Function at 0x1400053c4
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, rdx
cmp ecx, 2
jge 0x140005411
lea rcx, str._nHAZARD_EDIT_MAPPERv1_n
call fcn.140005370
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
or rax, 0xffffffffffffffff
jmp 0x140005786
xor r15d, r15d
mov dword [rbp + 0x67], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
lea r8d, [r15 + 3]
mov dword [rsp + 0x20], r8d
xor r9d, r9d
mov edx, 0x80000000
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
or rdi, 0xffffffffffffffff
cmp rax, rdi
jne 0x1400054c4
movdqa xmm0, xmmword [0x140037560]
movdqu xmmword [rbp - 1], xmm0
movdqa xmm1, xmmword [0x140037530]
movdqu xmmword [rbp + 0xf], xmm1
mov word [rbp + 0x1f], 0x98
mov ecx, r15d
mov edx, r15d
lea eax, [rcx + 0x72]
xor byte [rbp + rdx - 1], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0x21
jb 0x14000546f
mov byte [rbp + 0x20], r15b
lea rdx, [rbp - 1]
call fcn.1400057a8
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140004e18
mov dl, al
mov rcx, rbx
call fcn.1400059cc
mov rcx, rbx
call fcn.140004b94
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140005784
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov edx, eax
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x67]
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140005592
movdqa xmm0, xmmword [0x140037560]
movdqu xmmword [rbp - 1], xmm0
movdqa xmm1, xmmword [0x140037520]
movdqu xmmword [rbp + 0xf], xmm1
mov word [rbp + 0x1f], 0x98
mov ecx, r15d
mov rdx, r15
lea eax, [rcx + 0x72]
xor byte [rbp + rdx - 1], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0x21
jb 0x14000552e
mov byte [rbp + 0x20], r15b
lea rdx, [rbp - 1]
call fcn.1400057a8
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140004e18
mov dl, al
mov rcx, rbx
call fcn.1400059cc
mov rcx, rbx
call fcn.140004b94
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400054b4
mov r12d, 0x40
mov ecx, r12d
call fcn.140007590
mov rbx, rax
mov r8d, r12d
xor edx, edx
mov rcx, rax
call fcn.1400090d0
mov qword [rbx + 0x18], r15
lea r13d, [r12 - 0x31]
mov qword [rbx + 0x20], r13
mov byte [rbx + 8], r15b
mov byte [rbx + 0x28], r15b
mov qword [rbx + 0x30], r15
mov qword [rbx + 0x38], r15
mov rsi, qword [0x140043150]
mov qword [0x140043150], rbx
test rsi, rsi
je 0x140005632
mov rdx, qword [rsi + 0x20]
cmp rdx, 0x10
jb 0x14000561b
mov rcx, qword [rsi + 8]
inc rdx
cmp rdx, 0x1000
jb 0x140005616
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400057a1
mov rcx, r8
call fcn.1400075cc
mov qword [rsi + 0x18], r15
mov qword [rsi + 0x20], r13
mov byte [rsi + 8], r15b
mov rdx, r12
mov rcx, rsi
call fcn.1400075cc
movdqa xmm0, xmmword [str.1I__]
movdqu xmmword [rbp - 1], xmm0
movdqa xmm1, xmmword [0x140037510]
movdqu xmmword [rbp + 0xf], xmm1
mov dword [rbp + 0x1f], 0xece7bdd6
mov word [rbp + 0x23], 0xe5
mov ecx, r15d
mov rdx, r15
lea eax, [rcx + 0x72]
xor byte [rbp + rdx - 1], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0x25
jb 0x14000565f
mov byte [rbp + 0x24], r15b
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r13
mov byte [rbp - 0x21], r15b
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x21]
call fcn.1400047d8
nop
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], r15
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 1]
call fcn.140004844
lea rcx, [rbp - 1]
call fcn.140003424
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], r15
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 1]
call fcn.140004844
mov r9d, dword [rbp + 0x67]
mov r8, r14
lea rdx, [rbp - 1]
mov rcx, qword [0x140043150]
call fcn.140005cd8
test al, al
jne 0x140005748
mov dword [rbp - 0x31], 0x5504123f
mov dword [rbp - 0x2d], 0x15111610
xor eax, eax
mov byte [rbp - 0x29], al
mov ecx, r15d
mov rdx, r15
lea eax, [rcx + 0x72]
xor byte [rbp + rdx - 0x31], al
inc ecx
movsxd rdx, ecx
cmp rdx, 8
jb 0x1400056f6
mov byte [rbp - 0x29], r15b
lea rdx, [rbp - 0x31]
call fcn.1400057a8
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140004e18
mov dl, al
mov rcx, rbx
call fcn.1400059cc
mov rcx, rbx
call fcn.140004b94
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000574d
mov edi, 1
mov rdx, qword [rbp - 9]
cmp rdx, 0x10
jb 0x140005784
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000577f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400057a1
call fcn.1400075cc
mov eax, edi
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14000b47c
int3