Function at 0x140001150
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get number of processors

Disassembly:
mov r11, rsp
push rbx
push r15
sub rsp, 0xd8
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea rax, str.VMware
xor r15d, r15d
mov qword [rsp + 0x40], rax
mov edx, 0x1000
lea rax, str.VMW_
mov dword [r11 - 0x58], r15d
mov qword [rsp + 0x48], rax
xor ecx, ecx
lea rax, str.RAM_socket_
mov r8d, edx
mov qword [rsp + 0x50], rax
lea r9d, [r15 + 0x40]
lea rax, str.RAM_slot_
mov qword [rsp + 0x58], rax
lea rax, str.Welcome_to_the
mov qword [rsp + 0x60], rax
lea rax, str.Machine
mov qword [r11 - 0x80], rax
lea rax, str.VirtualBox
mov qword [r11 - 0x78], rax
lea rax, str.Oracle
mov qword [r11 - 0x70], rax
lea rax, str.vboxVer
mov qword [r11 - 0x68], rax
lea rax, str.vboxRev
mov qword [r11 - 0x60], rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x30], rax
mov rbx, rax
test rax, rax
jne 0x14000121d
lea rcx, str.Bad_init_shell__n
call fcn.140001030
xor al, al
jmp 0x1400015d0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0x100], rdi
cmp rbx, rax
jbe 0x140001260
lea rax, [rsp + 0xab]
cmp rbx, rax
jae 0x140001260
mov dword [rbx + 7], 0xc3050fd1
mov dword [rbx + 3], 0x8b4c0000
mov word [rbx + 1], r15w
mov byte [rbx], 0xb8
jmp 0x140001277
mov dword [rbx], 0xb8
mov dword [rbx + 4], 0xd18b4c00
mov word [rbx + 8], 0x50f
mov byte [rbx + 0xa], 0xc3
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x1400012b3
cmp al, 5
je 0x1400012ac
cmp al, 6
jne 0x1400012a8
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x1400012ac
sub ecx, 1
je 0x1400012a1
cmp ecx, 1
jne 0x1400012b3
mov ecx, 0x35
jmp 0x1400012b8
xor ecx, ecx
jmp 0x1400012b8
mov ecx, 0x34
jmp 0x1400012b8
mov ecx, 0x36
lea rdx, [rbx + 1]
mov dword [rsp + 0x20], ecx
lea rax, [rsp + 0x98]
cmp rdx, rax
jbe 0x140001300
lea rax, [rsp + 0x9c]
cmp rdx, rax
jae 0x140001300
movzx eax, byte [rsp + 0x23]
mov byte [rdx + 3], al
movzx eax, byte [rsp + 0x22]
mov byte [rdx + 2], al
movzx eax, byte [rsp + 0x21]
mov byte [rdx + 1], al
jmp 0x140001318
movzx eax, byte [rsp + 0x21]
mov byte [rdx + 1], al
movzx eax, byte [rsp + 0x22]
mov byte [rdx + 2], al
movzx eax, byte [rsp + 0x23]
mov byte [rdx + 3], al
mov byte [rdx], cl
xor edx, edx
mov rax, qword gs:[0x30]
lea r8d, [rdx + 0x28]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, 0x28
lea r9, [rsp + 0x90]
mov rdx, rax
mov rdi, rax
mov dword [rax], 0x52534d42
lea ecx, [r8 + 0x24]
mov qword [rax + 8], r15
mov dword [rax + 4], 1
call rbx
mov rcx, qword gs:[0x30]
mov r8, rdi
xor edx, edx
mov rsi, rax
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [rsp + 0x90]
xor edx, edx
lea r8d, [rcx + rcx]
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x38], rax
mov rdi, rax
test rax, rax
je 0x1400015a8
cmp esi, 0xc0000023
jne 0x14000158c
mov dword [rax], 0x52534d42
lea r9, [rsp + 0x90]
mov dword [rax + 8], r15d
mov rdx, rax
mov ecx, dword [rsp + 0x90]
mov qword [rsp + 0xf0], rbp
mov dword [rax + 0xc], ecx
mov ecx, 0x4c
mov dword [rax + 4], 1
mov r8d, dword [rsp + 0x90]
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xc8], r13
mov qword [rsp + 0xc0], r14
call rbx
mov r12d, dword [rdi + 0xc]
lea rdx, [rdi + 0x10]
mov qword [rsp + 0x28], rdx
lea rbx, [rsp + 0x48]
mov dword [rsp + 0x20], r15d
nop
mov rax, qword [rbx - 8]
xor ecx, ecx
mov r9, rax
test rax, rax
je 0x14000144d
cmp byte [rax], cl
je 0x14000144d
inc ecx
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x140001442
sub r9, rdx
movsxd r14, ecx
xor ebp, ebp
mov rsi, rdx
mov rdi, r14
test ecx, ecx
je 0x1400014a8
nop
mov r8, rsi
nop dword [rax]
nop word [rax + rax]
movzx r11d, byte [r9 + r8]
movzx r10d, byte [r8]
lea eax, [r11 - 0x61]
cmp eax, 0x19
lea edx, [r11 - 0x20]
lea eax, [r10 - 0x61]
cmova edx, r11d
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp ecx, edx
jne 0x1400015eb
inc r8
sub rdi, 1
jne 0x140001470
mov al, 1
test al, al
lea r13, [r15 + 1]
mov rax, qword [rbx]
cmove r13, r15
mov r9, rax
xor ecx, ecx
test rax, rax
je 0x1400014d0
cmp byte [rax], cl
je 0x1400014d0
inc ecx
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x1400014c5
mov rsi, qword [rsp + 0x28]
xor ebp, ebp
sub r9, rsi
movsxd r14, ecx
mov rdi, r14
test ecx, ecx
je 0x140001539
nop dword [rax]
nop dword [rax + rax]
mov rax, rsi
nop dword [rax]
nop word [rax + rax]
movzx r11d, byte [r9 + rax]
movzx r10d, byte [rax]
lea ecx, [r11 - 0x61]
cmp ecx, 0x19
lea r8d, [r11 - 0x20]
lea ecx, [r10 - 0x61]
cmova r8d, r11d
lea edx, [r10 - 0x20]
cmp ecx, 0x19
cmova edx, r10d
cmp edx, r8d
jne 0x140001611
inc rax
sub rdi, 1
jne 0x140001500
mov al, 1
mov edx, dword [rsp + 0x20]
lea r15, [r13 + 1]
test al, al
cmove r15, r13
add edx, 2
add rbx, 0x10
mov dword [rsp + 0x20], edx
cmp edx, 0xa
mov rdx, qword [rsp + 0x28]
jb 0x140001430
mov r14, qword [rsp + 0xc0]
mov r13, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xd0]
mov rbp, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rax, qword gs:[0x30]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdi, qword [rsp + 0x100]
cmp r15, 2
mov rsi, qword [rsp + 0xf8]
setae al
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140002330
add rsp, 0xd8
pop r15
pop rbx
ret
cmp r10d, r11d
je 0x1400014a8
inc rbp
inc rsi
dec r9
cmp rbp, r12
ja 0x14000160a
mov rdi, r14
jmp 0x140001460
xor al, al
jmp 0x1400014aa
cmp r10d, r11d
je 0x140001539
inc rbp
inc rsi
dec r9
cmp rbp, r12
ja 0x140001630
mov rdi, r14
jmp 0x1400014f0
xor al, al
jmp 0x14000153b