Function at 0x14001100f
Capabilities:
Get memory capacity
Get system information on windows
Terminate process

Disassembly:
jmp 0x140013b30
push rbp
push rdi
sub rsp, 0x2e8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x7a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140026040]
xor rax, rbp
mov qword [rbp + 0x298], rax
lea rcx, [0x14002c0e0]
call fcn.14001154b
nop
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
mov eax, dword [rbp + 0x28]
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 2
jae 0x140013b91
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov dword [rbp + 0x80], 0x40
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
nop
xor edx, edx
mov rax, qword [rbp + 0x88]
mov ecx, 0x400
div rcx
xor edx, edx
mov ecx, 0x400
div rcx
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 0x800
jae 0x140013be2
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
xor edx, edx
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0xf8], rax
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x144]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x18
lea rax, [rbp + 0x118]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop
mov eax, dword [rbp + 0x124]
mov rcx, qword [rbp + 0x118]
imul rcx, rax
mov rax, rcx
mov ecx, dword [rbp + 0x128]
imul rax, rcx
mov ecx, dword [rbp + 0x12c]
imul rax, rcx
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
mov dword [rbp + 0x164], eax
cmp dword [rbp + 0x164], 0x64
jae 0x140013ccf
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov dword [rbp + 0x184], 0
lea rcx, str.C:windowsSystem32_vboxoglpackspu.dll
call fcn.140011488
movzx eax, al
test eax, eax
je 0x140013cfd
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
jmp 0x140013ec3
lea rcx, str.C:windowsSystem32DriversVBoxSF.sys
call fcn.140011488
movzx eax, al
test eax, eax
je 0x140013d21
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
jmp 0x140013ec3
lea rcx, str.C:windowsSystem32DriversVBoxVideo.sys
call fcn.140011488
movzx eax, al
test eax, eax
je 0x140013d45
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
jmp 0x140013ec3
lea rcx, str.C:windowsSystem32_vboxoglpassthroughspu.dll
call fcn.140011488
movzx eax, al
test eax, eax
je 0x140013d69
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
jmp 0x140013ec3
lea rcx, str.C:windowsSystem32_vboxdisp.dll
call fcn.140011488
movzx eax, al
test eax, eax
je 0x140013d8d
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
jmp 0x140013ec3
lea rcx, str.C:windowsSystem32_vboxhook.dll
call fcn.140011488
movzx eax, al
test eax, eax
je 0x140013db1
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
jmp 0x140013ec3
lea rcx, str.C:windowsSystem32_vboxmrxnp.dll
call fcn.140011488
movzx eax, al
test eax, eax
je 0x140013dd5
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
jmp 0x140013ec3
lea rcx, str.C:windowsSystem32_vboxogl.dll
call fcn.140011488
movzx eax, al
test eax, eax
je 0x140013df9
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
jmp 0x140013ec3
lea rcx, str.C:windowsSystem32_vboxoglcrutil.dll
call fcn.140011488
movzx eax, al
test eax, eax
je 0x140013e1d
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
jmp 0x140013ec3
lea rcx, str.C:windowsSystem32DriversVBoxGuest.sys
call fcn.140011488
movzx eax, al
test eax, eax
je 0x140013e41
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
jmp 0x140013ec3
lea rcx, str.C:windowsSystem32_vboxoglerrorspu.dll
call fcn.140011488
movzx eax, al
test eax, eax
je 0x140013e62
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
jmp 0x140013ec3
lea rcx, str.C:windowsSystem32_vboxoglfeedbackspu.dll
call fcn.140011488
movzx eax, al
test eax, eax
je 0x140013e83
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
jmp 0x140013ec3
lea rcx, str.C:windowsSystem32DriversVBoxMouse.sys
call fcn.140011488
movzx eax, al
test eax, eax
je 0x140013ea4
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
jmp 0x140013ec3
lea rcx, str.C:windowsSystem32_vboxoglarrayspu.dll
call fcn.140011488
movzx eax, al
test eax, eax
je 0x140013ec3
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rax, str.vmtoolsd.exe
mov qword [rbp + 0x1a8], rax
lea rax, str.vmwaretray.exe
mov qword [rbp + 0x1b0], rax
lea rax, str.vmwareuser.exe
mov qword [rbp + 0x1b8], rax
lea rax, str.VGAuthService.exe
mov qword [rbp + 0x1c0], rax
lea rax, str.vmacthlp.exe
mov qword [rbp + 0x1c8], rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140022140]
call fcn.140011479
mov rcx, qword [rbp + 0x298]
xor rcx, rbp
call fcn.140011294
lea rsp, [rbp + 0x2a8]
pop rdi
pop rbp
ret