Function at 0x140026180
Capabilities:
Encode data using xor
Parse pe header
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rbx, rdx
mov rsi, rcx
call fcn.140025d04
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140026442
xor edx, edx
lea r8d, [rdi + 0x40]
lea rcx, [rsp + 0x40]
call fcn.14014e180
lea r9, [rbp + 0x138]
mov dword [rbp + 0x138], edi
lea r8d, [rdi + 0x40]
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140026439
cmp dword [rbp + 0x138], 0x40
jne 0x140026439
mov eax, 0x5a4d
cmp word [rsp + 0x40], ax
jne 0x140026439
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x108
call fcn.14014e180
movsxd rax, dword [rsp + 0x7c]
lea r8, [rbp + 0x144]
mov edx, eax
mov qword [rbp + 0x140], rax
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp + 0x140], eax
cmp eax, 0xffffffff
jne 0x14002627f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140026439
lea r9, [rbp + 0x138]
mov qword [rsp + 0x20], rdi
mov r8d, 0x108
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140026439
cmp dword [rbp + 0x138], 0x108
jne 0x140026439
cmp dword [rbp - 0x80], 0x4550
jne 0x140026439
cmp dword [rbp - 0x78], edi
je 0x140026439
mov eax, dword [rbp - 0x78]
lea r8, [rbp + 0x144]
mov edx, eax
mov qword [rbp + 0x140], rax
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp + 0x140], eax
cmp eax, 0xffffffff
jne 0x140026304
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140026439
lea r9, [rbp + 0x138]
mov qword [rsp + 0x20], rdi
mov r8d, 8
lea rdx, [rbp + 0x148]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140026439
cmp dword [rbp + 0x138], 8
jne 0x140026439
cmp dword [rbp + 0x148], 0x12d84cb
jne 0x140026439
lea r9, [rbp + 0x138]
mov qword [rsp + 0x20], rdi
mov r8d, 0x80
lea rdx, [rbp + 0x90]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140026439
cmp dword [rbp + 0x138], 0x80
jne 0x140026439
mov edx, dword [rbp + 0x14c]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsi + 0x40], rax
test rax, rax
je 0x140026439
mov r8d, dword [rbp + 0x14c]
lea r9, [rbp + 0x138]
mov rdx, rax
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140026426
mov eax, dword [rbp + 0x14c]
cmp dword [rbp + 0x138], eax
jne 0x140026426
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x14c]
mov qword [rsi + 0x48], rax
test rax, rax
je 0x14002641f
mov r9b, dil
mov rdx, qword [rsi + 0x40]
mov rcx, rdi
and ecx, 0x7f
mov r8b, byte [rdx + rdi]
add r9b, byte [rbp + rcx + 0x90]
xor r9b, r8b
mov byte [rdx + rdi], r9b
inc rdi
mov r9b, r8b
cmp rdi, qword [rsi + 0x48]
jb 0x1400263f6
mov eax, 1
jmp 0x140026444
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.140025d04
jmp 0x140026442
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x230]
add rsp, 0x210
pop rdi
pop rsi
pop rbp
ret