Function at 0x14001100f
Capabilities:
Check for unmoving mouse cursor
Enumerate gui resources
Enumerate processes
Get memory capacity
Get system information on windows

Disassembly:
jmp 0x1400149c0
push rbp
push rdi
sub rsp, 0xae8
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x1e2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140029040]
xor rax, rbp
mov qword [rbp + 0xa70], rax
lea rcx, [0x14002f120]
call fcn.14001160e
nop
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
mov eax, dword [rbp + 0x28]
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 2
jae 0x140014a1b
call fcn.14001166d
nop
mov dword [rbp + 0x80], 0x40
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
nop
xor edx, edx
mov rax, qword [rbp + 0x88]
mov ecx, 0x400
div rcx
xor edx, edx
mov ecx, 0x400
div rcx
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 0x800
jae 0x140014a66
call fcn.14001166d
nop
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
xor edx, edx
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0xf8], rax
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x144]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x18
lea rax, [rbp + 0x118]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop
mov eax, dword [rbp + 0x124]
mov rcx, qword [rbp + 0x118]
imul rcx, rax
mov rax, rcx
mov ecx, dword [rbp + 0x128]
imul rax, rcx
mov ecx, dword [rbp + 0x12c]
imul rax, rcx
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
mov dword [rbp + 0x164], eax
cmp dword [rbp + 0x164], 0x64
jae 0x140014b4d
call fcn.14001166d
nop
mov dword [rbp + 0x184], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
xor edx, edx
mov ecx, 0x3e8
div rcx
mov qword [rbp + 0x1a8], rax
cmp qword [rbp + 0x1a8], 0x4b0
jae 0x140014b81
call fcn.14001166d
nop
lea rax, [rbp + 0x1c8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMControlSet001EnumUSBSTOR
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rbp + 0x1e4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
nop
cmp dword [rbp + 0x1e4], 1
jae 0x140014c1b
call fcn.14001166d
nop
xor r9d, r9d
lea r8, str.Okay
lea rdx, str.Hey_please_press_okay_to_prove_that_you_are_not_a_robot_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
lea rcx, [rbp + 0x228]
call qword [sym.imp.USER32.dll_GetCursorPos]
nop
xorps xmm0, xmm0
movsd qword [rbp + 0x248], xmm0
xor eax, eax
cmp eax, 1
je 0x140014d05
lea rcx, [rbp + 0x208]
call qword [sym.imp.USER32.dll_GetCursorPos]
nop
mov eax, dword [rbp + 0x228]
mov ecx, dword [rbp + 0x208]
sub ecx, eax
mov eax, ecx
mov edx, 2
mov ecx, eax
call fcn.140011681
movsd qword [rbp + 0xa68], xmm0
mov eax, dword [rbp + 0x22c]
mov ecx, dword [rbp + 0x20c]
sub ecx, eax
mov eax, ecx
mov edx, 2
mov ecx, eax
call fcn.140011681
movsd xmm1, qword [rbp + 0xa68]
addsd xmm1, xmm0
movaps xmm0, xmm1
call fcn.140011078
movsd xmm1, qword [rbp + 0x248]
addsd xmm1, xmm0
movaps xmm0, xmm1
movsd qword [rbp + 0x248], xmm0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rax, qword [rbp + 0x208]
mov qword [rbp + 0x228], rax
movsd xmm0, qword [rbp + 0x248]
comisd xmm0, xmmword [0x140024e50]
jb 0x140014d00
jmp 0x140014d05
jmp 0x140014c4e
lea rcx, [0x140024858]
call fcn.1400112df
nop
lea rcx, str.C:windowsSystem32_vboxoglpackspu.dll
call fcn.14001153c
movzx eax, al
test eax, eax
je 0x140014d30
call fcn.14001166d
nop
jmp 0x140014ea5
lea rcx, str.C:windowsSystem32DriversVBoxSF.sys
call fcn.14001153c
movzx eax, al
test eax, eax
je 0x140014d4e
call fcn.14001166d
nop
jmp 0x140014ea5
lea rcx, str.C:windowsSystem32DriversVBoxVideo.sys
call fcn.14001153c
movzx eax, al
test eax, eax
je 0x140014d6c
call fcn.14001166d
nop
jmp 0x140014ea5
lea rcx, str.C:windowsSystem32_vboxoglpassthroughspu.dll
call fcn.14001153c
movzx eax, al
test eax, eax
je 0x140014d8a
call fcn.14001166d
nop
jmp 0x140014ea5
lea rcx, str.C:windowsSystem32_vboxdisp.dll
call fcn.14001153c
movzx eax, al
test eax, eax
je 0x140014da8
call fcn.14001166d
nop
jmp 0x140014ea5
lea rcx, str.C:windowsSystem32_vboxhook.dll
call fcn.14001153c
movzx eax, al
test eax, eax
je 0x140014dc6
call fcn.14001166d
nop
jmp 0x140014ea5
lea rcx, str.C:windowsSystem32_vboxmrxnp.dll
call fcn.14001153c
movzx eax, al
test eax, eax
je 0x140014de4
call fcn.14001166d
nop
jmp 0x140014ea5
lea rcx, str.C:windowsSystem32_vboxogl.dll
call fcn.14001153c
movzx eax, al
test eax, eax
je 0x140014e02
call fcn.14001166d
nop
jmp 0x140014ea5
lea rcx, str.C:windowsSystem32_vboxoglcrutil.dll
call fcn.14001153c
movzx eax, al
test eax, eax
je 0x140014e20
call fcn.14001166d
nop
jmp 0x140014ea5
lea rcx, str.C:windowsSystem32DriversVBoxGuest.sys
call fcn.14001153c
movzx eax, al
test eax, eax
je 0x140014e3b
call fcn.14001166d
nop
jmp 0x140014ea5
lea rcx, str.C:windowsSystem32_vboxoglerrorspu.dll
call fcn.14001153c
movzx eax, al
test eax, eax
je 0x140014e56
call fcn.14001166d
nop
jmp 0x140014ea5
lea rcx, str.C:windowsSystem32_vboxoglfeedbackspu.dll
call fcn.14001153c
movzx eax, al
test eax, eax
je 0x140014e71
call fcn.14001166d
nop
jmp 0x140014ea5
lea rcx, str.C:windowsSystem32DriversVBoxMouse.sys
call fcn.14001153c
movzx eax, al
test eax, eax
je 0x140014e8c
call fcn.14001166d
nop
jmp 0x140014ea5
lea rcx, str.C:windowsSystem32_vboxoglarrayspu.dll
call fcn.14001153c
movzx eax, al
test eax, eax
je 0x140014ea5
call fcn.14001166d
nop
lea rax, str.vmtoolsd.exe
mov qword [rbp + 0x268], rax
lea rax, str.vmwaretray.exe
mov qword [rbp + 0x270], rax
lea rax, str.vmwareuser.exe
mov qword [rbp + 0x278], rax
lea rax, str.VGAuthService.exe
mov qword [rbp + 0x280], rax
lea rax, str.vmacthlp.exe
mov qword [rbp + 0x288], rax
lea rax, [rbp + 0x2b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rbp + 0x2b0], 0x238
xor edx, edx
mov ecx, 2
call fcn.1400112e9
mov qword [rbp + 0x508], rax
lea rdx, [rbp + 0x2b0]
mov rcx, qword [rbp + 0x508]
call fcn.1400113c5
test eax, eax
je 0x140014f8e
lea r8, [rbp + 0x2dc]
mov edx, 0x104
lea rcx, [rbp + 0x530]
call fcn.140011519
nop
lea rcx, [rbp + 0x530]
call qword [sym.imp.USER32.dll_CharUpperW]
nop
lea rdx, str.WIRESHARK.EXE
lea rcx, [rbp + 0x530]
call fcn.1400110f5
test rax, rax
je 0x140014f77
call fcn.14001166d
nop
lea rdx, [rbp + 0x2b0]
mov rcx, qword [rbp + 0x508]
call fcn.140011573
test eax, eax
jne 0x140014f32
mov byte [rbp + 0x754], 0
lea rdx, [rbp + 0x754]
lea rcx, [0x14001101e]
call qword [sym.imp.USER32.dll_EnumWindows]
nop
movzx eax, byte [rbp + 0x754]
test eax, eax
je 0x140014fbb
call fcn.14001166d
nop
lea rcx, [rbp - 0x60]
lea rdx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.140011528
mov rcx, qword [rbp + 0xa70]
xor rcx, rbp
call fcn.140011307
lea rsp, [rbp + 0xa88]
pop rdi
pop rbp
ret