Function at 0x1800027a0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x60
mov rax, qword [0x180062020]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [0x180064be8]
mov rdi, rdx
mov qword [rsp + 0x80], rbp
mov ebp, dword [rax]
or ebp, 2
cmp ecx, 8
cmovne ebp, dword [rax]
xor r15d, r15d
mov rax, qword [0x180064be0]
test rax, rax
je 0x180002890
cmp dword [rax], r15d
je 0x180002890
mov ecx, dword [0x180063e9c]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x180064cb4], ecx
jle 0x18000284e
lea rcx, [0x180064cb4]
call fcn.1800185f0
cmp dword [0x180064cb4], 0xffffffff
jne 0x18000284e
mov rdx, qword [0x180064be0]
lea rcx, [0x180064cb4]
movzx eax, byte [rdx + 1]
sub al, byte [rdx + 3]
sub al, byte [rdx + 2]
add al, byte [rdx]
mov byte [0x180064b94], al
call fcn.180018590
movzx ecx, word [rdi]
mov rbx, rdi
mov rdx, rdi
test cx, cx
je 0x180002888
movzx r8d, byte [0x180064b94]
nop dword [rax]
nop dword [rax + rax]
xor cl, r8b
add rbx, 2
mov byte [rdx], cl
lea rdx, [rdx + 1]
movzx eax, word [rbx]
movzx ecx, al
test ax, ax
jne 0x180002870
sub rbx, rdi
sar rbx, 1
jmp 0x180002893
mov ebx, r15d
test bpl, 1
je 0x1800028a2
mov rcx, rdi
call qword [0x180048180]
mov qword [rsp + 0x90], rsi
test bpl, 2
je 0x18000293f
mov rsi, qword [0x180064bf0]
mov rcx, qword [rsi]
test rcx, rcx
jne 0x1800028f8
mov eax, dword [rsi + 8]
test eax, eax
jne 0x18000293f
mov eax, 1
lock xadd dword [rsi + 8], eax
inc eax
cmp eax, 1
jne 0x18000293f
mov rcx, rsi
call fcn.180003110
cmp qword [rsi], r15
je 0x18000293f
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call fcn.1800035c0
jmp 0x18000293f
test ebx, ebx
je 0x180002911
mov r9, rcx
movsxd r8, ebx
mov rcx, rdi
mov edx, 1
call fcn.18002811c
jmp 0x180002920
mov r8, rdi
lea rdx, [0x1800571f4]
call fcn.1800014d0
mov eax, 1
lock xadd dword [rsi + 0xc], eax
inc eax
cmp eax, 1
jne 0x18000293f
mov eax, r15d
xchg dword [rsi + 0xc], eax
mov rcx, qword [rsi]
call fcn.180023f70
mov rbx, 0xffffffffffffffff
test bpl, 4
je 0x1800029fa
mov rsi, qword [0x180064bf8]
mov rcx, qword [rsi]
cmp rcx, rbx
jne 0x1800029c0
call qword [0x180048090]
mov ecx, dword [rsi + 8]
add ecx, 0x2710
cmp eax, ecx
jbe 0x1800029fa
mov rcx, qword [rsi]
cmp rcx, rbx
jne 0x1800029c0
mov qword [rsp + 0x30], r15
lea r8d, [rbx + 8]
mov dword [rsp + 0x28], 0x80
lea rcx, str..GlobalProcmonDebugLogger
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [0x1800481e0]
mov qword [rsi], rax
call qword [0x180048090]
mov rcx, qword [rsi]
mov dword [rsi + 8], eax
cmp rcx, rbx
je 0x1800029fa
mov rax, rbx
cmp word [rdi + rax*2 + 2], r15w
lea rax, [rax + 1]
jne 0x1800029c3
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rdx
lea r9d, [rax + rax]
mov dword [rsp + 0x28], r15d
mov edx, 0x95358204
mov r8, rdi
mov qword [rsp + 0x20], r15
call qword [0x1800481f0]
test bpl, 8
mov rbp, qword [rsp + 0x80]
je 0x180002af2
mov rsi, qword [0x180064c00]
mov qword [rsp + 0x98], r14
cmp qword [rsi + 8], r15
jne 0x180002aab
lea rcx, str.Advapi32.dll
call qword [0x180048158]
mov qword [rsi], rax
test rax, rax
je 0x180002aab
lea rdx, str.EventRegister
mov rcx, rax
call qword [0x180048108]
mov rcx, qword [rsi]
lea rdx, str.EventUnregister
mov qword [rsi + 0x10], rax
call qword [0x180048108]
mov rcx, qword [rsi]
lea rdx, str.EventWrite
mov qword [rsi + 0x18], rax
call qword [0x180048108]
mov r10, qword [rsi + 0x10]
mov qword [rsi + 0x20], rax
test r10, r10
je 0x180002a9f
cmp qword [rsi + 0x18], r15
je 0x180002a9f
test rax, rax
je 0x180002a9f
lea r9, [rsi + 8]
xor r8d, r8d
xor edx, edx
lea rcx, [0x180058178]
call r10
jmp 0x180002aab
mov rcx, qword [rsi]
call qword [0x180048080]
mov qword [rsi], r15
mov rcx, qword [rsi + 8]
mov r14, qword [rsp + 0x98]
test rcx, rcx
je 0x180002af2
mov qword [rsp + 0x48], rdi
cmp word [rdi + rbx*2 + 2], r15w
lea rbx, [rbx + 1]
jne 0x180002ac1
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x54], r15d
lea r9, [rsp + 0x48]
mov dword [rsp + 0x50], eax
mov r8d, 1
lea rdx, [0x1800581b0]
call qword [rsi + 0x20]
mov rsi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180018470
add rsp, 0x60
pop r15
pop rdi
pop rbx
ret