Function at 0x1400010e0
Capabilities:
Enumerate files on windows
Enumerate processes
Get common file path
Get memory capacity
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x810]
sub rsp, 0x910
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x800], rax
mov rbx, rdx
mov r14d, ecx
xor r15d, r15d
lea rdx, [rbp + 0x5f0]
mov ecx, 0x104
mov edi, r15d
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140001135
xor dword [0x140005870], 0xd
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x5f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001160
xor dword [0x140005870], 0xe
nop dword [rax]
lea rdx, [rbp + 0x1f0]
mov rcx, rsi
inc edi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140001160
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp edi, 0x1f4
jae 0x14000118e
xor dword [0x140005870], 0xf
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, dword [0x140005870]
test eax, eax
je 0x1400011b0
xor ecx, 2
mov dword [0x140005870], ecx
mov r8d, r15d
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp byte [rbx + rdx], r8b
jne 0x1400011c0
sub edx, 1
movsxd r9, edx
js 0x1400011f8
cmp r8d, 2
je 0x140001472
cmp byte [r9 + rbx], 0x5c
lea eax, [r8 + 1]
cmovne eax, r8d
dec edx
sub r9, 1
mov r8d, eax
jns 0x1400011d1
cmp eax, 2
je 0x140001201
xor ecx, 0xc
mov dword [0x140005870], ecx
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp byte [rbx + rdx], r15b
jne 0x140001210
mov r8d, r15d
test rdx, rdx
je 0x14000123d
cmp byte [rbx], 0x5c
lea rbx, [rbx + 1]
cmove ecx, r15d
inc r8d
movsxd rax, r8d
cmp rax, rdx
jb 0x140001221
mov dword [0x140005870], ecx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, r14d
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rbx, r14
sub rbx, rdi
cmp rbx, 0x64
jbe 0x140001262
xor dword [0x140005870], 3
xorps xmm0, xmm0
mov dword [rbp - 0x50], 0x238
lea rcx, str.vmtoolsd.exe
xor edx, edx
lea rax, str.vm3dservice.exe
mov qword [rbp + 0x440], rcx
mov qword [rbp + 0x448], rax
lea rax, str.vboxtray.exe
mov qword [rbp + 0x458], rax
lea rax, str.vboxservice.exe
mov qword [rbp + 0x460], rax
xor eax, eax
mov qword [rbp + 0x450], rcx
movups xmmword [rbp + 0x468], xmm0
mov qword [rbp + 0x4d8], rax
lea ecx, [rax + 2]
movups xmmword [rbp + 0x478], xmm0
movups xmmword [rbp + 0x488], xmm0
movups xmmword [rbp + 0x498], xmm0
movups xmmword [rbp + 0x4a8], xmm0
movups xmmword [rbp + 0x4b8], xmm0
movups xmmword [rbp + 0x4c8], xmm0
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp - 0x50]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400013ba
nop dword [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x4e0]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x4e0]
mov qword [rsp + 0x30], r15
lea r8, [rbp - 0x24]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rbx, r15
nop dword [rax]
mov r8, qword [rbp + rbx*8 + 0x440]
lea rax, [rbp + 0x4e0]
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001385
inc rax
test ecx, ecx
jne 0x140001372
test edx, edx
jne 0x14000139c
lea rcx, str.this_is_a_Virtual_system_n
call fcn.140001010
xor dword [0x140005870], 4
inc rbx
cmp rbx, 5
jl 0x140001360
lea rdx, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001310
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, 0x12d687
jae 0x1400013db
lea rcx, [0x140003330]
call fcn.140001010
xor dword [0x140005870], 7
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, 0xfff8d001
cmp qword [rsp + 0x48], rax
jae 0x14000140d
lea rcx, str.Memory____n
call fcn.140001010
xor dword [0x140005870], 8
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp - 0x60], 4
jge 0x140001430
lea rcx, str.CoreNum___4_n
call fcn.140001010
xor dword [0x140005870], 9
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
mov eax, dword [0x140005870]
je 0x140001449
xor eax, 0xa
mov dword [0x140005870], eax
sar eax, 4
mov rcx, qword [rbp + 0x800]
xor rcx, rsp
call fcn.140001630
mov rbx, qword [rsp + 0x950]
add rsp, 0x910
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
movsxd rax, edx
mov byte [rax + rbx + 1], r15b
jmp 0x140001201