Function at 0x140001980
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push rbx
push r13
sub rsp, 0x78
mov rax, qword [0x140255020]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rdx
mov r13, rcx
test rcx, rcx
jne 0x1400019cb
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Unable_to_read_file_content.
call fcn.1400621a0
mov rcx, rax
lea rdx, [0x140064468]
call fcn.1400621a0
xor al, al
jmp 0x140001e70
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x60], r12
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140064468]
call fcn.1400621a0
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
jne 0x140001a3c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Unable_to_allocate_memory.
call fcn.1400621a0
mov rcx, rax
lea rdx, [0x140064468]
call fcn.1400621a0
mov rcx, r13
call fcn.140062b70
xor al, al
jmp 0x140001e6b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdx, r12
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x1400011c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140064468]
call fcn.1400621a0
mov r8, rbx
mov rdx, r13
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
movsxd rdi, dword [r12 + 0x3c]
lea rdx, str.Size_Of_image:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add rdi, r12
mov qword [rsp + 0x30], rdi
call fcn.1400621a0
mov rcx, rax
lea rdx, [0x1400011c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rdi + 0x50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140064468]
call fcn.1400621a0
mov edx, dword [rdi + 0x50]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x140001b1d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Unable_to_allocate_base_address.
call fcn.1400621a0
mov rcx, rax
lea rdx, [0x140064468]
call fcn.1400621a0
mov rcx, r13
call fcn.140062b70
mov rcx, r12
jmp 0x140001ddd
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Size_of_headers:
call fcn.1400621a0
mov rcx, rax
lea rdx, [0x1400011c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rdi + 0x54]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140064468]
call fcn.1400621a0
mov r8d, dword [rdi + 0x54]
mov rdx, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r9, rdi
mov r8, r12
mov rdx, r12
mov rcx, rsi
call fcn.140001770
mov rdx, rsi
mov rcx, rdi
call fcn.140001300
test al, al
jne 0x140001b96
lea rdx, str.Failed_to_fix_imports.
jmp 0x140001da6
mov rbx, qword [rdi + 0x30]
lea rdx, str.Expected_ImageBase:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0xa0], rbp
mov rbp, rsi
mov qword [rsp + 0x58], r14
sub rbp, rbx
mov qword [rsp + 0x50], r15
call fcn.1400621a0
mov rcx, rax
lea rdx, [0x1400011c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140064468]
call fcn.1400621a0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Loaded_ImageBase:
call fcn.1400621a0
mov rcx, rax
lea rdx, [0x1400011c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x140064468]
call fcn.1400621a0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Delta:
call fcn.1400621a0
mov rcx, rax
lea rdx, [0x1400011c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbp
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_long___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140064468]
call fcn.1400621a0
mov r14d, dword [rdi + 0xb0]
add r14, rsi
mov rbx, qword [r14]
mov r15, rbx
shr r15, 0x20
test r15d, r15d
je 0x140001d1b
mov edi, r15d
nop dword [rax]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.reloc..._n
call fcn.1400621a0
mov eax, r15d
lea r8, [r14 + 8]
sub rax, 8
mov r10d, edi
shr rax, 1
test eax, eax
jle 0x140001cfe
mov r9d, eax
mov edx, 0xf000
mov r11d, 0xa000
nop word [rax + rax]
movzx eax, word [r8]
movzx ecx, ax
and cx, dx
cmp cx, r11w
jne 0x140001cf4
and eax, 0xfff
mov edx, ebx
lea rcx, [rsi + rax]
add qword [rdx + rcx], rbp
mov edx, 0xf000
add r8, 2
sub r9, 1
jne 0x140001cd0
add r14, r10
mov rbx, qword [r14]
mov rdi, rbx
shr rdi, 0x20
mov r15d, edi
test edi, edi
jne 0x140001c90
mov rdi, qword [rsp + 0x30]
mov ebx, dword [rdi + 0x28]
lea rdx, str.Creating_thread_in:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add rbx, rsi
call fcn.1400621a0
mov rcx, rax
lea rdx, [0x1400011c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x140064468]
call fcn.1400621a0
mov r8d, dword [rdi + 0x28]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
add r8, rsi
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, qword [rsp + 0x50]
mov rbx, rax
mov r14, qword [rsp + 0x58]
mov rbp, qword [rsp + 0xa0]
test rax, rax
jne 0x140001def
lea rdx, str.Error_occurred_during_thread_creation_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400621a0
mov rcx, rax
lea rdx, [0x140064468]
call fcn.1400621a0
mov rcx, r13
call fcn.140062b70
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rsi
mov r8d, 0x8000
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
jmp 0x140001e61
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Thread_Created_with_ID:
call fcn.1400621a0
mov edx, dword [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140064468]
call fcn.1400621a0
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call fcn.140062b70
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov al, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140062b50
add rsp, 0x78
pop r13
pop rbx
ret