Function at 0x5a5d30
Capabilities:
Check for time delay via gettickcount
Check os version
Get memory capacity
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a7e78
push 0x5f71fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x524
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor esi, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1e8], 0x94
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push str.ADVAPI32.DLL
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call ebx
mov dword [ebp - 0x34], eax
push 0x6a7e54
call ebx
mov edi, eax
mov dword [ebp - 0xa0], edi
push str.NETAPI32.DLL
call ebx
mov ebx, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x30], esi
cmp ebx, esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x5a5dcf
push str.NetStatisticsGet
push ebx
call esi
mov dword [ebp - 0x40], eax
push str.NetApiBufferFree
push ebx
call esi
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x5a5e4e
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x5a5e4e
lea ecx, [ebp - 0x2c]
push ecx
push 0
push 0
push str.LanmanWorkstation
push 0
call dword [ebp - 0x40]
test eax, eax
jne 0x5a5e17
fld qword [0x6a7df0]
sub esp, 8
fstp qword [esp]
push 0xd8
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0059f290
add esp, 0x10
mov eax, dword [ebp - 0x2c]
push eax
call dword [ebp - 0x30]
lea ecx, [ebp - 0x2c]
push ecx
push 0
push 0
push str.LanmanServer
push 0
call dword [ebp - 0x40]
test eax, eax
jne 0x5a5e4e
fld qword [0x6a7dc8]
sub esp, 8
fstp qword [esp]
push 0x44
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0059f290
add esp, 0x10
mov eax, dword [ebp - 0x2c]
push eax
call dword [ebp - 0x30]
test ebx, ebx
je 0x5a5e59
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x5a5e83
push str.CryptAcquireContextW
mov ebx, eax
push ebx
call esi
mov dword [ebp - 0x44], eax
push str.CryptGenRandom
push ebx
call esi
mov dword [ebp - 0x3c], eax
push str.CryptReleaseContext
push ebx
call esi
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x5a5f53
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x5a5f53
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x5a5f53
push 0xf0000000
push 1
push 0
push 0
lea ecx, [ebp - 0x28]
push ecx
mov ebx, dword [ebp - 0x44]
call ebx
test eax, eax
je 0x5a5efd
lea edx, [ebp - 0x154]
push edx
push 0x40
mov eax, dword [ebp - 0x28]
push eax
call dword [ebp - 0x3c]
test eax, eax
je 0x5a5ef4
fld qword [0x6bee80]
sub esp, 8
fstp qword [esp]
push 0x40
lea ecx, [ebp - 0x154]
push ecx
call fcn.0059f290
add esp, 0x10
mov dword [ebp - 0x1c], 1
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [ebp - 0x38]
push 0
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
lea eax, [ebp - 0x28]
push eax
call ebx
test eax, eax
je 0x5a5f53
lea ecx, [ebp - 0x154]
push ecx
push 0x40
mov edx, dword [ebp - 0x28]
push edx
call dword [ebp - 0x3c]
test eax, eax
je 0x5a5f4a
fld qword [0x6a7d28]
sub esp, 8
fstp qword [esp]
push 0x40
lea eax, [ebp - 0x154]
push eax
call fcn.0059f290
add esp, 0x10
mov dword [ebp - 0x1c], 1
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x5a5f63
mov edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x1d8], 2
jne 0x5a5f79
call fcn.0059e060
test eax, eax
jne 0x5a6069
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x5a6069
push str.GetForegroundWindow
push ebx
call esi
mov dword [ebp - 0x7c], eax
push str.GetCursorInfo
push ebx
call esi
mov dword [ebp - 0x4c], eax
push str.GetQueueStatus
push ebx
call esi
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x5a5fdb
call eax
mov dword [ebp - 0x94], eax
fld qword [0x6bee80]
sub esp, 8
fstp qword [esp]
push 4
lea eax, [ebp - 0x94]
push eax
call fcn.0059f290
add esp, 0x10
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x5a6037
cmp dword [ebp - 0x1d8], 2
jne 0x5a5ff9
cmp dword [ebp - 0x1e4], 5
jae 0x5a5ff9
xor eax, eax
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x5a6037
mov dword [ebp - 0xd8], 0x14
lea ecx, [ebp - 0xd8]
push ecx
call dword [ebp - 0x4c]
test eax, eax
je 0x5a6037
fld qword [0x67e548]
sub esp, 8
fstp qword [esp]
mov edx, dword [ebp - 0xd8]
push edx
lea eax, [ebp - 0xd8]
push eax
call fcn.0059f290
add esp, 0x10
mov eax, dword [ebp - 0x74]
test eax, eax
je 0x5a6062
push 0xbf
call eax
mov dword [ebp - 0x50], eax
fld qword [0x6beec8]
sub esp, 8
fstp qword [esp]
push 4
lea ecx, [ebp - 0x50]
push ecx
call fcn.0059f290
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x5a6497
mov dword [ebp - 0x24], 0
push 0x6a7cc8
push edi
call esi
mov ebx, eax
push str.CloseToolhelp32Snapshot
push edi
call esi
mov dword [ebp - 0x9c], eax
push str.Heap32First
push edi
call esi
mov dword [ebp - 0x70], eax
push str.Heap32Next
push edi
call esi
mov dword [ebp - 0x68], eax
push str.Heap32ListFirst
push edi
call esi
mov dword [ebp - 0x60], eax
push str.Heap32ListNext
push edi
call esi
mov dword [ebp - 0x54], eax
push str.Process32First
push edi
call esi
mov dword [ebp - 0x58], eax
push str.Process32Next
push edi
call esi
mov dword [ebp - 0x5c], eax
push str.Thread32First
push edi
call esi
mov dword [ebp - 0x64], eax
push str.Thread32Next
push edi
call esi
mov dword [ebp - 0x6c], eax
push str.Module32First
push edi
call esi
mov dword [ebp - 0x78], eax
push 0x6a7c18
push edi
call esi
mov dword [ebp - 0x80], eax
test ebx, ebx
je 0x5a6490
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x5a6490
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x5a6490
mov eax, dword [ebp - 0x60]
test eax, eax
je 0x5a6490
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x5a6490
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x5a6490
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x5a6490
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x5a6490
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x5a6490
mov eax, dword [ebp - 0x78]
test eax, eax
je 0x5a6490
mov eax, dword [ebp - 0x80]
test eax, eax
je 0x5a6490
push 0
push 0xf
call ebx
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
je 0x5a6490
xor edx, edx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x90], 0x10
mov eax, dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
je 0x5a61bc
call esi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x90]
push eax
mov ebx, dword [ebp - 0x20]
push ebx
call dword [ebp - 0x60]
test eax, eax
je 0x5a631d
mov dword [ebp - 0x48], 0x2a
lea esp, [esp]
fld qword [0x6a7c10]
sub esp, 8
fstp qword [esp]
mov ecx, dword [ebp - 0x90]
push ecx
lea edx, [ebp - 0x90]
push edx
call fcn.0059f290
add esp, 0x10
wait
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xc4], 0x24
mov ecx, dword [ebp - 0x88]
push ecx
mov edx, dword [ebp - 0x8c]
push edx
lea eax, [ebp - 0xc4]
push eax
call dword [ebp - 0x70]
test eax, eax
je 0x5a62c1
mov ebx, 0x50
mov dword [ebp - 0x98], ebx
fld qword [0x6a7c08]
sub esp, 8
fstp qword [esp]
mov ecx, dword [ebp - 0xc4]
push ecx
lea edx, [ebp - 0xc4]
push edx
call fcn.0059f290
add esp, 0x10
lea eax, [ebp - 0xc4]
push eax
call dword [ebp - 0x68]
test eax, eax
je 0x5a62c1
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5a62b6
call esi
sub eax, dword [ebp - 0x24]
cmp eax, 0x3e8
jae 0x5a62c1
dec ebx
mov dword [ebp - 0x98], ebx
test ebx, ebx
jg 0x5a6273
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x5a62ea
lea ecx, [ebp - 0x90]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [ebp - 0x54]
test eax, eax
je 0x5a631a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5a630f
call esi
sub eax, dword [ebp - 0x24]
cmp eax, 0x3e8
jae 0x5a631a
mov eax, dword [ebp - 0x48]
test eax, eax
jg 0x5a61e0
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x310], 0x128
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5a6333
call esi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x310]
push eax
push ebx
call dword [ebp - 0x58]
test eax, eax
je 0x5a6399
mov ebx, dword [ebp - 0x24]
jmp 0x5a6350
fld qword [0x6a7c00]
sub esp, 8
fstp qword [esp]
mov ecx, dword [ebp - 0x310]
push ecx
lea edx, [ebp - 0x310]
push edx
call fcn.0059f290
add esp, 0x10
lea eax, [ebp - 0x310]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [ebp - 0x5c]
test eax, eax
je 0x5a6396
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5a6350
call esi
sub eax, ebx
cmp eax, 0x3e8
jb 0x5a6350
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0xf4], 0x1c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5a63af
call esi
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0xf4]
push edx
push ebx
call dword [ebp - 0x64]
test eax, eax
je 0x5a640a
mov ebx, dword [ebp - 0x24]
fld qword [0x6a7bf8]
sub esp, 8
fstp qword [esp]
mov eax, dword [ebp - 0xf4]
push eax
lea ecx, [ebp - 0xf4]
push ecx
call fcn.0059f290
add esp, 0x10
lea edx, [ebp - 0xf4]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [ebp - 0x6c]
test eax, eax
je 0x5a6407
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5a63c1
call esi
sub eax, ebx
cmp eax, 0x3e8
jb 0x5a63c1
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x534], 0x224
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5a6420
call esi
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x534]
push ecx
push ebx
call dword [ebp - 0x78]
test eax, eax
je 0x5a647b
mov ebx, dword [ebp - 0x80]
fld qword [0x6a7c00]
sub esp, 8
fstp qword [esp]
mov edx, dword [ebp - 0x534]
push edx
lea eax, [ebp - 0x534]
push eax
call fcn.0059f290
add esp, 0x10
lea ecx, [ebp - 0x534]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call ebx
test eax, eax
je 0x5a6478
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5a6432
call esi
sub eax, dword [ebp - 0x24]
cmp eax, 0x3e8
jb 0x5a6432
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x9c]
push ebx
test eax, eax
je 0x5a648a
call eax
jmp 0x5a6490
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.005a5cc0
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
fld qword [0x6beec8]
sub esp, 8
fstp qword [esp]
push 0x20
lea ecx, [ebp - 0x114]
push ecx
call fcn.0059f290
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x50], eax
fld qword [0x6beec8]
sub esp, 8
fstp qword [esp]
push 4
lea edx, [ebp - 0x50]
push edx
call fcn.0059f290
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret