Function at 0x140070ac3
Capabilities:
Enumerate files on windows
Enumerate process modules
Enumerate processes
Get common file path
Get disk size
Get hostname
Get local ipv4 addresses
Get memory capacity
Get session user name
Get system information on windows

Disassembly:
jmp 0x140077550
push rbp
push rdi
mov eax, 0x2818
call fcn.1400708c5
sub rsp, rax
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x86e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1401901d8]
xor rax, rbp
mov qword [rbp + 0x27a0], rax
lea rcx, [0x1401a20d8]
call fcn.1400730e3
mov dword [rbp + 4], 0
lea rax, [rbp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rbp + 0x30], 0x238
xor edx, edx
mov ecx, 2
call fcn.140071739
mov qword [rbp + 0x288], rax
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x288]
call fcn.140071d5b
test eax, eax
je 0x140077648
lea r8, [rbp + 0x5c]
mov edx, 0x104
lea rcx, [rbp + 0x2b0]
call fcn.140072819
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.USER32.dll_CharUpperW]
lea rdx, str.VMTOOLSD.EXE
lea rcx, [rbp + 0x2b0]
call fcn.140070703
test rax, rax
jne 0x14007762a
lea rdx, str.VM3DSERVICE.EXE
lea rcx, [rbp + 0x2b0]
call fcn.140070703
test rax, rax
je 0x140077634
mov eax, 1
jmp 0x140077b1a
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x288]
call fcn.1400729c7
test eax, eax
jne 0x1400775d8
lea rcx, [rbp + 0x4d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp + 0x4f8]
mov dword [rbp + 0x524], eax
cmp dword [rbp + 0x524], 2
jae 0x140077674
mov eax, 1
jmp 0x140077b1a
mov dword [rbp + 0x550], 0x40
lea rcx, [rbp + 0x550]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor edx, edx
mov rax, qword [rbp + 0x558]
mov ecx, 0x400
div rcx
xor edx, edx
mov ecx, 0x400
div rcx
mov qword [rbp + 0x5a8], rax
cmp qword [rbp + 0x5a8], 0x800
jae 0x1400776c4
mov eax, 1
jmp 0x140077b1a
lea r9, [rbp + 0x608]
lea r8, [rbp + 0x5c8]
lea rdx, [rbp + 0x5e8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x140077711
xor edx, edx
mov rax, qword [rbp + 0x5c8]
mov ecx, 0x40000000
div rcx
mov qword [rbp + 0x628], rax
cmp qword [rbp + 0x628], 0x64
jge 0x140077711
mov eax, 1
jmp 0x140077b1a
mov dword [rbp + 0x644], 0
lea rax, [rbp + 0x644]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov eax, dword [rbp + 0x644]
mov qword [rbp + 0x2798], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rbp + 0x2798]
mov r8, rcx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x668], rax
cmp qword [rbp + 0x668], 0
je 0x14007781c
lea rax, [rbp + 0x644]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x668]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
lea rax, [rbp + 0x684]
mov rdi, rax
xor eax, eax
mov ecx, 6
rep stosb byte [rdi], al
cmp qword [rbp + 0x668], 0
je 0x14007781c
mov rax, qword [rbp + 0x668]
cmp dword [rax + 0x58], 6
jne 0x140077808
mov rax, qword [rbp + 0x668]
add rax, 0x50
mov r8d, 6
mov rdx, rax
lea rcx, [rbp + 0x684]
call fcn.1400717ac
mov r8d, 3
lea rdx, [rbp + 0x684]
lea rcx, str.x08x00x27
call fcn.140071298
test eax, eax
jne 0x140077808
mov eax, 1
jmp 0x140077b1a
mov rax, qword [rbp + 0x668]
mov rax, qword [rax + 8]
mov qword [rbp + 0x668], rax
jmp 0x1400777aa
lea rdx, [rbp + 0x6b0]
lea rcx, str.C:WindowsSystem32VBox.dll
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x140077840
mov eax, 1
jmp 0x140077b1a
lea rax, [rbp + 0x918]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SYSTEMControlSet001ServicesVBoxSF
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140077877
mov eax, 1
jmp 0x140077b1a
lea rdx, [rbp + 0x934]
lea rcx, [rbp + 0x958]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0x958]
call qword [sym.imp.USER32.dll_CharUpperW]
lea rdx, str.DESKTOP_
lea rcx, [rbp + 0x958]
call fcn.140070703
test rax, rax
je 0x1400778ba
mov eax, 1
jmp 0x140077b1a
lea rdx, [rbp + 0x994]
lea rcx, [rbp + 0x9c0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rcx, [rbp + 0x9c0]
call qword [sym.imp.USER32.dll_CharUpperW]
lea rdx, str.ADMIN
lea rcx, [rbp + 0x9c0]
call fcn.140070703
test rax, rax
je 0x1400778fd
mov eax, 1
jmp 0x140077b1a
lea rax, [rbp + 0xbe8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMControlSet001EnumUSBSTOR
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rbp + 0xc04]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xbe8]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [rbp + 0xc04], 1
jae 0x140077999
mov eax, 1
jmp 0x140077b1a
mov qword [rbp + 0xc28], 0
lea r9, [rbp + 0xc28]
xor r8d, r8d
xor edx, edx
lea rcx, [0x14015e100]
call fcn.14007148c
movzx eax, word [0x14015ba54]
mov word [rbp + 0xc50], ax
lea rax, [rbp + 0xc52]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov r8, qword [rbp + 0xc28]
mov edx, 0x104
lea rcx, [rbp + 0xc50]
call fcn.1400717d4
lea r8, [0x14015bbd4]
mov edx, 0x104
lea rcx, [rbp + 0xc50]
call fcn.1400717d4
mov dword [rbp + 0xe74], 0
lea rdx, [rbp + 0xea0]
lea rcx, [rbp + 0xc50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x1108], rax
cmp qword [rbp + 0x1108], 0xffffffffffffffff
je 0x140077a62
mov eax, dword [rbp + 0xe74]
inc eax
mov dword [rbp + 0xe74], eax
lea rdx, [rbp + 0x6b0]
mov rcx, qword [rbp + 0x1108]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140077a3c
cmp dword [rbp + 0xe74], 2
jl 0x140077a7a
mov eax, dword [rbp + 0xe74]
sub eax, 2
mov dword [rbp + 0xe74], eax
cmp dword [rbp + 0xe74], 0x14
jge 0x140077a8b
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
lea r8, [rbp + 0x2144]
mov edx, 0x1000
lea rcx, [rbp + 0x1130]
call fcn.140071473
mov eax, dword [rbp + 0x2144]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rbp + 0x2164], eax
cmp dword [rbp + 0x2164], 0x28
jae 0x140077ac9
mov eax, 1
jmp 0x140077b1a
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
xor edx, edx
mov ecx, 0x3e8
div rcx
mov qword [rbp + 0x2188], rax
cmp qword [rbp + 0x2188], 0xb4
jae 0x140077af6
mov eax, 1
jmp 0x140077b1a
cmp qword [rbp + 0x2188], 0x384
jae 0x140077b0b
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 2
jl 0x140077b18
mov eax, 1
jmp 0x140077b1a
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x14015b6a0]
call fcn.14007284b
mov rax, rdi
mov rcx, qword [rbp + 0x27a0]
xor rcx, rbp
call fcn.1400717a7
lea rsp, [rbp + 0x27b8]
pop rdi
pop rbp
ret