Function at 0x18013e320
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rdx, qword [r9 + 8]
xor esi, esi
mov rdi, r8
mov qword [rbp + 0xc8], rsi
xor r8d, r8d
mov rbx, r9
mov r12, rcx
lea r15d, [rsi + 1]
call fcn.180143400
mov qword [rbp - 0x78], rax
mov r14, rax
test rax, rax
jne 0x18013e438
movdqa xmm0, xmmword [0x180161220]
lea rdx, [rbp - 0x10]
movdqa xmm1, xmmword [0x180161990]
lea rcx, [rbp + 0x38]
movabs rax, 0x4863e3ae9c06d2f
mov dword [rbp + 0x10], 0x167eb776
mov qword [rbp + 0x18], rax
movabs rax, 0x8509d316dfcdfd66
mov qword [rbp + 0x20], rax
movabs rax, 0xcf7c303f107722a7
mov qword [rbp + 0x28], rax
movdqu xmmword [rbp - 0x10], xmm0
mov dword [rbp + 0x14], 0xa71f
movdqu xmmword [rbp], xmm1
call fcn.18000fed0
mov rcx, rax
lea r8, [rbp - 0x68]
mov edx, 0x100000
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x68], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm0
mov eax, dword [rax + 0x20]
mov dword [rbp - 0x48], eax
movzx eax, word [rcx + 0x24]
mov word [rbp - 0x44], ax
movzx eax, byte [rcx + 0x26]
lea rcx, [0x18017bd90]
mov byte [rbp - 0x42], al
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x18013ea06
movdqa xmm0, xmmword [0x180160e20]
movabs rax, 0xbbde12c677dcc182
movdqa xmm1, xmmword [0x180161b60]
movabs rcx, 0xbe446f692da109c6
movdqu xmmword [rbp - 0x68], xmm0
mov r9, rsi
mov qword [rsp + 0x1b0], r13
movdqa xmm0, xmmword [0x1801613f0]
movabs r13, 0x587f9cbbfb40fa25
movdqu xmmword [rbp - 0x58], xmm1
mov r8, rax
mov qword [rbp - 0x28], r13
movdqa xmm1, xmmword [0x180160650]
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x20], rcx
movdqu xmmword [rbp - 0x38], xmm1
mov qword [rbp - 0x18], rax
nop dword [rax]
nop dword [rax + rax]
imul rax, r8
add rcx, r13
add rax, rcx
add rcx, r13
mov rdx, rax
shl rax, 0x20
shr rdx, 0x20
or rdx, rax
movzx eax, dl
xor al, byte [rbp + r9 - 0x68]
mov byte [rsp + r9 + 0x30], al
imul rdx, rdx
add rdx, rcx
mov r8, rdx
shl rdx, 0x20
shr r8, 0x20
or r8, rdx
movzx eax, r8b
xor al, byte [rbp + r9 - 0x67]
mov byte [rsp + r9 + 0x31], al
add r9, 2
mov rax, r8
cmp r9, 0x3e
jb 0x18013e4b0
movups xmm0, xmmword [rsp + 0x30]
mov eax, dword [rsp + 0x68]
lea r8, [rbp + 0xc8]
movups xmm1, xmmword [rsp + 0x40]
mov dword [rbp + 0x28], eax
lea rdx, [rbp - 0x10]
movzx eax, word [rsp + 0x6c]
mov rcx, r14
movups xmmword [rbp - 0x10], xmm0
mov word [rbp + 0x2c], ax
movups xmm0, xmmword [rsp + 0x50]
mov byte [rbp + 0x2e], sil
movups xmmword [rbp], xmm1
movsd xmm1, qword [rsp + 0x60]
movups xmmword [rbp + 0x10], xmm0
movsd qword [rbp + 0x20], xmm1
call fcn.180142ef0
mov qword [rbp - 0x80], rax
mov rsi, rax
test rax, rax
je 0x18013e9d5
mov r9, qword [rbx + 0x30]
mov rcx, r12
mov r8, qword [rdi + 8]
call fcn.180145f80
mov qword [rbp + 0xb8], rax
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18013e9d5
movdqa xmm0, xmmword [0x180160fd0]
lea rdx, [rsp + 0x30]
movdqa xmm1, xmmword [0x1801603a0]
lea rcx, [rbp - 0x68]
movabs rax, 0xbe446f692da109c6
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], rax
movabs rax, 0xbbde12c677dcc182
mov qword [rsp + 0x60], rax
movdqu xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.18000c3a0
mov rcx, rax
lea r8, [rbp + 0x38]
mov edx, 0x100000
movups xmm1, xmmword [rax]
movups xmmword [rbp + 0x38], xmm1
movsd xmm0, qword [rax + 0x10]
movsd qword [rbp + 0x48], xmm0
movzx eax, word [rax + 0x18]
mov word [rbp + 0x50], ax
movzx eax, byte [rcx + 0x1a]
lea rcx, [0x18017bd90]
mov byte [rbp + 0x52], al
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 0xc8]
call fcn.180026520
cmp eax, 0x65
je 0x18013e9ca
mov r13, qword [rbp + 0xd0]
cmp eax, 0x64
jne 0x18013e9c2
mov rbx, qword [rbp + 0xc8]
mov qword [rbp + 0x30], 0
test rbx, rbx
je 0x18013e7e6
xor edx, edx
mov rcx, rbx
call fcn.180026830
test rax, rax
lea rsi, [0x18015f0aa]
mov edx, 1
mov rcx, rbx
cmovne rsi, rax
call fcn.180026830
test rax, rax
lea r14, [0x18015f0aa]
mov edx, 2
mov rcx, rbx
cmovne r14, rax
call fcn.180026700
mov edx, 2
mov rcx, rbx
mov rdi, rax
call fcn.180026950
test rdi, rdi
je 0x18013e7df
test eax, eax
je 0x18013e7df
mov qword [rbp - 0x70], 0
test r13, r13
je 0x18013e800
mov r9, r13
mov r8d, eax
mov rdx, rdi
mov rcx, r12
call fcn.180143c00
mov rdi, rax
test rax, rax
jne 0x18013e888
movdqa xmm0, xmmword [0x180161f10]
movdqa xmm1, xmmword [0x1801622f0]
mov dword [rsp + 0x63], eax
mov byte [rsp + 0x67], al
movabs rax, 0x53a4a43623c65917
mov qword [rsp + 0x68], rax
movabs rax, 0xd42e5d227ec548f6
mov qword [rsp + 0x70], rax
movabs rax, 0xbc175a171ae1c518
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x60], 0xe57
movdqa xmm0, xmmword [0x180161490]
mov byte [rsp + 0x62], 0x91
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x78], rax
lea rcx, [rbp + 0x38]
movdqu xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.18000b5b0
lea r8, [rbp - 0x68]
mov edx, 0x100000
lea rcx, [0x18017bd90]
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x68], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 0x48], xmm1
mov eax, dword [rax + 0x30]
mov dword [rbp - 0x38], eax
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdi, qword [rbp + 0xb8]
mov rcx, qword [rbp + 0xc8]
call fcn.180026520
cmp eax, 0x65
jne 0x18013e657
jmp 0x18013e9c2
lea r9, [rbp + 0xd8]
mov dword [rbp + 0xd8], 0
lea r8, [rbp - 0x70]
mov edx, eax
mov rcx, rdi
call fcn.180140ac0
test eax, eax
jne 0x18013e884
movdqa xmm0, xmmword [0x180161570]
xor eax, eax
movdqa xmm1, xmmword [0x180161cf0]
mov dword [rsp + 0x63], eax
mov byte [rsp + 0x67], al
movabs rax, 0x4863e3ae9c06d2f
mov qword [rsp + 0x68], rax
movabs rax, 0x8509d316dfcdfd66
mov qword [rsp + 0x70], rax
movabs rax, 0xcf7c303f107722a7
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x60], 0x3cb2
movdqa xmm0, xmmword [0x180161f40]
mov byte [rsp + 0x62], 0x2b
jmp 0x18013e761
mov rdi, qword [rbp - 0x70]
lea r9, [rbp + 0x30]
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call fcn.180144620
mov rcx, rdi
mov rbx, rax
call fcn.180146f60
test rbx, rbx
je 0x18013e7df
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x18013e8b5
mov rdi, qword [rbp + 0xb8]
mov r9, rbx
mov r8, rdi
mov dword [rsp + 0x20], eax
mov rcx, r12
call fcn.180146300
mov rcx, rbx
mov r15d, eax
call fcn.180146f60
test r15d, r15d
jne 0x18013e7e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm0, xmmword [0x180161590]
lea rdx, [rsp + 0x30]
movdqa xmm1, xmmword [0x180161600]
lea rcx, [rbp + 0x38]
mov ebx, eax
movabs rax, 0xac376134c6c74723
mov qword [rsp + 0x60], rax
movabs rax, 0xe46e8db7682e3fce
mov qword [rsp + 0x68], rax
movabs rax, 0xa36eb40720a5f86d
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x70], rax
movdqa xmm0, xmmword [0x180160520]
movdqu xmmword [rsp + 0x40], xmm1
movdqu xmmword [rsp + 0x50], xmm0
call fcn.18000a020
mov r9d, ebx
lea r8, [rbp - 0x68]
mov edx, 0x100000
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x68], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm0
movsd xmm1, qword [rax + 0x20]
movsd qword [rbp - 0x48], xmm1
mov ecx, dword [rax + 0x28]
mov dword [rbp - 0x40], ecx
lea rcx, [0x18017bd90]
movzx eax, word [rax + 0x2c]
mov word [rbp - 0x3c], ax
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
xor esi, esi
mov dword [0x18017bd84], eax
mov r8d, eax
mov qword [rsp + 0x20], rsi
lea rdx, [0x18017bd90]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rsi, qword [rbp - 0x80]
mov r14, qword [rbp - 0x78]
mov rcx, rdi
call qword [r12 + 0xa8]
mov rcx, qword [rbp + 0xc8]
mov r13, qword [rsp + 0x1b0]
test rcx, rcx
je 0x18013e9ee
call fcn.180026a10
test rsi, rsi
je 0x18013e9fb
mov rcx, rsi
call fcn.180022770
mov rcx, r14
call fcn.180146f60
mov eax, r15d
add rsp, 0x170
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret