Function at 0x140011262
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x140011880
push rbp
push rdi
sub rsp, 0x2c8
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x6a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e008]
xor rax, rbp
mov qword [rbp + 0x258], rax
lea rcx, [0x14002300f]
call fcn.140011361
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 8], rax
lea rdx, str.NtAllocateVirtualMemory
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x28], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001e710], eax
lea rdx, str.NtWriteVirtualMemory
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x48], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x48]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001e19c], eax
lea rdx, str.NtCreateThreadEx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x68], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x68]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001e198], eax
lea rdx, str.NtWaitForSingleObject
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x88], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x88]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001e174], eax
mov qword [rbp + 0xa8], 0
movzx eax, byte [0x14001ac10]
mov byte [rbp + 0xc4], al
mov qword [rbp + 0xe8], 0x1000
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0xe8]
xor r8d, r8d
lea rdx, [rbp + 0xa8]
mov rcx, 0xffffffffffffffff
call fcn.1400113b1
mov dword [rbp + 0x104], eax
cmp dword [rbp + 0x104], 0
jl 0x1400119f5
lea rcx, str.Successfully_applied_for_memory:_n
call fcn.14001118b
jmp 0x140011a07
mov edx, dword [rbp + 0x104]
lea rcx, str.Failed_to_apply_for_memory:0x_08X_n
call fcn.14001118b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rbp + 0x124]
mov qword [rsp + 0x20], rcx
mov r9d, 1
lea r8, [rbp + 0xc4]
mov rdx, qword [rbp + 0xa8]
mov rcx, rax
call fcn.1400113b6
mov dword [rbp + 0x144], eax
cmp dword [rbp + 0x144], 0
jl 0x140011a52
lea rcx, str.Write_to_memory_successful:_n
call fcn.14001118b
jmp 0x140011a64
mov edx, dword [rbp + 0x144]
lea rcx, str.Write_to_memory_failed:0x_08X_n
call fcn.14001118b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rcx, qword [rbp + 0xa8]
mov qword [rsp + 0x20], rcx
mov r9, rax
xor r8d, r8d
mov edx, 0x20000000
lea rcx, [rbp + 0x168]
call fcn.1400111d1
mov dword [rbp + 0x184], eax
cmp dword [rbp + 0x184], 0
jl 0x140011adf
lea rcx, str.Successfully_created_thread:_n
call fcn.14001118b
jmp 0x140011af1
mov edx, dword [rbp + 0x184]
lea rcx, str.Create_thread_failed:0x_08X_n
call fcn.14001118b
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x168]
call fcn.140011393
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x60]
lea rdx, [0x14001adc0]
call fcn.1400112fd
mov eax, edi
mov rcx, qword [rbp + 0x258]
xor rcx, rbp
call fcn.1400111a4
lea rsp, [rbp + 0x268]
pop rdi
pop rbp
ret