Function at 0x180005d60
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x18002c528]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, r8
mov r12, rdx
mov r13, rcx
lea rdx, [0x180024bc0]
xor esi, esi
test r8, r8
cmovne rdx, r8
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], rsi
mov word [rbp - 0x30], si
cmp word [rdx], si
jne 0x180005dd0
mov r8d, esi
jmp 0x180005dde
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], si
jne 0x180005dd4
lea rcx, [rbp - 0x30]
call fcn.180003610
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r15, rax
test rax, rax
jne 0x180005dff
call qword [sym.imp.KERNEL32.dll_GetLastError]
movsxd rdi, dword [r15 + 0x3c]
add rdi, r15
mov r8d, dword [0x18002ede8]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
mov ebx, 1
cmp ecx, 3
jne 0x180005e71
lea ecx, [rbx + 0x27]
call fcn.18000ac98
mov r14, rax
call fcn.18000bfdc
add eax, dword [0x18002ede8]
mov dword [r14 + rsi*4], eax
add rsi, rbx
cmp rsi, 0xa
jl 0x180005e3e
mov ecx, dword [r14 + 0x24]
mov dword [0x18002ede8], ecx
mov rcx, r14
call fcn.18000bfd4
mov r8d, dword [0x18002ede8]
xor esi, esi
mov eax, 0x5a4d
cmp word [r15], ax
jne 0x180005ed5
cmp dword [rdi], 0x4550
jne 0x180005ed5
mov eax, 0x10b
cmp word [rdi + 0x18], ax
jne 0x180005eb2
cmp dword [rdi + 0x84], esi
je 0x1800060e0
mov eax, dword [rdi + 0x80]
test eax, eax
je 0x1800060e0
lea rdi, [r15 + rax]
jmp 0x180005f37
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x1800060e0
cmp dword [rdi + 0x94], esi
je 0x1800060e0
mov eax, dword [rdi + 0x90]
jmp 0x180005ea1
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, ebx
jne 0x180005f34
mov edx, esi
mov r9d, edx
mov r10d, 8
mov ecx, r9d
and ecx, ebx
sub ecx, ebx
not ecx
and ecx, r8d
mov eax, r9d
sar eax, 1
mov r9d, ecx
xor r9d, eax
sub r10, rbx
jne 0x180005f04
add r8d, r9d
add edx, ebx
cmp edx, 0x100
jl 0x180005efb
mov dword [0x18002ede8], r8d
mov rdi, rsi
test rdi, rdi
je 0x1800060e0
cmp dword [rdi + 0x10], esi
je 0x1800060e0
mov r14d, esi
mov edx, dword [rdi]
add rdx, r15
jmp 0x180005fd9
lea r10, [r15 + 2]
add r10, rax
mov eax, r8d
imul eax, r8d
and eax, 0x8000000f
jge 0x180005f72
sub eax, ebx
or eax, 0xfffffff0
add eax, ebx
cmp eax, 0xa
jne 0x180005fb4
mov r9d, esi
mov r11d, r9d
mov esi, 8
mov ecx, r11d
and ecx, ebx
sub ecx, ebx
not ecx
and ecx, r8d
mov eax, r11d
sar eax, 1
mov r11d, ecx
xor r11d, eax
sub rsi, rbx
jne 0x180005f82
add r8d, r11d
add r9d, ebx
cmp r9d, 0x100
jl 0x180005f7a
mov dword [0x18002ede8], r8d
mov r9, r13
sub r9, r10
movzx eax, byte [r10]
movzx ecx, byte [r10 + r9]
sub eax, ecx
jne 0x180005fce
add r10, rbx
test ecx, ecx
jne 0x180005fba
test eax, eax
je 0x18000602a
add r14d, ebx
add rdx, 8
mov rax, qword [rdx]
test rax, rax
jne 0x180005f56
add rdi, 0x14
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0xe
jne 0x180005f40
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov r8d, dword [0x18002ede8]
jmp 0x180005f40
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 3
jne 0x18000606a
cmp r8d, ebx
jle 0x180006064
mov eax, r8d
cdq
idiv ebx
inc ebx
add ebx, edx
cmp ebx, r8d
jl 0x180006055
mov dword [0x18002ede8], ebx
movsxd rdx, r14d
mov ecx, dword [rdi + 0x10]
add rcx, r15
lea rbx, [rcx + rdx*8]
mov rdi, qword [rbx]
test rdi, rdi
je 0x1800060e3
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
jne 0x180006096
mov qword [rbx], r12
jmp 0x1800060e3
lea rdx, str.VirtualProtect
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x1800060b3
mov qword [rbx], r12
jmp 0x1800060dc
lea r9, [rbp - 0x40]
mov r8d, 4
lea r14d, [r8 + 4]
mov edx, r14d
mov rcx, rbx
call rsi
mov qword [rbx], r12
lea r9, [rbp - 0x40]
mov r8d, dword [rbp - 0x40]
mov edx, r14d
mov rcx, rbx
call rsi
xor esi, esi
jmp 0x1800060e3
mov rdi, rsi
cmp qword [rbp - 0x18], 8
jb 0x1800060f3
mov rcx, qword [rbp - 0x30]
call fcn.18000b380
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], rsi
mov word [rbp - 0x30], si
mov rax, rdi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000acd0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret