Function at 0x140001230
Capabilities:
Check for windows sandbox via genuine state
Encode data using base64 via winapi
Get hostname
Get memory capacity
Get session user name
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
push rbp
push r12
push r15
lea rbp, [rsp - 0x36e0]
mov eax, 0x37e0
call fcn.1400017f0
sub rsp, rax
xor r12d, r12d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], r12d
xor ecx, ecx
lea edx, [r12 + 4]
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov r15, rax
test rax, rax
je 0x14000166a
mov qword [rsp + 0x37d8], rbx
lea rdx, str.cgdfiles.azureedge.net
mov qword [rsp + 0x37c8], rdi
mov r8d, 0x1bb
xor r9d, r9d
mov qword [rsp + 0x37c0], r14
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x40
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edx, 0x3e8
lea rcx, [rbp + 0x1360]
call sub.WS2_32.dll_gethostname
lea r8, [rbp + 0x3708]
mov dword [rbp + 0x3708], 0x3e8
lea rdx, [rbp + 0x3b0]
lea ecx, [r12 + 1]
call sub.Secur32.dll_GetUserNameExA
test al, al
jne 0x140001328
lea r8, [rbp + 0x3708]
lea rdx, [rbp + 0x3b0]
lea ecx, [r12 + 2]
call sub.Secur32.dll_GetUserNameExA
test al, al
jne 0x140001328
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.send_request_failed:__i
lea rcx, [rbp + 0x3b0]
call fcn.140001770
lea rdx, [rbp - 0x50]
lea rcx, str.55c92734_d682_4d71_983e_d6ec3f16059f
call qword [sym.imp.RPCRT4.dll_UuidFromStringA]
xor r8d, r8d
lea rdx, [rbp + 0x3718]
lea rcx, [rbp - 0x50]
call sub.SLWGA.dll_SLIsGenuineLocal
mov ebx, r12d
cmp dword [rbp + 0x3718], ebx
sete bl
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r9, qword [rsp + 0x78]
lea rcx, [rbp + 0x3b0]
mov r8d, dword [rsp + 0x74]
lea rdx, str.Load:__ld_nTotal_physical:__I64d_nFree_physical:__I64d_nTotal_page:__I64d_nFree_page:__I64d_nTotal_virtual:__I64d_nFree_virtual:__I64d_nLimit:__I64d_nUp:__I64d_nActive:__d_nHost:__s_nUser:__s
mov qword [rsp + 0x68], rcx
lea rcx, [rbp + 0x1360]
mov qword [rsp + 0x60], rcx
lea rcx, [rbp + 0x7a0]
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x50], rax
movabs rax, 0x200000000
mov qword [rsp + 0x48], rax
mov rax, qword [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp - 0x70]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x20], rax
call fcn.140001770
mov rdi, 0xffffffffffffffff
lea rax, [rbp + 0x7a0]
mov rbx, rdi
nop dword [rax]
inc rbx
cmp byte [rax + rbx], r12b
jne 0x1400013f0
lea rax, [rbp + 0x3710]
mov qword [rsp + 0x37d0], rsi
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8d, 0x40000001
lea rcx, [rbp + 0x7a0]
mov edx, ebx
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x140001482
mov eax, dword [rbp + 0x3710]
test eax, eax
je 0x140001482
mov ecx, eax
call fcn.1400033f8
mov rsi, rax
test rax, rax
je 0x140001482
lea rax, [rbp + 0x3710]
mov r9, rsi
mov r8d, 0x40000001
mov qword [rsp + 0x20], rax
mov edx, ebx
lea rcx, [rbp + 0x7a0]
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x140001482
mov r8, rsi
lea rdx, str._vt_d_s
lea rcx, [rbp + 0xb90]
call fcn.140001770
jmp 0x140001495
lea rdx, str._vt_dfail
lea rcx, [rbp + 0xb90]
call fcn.140001770
mov rsi, qword [rsp + 0x37d0]
lea rax, [rbp + 0xb90]
mov r9, rdi
inc r9
cmp byte [rax + r9], r12b
jne 0x1400014a7
mov dword [rsp + 0x28], r12d
lea r8, [rbp + 0xb90]
xor edx, edx
mov qword [rsp + 0x20], r12
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
lea rcx, [rbp + 0x1750]
mov r8d, 0xfb4
mov ebx, eax
call fcn.140002290
lea rax, [rbp + 0xb90]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], r12b
jne 0x1400014f0
lea rax, [rbp + 0x1750]
mov dword [rsp + 0x28], ebx
mov r9, rdi
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0xb90]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdi, qword [rsp + 0x37c8]
test eax, eax
jg 0x140001540
lea rdx, str._vt_dufail
lea rcx, [rbp + 0x1750]
call qword [sym.imp.USER32.dll_wsprintfW]
test r14, r14
je 0x140001645
mov dword [rsp + 0x30], 0x800000
lea r8, [rbp + 0x1750]
mov qword [rsp + 0x28], r12
lea rdx, [0x140013520]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rbx, rax
test rax, rax
je 0x140001620
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r12d
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x1400015d2
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, r15
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov eax, 1
jmp 0x140001603
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.send_request_failed:__d
lea rcx, [rbp - 0x40]
call fcn.140001770
xor r9d, r9d
lea r8, str.check
lea rdx, [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov rbx, qword [rsp + 0x37d8]
mov r14, qword [rsp + 0x37c0]
add rsp, 0x37e0
pop r15
pop r12
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.open_request_failed:__d
lea rcx, [rbp - 0x40]
call fcn.140001770
xor r9d, r9d
lea r8, [0x140013558]
jmp 0x1400015f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.connect_failed:__d
lea rcx, [rbp - 0x40]
call fcn.140001770
xor r9d, r9d
lea r8, [0x1400134ec]
jmp 0x1400015f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.open_failed:__d
lea rcx, [rbp - 0x40]
call fcn.140001770
xor r9d, r9d
lea r8, [0x1400134d8]
lea rdx, [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add rsp, 0x37e0
pop r15
pop r12
pop rbp
ret