Function at 0x1801e71b0
Capabilities:
Check for time delay via gettickcount
Check os version
Get memory capacity
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x5f0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x5c0], rax
xor r12d, r12d
mov qword [rsp + 0x50], r12
mov esi, r12d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x170], __WSAFDIsSet
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
lea rcx, str.ADVAPI32.DLL
call fcn.1801e6e10
mov rdi, rax
lea rcx, str.KERNEL32.DLL
call fcn.1801e6e10
mov qword [rsp + 0x40], rax
lea rcx, str.NETAPI32.DLL
call fcn.1801e6e10
mov rbx, rax
mov r15d, r12d
mov r14d, r12d
mov r13d, r12d
test rax, rax
je 0x1801e7276
lea rdx, str.NetStatisticsGet
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
lea rdx, str.NetApiBufferFree
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test r13, r13
je 0x1801e7300
test r12, r12
je 0x1801e7300
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.LanmanWorkstation
xor ecx, ecx
call r13
test eax, eax
jne 0x1801e72c3
movsd xmm2, qword [0x180349338]
mov edx, 0xd8
mov rcx, qword [rsp + 0x30]
call sym.VBoxRT.dll_RAND_add
mov rcx, qword [rsp + 0x30]
call r12
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.LanmanServer
xor ecx, ecx
call r13
test eax, eax
jne 0x1801e7300
movsd xmm2, qword [0x180349310]
lea edx, [rax + 0x44]
mov rcx, qword [rsp + 0x30]
call sym.VBoxRT.dll_RAND_add
mov rcx, qword [rsp + 0x30]
call r12
test rbx, rbx
je 0x1801e730e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rdi, rdi
je 0x1801e734e
lea rdx, str.CryptAcquireContextW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, str.CryptGenRandom
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rdx, str.CryptReleaseContext
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
jmp 0x1801e7351
mov r12, rsi
test r12, r12
je 0x1801e743d
test r15, r15
je 0x1801e743d
test r14, r14
je 0x1801e743d
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call r12
mov ebx, 0x40
test eax, eax
je 0x1801e73cc
lea r8, [rsp + 0x580]
mov edx, ebx
mov rcx, qword [rsp + 0x50]
call r15
test eax, eax
je 0x1801e73c2
xorpd xmm2, xmm2
mov edx, ebx
lea rcx, [rsp + 0x580]
call sym.VBoxRT.dll_RAND_add
mov esi, 1
mov dword [rsp + 0x38], esi
xor edx, edx
mov rcx, qword [rsp + 0x50]
call r14
mov dword [rsp + 0x20], 0
mov r9d, reloc.WS2_32.dll_shutdown
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x50]
call r12
test eax, eax
je 0x1801e743d
lea r8, [rsp + 0x580]
mov edx, ebx
mov rcx, qword [rsp + 0x50]
call r15
test eax, eax
je 0x1801e7433
pxor xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x1801e741b
addsd xmm2, qword [0x180237db8]
mov edx, ebx
lea rcx, [rsp + 0x580]
call sym.VBoxRT.dll_RAND_add
mov esi, 1
mov dword [rsp + 0x38], esi
xor edx, edx
mov rcx, qword [rsp + 0x50]
call r14
test rdi, rdi
je 0x1801e744b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [rsp + 0x180], 2
jne 0x1801e7462
call sym.VBoxRT.dll_OPENSSL_isservice
test eax, eax
jne 0x1801e7557
lea rcx, str.USER32.DLL
call fcn.1801e6e10
mov rbx, rax
test rax, rax
je 0x1801e7557
lea rdx, str.GetForegroundWindow
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
lea rdx, str.GetCursorInfo
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea rdx, [0x180349220]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test r13, r13
je 0x1801e74d3
call r13
mov qword [rsp + 0x58], rax
xorpd xmm2, xmm2
mov edx, 8
lea rcx, [rsp + 0x58]
call sym.VBoxRT.dll_RAND_add
test rdi, rdi
je 0x1801e7526
cmp dword [rsp + 0x180], 2
jne 0x1801e74ec
cmp dword [rsp + 0x174], 5
jb 0x1801e7526
test rdi, rdi
je 0x1801e7526
mov dword [rsp + 0x118], 0x18
lea rcx, [rsp + 0x118]
call rdi
test eax, eax
je 0x1801e7526
movsd xmm2, qword [0x180349218]
mov edx, dword [rsp + 0x118]
lea rcx, [rsp + 0x118]
call sym.VBoxRT.dll_RAND_add
test r12, r12
je 0x1801e754e
mov ecx, 0xbf
call r12
mov dword [rsp + 0x48], eax
movsd xmm2, qword [0x180310e68]
mov edx, 4
lea rcx, [rsp + 0x48]
call sym.VBoxRT.dll_RAND_add
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r15, qword [rsp + 0x40]
test r15, r15
je 0x1801e7a62
xor edi, edi
mov dword [rsp + 0x30], edi
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, str.CloseToolhelp32Snapshot
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x68], rax
lea rdx, str.Heap32First
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov qword [rsp + 0x98], rax
lea rdx, str.Heap32Next
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
mov qword [rsp + 0xb8], rax
lea rdx, str.Heap32ListFirst
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.Heap32ListNext
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov qword [rsp + 0xb0], rax
lea rdx, str.Process32First
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x78], rax
lea rdx, str.Process32Next
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x80], rax
lea rdx, str.Thread32First
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x90], rax
lea rdx, str.Thread32Next
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x88], rax
lea rdx, str.Module32First
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
lea rdx, [0x180349180]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xa0], rax
test r12, r12
je 0x1801e7a57
test r13, r13
je 0x1801e7a57
test r14, r14
je 0x1801e7a57
test rbx, rbx
je 0x1801e7a57
test r15, r15
je 0x1801e7a57
cmp qword [rsp + 0x78], rdi
je 0x1801e7a57
mov r13, qword [rsp + 0x80]
test r13, r13
je 0x1801e7a57
cmp qword [rsp + 0x90], rdi
je 0x1801e7a57
cmp qword [rsp + 0x88], rdi
je 0x1801e7a57
cmp qword [rsp + 0x58], rdi
je 0x1801e7a57
test rax, rax
je 0x1801e7a57
xor edx, edx
lea ecx, [rdi + 0xf]
call r12
mov r12, rax
mov qword [rsp + 0xa8], rax
cmp rax, 0xffffffffffffffff
je 0x1801e7a57
xor eax, eax
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rax
mov qword [rsp + 0xf8], 0x20
test esi, esi
je 0x1801e7761
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0xf8]
mov rcx, r12
call rbx
test eax, eax
je 0x1801e78d1
mov r13d, 0x2a
mov dword [rsp + 0x60], r13d
movsd xmm6, qword [0x180349178]
nop dword [rax]
movsd xmm2, qword [0x180349170]
mov edx, dword [rsp + 0xf8]
lea rcx, [rsp + 0xf8]
call sym.VBoxRT.dll_RAND_add
nop
xor eax, eax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xc0], 0x38
mov r8, qword [rsp + 0x108]
mov edx, dword [rsp + 0x100]
lea rcx, [rsp + 0xc0]
call qword [rsp + 0x98]
test eax, eax
je 0x1801e7864
mov ebx, 0x50
mov dword [rsp + 0x70], ebx
nop
movapd xmm2, xmm6
mov edx, dword [rsp + 0xc0]
lea rcx, [rsp + 0xc0]
call sym.VBoxRT.dll_RAND_add
lea rcx, [rsp + 0xc0]
call r14
test eax, eax
je 0x1801e7864
test esi, esi
je 0x1801e785a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jae 0x1801e7864
dec ebx
mov dword [rsp + 0x70], ebx
test ebx, ebx
jg 0x1801e7820
jmp 0x1801e789b
lea rdx, [rsp + 0xf8]
mov rcx, r12
call r15
test eax, eax
je 0x1801e78c9
test esi, esi
je 0x1801e78c0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jae 0x1801e78c9
test r13d, r13d
jg 0x1801e7790
mov r13, qword [rsp + 0x80]
mov dword [rsp + 0x210], 0x130
test esi, esi
je 0x1801e78e8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
movsxd rbx, esi
lea rdx, [rsp + 0x210]
mov rcx, r12
call qword [rsp + 0x78]
movsd xmm6, qword [0x180349168]
test eax, eax
je 0x1801e794d
nop word [rax + rax]
movapd xmm2, xmm6
mov edx, dword [rsp + 0x210]
lea rcx, [rsp + 0x210]
call sym.VBoxRT.dll_RAND_add
lea rdx, [rsp + 0x210]
mov rcx, r12
call r13
test eax, eax
je 0x1801e794d
test esi, esi
je 0x1801e7910
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jb 0x1801e7910
mov dword [rsp + 0x118], 0x1c
test esi, esi
je 0x1801e7964
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
lea rdx, [rsp + 0x118]
mov rcx, r12
call qword [rsp + 0x90]
test eax, eax
je 0x1801e79d1
movsd xmm7, qword [0x180349160]
mov rsi, qword [rsp + 0x88]
nop word [rax + rax]
movapd xmm2, xmm7
mov edx, dword [rsp + 0x118]
lea rcx, [rsp + 0x118]
call sym.VBoxRT.dll_RAND_add
lea rdx, [rsp + 0x118]
mov rcx, r12
call rsi
test eax, eax
je 0x1801e79cd
test rbx, rbx
je 0x1801e7990
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jb 0x1801e7990
mov esi, dword [rsp + 0x38]
mov dword [rsp + 0x340], 0x238
test esi, esi
je 0x1801e79e8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
lea rdx, [rsp + 0x340]
mov rcx, r12
call qword [rsp + 0x58]
test eax, eax
je 0x1801e7a40
mov rsi, qword [rsp + 0xa0]
movapd xmm2, xmm6
mov edx, dword [rsp + 0x340]
lea rcx, [rsp + 0x340]
call sym.VBoxRT.dll_RAND_add
lea rdx, [rsp + 0x340]
mov rcx, r12
call rsi
test eax, eax
je 0x1801e7a40
test rbx, rbx
je 0x1801e7a03
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jb 0x1801e7a03
mov rax, qword [rsp + 0x68]
mov rcx, r12
test rax, rax
je 0x1801e7a51
call rax
jmp 0x1801e7a57
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [reloc.WS2_32.dll_accept]
test eax, eax
je 0x1801e7aa0
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1801e7a83
mov dword [reloc.WS2_32.dll_accept], eax
jmp 0x1801e7aa0
xorpd xmm2, xmm2
mov edx, 8
lea rcx, [rsp + 0x68]
call sym.VBoxRT.dll_RAND_add
mov eax, dword [reloc.WS2_32.dll_accept]
test eax, eax
jne 0x1801e7abd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x30], eax
xorpd xmm2, xmm2
mov edx, 4
lea rcx, [rsp + 0x30]
call sym.VBoxRT.dll_RAND_add
lea rcx, [rsp + 0x138]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
movsd xmm2, qword [0x180310e68]
mov edx, 0x38
lea rcx, [rsp + 0x138]
call sym.VBoxRT.dll_RAND_add
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x48], eax
movsd xmm2, qword [0x180310e68]
mov edx, 4
lea rcx, [rsp + 0x48]
call sym.VBoxRT.dll_RAND_add
mov eax, 1
mov rcx, qword [rsp + 0x5c0]
xor rcx, rsp
call fcn.180227610
lea r11, [rsp + 0x5f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
ret