Function at 0x18005ab40
Capabilities:
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x720
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x1801c1080]
xor rax, rsp
mov qword [rsp + 0x710], rax
mov rdi, r8
mov rsi, rdx
mov r14, rcx
xor edx, edx
lea rcx, str..pipe5485E7A4_E975_40DC_86A4_D11465CB0F3D
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x18005b36b
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..pipe5485E7A4_E975_40DC_86A4_D11465CB0F3D
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
mov qword [rsp + 0x78], rax
cmp rax, 0xffffffffffffffff
je 0x18005b36b
mov dword [rsp + 0x130], r12d
mov r8d, 0x400
lea rcx, [rsp + 0x138]
call fcn.18005b490
mov qword [rsp + 0x168], r12
mov qword [rsp + 0x170], r12
call fcn.180053f90
mov dword [rsp + 0x130], 3
xor eax, eax
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], rax
mov rbx, qword [rsp + 0x138]
mov dword [rsp + 0xd0], 3
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
cmp qword [r14 + 0x18], 0x10
jb 0x18005ac4d
mov r14, qword [r14]
mov r9, rbx
mov r8, r14
lea rdx, str.exefile
lea rcx, [rsp + 0xc0]
call fcn.18005b700
cmp qword [rsi + 0x18], 0x10
jb 0x18005ac71
mov rsi, qword [rsi]
mov r9, rbx
mov r8, rsi
lea rdx, str.param
lea rcx, [rsp + 0xc0]
call fcn.18005b700
cmp qword [rdi + 0x18], 0x10
jb 0x18005ac95
mov rdi, qword [rdi]
mov r9, rbx
mov r8, rdi
lea rdx, str.currentdir
lea rcx, [rsp + 0xc0]
call fcn.18005b700
lea rcx, str.normal
mov rax, rcx
nop dword [rax]
inc rax
cmp byte [rax], 0
jne 0x18005acc0
mov qword [rsp + 0xd8], rcx
sub eax, ecx
mov dword [rsp + 0xe0], eax
mov edi, dword [rsp + 0xc8]
mov ecx, dword [rsp + 0xcc]
cmp edi, ecx
jb 0x18005ad4b
test ecx, ecx
jne 0x18005ad14
mov dword [rsp + 0xcc], 0x10
mov edx, 0x280
mov rcx, rbx
call fcn.18005b610
mov rdx, rax
mov qword [rsp + 0xc0], rax
jmp 0x18005ad53
lea eax, [rcx + rcx]
mov dword [rsp + 0xcc], eax
lea r9, [rax + rax*4]
shl r9, 3
lea r8, [rcx + rcx*4]
shl r8, 3
mov rdx, qword [rsp + 0xc0]
mov rcx, rbx
call fcn.18005b560
mov rdx, rax
mov qword [rsp + 0xc0], rax
jmp 0x18005ad53
mov rdx, qword [rsp + 0xc0]
lea rcx, [rdi + rdi*4]
movups xmm0, xmmword [rsp + 0xd8]
movups xmmword [rdx + rcx*8], xmm0
mov dword [rdx + rcx*8 + 0x10], 0x100005
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rdx + rcx*8 + 0x14], xmm0
mov dword [rdx + rcx*8 + 0x24], 0x102
inc edi
mov dword [rsp + 0xc8], edi
lea rcx, str.Execute
mov rax, rcx
inc rax
cmp byte [rax], 0
jne 0x18005ad93
mov qword [rsp + 0xd8], rcx
sub eax, ecx
mov dword [rsp + 0xe0], eax
mov ecx, dword [rsp + 0x12c]
cmp dword [rsp + 0x128], ecx
jb 0x18005ae1c
test ecx, ecx
jne 0x18005ade5
mov dword [rsp + 0x12c], 0x10
mov edx, 0x280
mov rcx, rbx
call fcn.18005b610
mov rdx, rax
mov qword [rsp + 0x120], rax
jmp 0x18005ae24
lea eax, [rcx + rcx]
mov dword [rsp + 0x12c], eax
lea r9, [rax + rax*4]
shl r9, 3
lea r8, [rcx + rcx*4]
shl r8, 3
mov rdx, qword [rsp + 0x120]
mov rcx, rbx
call fcn.18005b560
mov rdx, rax
mov qword [rsp + 0x120], rax
jmp 0x18005ae24
mov rdx, qword [rsp + 0x120]
mov eax, dword [rsp + 0x128]
lea rcx, [rax + rax*4]
movups xmm0, xmmword [rsp + 0xd8]
movups xmmword [rdx + rcx*8], xmm0
mov dword [rdx + rcx*8 + 0x10], 0x100005
mov eax, dword [rsp + 0x128]
lea rcx, [rax + rax*4]
mov rax, qword [rsp + 0x120]
lea rdx, [rax + rcx*8]
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rdx + 0x14], xmm0
mov eax, dword [rsp + 0xd0]
mov dword [rdx + 0x24], eax
mov dword [rsp + 0xd0], r12d
inc dword [rsp + 0x128]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 0x100
mov ecx, 1
call fcn.18010280c
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x70]
call fcn.180116654
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
add rax, qword [rsp + 0x70]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x88], rax
mov r8d, 0x200
lea rcx, [rsp + 0x90]
call fcn.18005b490
nop
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x120]
call fcn.18005b7f0
lea rcx, [rsp + 0x48]
call fcn.18005b690
mov byte [rax], 0
dec qword [rsp + 0x60]
mov qword [rsp + 0x108], r12
mov qword [rsp + 0x110], 0xf
mov byte [rsp + 0xf8], 0
mov rdx, qword [rsp + 0x58]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x18005af41
lea rcx, [rsp + 0xf8]
call fcn.180054590
nop
mov rdi, qword [rsp + 0x108]
lea rbx, [rsp + 0xf8]
cmp qword [rsp + 0x110], 0x10
cmovae rbx, qword [rsp + 0xf8]
mov qword [rsp + 0xe8], r12
mov qword [rsp + 0xf0], 0xf
mov byte [rsp + 0xd8], 0
mov r8d, 0xa
lea rdx, str.N1xU1mUxmp
lea rcx, [rsp + 0xd8]
call fcn.180054590
mov edx, r12d
test edi, edi
jle 0x18005b00d
mov r8d, edi
mov r9, qword [rsp + 0xf0]
mov r10, qword [rsp + 0xe8]
mov r11, qword [rsp + 0xd8]
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0xd8]
cmp r9, 0x10
cmovae rcx, r11
movsxd rax, edx
movzx ecx, byte [rax + rcx]
xor byte [rbx], cl
lea rbx, [rbx + 1]
lea eax, [rdx + 1]
cdqe
xor edx, edx
div r10
sub r8, 1
jne 0x18005afe0
lea rcx, [rsp + 0xd8]
call fcn.180054520
nop
mov dword [rsp + 0x40], r12d
lea rdx, [rsp + 0xf8]
cmp qword [rsp + 0x110], 0x10
cmovae rdx, qword [rsp + 0xf8]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x108]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18005b317
xor edx, edx
mov r8d, 0x3e8
lea rcx, [rsp + 0x320]
call fcn.1801099b0
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
mov r8d, 0x3e8
lea rdx, [rsp + 0x320]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18005b317
mov dword [rsp + 0x190], r12d
mov r8d, 0x400
lea rcx, [rsp + 0x198]
call fcn.18005b490
mov qword [rsp + 0x1c8], r12
mov qword [rsp + 0x1d0], r12
lea rax, [rsp + 0x320]
mov qword [rsp + 0xd8], rax
lea rax, [rsp + 0x320]
mov qword [rsp + 0xe0], rax
call fcn.180053f90
mov dword [rsp + 0x190], r12d
mov r8d, 0x100
lea rcx, [rsp + 0x1e0]
call fcn.18005b490
mov qword [rsp + 0x310], r12
mov qword [rsp + 0x318], r12
lea r8, [rsp + 0x180]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x1e0]
call fcn.18005c100
test al, al
je 0x18005b176
mov rcx, qword [rsp + 0x1b0]
add rcx, 0xffffffffffffffec
mov qword [rsp + 0x1b0], rcx
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x180], xmm0
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x190], eax
mov dword [rcx + 0x10], r12d
mov qword [rsp + 0x1c8], r12
mov qword [rsp + 0x1d0], r12
jmp 0x18005b1a6
mov rax, qword [rsp + 0x310]
mov qword [rsp + 0x1c8], rax
mov rax, qword [rsp + 0x318]
mov qword [rsp + 0x1d0], rax
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x1b0], rax
lea rcx, [rsp + 0x1e0]
call fcn.180053f20
cmp dword [rsp + 0x190], 0
je 0x18005b309
lea r13, str.errorcode
mov rbx, r13
nop dword [rax + rax]
inc rbx
cmp byte [rbx], 0
jne 0x18005b1d0
sub ebx, r13d
mov rdi, qword [rsp + 0x180]
mov rsi, rdi
mov eax, dword [rsp + 0x188]
lea rcx, [rax + rax*4]
lea r14, [rdi + rcx*8]
cmp rdi, r14
je 0x18005b309
nop
cmp ebx, dword [rsi + 8]
jne 0x18005b2fc
mov r8d, ebx
mov rdx, r13
mov rcx, qword [rsi]
call fcn.180109bf0
test eax, eax
jne 0x18005b2fc
mov rbx, r13
inc rbx
cmp byte [rbx], 0
jne 0x18005b222
sub ebx, r13d
cmp rdi, r14
je 0x18005b255
cmp ebx, dword [rdi + 8]
jne 0x18005b249
mov r8d, ebx
mov rdx, r13
mov rcx, qword [rdi]
call fcn.180109bf0
test eax, eax
je 0x18005b24f
add rdi, 0x28
jmp 0x18005b22d
add rdi, 0x24
jmp 0x18005b282
mov eax, dword [0x1801d15f8]
test al, 1
jne 0x18005b27b
or eax, 1
mov dword [0x1801d15f8], eax
mov dword [0x1801d1610], r12d
lea rcx, [0x1801454d0]
call fcn.180102c40
lea rdi, [0x1801d1610]
mov eax, dword [rdi]
shr eax, 0xa
test al, 1
je 0x18005b309
lea rcx, [rsp + 0x180]
call fcn.18005b3e0
cmp dword [rax], 0
jne 0x18005b309
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x198]
call fcn.180053f20
nop
lea rcx, [rsp + 0xf8]
call fcn.180054520
nop
lea rcx, [rsp + 0x90]
call fcn.180053f20
nop
mov rcx, qword [rsp + 0x58]
call fcn.1801164d4
mov edx, 1
mov rcx, qword [rsp + 0x50]
call fcn.180102804
nop
lea rcx, [rsp + 0x138]
call fcn.180053f20
mov al, 1
jmp 0x18005b36d
add rsi, 0x28
cmp rsi, r14
jne 0x18005b200
lea rcx, [rsp + 0x198]
call fcn.180053f20
nop
jmp 0x18005b31e
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xf8]
call fcn.180054520
nop
lea rcx, [rsp + 0x90]
call fcn.180053f20
nop
mov rcx, qword [rsp + 0x58]
call fcn.1801164d4
mov edx, 1
mov rcx, qword [rsp + 0x50]
call fcn.180102804
nop
lea rcx, [rsp + 0x138]
call fcn.180053f20
xor al, al
mov rcx, qword [rsp + 0x710]
xor rcx, rsp
call fcn.1801027e0
add rsp, 0x720
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret