Function at 0x140006688
Capabilities:
Enumerate processes
Get common file path
Get disk information
Get memory capacity
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
xor r14d, r14d
mov r15d, r14d
mov dword [rbp + 0x250], r14d
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp + 0xd0], 2
jb 0x1400058ab
mov dword [rbp + 0x70], 0x40
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp qword [rbp + 0x78], 0xffffffff80000000
jb 0x1400058ab
mov ecx, 0x2c0
mov dword [rbp + 0x258], ecx
call fcn.14000d53c
mov rbx, rax
lea rdx, [rbp + 0x258]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140005410
mov rcx, rbx
call fcn.14000d0a4
mov ecx, dword [rbp + 0x258]
call fcn.14000d53c
mov rbx, rax
lea rdx, [rbp + 0x258]
mov rcx, rbx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x14000549b
mov rdi, rbx
test rbx, rbx
je 0x14000549b
lea rsi, [rdi + 0x110]
lea rdx, str.VMware
mov rcx, rsi
call fcn.140008f58
test rax, rax
jne 0x1400058a3
lea rdx, str.VirtualBox
mov rcx, rsi
call fcn.140008f58
test rax, rax
jne 0x1400058a3
lea rdx, str.Ethernet
mov rcx, rsi
call fcn.140008f58
test rax, rax
jne 0x1400058a3
lea rdx, str.Hyper_V
mov rcx, rsi
call fcn.140008f58
test rax, rax
jne 0x1400058a3
mov rdi, qword [rdi]
test rdi, rdi
jne 0x14000542c
mov rcx, rbx
call fcn.14000d0a4
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
test eax, eax
je 0x1400058ab
lea rcx, [0x140022dfc]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x1400058ab
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x1400054e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1400058ab
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x140005501
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1400058ab
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x14000551e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1400058ab
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x1388
jb 0x1400058ab
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x1400231b0]
movdqa xmmword [rbp], xmm1
movsd xmm0, qword [str.vmtoolsd.exe]
movsd qword [rbp - 0x10], xmm0
mov eax, dword [0x140022e08]
mov dword [rbp - 8], eax
mov byte [rbp - 4], r14b
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1400231d0]
movdqa xmmword [rbp + 0x20], xmm1
movsd xmm0, qword [str.vboxservice.exe]
movsd qword [rbp + 0x10], xmm0
mov eax, dword [0x140022e18]
mov dword [rbp + 0x18], eax
movzx eax, word [0x140022e1c]
mov word [rbp + 0x1c], ax
mov al, byte [0x140022e1e]
mov byte [rbp + 0x1e], al
mov byte [rbp + 0x1f], r14b
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400231c0]
movdqa xmmword [rbp + 0x40], xmm1
movsd xmm0, qword [str.wireshark.exe]
movsd qword [rbp + 0x30], xmm0
mov eax, dword [0x140022e28]
mov dword [rbp + 0x38], eax
mov al, byte [0x140022e2c]
mov byte [rbp + 0x3c], al
mov byte [rbp + 0x3d], r14b
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x50]
call fcn.140005afc
nop
lea r9, [fcn.140005e84]
mov edx, 0x20
lea r8d, [rdx - 0x1d]
lea rcx, [rbp - 0x10]
call fcn.1400070c8
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400059da
mov dword [rbp + 0xe0], 0x130
lea rdx, [rbp + 0xe0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400059d1
mov ebx, 1
lea r13d, [rbx + 0xe]
mov rdi, qword [rbp + 0x50]
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0x260], rax
cmp rdi, rax
je 0x1400059b9
mov rdx, rdi
cmp qword [rdi + 0x18], r13
jbe 0x140005682
mov rdx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r14
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x140005695
lea rcx, [rbp - 0x30]
call fcn.140006170
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
lea rax, [rbp + 0x10c]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r14b
jne 0x1400056c5
lea rdx, [rbp + 0x10c]
lea rcx, [rsp + 0x50]
call fcn.140006170
nop
mov al, byte [0x140029c20]
mov byte [rbp + 0x250], al
mov rcx, qword [0x140029c68]
test rcx, rcx
je 0x1400059fe
mov rax, qword [rcx]
lea r9, [rbp + 0x250]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x50]
call qword [rax + 0x10]
or r15d, ebx
mov rcx, qword [0x140029b18]
test rcx, rcx
je 0x1400059f8
mov rax, qword [rcx]
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x30]
call qword [rax + 0x10]
nop
mov al, byte [0x140029c20]
mov byte [rbp + 0x250], al
mov rcx, qword [0x140029c68]
test rcx, rcx
je 0x140005a2e
mov rax, qword [rcx]
lea r9, [rbp + 0x250]
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x70]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140029b18]
test rcx, rcx
je 0x140005a28
mov rax, qword [rcx]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x70]
call qword [rax + 0x10]
or r15d, 0xe
lea r9, [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
cmp rsi, r13
cmova r9, qword [rsp + 0x30]
lea rcx, [rsp + 0x70]
mov r14, qword [rsp + 0x70]
mov r13, qword [rbp - 0x78]
cmp r13, 0xf
cmova rcx, r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rdx, qword [rbp - 0x80]
call fcn.1400060cc
mov qword [rbp + 0x250], rax
cmp r13, 0xf
jbe 0x140005809
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400057fc
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a04
mov rcx, r14
call fcn.1400073d8
mov rsi, qword [rsp + 0x48]
xor r14d, r14d
mov qword [rbp - 0x80], r14
lea r13d, [r14 + 0xf]
mov qword [rbp - 0x78], r13
mov byte [rsp + 0x70], r14b
mov rdx, qword [rbp - 0x58]
cmp rdx, r13
jbe 0x14000585c
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005852
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a0a
call fcn.1400073d8
mov rsi, qword [rsp + 0x48]
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r13
mov byte [rbp - 0x70], r14b
cmp rsi, r13
jbe 0x1400058cb
lea rdx, [rsi + 1]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
mov esi, 0x1000
cmp rdx, rsi
jb 0x14000589c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a10
call fcn.1400073d8
jmp 0x1400058d0
mov rcx, rbx
call fcn.14000d0a4
mov eax, 1
mov rbx, qword [rsp + 0x368]
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov esi, 0x1000
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x30], r14b
mov rdx, qword [rbp - 0x38]
cmp rdx, r13
jbe 0x140005915
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, rsi
jb 0x140005910
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a16
call fcn.1400073d8
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r13
mov byte [rbp - 0x50], r14b
mov rdx, qword [rsp + 0x68]
cmp rdx, r13
jbe 0x140005959
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, rsi
jb 0x140005954
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a1c
call fcn.1400073d8
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r13
mov byte [rsp + 0x50], r14b
mov rdx, qword [rbp - 0x18]
cmp rdx, r13
jbe 0x14000599e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, rsi
jb 0x140005999
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a22
call fcn.1400073d8
cmp qword [rbp + 0x250], 0xffffffffffffffff
jne 0x1400059ed
add rdi, 0x20
cmp rdi, qword [rbp + 0x260]
jne 0x140005676
lea rdx, [rbp + 0xe0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14000565e
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, r14b
lea rcx, [rbp + 0x50]
call fcn.140006000
mov al, bl
jmp 0x1400058b0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400059dd
call fcn.140006f88
nop
call fcn.140006f88
nop
call fcn.14000d4c4
nop
call fcn.14000d4c4
nop
call fcn.14000d4c4
nop
call fcn.14000d4c4
nop
call fcn.14000d4c4
nop
call fcn.14000d4c4
nop
call fcn.140006f88
nop
call fcn.140006f88
int3
jmp 0x140005368