Function at 0x1401cf97c
Capabilities:
Encode data using xor
Hash data with crc32
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov eax, dword [rcx + 0x28]
lea r9, [rbp - 0x39]
xor edi, edi
mov dword [rbp - 0x31], eax
cmp eax, r8d
mov dword [rbp - 0x49], edi
mov rbx, rcx
mov dword [rbp - 0x39], 0xc0e5510a
cmovb r8d, eax
mov byte [rbp - 0x32], dl
mov rax, qword [rcx + 0x28]
lea r11d, [rdi + 0x18]
shr rax, 0x20
lea r10d, [rdi + 6]
mov dword [rbp - 0x29], r8d
lea rsi, [0x14036f280]
mov dword [rbp - 0x2d], eax
or r8d, 0xffffffff
mov dword [rbp - 0x45], r11d
mov dword [rbp - 0x25], edi
mov word [rbp - 0x35], r11w
movzx ecx, byte [r9]
mov eax, r8d
xor rcx, rax
inc r9
shr eax, 8
movzx edx, cl
mov r8d, dword [rsi + rdx*4]
xor r8d, eax
sub r10, 1
jne 0x1401cf9f6
lea r9, [rbp - 0x32]
mov r10d, SafeArrayUnlock
movzx ecx, byte [r9]
mov eax, r8d
xor rcx, rax
inc r9
shr eax, 8
movzx edx, cl
mov r8d, dword [rsi + rdx*4]
xor r8d, eax
sub r10, 1
jne 0x1401cfa20
not r8b
mov byte [rbp - 0x33], r8b
cmp byte [rbx + 0x58], dil
je 0x1401cfa5c
mov rcx, rdi
not byte [rbp + rcx - 0x39]
inc rcx
cmp rcx, r11
jb 0x1401cfa50
mov rcx, qword [rbx + 0x48]
lea r9, [rbp - 0x41]
mov r8d, r11d
mov dword [rbp - 0x41], edi
lea rdx, [rbp - 0x39]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1401cfb03
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbp - 0x49], eax
call fcn.14004d8a4
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
jbe 0x1401cfaee
lea rax, str.Sample_file_compression_failed___Cannot_write_compressed_header_to_file
mov qword [rbp + 0xf], DllRegisterServer
mov qword [rbp + 7], rax
lea rdx, [rbp - 0x49]
lea rax, [rbp - 0x45]
mov qword [rbp + 0x1f], 4
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x27], rdx
mov qword [rbp + 0x2f], 4
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403dd6bc]
xor r8d, r8d
mov dword [rsp + 0x20], 5
call fcn.140001158
mov ecx, dword [rbp - 0x49]
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x1401cfb97
mov eax, dword [rbp - 0x45]
cmp dword [rbp - 0x41], eax
je 0x1401cfb91
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbp - 0x49], eax
call fcn.14004d8a4
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
jbe 0x1401cfaee
lea rax, str.Sample_file_compression_failed___didnt_write_all_compressed_header_to_file
mov qword [rbp + 0xf], 0x98
lea rdx, [rbp - 0x41]
mov qword [rbp + 7], rax
mov qword [rbp + 0x27], rdx
lea rax, [rbp - 0x45]
lea rdx, [rbp - 0x49]
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x37], rdx
mov qword [rbp + 0x1f], 4
mov qword [rbp + 0x2f], 4
mov qword [rbp + 0x3f], 4
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403dd665]
xor r8d, r8d
mov dword [rsp + 0x20], 6
call fcn.140001158
jmp 0x1401cfaee
add qword [rbx + 0x38], rax
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1402dfdb0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret