Function at 0x401708
Capabilities:
Encode data using xor
Get file size
Parse pe header
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x138]
sub rsp, 0x210
mov r12, r8
lea rcx, [rsp + 0x40]
mov rdi, rdx
mov r14d, 0x40
mov r8d, r14d
xor edx, edx
call fcn.00424830
mov r15d, 0x108
lea rcx, [rbp]
mov r8d, r15d
xor edx, edx
call fcn.00424830
xor ebx, ebx
or rsi, 0xffffffffffffffff
mov dword [r12], ebx
test rdi, rdi
je 0x401a5d
mov qword [rsp + 0x30], rbx
lea r8d, [r14 - 0x3d]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x401a5d
mov edi, ebx
mov ecx, edi
lea rdx, [rsp + 0x40]
mov r8d, r14d
mov dword [rbp + 0x140], ebx
add rdx, rcx
mov qword [rsp + 0x20], rbx
mov rcx, rsi
lea r9, [rbp + 0x140]
sub r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401a5d
cmp dword [rbp + 0x140], ebx
je 0x4017eb
add edi, dword [rbp + 0x140]
cmp edi, r14d
jb 0x4017a5
cmp edi, r14d
jne 0x401a5d
mov eax, 0x5a4d
cmp word [rsp + 0x40], ax
jne 0x401a5d
movsxd rax, dword [rsp + 0x7c]
lea r8, [rbp + 0x144]
mov edx, eax
mov qword [rbp + 0x140], rax
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
or r14d, 0xffffffff
mov dword [rbp + 0x140], eax
cmp eax, r14d
jne 0x40183a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, ebx
mov r8d, r15d
mov eax, edi
lea rdx, [rbp]
mov dword [rbp + 0x140], ebx
sub r8d, edi
mov qword [rsp + 0x20], rbx
add rdx, rax
lea r9, [rbp + 0x140]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401a5d
cmp dword [rbp + 0x140], ebx
je 0x401881
add edi, dword [rbp + 0x140]
cmp edi, r15d
jb 0x40183c
cmp edi, r15d
jne 0x401a5d
cmp dword [rbp], 0x4550
jne 0x401a5d
mov edi, dword [rbp + 8]
test edi, edi
je 0x401a5d
lea rdx, [rbp + 0x140]
mov qword [rbp + 0x140], rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
neg eax
sbb rcx, rcx
and rcx, qword [rbp + 0x140]
cmp rdi, rcx
ja 0x401a5d
xor r9d, r9d
mov qword [rbp + 0x140], rdi
lea r8, [rbp + 0x144]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp + 0x140], eax
cmp eax, r14d
jne 0x401905
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x401905
or rax, 0xffffffffffffffff
jmp 0x40190c
mov rax, qword [rbp + 0x140]
cmp rax, rdi
jne 0x401a5d
mov edi, ebx
mov r8d, 8
mov eax, edi
lea rdx, [rbp + 0x148]
mov dword [rbp + 0x140], ebx
sub r8d, edi
mov qword [rsp + 0x20], rbx
add rdx, rax
lea r9, [rbp + 0x140]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401a5d
cmp dword [rbp + 0x140], ebx
je 0x401962
add edi, dword [rbp + 0x140]
cmp edi, 8
jb 0x401917
cmp edi, 8
jne 0x401a5d
cmp dword [rbp + 0x148], 0x12d84cb
jne 0x401a5d
mov edi, ebx
mov r8d, 0x80
mov eax, edi
lea rdx, [rbp - 0x80]
mov dword [rbp + 0x140], ebx
sub r8d, edi
mov qword [rsp + 0x20], rbx
add rdx, rax
lea r9, [rbp + 0x140]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401a5d
cmp dword [rbp + 0x140], ebx
je 0x4019c8
add edi, dword [rbp + 0x140]
cmp edi, 0x80
jb 0x40197d
cmp edi, 0x80
jne 0x401a5d
mov edx, dword [rbp + 0x14c]
lea r9d, [rdi - 0x7c]
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
je 0x401a5d
mov edi, dword [rbp + 0x14c]
mov r14d, ebx
cmp edi, 1
jb 0x401a47
mov r8d, edi
mov edx, r14d
sub r8d, r14d
mov dword [rbp + 0x140], ebx
add rdx, r15
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x140]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401a41
cmp dword [rbp + 0x140], ebx
je 0x401a41
add r14d, dword [rbp + 0x140]
cmp r14d, edi
jb 0x401a02
mov edi, dword [rbp + 0x14c]
cmp r14d, edi
je 0x401a8e
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r15, rbx
cmp rsi, 0xffffffffffffffff
je 0x401a6f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x210]
mov rax, r15
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov dword [r12], edi
test edi, edi
je 0x401a66
mov r8b, bl
mov eax, ebx
inc ebx
lea rcx, [rax + r15]
and eax, 0x7f
mov dl, byte [rcx]
add r8b, byte [rbp + rax - 0x80]
xor r8b, dl
mov byte [rcx], r8b
mov r8b, dl
cmp ebx, edi
jb 0x401a99
jmp 0x401a66