Function at 0x180001310
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov eax, 0x5a4d
mov rbx, rcx
cmp word [0x18021d360], ax
jne 0x180001743
movsxd r14, dword [0x18021d39c]
lea r13, [0x18021d360]
add r14, r13
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov r8d, dword [r14 + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
je 0x180001743
lea rax, [rbp + 0x77]
xor r12d, r12d
mov dword [rbp + 0x77], r12d
mov r9d, 0x40
mov r8d, dword [r14 + 0x50]
mov rdx, r15
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r9d, 0x1000
mov qword [rbp - 0x59], rax
mov r8, r13
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, r15
mov qword [rbp - 0x51], rax
mov rcx, rbx
mov rax, qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 1
mov qword [rbp - 0x21], 1
mov qword [rbp - 0x41], r15
mov qword [rbp - 0x29], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000172e
movzx edi, word [r14 + 0x14]
mov esi, r12d
add rdi, 0x2c
cmp word [r14 + 6], r12w
je 0x180001453
add rdi, r14
mov eax, dword [rdi - 4]
test eax, eax
je 0x180001444
mov r8d, dword [rdi]
mov r9d, eax
mov edx, dword [rdi - 8]
add r8, r13
add rdx, r15
mov qword [rsp + 0x20], r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000172e
movzx eax, word [r14 + 6]
inc esi
add rdi, 0x28
cmp esi, eax
jne 0x180001418
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r12, rax
test rax, rax
je 0x18000172e
xor esi, esi
lea r8, [rbp - 0x59]
mov r9d, 0x40
mov qword [rsp + 0x20], rsi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180001714
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r13, rax
test rax, rax
je 0x180001714
mov r9d, 0x1000
mov qword [rsp + 0x20], rsi
lea r8, [0x180001760]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1800016e5
mov qword [rsp + 0x30], rsi
mov r9, r13
mov dword [rsp + 0x28], esi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x1800016e5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [rax + rax]
lea rdx, [rbp + 0x6f]
mov dword [rbp + 0x6f], esi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rbp + 0x6f], 0x103
je 0x180001743
xorps xmm0, xmm0
mov qword [rsp + 0x20], rsi
mov r9d, 0x40
lea r8, [rbp - 0x19]
mov rdx, r12
mov rcx, rbx
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdi, qword [rbp + 7]
cmp rdi, 0x404040
je 0x1800016e5
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test rdi, rdi
je 0x180001530
mov ecx, 0x1400000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp - 0x69], rax
mov rdi, rax
test rax, rax
je 0x180001743
xor edx, edx
mov r8d, 0x1400000
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1000
mov qword [rsp + 0x20], rsi
mov r8, rdi
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx edi, word [r14 + 0x14]
add rdi, 0x3c
cmp word [r14 + 6], si
je 0x18000165d
add rdi, r14
mov edx, 0x20
nop dword [rax]
mov ecx, dword [rdi - 0x1c]
test ecx, ecx
je 0x18000164e
mov eax, dword [rdi]
mov dword [rbp + 0x6f], 0
test eax, 0x80000000
jbe 0x18000161f
mov r9d, 4
jmp 0x18000162e
test eax, 0x20000000
mov r9d, 2
cmova r9d, edx
mov edx, dword [rdi - 0x18]
lea rax, [rbp + 0x6f]
mov r8, rcx
mov qword [rsp + 0x20], rax
add rdx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edx, 0x20
movzx eax, word [r14 + 6]
inc esi
add rdi, 0x28
cmp esi, eax
jne 0x180001600
xor edi, edi
mov r9d, 2
mov dword [rbp + 0x7f], edi
mov rdx, r15
movzx eax, word [r14 + 0x14]
mov rcx, rbx
mov r8d, dword [rax + r14 + 0x24]
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r8, qword [rbp - 0x69]
mov r9d, 0x1000
mov rdx, r13
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, reloc.obs.dll_obs_source_release
xor r8d, r8d
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, reloc.obs.dll_obs_source_release
xor r8d, r8d
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, reloc.obs.dll_obs_source_release
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov al, 1
jmp 0x180001745
mov r9d, reloc.obs.dll_obs_source_release
xor r8d, r8d
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, reloc.obs.dll_obs_source_release
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, r13
jmp 0x180001731
mov r9d, reloc.obs.dll_obs_source_release
xor r8d, r8d
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, r12
jmp 0x180001731
mov rdx, r15
mov r9d, reloc.obs.dll_obs_source_release
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor al, al
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret