Function at 0x140001390
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate process modules
Execute shellcode via indirect call
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x4c8
mov rax, qword [0x140018008]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov ebx, ecx
mov ebp, edx
lea rcx, str.KERNEL32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.OpenProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, ebx
xor edx, edx
mov rdi, rax
mov ecx, 0x1fffff
call rdi
mov rsi, rax
test rax, rax
jne 0x140001402
mov r8d, ebx
xor edx, edx
mov ecx, 0x1000
call rdi
mov rsi, rax
test rax, rax
jne 0x140001402
lea eax, [rsi - 3]
jmp 0x1400016a1
mov qword [rsp + 0x508], r14
cmp ebp, 1
jne 0x140001507
xor edx, edx
mov dword [rsp + 0x70], 0x438
mov r8d, 0x434
lea rcx, [rsp + 0x74]
call fcn.140002770
xor edi, edi
lea ecx, [rbp + 0x17]
mov edx, ebx
mov r14d, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x70]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14000148f
nop dword [rax]
nop word [rax + rax]
lea rdx, str.GSGameHook64.dll
lea rcx, [rsp + 0xa0]
call fcn.140003454
test eax, eax
je 0x14000148c
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140001460
jmp 0x14000148f
mov r14d, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
jne 0x1400014a4
mov ebp, edi
jmp 0x140001684
lea rcx, str.KERNEL32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x140015620]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov r9, rax
mov dword [rsp + 0x28], edi
xor edx, edx
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
mov edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001684
mov qword [rsp + 0x4f8], r12
lea rcx, [rsp + 0x40]
xor edi, edi
mov qword [rsp + 0x500], r13
mov qword [rsp + 0x4c0], r15
mov dword [rsp + 0x40], edi
call fcn.1400016c0
lea rcx, str.KERNEL32
mov r15, rax
mov ebp, edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.WriteProcessMemory
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1400155d8]
mov rcx, r12
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VirtualAllocEx
mov rcx, r12
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VirtualFreeEx
mov rcx, r12
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [rsp + 0x40]
mov r9d, 0x1000
add ecx, ecx
mov qword [rsp + 0x58], rax
mov r13d, ecx
xor edx, edx
mov r8d, ecx
mov rcx, rsi
mov dword [rsp + 0x20], 0x40
call rbx
mov r14, rax
test rax, rax
je 0x140001664
lea rax, [rsp + 0x60]
mov r9d, r13d
mov r8, r15
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, rsi
call qword [rsp + 0x48]
test eax, eax
je 0x140001651
lea rdx, [0x140015610]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001651
lea rcx, [rsp + 0x44]
mov r9, rax
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov rcx, rsi
xor edx, edx
mov qword [rsp + 0x20], r14
call qword [rsp + 0x50]
mov rbx, rax
test rax, rax
je 0x140001651
mov edx, 0xc8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140001648
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x40], edi
setne bpl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [rsp + 0x58]
mov rcx, r15
call fcn.140003f2c
mov r15, qword [rsp + 0x4c0]
mov r13, qword [rsp + 0x500]
mov r12, qword [rsp + 0x4f8]
test ebp, ebp
mov ebx, 0xfffffffb
mov rcx, rsi
cmovne ebx, edi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x508]
mov eax, ebx
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.1400017a0
add rsp, 0x4c8
pop rdi
pop rsi
pop rbp
pop rbx
ret