Function at 0x1400040cc
Capabilities:
Enumerate processes
Get common file path
Get disk information
Get memory capacity
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
xor ebx, ebx
mov r15d, ebx
mov dword [rbp + 0x250], ebx
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp + 0xd0], 2
jb 0x1400043d6
mov dword [rbp + 0x70], 0x40
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp qword [rbp + 0x78], 0xffffffff80000000
jb 0x1400043d6
mov ecx, 0x2c0
mov dword [rbp + 0x258], ecx
call fcn.14000c464
mov rdi, rax
lea rdx, [rbp + 0x258]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140004172
mov rcx, rdi
call fcn.14000bfcc
mov ecx, dword [rbp + 0x258]
call fcn.14000c464
mov rdi, rax
lea rdx, [rbp + 0x258]
mov rcx, rdi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x140004221
mov r14, rdi
test rdi, rdi
je 0x140004221
lea rsi, [r14 + 0x110]
lea rdx, str.VMware
mov rcx, rsi
call fcn.140007e78
test rax, rax
jne 0x1400043ce
lea rdx, str.VirtualBox
mov rcx, rsi
call fcn.140007e78
test rax, rax
jne 0x1400043ce
lea rdx, str.Virtual
mov rcx, rsi
call fcn.140007e78
test rax, rax
jne 0x1400043ce
lea rdx, str.Parallels
mov rcx, rsi
call fcn.140007e78
test rax, rax
jne 0x1400043ce
lea rdx, str.Hyper_V
mov rcx, rsi
call fcn.140007e78
test rax, rax
jne 0x1400043ce
mov r14, qword [r14]
test r14, r14
jne 0x140004196
mov rcx, rdi
call fcn.14000bfcc
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
test eax, eax
je 0x1400043d6
lea rcx, [0x140021de8]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x1400043d6
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x14000426a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1400043d6
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x140004287
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1400043d6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x1388
jb 0x1400043d6
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x140022170]
movdqa xmmword [rbp], xmm1
movsd xmm0, qword [str.vmtoolsd.exe]
movsd qword [rbp - 0x10], xmm0
mov eax, dword [0x140021df8]
mov dword [rbp - 8], eax
mov byte [rbp - 4], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x140022190]
movdqa xmmword [rbp + 0x20], xmm1
movsd xmm0, qword [str.vboxservice.exe]
movsd qword [rbp + 0x10], xmm0
mov eax, dword [0x140021e08]
mov dword [rbp + 0x18], eax
movzx eax, word [0x140021e0c]
mov word [rbp + 0x1c], ax
mov al, byte [0x140021e0e]
mov byte [rbp + 0x1e], al
mov byte [rbp + 0x1f], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x140022180]
movdqa xmmword [rbp + 0x40], xmm1
movsd xmm0, qword [str.wireshark.exe]
movsd qword [rbp + 0x30], xmm0
mov eax, dword [0x140021e18]
mov dword [rbp + 0x38], eax
mov al, byte [0x140021e1c]
mov byte [rbp + 0x3c], al
mov byte [rbp + 0x3d], bl
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x50]
call fcn.140004838
nop
lea r9, [fcn.140004c50]
mov edx, 0x20
lea r8d, [rdx - 0x1d]
lea rcx, [rbp - 0x10]
call fcn.140005fe8
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140004716
mov dword [rbp + 0xe0], 0x130
lea rdx, [rbp + 0xe0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000470c
mov r13d, 0xf
mov rdi, qword [rbp + 0x50]
mov r12, qword [rbp + 0x58]
jmp 0x1400046eb
mov rcx, rdi
call fcn.14000bfcc
mov al, 1
mov rbx, qword [rsp + 0x360]
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov al, byte [0x14002a108]
mov byte [rbp + 0x250], al
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
lea rax, [rbp + 0x10c]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x140004419
lea rdx, [rbp + 0x10c]
lea rcx, [rbp - 0x30]
call fcn.14000504c
nop
mov rcx, qword [0x140028cb8]
test rcx, rcx
je 0x140004739
mov rax, qword [rcx]
lea r9, [rbp + 0x250]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x50]
call qword [rax + 0x10]
or r15d, 4
mov rcx, qword [0x140028b38]
test rcx, rcx
je 0x140004733
mov rax, qword [rcx]
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x50]
call qword [rax + 0x10]
nop
mov sil, byte [0x14002a108]
mov rdx, rdi
cmp qword [rdi + 0x18], r13
jbe 0x14000448f
mov rdx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], bl
jne 0x1400044a5
lea rcx, [rsp + 0x30]
call fcn.14000504c
nop
mov byte [rbp + 0x250], sil
mov rcx, qword [0x140028cb8]
test rcx, rcx
je 0x140004769
mov rax, qword [rcx]
lea r9, [rbp + 0x250]
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x70]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140028b38]
test rcx, rcx
je 0x140004763
mov rax, qword [rcx]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x70]
call qword [rax + 0x10]
or r15d, 0xb
lea r9, [rsp + 0x70]
mov rsi, qword [rsp + 0x70]
mov r13, qword [rbp - 0x78]
cmp r13, 0xf
cmova r9, rsi
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x60]
call fcn.140004fa8
mov qword [rbp + 0x250], rax
cmp r13, 0xf
jbe 0x140004582
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000457a
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000473f
mov rcx, rsi
call fcn.1400062f8
mov qword [rbp - 0x80], rbx
mov r13d, 0xf
mov qword [rbp - 0x78], r13
mov byte [rsp + 0x70], bl
mov rdx, qword [rbp - 0x58]
mov esi, 0x1000
cmp rdx, r13
jbe 0x1400045cf
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, rsi
jb 0x1400045ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004745
call fcn.1400062f8
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], r13
mov byte [rbp - 0x70], bl
mov rdx, qword [rsp + 0x48]
cmp rdx, r13
jbe 0x140004612
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, rsi
jb 0x14000460d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000474b
call fcn.1400062f8
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x30], bl
mov rdx, qword [rsp + 0x68]
cmp rdx, r13
jbe 0x140004658
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, rsi
jb 0x140004653
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004751
call fcn.1400062f8
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], r13
mov byte [rsp + 0x50], bl
mov rdx, qword [rbp - 0x38]
cmp rdx, r13
jbe 0x14000469c
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, rsi
jb 0x140004697
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004757
call fcn.1400062f8
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], r13
mov byte [rbp - 0x50], bl
mov rdx, qword [rbp - 0x18]
cmp rdx, r13
jbe 0x1400046dd
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, rsi
jb 0x1400046d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000475d
call fcn.1400062f8
cmp qword [rbp + 0x250], 0xffffffffffffffff
jne 0x140004726
add rdi, 0x20
cmp rdi, r12
jne 0x1400043f3
lea rdx, [rbp + 0xe0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400043c1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x50]
call fcn.140004dcc
mov al, bl
jmp 0x1400043d8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x140004716
call fcn.140005ea8
nop
call fcn.140005ea8
nop
call fcn.14000c3ec
nop
call fcn.14000c3ec
nop
call fcn.14000c3ec
nop
call fcn.14000c3ec
nop
call fcn.14000c3ec
nop
call fcn.14000c3ec
nop
call fcn.140005ea8
nop
call fcn.140005ea8
int3
jmp 0x1400040cc