Function at 0x14002c9a0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x120
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov r8d, dword [0x1401cbd80]
mov rsi, rdx
mov rbx, rcx
mov eax, r8d
imul eax, r8d
imul eax, r8d
and eax, 0x8000000f
jge 0x14002c9ea
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 0xa
jne 0x14002ca4c
mov rax, qword [str.zR3hhnoilScx9]
or r8, 0xffffffffffffffff
mov qword [rsp + 0x48], rax
mov eax, dword [0x140157878]
mov rcx, r8
mov dword [rsp + 0x50], eax
movzx eax, word [0x14015787c]
mov word [rsp + 0x54], ax
lea rax, [rsp + 0x48]
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x14002ca20
mov eax, 4
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400d0cc8
mov rcx, rax
call fcn.1400d272c
mov r8d, dword [0x1401cbd80]
lea ecx, [r8 + 1]
mov eax, 0x38e38e39
xor dil, dil
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 4
jne 0x14002cb1a
xor edx, edx
nop word [rax + rax]
mov ecx, edx
mov eax, edx
inc edx
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, r8d
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, r8d
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, r8d
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, r8d
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, r8d
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, r8d
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, r8d
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, r8d
xor eax, ecx
add r8d, eax
cmp edx, 0x100
jl 0x14002ca80
mov dword [0x1401cbd80], r8d
imul r8d, r8d
mov eax, 0xb21642c9
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 0x11
jne 0x14002cb4a
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea r8d, [r9 + 2]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002cc73
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [0x1401cbd80]
mov eax, 0x66666667
mov r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 6
jne 0x14002cc2b
mov eax, 0x3e0f83e1
xor r8d, r8d
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x84
sub eax, edx
cmp eax, 0x72
je 0x14002cc24
nop word [rax + rax]
mov eax, ecx
inc r8d
or eax, 0xffffffb8
add ecx, eax
mov eax, ecx
imul eax, ecx
cmp r8d, eax
jg 0x14002cc24
mov eax, 0x3e0f83e1
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x84
sub eax, edx
cmp eax, 0x72
jne 0x14002cbf0
mov dword [0x1401cbd80], r8d
mov rdx, qword [rsi]
mov dword [rsp + 0x40], 0
lea r9, [rsp + 0x40]
mov r8d, dword [rdx - 0x10]
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002cc6a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dil, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, dil
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1400d1680
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret