Function at 0x1400112c6
Capabilities:
Allocate or change rwx memory
Capture process snapshot data

Disassembly:
jmp 0x140011a20
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x1a18
call fcn.1400110af
sub rsp, rax
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x4fe
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1a38]
mov rax, qword [0x14001e158]
xor rax, rbp
mov qword [rbp + 0x19e8], rax
lea rcx, [0x1400240a4]
call fcn.14001139d
lea rax, [rbp + 0x850]
mov rdi, rax
xor eax, eax
mov ecx, 0x7c8
rep stosb byte [rdi], al
mov qword [rbp + 0x13b8], 0x115
lea r9, [rbp + 0x1318]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x1a10]
call fcn.1400113ca
mov dword [rbp + 0x1354], eax
cmp dword [rbp + 0x1354], 0
je 0x140011ad9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____PssCaptureSnapshot_failed:_Win32_error__d__n
call fcn.14001119f
xor eax, eax
jmp 0x140011de2
mov r9d, 0x2c0
lea r8, [rbp + 0x1040]
xor edx, edx
mov rcx, qword [rbp + 0x1318]
call fcn.1400111fe
mov dword [rbp + 0x1354], eax
cmp dword [rbp + 0x1354], 0
je 0x140011b1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____PssQuerySnapshot_failed:_Win32_error__d__n
call fcn.14001119f
xor eax, eax
jmp 0x140011de2
cmp qword [rbp + 0x1048], 0
jne 0x140011b40
lea rcx, str.____PI.PebBaseAddress_IS_NULL__n
call fcn.14001119f
xor eax, eax
jmp 0x140011de2
mov r8d, 0x7c8
mov rdx, qword [rbp + 0x1048]
lea rcx, [rbp + 0x850]
call fcn.1400113e3
cmp qword [rbp + 0x8a8], 0
jne 0x140011b83
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____KernelCallbackTable_is_NULL_:_Win32_error__d__n
call fcn.14001119f
xor eax, eax
jmp 0x140011de2
mov r8d, 0x400
mov rdx, qword [rbp + 0x8a8]
lea rcx, [rbp + 0x10]
call fcn.1400111bd
mov rdx, qword [rbp + 0x20]
lea rcx, str._i___BEFORE_kct.__fnDWORD_:__0_16p__n
call fcn.14001119f
cmp dword [rbp + 0x1a20], 1
jne 0x140011bf3
mov r8, qword [rbp + 0x13b8]
mov rdx, qword [rbp + 0x1a18]
lea rcx, [0x14001eb00]
call fcn.1400113e3
lea rax, [0x14001eb00]
test rax, rax
jne 0x140011bf3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Buffer_is_NULL:_Win32_error__d__n
call fcn.14001119f
xor eax, eax
jmp 0x140011de2
lea r9, [rbp + 0x1374]
mov r8d, 4
mov rdx, qword [rbp + 0x13b8]
mov rcx, qword [rbp + 0x1a18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rbp + 0x1394], eax
cmp dword [rbp + 0x1394], 1
je 0x140011c3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._____1__VirtualProtect_failed:_Win32_error__d__n
call fcn.14001119f
xor eax, eax
jmp 0x140011de2
mov r8, qword [rbp + 0x13b8]
lea rdx, section..data
mov rcx, qword [rbp + 0x1a18]
call fcn.1400111bd
lea r9, [rbp + 0x1374]
mov r8d, 0x40
mov rdx, qword [rbp + 0x13b8]
mov rcx, qword [rbp + 0x1a18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rbp + 0x1394], eax
cmp dword [rbp + 0x1394], 1
je 0x140011ca3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._____2__VirtualProtect_failed:_Win32_error__d__n
call fcn.14001119f
xor eax, eax
jmp 0x140011de2
mov rdx, qword [rbp + 0x1a18]
lea rcx, str._i__WMIsAO_ADD_:__0_16p__n
call fcn.14001119f
mov r8d, 0x400
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x430]
call fcn.1400111bd
mov rax, qword [rbp + 0x1a18]
mov qword [rbp + 0x440], rax
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x1338], rax
mov r8d, 0x400
lea rdx, [rbp + 0x430]
mov rcx, qword [rbp + 0x1338]
call fcn.1400111bd
lea r9, [rbp + 0x1374]
mov r8d, 4
mov edx, 0x7c8
mov rcx, qword [rbp + 0x1048]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rbp + 0x1394], eax
mov rax, qword [rbp + 0x1048]
add rax, 0x58
mov r8d, 8
lea rdx, [rbp + 0x1338]
mov rcx, rax
call fcn.1400113e3
lea r9, [rbp + 0x1374]
mov r8d, dword [rbp + 0x1374]
mov edx, 0x7c8
mov rcx, qword [rbp + 0x1048]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rbp + 0x1394], eax
mov rcx, qword [rbp + 0x1a10]
call fcn.1400113c0
xor r9d, r9d
lea r8, str.test
lea rdx, str.test
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [rbp + 0x1a20], 1
jne 0x140011dd9
mov r8d, 0x400
lea rdx, [0x14001eb00]
mov rcx, qword [rbp + 0x1a18]
call fcn.1400113e3
mov r8d, 0x400
xor edx, edx
lea rcx, [0x14001eb00]
call fcn.1400112da
mov eax, 1
jmp 0x140011de2
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001b010]
call fcn.14001132a
mov rax, rdi
mov rcx, qword [rbp + 0x19e8]
xor rcx, rbp
call fcn.1400111b8
lea rsp, [rbp + 0x19f8]
pop rdi
pop rbp
ret