Function at 0x140011f80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rsi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x1400e5430]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r14, rcx
mov qword [rcx + 8], rdx
lea rcx, [0x1400c8110]
mov r12, rdx
call fcn.14036b37a
nop
mov rcx, qword [r14]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor esi, esi
lea rcx, str.xxxx____xxx____xxxxxxxxx
mov dword [rbp - 0x75], esi
mov dword [rbp - 0x51], 0xb8d18b4c
mov dword [rbp - 0x4d], esi
mov r15, rax
mov dword [rbp - 0x49], 0x2504f6
mov dword [rbp - 0x45], 0x1000000
mov dword [rbp - 0x41], 0x50f0375
mov dword [rbp - 0x3d], 0xc32ecdc3
call fcn.14036b37a
nop
mov r8, rax
lea rax, [rbp - 0x51]
mov r9, r15
sub r9, rax
lea rax, [rbp - 0x51]
mov qword [rsp + 0x120], rbx
lea rcx, [rbp - 0x51]
mov edx, esi
mov qword [rsp + 0xd8], rdi
sub r8, rax
nop dword [rax + rax]
cmp byte [rcx + r8], 0x3f
je 0x140012044
movzx eax, byte [rcx]
cmp byte [rcx + r9], al
jne 0x140012163
inc edx
inc rcx
cmp edx, 0x18
jl 0x140012030
mov eax, dword [r15 + 0xb]
mov ebx, 1
mov dword [rbp - 0x75], eax
mov edi, dword [r15 + 4]
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, r12
mov qword [rsp + 0xd0], r13
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rcx, qword [r14 + 8]
mov r13, rax
lea rax, [rbp - 0x51]
lea r8, [rbp - 0x79]
mov r9d, 3
mov rdx, r13
mov word [rbp - 0x79], 0x8b4c
mov qword [rsp + 0x20], rax
mov byte [rbp - 0x77], 0xd1
mov qword [rbp - 0x51], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [r14 + 8]
cmp ebx, 1
lea rbx, [r13 + 3]
lea rax, [rbp - 0x51]
mov byte [rbp - 0x19], 0xb8
mov dword [rbp - 0x18], edi
mov qword [rbp - 0x51], rsi
mov r9d, 5
mov rdx, rbx
lea r8, [rbp - 0x19]
mov qword [rsp + 0x20], rax
jne 0x1400121cd
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [rbp - 0x75]
mov rcx, qword [r14 + 8]
mov dword [rbp + 2], eax
lea rax, [rbp - 0x51]
lea r8, [rbp - 1]
lea rdx, [rbx + 5]
mov r9d, 8
mov word [rbp - 1], 0x4f6
mov qword [rsp + 0x20], rax
mov byte [rbp + 1], 0x25
mov byte [rbp + 6], 1
mov qword [rbp - 0x51], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [r14 + 8]
lea rax, [rbp - 0x51]
lea r8, [rbp - 0x39]
lea rdx, [rbx + 0xd]
mov r9d, 8
mov dword [rbp - 0x39], 0x50f0375
mov dword [rbp - 0x35], 0xc32ecdc3
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x51], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 0x15
jmp 0x14001220a
lea rcx, [0x1400c8140]
mov dword [rbp - 0x51], 0xb8d18b4c
mov dword [rbp - 0x4d], esi
mov dword [rbp - 0x49], 0xfc3050f
mov dword [rbp - 0x45], 0x441f
call fcn.14036b37a
nop
mov r8, rax
lea rax, [rbp - 0x51]
mov r9, r15
sub r9, rax
lea rax, [rbp - 0x51]
lea rcx, [rbp - 0x51]
sub r8, rax
mov edx, esi
cmp byte [rcx + r8], 0x3f
je 0x1400121b2
movzx eax, byte [rcx]
cmp byte [rcx + r9], al
jne 0x1400121c6
inc edx
inc rcx
cmp edx, 0x10
jl 0x1400121a2
mov ebx, 2
jmp 0x14001205a
xor al, al
jmp 0x140012628
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [r14 + 8]
lea rax, [rbp - 0x51]
lea r8, [rbp - 0x39]
lea rdx, [rbx + 5]
mov r9d, 8
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x39], 0xfc3050f
mov dword [rbp - 0x35], 0x441f
mov qword [rbp - 0x51], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 0xd
mov rcx, qword [r14 + 8]
lea rax, [rbp - 0x51]
lea r8, [rbp - 0x29]
mov r9d, 5
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rdi, rbx
mov dword [rbp - 0x29], 0xb70f4466
mov byte [rbp - 0x25], setsockopt
mov qword [rbp - 0x51], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [r14 + 8]
lea rax, [rbp - 0x51]
lea r8, [rbp - 0x31]
lea rdx, [rbx + 5]
mov r9d, 5
mov dword [rbp - 0x31], 0xfa834166
mov byte [rbp - 0x2d], 0x18
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x51], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [r14 + 8]
lea rax, [rbp - 0x51]
lea r8, [rbp - 0x79]
lea rdx, [rbx + 0xa]
mov r9d, 2
mov qword [rsp + 0x20], rax
mov word [rbp - 0x79], 0x8c0f
mov qword [rbp - 0x51], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [r14 + 8]
add rbx, 0xc
mov eax, r13d
sub eax, ebx
lea r8, [rbp - 0x75]
mov r9d, 4
sub eax, 4
mov rdx, rbx
mov qword [rbp - 0x51], rsi
mov dword [rbp - 0x75], eax
lea rax, [rbp - 0x51]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [r14 + 8]
lea rax, [rbp - 0x51]
lea r8, [rbp - 0x61]
lea rdx, [rbx + 4]
mov r9d, 4
mov dword [rbp - 0x61], 0x8528b4c
mov qword [rbp - 0x51], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [r14 + 8]
lea rax, [rbp - 0x51]
lea r8, [rbp - 0x69]
lea rdx, [rbx + 8]
mov r9d, 4
mov dword [rbp - 0x69], 0xfa8349
mov qword [rbp - 0x51], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [r14 + 8]
lea rax, [rbp - 0x51]
lea r8, [rbp - 0x79]
lea rdx, [rbx + 0xc]
mov r9d, 2
mov word [rbp - 0x79], 0x840f
mov qword [rbp - 0x51], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 0xe
mov eax, r13d
mov qword [rbp - 0x51], rsi
mov r9d, 4
sub eax, ebx
lea r8, [rbp - 0x75]
mov rdx, rbx
sub eax, 4
mov dword [rbp - 0x75], eax
lea rax, [rbp - 0x51]
mov qword [rsp + 0x20], rax
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [rbp - 0x39]
add rbx, 4
mov r9d, 0x700041
mov r8, r13
mov rcx, r14
mov qword [rbp - 0x39], rbx
call fcn.140011e30
lea rdx, [rbp - 0x39]
mov r9d, 0x490070
mov r8, r13
mov rcx, r14
call fcn.140011e30
lea rdx, [rbp - 0x39]
mov r9d, 0x69006e
mov r8, r13
mov rcx, r14
call fcn.140011e30
lea rdx, [rbp - 0x39]
mov r9d, 0x5f0074
mov r8, r13
mov rcx, r14
call fcn.140011e30
lea rdx, [rbp - 0x39]
mov r9d, 0x4c0044
mov r8, r13
mov rcx, r14
call fcn.140011e30
lea rdx, [rbp - 0x39]
mov r9d, 0x73004c
mov r8, r13
mov rcx, r14
call fcn.140011e30
mov rbx, qword [rbp - 0x39]
mov rcx, qword [r14 + 8]
lea rax, [rbp - 0x51]
lea r8, [rbp - 0x11]
mov rdx, rbx
mov r9d, 5
mov dword [rbp - 0x11], 0x3a834166
mov byte [rbp - 0xd], sil
mov qword [rbp - 0x51], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [r14 + 8]
lea rax, [rbp - 0x51]
lea r8, [rbp - 0x79]
lea rdx, [rbx + 5]
mov r9d, 2
mov qword [rsp + 0x20], rax
mov word [rbp - 0x79], 0x850f
mov qword [rbp - 0x51], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [r14 + 8]
add rbx, 7
lea rax, [rbp - 0x51]
sub r13d, ebx
lea r8, [rbp - 0x75]
mov r9d, 4
sub r13d, 4
mov rdx, rbx
mov qword [rbp - 0x51], rsi
mov dword [rbp - 0x75], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [r14 + 8]
lea rax, [rbp - 0x51]
lea r8, [rbp - 0x21]
lea rdx, [rbx + 4]
mov r9d, 5
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x21], 0x24548b4c
mov byte [rbp - 0x1d], 0x30
mov qword [rbp - 0x51], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rbp - 0x51]
mov qword [rbp - 0x51], rsi
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x69]
mov rcx, qword [r14 + 8]
lea rdx, [rbx + 9]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [r14 + 8]
lea rax, [rbp - 0x51]
lea r8, [rbp - 0x6d]
lea rdx, [rbx + 0xd]
mov r9d, 2
mov qword [rsp + 0x20], rax
mov word [rbp - 0x6d], 0x774
mov qword [rbp - 0x51], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [r14 + 8]
lea rax, [rbp - 0x51]
lea r8, [rbp - 9]
lea rdx, [rbx + 0xf]
mov r9d, 7
mov qword [rsp + 0x20], rax
mov dword [rbp - 9], 0x2c741
mov word [rbp - 5], si
mov byte [rbp - 3], sil
mov qword [rbp - 0x51], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [r14 + 8]
lea rax, [rbp - 0x51]
lea r8, [rbp - 0x65]
lea rdx, [rbx + 0x16]
mov r9d, 3
mov qword [rsp + 0x20], rax
mov word [rbp - 0x65], 0x3148
mov byte [rbp - 0x63], 0xc0
mov qword [rbp - 0x51], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [r14 + 8]
lea rax, [rbp - 0x51]
lea rdx, [rbx + 0x19]
lea r8, [rbp - 0x71]
mov r9d, 1
mov qword [rsp + 0x20], rax
mov byte [rbp - 0x71], 0xc3
mov qword [rbp - 0x51], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 0x40
lea rax, [rbp - 0x5d]
lea r8d, [r9 - 0x33]
mov rdx, r15
mov rcx, r12
mov qword [rbp - 0x59], rsi
mov word [rbp + 7], 0xba49
mov word [rbp + 0x11], 0xff41
mov byte [rbp + 0x13], 0xe2
mov qword [rbp + 9], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp - 0x59]
lea r8, [rbp + 7]
mov r9d, 0xd
mov rdx, r15
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 0x20
lea rax, [rbp - 0x5d]
lea r8d, [r9 - 0x13]
mov rdx, r15
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp qword [rbp - 0x59], 0xd
mov r13, qword [rsp + 0xd0]
sete al
mov rdi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x120]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14007e1c0
add rsp, 0xe0
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret