Function at 0x180143e70
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rdi
lea rbp, [rsp - 0x58]
sub rsp, 0x158
mov rdi, rcx
test rdx, rdx
jne 0x180143e9c
xor eax, eax
add rsp, 0x158
pop rdi
pop rbp
ret
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], rsi
mov rsi, qword [rdx + 8]
mov qword [rsp + 0x148], r14
mov r14d, dword [rdx]
mov qword [rsp + 0x140], r15
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r14 + 0xc]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x180143ef3
mov rcx, rsi
call qword [rdi + 0xf8]
xor eax, eax
jmp 0x1801442f9
lea rcx, [rax + 0xc]
mov qword [rsp + 0x150], r12
mov r8, r14
mov dword [rax], 0x4d42444b
mov rdx, rsi
mov dword [rax + 4], 1
mov dword [rax + 8], r14d
call fcn.18014af30
mov rcx, rsi
call qword [rdi + 0xf8]
mov rax, qword [rdi + 0x158]
lea rdx, [0x18015f220]
xor r12d, r12d
lea rcx, [rbp + 0x88]
xor r9d, r9d
mov qword [rbp + 0x88], r12
xor r8d, r8d
call rax
mov r9d, eax
test eax, eax
jns 0x180144068
movdqa xmm0, xmmword [0x180161db0]
movabs rcx, 0xba45525d99e91831
movdqa xmm1, xmmword [0x180162180]
movabs r10, 0xf5d06b73146ce1d
movdqu xmmword [rsp + 0x50], xmm0
movabs r8, 0xc0bc83244ed08cac
mov qword [rbp - 0x70], r10
movdqa xmm0, xmmword [0x180160ec0]
mov edx, r12d
movdqu xmmword [rsp + 0x60], xmm1
mov rax, rcx
mov qword [rbp - 0x68], r8
movdqa xmm1, xmmword [0x180160450]
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x60], rcx
movdqu xmmword [rbp - 0x80], xmm1
nop dword [rax]
imul rax, rcx
add r8, r10
add rax, r8
mov rcx, rax
shl rax, 0x20
shr rcx, 0x20
or rcx, rax
movzx eax, cl
xor al, byte [rsp + rdx + 0x50]
mov byte [rbp + rdx - 0x50], al
inc rdx
mov rax, rcx
cmp rdx, 0x3b
jb 0x180143fc0
movups xmm0, xmmword [rbp - 0x50]
mov byte [rbp - 0x15], r12b
lea r8, [rbp - 8]
movups xmm1, xmmword [rbp - 0x40]
mov eax, dword [rbp - 0x18]
lea rcx, [0x18017bd90]
movups xmmword [rbp - 8], xmm0
mov edx, 0x100000
mov dword [rbp + 0x30], eax
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rbp + 8], xmm1
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbp + 0x18], xmm0
movsd qword [rbp + 0x28], xmm1
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call fcn.180146f60
xor eax, eax
jmp 0x1801442f1
mov rax, qword [rdi + 0x160]
lea r8, str.ChainingModeGCM
mov rcx, qword [rbp + 0x88]
lea rdx, str.ChainingMode
mov r9d, 8
mov dword [rsp + 0x20], r12d
call rax
mov r15d, eax
test eax, eax
jns 0x18014418c
movdqa xmm0, xmmword [0x180161470]
lea rdx, [rsp + 0x50]
movdqa xmm1, xmmword [0x180161700]
lea rcx, [rbp - 0x50]
xor eax, eax
mov byte [rbp - 0x80], 0x2a
mov dword [rbp - 0x7f], eax
mov word [rbp - 0x7b], ax
mov byte [rbp - 0x79], al
movabs rax, 0x53a4a43623c65917
mov qword [rbp - 0x78], rax
movabs rax, 0x2ea5818e5c665640
mov qword [rbp - 0x70], rax
movabs rax, 0xd8e85bd0980c611d
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rbp - 0x68], rax
movdqa xmm0, xmmword [0x180160fe0]
movdqu xmmword [rsp + 0x60], xmm1
movdqu xmmword [rsp + 0x70], xmm0
call fcn.18000c9f0
mov r9d, r15d
lea r8, [rbp - 8]
mov edx, 0x100000
lea rcx, [0x18017bd90]
movups xmm2, xmmword [rax]
movups xmmword [rbp - 8], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp + 0x18], xmm1
movzx eax, word [rax + 0x30]
mov word [rbp + 0x28], ax
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 0x88]
xor edx, edx
call qword [rdi + 0x170]
mov rcx, rbx
call fcn.180146f60
xor eax, eax
jmp 0x1801442f1
mov r10, qword [rdi + 0x148]
lea eax, [r14 + 0xc]
mov rcx, qword [rbp + 0x88]
lea r9, [rbp + 0x80]
mov dword [rsp + 0x40], r12d
lea r8, str.KeyDataBlob
mov dword [rsp + 0x38], eax
xor edx, edx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov qword [rbp + 0x80], r12
call r10
mov rcx, qword [rbp + 0x88]
xor edx, edx
mov r14d, eax
call qword [rdi + 0x170]
mov rcx, rbx
call fcn.180146f60
test r14d, r14d
je 0x1801442ea
movdqa xmm0, xmmword [0x180161480]
lea rdx, [rsp + 0x50]
movdqa xmm1, xmmword [0x1801617a0]
lea rcx, [rbp - 8]
movabs rax, 0x53a4a43623c65917
mov dword [rbp - 0x70], 0x7031a575
mov qword [rbp - 0x68], rax
movabs rax, 0x2ea5818e5c665640
mov qword [rbp - 0x60], rax
movabs rax, 0xd8e85bd0980c611d
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rbp - 0x58], rax
movdqa xmm0, xmmword [0x180160c00]
movdqu xmmword [rsp + 0x60], xmm1
mov dword [rbp - 0x6c], 0x9f04
movdqa xmm1, xmmword [str.y:M_]
movdqu xmmword [rsp + 0x70], xmm0
movdqu xmmword [rbp - 0x80], xmm1
call fcn.18000c770
mov r9, rsi
mov dword [rsp + 0x20], r14d
lea r8, [rbp - 0x50]
mov edx, 0x100000
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x50], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 0x30], xmm1
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rbp - 0x20], xmm0
mov ecx, dword [rax + 0x40]
mov dword [rbp - 0x10], ecx
movzx ecx, word [rax + 0x44]
mov word [rbp - 0xc], cx
lea rcx, [0x18017bd90]
movzx eax, byte [rax + 0x46]
mov byte [rbp - 0xa], al
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rbp + 0x80]
mov r12, qword [rsp + 0x150]
mov r14, qword [rsp + 0x148]
mov rsi, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x170]
mov r15, qword [rsp + 0x140]
add rsp, 0x158
pop rdi
pop rbp
ret