Function at 0x140087980
Capabilities:
Encode data using base64
Encode data using xor
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
movaps xmmword [rbp - 0x10], xmm6
mov r14, r8
mov r15, rdx
mov eax, dword [0x141dce300]
imul eax, dword [0x141dce304]
mov rbx, rcx
imul eax, eax, 0xb7688866
add eax, 0x2f57bf4b
cmp eax, 0x853daef7
jb 0x140087a26
mov eax, dword [0x141dce308]
xor edx, edx
div dword [0x141dce30c]
imul ecx, eax, 0x1215f32f
or ecx, 0x23e34350
add ecx, 0xfe9ca01
xor eax, eax
call fcn.1400ef330
sub rsp, rax
mov r9, rsp
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r8, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r13, rsp
cmp ecx, 0xceedfd29
jbe 0x140087a5c
xor eax, eax
call fcn.1400ef330
sub rsp, rax
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
jmp 0x1400879c1
mov eax, dword [0x141dce310]
sub eax, dword [0x141dce314]
and eax, 0x15123286
imul rax, rax, 0x17d892ab
shr rax, 0x38
imul eax, eax, 0xc0623893
cmp eax, 0x25ddf773
jne 0x140087a91
movups xmm0, xmmword [0x141db9400]
movups xmmword [r13], xmm0
mov qword [rbp - 0x28], r9
movups xmm0, xmmword [0x141db9400]
nop dword [rax]
mov eax, dword [0x141dce318]
add eax, dword [0x141dce31c]
imul eax, eax, 0x64299a03
or eax, 0xf5fbb3d4
add eax, 0xab84a78f
movups xmmword [r13], xmm0
cmp eax, 0xefdf1667
ja 0x140087aa0
mov qword [rbp - 0x18], r8
mov qword [rbp - 0x20], rdx
mov eax, dword [0x141dce320]
add eax, dword [0x141dce324]
xor eax, 0x81790eca
imul eax, eax, 0x8980ffe
cmp eax, 0xc70ea124
jbe 0x140087b29
mov eax, 0xffffffff
cmp r14, rax
cmovb rax, r14
sub rsp, 0x50
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x30], eax
mov rcx, rbx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
add rsp, 0x50
mov edi, 0xffffffff
xorps xmm6, xmm6
mov rsi, qword [sym.imp.ntdll.dll_NtWriteFile]
nop dword [rax + rax]
mov r12d, dword [0x141dce328]
xor r12d, dword [0x141dce32c]
xor r12d, 0x2000c00
or r12d, 0x697063de
and r12d, 0xef777fde
cmp r14, rdi
mov eax, 0xffffffff
cmovb rax, r14
sub rsp, 0x50
movups xmmword [rsp + 0x38], xmm6
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r13
mov rcx, rbx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rsi
add rsp, 0x50
cmp r12d, 0xb8ad531c
jb 0x140087b40
cmp eax, 0x103
jne 0x140087bcc
sub rsp, 0x20
mov rcx, rbx
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x20
mov eax, dword [r13]
cmp eax, 0x103
je 0x140087c5b
test eax, eax
js 0x140087bec
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140087be0
mov rdx, qword [r13 + 8]
xor eax, eax
jmp 0x140087c20
sub rsp, 0x20
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
add rsp, 0x20
mov edx, eax
shl rdx, 0x20
or rdx, 2
xor eax, eax
nop dword [rax + rax]
test al, al
jne 0x140087c10
mov eax, 1
nop dword [rax]
mov ecx, dword [0x141dce340]
xor ecx, dword [0x141dce344]
or ecx, 0x4c4f4402
and ecx, 0xdcef44d2
add ecx, 0xf9b5b2ad
cmp ecx, 0x1d4064f7
jb 0x140087c20
movaps xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rax, qword [rbp - 0x18]
mov dword [rax], 0
mov byte [rax + 4], 0
lea rax, [0x141db9460]
mov rdx, qword [rbp - 0x20]
mov qword [rdx], rax
mov eax, dword [0x141dce330]
imul eax, dword [0x141dce334]
or eax, 0xc226293d
add eax, 0x8da8205d
mov ecx, 0xdce34fc1
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0xcda73fd6
mov rcx, qword [rbp - 0x28]
ja 0x140087cc0
mov qword [rdx + 8], 1
mov qword [rdx + 0x10], rcx
xorps xmm0, xmm0
movups xmmword [rdx + 0x18], xmm0
xor eax, eax
test al, al
je 0x140087cd5
mov qword [rdx + 8], 1
mov qword [rdx + 0x10], rcx
xorps xmm0, xmm0
movups xmmword [rdx + 0x18], xmm0
jmp 0x140087ca7
xor eax, eax
test al, al
je 0x140087cff
sub rsp, 0x20
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x20]
call fcn.1400885c0
mov rcx, rax
call fcn.140088a00
add rsp, 0x20
mov ecx, 7
int 0x29
mov edi, 0xedd70fe7
mov rbx, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
nop dword [rax]
mov esi, dword [0x141dce338]
imul esi, dword [0x141dce33c]
add esi, 0x65998ee3
xor esi, 0xf40c049e
imul rsi, rdi
shr rsi, 0x3f
sub rsp, 0x20
mov rcx, r14
mov rdx, rbx
call fcn.1400885c0
mov rcx, rax
call fcn.140088a00
add rsp, 0x20
mov ecx, 7
int 0x29
cmp esi, 0xb87a12c7
ja 0x140087d10
ud2