Function at 0x1400f8788
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x1405fa008]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov r13, qword [rbp + 0x2b0]
lea rcx, [rsp + 0x60]
mov r12, r9
mov r15, r8
mov rdi, rdx
call fcn.1400ee91c
and qword [rsp + 0x48], 0
lea r9, [rsp + 0x34]
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x60]
and dword [rsp + 0x30], 0
mov ebx, 0xfc
and qword [rsp + 0x20], 0
mov r8d, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400f8823
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14003de7c
mov esi, eax
mov ecx, eax
call fcn.14003e600
jmp 0x1400f8b70
cmp dword [rsp + 0x34], ebx
je 0x1400f8832
mov ecx, 0x8007000d
mov esi, ecx
jmp 0x1400f8819
mov eax, dword [rbp + 0x58]
test eax, eax
je 0x1400f8829
mov ecx, eax
call fcn.14011ea0c
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1401c4984
mov rbx, qword [rsp + 0x48]
test rbx, rbx
jne 0x1400f8860
mov esi, 0x8007000e
mov ecx, esi
jmp 0x1400f8819
mov r8d, dword [rbp + 0x58]
lea r9, [rsp + 0x34]
and qword [rsp + 0x20], 0
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400f8808
mov eax, dword [rsp + 0x34]
cmp dword [rbp + 0x58], eax
jne 0x1400f8829
mov r8d, 0x3c
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14007b650
mov esi, eax
test eax, eax
js 0x1400f8817
lea rdx, str.spp:migblob_aesencryptor_tokenact
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x1400f88e1
and qword [rsp + 0x20], 0
mov ecx, 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc00004a5
call fcn.14006a49c
mov esi, 0x80049e59
jmp 0x1400f885c
lea rcx, [0x14041cd98]
call fcn.140014e98
mov rdi, rax
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
mov edx, 0x60
lea rcx, [rbp - 0x28]
call rdi
mov rcx, rdi
mov esi, eax
call fcn.140018b24
test esi, esi
js 0x1400f885c
mov r14, qword [rsp + 0x38]
lea r9, [0x1400b5a70]
mov esi, dword [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov edi, dword [rbp + 0x58]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8d, [rdx - 0xf]
call fcn.14003c25c
lea rcx, [rbp + 0xf0]
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x58], rbx
call fcn.14003a604
lea rcx, [rbp + 0x60]
call fcn.14003a604
mov edi, 0x40
cmp esi, edi
jbe 0x1400f8970
mov esi, 0x80004005
mov ecx, esi
jmp 0x1400f8ab0
mov r8, rdi
lea rcx, [rbp + 0x1c0]
xor edx, edx
call fcn.14001ba6e
mov r8, rdi
lea rcx, [rbp + 0x180]
xor edx, edx
call fcn.14001ba6e
mov r8, rsi
lea rcx, [rbp + 0x1c0]
mov rdx, r14
call sub.msvcrt.dll_memcpy
mov r8, rsi
lea rcx, [rbp + 0x180]
mov rdx, r14
call sub.msvcrt.dll_memcpy
xor eax, eax
lea ecx, [rax + 4]
movdqu xmm0, xmmword [rbp + rax + 0x1c0]
lea rax, [rax + 0x10]
pxor xmm0, xmmword [str.6666666666666666_]
movdqu xmmword [rbp + rax + 0x1b0], xmm0
movdqu xmm0, xmmword [rbp + rax + 0x170]
pxor xmm0, xmmword [0x1403a6380]
movdqu xmmword [rbp + rax + 0x170], xmm0
sub rcx, 1
jne 0x1400f89bb
mov r8d, edi
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0xf0]
call fcn.14007ae3c
mov esi, eax
test eax, eax
js 0x1400f8aae
xor r14d, r14d
lea rdi, [rsp + 0x58]
mov r8d, dword [rdi - 8]
lea rcx, [rbp + 0xf0]
mov rdx, qword [rdi]
call fcn.14007ae3c
mov esi, eax
test eax, eax
js 0x1400f8aae
inc r14d
add rdi, 0x10
cmp r14d, 1
jb 0x1400f8a21
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0xf0]
call fcn.140062c08
mov esi, eax
test eax, eax
js 0x1400f8aae
mov r8d, 0x40
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x60]
call fcn.14007ae3c
mov esi, eax
test eax, eax
js 0x1400f8aae
mov r8d, 0x20
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x60]
call fcn.14007ae3c
mov esi, eax
test eax, eax
js 0x1400f8aae
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x60]
call fcn.140062c08
mov esi, eax
test eax, eax
jns 0x1400f8ab5
mov ecx, eax
call fcn.14003e600
xor eax, eax
lea rdi, [rbp + 0x1c0]
lea edx, [rax + 0x40]
mov ecx, edx
rep stosb byte [rdi], al
mov ecx, edx
lea rdi, [rbp + 0x180]
rep stosb byte [rdi], al
mov ecx, esi
call fcn.14006a86c
test esi, esi
jns 0x1400f8ae2
mov ecx, esi
call fcn.14003e600
mov ecx, esi
call fcn.14006a86c
test esi, esi
jns 0x1400f8af1
mov ecx, esi
jmp 0x1400f8b12
mov r8d, 0x20
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x38]
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x1400f8b17
mov ecx, 0x8007000d
mov esi, ecx
call fcn.14003e600
mov ecx, esi
call fcn.14006a86c
test esi, esi
jns 0x1400f8b29
mov ecx, esi
call fcn.14003e600
mov ecx, esi
call fcn.14006a86c
test esi, esi
js 0x1400f885c
mov edx, dword [rbp + 0x58]
lea r8, [rsp + 0x40]
mov rcx, rbx
call fcn.1400efd40
mov esi, eax
test eax, eax
js 0x1400f8817
mov rax, qword [rsp + 0x38]
and qword [rsp + 0x38], 0
mov qword [r12], rax
mov eax, dword [rsp + 0x30]
mov dword [r15], eax
mov eax, dword [rsp + 0x40]
mov dword [r13], eax
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x1400f8b82
mov ecx, dword [rsp + 0x30]
xor eax, eax
rep stosb byte [rdi], al
mov ecx, esi
call fcn.14006a86c
lea rcx, [rsp + 0x38]
call fcn.14003b618
lea rcx, [rsp + 0x48]
call fcn.14019c76c
mov eax, esi
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.14001af10
mov rbx, qword [rsp + 0x390]
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret