Function at 0x140131770
Capabilities:
Check for time delay via gettickcount
Check os version
Get memory capacity
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x5f0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x140264330]
xor rax, rsp
mov qword [rsp + 0x5c0], rax
xor edi, edi
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x170], __WSAFDIsSet
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
lea rcx, str.ADVAPI32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
lea rcx, [0x1402969e8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x40], rax
lea rcx, str.NETAPI32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov r13d, edi
mov r12d, edi
mov r15d, edi
mov r14d, edi
test rax, rax
je 0x140131837
lea rdx, str.NetStatisticsGet
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rdx, str.NetApiBufferFree
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test r15, r15
je 0x1401318f6
test r14, r14
je 0x1401318f6
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.LanmanWorkstation
xor ecx, ecx
call r15
test eax, eax
jne 0x1401318a3
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
call fcn.1400d9c50
test rax, rax
je 0x14013189b
mov r8, qword [rax + 0x18]
test r8, r8
je 0x14013189b
movsd xmm2, qword [0x14024c018]
mov edx, 0xd8
mov rcx, qword [rsp + 0x58]
call r8
mov rcx, qword [rsp + 0x38]
call r14
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.LanmanServer
xor ecx, ecx
call r15
test eax, eax
jne 0x1401318f6
mov r15, qword [rsp + 0x38]
call fcn.1400d9c50
test rax, rax
je 0x1401318ee
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1401318ee
movsd xmm2, qword [0x14024c008]
mov edx, 0x44
mov rcx, r15
call r8
mov rcx, qword [rsp + 0x38]
call r14
test rbx, rbx
je 0x140131904
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rsi, rsi
je 0x140131944
lea rdx, str.CryptAcquireContextW
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
lea rdx, str.CryptGenRandom
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, str.CryptReleaseContext
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
jmp 0x140131947
mov r14, rdi
test r13, r13
je 0x140131a4d
test r12, r12
je 0x140131a4d
test r14, r14
je 0x140131a4d
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call r13
mov ebx, 0x40
test eax, eax
je 0x1401319d1
lea r8, [rsp + 0x580]
mov edx, ebx
mov rcx, qword [rsp + 0x50]
call r12
test eax, eax
je 0x1401319c7
call fcn.1400d9c50
test rax, rax
je 0x1401319bf
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1401319bf
xorps xmm2, xmm2
mov edx, ebx
lea rcx, [rsp + 0x580]
call r8
mov dword [rsp + 0x30], 1
xor edx, edx
mov rcx, qword [rsp + 0x50]
call r14
mov dword [rsp + 0x20], edi
mov r9d, reloc.WS2_32.dll_shutdown
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x50]
call r13
test eax, eax
je 0x140131a4d
lea r8, [rsp + 0x580]
mov edx, ebx
mov rcx, qword [rsp + 0x50]
call r12
test eax, eax
je 0x140131a43
call fcn.1400d9c50
test rax, rax
je 0x140131a3b
mov r8, qword [rax + 0x18]
test r8, r8
je 0x140131a3b
xorps xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x140131a2e
addsd xmm2, qword [0x14024c0a0]
mov edx, ebx
lea rcx, [rsp + 0x580]
call r8
mov dword [rsp + 0x30], 1
xor edx, edx
mov rcx, qword [rsp + 0x50]
call r14
test rsi, rsi
je 0x140131a5b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [rsp + 0x180], 2
jne 0x140131a72
call fcn.1400f72a0
test eax, eax
jne 0x140131b9b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140131b9b
lea rdx, str.GetForegroundWindow
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
lea rdx, str.GetCursorInfo
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.GetQueueStatus
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test r14, r14
je 0x140131af4
call r14
mov qword [rsp + 0x58], rax
call fcn.1400d9c50
test rax, rax
je 0x140131af4
mov r8, qword [rax + 0x18]
test r8, r8
je 0x140131af4
xorps xmm2, xmm2
mov edx, 8
lea rcx, [rsp + 0x58]
call r8
test rsi, rsi
je 0x140131b5a
cmp dword [rsp + 0x180], 2
jne 0x140131b0d
cmp dword [rsp + 0x174], 5
jb 0x140131b5a
test rsi, rsi
je 0x140131b5a
mov dword [rsp + 0x118], 0x18
lea rcx, [rsp + 0x118]
call rsi
test eax, eax
je 0x140131b5a
mov esi, dword [rsp + 0x118]
call fcn.1400d9c50
test rax, rax
je 0x140131b5a
mov r8, qword [rax + 0x18]
test r8, r8
je 0x140131b5a
movsd xmm2, qword [0x14024bfd8]
mov edx, esi
lea rcx, [rsp + 0x118]
call r8
test r15, r15
je 0x140131b92
mov ecx, 0xbf
call r15
mov dword [rsp + 0x48], eax
call fcn.1400d9c50
test rax, rax
je 0x140131b92
mov rax, qword [rax + 0x18]
test rax, rax
je 0x140131b92
movsd xmm2, qword [0x14024bfc8]
mov edx, 4
lea rcx, [rsp + 0x48]
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r13, qword [rsp + 0x40]
test r13, r13
je 0x1401320f5
mov dword [rsp + 0x38], edi
lea rdx, [0x140296b68]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.CloseToolhelp32Snapshot
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xb8], rax
lea rdx, str.Heap32First
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov qword [rsp + 0x98], rax
lea rdx, str.Heap32Next
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov qword [rsp + 0xb0], rax
lea rdx, str.Heap32ListFirst
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.Heap32ListNext
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
mov qword [rsp + 0x90], rax
lea rdx, str.Process32First
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov qword [rsp + 0x88], rax
lea rdx, str.Process32Next
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x68], rax
lea rdx, str.Thread32First
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x78], rax
lea rdx, str.Thread32Next
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x70], rax
lea rdx, [0x140296c20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
lea rdx, [0x140296c40]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xa8], rax
test rsi, rsi
je 0x1401320ea
test r15, r15
je 0x1401320ea
test r12, r12
je 0x1401320ea
test rbx, rbx
je 0x1401320ea
test r14, r14
je 0x1401320ea
test r13, r13
je 0x1401320ea
mov r15, qword [rsp + 0x68]
test r15, r15
je 0x1401320ea
cmp qword [rsp + 0x78], rdi
je 0x1401320ea
cmp qword [rsp + 0x70], rdi
je 0x1401320ea
cmp qword [rsp + 0x58], rdi
je 0x1401320ea
test rax, rax
je 0x1401320ea
xor edx, edx
lea ecx, [rdx + 0xf]
call rsi
mov r14, rax
mov qword [rsp + 0x80], rax
cmp rax, 0xffffffffffffffff
je 0x1401320ea
xor eax, eax
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rax
mov qword [rsp + 0xf8], 0x20
movsxd r13, dword [rsp + 0x30]
test r13d, r13d
je 0x140131d9b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov dword [rsp + 0x38], eax
mov rsi, r13
mov qword [rsp + 0xa0], r13
lea rdx, [rsp + 0xf8]
mov rcx, r14
call rbx
test eax, eax
je 0x140131f25
mov r15d, 0x2a
mov dword [rsp + 0x60], r15d
movsd xmm6, qword [0x14024bfe8]
nop
mov ebx, dword [rsp + 0xf8]
call fcn.1400d9c50
test rax, rax
je 0x140131e00
mov r8, qword [rax + 0x18]
test r8, r8
je 0x140131e00
movsd xmm2, qword [0x14024bfe0]
mov edx, ebx
lea rcx, [rsp + 0xf8]
call r8
nop
xor eax, eax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xc0], 0x38
mov r8, qword [rsp + 0x108]
mov edx, dword [rsp + 0x100]
lea rcx, [rsp + 0xc0]
call qword [rsp + 0x98]
test eax, eax
je 0x140131eb5
mov ebx, 0x50
mov dword [rsp + 0x64], ebx
movaps xmm2, xmm6
mov edx, dword [rsp + 0xc0]
lea rcx, [rsp + 0xc0]
call fcn.1400d9cc0
lea rcx, [rsp + 0xc0]
call r12
test eax, eax
je 0x140131eb5
test rsi, rsi
je 0x140131eab
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jae 0x140131eb5
dec ebx
mov dword [rsp + 0x64], ebx
test ebx, ebx
jg 0x140131e71
jmp 0x140131eed
lea rdx, [rsp + 0xf8]
mov rcx, r14
call qword [rsp + 0x90]
test eax, eax
je 0x140131f20
test r13d, r13d
je 0x140131f17
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jae 0x140131f20
test r15d, r15d
jg 0x140131dd0
mov r15, qword [rsp + 0x68]
mov dword [rsp + 0x210], 0x130
test r13d, r13d
je 0x140131f3d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
lea rdx, [rsp + 0x210]
mov rcx, r14
call qword [rsp + 0x88]
movsd xmm6, qword [0x14024bff8]
test eax, eax
je 0x140131fb0
nop dword [rax + rax]
mov ebx, dword [rsp + 0x210]
call fcn.1400d9c50
test rax, rax
je 0x140131f8a
mov r8, qword [rax + 0x18]
test r8, r8
je 0x140131f8a
movaps xmm2, xmm6
mov edx, ebx
lea rcx, [rsp + 0x210]
call r8
lea rdx, [rsp + 0x210]
mov rcx, r14
call r15
test eax, eax
je 0x140131fb0
test rsi, rsi
je 0x140131f60
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jb 0x140131f60
mov dword [rsp + 0x118], 0x1c
test r13d, r13d
je 0x140131fc8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
lea rdx, [rsp + 0x118]
mov rcx, r14
call qword [rsp + 0x78]
test eax, eax
je 0x140132045
movsd xmm7, qword [0x14024bff0]
mov r13, qword [rsp + 0x70]
nop dword [rax + rax]
mov ebx, dword [rsp + 0x118]
call fcn.1400d9c50
test rax, rax
je 0x14013201a
mov r8, qword [rax + 0x18]
test r8, r8
je 0x14013201a
movaps xmm2, xmm7
mov edx, ebx
lea rcx, [rsp + 0x118]
call r8
lea rdx, [rsp + 0x118]
mov rcx, r14
call r13
test eax, eax
je 0x140132040
test rsi, rsi
je 0x140131ff0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jb 0x140131ff0
mov r13d, dword [rsp + 0x30]
mov dword [rsp + 0x340], 0x238
test r13d, r13d
je 0x14013205d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
lea rdx, [rsp + 0x340]
mov rcx, r14
call qword [rsp + 0x58]
test eax, eax
je 0x1401320d0
mov r15, qword [rsp + 0xa8]
nop dword [rax + rax]
mov ebx, dword [rsp + 0x340]
call fcn.1400d9c50
test rax, rax
je 0x1401320aa
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1401320aa
movaps xmm2, xmm6
mov edx, ebx
lea rcx, [rsp + 0x340]
call r8
lea rdx, [rsp + 0x340]
mov rcx, r14
call r15
test eax, eax
je 0x1401320d0
test rsi, rsi
je 0x140132080
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jb 0x140132080
mov rax, qword [rsp + 0xb8]
mov rcx, r14
test rax, rax
je 0x1401320e4
call rax
jmp 0x1401320ea
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.1401321b0
lea rcx, [rsp + 0x138]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.1400d9c50
test rax, rax
je 0x140132133
mov r8, qword [rax + 0x18]
test r8, r8
je 0x140132133
movsd xmm2, qword [0x14024bfc8]
mov edx, 0x38
lea rcx, [rsp + 0x138]
call r8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x48], eax
call fcn.1400d9c50
test rax, rax
je 0x140132165
mov r8, qword [rax + 0x18]
test r8, r8
je 0x140132165
movsd xmm2, qword [0x14024bfc8]
mov edx, 4
lea rcx, [rsp + 0x48]
call r8
mov eax, 1
mov rcx, qword [rsp + 0x5c0]
xor rcx, rsp
call fcn.1401bb2c0
lea r11, [rsp + 0x5f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
ret