Function at 0x140008100
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
sub rsp, 0x360
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
xor edi, edi
xorps xmm0, xmm0
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rbp + 0x40], edi
lea r8d, [rdi + 1]
mov dword [rsp + 0x20], 3
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
test rax, rax
jne 0x14000824e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
movabs rcx, 0x39607bf5c964feba
movabs rax, 0x6b0c615e54fa4614
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xb36b92a6bbfca95c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xe8222fb422de8693
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x24a042a359f3457
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xdc19e0c39babcc30
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x9007578402e4a6e1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x20]
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140001d70
xor eax, eax
jmp 0x1400083f2
xor edx, edx
lea rcx, [rbp + 0xa0]
mov r8d, 0x248
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x48]
mov r8d, 0x248
lea r9, [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, eax
test eax, eax
jns 0x14000836f
movabs rcx, 0x39607bf5c964feba
movabs rax, 0x6b0c604b50cd4019
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xa43c98f3bb91a95c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x9007578402e4a6eb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x24a042a359f3457
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xdc19e0c39babcc30
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x9007578402e4a6e1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x20]
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140001d70
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400083f2
mov rax, qword [rbp + 0xdc]
cmp eax, 0x100
jg 0x1400083a1
mov ecx, 0x5a4d
cmp word [rbp + 0xa0], cx
jne 0x1400083e6
cdqe
lea rcx, [rbp + 0xa0]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400083e6
jmp 0x1400083d8
mov dword [rbp + 0x58], eax
lea r9, [rbp + 0x40]
lea rax, [rbp + 0x48]
mov r8d, 0x248
lea rdx, [rbp + 0xa0]
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, eax
test eax, eax
js 0x14000828f
lea rcx, [rbp + 0xa0]
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400083e6
mov edi, dword [rcx + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.14000a1a0
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret