Function at 0x18004fea0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180064040]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov esi, 1
mov edi, ebx
xor eax, eax
lock cmpxchg dword [0x180064c48], esi
je 0x18004ff01
nop word [rax + rax]
cmp rdi, 0x20
jae 0x18004feea
xor ecx, ecx
jmp 0x18004feec
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rdi
xor eax, eax
lock cmpxchg dword [0x180064c48], esi
jne 0x18004fee0
cmp qword [0x180064c50], rbx
je 0x180050598
xor ecx, ecx
call fcn.180050e14
mov ecx, ebx
xchg dword [0x180064c48], ecx
test eax, eax
jne 0x18005059e
mov rdi, rbx
lock cmpxchg dword [0x180064c48], esi
je 0x18004ff53
cmp rdi, 0x20
jae 0x18004ff3c
xor ecx, ecx
jmp 0x18004ff3e
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rdi
xor eax, eax
lock cmpxchg dword [0x180064c48], esi
jne 0x18004ff32
cmp qword [0x180064c50], rbx
je 0x180050598
xor ecx, ecx
call fcn.180050e14
test eax, eax
jne 0x180050598
mov rcx, qword [0x180064e10]
mov qword [0x180064e10], rbx
test rcx, rcx
je 0x18004ff9b
mov rdi, qword [rcx]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rdi
test rdi, rdi
jne 0x18004ff82
mov r8, qword [0x180064e20]
xor edx, edx
mov rcx, qword [0x180064c50]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x180064c50]
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
mov eax, ebx
mov qword [0x180064c50], rbx
mov qword [0x180064e20], rbx
lea r9, [rbp - 0x10]
mov qword [0x180064e28], rbx
mov edx, 0xf
xchg dword [0x180064c48], eax
mov rdi, qword [0x180064c70]
mov r8d, 0x40
add rdi, 0x113b5a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [str._SUWAUAWH]
lea r9, [rbp - 0xc]
mov r8d, dword [rbp - 0x10]
mov edx, 0xf
movsd qword [rdi], xmm0
mov rcx, rdi
mov eax, dword [0x18005c230]
mov dword [rdi + 8], eax
movzx eax, word [0x18005c234]
mov word [rdi + 0xc], ax
movzx eax, byte [0x18005c236]
mov byte [rdi + 0xe], al
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdi, qword [0x180064c70]
lea r9, [rbp - 0x10]
mov edx, 0x13
mov r8d, 0x40
lea rcx, [rdi + 0x113b5af]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movups xmm0, xmmword [0x18005c238]
mov r8d, dword [rbp - 0x10]
lea r9, [rbp - 0xc]
mov edx, 0x13
lea rcx, [rdi + 0x113b5af]
movups xmmword [rdi + 0x113b5af], xmm0
movzx eax, word [0x18005c248]
mov word [rdi + 0x113b5bf], ax
movzx eax, byte [0x18005c24a]
mov byte [rdi + 0x113b5c1], al
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdi, qword [0x180064c70]
lea r9, [rbp - 0x10]
add rdi, 0x10daf80
mov edx, 0xf
mov rcx, rdi
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [0x18005c250]
lea r9, [rbp - 0xc]
mov r8d, dword [rbp - 0x10]
mov edx, 0xf
movsd qword [rdi], xmm0
mov rcx, rdi
mov eax, dword [0x18005c258]
mov dword [rdi + 8], eax
movzx eax, word [0x18005c25c]
mov word [rdi + 0xc], ax
movzx eax, byte [0x18005c25e]
mov byte [rdi + 0xe], al
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdi, qword [0x180064c70]
lea r9, [rbp - 0x10]
add rdi, 0x1be75e0
mov edx, 0xf
mov rcx, rdi
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [0x18005c260]
movsd qword [rdi], xmm0
mov eax, dword [0x18005c268]
mov dword [rdi + 8], eax
movzx eax, word [0x18005c26c]
mov word [rdi + 0xc], ax
movzx eax, byte [0x18005c26e]
lea r9, [rbp - 0xc]
mov r8d, dword [rbp - 0x10]
mov edx, 0xf
mov rcx, rdi
mov byte [rdi + 0xe], al
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdi, qword [0x180064c70]
lea r9, [rbp - 0x10]
mov edx, 0x11
mov r8d, 0x40
lea rcx, [rdi + 0x11f88dd]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movups xmm0, xmmword [0x18005c270]
mov r8d, dword [rbp - 0x10]
lea r9, [rbp - 0xc]
mov edx, 0x11
lea rcx, [rdi + 0x11f88dd]
movups xmmword [rdi + 0x11f88dd], xmm0
movzx eax, byte [0x18005c280]
mov byte [rdi + 0x11f88ed], al
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdi, qword [0x180064c70]
lea r9, [rbp - 0x10]
mov edx, 0x12
mov r8d, 0x40
lea rcx, [rdi + 0x10a43d6]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movups xmm0, xmmword [0x18005c288]
mov r8d, dword [rbp - 0x10]
lea r9, [rbp - 0xc]
mov edx, 0x12
lea rcx, [rdi + 0x10a43d6]
movups xmmword [rdi + 0x10a43d6], xmm0
movzx eax, word [0x18005c298]
mov word [rdi + 0x10a43e6], ax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdi, qword [0x180064c70]
lea r9, [rbp - 0x10]
mov edx, 0xe
mov r8d, 0x40
lea rcx, [rdi + 0x103f117]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [0x18005c2a0]
lea r9, [rbp - 0xc]
mov r8d, dword [rbp - 0x10]
lea rcx, [rdi + 0x103f117]
movsd qword [rdi + 0x103f117], xmm0
mov edx, 0xe
mov eax, dword [0x18005c2a8]
mov dword [rdi + 0x103f11f], eax
movzx eax, word [0x18005c2ac]
mov word [rdi + 0x103f123], ax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdi, qword [0x180064c70]
lea r9, [rbp - 0x10]
add rdi, 0x10b8cb0
mov edx, 0xf
mov rcx, rdi
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [0x18005c2b0]
lea r9, [rbp - 0xc]
mov r8d, dword [rbp - 0x10]
mov edx, 0xf
movsd qword [rdi], xmm0
mov rcx, rdi
mov eax, dword [0x18005c2b8]
mov dword [rdi + 8], eax
movzx eax, word [0x18005c2bc]
mov word [rdi + 0xc], ax
movzx eax, byte [0x18005c2be]
mov byte [rdi + 0xe], al
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdi, qword [0x180064c70]
lea r9, [rbp - 0x10]
mov edx, 0x14
mov r8d, 0x40
lea rcx, [rdi + 0x11f0889]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movups xmm0, xmmword [0x18005c2c0]
mov r8d, dword [rbp - 0x10]
lea r9, [rbp - 0xc]
movups xmmword [rdi + 0x11f0889], xmm0
mov eax, dword [0x18005c2d0]
lea rcx, [rdi + 0x11f0889]
mov edx, 0x14
mov dword [rdi + 0x11f0899], eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdi, qword [0x180064c70]
lea r9, [rbp - 0x10]
mov edx, 0xe
mov r8d, 0x40
lea rcx, [rdi + 0x10bcea0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [0x18005c2d8]
lea r9, [rbp - 0xc]
mov r8d, dword [rbp - 0x10]
lea rcx, [rdi + 0x10bcea0]
movsd qword [rdi + 0x10bcea0], xmm0
mov edx, 0xe
mov eax, dword [0x18005c2e0]
mov dword [rdi + 0x10bcea8], eax
movzx eax, word [0x18005c2e4]
mov word [rdi + 0x10bceac], ax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdi, qword [0x180064c70]
lea r9, [rbp - 0x10]
mov edx, 0x12
mov r8d, 0x40
lea rcx, [rdi + 0x11bdc49]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movups xmm0, xmmword [0x18005c2e8]
mov r8d, dword [rbp - 0x10]
lea r9, [rbp - 0xc]
mov edx, 0x12
lea rcx, [rdi + 0x11bdc49]
movups xmmword [rdi + 0x11bdc49], xmm0
movzx eax, word [0x18005c2f8]
mov word [rdi + 0x11bdc59], ax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rsi, qword [0x180064a50]
test rsi, rsi
je 0x18005041d
mov rdi, qword [rsi + 0x98]
jmp 0x180050420
mov rdi, rbx
call fcn.18002eee0
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x180050434
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rdi]
test rcx, rcx
je 0x180050442
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x180050451
mov rax, qword [rcx]
call qword [rax + 0x10]
and dword [rsi + 0xc], 0xfffffff7
mov rax, qword [0x180064a50]
mov qword [rsi + 0x88], rbx
mov qword [rsi + 0x98], rbx
test rax, rax
je 0x180050475
dec dword [rax + 0xf0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x180064a50]
test rax, rax
je 0x180050493
mov rsi, qword [rax + 0x90]
jmp 0x180050496
mov rsi, rbx
mov rcx, qword [rsi + 0x30]
lea rdi, [rax + 8]
test rcx, rcx
je 0x1800504b0
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x180064a50]
and dword [rdi + 4], 0xfffffff8
mov qword [rdi + 0x78], rbx
mov qword [rdi + 0x88], rbx
test rax, rax
je 0x1800504ca
dec dword [rax + 0xf0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [0x180064a50]
mov qword [0x180064a50], rdi
call fcn.1800065a0
mov qword [0x180064a50], rbx
test rdi, rdi
je 0x180050515
mov rcx, rdi
call fcn.18001d040
mov rax, qword [0x180064a50]
test rax, rax
je 0x18005050c
dec dword [rax + 0xf0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x180064b08]
test rcx, rcx
je 0x18005052e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x180064b08], rbx
mov rcx, qword [0x180064aa0]
test rcx, rcx
je 0x180050547
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x180064aa0], rbx
mov rcx, qword [0x180064a60]
test rcx, rcx
je 0x180050560
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x180064a60], rbx
mov r8, qword [0x180064ba0]
mov edx, 0xfffffffc
mov rcx, qword [0x180064b38]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x18004fe80]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x18005059e
xchg dword [0x180064c48], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800521b0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret