Function at 0x1800075d0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov byte [rsp + 0x20], r9b
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xc0
mov rbx, qword [0x1800873c8]
mov rsi, rcx
mov rdi, qword [0x1800873d0]
mov rcx, rbx
call fcn.180015b08
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov r14, rax
call fcn.18002f600
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x180007991
movsxd rdi, dword [r14 + 0x3c]
mov eax, 0x8664
add rdi, r14
cmp word [rdi + 4], ax
jne 0x180007991
mov r8d, dword [rdi + 0x50]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
je 0x180007991
xor r12d, r12d
lea rax, [rsp + 0x110]
mov dword [rsp + 0x110], r12d
mov rdx, r15
mov r8d, dword [rdi + 0x50]
mov rcx, rsi
mov qword [rsp + 0x20], rax
lea r9d, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r9d, 0x1000
mov qword [rsp + 0x40], rax
mov r8, r14
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, r15
mov qword [rsp + 0x48], rax
mov rcx, rsi
mov rax, qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x78], 1
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000797c
movzx ebx, word [rdi + 0x14]
mov ebp, r12d
add rbx, 0x28
cmp word [rdi + 6], r12w
je 0x18000774a
add rbx, rdi
nop
mov eax, dword [rbx]
test eax, eax
je 0x18000773c
mov r8d, dword [rbx + 4]
mov r9d, eax
mov edx, dword [rbx - 4]
add r8, r14
add rdx, r15
mov qword [rsp + 0x20], r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000797c
movzx eax, word [rdi + 6]
inc ebp
add rbx, 0x28
cmp ebp, eax
jne 0x180007710
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov rcx, rsi
lea r8d, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
je 0x18000797c
mov r9d, 0x40
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x40]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180007962
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbp, rax
test rax, rax
je 0x180007962
mov r9d, 0x54f
mov qword [rsp + 0x20], r12
lea r8, [0x180080f40]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180007933
mov qword [rsp + 0x30], r12
mov r9, rbp
mov dword [rsp + 0x28], r12d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x180007933
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [rax + rax]
lea rdx, [rsp + 0x108]
mov dword [rsp + 0x108], r12d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x108], 0x103
jne 0x180007991
xorps xmm0, xmm0
mov qword [rsp + 0x20], r12
mov r9d, 0x40
lea r8, [rsp + 0x80]
mov rdx, rdi
mov rcx, rsi
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rsp + 0xa0]
cmp rbx, 0x404040
je 0x180007933
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x180007820
mov ecx, 0x1400000
call fcn.18003be5c
mov rbx, rax
test rax, rax
je 0x180007991
xor edx, edx
mov r8d, 0x1400000
mov rcx, rax
call fcn.18002f440
mov r9d, 0x1000
mov qword [rsp + 0x20], r12
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180007991
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
je 0x180007991
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
je 0x180007991
mov al, 1
jmp 0x180007993
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, rbp
jmp 0x18000797f
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, rdi
jmp 0x18000797f
mov rdx, r15
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor al, al
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret