Function at 0x406cf0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414145
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x54
mov eax, dword [0x41b040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
xor eax, eax
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x54], 0x6e
nop dword [eax]
rdtsc
mov dword [ebp - 0x58], eax
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x4c], edx
push ebx
cpuid
mov esi, ebx
pop ebx
lea edi, [ebp - 0x3c]
mov dword [edi], eax
mov eax, edi
mov edi, dword [ebp - 0x50]
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0xc], edx
rdtsc
sub eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
sbb edx, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], edx
cmp ecx, edi
je 0x406da7
mov dword [ecx], eax
mov dword [ecx + 4], edx
add ecx, 8
mov dword [ebp - 0x1c], ecx
jmp 0x406dbd
lea eax, [ebp - 0x60]
push eax
push ecx
lea ecx, [ebp - 0x20]
call fcn.004098e0
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x50], edi
sub dword [ebp - 0x54], 1
jne 0x406d60
mov esi, dword [ebp - 0x20]
mov eax, ecx
mov byte [ebp - 0x4c], 0
sub eax, esi
push dword [ebp - 0x4c]
sar eax, 3
mov edx, ecx
push eax
mov ecx, esi
call fcn.00409b60
add esp, 8
mov eax, 5
xorps xmm1, xmm1
xorps xmm2, xmm2
nop dword [eax]
movups xmm0, xmmword [esi + eax*8]
paddq xmm1, xmm0
movups xmm0, xmmword [esi + eax*8 + 0x10]
add eax, 4
paddq xmm2, xmm0
cmp eax, 0x69
jl 0x406df0
paddq xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movd ecx, xmm1
psrldq xmm1, 4
movd eax, xmm1
test eax, eax
jne 0x406e35
mov byte [ebp - 0x45], al
cmp ecx, 0x18704
jb 0x406e39
mov byte [ebp - 0x45], 1
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x406e73
sub edi, esi
mov eax, esi
and edi, 0xfffffff8
cmp edi, 0x1000
jb 0x406e69
mov esi, dword [eax - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x406e69
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edi
push esi
call fcn.00412260
add esp, 8
cmp byte [ebp - 0x45], 0
jne 0x407046
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push str.wmic_diskdrive_get_model
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
call fcn.004030b0
lea edx, [ebp - 0x2c]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x44]
call fcn.0040a370
mov edi, dword [ebp - 0x30]
lea ecx, [ebp - 0x44]
mov esi, dword [ebp - 0x44]
cmp edi, 0xf
mov edx, dword [ebp - 0x34]
push 0xd
cmova ecx, esi
push str.DADY_HARDDISK
push ecx
call fcn.00402fc0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x406fd4
mov edx, dword [ebp - 0x34]
lea ecx, [ebp - 0x44]
cmp edi, 0xf
push 0xd
cmova ecx, esi
push str.QEMU_HARDDISK
push ecx
call fcn.00402fc0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x406fd4
cmp edi, 0xf
jbe 0x406f31
inc edi
mov eax, esi
cmp edi, 0x1000
jb 0x406f27
mov esi, dword [eax - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407036
push edi
push esi
call fcn.00412260
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp ecx, 0xf
jbe 0x406f7e
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406f74
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407036
push ecx
push edx
call fcn.00412260
add esp, 8
call fcn.00406520
test al, al
jne 0x407046
call fcn.00405390
test al, al
jne 0x407046
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov edi, eax
call esi
cmp edi, 0x320
jl 0x407046
cmp eax, 0x258
jl 0x407046
call fcn.00405c60
test al, al
jne 0x407046
call fcn.004066d0
test al, al
setne al
jmp 0x407048
cmp edi, 0xf
jbe 0x406ffe
inc edi
mov eax, esi
cmp edi, 0x1000
jb 0x406ff4
mov esi, dword [eax - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407036
push edi
push esi
call fcn.00412260
add esp, 8
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp ecx, 0xf
jbe 0x407046
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40703c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40703c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00412260
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041210d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret