It has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via KernelCallbackTable hijacking. It has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.