Function at 0x140001760
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x318
xor edx, edx
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400019d9
lea rdi, [rsp + 0xd0]
mov rcx, rax
mov dword [rsp + 0xd0], 0x238
mov rdx, rdi
call sym.Process32FirstW
test eax, eax
je 0x1400019f8
mov rbp, qword [sym.imp.KERNEL32.dll_lstrcmpW]
lea r13, [rsp + 0xfc]
lea r12, str.cs2.exe
jmp 0x1400017e3
mov rdx, rdi
mov rcx, rsi
call sym.Process32NextW
test eax, eax
je 0x1400019f8
mov rdx, r12
mov rcx, r13
call rbp
mov ebx, eax
test eax, eax
jne 0x1400017d0
xor edx, edx
mov ecx, 0x2a
mov r8d, dword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x1400019d9
movsxd rbp, dword [0x14000403c]
xor edx, edx
lea r14, section..data
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rcx, rdi
mov r15, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
add rbp, r14
mov r8d, dword [rbp + 0x50]
call r15
mov r13, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8, r14
mov rcx, rdi
mov qword [rsp + 0x20], 0
mov r12, rax
mov rdx, rax
mov r9d, dword [rbp + 0x54]
call r13
cmp word [rbp + 6], 0
je 0x1400018ae
lea rsi, [rbp + 0x114]
nop
mov eax, dword [rsi + 8]
mov edx, dword [rsi]
mov rcx, rdi
add ebx, 1
mov qword [rsp + 0x20], 0
mov r9d, dword [rsi + 4]
add rsi, 0x28
add rdx, r12
lea r8, [r14 + rax]
call r13
movzx eax, word [rbp + 6]
cmp eax, ebx
jg 0x140001880
mov r9d, 0x3000
mov r8d, 0x1000
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], 0x20
call r15
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll
movq xmm0, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov qword [rsp + 0x40], r12
movq xmm1, rsi
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.RtlZeroMemory
mov rcx, rax
call rsi
mov rdx, rbx
lea rsi, [rbx + 0x20]
mov r9d, 0x20
lea r8, [rsp + 0x40]
mov rcx, rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], 0
call r13
lea r8, [sym.ManualMap]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], 0
lea r9, [sym.stub]
sub r9d, r8d
call r13
mov r9, rsi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, rbx
lea rbx, [rsp + 0x60]
xor r8d, r8d
mov r9d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
lea r9, str.cs2.exe
mov edx, 0x64
mov rcx, rbx
lea r8, str.Dll_successfully_loaded_into__ws_at_0x_x
mov dword [rsp + 0x20], r12d
call qword [sym.sprintf_s]
mov r9d, 0x40
mov rdx, rbx
xor ecx, ecx
lea r8, str.Success
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
add rsp, 0x318
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400019d9