Function at 0x1400063a0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject dll
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov r13, r8
mov edi, edx
mov r12, rcx
mov rdx, qword [rcx + 0x68]
xor ebx, ebx
mov eax, ebx
test rdx, rdx
je 0x1400063d9
cmp word [rdx], ax
sete al
jmp 0x1400063e4
cmp qword [rcx + 0x98], 2
setle al
test eax, eax
jne 0x14000641c
test rdx, rdx
jne 0x140006404
cmp qword [rcx + 0x98], rdx
lea rdx, [0x140035c44]
je 0x140006404
mov rdx, qword [rcx + 0x88]
add rcx, 0x30
call fcn.140006f90
test rax, rax
je 0x14000641c
mov eax, 1
jmp 0x1400068bd
mov rcx, qword [r13 + 0x18]
mov eax, ebx
test rcx, rcx
je 0x140006430
cmp word [rcx], 0
sete al
jmp 0x140006438
cmp qword [r13 + 0x48], 2
setle al
cmp eax, 1
je 0x1400068bb
call fcn.140005f00
test eax, eax
je 0x1400068bb
mov dword [rbp + 0xa0], 0x1f0fff
mov dword [rbp + 0xb8], edi
lea r8, [rbp + 0xa0]
lea rdx, [rbp + 0xb8]
lea rcx, [r12 + 0x30]
call fcn.140007570
test eax, eax
je 0x1400068bb
mov rcx, qword [r13 + 0x18]
test rcx, rcx
je 0x14000649c
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006490
jmp 0x1400064b0
mov rax, qword [r13 + 0x48]
test rax, rax
jne 0x1400064aa
mov rax, rbx
jmp 0x1400064b0
shr rax, 1
dec rax
lea eax, [rax*2 + 2]
cdqe
mov qword [rbp + 0x48], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rax
xor edx, edx
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
je 0x1400068bb
lea r8, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0x10], r8
lea r9, vtable.CVolObject.0
mov qword [rbp + 0x10], r9
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], rbx
lea r10, vtable.CVolMem.0
mov qword [rbp + 0x10], r10
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x40], 0x40
mov qword [rbp - 0x48], r8
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
lea rdx, vtable.CWString.0
mov qword [rbp - 0x48], rdx
lea rax, [rbp - 0x28]
mov qword [rbp + 0xa0], rax
mov qword [rbp - 0x28], r8
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x28], r10
mov qword [rbp - 0x10], rbx
mov qword [rbp], rbx
mov qword [rbp - 8], rbx
mov qword [rbp + 8], 0x40
mov qword [rbp - 0x30], rbx
mov qword [rbp + 8], 0xfe
lea rcx, vtable.CWConstString.0
mov qword [rbp - 0x48], rcx
lea rax, [0x140035168]
mov qword [rbp - 0x30], rax
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x60], rdx
lea rax, [rbp - 0x80]
mov qword [rbp + 0xb8], rax
mov qword [rbp - 0x80], r8
mov qword [rbp - 0x80], r9
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x80], r10
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], 0x40
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x50], 0xfe
mov qword [rsp + 0x60], rcx
lea rax, str.kernel32.dll
mov qword [rsp + 0x78], rax
lea rcx, [0x140035c44]
mov rax, qword [rbp - 0x30]
test rax, rax
cmovne rcx, rax
lea rsi, [0x140035c44]
mov rax, qword [rsp + 0x78]
test rax, rax
cmovne rsi, rax
lea rdx, [rbp + 0x10]
call fcn.1400109a0
mov rdi, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [rbp + 0xb8], rax
lea rax, [rbp - 0x80]
mov qword [rbp + 0x50], rax
lea rax, vtable.CVolMem.0
mov qword [rbp - 0x80], rax
mov rdx, qword [rbp - 0x68]
test rdx, rdx
je 0x140006675
lea rcx, [rbp - 0x80]
mov rax, qword [rbp - 0x80]
call qword [rax + 0x18]
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x60], rbx
lea rsi, vtable.CVolObject.0
mov qword [rbp - 0x80], rsi
mov qword [rsp + 0x60], rsi
lea rax, [rbp - 0x28]
mov qword [rbp + 0xa0], rax
lea rax, vtable.CVolMem.0
mov qword [rbp - 0x28], rax
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x1400066c2
lea rcx, [rbp - 0x28]
mov rax, qword [rbp - 0x28]
call qword [rax + 0x18]
lea rax, vtable.CVolMem.0
mov qword [rbp - 0x10], rbx
mov qword [rbp], rbx
mov qword [rbp - 8], rbx
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x48], rsi
mov qword [rbp + 0x10], rax
mov rdx, qword [rbp + 0x28]
test rdx, rdx
je 0x1400066ee
lea rcx, [rbp + 0x10]
mov rax, qword [rbp + 0x10]
call qword [rax + 0x18]
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x10], rsi
test rdi, rdi
je 0x1400068bb
mov rdi, qword [r13 + 0x18]
test rdi, rdi
jne 0x140006721
cmp qword [r13 + 0x48], rdi
lea rdi, [0x140035c44]
je 0x140006721
mov rdi, qword [r13 + 0x38]
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x1400068a4
mov dword [rbp + 0xa0], ebx
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov rsi, qword [rbp + 0x48]
mov r8, rsi
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1400068a4
mov qword [rsp + 0x20], rbx
mov r9, rsi
mov r8, rdi
mov rdx, r15
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
mov qword [rsp + 0x20], rbx
mov r9d, dword [rbp + 0xa0]
mov r8, rsi
mov rdx, r15
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test edi, edi
je 0x1400068a4
cmp qword [r12 + 0x30], 0
je 0x140006889
mov qword [rbp + 0xa0], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtCreateThreadEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [r12 + 0x30]
mov r9, qword [rbp + 0xb8]
xor r8d, r8d
test rax, rax
je 0x14000681f
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r9
mov r9, rcx
mov edx, 0x1fffff
lea rcx, [rbp + 0xa0]
call rax
mov rax, qword [rbp + 0xa0]
jmp 0x14000683c
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0xa0], rax
test rax, rax
je 0x140006889
mov ebx, 1
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
lea rcx, [r12 + 0x50]
mov rdx, r13
call fcn.1400078a0
mov eax, ebx
jmp 0x1400068bd
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, ebx
jmp 0x1400068bd
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret