Function at 0x1400c00b0
Capabilities:
Check for time delay via gettickcount
Check os version
Get memory capacity
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x5f0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x140177090]
xor rax, rsp
mov qword [rsp + 0x5c0], rax
xor edi, edi
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x170], __WSAFDIsSet
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
lea rcx, str.ADVAPI32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
lea rcx, [0x1401a6598]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x40], rax
lea rcx, str.NETAPI32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov r13d, edi
mov r12d, edi
mov r15d, edi
mov r14d, edi
test rax, rax
je 0x1400c0177
lea rdx, str.NetStatisticsGet
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rdx, str.NetApiBufferFree
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test r15, r15
je 0x1400c0236
test r14, r14
je 0x1400c0236
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.LanmanWorkstation
xor ecx, ecx
call r15
test eax, eax
jne 0x1400c01e3
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
call fcn.14006f600
test rax, rax
je 0x1400c01db
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1400c01db
movsd xmm2, qword [0x140161b78]
mov edx, 0xd8
mov rcx, qword [rsp + 0x58]
call r8
mov rcx, qword [rsp + 0x38]
call r14
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.LanmanServer
xor ecx, ecx
call r15
test eax, eax
jne 0x1400c0236
mov r15, qword [rsp + 0x38]
call fcn.14006f600
test rax, rax
je 0x1400c022e
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1400c022e
movsd xmm2, qword [0x140161b68]
mov edx, 0x44
mov rcx, r15
call r8
mov rcx, qword [rsp + 0x38]
call r14
test rbx, rbx
je 0x1400c0244
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rsi, rsi
je 0x1400c0284
lea rdx, str.CryptAcquireContextW
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
lea rdx, str.CryptGenRandom
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, str.CryptReleaseContext
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
jmp 0x1400c0287
mov r14, rdi
test r13, r13
je 0x1400c038d
test r12, r12
je 0x1400c038d
test r14, r14
je 0x1400c038d
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call r13
mov ebx, 0x40
test eax, eax
je 0x1400c0311
lea r8, [rsp + 0x580]
mov edx, ebx
mov rcx, qword [rsp + 0x50]
call r12
test eax, eax
je 0x1400c0307
call fcn.14006f600
test rax, rax
je 0x1400c02ff
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1400c02ff
xorps xmm2, xmm2
mov edx, ebx
lea rcx, [rsp + 0x580]
call r8
mov dword [rsp + 0x30], 1
xor edx, edx
mov rcx, qword [rsp + 0x50]
call r14
mov dword [rsp + 0x20], edi
mov r9d, reloc.WS2_32.dll_shutdown
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x50]
call r13
test eax, eax
je 0x1400c038d
lea r8, [rsp + 0x580]
mov edx, ebx
mov rcx, qword [rsp + 0x50]
call r12
test eax, eax
je 0x1400c0383
call fcn.14006f600
test rax, rax
je 0x1400c037b
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1400c037b
xorps xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x1400c036e
addsd xmm2, qword [0x140161bc8]
mov edx, ebx
lea rcx, [rsp + 0x580]
call r8
mov dword [rsp + 0x30], 1
xor edx, edx
mov rcx, qword [rsp + 0x50]
call r14
test rsi, rsi
je 0x1400c039b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [rsp + 0x180], 2
jne 0x1400c03b2
call fcn.1400909c0
test eax, eax
jne 0x1400c04db
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x1400c04db
lea rdx, str.GetForegroundWindow
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
lea rdx, str.GetCursorInfo
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.GetQueueStatus
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test r14, r14
je 0x1400c0434
call r14
mov qword [rsp + 0x58], rax
call fcn.14006f600
test rax, rax
je 0x1400c0434
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1400c0434
xorps xmm2, xmm2
mov edx, 8
lea rcx, [rsp + 0x58]
call r8
test rsi, rsi
je 0x1400c049a
cmp dword [rsp + 0x180], 2
jne 0x1400c044d
cmp dword [rsp + 0x174], 5
jb 0x1400c049a
test rsi, rsi
je 0x1400c049a
mov dword [rsp + 0x118], 0x18
lea rcx, [rsp + 0x118]
call rsi
test eax, eax
je 0x1400c049a
mov esi, dword [rsp + 0x118]
call fcn.14006f600
test rax, rax
je 0x1400c049a
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1400c049a
movsd xmm2, qword [0x140161b38]
mov edx, esi
lea rcx, [rsp + 0x118]
call r8
test r15, r15
je 0x1400c04d2
mov ecx, 0xbf
call r15
mov dword [rsp + 0x48], eax
call fcn.14006f600
test rax, rax
je 0x1400c04d2
mov rax, qword [rax + 0x18]
test rax, rax
je 0x1400c04d2
movsd xmm2, qword [0x140161b28]
mov edx, 4
lea rcx, [rsp + 0x48]
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r13, qword [rsp + 0x40]
test r13, r13
je 0x1400c0a35
mov dword [rsp + 0x38], edi
lea rdx, [0x1401a6718]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.CloseToolhelp32Snapshot
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xb8], rax
lea rdx, str.Heap32First
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov qword [rsp + 0x98], rax
lea rdx, str.Heap32Next
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov qword [rsp + 0xb0], rax
lea rdx, str.Heap32ListFirst
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.Heap32ListNext
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
mov qword [rsp + 0x90], rax
lea rdx, str.Process32First
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov qword [rsp + 0x88], rax
lea rdx, str.Process32Next
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x68], rax
lea rdx, str.Thread32First
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x78], rax
lea rdx, str.Thread32Next
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x70], rax
lea rdx, [0x1401a67d0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
lea rdx, [0x1401a67f0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xa8], rax
test rsi, rsi
je 0x1400c0a2a
test r15, r15
je 0x1400c0a2a
test r12, r12
je 0x1400c0a2a
test rbx, rbx
je 0x1400c0a2a
test r14, r14
je 0x1400c0a2a
test r13, r13
je 0x1400c0a2a
mov r15, qword [rsp + 0x68]
test r15, r15
je 0x1400c0a2a
cmp qword [rsp + 0x78], rdi
je 0x1400c0a2a
cmp qword [rsp + 0x70], rdi
je 0x1400c0a2a
cmp qword [rsp + 0x58], rdi
je 0x1400c0a2a
test rax, rax
je 0x1400c0a2a
xor edx, edx
lea ecx, [rdx + 0xf]
call rsi
mov r14, rax
mov qword [rsp + 0x80], rax
cmp rax, 0xffffffffffffffff
je 0x1400c0a2a
xor eax, eax
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rax
mov qword [rsp + 0xf8], 0x20
movsxd r13, dword [rsp + 0x30]
test r13d, r13d
je 0x1400c06db
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov dword [rsp + 0x38], eax
mov rsi, r13
mov qword [rsp + 0xa0], r13
lea rdx, [rsp + 0xf8]
mov rcx, r14
call rbx
test eax, eax
je 0x1400c0865
mov r15d, 0x2a
mov dword [rsp + 0x60], r15d
movsd xmm6, qword [0x140161b48]
nop
mov ebx, dword [rsp + 0xf8]
call fcn.14006f600
test rax, rax
je 0x1400c0740
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1400c0740
movsd xmm2, qword [0x140161b40]
mov edx, ebx
lea rcx, [rsp + 0xf8]
call r8
nop
xor eax, eax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xc0], 0x38
mov r8, qword [rsp + 0x108]
mov edx, dword [rsp + 0x100]
lea rcx, [rsp + 0xc0]
call qword [rsp + 0x98]
test eax, eax
je 0x1400c07f5
mov ebx, 0x50
mov dword [rsp + 0x64], ebx
movaps xmm2, xmm6
mov edx, dword [rsp + 0xc0]
lea rcx, [rsp + 0xc0]
call fcn.14006f670
lea rcx, [rsp + 0xc0]
call r12
test eax, eax
je 0x1400c07f5
test rsi, rsi
je 0x1400c07eb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jae 0x1400c07f5
dec ebx
mov dword [rsp + 0x64], ebx
test ebx, ebx
jg 0x1400c07b1
jmp 0x1400c082d
lea rdx, [rsp + 0xf8]
mov rcx, r14
call qword [rsp + 0x90]
test eax, eax
je 0x1400c0860
test r13d, r13d
je 0x1400c0857
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jae 0x1400c0860
test r15d, r15d
jg 0x1400c0710
mov r15, qword [rsp + 0x68]
mov dword [rsp + 0x210], 0x130
test r13d, r13d
je 0x1400c087d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
lea rdx, [rsp + 0x210]
mov rcx, r14
call qword [rsp + 0x88]
movsd xmm6, qword [0x140161b58]
test eax, eax
je 0x1400c08f0
nop dword [rax + rax]
mov ebx, dword [rsp + 0x210]
call fcn.14006f600
test rax, rax
je 0x1400c08ca
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1400c08ca
movaps xmm2, xmm6
mov edx, ebx
lea rcx, [rsp + 0x210]
call r8
lea rdx, [rsp + 0x210]
mov rcx, r14
call r15
test eax, eax
je 0x1400c08f0
test rsi, rsi
je 0x1400c08a0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jb 0x1400c08a0
mov dword [rsp + 0x118], 0x1c
test r13d, r13d
je 0x1400c0908
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
lea rdx, [rsp + 0x118]
mov rcx, r14
call qword [rsp + 0x78]
test eax, eax
je 0x1400c0985
movsd xmm7, qword [0x140161b50]
mov r13, qword [rsp + 0x70]
nop dword [rax + rax]
mov ebx, dword [rsp + 0x118]
call fcn.14006f600
test rax, rax
je 0x1400c095a
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1400c095a
movaps xmm2, xmm7
mov edx, ebx
lea rcx, [rsp + 0x118]
call r8
lea rdx, [rsp + 0x118]
mov rcx, r14
call r13
test eax, eax
je 0x1400c0980
test rsi, rsi
je 0x1400c0930
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jb 0x1400c0930
mov r13d, dword [rsp + 0x30]
mov dword [rsp + 0x340], 0x238
test r13d, r13d
je 0x1400c099d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
lea rdx, [rsp + 0x340]
mov rcx, r14
call qword [rsp + 0x58]
test eax, eax
je 0x1400c0a10
mov r15, qword [rsp + 0xa8]
nop dword [rax + rax]
mov ebx, dword [rsp + 0x340]
call fcn.14006f600
test rax, rax
je 0x1400c09ea
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1400c09ea
movaps xmm2, xmm6
mov edx, ebx
lea rcx, [rsp + 0x340]
call r8
lea rdx, [rsp + 0x340]
mov rcx, r14
call r15
test eax, eax
je 0x1400c0a10
test rsi, rsi
je 0x1400c09c0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jb 0x1400c09c0
mov rax, qword [rsp + 0xb8]
mov rcx, r14
test rax, rax
je 0x1400c0a24
call rax
jmp 0x1400c0a2a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.1400c0af0
lea rcx, [rsp + 0x138]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.14006f600
test rax, rax
je 0x1400c0a73
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1400c0a73
movsd xmm2, qword [0x140161b28]
mov edx, 0x38
lea rcx, [rsp + 0x138]
call r8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x48], eax
call fcn.14006f600
test rax, rax
je 0x1400c0aa5
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1400c0aa5
movsd xmm2, qword [0x140161b28]
mov edx, 4
lea rcx, [rsp + 0x48]
call r8
mov eax, 1
mov rcx, qword [rsp + 0x5c0]
xor rcx, rsp
call fcn.140129b50
lea r11, [rsp + 0x5f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
ret