Function at 0x1400f5664
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov rax, qword [0x1405fa008]
xor rax, rsp
mov qword [rbp + 0x230], rax
and qword [rsp + 0x50], 0
mov r15, rcx
and qword [rsp + 0x48], 0
lea rcx, [rsp + 0x70]
and qword [rsp + 0x38], 0
xor eax, eax
mov dword [rsp + 0x40], eax
mov r14, r8
mov rdi, rdx
call fcn.1400ee91c
test rdi, rdi
je 0x1400f56e4
mov rdx, rdi
lea rcx, str.msft:spp_migrationencryptor_tokenact_1.0
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x1400f56e4
mov ebx, 0x80070057
mov ecx, ebx
call fcn.14003e600
jmp 0x1400f5aae
lea rsi, [r15 + 0x10]
mov r13d, 0x40
mov edx, r13d
mov rcx, rsi
call fcn.1400c35d8
mov ebx, eax
test eax, eax
jns 0x1400f5703
mov ecx, eax
jmp 0x1400f56da
lea rcx, [0x1405b81f8]
call fcn.14000944c
mov rdi, rax
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x50]
mov edx, r13d
mov rcx, rsi
call rdi
mov rcx, rdi
mov ebx, eax
call fcn.140018b24
test ebx, ebx
js 0x1400f56d8
cmp dword [rsp + 0x44], 0x60
je 0x1400f5742
mov ecx, 0x8007000d
mov ebx, ecx
jmp 0x1400f56da
lea r8, [rsp + 0x48]
xor edx, edx
lea rcx, str.msft:rm_algorithm_hwid_4.0
call fcn.1400bb564
mov ebx, eax
test eax, eax
js 0x1400f56ff
mov rdi, qword [rsp + 0x48]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x60]
mov rcx, rbx
call qword [0x1403358c8]
mov rcx, rdi
call rbx
mov ebx, eax
test eax, eax
js 0x1400f56ff
mov rax, qword [rdi]
mov rbx, qword [rax + 0x38]
mov rcx, rbx
call qword [0x1403358c8]
lea r8, [rsp + 0x38]
mov rcx, rdi
lea rdx, str.SppBindingEnvironmentData
call rbx
mov ebx, eax
test eax, eax
js 0x1400f56ff
mov rax, qword [rsp + 0x38]
cmp dword [rax + 8], 4
jne 0x1400f5739
mov ebx, dword [rax + 0x18]
test ebx, ebx
je 0x1400f5739
mov rdi, qword [rax + 0x10]
lea r9, [0x1400b5a70]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, [rsp + 0x58]
lea r8d, [rdx - 0xf]
call fcn.14003c25c
lea rcx, [rbp + 0x70]
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x60], rdi
call fcn.14003a604
lea rcx, [rbp + 0x100]
call fcn.14003a604
movups xmm0, xmmword [rsi]
xor eax, eax
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbp + 0x1d0], xmm0
lea ecx, [rax + 4]
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rbp + 0x1e0], xmm1
movups xmm1, xmmword [rsi + 0x30]
movups xmmword [rbp + 0x1f0], xmm0
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x200], xmm1
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbp + 0x190], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rbp + 0x1a0], xmm1
movups xmm1, xmmword [rsi + 0x30]
movups xmmword [rbp + 0x1b0], xmm0
movups xmmword [rbp + 0x1c0], xmm1
movdqu xmm0, xmmword [rbp + rax + 0x1d0]
lea rax, [rax + 0x10]
pxor xmm0, xmmword [str.6666666666666666_]
movdqu xmmword [rbp + rax + 0x1c0], xmm0
movdqu xmm0, xmmword [rbp + rax + 0x180]
pxor xmm0, xmmword [0x1403a6380]
movdqu xmmword [rbp + rax + 0x180], xmm0
sub rcx, 1
jne 0x1400f584f
mov r8d, r13d
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x70]
call fcn.14007ae3c
mov ebx, eax
test eax, eax
js 0x1400f5939
xor esi, esi
lea rdi, [rsp + 0x60]
mov r8d, dword [rdi - 8]
lea rcx, [rbp + 0x70]
mov rdx, qword [rdi]
call fcn.14007ae3c
mov ebx, eax
test eax, eax
js 0x1400f5939
inc esi
add rdi, 0x10
cmp esi, 1
jb 0x1400f58b1
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x70]
call fcn.140062c08
mov ebx, eax
test eax, eax
js 0x1400f5939
mov r8d, r13d
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x100]
call fcn.14007ae3c
mov ebx, eax
test eax, eax
js 0x1400f5939
mov r8d, 0x20
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x100]
call fcn.14007ae3c
mov ebx, eax
test eax, eax
js 0x1400f5939
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x100]
call fcn.140062c08
mov ebx, eax
test eax, eax
jns 0x1400f5940
mov ecx, eax
call fcn.14003e600
xor eax, eax
lea rdi, [rbp + 0x1d0]
mov rcx, r13
rep stosb byte [rdi], al
lea rdi, [rbp + 0x190]
mov rcx, r13
rep stosb byte [rdi], al
mov ecx, ebx
call fcn.14006a86c
test ebx, ebx
jns 0x1400f596c
mov ecx, ebx
call fcn.14003e600
mov ecx, ebx
call fcn.14006a86c
test ebx, ebx
jns 0x1400f597e
mov ecx, ebx
call fcn.14003e600
mov ecx, ebx
call fcn.14006a86c
test ebx, ebx
js 0x1400f56d8
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, 4
mov dword [rsp + 0x40], 2
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400f59cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14003de7c
mov ebx, eax
jmp 0x1400f56ff
cmp dword [rsp + 0x30], 4
je 0x1400f59dd
mov ecx, 0x80004005
jmp 0x1400f573e
lea r8, str.spp:migblob_aesencryptor_tokenact
mov edx, 0x78
lea rcx, [rsp + 0x70]
call fcn.14007a634
mov ebx, eax
test eax, eax
js 0x1400f56ff
mov rax, qword [rsp + 0x50]
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x70]
mov edi, 0xfc
mov r8d, edi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rbp + 0x18], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x50]
mov rax, qword [rsp + 0x38]
movups xmmword [rbp + 0x38], xmm1
mov ecx, dword [rax + 0x18]
mov dword [rbp + 0x68], ecx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400f59b8
cmp dword [rsp + 0x30], edi
jne 0x1400f59d3
mov rdx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
mov rcx, r14
mov r8d, dword [rdx + 0x18]
mov rdx, qword [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400f59b8
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 0x18]
cmp dword [rsp + 0x30], ecx
jne 0x1400f59d3
mov qword [r15 + 8], r14
mov ecx, ebx
call fcn.14006a86c
lea rcx, [rsp + 0x38]
call fcn.1400b645c
lea rcx, [rsp + 0x48]
call fcn.140109cb4
lea rcx, [rsp + 0x50]
call fcn.14003b618
mov eax, ebx
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.14001af10
add rsp, 0x340
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret