Function at 0x1400013c0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x14006f040]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor esi, esi
mov ecx, 8
call fcn.14005a910
lea rcx, [0x140001330]
mov qword [rax], rcx
mov qword [rbp + 0x17], rax
lea rcx, [rbp + 0x2f]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140001d20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x27], rax
test rax, rax
je 0x1400017ba
cmp dword [rbp + 0x2f], esi
je 0x1400017ae
movaps xmm0, xmmword [rbp + 0x27]
movdqa xmmword [rbp - 0x39], xmm0
lea rcx, [rbp - 0x39]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400017ae
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x27], xmm0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [rbp - 0x11], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 9], rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rbp + 0x17], rax
mov r12d, 0x6a
movabs r14, 0x1fffffffffffffff
nop dword [rax + rax]
mov rdx, qword [0x1400760f8]
cmp rdx, qword [0x140076100]
je 0x1400014ce
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [rdx], rax
mov rdx, qword [0x1400760f8]
add rdx, 8
mov qword [0x1400760f8], rdx
jmp 0x1400014de
lea r8, [rbp - 0x11]
call fcn.140001b50
mov rdx, qword [0x1400760f8]
cmp rdx, qword [0x140076100]
je 0x140001505
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdx], rax
mov rdx, qword [0x1400760f8]
add rdx, 8
mov qword [0x1400760f8], rdx
jmp 0x140001515
lea r8, [rbp - 9]
call fcn.140001b50
mov rdx, qword [0x1400760f8]
cmp rdx, qword [0x140076100]
je 0x140001532
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rdx], rax
add qword [0x1400760f8], 8
jmp 0x14000153b
lea r8, [rbp + 0x17]
call fcn.140001b50
lea rcx, [0x14005de60]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140001584
lea rdx, str.DbgBreakPoint
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140001584
lea r9, [rbp + 0x37]
mov edx, 1
mov r8d, 0x40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140001584
mov byte [rbx], 0xc3
call fcn.1400017d0
test al, al
je 0x140001595
mov byte [0], 0
lea rcx, [0x14005de60]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140001649
lea rdx, str.DbgUiRemoteBreakin
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140001649
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140001649
lea rdx, [0x14005de98]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x140001649
mov word [rbp - 0x39], r12w
mov byte [rbp - 0x37], 0x68
mov dword [rbp - 0x36], 0xffffffff
mov byte [rbp - 0x32], 0xb8
lea r9, [rbp + 7]
mov edx, select
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140001649
movsd xmm0, qword [rbp - 0x39]
movsd qword [rbx], xmm0
mov dword [rbx + 8], edi
mov word [rbx + 0xc], 0xd0ff
lea r9, [rbp + 7]
mov r8d, dword [rbp + 7]
mov edx, select
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rsi
mov rax, qword [0x1400760f8]
sub rax, qword [0x1400760f0]
sar rax, 3
test rax, rax
je 0x1400016fc
cmp rax, r14
ja 0x1400017a8
lea rbx, [rax*8]
test rbx, rbx
jne 0x14000168b
mov rdi, rsi
jmp 0x1400016c8
cmp rbx, 0x1000
jb 0x1400016bd
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x1400017a2
call fcn.14005a910
test rax, rax
je 0x14000179b
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400016c8
mov rcx, rbx
call fcn.14005a910
mov rdi, rax
mov qword [rbp - 0x29], rdi
lea rcx, [rbx + rdi]
mov qword [rbp - 0x19], rcx
mov rdx, qword [0x1400760f0]
mov rbx, qword [0x1400760f8]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 3
lea rax, [rdi + rbx*8]
mov qword [rbp - 0x21], rax
lea r8, [rbp - 0x29]
call fcn.1400019a0
test al, al
je 0x140001711
mov byte [0], 0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rbp + 0xf], 8
xor r9d, r9d
mov r8d, 8
lea rdx, [rbp + 0xf]
mov ecx, 0x67
call rax
mov eax, dword [rbp + 0x13]
test al, 2
jne 0x140001754
test al, al
jns 0x140001770
xor r9d, r9d
xor r8d, r8d
lea rdx, str.The_program_can_not_be_run_with_test_signing_on._Please_disable_it_and_try_again.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop dword [rax]
lea rcx, [0x14005de60]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400014a0
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1400014a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001260
int3
call fcn.140001b30
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x2f], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3