Function at 0x4015a4
Capabilities:
Check for sandbox username or hostname
Enumerate files on windows
Enumerate gui resources
Get common file path
Get hostname
Get system information on windows
Query or enumerate registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x888
lea rbp, [rsp + 0x80]
call sym.__main
lea rax, [rbp + 0x778]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
mov dword [rbp + 0x7dc], eax
cmp dword [rbp + 0x7dc], 0
je 0x401602
mov ecx, 0
call sym.exit
mov dword [rbp + 0x76c], 4
mov rcx, qword [rbp + 0x778]
lea rdx, [rbp + 0x774]
lea rax, [rbp + 0x76c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x770]
mov qword [rsp + 0x20], rax
mov r9, rdx
mov r8d, 0
lea rdx, str.ProgramFilesDir
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov dword [rbp + 0x7dc], eax
cmp dword [rbp + 0x7dc], 0
je 0x401664
mov ecx, 0
call sym.exit
mov dword [rbp + 0x65c], 0x100
lea rdx, [rbp + 0x65c]
lea rax, [rbp + 0x660]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetComputerNameA]
call rax
test eax, eax
setne al
test al, al
je 0x4016db
lea rax, [rbp + 0x660]
mov rdx, rax
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [0x0040abc0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
lea rax, [rbp + 0x660]
lea rdx, str.HAL9TH
mov rcx, rax
call sym.strstr
test rax, rax
je 0x4016db
mov ecx, 0
call sym.exit
lea rax, [rbp + 0x620]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp + 0x640]
cmp eax, 1
jne 0x401725
lea rdx, str.Exit
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [0x0040abc0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov ecx, 0
call sym.exit
lea rax, [rbp + 0x220]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call rax
mov dword [rbp + 0x7fc], 0
lea rax, [rbp + 0x220]
lea rdx, [0x0040a4d6]
mov rcx, rax
call sym.int_strcat_s_1024ull__char_____1024ull___char_const_
lea rdx, [rbp + 0xe0]
lea rax, [rbp + 0x220]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call rax
mov qword [rbp + 0x7d0], rax
cmp qword [rbp + 0x7d0], 0xffffffffffffffff
je 0x4017e7
mov eax, dword [rbp + 0xe0]
and eax, 0x10
test eax, eax
jne 0x4017af
add dword [rbp + 0x7fc], 1
lea rax, [rbp + 0xe0]
mov rcx, qword [rbp + 0x7d0]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileA]
call rax
test eax, eax
setne al
test al, al
je 0x4017d4
jmp 0x40179b
mov rax, qword [rbp + 0x7d0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
mov eax, dword [rbp + 0x7fc]
mov edx, eax
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::ostream::operator___int_
mov rdx, qword [0x0040abc0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
cmp dword [rbp + 0x7fc], 0
jne 0x40181d
mov ecx, 0
call sym.exit
mov rax, qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call rax
test eax, eax
setne al
test al, al
je 0x401839
mov ecx, 0
call sym.exit
mov dword [rbp + 0xb0], 0xd1
mov dword [rbp + 0xb4], 0xee
mov dword [rbp + 0xb8], 0xf5
mov dword [rbp + 0xbc], 0xf3
mov dword [rbp + 0xc0], 0xf2
mov dword [rbp + 0xc4], 0xe6
mov dword [rbp + 0xc8], 0xeb
mov dword [rbp + 0xcc], 0xc6
mov dword [rbp + 0xd0], 0xeb
mov dword [rbp + 0xd4], 0xeb
mov dword [rbp + 0xd8], 0xe8
mov dword [rbp + 0xdc], 0xe4
mov dword [rbp + 0x7cc], 0xc
mov dword [rbp + 0x7c8], 0x87
mov qword [rbp + 0x7f0], 0
mov eax, dword [rbp + 0x7cc]
cmp qword [rbp + 0x7f0], rax
jae 0x40191b
mov rax, qword [rbp + 0x7f0]
mov eax, dword [rbp + rax*4 + 0xb0]
xor eax, dword [rbp + 0x7c8]
mov dword [rbp + 0x7c4], eax
mov eax, dword [rbp + 0x7c4]
mov ecx, eax
lea rax, [rbp - 0x50]
mov rdx, qword [rbp + 0x7f0]
add rax, rdx
mov byte [rax], cl
add qword [rbp + 0x7f0], 1
jmp 0x4018d0
mov eax, dword [rbp + 0x7cc]
mov byte [rbp + rax - 0x50], 0
lea rcx, str.kernel32.dll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0x7b8], rax
mov rax, qword [rbp + 0x7b8]
mov rdx, rax
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::ostream::operator___void_const_
mov rdx, qword [0x0040abc0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
lea rax, [rbp - 0x50]
mov rcx, qword [rbp + 0x7b8]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x7b0], rax
cmp qword [rbp + 0x7b0], 0
setne al
movzx eax, al
mov edx, eax
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::ostream::operator___bool_
mov rdx, qword [0x0040abc0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov rax, qword [rbp + 0x7b0]
mov qword [rbp + 0x7a8], rax
mov rax, qword [rbp + 0x7a8]
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x100000
mov ecx, 0
call rax
mov qword [rbp + 0x7a0], rax
mov dword [rbp + 0x79c], 0
mov dword [rbp + 0x79c], 0x1d
mov rax, qword [rbp + 0x7a0]
mov qword [rbp + 0x7e8], rax
mov dword [rbp + 0x7e4], 0
mov eax, dword [rbp + 0x7e4]
cmp eax, dword [rbp + 0x79c]
jge 0x401b4e
mov eax, dword [rbp + 0x7e4]
cdqe
lea rdx, [rax*8]
lea rax, str.6304cf7b_6f77_8747_8787_c6d6c6d7d5d6
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x790], rax
mov rdx, qword [rbp + 0x7e8]
mov rax, qword [rbp + 0x790]
mov rcx, rax
mov rax, qword [sym.imp.RPCRT4.dll_UuidFromStringA]
call rax
mov dword [rbp + 0x78c], eax
cmp dword [rbp + 0x78c], 0
je 0x401aa9
lea rdx, str.NOT_S_OK
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [0x0040abc0]
mov rcx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov rax, qword [rbp + 0x7a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0xffffffff
jmp 0x401b8b
mov rax, qword [rbp + 0x7e8]
mov qword [rbp + 0x780], rax
mov dword [rbp + 0x7e0], 0
cmp dword [rbp + 0x7e0], 0xf
jg 0x401b27
mov eax, dword [rbp + 0x7e0]
cdqe
mov rdx, qword [rbp + 0x780]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x7e0]
cdqe
mov rdx, qword [rbp + 0x780]
add rax, rdx
mov edx, ecx
xor edx, 0xffffff87
mov byte [rax], dl
mov eax, dword [rbp + 0x7e0]
cdqe
mov rdx, qword [rbp + 0x780]
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
mov edx, eax
lea rcx, str.x_02x
call sym.printf_char_const__::_
add dword [rbp + 0x7e0], 1
jmp 0x401ac1
mov rdx, qword [0x0040abc0]
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
call sym.std::ostream::operator___std::ostream____std::ostream__
add qword [rbp + 0x7e8], 0x10
add dword [rbp + 0x7e4], 1
jmp 0x401a0b
mov rbx, qword [rbp + 0x7a0]
mov rax, qword [sym.imp.USER32.dll_GetProcessWindowStation]
call rax
mov r8d, 0
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_EnumDesktopsA]
call rax
mov rax, qword [rbp + 0x7a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x888
pop rbx
pop rbp
ret