Function at 0x14001164f
Capabilities:
Create thread
Enumerate processes
Inject thread

Disassembly:
jmp 0x140029650
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2f8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x7e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x318]
mov rax, qword [0x140037040]
xor rax, rbp
mov qword [rbp + 0x2a8], rax
lea rcx, [0x14003f249]
call fcn.140011c44
xor edx, edx
mov ecx, 2
call fcn.1400115cd
mov qword [rbp + 8], rax
mov dword [rbp + 0x30], 0x130
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140011a00
test eax, eax
jne 0x1400296d7
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1400298d6
mov dword [rbp + 0x174], 0
mov rdx, qword [rbp + 0x2d0]
lea rcx, [rbp + 0x5c]
call fcn.140011d9d
test eax, eax
jne 0x140029700
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x174], eax
jmp 0x140029711
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140011c5d
test eax, eax
jne 0x1400296e1
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 0x174], 0
jne 0x14002972b
xor al, al
jmp 0x1400298d6
mov r8d, dword [rbp + 0x174]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x198], 0
jne 0x140029757
xor al, al
jmp 0x1400298d6
mov rcx, qword [rbp + 0x2d8]
call fcn.140011573
inc rax
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x1b8], rax
cmp qword [rbp + 0x1b8], 0
jne 0x1400297ab
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1400298d6
mov rcx, qword [rbp + 0x2d8]
call fcn.140011573
inc rax
mov qword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x2d8]
mov rdx, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140029816
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1400298d6
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x1b8]
mov qword [rsp + 0x20], rax
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x1d8], rax
cmp qword [rbp + 0x1d8], 0
jne 0x14002988b
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1400298d6
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140030620]
call fcn.140011a19
mov rax, rdi
mov rcx, qword [rbp + 0x2a8]
xor rcx, rbp
call fcn.1400115f5
lea rsp, [rbp + 0x2b8]
pop rdi
pop rbp
ret