Function at 0x180001950
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov r13d, ecx
mov r14, rdx
lea rcx, [rbp - 0x80]
call fcn.1800031a0
lea rdx, str.Target_process:
lea rcx, [rbp - 0x80]
call fcn.1800055f0
xor edi, edi
lea rcx, [rsp + 0x60]
mov rdx, rax
mov r15d, edi
mov rsi, rax
call fcn.180004820
mov ebx, 4
cmp byte [rsp + 0x68], dil
je 0x180001a50
mov rcx, qword [rsi]
movsxd rdx, dword [rcx + 4]
mov rcx, qword [rdx + rsi + 0x40]
mov rdi, qword [rcx + 8]
mov rcx, rdi
mov qword [rsp + 0x48], rdi
mov rax, qword [rdi]
call qword [rax + 8]
lea rcx, [rsp + 0x40]
call fcn.180005ae0
mov r12, rax
test rdi, rdi
je 0x1800019ff
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x10]
test rax, rax
je 0x1800019ff
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
mov rax, qword [rsi]
lea r8, [rsp + 0x40]
mov r10, qword [r12]
lea rdx, [rsp + 0x50]
mov byte [rsp + 0x40], r15b
mov rcx, r12
mov dword [rsp + 0x28], r13d
movsxd r9, dword [rax + 4]
add r9, rsi
mov rax, qword [r9 + 0x48]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movzx eax, byte [r9 + 0x58]
movdqa xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x20], al
call qword [r10 + 0x40]
cmp byte [rsp + 0x50], r15b
cmovne r15d, ebx
xor edi, edi
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
mov eax, ebx
add rcx, rsi
cmp qword [rcx + 0x48], 0
cmovne eax, edi
or eax, dword [rcx + 0x10]
or eax, r15d
and eax, 0x17
mov dword [rcx + 0x10], eax
and eax, dword [rcx + 0x14]
jne 0x180001dd6
lea rcx, [rsp + 0x60]
call fcn.180004760
lea rdx, str.__dllPath:
mov rcx, rsi
call fcn.1800055f0
mov rcx, rax
mov rdx, r14
call fcn.1800055f0
mov rcx, rax
lea rdx, [0x1800363c0]
call fcn.1800055f0
mov r8d, r13d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x180001b10
lea rdx, str.Good_process_handle._Waiting_for_input_idle...
lea rcx, [rbp - 0x80]
call fcn.1800055f0
mov rcx, rax
lea rdx, [0x1800363c0]
call fcn.1800055f0
mov edx, 0xffffffff
mov rcx, r15
call qword [sym.imp.USER32.dll_WaitForInputIdle]
lea rdx, str.WaitForInputIdle_finished.
lea rcx, [rbp - 0x80]
call fcn.1800055f0
mov rcx, rax
lea rdx, [0x1800363c0]
call fcn.1800055f0
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r12, rax
test rax, rax
je 0x180001b56
lea rdx, str.VirtualAllocEx_was_successfull._Returned_valid_dll_base_address
lea rcx, [rbp - 0x80]
call fcn.1800055f0
mov rcx, rax
lea rdx, [0x1800363c0]
call fcn.1800055f0
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [r14 + r9], 0
jne 0x180001b60
lea rax, [rbp + 0xe0]
inc r9
mov r8, r14
mov qword [rsp + 0x20], rax
mov rdx, r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str.WriteProcessMemory_wrote
lea rcx, [rbp - 0x80]
call fcn.1800055f0
mov rsi, rax
lea rcx, [rsp + 0x40]
mov rax, qword [rbp + 0xe0]
mov rdx, rsi
mov qword [rbp + 0xe8], rax
mov r14d, edi
call fcn.180004820
cmp byte [rsp + 0x48], 0
je 0x180001c68
mov rcx, qword [rsi]
movsxd rdx, dword [rcx + 4]
mov rcx, qword [rdx + rsi + 0x40]
mov rdi, qword [rcx + 8]
mov rcx, rdi
mov qword [rsp + 0x58], rdi
mov rax, qword [rdi]
call qword [rax + 8]
lea rcx, [rsp + 0x50]
call fcn.180005ae0
mov r13, rax
test rdi, rdi
je 0x180001c10
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x10]
test rax, rax
je 0x180001c10
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
mov rax, qword [rsi]
lea r8, [rsp + 0x50]
mov r10, qword [r13]
lea rdx, [rsp + 0x60]
mov byte [rsp + 0x60], 0
mov rcx, r13
movsxd r9, dword [rax + 4]
add r9, rsi
mov rax, qword [r9 + 0x48]
mov qword [rsp + 0x68], rax
mov rax, qword [rbp + 0xe8]
movaps xmm0, xmmword [rsp + 0x60]
mov qword [rsp + 0x28], rax
movzx eax, byte [r9 + 0x58]
mov byte [rsp + 0x20], al
movdqa xmmword [rsp + 0x50], xmm0
call qword [r10 + 0x30]
cmp byte [rsp + 0x60], 0
cmovne r14d, ebx
xor edi, edi
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
cmp qword [rcx + 0x48], 0
cmovne ebx, edi
or ebx, r14d
or ebx, dword [rcx + 0x10]
and ebx, 0x17
mov dword [rcx + 0x10], ebx
and ebx, dword [rcx + 0x14]
jne 0x180001d8b
lea rcx, [rsp + 0x40]
call fcn.180004760
lea rdx, str._Bytes
mov rcx, rsi
call fcn.1800055f0
mov rcx, rax
lea rdx, [0x1800363c0]
call fcn.1800055f0
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
mov qword [rsp + 0x30], rdi
xor edx, edx
mov dword [rsp + 0x28], edi
mov rcx, r15
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
je 0x180001d0a
lea rdx, str.CreateRemoteThread_returned_a_valid_thread_HANDLE._Closing_handle.
lea rcx, [rbp - 0x80]
call fcn.1800055f0
mov rcx, rax
lea rdx, [0x1800363c0]
call fcn.1800055f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea rax, [0x180036688]
mov qword [rbp + rcx - 0x80], rax
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x7c], edx
lea rcx, [rbp - 0x78]
call fcn.180002e30
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea rax, [0x1800366d0]
mov qword [rbp + rcx - 0x80], rax
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea rax, [0x180036608]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x7c], edx
lea rcx, [rbp + 0x28]
mov qword [rbp + 0x28], rax
call fcn.1800088fc
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test bl, 4
je 0x180001d99
lea rbx, str.ios_base::badbit_set
jmp 0x180001dae
test bl, 2
lea rax, str.ios_base::eofbit_set
lea rbx, str.ios_base::failbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rsp + 0x50]
call fcn.1800012d0
mov r8, rax
lea rcx, [rsp + 0x60]
mov rdx, rbx
call fcn.180001840
mov rcx, rax
call fcn.1800010e0
int3
test bl, al
je 0x180001de3
lea rbx, str.ios_base::badbit_set
jmp 0x180001df7
test al, 2
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rsp + 0x50]
call fcn.1800012d0
mov r8, rax
lea rcx, [rsp + 0x60]
mov rdx, rbx
call fcn.180001840
mov rcx, rax
call fcn.1800010e0
int3