x180137fa3
mov rcx, qword [rbp + 0xc0]
call fcn.180146f60
mov eax, 1
mov rbx, qword [rsp + 0x1b0]
mov rsi, qword [rsp + 0x180]
mov r14, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x178]
add rsp, 0x188
pop r15
pop r13
pop r12
pop rbp
ret