Function at 0x180145ac0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [rcx + 0x90]
mov r10, rdx
mov r12, r9
mov r13, r8
mov rdi, rcx
xor r15d, r15d
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r10
call rax
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x180145bfb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm0, xmmword [0x180161f70]
lea rdx, [rbp - 0x79]
movdqa xmm1, xmmword [0x180161e40]
lea rcx, [rbp - 1]
mov ebx, eax
movabs rax, 0x8488351c950cfdf5
mov qword [rbp - 0x49], rax
movabs rax, 0xffd248db3b5cd2f8
mov qword [rbp - 0x41], rax
movabs rax, 0x2b7ae7f98d26cfe2
movdqu xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x39], rax
movdqa xmm0, xmmword [0x180160530]
movdqu xmmword [rbp - 0x69], xmm1
movdqu xmmword [rbp - 0x59], xmm0
call fcn.18000a020
mov r9d, ebx
lea r8, [rbp - 0x31]
mov edx, 0x100000
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x31], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x21], xmm0
movsd xmm1, qword [rax + 0x20]
movsd qword [rbp - 0x11], xmm1
mov ecx, dword [rax + 0x28]
mov dword [rbp - 9], ecx
lea rcx, [0x18017bd90]
movzx eax, word [rax + 0x2c]
mov word [rbp - 5], ax
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, ebx
jmp 0x180145f51
mov rax, qword [rdi + 0x88]
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x128], r14
call rax
mov r14d, eax
cmp eax, 0xffffffff
jne 0x180145cfb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm0, xmmword [0x1801615a0]
lea rdx, [rbp - 0x79]
movdqa xmm1, xmmword [0x180162170]
movabs rcx, 0xf6b6e887461db0fc
movdqu xmmword [rbp - 0x79], xmm0
movabs r9, 0x7fe2cc93ac8b5cc3
movabs r8, 0x4ee67dc5cf142626
movdqa xmm0, xmmword [0x180160570]
mov ebx, eax
mov qword [rbp - 0x39], rcx
lea rcx, [rbp - 1]
movdqu xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x49], r9
movdqu xmmword [rbp - 0x69], xmm1
mov qword [rbp - 0x41], r8
call fcn.18000a020
mov r9d, ebx
lea r8, [rbp - 0x31]
mov edx, 0x100000
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x31], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x21], xmm0
movsd xmm1, qword [rax + 0x20]
movsd qword [rbp - 0x11], xmm1
mov ecx, dword [rax + 0x28]
mov dword [rbp - 9], ecx
lea rcx, [0x18017bd90]
movzx eax, word [rax + 0x2c]
mov word [rbp - 5], ax
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [rdi + 0xa8]
mov eax, ebx
jmp 0x180145f49
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
jne 0x180145e20
movdqa xmm0, xmmword [0x180161510]
movabs rcx, 0xf6b6e887461db0fc
movdqa xmm1, xmmword [0x1801618f0]
movabs r9, 0x7fe2cc93ac8b5cc3
movdqu xmmword [rbp - 0x79], xmm0
movabs r8, 0x4ee67dc5cf142626
mov qword [rbp - 0x49], r9
movdqa xmm0, xmmword [0x180160880]
xor edx, edx
movdqu xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], r8
mov rax, rcx
movdqu xmmword [rbp - 0x69], xmm1
mov qword [rbp - 0x39], rcx
nop dword [rax]
nop dword [rax + rax]
imul rax, rcx
add r8, r9
add rax, r8
mov rcx, rax
shl rax, 0x20
shr rcx, 0x20
or rcx, rax
movzx eax, cl
xor al, byte [rbp + rdx - 0x79]
mov byte [rbp + rdx - 1], al
inc rdx
mov rax, rcx
cmp rdx, 0x2f
jb 0x180145d80
movups xmm0, xmmword [rbp - 1]
mov byte [rbp + 0x2e], 0
lea r8, [rbp - 0x31]
movups xmm1, xmmword [rbp + 0xf]
mov edx, 0x100000
lea rcx, [0x18017bd90]
movups xmmword [rbp - 0x31], xmm0
movups xmm0, xmmword [rbp + 0x1f]
movups xmmword [rbp - 0x21], xmm1
movups xmmword [rbp - 0x11], xmm0
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [rdi + 0xa8]
mov eax, 0x7a
jmp 0x180145f49
mov rax, qword [rdi + 0x98]
lea r9, [rbp + 0x67]
xor ecx, ecx
mov r8d, r14d
mov dword [rbp + 0x67], ecx
mov rdx, r15
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call rax
test eax, eax
jne 0x180145f36
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm0, xmmword [0x180161b80]
lea rdx, [rbp - 0x79]
movdqa xmm1, xmmword [0x1801620e0]
lea rcx, [rbp - 0x31]
mov ebx, eax
movabs rax, 0x231b6e12be0bcbc9
mov qword [rbp - 0x49], rax
movabs rax, 0x10d28d7dd9a16e36
mov qword [rbp - 0x41], rax
movabs rax, 0x29d2a59a3045c2fe
movdqu xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x39], rax
movdqa xmm0, xmmword [0x180160740]
movdqu xmmword [rbp - 0x69], xmm1
movdqu xmmword [rbp - 0x59], xmm0
call fcn.180005380
mov r9d, ebx
lea r8, [rbp - 1]
mov edx, 0x100000
movups xmm2, xmmword [rax]
movups xmmword [rbp - 1], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf], xmm0
movsd xmm1, qword [rax + 0x20]
movsd qword [rbp + 0x1f], xmm1
mov ecx, dword [rax + 0x28]
mov dword [rbp + 0x27], ecx
movzx ecx, word [rax + 0x2c]
mov word [rbp + 0x2b], cx
lea rcx, [0x18017bd90]
movzx eax, byte [rax + 0x2e]
mov byte [rbp + 0x2d], al
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [rdi + 0xa8]
mov rcx, r15
call fcn.180146f60
mov eax, ebx
jmp 0x180145f49
mov rcx, rsi
mov qword [r13], r15
mov dword [r12], r14d
call qword [rdi + 0xa8]
xor eax, eax
mov r14, qword [rsp + 0x128]
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret