Function at 0x140130840
Capabilities:
Check for time delay via gettickcount
Check os version
Get memory capacity
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x5f0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x1402581e0]
xor rax, rsp
mov qword [rsp + 0x5c0], rax
xor edi, edi
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x170], __WSAFDIsSet
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
lea rcx, str.ADVAPI32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
lea rcx, [0x14028a898]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x40], rax
lea rcx, str.NETAPI32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov r13d, edi
mov r12d, edi
mov r15d, edi
mov r14d, edi
test rax, rax
je 0x140130907
lea rdx, str.NetStatisticsGet
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rdx, str.NetApiBufferFree
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test r15, r15
je 0x1401309c6
test r14, r14
je 0x1401309c6
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.LanmanWorkstation
xor ecx, ecx
call r15
test eax, eax
jne 0x140130973
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
call fcn.1400d8c40
test rax, rax
je 0x14013096b
mov r8, qword [rax + 0x18]
test r8, r8
je 0x14013096b
movsd xmm2, qword [0x140240eb8]
mov edx, 0xd8
mov rcx, qword [rsp + 0x58]
call r8
mov rcx, qword [rsp + 0x38]
call r14
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.LanmanServer
xor ecx, ecx
call r15
test eax, eax
jne 0x1401309c6
mov r15, qword [rsp + 0x38]
call fcn.1400d8c40
test rax, rax
je 0x1401309be
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1401309be
movsd xmm2, qword [0x140240ea8]
mov edx, 0x44
mov rcx, r15
call r8
mov rcx, qword [rsp + 0x38]
call r14
test rbx, rbx
je 0x1401309d4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rsi, rsi
je 0x140130a14
lea rdx, str.CryptAcquireContextW
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
lea rdx, str.CryptGenRandom
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, str.CryptReleaseContext
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
jmp 0x140130a17
mov r14, rdi
test r13, r13
je 0x140130b1d
test r12, r12
je 0x140130b1d
test r14, r14
je 0x140130b1d
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call r13
mov ebx, 0x40
test eax, eax
je 0x140130aa1
lea r8, [rsp + 0x580]
mov edx, ebx
mov rcx, qword [rsp + 0x50]
call r12
test eax, eax
je 0x140130a97
call fcn.1400d8c40
test rax, rax
je 0x140130a8f
mov r8, qword [rax + 0x18]
test r8, r8
je 0x140130a8f
xorps xmm2, xmm2
mov edx, ebx
lea rcx, [rsp + 0x580]
call r8
mov dword [rsp + 0x30], 1
xor edx, edx
mov rcx, qword [rsp + 0x50]
call r14
mov dword [rsp + 0x20], edi
mov r9d, reloc.WS2_32.dll_shutdown
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x50]
call r13
test eax, eax
je 0x140130b1d
lea r8, [rsp + 0x580]
mov edx, ebx
mov rcx, qword [rsp + 0x50]
call r12
test eax, eax
je 0x140130b13
call fcn.1400d8c40
test rax, rax
je 0x140130b0b
mov r8, qword [rax + 0x18]
test r8, r8
je 0x140130b0b
xorps xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x140130afe
addsd xmm2, qword [0x140240f40]
mov edx, ebx
lea rcx, [rsp + 0x580]
call r8
mov dword [rsp + 0x30], 1
xor edx, edx
mov rcx, qword [rsp + 0x50]
call r14
test rsi, rsi
je 0x140130b2b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [rsp + 0x180], 2
jne 0x140130b42
call fcn.1400f62c0
test eax, eax
jne 0x140130c6b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140130c6b
lea rdx, str.GetForegroundWindow
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
lea rdx, str.GetCursorInfo
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.GetQueueStatus
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test r14, r14
je 0x140130bc4
call r14
mov qword [rsp + 0x58], rax
call fcn.1400d8c40
test rax, rax
je 0x140130bc4
mov r8, qword [rax + 0x18]
test r8, r8
je 0x140130bc4
xorps xmm2, xmm2
mov edx, 8
lea rcx, [rsp + 0x58]
call r8
test rsi, rsi
je 0x140130c2a
cmp dword [rsp + 0x180], 2
jne 0x140130bdd
cmp dword [rsp + 0x174], 5
jb 0x140130c2a
test rsi, rsi
je 0x140130c2a
mov dword [rsp + 0x118], 0x18
lea rcx, [rsp + 0x118]
call rsi
test eax, eax
je 0x140130c2a
mov esi, dword [rsp + 0x118]
call fcn.1400d8c40
test rax, rax
je 0x140130c2a
mov r8, qword [rax + 0x18]
test r8, r8
je 0x140130c2a
movsd xmm2, qword [0x140240e78]
mov edx, esi
lea rcx, [rsp + 0x118]
call r8
test r15, r15
je 0x140130c62
mov ecx, 0xbf
call r15
mov dword [rsp + 0x48], eax
call fcn.1400d8c40
test rax, rax
je 0x140130c62
mov rax, qword [rax + 0x18]
test rax, rax
je 0x140130c62
movsd xmm2, qword [0x140240e68]
mov edx, 4
lea rcx, [rsp + 0x48]
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r13, qword [rsp + 0x40]
test r13, r13
je 0x1401311c5
mov dword [rsp + 0x38], edi
lea rdx, [0x14028aa18]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.CloseToolhelp32Snapshot
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xb8], rax
lea rdx, str.Heap32First
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov qword [rsp + 0x98], rax
lea rdx, str.Heap32Next
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov qword [rsp + 0xb0], rax
lea rdx, str.Heap32ListFirst
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.Heap32ListNext
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
mov qword [rsp + 0x90], rax
lea rdx, str.Process32First
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov qword [rsp + 0x88], rax
lea rdx, str.Process32Next
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x68], rax
lea rdx, str.Thread32First
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x78], rax
lea rdx, str.Thread32Next
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x70], rax
lea rdx, [0x14028aad0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
lea rdx, [0x14028aaf0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xa8], rax
test rsi, rsi
je 0x1401311ba
test r15, r15
je 0x1401311ba
test r12, r12
je 0x1401311ba
test rbx, rbx
je 0x1401311ba
test r14, r14
je 0x1401311ba
test r13, r13
je 0x1401311ba
mov r15, qword [rsp + 0x68]
test r15, r15
je 0x1401311ba
cmp qword [rsp + 0x78], rdi
je 0x1401311ba
cmp qword [rsp + 0x70], rdi
je 0x1401311ba
cmp qword [rsp + 0x58], rdi
je 0x1401311ba
test rax, rax
je 0x1401311ba
xor edx, edx
lea ecx, [rdx + 0xf]
call rsi
mov r14, rax
mov qword [rsp + 0x80], rax
cmp rax, 0xffffffffffffffff
je 0x1401311ba
xor eax, eax
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rax
mov qword [rsp + 0xf8], 0x20
movsxd r13, dword [rsp + 0x30]
test r13d, r13d
je 0x140130e6b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov dword [rsp + 0x38], eax
mov rsi, r13
mov qword [rsp + 0xa0], r13
lea rdx, [rsp + 0xf8]
mov rcx, r14
call rbx
test eax, eax
je 0x140130ff5
mov r15d, 0x2a
mov dword [rsp + 0x60], r15d
movsd xmm6, qword [0x140240e88]
nop
mov ebx, dword [rsp + 0xf8]
call fcn.1400d8c40
test rax, rax
je 0x140130ed0
mov r8, qword [rax + 0x18]
test r8, r8
je 0x140130ed0
movsd xmm2, qword [0x140240e80]
mov edx, ebx
lea rcx, [rsp + 0xf8]
call r8
nop
xor eax, eax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xc0], 0x38
mov r8, qword [rsp + 0x108]
mov edx, dword [rsp + 0x100]
lea rcx, [rsp + 0xc0]
call qword [rsp + 0x98]
test eax, eax
je 0x140130f85
mov ebx, 0x50
mov dword [rsp + 0x64], ebx
movaps xmm2, xmm6
mov edx, dword [rsp + 0xc0]
lea rcx, [rsp + 0xc0]
call fcn.1400d8cb0
lea rcx, [rsp + 0xc0]
call r12
test eax, eax
je 0x140130f85
test rsi, rsi
je 0x140130f7b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jae 0x140130f85
dec ebx
mov dword [rsp + 0x64], ebx
test ebx, ebx
jg 0x140130f41
jmp 0x140130fbd
lea rdx, [rsp + 0xf8]
mov rcx, r14
call qword [rsp + 0x90]
test eax, eax
je 0x140130ff0
test r13d, r13d
je 0x140130fe7
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jae 0x140130ff0
test r15d, r15d
jg 0x140130ea0
mov r15, qword [rsp + 0x68]
mov dword [rsp + 0x210], 0x130
test r13d, r13d
je 0x14013100d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
lea rdx, [rsp + 0x210]
mov rcx, r14
call qword [rsp + 0x88]
movsd xmm6, qword [0x140240e98]
test eax, eax
je 0x140131080
nop dword [rax + rax]
mov ebx, dword [rsp + 0x210]
call fcn.1400d8c40
test rax, rax
je 0x14013105a
mov r8, qword [rax + 0x18]
test r8, r8
je 0x14013105a
movaps xmm2, xmm6
mov edx, ebx
lea rcx, [rsp + 0x210]
call r8
lea rdx, [rsp + 0x210]
mov rcx, r14
call r15
test eax, eax
je 0x140131080
test rsi, rsi
je 0x140131030
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jb 0x140131030
mov dword [rsp + 0x118], 0x1c
test r13d, r13d
je 0x140131098
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
lea rdx, [rsp + 0x118]
mov rcx, r14
call qword [rsp + 0x78]
test eax, eax
je 0x140131115
movsd xmm7, qword [0x140240e90]
mov r13, qword [rsp + 0x70]
nop dword [rax + rax]
mov ebx, dword [rsp + 0x118]
call fcn.1400d8c40
test rax, rax
je 0x1401310ea
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1401310ea
movaps xmm2, xmm7
mov edx, ebx
lea rcx, [rsp + 0x118]
call r8
lea rdx, [rsp + 0x118]
mov rcx, r14
call r13
test eax, eax
je 0x140131110
test rsi, rsi
je 0x1401310c0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jb 0x1401310c0
mov r13d, dword [rsp + 0x30]
mov dword [rsp + 0x340], 0x238
test r13d, r13d
je 0x14013112d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
lea rdx, [rsp + 0x340]
mov rcx, r14
call qword [rsp + 0x58]
test eax, eax
je 0x1401311a0
mov r15, qword [rsp + 0xa8]
nop dword [rax + rax]
mov ebx, dword [rsp + 0x340]
call fcn.1400d8c40
test rax, rax
je 0x14013117a
mov r8, qword [rax + 0x18]
test r8, r8
je 0x14013117a
movaps xmm2, xmm6
mov edx, ebx
lea rcx, [rsp + 0x340]
call r8
lea rdx, [rsp + 0x340]
mov rcx, r14
call r15
test eax, eax
je 0x1401311a0
test rsi, rsi
je 0x140131150
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jb 0x140131150
mov rax, qword [rsp + 0xb8]
mov rcx, r14
test rax, rax
je 0x1401311b4
call rax
jmp 0x1401311ba
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.140131280
lea rcx, [rsp + 0x138]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call fcn.1400d8c40
test rax, rax
je 0x140131203
mov r8, qword [rax + 0x18]
test r8, r8
je 0x140131203
movsd xmm2, qword [0x140240e68]
mov edx, 0x38
lea rcx, [rsp + 0x138]
call r8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x48], eax
call fcn.1400d8c40
test rax, rax
je 0x140131235
mov r8, qword [rax + 0x18]
test r8, r8
je 0x140131235
movsd xmm2, qword [0x140240e68]
mov edx, 4
lea rcx, [rsp + 0x48]
call r8
mov eax, 1
mov rcx, qword [rsp + 0x5c0]
xor rcx, rsp
call fcn.1401bddc0
lea r11, [rsp + 0x5f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
ret