Function at 0x140141990
Capabilities:
Encode data using base64
Encode data using xor
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov rbp, rsp
mov r14, rcx
mov eax, dword [0x1415c1678]
mov ecx, dword [0x1415c167c]
mov r9d, eax
xor r9d, ecx
not r9d
and r9d, ecx
add r9d, r9d
sub ecx, r9d
add ecx, eax
or ecx, 0xcff4fa24
imul eax, ecx, 0xf4938a52
mov ecx, eax
not ecx
mov r9d, eax
and r9d, 0x768794d8
and ecx, 0x89786b27
imul ecx, r9d
mov r9d, eax
and r9d, 0x89786b26
or eax, 0x89786b27
imul eax, r9d
add eax, ecx
cmp eax, 0xb9d2a05c
ja 0x140141a33
xor ecx, ecx
xor eax, eax
call fcn.14021cf50
sub rsp, rax
mov r15, rsp
mov eax, 0x30
call fcn.14021cf50
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.14021cf50
sub rsp, rax
mov rdi, rsp
test cl, cl
je 0x140141a59
xor eax, eax
call fcn.14021cf50
sub rsp, rax
mov eax, 0x30
call fcn.14021cf50
sub rsp, rax
mov eax, 0x10
call fcn.14021cf50
sub rsp, rax
jmp 0x140141a00
mov eax, 0x10
call fcn.14021cf50
sub rsp, rax
mov r12, rsp
movups xmm0, xmmword [0x14159ec18]
movups xmmword [r12], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
sub rsp, 0x50
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov rcx, r14
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
add rsp, 0x50
mov ebx, eax
cmp eax, 0x103
jne 0x140141b50
sub rsp, 0x20
mov rcx, r14
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x20
mov ebx, dword [r12]
nop word [rax + rax]
mov eax, dword [0x1415c1680]
and eax, dword [0x1415c1684]
add eax, 0xbe81ace1
mov ecx, eax
and ecx, 0xa36090b3
or eax, 0xa36090b3
add eax, ecx
xor eax, 0x5d0a8266
cmp eax, 0x8db4303d
ja 0x140141ae0
nop dword [rax]
mov eax, dword [0x1415c1688]
sub eax, dword [0x1415c168c]
xor eax, 0x5af00977
add eax, 0xaf871b72
mov ecx, eax
xor ecx, 0x322861c1
or eax, 0xcdd79e3e
and eax, ecx
cmp eax, 0x40db3d94
je 0x140141b10
cmp ebx, 0x103
je 0x140141cec
nop dword [rax + rax]
mov eax, dword [0x1415c16c0]
mov ecx, dword [0x1415c16c4]
not eax
not ecx
or ecx, eax
not ecx
add ecx, 0x22b059c7
mov eax, ecx
and eax, 0x329bc062
or ecx, 0x329bc062
add ecx, eax
xor ecx, 0x246e9b62
cmp ecx, 0xbeece373
ja 0x140141b50
test ebx, ebx
js 0x140141c01
nop dword [rax + rax]
mov eax, dword [0x1415c16e0]
sub eax, dword [0x1415c16e4]
and eax, 0x15503a21
imul eax, eax, 0xf9dbcb29
add eax, 0x735d9e22
cmp eax, 0x95055462
jb 0x140141b90
mov ecx, 0x86f772d1
xor eax, eax
nop word [rax + rax]
mov edx, dword [0x1415c16e8]
mov r8d, dword [0x1415c16ec]
not edx
not r8d
or r8d, edx
not r8d
imul r8, rcx
shr r8, 0x3d
add r8d, 0xcb8c51b3
xor r8d, 0xc57cc897
cmp r8d, 0xe028ab34
ja 0x140141bc0
mov rdx, qword [r12 + 8]
jmp 0x140141cde
mov eax, dword [0x1415c16c8]
mov ecx, eax
not ecx
or ecx, dword [0x1415c16cc]
add eax, ecx
inc eax
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x94771007
and ecx, 0x6b88eff8
imul ecx, edx
mov edx, eax
and edx, 0x6b88eff8
or eax, 0x6b88eff8
imul eax, edx
add eax, ecx
add eax, 0xb50e5a80
cmp eax, 0x833d0ff3
jae 0x140141c57
sub rsp, 0x20
mov ecx, ebx
call fcn.14021ba80
add rsp, 0x20
mov rsi, qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop
mov eax, dword [0x1415c16d0]
xor eax, dword [0x1415c16d4]
add eax, 0x6f68ef7c
mov ecx, eax
not ecx
or ecx, 0xa28774b6
lea edi, [rcx + rax]
add edi, 0x64649c0a
sub rsp, 0x20
mov ecx, ebx
call rsi
add rsp, 0x20
cmp edi, 0xc3111a03
ja 0x140141c60
mov edx, eax
shl rdx, 0x20
or rdx, 2
nop word cs:[rax + rax]
mov eax, dword [0x1415c16d8]
xor eax, dword [0x1415c16dc]
add eax, 0xafb4d8f8
imul rax, rax, 0x9a9f563
shr rax, 0x3b
imul eax, eax, 0xb1b12dc5
cmp eax, 0x9ee4bc68
ja 0x140141cb0
mov eax, 1
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x1415c1690]
add eax, dword [0x1415c1694]
mov ecx, eax
and ecx, 0x125ca5e0
add ecx, ecx
sub eax, ecx
add eax, 0x925ca5e0
mov ecx, eax
not ecx
and ecx, 0x15ed4b40
mov edx, eax
and edx, 0xea12b4bf
imul edx, ecx
mov ecx, eax
and ecx, 0x15ed4b40
or eax, 0x15ed4b40
imul eax, ecx
add eax, edx
xor eax, 0xd381a65
cmp eax, 0x209573e8
jb 0x140141d88
mov eax, dword [0x1415c1698]
mov ecx, dword [0x1415c169c]
not eax
not ecx
and ecx, eax
not ecx
mov eax, 0xca6c965f
imul rax, rcx
shr rax, 0x3f
imul eax, eax, 0x5a1d6315
imul rcx, rax, 0xa92fb55
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
mov dword [rdi], 0
mov byte [rdi + 4], 0
cmp eax, 0x3f8998b3
jne 0x140141d94
mov dword [rdi], 0
mov byte [rdi + 4], 0
jmp 0x140141d3c
mov eax, dword [0x1415c16a0]
xor eax, dword [0x1415c16a4]
imul rcx, rax, 0xb4f7be5
shr rcx, 0x3b
or ecx, 0xf17e7342
lea rax, [0x14159ec78]
cmp ecx, 0x20532c87
jae 0x140141de0
mov qword [rsi], rax
mov qword [rsi + 8], 1
mov qword [rsi + 0x20], 0
mov qword [rsi + 0x10], r15
nop word [rax + rax]
mov ecx, dword [0x1415c16a8]
imul ecx, dword [0x1415c16ac]
add ecx, 0xf27116e5
mov edx, ecx
and edx, 0xf79e9562
or ecx, 0xf79e9562
add ecx, edx
imul ecx, ecx, 0x5bd0b5ff
mov qword [rsi], rax
mov qword [rsi + 8], 1
mov qword [rsi + 0x20], 0
mov qword [rsi + 0x10], r15
cmp ecx, 0xfb1ab5f5
je 0x140141de0
mov eax, dword [0x1415c16b0]
xor edx, edx
div dword [0x1415c16b4]
mov ecx, eax
xor ecx, 0xea8
add ecx, eax
and eax, 0x157
sub ecx, eax
and ecx, 0x850
cmp ecx, 0x407b75b7
ja 0x140141ee8
mov eax, dword [0x1415c16b8]
mov ecx, dword [str.36]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
or eax, 0xfcc26c8
imul ebx, eax, 0x4990bc82
mov eax, ebx
not eax
mov ecx, ebx
and ecx, 0x55de52ca
and eax, 0xaa21ad34
imul eax, ecx
mov ecx, ebx
and ecx, 0xaa21ad34
or ebx, 0xaa21ad34
imul ebx, ecx
add ebx, eax
mov qword [rsi + 0x18], 0
sub rsp, 0x20
mov rcx, rdi
mov rdx, rsi
call fcn.140142c60
mov rcx, rax
call fcn.140143250
add rsp, 0x20
mov ecx, 7
int 0x29
cmp ebx, 0xe9e4fe91
jbe 0x140141f17
mov qword [rsi + 0x18], 0
sub rsp, 0x20
mov rcx, rdi
mov rdx, rsi
call fcn.14021b6a0
mov rcx, rax
call fcn.14021acc0
add rsp, 0x20
mov ecx, 7
int 0x29
jmp 0x140141e59
ud2