Function at 0x180001180
Capabilities:
Allocate or change rwx memory
Create thread
Get system information on windows
Spawn thread to rwx shellcode

Disassembly:
mov r11, rsp
sub rsp, 0xc8
mov rax, qword [0x1800ae040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rax, qword [0x1800aef50]
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 - 8], rdi
cmp byte [rax], 0
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x18], r13
je 0x180001206
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rax
lea rdx, [0x180074760]
lea rcx, str.CONOUT_
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rax
lea rdx, [0x180074760]
lea rcx, str.CONOUT_
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen]
lea r9, str.Nov_15_2024
lea r8, str.0.5.6
lea rdx, str.INFO:_MK1Hook___s___s__Begin_
lea rcx, str.OnInitializeHook
call fcn.18005e3f0
mov rax, qword gs:[0x58]
mov ecx, dword [0x1800aea00]
mov edx, 4
mov rbx, qword [rax + rcx*8]
add rbx, rdx
mov eax, dword [rbx]
cmp dword [0x1800bfd9c], eax
jle 0x18000127b
lea rcx, [0x1800bfd9c]
call fcn.180072410
cmp dword [0x1800bfd9c], 0xffffffff
jne 0x18000127b
mov rax, qword [0x1800aed58]
lea rcx, [0x1800bfd9c]
mov qword [0x1800bfdb8], rax
call fcn.1800723a4
mov rcx, qword [0x1800bfdb8]
test rcx, rcx
je 0x180001297
mov eax, dword [rcx]
add rcx, 4
add rcx, rax
mov qword [0x1800aecf0], rcx
mov eax, dword [rbx]
cmp dword [0x1800c0148], eax
jle 0x1800012d0
lea rcx, [0x1800c0148]
call fcn.180072410
cmp dword [0x1800c0148], 0xffffffff
jne 0x1800012d0
mov rax, qword [0x1800aeea0]
lea rcx, [0x1800c0148]
mov qword [0x1800c0140], rax
call fcn.1800723a4
mov rcx, qword [0x1800c0140]
test rcx, rcx
je 0x1800012ec
mov eax, dword [rcx]
add rcx, 4
add rcx, rax
mov qword [0x1800aef10], rcx
mov rax, qword [0x1800aef50]
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xa8], r14
cmp byte [rax + 2], 0
je 0x1800013ae
lea r14, str.xinput1_4.dll
mov esi, 0xffffffff
mov rbx, r14
lea rbp, str.string_too_long
xor edi, edi
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1800aeca0], rax
test rax, rax
jne 0x18000134e
inc edi
add rbx, 8
cmp rbx, rbp
jl 0x180001325
mov rcx, qword [0x1800aec98]
jmp 0x180001371
lea rdx, str.XInputGetState
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov qword [0x1800aec98], rax
mov rax, qword [0x1800aeca0]
mov esi, edi
test rax, rax
je 0x18000139b
test rcx, rcx
je 0x18000139b
test esi, esi
js 0x18000139b
movsxd r8, esi
lea rdx, str.XInput_loaded___DLL:__s_
lea rcx, str.eGamepadManager::Initialize
mov r8, qword [r14 + r8*8]
call fcn.18005e3f0
jmp 0x1800013ae
lea rdx, str.Failed_to_initialize_XInput_
lea rcx, str.eGamepadManager::Initialize
call fcn.18005e3f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, qword [0x1800aea20]
mov r12d, 0x80000000
mov rbp, rax
mov r13d, 0xffffffff
test rbx, rbx
je 0x1800013f3
mov rcx, qword [rbx + 8]
sub rcx, rbp
add rcx, r12
cmp rcx, r13
ja 0x1800013eb
cmp qword [rbx + 0x10], 0xe
jae 0x1800014d9
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1800013d1
lea rcx, [rsp + 0x60]
mov qword [rsp + 0xa0], r15
mov rdi, rbp
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x88]
lea rdx, [rsp + 0x30]
mov r15d, ecx
mov r8d, 0x30
lea r14d, [rcx - 1]
lea rsi, [rcx + 0x25]
not r14
mov rcx, rbp
and rsi, r14
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800014ae
nop word [rax + rax]
cmp dword [rsp + 0x50], 0x10000
jne 0x18000148d
mov rax, qword [rsp + 0x48]
cmp rax, rsi
jb 0x180001492
mov rcx, qword [rsp + 0x30]
dec rcx
add rcx, r15
and rcx, r14
mov rax, rcx
sub rax, rbp
add rax, r12
cmp rax, r13
ja 0x1800014ae
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800014b0
mov rax, qword [rsp + 0x48]
add rdi, rax
lea rdx, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180001440
xor ebx, ebx
mov rax, qword [0x1800aea20]
mov r15, qword [rsp + 0xa0]
mov qword [0x1800aea20], rbx
mov qword [rbx], rax
lea rax, [rbx + 0x18]
mov qword [rbx + 8], rax
lea rax, [rsi - 0x18]
mov qword [rbx + 0x10], rax
mov rax, qword [rbx + 0x10]
lea rcx, [0x180070fc0]
mov r14, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
cmp rax, 0xe
jb 0x180001532
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rdx
mov qword [rbx + 0x10], rax
test rdx, rdx
je 0x180001534
add qword [rbx + 8], 0xe
add rax, 0xfffffffffffffff2
mov qword [rbx + 0x10], rax
jmp 0x180001534
xor edx, edx
mov dword [rdx], 0x25ff
mov word [rdx + 4], 0
mov qword [rdx + 6], rcx
mov rcx, qword [0x1800aed38]
call fcn.180001ca0
mov rcx, qword [rbx + 0x10]
lea r8, [0x180062770]
cmp rcx, 0xe
jb 0x180001581
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rdx
mov qword [rbx + 0x10], rcx
test rdx, rdx
je 0x180001583
add qword [rbx + 8], 0xe
lea rax, [rcx - 0xe]
mov qword [rbx + 0x10], rax
jmp 0x180001583
xor edx, edx
mov dword [rdx], 0x25ff
mov word [rdx + 4], 0
mov rcx, qword [0x1800aed48]
mov qword [rdx + 6], r8
call fcn.180001ca0
mov r8, qword [0x1800aee50]
lea rdi, [0x180063520]
movsxd rax, dword [r8 + 1]
lea rcx, [r8 + 5]
add rcx, rax
mov qword [0x1800aed00], rcx
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xe
jb 0x1800015e9
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rdx
mov qword [rbx + 0x10], rcx
test rdx, rdx
je 0x1800015eb
add qword [rbx + 8], 0xe
lea rax, [rcx - 0xe]
mov qword [rbx + 0x10], rax
jmp 0x1800015eb
xor edx, edx
mov dword [rdx], 0x25ff
mov rcx, r8
mov word [rdx + 4], 0
mov qword [rdx + 6], rdi
call fcn.180001ca0
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xe
jb 0x18000162d
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rdx
mov qword [rbx + 0x10], rcx
test rdx, rdx
je 0x18000162f
add qword [rbx + 8], 0xe
lea rax, [rcx - 0xe]
mov qword [rbx + 0x10], rax
jmp 0x18000162f
xor edx, edx
mov dword [rdx], 0x25ff
mov word [rdx + 4], 0
mov rcx, qword [0x1800aee58]
mov qword [rdx + 6], rdi
call fcn.180001ca0
mov r8, qword [0x1800aeee8]
lea r9, [0x180064bd0]
mov rdi, qword [rsp + 0xc0]
movsxd rax, dword [r8 + 1]
lea rcx, [r8 + 5]
add rcx, rax
mov qword [0x1800aed28], rcx
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xe
jb 0x18000169d
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rdx
mov qword [rbx + 0x10], rcx
test rdx, rdx
je 0x18000169f
add qword [rbx + 8], 0xe
lea rax, [rcx - 0xe]
mov qword [rbx + 0x10], rax
jmp 0x18000169f
xor edx, edx
mov dword [rdx], 0x25ff
mov rcx, r8
mov word [rdx + 4], 0
mov qword [rdx + 6], r9
call fcn.180001ca0
mov rcx, qword [0x1800aeeb0]
lea r8, [0x1800aecb8]
lea rdx, [0x180060c10]
movsxd rax, dword [rcx + 1]
add rcx, 5
add rcx, rax
mov qword [0x1800aece8], rcx
mov rcx, qword [0x1800aeeb8]
movsxd rax, dword [rcx + 1]
add rcx, 5
add rcx, rax
mov qword [0x1800aece0], rcx
mov rcx, qword [0x1800aeec0]
movsxd rax, dword [rcx + 1]
add rcx, 5
add rcx, rax
mov qword [0x1800aecd8], rcx
mov rcx, qword [0x1800aeed0]
movsxd rax, dword [rcx + 1]
add rcx, 5
add rcx, rax
mov qword [0x1800aecc8], rcx
mov rcx, qword [0x1800aeed8]
movsxd rax, dword [rcx + 1]
add rcx, 5
add rcx, rax
mov qword [0x1800aecd0], rcx
mov rcx, qword [0x1800aee68]
call fcn.18005fb30
mov rcx, qword [0x1800aee68]
call fcn.18005fe20
mov rcx, qword [0x1800aee70]
lea r8, [0x1800aecb0]
lea rdx, [0x180060ca0]
call fcn.18005fb30
mov rcx, qword [0x1800aee70]
call fcn.18005fe20
mov rcx, qword [0x1800aee98]
lea r8, [0x1800aed20]
lea rdx, [0x180064b00]
call fcn.18005fb30
mov rcx, qword [0x1800aee98]
call fcn.18005fe20
mov rcx, qword [0x1800aede8]
lea r8, [0x1800aecc0]
lea rdx, [0x180061390]
call fcn.18005fb30
mov rcx, qword [0x1800aede8]
call fcn.18005fe20
mov rcx, qword [0x1800aeea8]
lea r8, [0x1800aed18]
lea rdx, [0x180063bf0]
call fcn.18005fb30
mov rcx, qword [0x1800aeea8]
call fcn.18005fe20
mov rcx, qword [0x1800aee48]
lea r8, [0x1800aed08]
lea rdx, [0x180063550]
call fcn.18005fb30
mov rcx, qword [0x1800aee48]
call fcn.18005fe20
mov rcx, qword [0x1800aeee0]
lea r8, [0x1800aed10]
lea rdx, [0x180064bb0]
call fcn.18005fb30
mov rcx, qword [0x1800aeee0]
call fcn.18005fe20
xor r9d, r9d
mov qword [rsp + 0x28], 0
lea r8, [0x180002610]
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0xd0]
test rax, rax
je 0x180001879
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180071cc0
add rsp, 0xc8
ret