Function at 0x140088720
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov rbp, rsp
mov r9, rdx
mov eax, dword [0x141dcf2d0]
sub eax, dword [0x141dcf2d4]
mov rsi, rcx
and eax, 0x69af18b9
add eax, 0xf3afed00
cmp eax, 0x31fb2f68
jbe 0x14008878e
xor eax, eax
call fcn.1400f07c0
sub rsp, rax
mov eax, 0x30
call fcn.1400f07c0
sub rsp, rax
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov rax, rsp
movups xmm0, xmmword [0x141dba820]
movups xmmword [rax], xmm0
mov ecx, 0xffffffff
movups xmm0, xmmword [0x141dba820]
nop word [rax + rax]
mov eax, dword [0x141dcf2d8]
xor edx, edx
div dword [0x141dcf2dc]
imul edx, eax, 0x80443270
add edx, 0x5e7e5c35
xor eax, eax
call fcn.1400f07c0
sub rsp, rax
mov r14, rsp
mov eax, 0x30
call fcn.1400f07c0
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov rbx, rsp
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov r15, rsp
cmp r8, rcx
mov eax, 0xffffffff
cmovb rax, r8
movups xmmword [r15], xmm0
cmp edx, 0x4e27631
jb 0x1400887a0
sub rsp, 0x50
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r15
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
add rsp, 0x50
nop
mov ecx, dword [0x141dcf2e0]
or ecx, dword [0x141dcf2e4]
add ecx, 0x4a0f1e2b
xor ecx, 0xb4fe1dac
cmp ecx, 0x12d4faf5
jb 0x140088840
cmp eax, 0x103
jne 0x14008891c
nop dword [rax + rax]
mov eax, dword [0x141dcf2e8]
imul eax, dword [0x141dcf2ec]
add eax, 0x22c9b973
or eax, 0x282deded
xor eax, 0x983e70eb
cmp eax, 0x9e078d44
jb 0x140088870
mov eax, dword [0x141dcf2f0]
and eax, dword [0x141dcf2f4]
or eax, 0x3a232fa7
add eax, 0x75fe1e8d
imul rcx, rax, 0x41151d5
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
cmp eax, 0xe552af05
ja 0x1400888f6
mov eax, dword [0x141dcf2f8]
add eax, dword [0x141dcf2fc]
imul r12d, eax, 0xe85e19e1
sub rsp, 0x20
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x20
cmp r12d, 0xb69efe38
jne 0x14008890e
sub rsp, 0x20
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x20
jmp 0x1400888c4
mov eax, dword [r15]
cmp eax, 0x103
je 0x140088a47
test eax, eax
js 0x140088989
mov eax, dword [0x141dcf330]
xor eax, dword [0x141dcf334]
imul eax, eax, 0xbab96d43
add eax, 0xb3e393dd
and eax, 0xfc277fd5
cmp eax, 0xcec7f75
jb 0x140088920
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140088950
mov rcx, qword [r15 + 8]
xor r8d, r8d
nop dword [rax + rax]
mov eax, dword [str.:px_]
xor edx, edx
div dword [0x141dcf33c]
xor eax, 0x25150000
or eax, 0x801649
and eax, 0xad9d1649
cmp eax, 0xf5a99983
ja 0x140088960
jmp 0x140088a10
sub rsp, 0x20
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
add rsp, 0x20
movsxd rcx, eax
shl rcx, 0x20
mov eax, dword [0x141dcf318]
and eax, dword [0x141dcf31c]
or eax, 0xd43cfd66
add eax, 0xe7731fd5
or eax, 0x48c81f02
cmp eax, 0x1db6ebf2
je 0x1400889a0
mov eax, dword [0x141dcf320]
xor edx, edx
div dword [0x141dcf324]
mov eax, 0xa5510dd9
or rcx, 2
nop dword [rax]
mov edx, dword [0x141dcf328]
and edx, dword [0x141dcf32c]
imul edx, edx, 0x3707d9d0
imul rdx, rax
shr rdx, 0x3f
cmp edx, 0x8c121441
je 0x1400889e0
mov r8d, 1
nop dword [rax + rax]
mov eax, dword [0x141dcf340]
add eax, dword [0x141dcf344]
and eax, 0x77fe6658
xor eax, 0x7a5337d4
imul eax, eax, 0x5a99aa8f
cmp eax, 0xc62769f2
ja 0x140088a10
mov rax, r8
mov rdx, rcx
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov dword [rbx], 0
mov byte [rbx + 4], 0
lea rax, [0x141dba880]
mov qword [rdi], rax
mov qword [rdi + 8], 1
mov qword [rdi + 0x20], 0
xor eax, eax
test al, al
je 0x140088a90
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 0
sub rsp, 0x20
mov rcx, rbx
mov rdx, rdi
call fcn.1400893a0
add rsp, 0x20
mov eax, dword [0x141dcf300]
sub eax, dword [0x141dcf304]
imul r15d, eax, 0x6ee8fe58
or r15d, 0x836a44de
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 0
sub rsp, 0x20
mov rcx, rbx
mov rdx, rdi
call fcn.1400893a0
add rsp, 0x20
cmp r15d, 0x4416b86b
je 0x140088a90
mov rsi, rax
mov eax, dword [0x141dcf308]
sub eax, dword [0x141dcf30c]
and eax, 0x79597673
imul eax, eax, 0x10441164
cmp eax, 0x56c52808
jne 0x140088b10
sub rsp, 0x20
mov rcx, rsi
call fcn.1400897c0
add rsp, 0x20
mov ecx, 7
int 0x29
nop word [rax + rax]
mov edi, dword [0x141dcf310]
xor edi, dword [0x141dcf314]
add edi, 0x865f8d94
or edi, 0x6f9e8fdb
sub rsp, 0x20
mov rcx, rsi
call fcn.1400897c0
add rsp, 0x20
mov ecx, 7
int 0x29
cmp edi, 0xcafc1f3c
jb 0x140088b10
ud2