Function at 0x1801325f0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
movabs rcx, 0xd7a5ce30cb35674b
mov dword [rsp + 0x40], 0x9043ad31
movabs r9, 0x53a4a43623c65917
mov qword [rbp - 0x70], rcx
movabs r8, 0x6adadc270a64e80c
mov qword [rbp - 0x80], r9
xor r15d, r15d
mov qword [rbp - 0x78], r8
mov rax, rcx
mov dword [rsp + 0x44], 0x56190e9e
mov edx, r15d
mov dword [rsp + 0x48], 0x920ee6d4
mov dword [rsp + 0x4c], 0x79069d54
mov dword [rsp + 0x50], 0xe66d2620
mov dword [rsp + 0x54], 0xdaa4fcf9
mov dword [rsp + 0x58], 0x913c0d8f
mov dword [rsp + 0x5c], 0x77318782
mov dword [rsp + 0x60], 0x651231cd
mov dword [rsp + 0x64], 0x84e0ff02
mov dword [rsp + 0x68], 0xd20f5b3e
mov dword [rsp + 0x6c], 0xc91c5bd2
mov dword [rsp + 0x70], 0x8b5b6d23
mov dword [rsp + 0x74], 0x1b300b2
mov dword [rsp + 0x78], 0x814e8064
mov dword [rsp + 0x7c], 0xb4b4
imul rax, rcx
add r8, r9
add rax, r8
mov rcx, rax
shl rax, 0x20
shr rcx, 0x20
or rcx, rax
movzx eax, cx
xor ax, word [rsp + rdx + 0x40]
mov word [rbp + rdx - 0x60], ax
add rdx, 2
mov rax, rcx
cmp rdx, 0x3e
jb 0x1801326c0
movups xmm0, xmmword [rbp - 0x60]
xor r9d, r9d
mov qword [rsp + 0x30], r15
movups xmm1, xmmword [rbp - 0x50]
mov word [rbp - 0x22], r15w
mov edx, 0x40000000
movups xmmword [rbp + 0x50], xmm0
mov dword [rsp + 0x28], r15d
lea r8d, [r9 + 7]
movups xmm0, xmmword [rbp - 0x40]
lea rcx, [rbp + 0x50]
mov dword [rsp + 0x20], 4
movups xmmword [rbp + 0x60], xmm1
movups xmm1, xmmword [rbp - 0x30]
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
movdqa xmm0, xmmword [0x180160ee0]
movabs rdi, 0xf1084821f64594e9
movdqa xmm1, xmmword [0x180160e10]
movabs rsi, 0x3166d599c42f3118
mov qword [0x18017bd78], rax
movabs rbx, 0xf5d06b73146ce1d
xor eax, eax
mov word [rbp - 0x80], 0x33ed
movdqu xmmword [rsp + 0x40], xmm0
mov rdx, r15
mov dword [rbp - 0x7d], eax
movdqa xmm0, xmmword [str.kQJ]
mov rcx, rdi
movdqu xmmword [rsp + 0x50], xmm1
mov r8, rsi
mov byte [rbp - 0x79], al
movdqa xmm1, xmmword [0x180160c30]
mov rax, rdi
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rbp - 0x7e], 0xf6
movdqu xmmword [rsp + 0x70], xmm1
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rdi
nop dword [rax]
imul rax, rcx
add r8, rbx
add rax, r8
mov rcx, rax
shl rax, 0x20
shr rcx, 0x20
or rcx, rax
movzx eax, cl
xor al, byte [rsp + rdx + 0x40]
mov byte [rbp + rdx - 0x60], al
inc rdx
mov rax, rcx
cmp rdx, 0x43
jb 0x1801327d0
movups xmm0, xmmword [rbp - 0x60]
mov byte [rbp - 0x1d], r15b
lea r8, [rbp + 0x50]
movups xmm1, xmmword [rbp - 0x50]
mov eax, dword [rbp - 0x20]
lea rcx, [0x18017bd90]
movups xmmword [rbp + 0x50], xmm0
mov edx, 0x100000
mov dword [rbp + 0x90], eax
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp + 0x60], xmm1
movups xmm1, xmmword [rbp - 0x30]
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm1
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rbp + 0x100]
call fcn.1801470b0
test eax, eax
jne 0x18013292e
movdqa xmm0, xmmword [0x180160e40]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160d80]
lea rcx, [rbp + 0xd0]
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x30], rbx
movdqa xmm0, xmmword [0x180160560]
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x28], rsi
movdqu xmmword [rbp - 0x50], xmm1
mov qword [rbp - 0x20], rdi
call fcn.18000a020
lea r8, [rbp + 8]
mov edx, 0x100000
movups xmm2, xmmword [rax]
movups xmmword [rbp + 8], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 0x18], xmm0
movsd xmm1, qword [rax + 0x20]
movsd qword [rbp + 0x28], xmm1
mov ecx, dword [rax + 0x28]
mov dword [rbp + 0x30], ecx
lea rcx, [0x18017bd90]
movzx eax, word [rax + 0x2c]
mov word [rbp + 0x34], ax
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1801330c6
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x100]
call fcn.180141b20
test eax, eax
movabs rax, 0xfb15fb380cc1731b
jne 0x180132a1f
movdqa xmm0, xmmword [0x180160f50]
lea rdx, [rbp - 0x60]
movdqa xmm1, xmmword [0x180160ca0]
lea rcx, [rbp + 8]
mov qword [rbp - 0x38], rax
movabs rax, 0x989f58b5d4fa3bbc
mov qword [rbp - 0x30], rax
movabs rax, 0x6dc8d4bcf0e3954a
mov qword [rbp - 0x28], rax
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x40], 0x450e9579
movdqu xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x3c], 0x583b600b
call fcn.180010980
lea r8, [rbp + 0xd0]
mov edx, 0x100000
lea rcx, [0x18017bd90]
movups xmm2, xmmword [rax]
movups xmmword [rbp + 0xd0], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe0], xmm0
movsd xmm1, qword [rax + 0x20]
movsd qword [rbp + 0xf0], xmm1
movzx eax, byte [rax + 0x28]
mov byte [rbp + 0xf8], al
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, 1
jmp 0x1801330cb
movdqa xmm0, xmmword [0x180161050]
lea rdx, [rsp + 0x40]
movdqa xmm1, xmmword [0x180160980]
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x78], rax
movabs rax, 0x989f58b5d4fa3bbc
mov qword [rbp - 0x80], rax
movabs rax, 0x6dc8d4bcf0e3954a
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x78], rax
movdqa xmm0, xmmword [0x180161270]
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x70], 0x5bdb2af
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x74], 0x50f34a
call fcn.180008d80
lea r8, [rbp - 0x60]
mov edx, 0x100000
lea rcx, [0x18017bd90]
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x60], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 0x40], xmm1
movsd xmm0, qword [rax + 0x30]
movsd qword [rbp - 0x30], xmm0
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rbp - 0x18]
mov qword [rbp - 0x18], r15
xor r8d, r8d
lea rcx, [0x18014d560]
xor edx, edx
call qword [rbp + 0x2a0]
test eax, eax
jns 0x180132d49
xor esi, esi
mov word [rbp + 2], r15w
mov eax, 0xa6ea
mov dword [rbp + 0x62], esi
mov edi, 0x30
mov word [rbp + 0x66], si
mov esi, 0xa6a9
mov ecx, 0x5205
xor ax, si
mov edx, 0x5134
mov word [rbp - 0x10], ax
mov r8d, 0x2185
mov eax, 0x523f
mov r9d, 0x3803
xor cx, ax
mov r10d, 0xacac
mov eax, 0x5168
mov word [rbp - 0xe], cx
xor dx, ax
mov r11d, 0x8ff4
mov eax, 0x21d0
mov word [rbp - 0xc], dx
xor r8w, ax
mov ebx, 0x5cb1
mov eax, 0x3870
mov word [rbp - 0xa], r8w
xor r9w, ax
mov eax, 0xacc9
xor r10w, ax
mov word [rbp - 8], r9w
mov eax, 0x8f86
mov word [rbp - 6], r10w
xor r11w, ax
mov eax, 0x5cc2
xor bx, ax
mov word [rbp - 4], r11w
xor di, di
mov word [rbp - 2], bx
movups xmm0, xmmword [rbp - 0x10]
mov word [rbp], di
mov rdi, 0xffffffffffffffff
mov eax, dword [rbp]
mov dword [rbp + 0xa8], eax
lea rax, [rbp + 0x98]
movups xmmword [rbp + 0x98], xmm0
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], r15w
jne 0x180132be0
lea rbx, [rdi*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp - 0x18], rax
test rax, rax
jne 0x180132d37
movdqa xmm0, xmmword [0x180161800]
movabs rcx, 0x4e0effb15aa2da28
movdqa xmm1, xmmword [0x1801624c0]
movabs r9, 0xa8ce5db91a41f821
movdqu xmmword [rsp + 0x40], xmm0
movabs r8, 0x99bd04a33aa037c8
mov word [rsp + 0x75], ax
movdqa xmm0, xmmword [0x180161a40]
mov rdx, r15
mov byte [rsp + 0x77], al
mov rax, rcx
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0xc6b74406
movdqu xmmword [rsp + 0x50], xmm1
mov byte [rsp + 0x74], 0x22
mov qword [rsp + 0x78], r9
mov qword [rbp - 0x80], r8
mov qword [rbp - 0x78], rcx
nop word [rax + rax]
imul rax, rcx
add r8, r9
add rax, r8
mov rcx, rax
shl rax, 0x20
shr rcx, 0x20
or rcx, rax
movzx eax, cl
xor al, byte [rsp + rdx + 0x40]
mov byte [rbp + rdx - 0x60], al
inc rdx
mov rax, rcx
cmp rdx, 0x35
jb 0x180132c90
movups xmm0, xmmword [rbp - 0x60]
mov eax, dword [rbp - 0x30]
lea r8, [rbp + 0x50]
movups xmm1, xmmword [rbp - 0x50]
mov dword [rbp + 0x80], eax
mov edx, 0x100000
movups xmmword [rbp + 0x50], xmm0
mov byte [rbp - 0x2b], r15b
lea rcx, [0x18017bd90]
movups xmm0, xmmword [rbp - 0x40]
movzx eax, word [rbp - 0x2c]
movups xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x84], ax
movups xmmword [rbp + 0x70], xmm0
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, 2
jmp 0x1801330cb
mov r8, rdi
lea rdx, [rbp + 0x98]
mov rcx, rax
call fcn.1801159dc
movdqa xmm0, xmmword [0x180161c30]
lea rdx, [rsp + 0x40]
movdqa xmm1, xmmword [0x180161bc0]
lea rcx, [rbp + 0x50]
mov rbx, qword [rbp - 0x18]
xor eax, eax
movdqu xmmword [rsp + 0x40], xmm0
movabs rsi, 0x5c1b7809632d1a9c
mov qword [rsp + 0x3e0], r14
movdqa xmm0, xmmword [0x180162140]
movabs r14, 0x4863e3ae9c06d2f
movabs rdi, 0x1b53e4003077bf02
mov word [rsp + 0x70], 0xc024
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x72], eax
movdqu xmmword [rsp + 0x50], xmm1
mov word [rsp + 0x76], ax
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rdi
call fcn.18000d3f0
mov r9, rbx
lea r8, [rbp - 0x60]
mov edx, 0x100000
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x60], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 0x40], xmm1
movzx ecx, word [rax + 0x30]
mov word [rbp - 0x30], cx
lea rcx, [0x18017bd90]
movzx eax, byte [rax + 0x32]
mov byte [rbp - 0x2e], al
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, [rbp + 8]
mov dword [rbp + 8], 0x147e65ab
lea rcx, [rbp - 0x60]
mov dword [rbp + 0xc], 0xe3af9205
mov dword [rbp + 0x10], 0xc1d75b91
mov dword [rbp + 0x14], 0xe11a91c5
mov dword [rbp + 0x18], 0x4717812
mov dword [rbp + 0x1c], 0x6e98bb37
mov dword [rbp + 0x20], 0xdc98b5d7
mov dword [rbp + 0x24], 0x19ac8689
mov dword [rbp + 0x28], 0xd9b074b0
mov dword [rbp + 0x2c], 0x9c7e80c0
mov dword [rbp + 0x30], 0x38d65869
mov dword [rbp + 0x34], 0x5ae5
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rdi
call fcn.1800154c0
mov rdx, qword [rbp - 0x18]
lea r9, [rbp + 0xb0]
lea r8, [rbp + 0x50]
lea rcx, [rbp + 0x100]
movups xmm1, xmmword [rax]
movups xmmword [rbp + 0x50], xmm1
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp + 0x70], xmm1
call fcn.1801330f0
mov r14, qword [rsp + 0x3e0]
test eax, eax
jne 0x180132fad
movdqa xmm0, xmmword [0x180161060]
lea rdx, [rsp + 0x40]
movdqa xmm1, xmmword [0x180160dc0]
lea rcx, [rbp + 0xd0]
movabs rax, 0xa7ec59b91e41e411
mov qword [rsp + 0x70], rax
movabs rax, 0x1102bccb1f38898a
mov qword [rsp + 0x78], rax
movabs rax, 0xba9d839a02d57d6b
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x80], rax
movdqa xmm0, xmmword [0x1801603b0]
movdqu xmmword [rsp + 0x50], xmm1
movdqu xmmword [rsp + 0x60], xmm0
call fcn.180004940
lea r8, [rbp + 8]
mov edx, 0x100000
movups xmm2, xmmword [rax]
movups xmmword [rbp + 8], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 0x18], xmm0
movsd xmm1, qword [rax + 0x20]
movsd qword [rbp + 0x28], xmm1
movzx ecx, word [rax + 0x28]
mov word [rbp + 0x30], cx
lea rcx, [0x18017bd90]
movzx eax, byte [rax + 0x2a]
mov byte [rbp + 0x32], al
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 0xb0]
call qword [rbp + 0x148]
mov rcx, qword [rbp + 0xc8]
call qword [rbp + 0x108]
test eax, eax
jne 0x1801330a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm0, xmmword [0x180160a20]
lea rdx, [rsp + 0x40]
movdqa xmm1, xmmword [0x180161740]
lea rcx, [rbp + 0x50]
mov rdi, qword [rbp + 0xc8]
mov ebx, eax
movabs rax, 0xac376134c6c74723
mov qword [rsp + 0x70], rax
movabs rax, 0xf993f31c159b129a
mov qword [rsp + 0x78], rax
movabs rax, 0x51292933998699a6
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x80], rax
movdqa xmm0, xmmword [0x180160f20]
movdqu xmmword [rsp + 0x50], xmm1
movdqu xmmword [rsp + 0x60], xmm0
call fcn.18000aa70
mov r9, rdi
mov dword [rsp + 0x20], ebx
lea r8, [rbp - 0x60]
mov edx, 0x100000
lea rcx, [0x18017bd90]
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x60], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 0x40], xmm1
movzx eax, byte [rax + 0x30]
mov byte [rbp - 0x30], al
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rbp + 0x100]
call fcn.1801412b0
mov rcx, qword [rbp + 0xc8]
call fcn.180146f60
mov rcx, qword [rbp - 0x18]
call fcn.180146f60
mov eax, 3
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret