Function at 0x140005074
Capabilities:
Check if file exists
Encode data using xor
Get file attributes
Set file attributes
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r14, r9
mov r15, r8
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
je 0x1400050c4
test al, 1
je 0x1400050c4
and eax, 0xfffffffe
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140005341
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
test rax, rax
je 0x140005341
cmp rax, 0xffffffffffffffff
je 0x140005341
jmp 0x14000510d
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x140018a50], rsi
jne 0x140005102
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.140006de0
call fcn.140006df8
mov ebx, eax
shl ebx, 0xc
call fcn.140006df8
mov ebp, eax
mov eax, 0x21fb7813
or ebp, ebx
mov ecx, ebp
mul ebp
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 7
imul ecx, ecx, 0xe2
sub ebp, ecx
add ebp, 0x2d8
mov ecx, ebp
mov edi, ebp
call fcn.140006540
mov r13, rax
test ebp, ebp
je 0x1400051a5
mov rbx, rax
call fcn.140006df8
mov r11d, eax
mov eax, 0x80808081
imul r11d
add edx, r11d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0xff
sub r11d, edx
mov byte [rbx], r11b
inc rbx
dec rdi
jne 0x140005174
lea eax, [rbp - 1]
movzx esi, byte [rax + r13]
lea eax, [rbp - 2]
movzx eax, byte [rax + r13]
shl si, 8
or si, ax
lea eax, [rbp - 3]
movzx edi, byte [rax + r13]
lea eax, [rbp - 4]
movzx eax, byte [rax + r13]
shl di, 8
or di, ax
call fcn.140006df8
mov ebx, eax
shl ebx, 0xc
call fcn.140006df8
xor edx, edx
or eax, ebx
mov ecx, ebp
xor di, 0x44
shr ecx, 1
mov r11d, ebp
div ecx
shr r11d, 2
add r11d, edx
mov edx, 0x81c3d17
movzx eax, r11w
lea r10d, [r11 + 2]
lea r9d, [r13 + r11 + 4]
xor ax, si
add r10, r13
xor r8d, r8d
mov word [r13], ax
mov rax, qword [rsp + 0xa0]
mov word [r10], di
movups xmm0, xmmword [rax + 0x18]
movdqu xmmword [r10 + 2], xmm0
movups xmm0, xmmword [rax + 0x28]
mov rax, qword [rsp + 0x88]
movdqu xmmword [r10 + 0x12], xmm0
mov rax, qword [rax]
mov qword [r10 + 0x22], rax
mov rax, qword [0x140018898]
mov qword [r10 + 0x2a], rax
mov rax, qword [r15]
mov qword [r10 + 0x32], rax
mov rax, qword [r14]
mov qword [r10 + 0x3a], rax
movzx ecx, byte [r9]
inc r9
mov eax, ecx
imul ecx, edx
imul eax, r8d
add ecx, 0xd1a3
inc r8d
add eax, edx
mov edx, eax
xor edx, ecx
cmp r8d, 0x40
jl 0x140005262
lea eax, [rdx + r11]
xor r9d, r9d
mov dword [r10 + 0x42], eax
mov eax, 0xffff
mov word [r10 + 0x46], ax
test ebp, ebp
jle 0x1400052cb
mov r10, qword [rsp + 0xa8]
mov r8, r13
mov eax, r9d
inc r9d
cdq
idiv dword [rsp + 0xb0]
movsxd rax, edx
mov cl, byte [rax + r10]
xor byte [r8], cl
inc r8
cmp r9d, ebp
jl 0x1400052ab
mov r10d, dword [0x14001bb30]
mov r11, qword [0x14001bb28]
xor r9d, r9d
test ebp, ebp
jle 0x1400052ff
mov r8, r13
mov eax, r9d
inc r9d
cdq
idiv r10d
movsxd rax, edx
mov cl, byte [rax + r11]
xor byte [r8], cl
inc r8
cmp r9d, ebp
jl 0x1400052e3
and dword [rsp + 0x40], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, ebp
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140005338
cmp dword [rsp + 0x40], ebp
jne 0x140005338
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140005343
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret