Function at 0x140034014
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], r9
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [r9]
xor r15d, r15d
mov rcx, r8
cmp word [rax + 2], r15w
lea edi, [r15 + 0x7c]
mov r13, r8
mov edx, edi
setne byte [rsp + 0x48]
call qword [sym.imp.SHLWAPI.dll_StrChrW]
lea r14d, [r15 + 0x2b]
mov rbx, rax
mov qword [rsp + 0x50], rax
cmp rax, r15
jne 0x1400340ab
lea rcx, [rsp + 0x40]
mov rdx, r13
call fcn.14006016c
lea rcx, [rsp + 0x40]
call fcn.14005da74
cmp al, r15b
jle 0x14003409c
mov edx, r14d
mov rcx, r13
mov di, r14w
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
call fcn.14004ea6c
mov rbx, qword [rsp + 0x50]
or rsi, 0xffffffffffffffff
mov rbp, r15
mov r12, rsi
cmp rbx, r15
je 0x14003410f
mov word [rbx], r15w
add qword [rsp + 0x50], 2
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], r15
call fcn.14005ba04
mov rax, qword [rsp + 0x50]
movsxd rbp, dword [rsp + 0x40]
mov rcx, r15
mov qword [rsp + 0x40], rcx
cmp di, word [rax]
jne 0x14003410c
add rax, 2
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
call fcn.14005ba04
mov rcx, qword [rsp + 0x40]
movsxd r12, ecx
lea rcx, [rsp + 0x70]
mov rdx, r13
call fcn.14006016c
cmp rbx, r15
je 0x140034125
mov word [rbx], r14w
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x78], r15d
call fcn.1400682f8
mov r14d, dword [rsp + 0x108]
mov rcx, qword [rsp + 0x100]
lea rdx, [rsp + 0x70]
xor r8d, r8d
sar r14d, 0x10
mov dil, al
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
call fcn.140003728
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x40]
mov r9d, 7
mov r8d, 0x80000000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x20], r15
call fcn.140003590
mov rbx, qword [rsp + 0x40]
cmp rbx, r15
je 0x1400345b2
mov rcx, rbx
cmp dil, r15b
je 0x1400341c6
mov dl, dil
call fcn.140053f60
mov rdi, rax
jmp 0x1400341db
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], r15
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rdi, qword [rsp + 0x40]
cmp rdi, r15
jle 0x1400345a4
cmp rdi, rbp
jl 0x1400345a4
cmp rbp, r15
jle 0x1400341f5
sub rdi, rbp
mov eax, 0x10000000
cmp rdi, rax
cmovg rdi, rax
cmp r12, r15
jle 0x14003420d
cmp rdi, r12
cmovg rdi, r12
lea eax, [rdi + 0x10]
lea rcx, [rsp + 0x58]
movsxd r12, eax
mov rdx, r12
call fcn.140055e58
mov r15, qword [rsp + 0x58]
xor eax, eax
cmp r15, rax
jne 0x140034246
cmp rbx, rsi
je 0x14003423a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x108]
jmp 0x1400345b2
mov qword [rsp + 0x68], r12
xor r12d, r12d
movsxd rax, edi
cmp rbp, r12
mov qword [rsp + 0x60], rax
jle 0x14003426d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, r15
mov rcx, rbx
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [rsp + 0x40]
cmp edi, r12d
cmovl edi, r12d
xor edx, edx
movsxd rbp, edi
lea r8d, [rdx + 0x10]
lea rcx, [r15 + rbp]
call fcn.1400cc8d0
cmp rbx, rsi
je 0x1400342b6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xf8]
mov rdx, r13
mov rcx, rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rbp
call fcn.140056108
lea rdx, [0x1400ed1e0]
mov rcx, rbx
call fcn.140056108
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
mov edx, edi
call fcn.140052460
movzx esi, r14w
mov r13d, 1
movzx ecx, sil
mov dil, al
mov ebx, ecx
shl ebx, 8
or ebx, ecx
mov rcx, qword [rsp + 0x58]
cmp al, r12b
je 0x1400343a4
mov qword [rsp + 0x80], rcx
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x80]
mov r8d, esi
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x88], rbp
call fcn.14005a8e8
mov rcx, qword [rsp + 0x80]
call fcn.14004ea20
mov edx, dword [rsp + 0x108]
movsx ecx, dil
movzx eax, r14w
mov r11d, 0xfeff
xor ax, r11w
cmp ax, word [r15]
movzx eax, dx
cmove ebx, esi
mov edi, ebx
shl edi, 0x10
or edi, eax
or edi, ecx
or ecx, edx
mov dword [rsp + 0x108], ecx
lea rcx, [rsp + 0x80]
call fcn.14004ea6c
jmp 0x1400343dc
movzx eax, r14w
mov r11d, 0xfeff
xor ax, r11w
cmp ax, word [rcx]
lea rax, [rbp + 1]
cmove ebx, esi
shr rax, 1
jmp 0x1400343c8
xor word [rcx], bx
add rcx, 2
sub eax, r13d
jns 0x1400343c1
movzx eax, word [rsp + 0x108]
mov edi, ebx
shl edi, 0x10
or edi, eax
or edi, 3
lea rcx, [rsp + 0x58]
mov edx, edi
call fcn.1400bcf6c
mov r8, qword [rsp + 0x58]
movzx edx, bx
mov rcx, r8
call fcn.14001804c
movsxd r12, eax
lea eax, [r12 + r12]
cmp ebx, esi
je 0x140034429
lea ecx, [r12 - 1]
xor esi, esi
xor bx, r14w
cmp ecx, esi
jl 0x14003442b
xor word [r8], bx
add r8, 2
sub ecx, r13d
jns 0x140034415
mov r8, qword [rsp + 0x58]
jmp 0x14003442b
xor esi, esi
mov r15, qword [rsp + 0x100]
movsxd rbx, eax
mov rcx, r8
movzx r13d, word [r15 + 0x88]
lea rdx, [rbx + 0x23]
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x60], r12
call fcn.140055c58
lea rcx, [rbx + rax]
mov qword [rsp + 0x58], rax
mov eax, 0xf
mov word [rcx + 0x20], si
mov word [rcx + rax*2], r14w
sub rax, 1
jns 0x140034466
mov rbp, qword [rsp + 0x58]
mov r8b, byte [rsp + 0x48]
mov rcx, r15
mov rdx, rbp
call fcn.140023328
cmp word [rbp], r13w
je 0x1400345b2
mov r14, qword [rsp + 0xe0]
cmp qword [r14], rsi
je 0x1400344ae
mov rcx, qword [r14]
movzx edx, r13w
call fcn.14001804c
mov ebx, eax
jmp 0x1400344b0
mov ebx, esi
movzx eax, word [r15 + 0x90]
mov rcx, qword [r14]
cmp word [rbp + r12*2 - 2], ax
mov eax, 1
cmovne esi, eax
lea eax, [rsi + rbx]
lea edx, [rax + r12 + 0x10]
movsxd rdx, edx
lea rdx, [rdx + rdx + 2]
call fcn.140055c58
mov qword [r14], rax
mov r14d, dword [rsp + 0xe8]
cmp r14d, ebx
cmovg r14d, ebx
cmp ebx, r14d
movsxd rcx, r14d
lea r10, [rax + rcx*2]
jle 0x140034518
mov eax, ebx
mov rdx, r10
sub eax, r14d
add eax, eax
movsxd r8, eax
movsxd rax, esi
add rax, r12
lea rcx, [r10 + rax*2]
call fcn.14001a478
xor eax, eax
cmp esi, eax
je 0x14003452b
movzx eax, word [r15 + 0x90]
mov word [r10 + r12*2], ax
lea r8, [r12 + r12]
mov rdx, rbp
mov rcx, r10
call fcn.14001a4c0
movsxd rcx, esi
movsxd r8, ebx
mov rbx, qword [rsp + 0xe0]
lea rax, [r12 + rcx]
add r8, rax
mov rax, qword [rbx]
mov word [rax + r8*2], r13w
mov rcx, qword [rsp + 0x58]
call fcn.14004ea20
mov edi, dword [rsp + 0x108]
mov r9, qword [rsp + 0xf8]
mov r8d, r12d
mov edx, r14d
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r15
call fcn.140033c6c
movzx ebx, ax
lea rcx, [rsp + 0x58]
or ebx, edi
call fcn.14004ea6c
lea rcx, [rsp + 0x70]
call fcn.14004ea6c
mov eax, ebx
jmp 0x1400345c8
cmp rbx, rsi
je 0x1400345b2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x58]
call fcn.14004ea6c
lea rcx, [rsp + 0x70]
call fcn.14004ea6c
mov eax, esi
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret