Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rdi
sub rsp, 0x278
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140063008]
xor rax, rbp
mov qword [rbp + 0x228], rax
lea rcx, [0x14006b013]
call fcn.140001990
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov byte [rbp + 0x88], 0x48
mov byte [rbp + 0x89], 0x83
mov byte [rbp + 0x8a], 0xec
mov byte [rbp + 0x8b], 0x20
mov byte [rbp + 0x8c], 0x48
mov byte [rbp + 0x8d], 0x31
mov byte [rbp + 0x8e], 0xc9
mov byte [rbp + 0x8f], 0x48
mov byte [rbp + 0x90], 0x89
mov byte [rbp + 0x91], 0xca
mov byte [rbp + 0x92], 0xe8
mov byte [rbp + 0x93], 0
mov byte [rbp + 0x94], 0
mov byte [rbp + 0x95], 0
mov byte [rbp + 0x96], 0
mov byte [rbp + 0x97], 0x58
mov byte [rbp + 0x98], 0x48
mov byte [rbp + 0x99], 0x83
mov byte [rbp + 0x9a], 0xe8
mov byte [rbp + 0x9b], 0x3f
mov byte [rbp + 0x9c], 0x49
mov byte [rbp + 0x9d], 0x89
mov byte [rbp + 0x9e], 0xc0
mov byte [rbp + 0x9f], 0x49
mov byte [rbp + 0xa0], 0x83
mov byte [rbp + 0xa1], 0xc0
mov byte [rbp + 0xa2], 0x10
mov byte [rbp + 0xa3], 0xff
mov byte [rbp + 0xa4], 0x10
mov byte [rbp + 0xa5], 0x48
mov byte [rbp + 0xa6], 0x83
mov byte [rbp + 0xa7], 0xc4
mov byte [rbp + 0xa8], 0x20
mov byte [rbp + 0xa9], 0xc3
lea rax, [rbp + 0xaa]
mov rdi, rax
xor eax, eax
mov ecx, 0xe
rep stosb byte [rdi], al
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 0xd8], rax
cmp qword [rbp + 0xd8], 0
jne 0x140001173
xor eax, eax
jmp 0x140001325
mov qword [rbp + 0xf8], 0
lea rdx, str.CreateMutexA
mov rcx, qword [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xf8], rax
cmp qword [rbp + 0xf8], 0
jne 0x1400011aa
xor eax, eax
jmp 0x140001325
call fcn.1400014f0
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x138], 0
mov r8d, 8
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x10]
call fcn.140003ca0
lea rax, [rbp + 0x20]
mov r8d, 0x17
lea rdx, str.QQGame_Mutex03_01_2003
mov rcx, rax
call fcn.140003ca0
lea rax, [rbp + 0x40]
mov r8d, 0x30
lea rdx, [rbp + 0x88]
mov rcx, rax
call fcn.140003ca0
cmp qword [rbp + 0x118], 0
je 0x140001323
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
xor edx, edx
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x158], 0
je 0x140001301
mov qword [rsp + 0x20], 0
mov r9d, 0x60
lea r8, [rbp + 0x10]
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400012e4
mov rax, qword [rbp + 0x158]
add rax, 0x30
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x138], rax
cmp qword [rbp + 0x138], 0
je 0x1400012e4
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140050700]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x1400505b0]
call fcn.140001808
mov rax, rdi
mov rcx, qword [rbp + 0x228]
xor rcx, rbp
call fcn.140001a60
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret