Function at 0x140153700
Capabilities:
Check for time delay via gettickcount
Get memory capacity
Link many functions at runtime

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x818
movaps xmmword [rsp + 0x7e0], xmm6
movaps xmmword [rsp + 0x7f0], xmm7
movaps xmmword [rsp + 0x800], xmm8
mov rbx, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, str.ADVAPI32.DLL
mov qword [rsp + 0x98], 0
lea r13, [rsp + 0x3a0]
call rbx
lea rcx, str.KERNEL32.DLL
mov r14, rax
call rbx
lea rcx, str.NETAPI32.DLL
mov r12, rax
call rbx
mov r15, rax
test rax, rax
je 0x1401537e4
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NetStatisticsGet
mov rcx, rax
call rsi
lea rdx, str.NetApiBufferFree
mov rcx, r15
mov rdi, rax
call rsi
mov rsi, rax
test rdi, rdi
je 0x1401537db
test rax, rax
je 0x1401537db
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], r13
lea rdx, str.LanmanWorkstation
call rdi
test eax, eax
je 0x140153ee0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], r13
lea rdx, str.LanmanServer
call rdi
test eax, eax
je 0x140153ea8
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test r14, r14
je 0x140153903
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptAcquireContextW
mov rcx, r14
call rsi
lea rdx, str.CryptGenRandom
mov rcx, r14
mov rdi, rax
call rsi
lea rdx, str.CryptReleaseContext
mov rcx, r14
mov rbp, rax
call rsi
test rdi, rdi
setne dl
test rbp, rbp
mov qword [rsp + 0x38], rax
mov rsi, rax
setne al
test dl, al
je 0x140153e48
test rsi, rsi
je 0x140153e48
lea r15, [rsp + 0x98]
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
xor edx, edx
mov r9d, 1
mov rcx, r15
call rdi
mov esi, eax
test eax, eax
je 0x1401538a7
lea r8, [rsp + 0x120]
mov rcx, qword [rsp + 0x98]
mov edx, 0x40
mov qword [rsp + 0x40], r8
call rbp
mov r8, qword [rsp + 0x40]
test eax, eax
mov esi, eax
jne 0x140153f40
mov rcx, qword [rsp + 0x98]
mov rax, qword [rsp + 0x38]
xor edx, edx
call rax
xor edx, edx
mov r9d, 0x16
mov rcx, r15
mov dword [rsp + 0x20], 0
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
call rdi
test eax, eax
je 0x1401538fa
lea rdi, [rsp + 0x120]
mov rcx, qword [rsp + 0x98]
mov edx, 0x40
mov r8, rdi
call rbp
test eax, eax
jne 0x140153f60
mov rcx, qword [rsp + 0x98]
mov rax, qword [rsp + 0x38]
xor edx, edx
call rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [sym.imp.KERNEL32.dll_GetVersion]
call rdi
test eax, eax
js 0x140153bc0
call fcn.14006c500
test eax, eax
je 0x140153bc0
movsd xmm6, qword [0x1404c8fc0]
lea r14, [rsp + 0x94]
test r12, r12
je 0x140153da9
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, r12
call rbx
lea rdx, str.CloseToolhelp32Snapshot
mov rcx, r12
mov r15, rax
call rbx
lea rdx, str.Heap32First
mov rcx, r12
mov qword [rsp + 0x78], rax
call rbx
lea rdx, str.Heap32Next
mov rcx, r12
mov rbp, rax
call rbx
lea rdx, str.Heap32ListFirst
mov rcx, r12
mov rdi, rax
call rbx
lea rdx, str.Heap32ListNext
mov rcx, r12
mov qword [rsp + 0x38], rax
call rbx
lea rdx, str.Process32First
mov rcx, r12
mov qword [rsp + 0x40], rax
call rbx
lea rdx, str.Process32Next
mov rcx, r12
mov qword [rsp + 0x48], rax
call rbx
lea rdx, str.Thread32First
mov rcx, r12
mov qword [rsp + 0x50], rax
call rbx
lea rdx, str.Thread32Next
mov rcx, r12
mov qword [rsp + 0x58], rax
call rbx
lea rdx, str.Module32First
mov rcx, r12
mov qword [rsp + 0x60], rax
call rbx
mov rcx, r12
lea rdx, str.Module32Next
mov qword [rsp + 0x68], rax
call rbx
mov qword [rsp + 0x70], rax
mov rcx, rax
test r15, r15
je 0x140153da0
test rbp, rbp
je 0x140153da0
test rdi, rdi
je 0x140153da0
cmp qword [rsp + 0x38], 0
je 0x140153da0
cmp qword [rsp + 0x40], 0
je 0x140153da0
cmp qword [rsp + 0x48], 0
je 0x140153da0
cmp qword [rsp + 0x50], 0
je 0x140153da0
cmp qword [rsp + 0x58], 0
je 0x140153da0
cmp qword [rsp + 0x60], 0
setne dl
cmp qword [rsp + 0x68], 0
setne al
test dl, al
je 0x140153da0
test rcx, rcx
je 0x140153da0
xor edx, edx
mov ecx, 0xf
call r15
mov qword [rsp + 0x80], rax
cmp rax, 0xffffffffffffffff
je 0x140153da0
lea rax, [rsp + 0xc0]
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov rbx, rax
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xc0], 0x20
test esi, esi
jne 0x14015420b
mov rdx, rax
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x38]
call rax
test eax, eax
je 0x1401541f0
mov dword [rsp + 0x8c], 0
mov qword [rsp + 0x38], r12
movsd xmm7, qword [0x1404c8fd0]
mov r12, rbx
lea r15, [rsp + 0xe0]
movsd xmm8, qword [0x1404c8fc8]
jmp 0x140153b52
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x40]
mov rdx, r12
call rax
test eax, eax
je 0x140153ca3
test esi, esi
jne 0x140154004
mov edx, dword [rsp + 0xc0]
mov rcx, r12
movapd xmm2, xmm8
call fcn.1400b8010
mov r8, qword [rsp + 0xd0]
mov edx, dword [rsp + 0xc8]
mov rcx, r15
mov qword [rsp + 0xe0], 0x38
call rbp
test eax, eax
je 0x140153b30
mov ebx, 0x50
jmp 0x140153b9d
sub ebx, 1
je 0x140153b30
mov edx, dword [rsp + 0xe0]
mov rcx, r15
movapd xmm2, xmm7
call fcn.1400b8010
mov rcx, r15
call rdi
test eax, eax
jne 0x140153b98
jmp 0x140153b30
lea rcx, str.USER32.DLL
call rbx
mov r15, rax
test rax, rax
je 0x140153921
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetForegroundWindow
mov rcx, rax
call rbx
lea rdx, str.GetCursorInfo
mov rcx, r15
mov rbp, rax
call rbx
lea rdx, str.GetQueueStatus
mov rcx, r15
mov r14, rax
call rbx
mov rbx, rax
test rbp, rbp
je 0x140153c29
call rbp
pxor xmm2, xmm2
mov edx, 8
mov rcx, r13
mov qword [rsp + 0x3a0], rax
call fcn.1400b8010
test r14, r14
je 0x140153c51
call rdi
test eax, eax
jns 0x140153f10
mov dword [rsp + 0x3a0], 0x18
mov rcx, r13
call r14
test eax, eax
jne 0x140153f20
movsd xmm6, qword [0x1404c8fc0]
lea r14, [rsp + 0x94]
test rbx, rbx
je 0x140153c95
mov ecx, 0x4bf
lea r14, [rsp + 0x94]
call rbx
movsd xmm6, qword [0x1404c8fc0]
mov edx, 4
mov rcx, r14
mov dword [rsp + 0x94], eax
movapd xmm2, xmm6
call fcn.1400b8010
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140153931
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12, qword [rsp + 0x38]
mov dword [rsp + 0x160], 0x238
mov r15, rax
test esi, esi
jne 0x140154036
lea rbx, [rsp + 0x160]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x48]
mov rdx, rbx
call rax
test eax, eax
jne 0x140154062
mov dword [rsp + 0xa0], 0x1c
lea rbx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x58]
mov rdx, rbx
call rax
test eax, eax
jne 0x140153f7f
mov dword [rsp + 0x3a0], 0x438
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x68]
mov rdx, r13
call rax
test eax, eax
je 0x140153d87
movsd xmm7, qword [0x1404c8fd8]
mov rbx, qword [sym.imp.KERNEL32.dll_GetTickCount]
test esi, esi
jne 0x1401541a0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
nop dword [rax]
mov edx, dword [rsp + 0x3a0]
mov rcx, r13
movapd xmm2, xmm7
call fcn.1400b8010
mov rdx, r13
mov rcx, rsi
call rbx
test eax, eax
jne 0x140153d60
mov qword [rsp + 0x80], rsi
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
test rax, rax
je 0x14015423d
call rax
nop
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [0x140422ea0]
test edx, edx
jne 0x140153e60
call qword [sym.imp.KERNEL32.dll_GetTickCount]
pxor xmm2, xmm2
mov edx, 4
lea rcx, [rsp + 0x160]
mov dword [rsp + 0x160], eax
call fcn.1400b8010
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
movapd xmm2, xmm6
mov rcx, r13
mov edx, 0x38
call fcn.1400b8010
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movapd xmm2, xmm6
mov edx, 4
mov rcx, r14
mov dword [rsp + 0x94], eax
call fcn.1400b8010
nop
movaps xmm6, xmmword [rsp + 0x7e0]
mov eax, 1
movaps xmm7, xmmword [rsp + 0x7f0]
movaps xmm8, xmmword [rsp + 0x800]
add rsp, 0x818
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor esi, esi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140153903
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x140153e80
mov dword [0x140422ea0], 0
jmp 0x140153db7
pxor xmm2, xmm2
mov edx, 8
mov rcx, r13
call fcn.1400b8010
mov eax, dword [0x140422ea0]
test eax, eax
jne 0x140153dda
jmp 0x140153db7
movsd xmm2, qword [0x1404c8fa8]
mov rcx, qword [rsp + 0x3a0]
mov edx, 0x44
call fcn.1400b8010
mov rcx, qword [rsp + 0x3a0]
call rsi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1401537e4
mov rcx, qword [rsp + 0x3a0]
movsd xmm2, qword [0x1404c8fa0]
mov edx, 0xd8
call fcn.1400b8010
mov rcx, qword [rsp + 0x3a0]
call rsi
jmp 0x1401537bd
call rdi
cmp al, 4
jbe 0x140153c51
jmp 0x140153c38
movsd xmm2, qword [0x1404c8fb8]
mov edx, dword [rsp + 0x3a0]
mov rcx, r13
call fcn.1400b8010
jmp 0x140153c51
pxor xmm2, xmm2
mov edx, 0x40
mov rcx, r8
mov esi, 1
call fcn.1400b8010
jmp 0x140153896
movsd xmm2, qword [0x1404c8fb0]
mov edx, 0x40
mov rcx, rdi
mov esi, 1
call fcn.1400b8010
jmp 0x1401538e9
movsd xmm7, qword [0x1404c8fe0]
mov rdi, qword [sym.imp.KERNEL32.dll_GetTickCount]
test esi, esi
jne 0x140154154
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x80]
nop dword [rax + rax]
mov edx, dword [rsp + 0xa0]
mov rcx, rbx
movapd xmm2, xmm7
call fcn.1400b8010
mov rdx, rbx
mov rcx, rdi
call rsi
test eax, eax
jne 0x140153fa8
mov rax, qword [rsp + 0x68]
mov rdx, r13
mov rsi, rdi
mov rcx, rdi
mov qword [rsp + 0x80], rdi
mov dword [rsp + 0x3a0], 0x438
call rax
test eax, eax
je 0x140153d87
movsd xmm7, qword [0x1404c8fd8]
mov rbx, qword [rsp + 0x70]
jmp 0x140153d60
mov rbx, qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0x8c]
cmp eax, 0x3e7
jbe 0x140153b52
mov r12, qword [rsp + 0x38]
mov r15, rbx
mov dword [rsp + 0x160], 0x238
call r15
lea rbx, [rsp + 0x160]
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0x8c], eax
mov rdx, rbx
mov rax, qword [rsp + 0x48]
call rax
test eax, eax
je 0x140154103
movsd xmm7, qword [0x1404c8fd8]
mov rdi, qword [sym.imp.KERNEL32.dll_GetTickCount]
test esi, esi
jne 0x1401540bf
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x80]
nop word [rax + rax]
mov edx, dword [rsp + 0x160]
mov rcx, rbx
movapd xmm2, xmm7
call fcn.1400b8010
mov rdx, rbx
mov rcx, rbp
call rdi
test eax, eax
jne 0x140154088
mov qword [rsp + 0x80], rbp
mov dword [rsp + 0xa0], 0x1c
jmp 0x140153cf2
mov edx, dword [rsp + 0x160]
mov rcx, rbx
movapd xmm2, xmm7
call fcn.1400b8010
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x50]
mov rdx, rbx
call rax
test eax, eax
je 0x140154248
call rdi
sub eax, dword [rsp + 0x8c]
cmp eax, 0x3e7
jbe 0x140154071
mov r15, rdi
mov dword [rsp + 0xa0], 0x1c
call r15
lea rbx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0x8c], eax
mov rdx, rbx
mov rax, qword [rsp + 0x58]
call rax
test eax, eax
jne 0x140153f7f
mov dword [rsp + 0x3a0], 0x438
call r15
mov dword [rsp + 0x8c], eax
jmp 0x140153d1f
mov edx, dword [rsp + 0xa0]
mov rcx, rbx
movapd xmm2, xmm7
call fcn.1400b8010
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x60]
mov rdx, rbx
call rax
test eax, eax
je 0x140154262
call rdi
sub eax, dword [rsp + 0x8c]
cmp eax, 0x3e7
jbe 0x140153f8e
mov r15, rdi
jmp 0x14015413a
mov edx, dword [rsp + 0x3a0]
mov rcx, r13
movapd xmm2, xmm7
call fcn.1400b8010
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x70]
mov rdx, r13
call rax
test eax, eax
je 0x140153d87
call rbx
sub eax, dword [rsp + 0x8c]
cmp eax, 0x3e7
jbe 0x140153d44
jmp 0x140153d87
mov dword [rsp + 0x160], 0x238
mov dword [rsp + 0x8c], 0
jmp 0x140153cc5
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r15, rax
call rax
mov rcx, qword [rsp + 0x80]
mov rdx, rbx
mov dword [rsp + 0x8c], eax
mov rax, qword [rsp + 0x38]
call rax
test eax, eax
je 0x14015402b
jmp 0x140153b08
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140153da0
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0xa0], 0x1c
mov r15, rax
jmp 0x14015410e
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x3a0], 0x438
mov r15, rax
jmp 0x140154145