__int64 sub_14007479E()
{
  __int64 result; // rax
  int v1; // ecx
  int i; // r8d
  BOOL v3; // [rsp+2Ch] [rbp-4Ch]
  struct _STRUCT Buffer; // [rsp+30h] [rbp-48h] BYREF

  Buffer.field0 = 64;
  v3 = GlobalMemoryStatusEx(&Buffer);
  result = 4105884444LL;
  v1 = 592532183;
  if ( !(Buffer.field1 >> 31) )
    v1 = -189082852;
  for ( i = -1487193492; ; i = v1 )
  {
    while ( 1 )
    {
      while ( i <= -118447998 )
      {
        if ( i == -1960191909 )
        {
          i = 929412080;
          result = 1;
        }
        else if ( i == -1487193492 )
        {
          i = 1526186595;
          if ( !v3 )
            i = -1960191909;
        }
        else
        {
          i = -118447997;
          result = 0;
        }
      }
      if ( i > 929412079 )
        break;
      if ( i == -118447997 )
      {
        i = 929412080;
      }
      else
      {
        i = -118447997;
        result = 1;
      }
    }
    if ( i == 929412080 )
      break;
  }
  return result;
}

### 1. Functionality Description
The provided code is a heavily obfuscated function designed to perform a basic system environment check. 

**Simplified Logic:**
The function calls the Windows API `GlobalMemoryStatusEx` to retrieve information about the system's physical and virtual memory. 
- If `GlobalMemoryStatusEx` **fails** (returns `FALSE`), the function eventually returns **1**.
- If `GlobalMemoryStatusEx` **succeeds** (returns `TRUE`), the function eventually returns **0**.

The primary purpose of this function is to detect whether the malware is running in an environment (such as a sandbox, emulator, or debugger) where standard Windows API calls are either not implemented correctly or are being hooked/interfered with.

---

### 2. Well-Known Algorithms
No standard cryptographic or data-processing algorithms are used. However, the code employs a well-known **obfuscation pattern** called **Control Flow Flattening**. 

Instead of using standard `if/else` or `while` blocks to dictate logic, the program uses a "dispatcher" (the `for` and `while` loops) and a state variable (`i`) to jump between blocks of code. This is a common feature of obfuscators like **OLLVM (Obfuscator-LLVM)**.

---

### 3. Indicators of Compromise (IOCs)
No traditional network or file-based IOCs were found in this snippet.
- **File Paths:** None
- **IP Addresses / Domains:** None
- **Registry Keys:** None
- **Commands/Scripts:** None
- **API Calls:** `GlobalMemoryStatusEx` (Used for environment fingerprinting).

---

### 4. MITRE ATT&CK Mapping

| Technique ID | Technique Name | Justification |
| :--- | :--- | :--- |
| **T1497** | Virtualization/Sandbox Evasion | The code calls `GlobalMemoryStatusEx` and checks the return value. Malware often does this because some sandboxes fail to emulate this API correctly or return inconsistent values, allowing the malware to detect the analysis environment and terminate or change behavior. |

---

### 5. Obfuscation and Evasion Techniques
The code utilizes several techniques to hinder reverse engineering:

*   **Control Flow Flattening:** The logic is broken into a state machine. The actual execution path is hidden behind a series of `while` loops and `if/else` checks using large, arbitrary integer constants (e.g., `-1487193492`, `929412080`) to determine the next block to execute.
*   **Opaque Predicates / Junk Logic:** The check `if ( !(Buffer.field1 >> 31) )` is largely meaningless. `Buffer.field1` (which corresponds to `dwMemoryLoad` in the `MEMORYSTATUSEX` struct) is a percentage (0-100). Shifting it right by 31 bits will always result in 0. This is used to create a fake conditional branch to confuse analysts.
*   **Dead Store/Constant Noise:** The variable `result` is initialized to `4105884444LL`, a value that is immediately overwritten, serving only to distract the analyst.

---

### 6. Observed Facts vs. Inferred Behavior

#### Observed Facts (Directly from code)
- The function calls `GlobalMemoryStatusEx` with a buffer size of 64 bytes.
- The function uses a state variable `i` to navigate a complex set of nested loops.
- The function returns either `0` or `1` based on the result of the API call and the subsequent state transitions.
- The code uses large signed integers to control the flow of execution.

#### Inferred Behavior (Reasoning)
- **Inference:** The function is an anti-analysis check. 
- **Reasoning:** The use of `GlobalMemoryStatusEx` combined with extreme control flow obfuscation is characteristic of malware attempting to hide its true intent from automated analysis tools.
- **Inference:** The code was likely generated by an automated obfuscator (like OLLVM).
- **Reasoning:** The specific pattern of a "dispatcher" loop using large constants to manage state is the signature of Control Flow Flattening.