Function at 0x1400878d0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
movaps xmmword [rbp - 0x10], xmm7
movaps xmmword [rbp - 0x20], xmm6
mov r9, r8
mov rdi, rdx
mov eax, dword [0x141dcd648]
sub eax, dword [0x141dcd64c]
xor eax, 0x1040000
or eax, 0xbc73dd7c
and eax, 0xbf7fdf7c
cmp eax, 0x427b601f
jae 0x140087940
xor eax, eax
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
nop dword [rax]
mov eax, dword [0x141dcd650]
and eax, dword [0x141dcd654]
imul eax, eax, 0x4131384e
xor eax, 0xab005861
imul edx, eax, 0x4489085
xor eax, eax
call fcn.1400eeec0
sub rsp, rax
mov r10, rsp
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov r14, rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r15, rsp
cmp edx, 0xb30453dd
je 0x140087940
mov qword [rbp - 0x28], r10
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov rbx, rsp
mov eax, dword [0x141dcd658]
xor eax, dword [0x141dcd65c]
xor eax, 0x84128c12
or eax, 0x5aa473e5
cmp eax, 0x2783209f
jne 0x140087a11
movups xmm0, xmmword [0x141db8600]
movups xmmword [rbx], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
sub rsp, 0x50
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
xor edx, edx
mov r12, rcx
xor r8d, r8d
mov rsi, r9
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov r9, rsi
mov rcx, r12
add rsp, 0x50
movups xmm6, xmmword [0x141db8600]
xorps xmm7, xmm7
nop dword [rax + rax]
mov eax, dword [0x141dcd660]
xor edx, edx
div dword [0x141dcd664]
mov r13d, eax
add r13d, 0xc452840e
or r13d, 0xdb45582c
xor r13d, 0x27769dd2
movups xmmword [rbx], xmm6
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
sub rsp, 0x50
movups xmmword [rsp + 0x38], xmm7
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
xor edx, edx
mov r12, rcx
xor r8d, r8d
mov rsi, r9
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov r9, rsi
mov rcx, r12
add rsp, 0x50
cmp r13d, 0x47ace4da
jb 0x140087a20
mov r12d, eax
cmp eax, 0x103
jne 0x140087b05
sub rsp, 0x20
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x20
mov eax, dword [0x141dcd668]
sub eax, dword [0x141dcd66c]
imul rax, rax, 0x7915fbd9
shr rax, 0x37
xor eax, 0x15a01395
and eax, 0x15a013b5
cmp eax, 0x6d936330
ja 0x140087ab0
mov r12d, dword [rbx]
nop dword [rax + rax]
mov eax, dword [0x141dcd670]
or eax, dword [0x141dcd674]
add eax, 0x2470743b
cmp eax, 0xdad6ff44
ja 0x140087ae0
cmp r12d, 0x103
je 0x140087b83
test r12d, r12d
js 0x140087b58
nop word [rax + rax]
mov eax, dword [0x141dcd6a0]
xor eax, dword [0x141dcd6a4]
or eax, 0xfd42d4c
cmp eax, 0xd67bbdd
je 0x140087b10
xor eax, eax
nop word [rax + rax]
mov ecx, dword [0x141dcd6a8]
sub ecx, dword [0x141dcd6ac]
imul rcx, rcx, 0x4357527d
shr rcx, 0x36
cmp ecx, 0xbd04114c
je 0x140087b30
mov rcx, qword [rbx + 8]
jmp 0x140087c90
mov eax, dword [0x141dcd678]
add eax, dword [0x141dcd67c]
shr eax, 2
imul rax, rax, 0x25ccb351
shr rax, 0x3b
add eax, 0xb1c6233b
cmp eax, 0xa875ef37
jae 0x140087bd5
jmp 0x140087c0d
mov dword [r15], 0
mov byte [r15 + 4], 0
lea rax, [0x141db8660]
mov qword [r14], rax
mov qword [r14 + 8], 1
mov rax, qword [rbp - 0x28]
mov qword [r14 + 0x10], rax
xorps xmm0, xmm0
movups xmmword [r14 + 0x18], xmm0
sub rsp, 0x20
mov rcx, r15
mov rdx, r14
call fcn.1400881b0
mov rcx, rax
call fcn.1400884c0
add rsp, 0x20
mov ecx, 7
int 0x29
ud2
mov eax, dword [0x141dcd680]
imul eax, dword [0x141dcd684]
imul esi, eax, 0xfbe147eb
xor esi, 0x80e40485
or esi, 0x771bfb0a
sub rsp, 0x20
mov ecx, r12d
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
add rsp, 0x20
cmp esi, 0x90915c7e
jbe 0x140087c20
sub rsp, 0x20
mov ecx, r12d
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
add rsp, 0x20
jmp 0x140087bd5
movsxd rcx, eax
mov eax, dword [0x141dcd688]
xor edx, edx
div dword [0x141dcd68c]
shl rcx, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dcd690]
sub eax, dword [0x141dcd694]
add eax, 0x3a74b2f
or eax, 0xffbffdfe
cmp eax, 0x3e6b5771
jb 0x140087c40
or rcx, 2
nop word cs:[rax + rax]
mov eax, dword [0x141dcd698]
xor edx, edx
div dword [0x141dcd69c]
imul eax, eax, 0xf4606220
cmp eax, 0xe3d5c1c2
je 0x140087c70
mov eax, 1
mov rdx, rcx
movaps xmm6, xmmword [rbp - 0x20]
movaps xmm7, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret