Function at 0x495950
Capabilities:
Check for time delay via gettickcount
Get memory capacity
Link many functions at runtime

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x928
movaps xmmword [rsp + 0x8f0], xmm6
movaps xmmword [rsp + 0x900], xmm7
movaps xmmword [rsp + 0x910], xmm8
lea rcx, [rsp + 0x150]
lea r15, [rsp + 0x4b0]
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x150], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov rsi, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, str.ADVAPI32.DLL
call rsi
lea rcx, str.KERNEL32.DLL
mov rdi, rax
call rsi
lea rcx, str.NETAPI32.DLL
mov rbx, rax
call rsi
test rax, rax
mov rbp, rax
je 0x495a51
mov r13, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NetStatisticsGet
mov rcx, rax
call r13
mov r12, rax
lea rdx, str.NetApiBufferFree
mov rcx, rbp
call r13
test r12, r12
mov r13, rax
je 0x495a48
test rax, rax
je 0x495a48
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], r15
lea rdx, str.LanmanWorkstation
call r12
test eax, eax
je 0x496020
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], r15
lea rdx, str.LanmanServer
call r12
test eax, eax
je 0x495ff0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rdi, rdi
mov dword [rsp + 0x78], 0
je 0x495b68
mov r13, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptAcquireContextW
mov rcx, rdi
call r13
mov rbp, rax
lea rdx, str.CryptGenRandom
mov rcx, rdi
call r13
lea rdx, str.CryptReleaseContext
mov r12, rax
mov rcx, rdi
call r13
test rbp, rbp
mov r13, rax
setne dl
test r12, r12
setne al
test dl, al
je 0x495fc0
test r13, r13
je 0x495fc0
lea r14, [rsp + 0x88]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
mov rcx, r14
call rbp
test eax, eax
je 0x495b0f
lea rax, [rsp + 0x110]
mov edx, 0x40
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov r8, rax
call r12
test eax, eax
jne 0x496072
xor edx, edx
mov rcx, qword [rsp + 0x88]
call r13
xor edx, edx
mov dword [rsp + 0x20], 0
mov r9d, 0x16
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
mov rcx, r14
call rbp
test eax, eax
je 0x495b5f
lea rbp, [rsp + 0x110]
mov edx, 0x40
mov rcx, qword [rsp + 0x88]
mov r8, rbp
call r12
test eax, eax
jne 0x496050
xor edx, edx
mov rcx, qword [rsp + 0x88]
call r13
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [rsp + 0x160], 2
je 0x495c50
lea rcx, str.USER32.DLL
call rsi
test rax, rax
mov rsi, rax
je 0x495c5d
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetForegroundWindow
mov rcx, rax
call rdi
mov rbp, rax
lea rdx, str.GetCursorInfo
mov rcx, rsi
call rdi
lea rdx, str.GetQueueStatus
mov r12, rax
mov rcx, rsi
call rdi
test rbp, rbp
mov rdi, rax
je 0x495bdf
call rbp
pxor xmm2, xmm2
mov edx, 8
mov rcx, r15
mov qword [rsp + 0x4b0], rax
call fcn.004956b0
test r12, r12
je 0x495c0b
cmp dword [rsp + 0x160], 2
je 0x4960d4
mov dword [rsp + 0x4b0], 0x18
mov rcx, r15
call r12
test eax, eax
jne 0x496092
test rdi, rdi
je 0x4961d0
mov ecx, 0x4bf
call rdi
movsd xmm6, qword [0x006948a8]
lea rdi, [rsp + 0x84]
mov edx, 4
mov dword [rsp + 0x84], eax
movapd xmm2, xmm6
mov rcx, rdi
call fcn.004956b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x495c6d
call fcn.00492df0
test eax, eax
je 0x495b76
movsd xmm6, qword [0x006948a8]
lea rdi, [rsp + 0x84]
test rbx, rbx
je 0x495f1d
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rbx
call rsi
mov r14, rax
lea rdx, str.CloseToolhelp32Snapshot
mov rcx, rbx
call rsi
lea rdx, str.Heap32First
mov rcx, rbx
mov qword [rsp + 0x60], rax
call rsi
lea rdx, str.Heap32Next
mov rcx, rbx
mov r12, rax
call rsi
lea rdx, str.Heap32ListFirst
mov rcx, rbx
mov rbp, rax
call rsi
lea rdx, str.Heap32ListNext
mov rcx, rbx
mov r13, rax
call rsi
lea rdx, str.Process32First
mov rcx, rbx
mov qword [rsp + 0x30], rax
call rsi
lea rdx, str.Process32Next
mov rcx, rbx
mov qword [rsp + 0x38], rax
call rsi
lea rdx, str.Thread32First
mov rcx, rbx
mov qword [rsp + 0x40], rax
call rsi
lea rdx, str.Thread32Next
mov rcx, rbx
mov qword [rsp + 0x48], rax
call rsi
lea rdx, str.Module32First
mov rcx, rbx
mov qword [rsp + 0x50], rax
call rsi
lea rdx, str.Module32Next
mov qword [rsp + 0x58], rax
mov rcx, rbx
call rsi
test r14, r14
mov rsi, rax
je 0x495f14
test r12, r12
je 0x495f14
test rbp, rbp
je 0x495f14
test r13, r13
je 0x495f14
cmp qword [rsp + 0x30], 0
je 0x495f14
cmp qword [rsp + 0x38], 0
je 0x495f14
cmp qword [rsp + 0x40], 0
je 0x495f14
cmp qword [rsp + 0x48], 0
je 0x495f14
cmp qword [rsp + 0x50], 0
setne dl
cmp qword [rsp + 0x58], 0
setne al
test dl, al
je 0x495f14
test rsi, rsi
je 0x495f14
xor edx, edx
mov ecx, 0xf
call r14
cmp rax, 0xffffffffffffffff
mov qword [rsp + 0x68], rax
je 0x495f14
mov r10d, dword [rsp + 0x78]
lea rax, [rsp + 0xb0]
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0x70], rax
mov qword [rsp + 0xb0], 0x20
test r10d, r10d
jne 0x49630b
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call r13
test eax, eax
jne 0x496413
mov dword [rsp + 0x270], 0x238
mov dword [rsp + 0x7c], 0
lea r12, [rsp + 0x270]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x38]
mov rdx, r12
call rax
test eax, eax
jne 0x49622e
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x90], 0x1c
lea r12, [rsp + 0x90]
mov rax, qword [rsp + 0x48]
mov rdx, r12
call rax
test eax, eax
je 0x496420
mov rbp, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13d, dword [rsp + 0x78]
movsd xmm7, qword [0x006948c8]
test r13d, r13d
jne 0x49628a
mov rbp, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov edx, dword [rsp + 0x90]
movapd xmm2, xmm7
mov rcx, r12
call fcn.004956b0
mov rdx, r12
mov rcx, r13
call rbp
test eax, eax
jne 0x495eb0
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x4b0], 0x438
mov rdx, r15
mov rcx, r13
mov rax, qword [rsp + 0x58]
mov rbp, r13
call rax
test eax, eax
movsd xmm7, qword [0x006948c0]
jne 0x4961a1
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
test rax, rax
je 0x496430
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [0x00675150]
test edx, edx
jne 0x495fd0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
pxor xmm2, xmm2
lea rcx, [rsp + 0x270]
mov edx, 4
mov dword [rsp + 0x270], eax
call fcn.004956b0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
movapd xmm2, xmm6
mov rcx, r15
mov edx, 0x38
call fcn.004956b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movapd xmm2, xmm6
mov edx, 4
mov rcx, rdi
mov dword [rsp + 0x84], eax
call fcn.004956b0
nop
movaps xmm6, xmmword [rsp + 0x8f0]
mov eax, 1
movaps xmm7, xmmword [rsp + 0x900]
movaps xmm8, xmmword [rsp + 0x910]
add rsp, 0x928
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0x78], 0
jmp 0x495b5f
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x4960b0
mov dword [0x00675150], 0
jmp 0x495f2b
mov rcx, qword [rsp + 0x4b0]
movsd xmm2, qword [0x00694890]
mov edx, 0x44
call fcn.004956b0
mov rcx, qword [rsp + 0x4b0]
call r13
jmp 0x495a48
mov rcx, qword [rsp + 0x4b0]
movsd xmm2, qword [0x00694888]
mov edx, 0xd8
call fcn.004956b0
mov rcx, qword [rsp + 0x4b0]
call r13
jmp 0x495a29
movsd xmm2, qword [0x00694898]
mov edx, 0x40
mov rcx, rbp
call fcn.004956b0
mov dword [rsp + 0x78], 1
jmp 0x495b52
pxor xmm2, xmm2
mov rcx, qword [rsp + 0x30]
mov edx, 0x40
call fcn.004956b0
mov dword [rsp + 0x78], 1
jmp 0x495b02
mov edx, dword [rsp + 0x4b0]
movsd xmm2, qword [0x006948a0]
mov rcx, r15
call fcn.004956b0
jmp 0x495c0b
pxor xmm2, xmm2
mov edx, 8
mov rcx, r15
call fcn.004956b0
mov eax, dword [0x00675150]
test eax, eax
jne 0x495f4e
jmp 0x495f2b
cmp dword [rsp + 0x154], 4
jbe 0x495c0b
jmp 0x495bf2
mov edx, dword [rsp + 0x270]
movapd xmm2, xmm7
mov rcx, r12
call fcn.004956b0
mov rdx, r12
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x40]
call rax
test eax, eax
je 0x49643b
call rbp
sub eax, dword [rsp + 0x7c]
cmp eax, 0x3e7
jbe 0x49623d
mov r14, rbp
mov dword [rsp + 0x90], 0x1c
lea r12, [rsp + 0x90]
call r14
mov rdx, r12
mov dword [rsp + 0x7c], eax
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
call rax
test eax, eax
jne 0x495e89
mov dword [rsp + 0x4b0], 0x438
call r14
mov dword [rsp + 0x7c], eax
mov rdx, r15
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x58]
call rax
test eax, eax
je 0x495eff
mov rbp, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, dword [rsp + 0x78]
movsd xmm7, qword [0x006948c0]
test r12d, r12d
jne 0x4962d0
mov rbp, qword [rsp + 0x68]
mov edx, dword [rsp + 0x4b0]
movapd xmm2, xmm7
mov rcx, r15
call fcn.004956b0
mov rdx, r15
mov rcx, rbp
call rsi
test eax, eax
jne 0x4961a1
mov qword [rsp + 0x68], rbp
jmp 0x495eff
movsd xmm6, qword [0x006948a8]
lea rdi, [rsp + 0x84]
jmp 0x495c43
mov r8d, dword [rsp + 0x78]
mov dword [rsp + 0x270], 0x238
test r8d, r8d
je 0x495e40
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14, rax
lea r12, [rsp + 0x270]
call r14
mov rdx, r12
mov dword [rsp + 0x7c], eax
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x38]
call rax
test eax, eax
je 0x496125
mov rbp, qword [sym.imp.KERNEL32.dll_GetTickCount]
movsd xmm7, qword [0x006948c0]
mov ecx, dword [rsp + 0x78]
test ecx, ecx
jne 0x4960e7
mov rbp, qword [rsp + 0x40]
mov r13, qword [rsp + 0x68]
mov edx, dword [rsp + 0x270]
movapd xmm2, xmm7
mov rcx, r12
call fcn.004956b0
mov rdx, r12
mov rcx, r13
call rbp
test eax, eax
jne 0x496253
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x90], 0x1c
mov rcx, r13
jmp 0x495e6f
mov edx, dword [rsp + 0x90]
movapd xmm2, xmm7
mov rcx, r12
call fcn.004956b0
mov rdx, r12
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x50]
call rax
test eax, eax
je 0x496455
call rbp
sub eax, dword [rsp + 0x7c]
mov r14, rbp
cmp eax, 0x3e7
jbe 0x495e9d
jmp 0x496156
mov edx, dword [rsp + 0x4b0]
movapd xmm2, xmm7
mov rcx, r15
call fcn.004956b0
mov rdx, r15
mov rcx, qword [rsp + 0x68]
call rsi
test eax, eax
je 0x495eff
call rbp
sub eax, dword [rsp + 0x7c]
cmp eax, 0x3e7
jbe 0x496193
jmp 0x495eff
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14, rax
call rax
mov rdx, qword [rsp + 0x70]
mov dword [rsp + 0x7c], eax
mov rcx, qword [rsp + 0x68]
call r13
test eax, eax
je 0x496403
movsd xmm8, qword [0x006948b0]
lea r13, [rsp + 0xd0]
movsd xmm7, qword [0x006948b8]
jmp 0x496373
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x30]
call rax
test eax, eax
je 0x4961e5
mov r9d, dword [rsp + 0x78]
test r9d, r9d
jne 0x4963e7
mov edx, dword [rsp + 0xb0]
mov rcx, qword [rsp + 0x70]
movapd xmm2, xmm8
call fcn.004956b0
mov qword [rsp + 0xd0], 0x38
mov r8, qword [rsp + 0xc0]
mov rcx, r13
mov edx, dword [rsp + 0xb8]
call r12
test eax, eax
je 0x496350
mov r14d, 0x50
jmp 0x4963c6
sub r14d, 1
je 0x496350
mov edx, dword [rsp + 0xd0]
movapd xmm2, xmm7
mov rcx, r13
call fcn.004956b0
mov rcx, r13
call rbp
test eax, eax
jne 0x4963c0
jmp 0x496350
mov r14, qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0x7c]
cmp eax, 0x3e7
jbe 0x496373
mov dword [rsp + 0x270], 0x238
jmp 0x496208
mov dword [rsp + 0x7c], 0
jmp 0x496330
mov dword [rsp + 0x4b0], 0x438
jmp 0x496168
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x495f14
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x90], 0x1c
mov r14, rax
jmp 0x496130
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x4b0], 0x438
mov r14, rax
jmp 0x496161