Function at 0x1400b11b0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movaps xmmword [rbp - 0x10], xmm6
mov rbx, rdx
mov eax, dword [0x14021d788]
mov r9d, dword [0x14021d78c]
mov edx, eax
xor edx, r9d
not edx
or eax, r9d
and eax, edx
mov edx, eax
xor edx, 0x65085a8a
xor eax, 0x75ae5a8a
and edx, 0x6558deba
add edx, edx
sub edx, eax
add edx, 0x186704cc
cmp edx, 0x4d7b7a23
jae 0x1400b1220
xor eax, eax
call fcn.1401516e0
sub rsp, rax
nop word cs:[rax + rax]
mov r9d, dword [0x14021d790]
and r9d, dword [0x14021d794]
mov eax, r9d
not eax
and eax, 0x1b67d3ec
mov edx, r9d
and edx, 0xe4982c13
imul edx, eax
mov eax, r9d
and eax, 0x1b67d3ec
or r9d, 0x1b67d3ec
imul r9d, eax
add r9d, edx
and r9d, 0xd46de17c
xor r9d, 0x684069
xor eax, eax
call fcn.1401516e0
sub rsp, rax
mov r12, rsp
cmp r9d, 0x1aa09bfa
je 0x1400b1220
mov eax, dword [0x14021d798]
sub eax, dword [0x14021d79c]
mov edx, eax
xor edx, 0x41112000
xor eax, 0x481045
and eax, 0x48104d
and edx, 0x4111a100
or edx, eax
cmp edx, 0xc766bb1b
ja 0x1400b1349
mov eax, dword [0x14021d7a0]
add eax, dword [0x14021d7a4]
imul eax, eax, 0xea868c2
mov r10d, eax
and r10d, 0xe0d5a668
mov edx, r10d
not edx
and edx, 0x138007be
mov r9d, eax
and r9d, 0xe055a040
imul r9d, edx
and eax, 0x800628
or r10d, 0x138007be
imul r10d, eax
add r10d, r9d
mov eax, 0x30
call fcn.1401516e0
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov r13, rsp
mov esi, 0xffffffff
cmp r8, rsi
cmovb rsi, r8
movups xmm0, xmmword [0x1402071e0]
movups xmmword [r13], xmm0
cmp r10d, 0x28457e7a
jae 0x1400b1382
mov eax, 0x30
call fcn.1401516e0
sub rsp, rax
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rax, rsp
movups xmm0, xmmword [0x1402071e0]
movups xmmword [rax], xmm0
jmp 0x1400b12b0
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x20], rdx
mov eax, dword [0x14021d7a8]
mov r8d, dword [0x14021d7ac]
mov edx, eax
and edx, r8d
or eax, r8d
add eax, edx
imul eax, eax, 0x20b8e3ce
add eax, 0xdd321084
and eax, 0xec141f86
cmp eax, 0xfed05b68
jbe 0x1400b13ea
sub rsp, 0x50
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r13
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov rdi, rcx
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov rcx, rdi
add rsp, 0x50
xorps xmm6, xmm6
mov rdi, qword [sym.imp.ntdll.dll_NtWriteFile]
nop word cs:[rax + rax]
mov eax, dword [0x14021d7b0]
mov r8d, dword [0x14021d7b4]
lea edx, [r8 + rax]
add eax, r8d
add eax, 0x2848c098
not eax
or eax, 0xc1c3730
lea r14d, [rax + rdx]
add r14d, 0x4029f25
sub rsp, 0x50
movups xmmword [rsp + 0x38], xmm6
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r13
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov r15, rcx
call rdi
mov rcx, r15
add rsp, 0x50
cmp r14d, 0x64fbecac
jb 0x1400b1400
mov r15d, eax
cmp eax, 0x103
jne 0x1400b148d
sub rsp, 0x20
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x20
mov r15d, dword [r13]
cmp r15d, 0x103
je 0x1400b1715
test r15d, r15d
js 0x1400b1580
nop word cs:[rax + rax]
mov eax, dword [0x14021d7e0]
mov ecx, dword [0x14021d7e4]
mov edx, eax
and edx, ecx
xor eax, ecx
lea eax, [rax + rdx*2]
or eax, 0x636a1d61
imul eax, eax, 0x2b13716a
mov ecx, eax
not ecx
or eax, 0xb5c4c624
or ecx, 0x4a3b39db
and ecx, eax
cmp ecx, 0x1b09c687
jb 0x1400b14a0
nop dword [rax]
mov eax, dword [0x14021d7e8]
mov ecx, dword [0x14021d7ec]
not eax
mov edx, eax
and edx, ecx
or eax, ecx
not eax
or eax, edx
imul rcx, rax, 0x7955587
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
or eax, 0xca62f16c
cmp eax, 0xdf4db9be
ja 0x1400b14e0
mov rdx, qword [r13 + 8]
xor eax, eax
nop
mov ecx, dword [0x14021d7f0]
add ecx, dword [0x14021d7f4]
mov r8d, ecx
not r8d
mov r9d, ecx
and r9d, 0xdcc253be
and r8d, 0x233dac41
imul r8d, r9d
mov r9d, ecx
and r9d, 0x233dac41
or ecx, 0x233dac41
imul ecx, r9d
add ecx, r8d
mov r8d, ecx
xor r8d, 0x9618720f
and ecx, 0x69e78df0
add ecx, ecx
sub ecx, r8d
cmp ecx, 0x81c65dab
je 0x1400b1520
jmp 0x1400b16e0
mov eax, dword [0x14021d7c8]
mov ecx, dword [0x14021d7cc]
mov edx, eax
and edx, ecx
or eax, ecx
not eax
or eax, edx
mov ecx, eax
xor ecx, 0x2012800
xor eax, 0x24a0467a
and eax, 0xadb2c77a
and ecx, 0x524d3885
or ecx, eax
mov eax, ecx
xor eax, 0xc823cb48
xor ecx, 0x5fdbb21e
and ecx, eax
cmp ecx, 0xa25cc26a
jbe 0x1400b15d8
sub rsp, 0x20
mov ecx, r15d
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
add rsp, 0x20
mov rsi, qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
xor edi, edi
nop word cs:[rax + rax]
sub rsp, 0x20
mov ecx, r15d
call rsi
add rsp, 0x20
test dil, dil
jne 0x1400b15f0
mov edx, eax
mov eax, 0xe8d12bf5
shl rdx, 0x20
or rdx, 2
nop word cs:[rax + rax]
mov ecx, dword [0x14021d7d0]
mov r8d, dword [0x14021d7d4]
mov r9d, r8d
not r9d
or r9d, ecx
not ecx
or ecx, r8d
and ecx, r9d
not ecx
mov r8d, ecx
and r8d, 0x6c5f8511
add r8d, r8d
neg r8d
add ecx, r8d
add ecx, 0x3f8dd16
imul rcx, rax
shr rcx, 0x3c
cmp ecx, 0x92513286
ja 0x1400b1620
nop dword [rax]
mov ecx, dword [0x14021d7d8]
mov r8d, dword [0x14021d7dc]
mov eax, ecx
not eax
mov r9d, r8d
not r9d
mov r10d, eax
and r10d, 0xb0508b11
and ecx, 0x4faf74ee
or ecx, r10d
or eax, r9d
and r9d, 0xb0508b11
and r8d, 0x4faf74ee
or r8d, r9d
xor r8d, ecx
not eax
or eax, r8d
add eax, 0xb12cc8ab
xor eax, 0x10040802
and eax, 0x10ac084e
cmp eax, 0x54cb0612
je 0x1400b1670
mov eax, 1
nop word cs:[rax + rax]
mov ecx, dword [0x14021d7f8]
sub ecx, dword [0x14021d7fc]
and ecx, 0x3714e89d
imul ecx, ecx, 0x83e84bb9
cmp ecx, 0x31749a4b
je 0x1400b16e0
movaps xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rax, qword [rbp - 0x18]
mov dword [rax], 0
mov byte [rax + 4], 0
mov eax, dword [0x14021d7b8]
xor eax, dword [0x14021d7bc]
add eax, 0x71dec8f5
mov ecx, eax
or ecx, 0x231c1efe
mov edx, eax
not edx
and edx, 0xdcc12000
mov r8d, ecx
and r8d, 0x126d3cb
imul r8d, edx
and ecx, 0xfed92c34
or eax, 0xffdd3efe
imul eax, ecx
add eax, r8d
cmp eax, 0x7d9ce3b6
jae 0x1400b179e
lea rax, [0x140207240]
mov rdx, qword [rbp - 0x20]
mov qword [rdx], rax
mov qword [rdx + 8], 1
mov qword [rdx + 0x10], r12
xorps xmm0, xmm0
movups xmmword [rdx + 0x18], xmm0
sub rsp, 0x20
mov rcx, qword [rbp - 0x18]
call fcn.1400b2630
add rsp, 0x20
lea rsi, [0x140207240]
xorps xmm6, xmm6
mov rbx, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
mov edi, dword [0x14021d7c0]
xor edi, dword [0x14021d7c4]
and edi, 0x1fffffff
add edi, 0xd8a570d5
and edi, 0x16b49010
mov qword [rbx], rsi
mov qword [rbx + 8], 1
mov qword [rbx + 0x10], r12
movups xmmword [rbx + 0x18], xmm6
sub rsp, 0x20
mov rcx, r14
mov rdx, rbx
call fcn.1400b2630
add rsp, 0x20
cmp edi, 0x1c92703f
je 0x1400b17b0
sub rsp, 0x20
mov rcx, rax
call fcn.1400b2ce0
add rsp, 0x20
mov ecx, 7
int 0x29
ud2