Function at 0x1400014a0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r12d, r12d
mov qword [rbp - 0x41], r12
mov qword [rbp - 0x31], r12
mov ebx, 7
mov qword [rbp - 0x29], rbx
mov word [rbp - 0x41], r12w
mov r8d, ebx
lea rcx, [rbp - 0x41]
call fcn.1400018e0
nop
mov qword [rbp - 0x19], r12
mov qword [rbp - 9], r12
mov qword [rbp - 1], r12
lea r14, [rbp - 0x41]
mov rsi, qword [rbp - 0x41]
mov r15, qword [rbp - 0x29]
cmp r15, 8
cmovae r14, rsi
mov rdi, qword [rbp - 0x31]
cmp rdi, 8
jae 0x14000152f
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x19], xmm0
jmp 0x1400015c2
mov rbx, rdi
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140001864
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000159c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001864
mov rcx, rax
call fcn.140001aa0
mov rcx, rax
test rax, rax
je 0x140001595
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400015ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400015a8
call fcn.140001aa0
jmp 0x1400015ab
mov rax, r12
mov qword [rbp - 0x19], rax
lea r8, [rdi*2 + 2]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 9], rdi
mov qword [rbp - 1], rbx
lea rcx, [rbp - 0x19]
call fcn.140001270
mov ebx, eax
test eax, eax
je 0x1400017f7
mov ecx, eax
call section..text
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000162c
mov qword [rsp + 0x20], r12
mov r9d, 1
lea r8, [rbp - 0x59]
movabs rdx, 0x140447420
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rbp - 0x59], 0x40
jne 0x1400017f7
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400017f7
mov qword [rbp - 0x51], r12
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x1000
mov r8d, 0x3ff9e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r13, rax
test rax, rax
je 0x1400017ed
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
mov qword [rbp - 0x19], r13
mov qword [rbp - 0x11], 0x3fa00
lea rdx, str.LdrGetProcedureAddress
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 9], rax
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 1], rax
lea rdx, str.LdrLoadDll
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 7], rax
lea rdx, str.RtlInitAnsiString
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xf], rax
lea rdx, str.RtlAnsiStringToUnicodeString
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x17], rax
lea rdx, str.RtlFreeUnicodeString
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x1f], rax
lea rax, [rbp - 0x51]
mov qword [rsp + 0x20], rax
mov r9d, 0x3fa00
lea r8, [0x140005040]
mov rdx, r13
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp - 0x51]
mov qword [rsp + 0x20], rax
mov r9d, 0x45e
lea r8, str._USVWATH
lea rdx, [r13 + 0x3fa00]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rbx, [r13 + 0x3fe5e]
lea rax, [rbp - 0x51]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rbp - 0x19]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbx
lea r9, [r13 + 0x3fa00]
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
je 0x1400017ed
mov dword [rbp - 0x49], r12d
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp - 0x49]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov r9d, 0x10000
xor r8d, r8d
mov rdx, r13
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp r15, 8
jb 0x140001835
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000182d
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000182d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140001adc
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140001a80
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
int3