Function at 0x140011e50
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Enumerate pe sections
Inject thread
Resume thread
Spawn thread to rwx shellcode
Terminate process
Terminate thread
Use process replacement

Disassembly:
push rdi
sub rsp, 0x9e0
mov qword [rsp + 0xf8], 0xfffffffffffffffe
mov rax, qword [0x14004b078]
xor rax, rsp
mov qword [rsp + 0x9d0], rax
lea rcx, [rsp + 0x640]
call fcn.1400089a0
nop
mov dword [rsp + 0x1a0], 0x10000b
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x100]
call fcn.140016310
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.140016310
movzx r8d, byte [rsp + 0x59]
lea rdx, str.Sentient.sh_Loader
lea rcx, [rsp + 0x6f8]
call fcn.1400037a0
mov rcx, rax
call fcn.14000f100
mov rdx, rax
lea rcx, [0x14004c4f0]
call fcn.1400066f0
lea rdx, [0x140008130]
mov rcx, rax
call fcn.14000a130
movzx r8d, byte [rsp + 0x54]
lea rdx, str.Dont_open_the_game_until_youre_asked_to.
lea rcx, [rsp + 0x740]
call fcn.140002250
mov rcx, rax
call fcn.14000f380
mov rdx, rax
lea rcx, [0x14004c4f0]
call fcn.1400066f0
lea rdx, [0x140008130]
mov rcx, rax
call fcn.14000a130
call fcn.14000e930
movzx eax, al
test eax, eax
je 0x140011f91
movzx r8d, byte [rsp + 0x55]
lea rdx, str.Had_to_close_game_processes__next_time_start_the_loader_first.
lea rcx, [rsp + 0x770]
call fcn.140001230
mov rcx, rax
call fcn.14000f4c0
mov rdx, rax
lea rcx, [0x14004c4f0]
call fcn.1400066f0
lea rdx, [0x140008130]
mov rcx, rax
call fcn.14000a130
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x8c0]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov dword [rsp + 0x68], 0x104
mov r8d, dword [rsp + 0x68]
lea rdx, [rsp + 0x8c0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x8c0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
mov byte [rax], 0
movzx r8d, byte [rsp + 0x56]
lea rdx, str.Cleaning_traces
lea rcx, [rsp + 0x680]
call fcn.140004a50
mov rcx, rax
call fcn.14000f740
mov rdx, rax
lea rcx, [0x14004c4f0]
call fcn.1400066f0
lea rdx, [0x140008130]
mov rcx, rax
call fcn.14000a130
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0xa8]
lea r8, [0x14000dda0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0xc8], rax
movzx r8d, byte [rsp + 0x57]
lea rdx, str.Starting_loader
lea rcx, [rsp + 0x698]
call fcn.140004cb0
mov rcx, rax
call fcn.14000f740
mov rdx, rax
lea rcx, [0x14004c4f0]
call fcn.1400066f0
lea rdx, [0x140008130]
mov rcx, rax
call fcn.14000a130
lea rcx, [rsp + 0xd8]
call fcn.140008f30
nop
lea rcx, [rsp + 0x640]
call fcn.14000db90
mov qword [rsp + 0xf0], rax
movzx r8d, byte [rsp + 0x58]
lea rdx, str._GUI_ldr_pubg.php
lea rcx, [rsp + 0x6b0]
call fcn.140004010
mov rcx, rax
call fcn.14000f060
mov r9b, 1
lea r8, [rsp + 0xd8]
mov rcx, qword [rsp + 0xf0]
mov rdx, rcx
mov rcx, rax
call fcn.14000ade0
movzx eax, al
test eax, eax
jne 0x140012182
movzx r8d, byte [rsp + 0x5f]
lea rdx, str.Fail__terminating.
lea rcx, [rsp + 0x710]
call fcn.140003a70
mov rcx, rax
call fcn.14000f100
mov rdx, rax
lea rcx, [0x14004c4f0]
call fcn.1400066f0
lea rdx, [0x140008130]
mov rcx, rax
call fcn.14000a130
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0xc0], 1
lea rcx, [rsp + 0xd8]
call fcn.140009d00
nop
lea rcx, [rsp + 0x640]
call fcn.140009b50
mov eax, dword [rsp + 0xc0]
jmp 0x1400126b1
xor edx, edx
lea rcx, [rsp + 0xd8]
call fcn.14000a2b0
mov qword [rsp + 0x70], rax
movzx r8d, byte [rsp + 0x5a]
lea rdx, str.calc.exe__
lea rcx, [rsp + 0x670]
call fcn.140005b50
mov rcx, rax
call fcn.14000efc0
mov rdx, rax
lea rcx, [rsp + 0x7b0]
call fcn.14001c530
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0x7b0]
call fcn.14001c490
lea rdx, [0x140035524]
lea rcx, [rsp + 0x7b0]
call fcn.14001c490
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x7b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400122b9
movzx r8d, byte [rsp + 0x5b]
lea rdx, str.Error_doing_magic.
lea rcx, [rsp + 0x728]
call fcn.140003d40
mov rcx, rax
call fcn.14000f100
mov rdx, rax
lea rcx, [0x14004c4f0]
call fcn.1400066f0
lea rdx, [0x140008130]
mov rcx, rax
call fcn.14000a130
mov dword [rsp + 0x98], 1
lea rcx, [rsp + 0xd8]
call fcn.140009d00
nop
lea rcx, [rsp + 0x640]
call fcn.140009b50
mov eax, dword [rsp + 0x98]
jmp 0x1400126b1
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012360
movzx r8d, byte [rsp + 0x5c]
lea rdx, str.Error_validation.
lea rcx, [rsp + 0x6c8]
call fcn.1400042b0
mov rcx, rax
call fcn.14000f060
mov rdx, rax
lea rcx, [0x14004c4f0]
call fcn.1400066f0
lea rdx, [0x140008130]
mov rcx, rax
call fcn.14000a130
mov edx, 1
mov rcx, qword [rsp + 0x80]
call sub.ntdll.dll_NtTerminateProcess
mov dword [rsp + 0x9c], 1
lea rcx, [rsp + 0xd8]
call fcn.140009d00
nop
lea rcx, [rsp + 0x640]
call fcn.140009b50
mov eax, dword [rsp + 0x9c]
jmp 0x1400126b1
mov rax, qword [rsp + 0xb0]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x170]
mov rcx, qword [rsp + 0x88]
call sub.ntdll.dll_NtGetContextThread
mov rax, qword [rsp + 0x1f8]
add rax, 0x10
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0xd0]
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call sub.ntdll.dll_NtReadVirtualMemory
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x30]
cmp qword [rsp + 0xd0], rax
jne 0x1400123ec
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x80]
call sub.ntdll.dll_NtUnmapViewOfSection
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, eax
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax + 0x30]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x1400124b1
movzx r8d, byte [rsp + 0x5d]
lea rdx, str.Error_allocating.
lea rcx, [rsp + 0x6e0]
call fcn.140004550
mov rcx, rax
call fcn.14000f060
mov rdx, rax
lea rcx, [0x14004c4f0]
call fcn.1400066f0
lea rdx, [0x140008130]
mov rcx, rax
call fcn.14000a130
mov edx, 1
mov rcx, qword [rsp + 0x80]
call sub.ntdll.dll_NtTerminateProcess
mov dword [rsp + 0xa0], 1
lea rcx, [rsp + 0xd8]
call fcn.140009d00
nop
lea rcx, [rsp + 0x640]
call fcn.140009b50
mov eax, dword [rsp + 0xa0]
jmp 0x1400126b1
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x60]
mov r9d, dword [rax + 0x54]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [rsp + 0x50], 0
jmp 0x1400124ee
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x60]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x50], eax
jae 0x14001258c
lfence
mov rax, qword [rsp + 0xb0]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 0x50]
imul rcx, rcx, 0x28
lea rax, [rax + rcx + 0x108]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xb8]
mov eax, dword [rax + 0x14]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xb8]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x78]
add rdx, rcx
mov rcx, rdx
mov qword [rsp + 0x20], 0
mov rdx, qword [rsp + 0xb8]
mov r9d, dword [rdx + 0x10]
mov r8, rax
mov rdx, rcx
mov rcx, qword [rsp + 0x80]
call sub.ntdll.dll_NtWriteVirtualMemory
jmp 0x1400124e4
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x60]
add rax, 0x30
mov rcx, qword [rsp + 0x1f8]
add rcx, 0x10
mov qword [rsp + 0x20], 0
mov r9d, 8
mov r8, rax
mov rdx, rcx
mov rcx, qword [rsp + 0x80]
call sub.ntdll.dll_NtWriteVirtualMemory
lea rdx, [rsp + 0x170]
mov rcx, qword [rsp + 0x88]
call sub.ntdll.dll_NtSetContextThread
xor edx, edx
mov rcx, qword [rsp + 0x88]
call sub.ntdll.dll_NtResumeThread
mov rcx, qword [rsp + 0x88]
call sub.ntdll.dll_NtClose
mov rcx, qword [rsp + 0x80]
call sub.ntdll.dll_NtClose
xor edx, edx
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0xc8]
call sub.ntdll.dll_NtClose
movzx r8d, byte [rsp + 0x5e]
lea rdx, str.Started.
lea rcx, [rsp + 0x660]
call fcn.140006000
mov rcx, rax
call fcn.14000ee80
mov rdx, rax
lea rcx, [0x14004c4f0]
call fcn.1400066f0
lea rdx, [0x140008130]
mov rcx, rax
call fcn.14000a130
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0xa4], 0
lea rcx, [rsp + 0xd8]
call fcn.140009d00
nop
lea rcx, [rsp + 0x640]
call fcn.140009b50
mov eax, dword [rsp + 0xa4]
mov rcx, qword [rsp + 0x9d0]
xor rcx, rsp
call fcn.140015310
add rsp, 0x9e0
pop rdi
ret