Function at 0x1801330f0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x18], r8
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov r13, r9
lea r8, str._ws
mov r9, rdx
mov rsi, rdx
mov r15, rcx
mov edx, 0x104
lea rcx, [rbp + 0x240]
call fcn.180001080
mov rax, qword [r15 + 0x70]
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x240]
call rax
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x18013351f
xor r14d, r14d
test byte [rbp - 0x10], 0x10
je 0x180133411
movzx ecx, word [rbp + 0x1c]
movzx eax, word [rbp + 0x1e]
cmp cx, 0x2e
jne 0x180133197
test ax, ax
je 0x180133411
cmp cx, cx
jne 0x180133197
cmp ax, cx
jne 0x180133197
cmp word [rbp + 0x20], r14w
je 0x180133411
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rsi + rax*2], r14w
jne 0x1801331a0
lea rdx, [rbp + 0x1c]
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rdx + rcx*2], r14w
jne 0x1801331b5
add rax, rcx
lea rbx, [rax*2 + 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x180133435
lea rax, [rbp + 0x1c]
mov r9, rsi
mov qword [rsp + 0x28], rax
lea r8, str._ws_ws_ws
lea rax, [0x18015f234]
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.180001080
movdqa xmm0, xmmword [0x180161950]
movabs rax, 0x1b53e4003077bf02
movdqa xmm1, xmmword [0x180161bb0]
movabs rbx, 0x4863e3ae9c06d2f
movdqu xmmword [rsp + 0x30], xmm0
movabs r8, 0x5c1b7809632d1a9c
mov qword [rsp + 0x60], rbx
movdqa xmm0, xmmword [0x1801609d0]
mov rdx, r14
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x68], r8
mov rcx, rax
movdqu xmmword [rsp + 0x40], xmm1
mov qword [rsp + 0x70], rax
nop dword [rax]
nop dword [rax + rax]
imul rax, rcx
add r8, rbx
add rax, r8
mov rcx, rax
shl rax, 0x20
shr rcx, 0x20
or rcx, rax
movzx eax, cl
xor al, byte [rsp + rdx + 0x30]
mov byte [rbp + rdx - 0x48], al
inc rdx
mov rax, rcx
cmp rdx, 0x2f
jb 0x180133280
movups xmm0, xmmword [rbp - 0x48]
mov byte [rbp - 0x19], r14b
mov r9, rdi
movups xmm1, xmmword [rbp - 0x38]
lea r8, [rbp - 0x80]
mov edx, 0x100000
movups xmmword [rbp - 0x80], xmm0
lea rcx, [0x18017bd90]
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rbp - 0x70], xmm1
movups xmmword [rbp - 0x60], xmm0
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9, qword [rbp + 0x490]
mov r8, rdi
mov rdx, r13
mov rcx, r15
call fcn.180133630
test eax, eax
jne 0x180133409
movdqa xmm0, xmmword [0x180161870]
movabs rax, 0x1b53e4003077bf02
movdqa xmm1, xmmword [0x180161bd0]
movabs r8, 0x5c1b7809632d1a9c
movdqu xmmword [rsp + 0x30], xmm0
mov rdx, r14
mov qword [rsp + 0x60], rbx
movdqa xmm0, xmmword [0x1801609e0]
mov rcx, rax
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x68], r8
movdqu xmmword [rsp + 0x40], xmm1
mov qword [rsp + 0x70], rax
nop dword [rax]
imul rax, rcx
add r8, rbx
add rax, r8
mov rcx, rax
shl rax, 0x20
shr rcx, 0x20
or rcx, rax
movzx eax, cl
xor al, byte [rsp + rdx + 0x30]
mov byte [rbp + rdx - 0x48], al
inc rdx
mov rax, rcx
cmp rdx, 0x2f
jb 0x180133380
movups xmm0, xmmword [rbp - 0x48]
mov byte [rbp - 0x19], r14b
lea r8, [rbp - 0x80]
movups xmm1, xmmword [rbp - 0x38]
mov edx, 0x100000
lea rcx, [0x18017bd90]
movups xmmword [rbp - 0x80], xmm0
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rbp - 0x70], xmm1
movups xmmword [rbp - 0x60], xmm0
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call fcn.180146f60
mov rax, qword [r15 + 0x78]
lea rdx, [rbp - 0x10]
mov rcx, r12
call rax
test eax, eax
jne 0x180133161
mov rcx, r12
call qword [r15 + pe_nt_image_headers64]
jmp 0x180133603
movdqa xmm0, xmmword [0x180161680]
lea rdx, [rsp + 0x30]
movdqa xmm1, xmmword [0x1801625c0]
lea rcx, [rbp - 0x48]
movabs rax, 0xa8ce5db91a41f821
mov dword [rsp + 0x60], 0xe2ca0952
mov qword [rsp + 0x68], rax
movabs rax, 0x99bd04a33aa037c8
mov qword [rsp + 0x70], rax
movabs rax, 0x4e0effb15aa2da28
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [0x180162310]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x64], 0x5728
movdqu xmmword [rsp + 0x50], xmm0
call fcn.18000cfc0
lea r9, [rbp + 0x1c]
mov edx, 0x100000
lea r8, [rbp - 0x80]
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x80], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 0x60], xmm1
mov ecx, dword [rax + 0x30]
mov dword [rbp - 0x50], ecx
movzx ecx, word [rax + 0x34]
mov word [rbp - 0x4c], cx
lea rcx, [0x18017bd90]
movzx eax, byte [rax + 0x36]
mov byte [rbp - 0x4a], al
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x180133608
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm0, xmmword [0x180160ef0]
lea rdx, [rsp + 0x30]
movdqa xmm1, xmmword [0x1801616d0]
lea rcx, [rbp - 0x48]
mov ebx, eax
mov byte [rsp + 0x60], 0x67
xor eax, eax
mov dword [rsp + 0x61], eax
mov word [rsp + 0x65], ax
mov byte [rsp + 0x67], al
movabs rax, 0x53a4a43623c65917
mov qword [rsp + 0x68], rax
movabs rax, 0x6adadc270a64e80c
mov qword [rsp + 0x70], rax
movabs rax, 0xd7a5ce30cb35674b
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [0x180160a90]
movdqu xmmword [rsp + 0x40], xmm1
movdqu xmmword [rsp + 0x50], xmm0
call fcn.18000c9f0
mov r9d, ebx
lea r8, [rbp - 0x80]
mov edx, 0x100000
lea rcx, [0x18017bd90]
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x80], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 0x60], xmm1
movzx eax, word [rax + 0x30]
mov word [rbp - 0x50], ax
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
xor r14d, r14d
mov dword [0x18017bd84], eax
mov r8d, eax
mov qword [rsp + 0x20], r14
lea rdx, [0x18017bd90]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, 1
lea r11, [rsp + 0x550]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret