Function at 0x140001640
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get number of processors

Disassembly:
push rbx
push r15
sub rsp, 0xa8
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rax, str.VMWARE
xor r15d, r15d
mov qword [rsp + 0x48], rax
mov edx, 0x1000
lea rax, str.VMware_Virtual_Battery
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x50], rax
xor ecx, ecx
lea rax, str.VBOX
mov r8d, edx
lea r9d, [r15 + 0x40]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x38], rax
mov rbx, rax
test rax, rax
jne 0x1400016bd
lea rcx, str.Bad_init_shell__n
call fcn.140001030
xor al, al
jmp 0x140001b04
lea rax, [rsp + 0x70]
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xd0], rdi
cmp rbx, rax
jbe 0x140001700
lea rax, [rsp + 0x7b]
cmp rbx, rax
jae 0x140001700
mov dword [rbx + 7], 0xc3050fd1
mov dword [rbx + 3], 0x8b4c0000
mov word [rbx + 1], r15w
mov byte [rbx], 0xb8
jmp 0x140001717
mov dword [rbx], 0xb8
mov dword [rbx + 4], 0xd18b4c00
mov word [rbx + 8], 0x50f
mov byte [rbx + 0xa], 0xc3
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x140001753
cmp al, 5
je 0x14000174c
cmp al, 6
jne 0x140001748
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14000174c
sub ecx, 1
je 0x140001741
cmp ecx, 1
jne 0x140001753
mov ecx, 0x35
jmp 0x140001758
xor ecx, ecx
jmp 0x140001758
mov ecx, 0x34
jmp 0x140001758
mov ecx, 0x36
lea rdx, [rbx + 1]
mov dword [rsp + 0x20], ecx
lea rax, [rsp + 0x68]
cmp rdx, rax
jbe 0x140001790
lea rax, [rsp + 0x6c]
cmp rdx, rax
jae 0x140001790
movzx eax, byte [rsp + 0x23]
mov byte [rdx + 3], al
movzx eax, byte [rsp + 0x22]
mov byte [rdx + 2], al
movzx eax, byte [rsp + 0x21]
mov byte [rdx + 1], al
jmp 0x1400017a8
movzx eax, byte [rsp + 0x21]
mov byte [rdx + 1], al
movzx eax, byte [rsp + 0x22]
mov byte [rdx + 2], al
movzx eax, byte [rsp + 0x23]
mov byte [rdx + 3], al
mov byte [rdx], cl
xor edx, edx
mov rax, qword gs:[0x30]
lea r8d, [rdx + 0x28]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, 0x28
lea r9, [rsp + 0x60]
mov rdx, rax
mov rdi, rax
mov dword [rax], 0x41435049
lea ecx, [r8 + 0x24]
mov qword [rax + 8], r15
mov dword [rax + 4], 1
call rbx
mov rcx, qword gs:[0x30]
mov r8, rdi
xor edx, edx
mov rsi, rax
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [rsp + 0x60]
xor edx, edx
lea r8d, [rcx + rcx]
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x40], rax
mov rdi, rax
test rax, rax
je 0x140001add
cmp esi, 0xc0000023
jne 0x140001ac1
mov dword [rax], 0x41435049
lea r9, [rsp + 0x60]
mov dword [rax + 8], r15d
mov rdx, rax
mov ecx, dword [rsp + 0x60]
mov qword [rsp + 0xc0], rbp
mov dword [rax + 0xc], ecx
mov ecx, 0x4c
mov dword [rax + 4], 1
mov r8d, dword [rsp + 0x60]
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0x98], r13
mov qword [rsp + 0x90], r14
call rbx
mov r13d, dword [rdi + 0xc]
lea r12, [rsp + 0x50]
mov qword [rsp + 0x30], r13
lea rbx, [rdi + 0x10]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x24], r15d
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r12 - 8]
xor ecx, ecx
mov r9, rax
test rax, rax
je 0x1400018de
cmp byte [rax], cl
je 0x1400018de
inc ecx
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x1400018d3
sub r9, rbx
movsxd r14, ecx
xor ebp, ebp
mov rsi, rbx
mov rdi, r14
test ecx, ecx
je 0x140001938
mov r8, rsi
nop dword [rax]
nop word [rax + rax]
movzx r10d, byte [r8]
movzx r11d, byte [r9 + r8]
lea eax, [r10 - 0x61]
cmp eax, 0x19
lea edx, [r10 - 0x20]
lea eax, [r11 - 0x61]
cmova edx, r10d
lea ecx, [r11 - 0x20]
cmp eax, 0x19
cmova ecx, r11d
cmp edx, ecx
jne 0x140001b1f
inc r8
sub rdi, 1
jne 0x140001900
mov al, 1
test al, al
lea r12, [r15 + 1]
mov rax, qword [rsp + 0x28]
cmove r12, r15
xor ecx, ecx
mov rax, qword [rax]
mov r9, rax
test rax, rax
je 0x14000196b
cmp byte [rax], cl
je 0x14000196b
nop word [rax + rax]
inc ecx
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x140001960
sub r9, rbx
movsxd r14, ecx
xor ebp, ebp
mov rsi, rbx
mov rdi, r14
test ecx, ecx
je 0x1400019c8
nop dword [rax]
mov r8, rsi
nop dword [rax]
nop word [rax + rax]
movzx r10d, byte [r8]
movzx r11d, byte [r9 + r8]
lea eax, [r10 - 0x61]
cmp eax, 0x19
lea edx, [r10 - 0x20]
lea eax, [r11 - 0x61]
cmova edx, r10d
lea ecx, [r11 - 0x20]
cmp eax, 0x19
cmova ecx, r11d
cmp edx, ecx
jne 0x140001b45
inc r8
sub rdi, 1
jne 0x140001990
mov al, 1
test al, al
lea r13, [r12 + 1]
cmove r13, r12
mov r12, qword [rsp + 0x28]
xor ecx, ecx
mov rax, qword [r12 + 8]
mov r9, rax
test rax, rax
je 0x1400019fb
cmp byte [rax], cl
je 0x1400019fb
nop dword [rax]
inc ecx
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x1400019f0
sub r9, rbx
movsxd r14, ecx
xor ebp, ebp
mov rsi, rbx
mov rdi, r14
test ecx, ecx
je 0x140001a69
mov r15, qword [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
mov rax, rsi
nop dword [rax]
nop word [rax + rax]
movzx r10d, byte [rax]
movzx r11d, byte [r9 + rax]
lea ecx, [r10 - 0x61]
cmp ecx, 0x19
lea r8d, [r10 - 0x20]
lea ecx, [r11 - 0x61]
cmova r8d, r10d
lea edx, [r11 - 0x20]
cmp ecx, 0x19
cmova edx, r11d
cmp r8d, edx
jne 0x140001b6b
inc rax
sub rdi, 1
jne 0x140001a30
mov al, 1
mov edx, dword [rsp + 0x24]
lea r15, [r13 + 1]
test al, al
cmove r15, r13
mov r13, qword [rsp + 0x30]
add edx, 3
add r12, 0x18
mov dword [rsp + 0x24], edx
mov qword [rsp + 0x28], r12
cmp edx, 3
jb 0x1400018c0
mov r14, qword [rsp + 0x90]
mov r13, qword [rsp + 0x98]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rax, qword gs:[0x30]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdi, qword [rsp + 0xd0]
test r15, r15
mov rsi, qword [rsp + 0xc8]
setne al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140002330
add rsp, 0xa8
pop r15
pop rbx
ret
cmp r10d, r11d
je 0x140001938
inc rbp
inc rsi
dec r9
cmp rbp, r13
ja 0x140001b3e
mov rdi, r14
jmp 0x1400018f0
xor al, al
jmp 0x14000193a
cmp r10d, r11d
je 0x1400019c8
inc rbp
inc rsi
dec r9
cmp rbp, r13
ja 0x140001b64
mov rdi, r14
jmp 0x140001980
xor al, al
jmp 0x1400019ca
cmp r10d, r11d
je 0x140001a69
inc rbp
inc rsi
dec r9
cmp rbp, r15
ja 0x140001b8a
mov rdi, r14
jmp 0x140001a20
xor al, al
jmp 0x140001a6b