Function at 0x14008a8b0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rcx
mov eax, dword [0x141dd1990]
add eax, dword [0x141dd1994]
imul eax, eax, 0x486a5865
add eax, 0xd940b0e0
imul rax, rax, 0x3794e171
shr rax, 0x3d
cmp eax, 0x211f5b54
jne 0x14008a910
xor eax, eax
call fcn.1400f1350
sub rsp, rax
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
nop dword [rax]
mov eax, dword [0x141dd1998]
xor eax, dword [0x141dd199c]
add eax, 0xc0322a
imul rcx, rax, 0x1f9dcfff
shr rcx, 0x3a
xor eax, eax
call fcn.1400f1350
sub rsp, rax
mov r15, rsp
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov rbx, rsp
cmp ecx, 0x561233ec
je 0x14008a910
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov r14, rsp
movups xmm0, xmmword [0x141dbb820]
movups xmmword [r14], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
sub rsp, 0x50
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r14
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
add rsp, 0x50
nop word [rax + rax]
mov ecx, dword [0x141dd19a0]
add ecx, dword [str.kZ:]
and ecx, 0xea80068c
imul ecx, ecx, 0x470371a6
add ecx, 0xd9fa035e
cmp ecx, 0xaedad0e2
ja 0x14008a9c0
cmp eax, 0x103
jne 0x14008aa50
sub rsp, 0x20
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x20
mov eax, dword [r14]
xor ecx, ecx
nop dword [rax + rax]
test cl, cl
jne 0x14008aa10
nop word cs:[rax + rax]
mov ecx, dword [0x141dd19a8]
xor ecx, dword [0x141dd19ac]
imul rcx, rcx, 0x23f8a255
shr rcx, 0x3d
imul ecx, ecx, 0xde2e8d95
cmp ecx, 0x46c55b44
je 0x14008aa20
cmp eax, 0x103
je 0x14008ab19
mov ecx, dword [0x141dd19c0]
imul ecx, dword [0x141dd19c4]
imul ecx, ecx, 0x748560a2
add ecx, 0xb63e8735
cmp ecx, 0xcd5d9811
ja 0x14008aa50
test eax, eax
js 0x14008aaad
mov eax, 0x96e1c57f
nop word [rax + rax]
mov ecx, dword [0x141dd19d0]
xor ecx, dword [0x141dd19d4]
add ecx, 0x3a0626f
imul rcx, rax
shr rcx, 0x3d
and ecx, 0xfffffffe
cmp ecx, 0x6cdf8bda
je 0x14008aa80
mov rdx, qword [r14 + 8]
xor eax, eax
jmp 0x14008ab0c
sub rsp, 0x20
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
add rsp, 0x20
mov edx, eax
shl rdx, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dd19c8]
imul eax, dword [0x141dd19cc]
shr eax, 2
imul rax, rax, 0x44b07f53
shr rax, 0x3c
imul eax, eax, 0x80b827a0
imul rax, rax, 0x5f25db99
shr rax, 0x3b
cmp eax, 0x77d64058
je 0x14008aad0
or rdx, 2
mov eax, 1
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov dword [rbx], 0
mov byte [rbx + 4], 0
lea rax, [0x141dbb880]
mov qword [rdi], rax
mov qword [rdi + 8], 1
mov qword [rdi + 0x10], r15
xorps xmm0, xmm0
movups xmmword [rdi + 0x18], xmm0
sub rsp, 0x20
mov rcx, rbx
mov rdx, rdi
call fcn.14008b390
add rsp, 0x20
mov rsi, rax
mov eax, dword [0x141dd19b0]
sub eax, dword [0x141dd19b4]
xor eax, 0x85a22a04
imul eax, eax, 0x524175b0
xor eax, 0x2fd627c
cmp eax, 0x607d0d83
jb 0x14008abbb
mov eax, dword [str.Q_eEl]
imul eax, dword [0x141dd19bc]
add eax, 0x7fbe89f
imul rdi, rax, 0x804ea35
shr rdi, 0x3b
or edi, 0x271f1906
sub rsp, 0x20
mov rcx, rsi
call fcn.14008b7b0
add rsp, 0x20
mov ecx, 7
int 0x29
cmp edi, 0x5a040850
jbe 0x14008abd4
sub rsp, 0x20
mov rcx, rsi
call fcn.14008b7b0
add rsp, 0x20
mov ecx, 7
int 0x29
jmp 0x14008ab79
ud2