Function at 0x18013b570
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rbx, r8
mov esi, 1
xor r12d, r12d
mov dword [rbp + 0x1d0], esi
xor r8d, r8d
mov qword [rbp + 0x1b8], r12
mov rdi, r9
mov r14, rcx
mov rdx, qword [rbx + 0x18]
call fcn.180143400
mov qword [rbp + 0x1c0], rax
mov r15, rax
test rax, rax
jne 0x18013b69d
movdqa xmm0, xmmword [0x180161880]
lea rdx, [rsp + 0x50]
movdqa xmm1, xmmword [0x1801622c0]
lea rcx, [rbp + 0x80]
movabs rax, 0x4863e3ae9c06d2f
mov dword [rsp + 0x70], 0x5786e52d
mov qword [rsp + 0x78], rax
movabs rax, 0x5c1b7809632d1a9c
mov qword [rbp - 0x80], rax
movabs rax, 0x1b53e4003077bf02
mov qword [rbp - 0x78], rax
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x74], 0x765cec0d
movdqu xmmword [rsp + 0x60], xmm1
call fcn.180010980
lea r8, [rbp - 0x48]
mov edx, 0x100000
lea rcx, [0x18017bd90]
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x48], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm0
movsd xmm1, qword [rax + 0x20]
movsd qword [rbp - 0x28], xmm1
movzx eax, byte [rax + 0x28]
mov byte [rbp - 0x20], al
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x18013bd1f
movdqa xmm0, xmmword [0x180160c70]
lea rdx, [rbp + 0x10]
movdqa xmm1, xmmword [0x180160d40]
lea rcx, [rbp + 0x110]
movdqu xmmword [rbp + 0x10], xmm0
movabs rax, 0x6adadc270a64e80c
mov qword [rsp + 0x2c8], r13
movdqa xmm0, xmmword [0x1801617d0]
movabs r13, 0x53a4a43623c65917
movdqu xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x70], rax
movabs rax, 0xd7a5ce30cb35674b
movdqa xmm0, xmmword [0x180161ce0]
movdqu xmmword [rbp + 0x20], xmm1
mov dword [rbp + 0x60], 0x1f86b181
movdqa xmm1, xmmword [0x180161630]
movdqu xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x64], 0x3bf906c5
movdqu xmmword [rbp + 0x40], xmm1
mov qword [rbp + 0x68], r13
mov qword [rbp + 0x78], rax
call fcn.180010cc0
lea r8, [rbp + 0x1b8]
mov rcx, r15
lea rdx, [rbp + 0xb0]
movups xmm2, xmmword [rax]
movups xmmword [rbp + 0xb0], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp + 0xd0], xmm1
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rbp + 0xf0], xmm1
movsd xmm0, qword [rax + 0x50]
movsd qword [rbp + 0x100], xmm0
movzx eax, byte [rax + 0x58]
mov byte [rbp + 0x108], al
call fcn.180142ef0
mov qword [rbp - 0x60], rax
mov r12, rax
test rax, rax
je 0x18013bcef
mov r9, qword [rbx + 0x28]
mov rcx, r14
mov r8, qword [rdi + 0x18]
call fcn.180145f80
mov qword [rbp - 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x18013bcef
mov rcx, qword [rbp + 0x1b8]
call fcn.180026520
movdqa xmm0, xmmword [0x180160a10]
lea rdx, [rsp + 0x50]
movdqa xmm1, xmmword [0x180161610]
lea rcx, [rbp - 0x48]
mov ebx, eax
mov word [rsp + 0x70], 0x43c
xor eax, eax
mov byte [rsp + 0x72], 0x52
mov dword [rsp + 0x73], eax
mov byte [rsp + 0x77], al
movabs rax, 0x6adadc270a64e80c
mov qword [rbp - 0x80], rax
movabs rax, 0xd7a5ce30cb35674b
mov qword [rbp - 0x78], rax
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x78], r13
movdqu xmmword [rsp + 0x60], xmm1
call fcn.180008f90
lea r8, [rbp + 0x80]
mov edx, 0x100000
lea rcx, [0x18017bd90]
movups xmm2, xmmword [rax]
movups xmmword [rbp + 0x80], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 0x90], xmm0
mov eax, dword [rax + 0x20]
mov dword [rbp + 0xa0], eax
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp ebx, 0x65
je 0x18013bce4
movabs rdi, 0xf1084821f64594e9
lea rsi, [0x18015f198]
lea r14, [0x18015f1a0]
cmp ebx, 0x64
jne 0x18013bccc
mov rbx, qword [rbp + 0x1b8]
mov edx, 6
mov rcx, rbx
call fcn.1800267e0
mov r9, rax
lea r8, [0x18015f1f0]
mov edx, 0x16
lea rcx, [rbp + 0x80]
call fcn.1800010e0
xor edx, edx
mov rcx, rbx
call fcn.180026830
test rax, rax
lea r15, [0x18015f0aa]
mov edx, 1
mov rcx, rbx
cmovne r15, rax
call fcn.180026830
test rax, rax
lea r12, [0x18015f0aa]
mov edx, 2
mov rcx, rbx
cmovne r12, rax
call fcn.180026830
test rax, rax
lea r13, [0x18015f0aa]
mov edx, 4
mov rcx, rbx
cmovne r13, rax
call fcn.1800267a0
test eax, eax
mov edx, 3
mov rcx, rbx
cmovne rsi, r14
mov qword [rbp + 8], rsi
call fcn.180026830
test rax, rax
lea rcx, [0x18015f0aa]
mov edx, 7
cmovne rcx, rax
mov qword [rbp - 0x58], rcx
mov rcx, rbx
call fcn.1800267a0
cmp eax, 0xffffffff
lea rax, [0x18015f198]
cmove r14, rax
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r14 + rax], 0
jne 0x18013b990
mov rdx, qword [rbp - 0x58]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdx + rcx], 0
jne 0x18013b9a5
add rax, rcx
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x18013b9c0
add rax, rcx
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rcx + r13], 0
jne 0x18013b9d3
add rax, rcx
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp byte [r12 + rcx], 0
jne 0x18013b9f0
add rax, rcx
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [r15 + rcx], 0
jne 0x18013ba04
add rax, rcx
lea rdx, [rbp + 0x80]
mov rcx, 0xffffffffffffffff
nop
cmp byte [rdx + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18013ba20
lea rsi, [rax + rcx]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsi + 0x1e]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x18013bbf0
mov rax, qword [rbp - 0x58]
lea r8, str._s_t_s_t_s_t_s_t_s_t_s_t_s_n
mov qword [rsp + 0x48], rax
lea rdx, [rsi + 0x1e]
mov qword [rsp + 0x40], r13
lea rax, [rbp + 0x80]
mov qword [rsp + 0x38], rax
mov r9, r15
mov rax, qword [rbp + 8]
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
call fcn.1800010e0
mov r14, qword [rbp + 0x1b0]
mov r9, rbx
mov r8, qword [rbp - 0x50]
mov rcx, r14
mov dword [rsp + 0x20], eax
call fcn.180146300
mov rcx, rbx
mov dword [rbp + 0x1d0], eax
mov esi, eax
call fcn.180146f60
test esi, esi
jne 0x18013bcb5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm0, xmmword [0x1801614c0]
movabs r8, 0xf5d06b73146ce1d
movdqa xmm1, xmmword [0x180160f30]
movabs rdx, 0x3166d599c42f3118
movdqu xmmword [rbp + 0x10], xmm0
mov r9d, eax
mov qword [rbp + 0x60], r8
movdqa xmm0, xmmword [str.gx_K]
xor ecx, ecx
movdqu xmmword [rbp + 0x30], xmm0
mov rax, rdi
mov qword [rbp + 0x68], rdx
movdqa xmm0, xmmword [0x180160310]
movdqu xmmword [rbp + 0x20], xmm1
mov qword [rbp + 0x70], rdi
movdqa xmm1, xmmword [0x180160aa0]
movdqu xmmword [rbp + 0x50], xmm0
movdqu xmmword [rbp + 0x40], xmm1
nop word [rax + rax]
imul rax, rdi
add rdx, r8
add rax, rdx
mov rdi, rax
shl rax, 0x20
shr rdi, 0x20
or rdi, rax
movzx eax, dil
xor al, byte [rbp + rcx + 0x10]
mov byte [rsp + rcx + 0x50], al
inc rcx
mov rax, rdi
cmp rcx, 0x49
jb 0x18013bb40
movups xmm0, xmmword [rsp + 0x50]
mov byte [rbp - 0x67], 0
lea r8, [rbp - 0x48]
movups xmm1, xmmword [rsp + 0x60]
movzx eax, word [rbp - 0x68]
lea rcx, [0x18017bd90]
movups xmmword [rbp - 0x48], xmm0
mov edx, 0x100000
mov word [rbp], ax
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rbp - 0x38], xmm1
movups xmm1, xmmword [rbp - 0x80]
movups xmmword [rbp - 0x28], xmm0
movsd xmm0, qword [rbp - 0x70]
movsd qword [rbp - 8], xmm0
movups xmmword [rbp - 0x18], xmm1
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x18013bcd9
movdqa xmm0, xmmword [0x180161130]
lea rdx, [rsp + 0x50]
movdqa xmm1, xmmword [0x180161180]
lea rcx, [rbp + 0x80]
movabs rax, 0xf5d06b73146ce1d
mov qword [rbp - 0x70], rdi
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rbp - 0x80], rax
movabs rax, 0x3166d599c42f3118
movdqa xmm0, xmmword [str.gQM]
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x78], rax
movdqu xmmword [rsp + 0x60], xmm1
call fcn.180004940
lea r8, [rbp - 0x48]
mov edx, 0x100000
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x48], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm0
movsd xmm1, qword [rax + 0x20]
movsd qword [rbp - 0x28], xmm1
movzx ecx, word [rax + 0x28]
mov word [rbp - 0x20], cx
lea rcx, [0x18017bd90]
movzx eax, byte [rax + 0x2a]
mov byte [rbp - 0x1e], al
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 0x1b8]
call fcn.180026520
mov ebx, eax
cmp eax, 0x65
jne 0x18013b8a4
mov r14, qword [rbp + 0x1b0]
mov esi, dword [rbp + 0x1d0]
mov r15, qword [rbp + 0x1c0]
mov r12, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x50]
call qword [r14 + 0xa8]
mov rcx, qword [rbp + 0x1b8]
mov r13, qword [rsp + 0x2c8]
test rcx, rcx
je 0x18013bd08
call fcn.180026a10
test r12, r12
je 0x18013bd15
mov rcx, r12
call fcn.180022770
mov rcx, r15
call fcn.180146f60
mov eax, esi
add rsp, 0x270
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret