Function at 0x18000d7bc
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2c0
mov r15, qword [rcx]
xor edx, edx
and dword [rbp + 0x1e0], 0
lea rcx, [rbp - 0x50]
mov r8d, 0x208
call sub.ntdll.dll_memset
call fcn.1800042a4
lea rdx, [0x180035014]
mov r14, rax
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
movabs rcx, 0x9ead7275034fe1de
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x58], rcx
movabs rax, 0xb1f5694e331e1997
mov qword [rbp - 0x70], rax
movabs rax, 0x6bc1629f3926102c
mov qword [rbp - 0x68], rax
movabs rax, 0xc935ac473cdbee1
mov qword [rbp - 0x60], rax
movabs rax, 0xb198692b336a19cb
mov qword [rsp + 0x40], rax
movabs rax, 0x6ba462f43908105c
mov qword [rsp + 0x48], rax
movabs rax, 0xc935ac473cdbe98
movups xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movups xmm1, xmmword [rsp + 0x50]
mov qword [rbp - 0x58], rcx
lea rcx, [rbp - 0x50]
pxor xmm0, xmmword [rbp - 0x70]
pxor xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
and qword [rsp + 0x30], 0
lea rcx, [rbp - 0x50]
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000d97b
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
xor ecx, ecx
mov edx, eax
mov r8d, 0x1000
mov esi, eax
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x18000d923
test rbx, rbx
je 0x18000d91b
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, r14
jmp 0x18000da27
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x1e0]
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_ReadFile]
lea r8d, [rsi - 2]
lea rdx, [rdi + 2]
test r8d, r8d
je 0x18000d95e
mov rax, rdx
mov ecx, r8d
xor byte [rax], 0x62
inc rax
sub rcx, 1
jne 0x18000d952
mov rcx, r14
call qword [r14 + 0x28]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
test rbx, rbx
je 0x18000d984
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
and dword [rsp + 0x7c], 0
xorps xmm0, xmm0
and dword [rbp - 0x7c], 0
mov rcx, r14
movdqu xmmword [rsp + 0x64], xmm0
mov dword [rsp + 0x60], 0x134d74f
mov dword [rsp + 0x74], 0xe000
mov rax, qword [r14 + 0x30]
call rax
and dword [rbp - 0x80], 0
mov dword [rsp + 0x78], eax
call fcn.1800042a4
mov r8d, 0x28
lea rdx, [rsp + 0x60]
mov rcx, rax
mov rsi, rax
call qword [rax + 0x28]
mov rdx, qword [r14 + 0x30]
mov rcx, r14
mov rdi, qword [rsi + 0x28]
call rdx
mov r8, qword [r14 + 0x38]
xor edx, edx
mov rcx, r14
mov ebx, eax
call r8
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call rdi
mov rax, qword [rsi + 0x30]
mov rcx, rsi
mov rdi, qword [r15 + 0x30]
call rax
mov r8, qword [rsi + 0x38]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call r8
mov r8d, ebx
mov rdx, rax
mov rcx, r15
call rdi
mov rcx, r14
call fcn.180004324
mov rcx, rsi
call fcn.180004324
lea r11, [rsp + 0x2c0]
xor eax, eax
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret