Function at 0x1400112b7
Capabilities:
Allocate or change rwx memory
Capture process snapshot data

Disassembly:
jmp 0x140011a10
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x1a18
call fcn.1400110af
sub rsp, rax
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x4fe
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1a38]
mov rax, qword [0x14001e158]
xor rax, rbp
mov qword [rbp + 0x19e8], rax
lea rcx, [0x14002400f]
call fcn.14001138e
lea rax, [rbp + 0x850]
mov rdi, rax
xor eax, eax
mov ecx, 0x7c8
rep stosb byte [rdi], al
mov qword [rbp + 0x13b8], 0x110
lea r9, [rbp + 0x1318]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x1a10]
call fcn.1400113bb
mov dword [rbp + 0x1354], eax
cmp dword [rbp + 0x1354], 0
je 0x140011ac9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____PssCaptureSnapshot_failed:_Win32_error__d__n
call fcn.140011195
xor eax, eax
jmp 0x140011dd2
mov r9d, 0x2c0
lea r8, [rbp + 0x1040]
xor edx, edx
mov rcx, qword [rbp + 0x1318]
call fcn.1400111f4
mov dword [rbp + 0x1354], eax
cmp dword [rbp + 0x1354], 0
je 0x140011b0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____PssQuerySnapshot_failed:_Win32_error__d__n
call fcn.140011195
xor eax, eax
jmp 0x140011dd2
cmp qword [rbp + 0x1048], 0
jne 0x140011b30
lea rcx, str.____PI.PebBaseAddress_IS_NULL__n
call fcn.140011195
xor eax, eax
jmp 0x140011dd2
mov r8d, 0x7c8
mov rdx, qword [rbp + 0x1048]
lea rcx, [rbp + 0x850]
call fcn.1400113d4
cmp qword [rbp + 0x8a8], 0
jne 0x140011b73
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____KernelCallbackTable_is_NULL_:_Win32_error__d__n
call fcn.140011195
xor eax, eax
jmp 0x140011dd2
mov r8d, 0x400
mov rdx, qword [rbp + 0x8a8]
lea rcx, [rbp + 0x10]
call fcn.1400111b3
mov rdx, qword [rbp + 0x20]
lea rcx, str._i___BEFORE_kct.__fnDWORD_:__0_16p__n
call fcn.140011195
cmp dword [rbp + 0x1a20], 1
jne 0x140011be3
mov r8, qword [rbp + 0x13b8]
mov rdx, qword [rbp + 0x1a18]
lea rcx, [0x14001eb00]
call fcn.1400113d4
lea rax, [0x14001eb00]
test rax, rax
jne 0x140011be3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Buffer_is_NULL:_Win32_error__d__n
call fcn.140011195
xor eax, eax
jmp 0x140011dd2
lea r9, [rbp + 0x1374]
mov r8d, 4
mov rdx, qword [rbp + 0x13b8]
mov rcx, qword [rbp + 0x1a18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rbp + 0x1394], eax
cmp dword [rbp + 0x1394], 1
je 0x140011c2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._____1__VirtualProtect_failed:_Win32_error__d__n
call fcn.140011195
xor eax, eax
jmp 0x140011dd2
mov r8, qword [rbp + 0x13b8]
lea rdx, section..data
mov rcx, qword [rbp + 0x1a18]
call fcn.1400111b3
lea r9, [rbp + 0x1374]
mov r8d, 0x40
mov rdx, qword [rbp + 0x13b8]
mov rcx, qword [rbp + 0x1a18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rbp + 0x1394], eax
cmp dword [rbp + 0x1394], 1
je 0x140011c93
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._____2__VirtualProtect_failed:_Win32_error__d__n
call fcn.140011195
xor eax, eax
jmp 0x140011dd2
mov rdx, qword [rbp + 0x1a18]
lea rcx, str._i__WMIsAO_ADD_:__0_16p__n
call fcn.140011195
mov r8d, 0x400
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x430]
call fcn.1400111b3
mov rax, qword [rbp + 0x1a18]
mov qword [rbp + 0x440], rax
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x1338], rax
mov r8d, 0x400
lea rdx, [rbp + 0x430]
mov rcx, qword [rbp + 0x1338]
call fcn.1400111b3
lea r9, [rbp + 0x1374]
mov r8d, 4
mov edx, 0x7c8
mov rcx, qword [rbp + 0x1048]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rbp + 0x1394], eax
mov rax, qword [rbp + 0x1048]
add rax, 0x58
mov r8d, 8
lea rdx, [rbp + 0x1338]
mov rcx, rax
call fcn.1400113d4
lea r9, [rbp + 0x1374]
mov r8d, dword [rbp + 0x1374]
mov edx, 0x7c8
mov rcx, qword [rbp + 0x1048]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rbp + 0x1394], eax
mov rcx, qword [rbp + 0x1a10]
call fcn.1400113b1
xor r9d, r9d
lea r8, str.test
lea rdx, str.test
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [rbp + 0x1a20], 1
jne 0x140011dc9
mov r8d, 0x400
lea rdx, [0x14001eb00]
mov rcx, qword [rbp + 0x1a18]
call fcn.1400113d4
mov r8d, 0x400
xor edx, edx
lea rcx, [0x14001eb00]
call fcn.1400112cb
mov eax, 1
jmp 0x140011dd2
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001b000]
call fcn.14001131b
mov rax, rdi
mov rcx, qword [rbp + 0x19e8]
xor rcx, rbp
call fcn.1400111ae
lea rsp, [rbp + 0x19f8]
pop rdi
pop rbp
ret