Function at 0x14000a7d8
Capabilities:
Contain obfuscated stackstrings
Get system firmware table

Disassembly:
sub rsp, 0x238
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov rax, qword [0x1400871c0]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov byte [rsp + 0x160], 0x6b
mov byte [rsp + 0x161], 0x65
mov byte [rsp + 0x162], 0x72
mov byte [rsp + 0x163], 0x6e
mov byte [rsp + 0x164], 0x65
mov byte [rsp + 0x165], 0x6c
mov byte [rsp + 0x166], 0x33
mov byte [rsp + 0x167], 0x32
mov byte [rsp + 0x168], 0x2e
mov byte [rsp + 0x169], 0x64
mov byte [rsp + 0x16a], 0x6c
mov byte [rsp + 0x16b], 0x6c
mov byte [rsp + 0x16c], 0
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14000a887
xor al, al
jmp 0x14000ac65
mov byte [rsp + 0x180], 0x47
mov byte [rsp + 0x181], 0x65
mov byte [rsp + 0x182], 0x74
mov byte [rsp + 0x183], 0x43
mov byte [rsp + 0x184], 0x6f
mov byte [rsp + 0x185], 0x6d
mov byte [rsp + 0x186], 0x70
mov byte [rsp + 0x187], 0x75
mov byte [rsp + 0x188], 0x74
mov byte [rsp + 0x189], 0x65
mov byte [rsp + 0x18a], 0x72
mov byte [rsp + 0x18b], 0x4e
mov byte [rsp + 0x18c], 0x61
mov byte [rsp + 0x18d], 0x6d
mov byte [rsp + 0x18e], 0x65
mov byte [rsp + 0x18f], 0x41
mov byte [rsp + 0x190], 0
mov byte [rsp + 0x170], 0x47
mov byte [rsp + 0x171], 0x65
mov byte [rsp + 0x172], 0x74
mov byte [rsp + 0x173], 0x53
mov byte [rsp + 0x174], 0x79
mov byte [rsp + 0x175], 0x73
mov byte [rsp + 0x176], 0x74
mov byte [rsp + 0x177], 0x65
mov byte [rsp + 0x178], 0x6d
mov byte [rsp + 0x179], 0x49
mov byte [rsp + 0x17a], 0x6e
mov byte [rsp + 0x17b], 0x66
mov byte [rsp + 0x17c], 0x6f
mov byte [rsp + 0x17d], 0
lea rdx, [rsp + 0x180]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x170]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x48], 0
je 0x14000a9bf
cmp qword [rsp + 0x58], 0
jne 0x14000a9d1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0x14000ac65
lea rax, str.avast
mov qword [rsp + 0x110], rax
lea rax, [0x1400685e4]
mov qword [rsp + 0x118], rax
lea rax, str.bitdefender
mov qword [rsp + 0x120], rax
lea rax, str.cuckoo
mov qword [rsp + 0x128], rax
lea rax, str.malware
mov qword [rsp + 0x130], rax
lea rax, str.sandbox
mov qword [rsp + 0x138], rax
lea rax, str.virtual
mov qword [rsp + 0x140], rax
lea rax, str.vmware
mov qword [rsp + 0x148], rax
lea rax, str.virtualbox
mov qword [rsp + 0x150], rax
lea rax, str.qemu
mov qword [rsp + 0x158], rax
mov dword [rsp + 0x90], 0x80
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x1a0]
call qword [rsp + 0x48]
test eax, eax
jne 0x14000aa9c
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0x14000ac65
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x98]
call fcn.140002540
nop
lea rax, [rsp + 0x110]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
add rax, 0x50
mov qword [rsp + 0x68], rax
jmp 0x14000aae7
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x68]
cmp qword [rsp + 0x30], rax
je 0x14000ab46
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x70], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x98]
call fcn.14000e058
cmp rax, qword [0x140067980]
je 0x14000ab44
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x98]
call fcn.14000289c
mov al, byte [rsp + 0x20]
jmp 0x14000ac65
jmp 0x14000aad9
lea rcx, [rsp + 0xd8]
call qword [rsp + 0x58]
mov r9d, 0x80
lea r8, [rsp + 0x1a0]
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jbe 0x14000ac44
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0xb8]
call fcn.140002540
nop
lea rax, [rsp + 0x110]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 0x50
mov qword [rsp + 0x78], rax
jmp 0x14000abc7
mov rax, qword [rsp + 0x38]
add rax, 8
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x38], rax
je 0x14000ac37
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x80], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0xb8]
call fcn.14000e058
cmp rax, qword [0x140067980]
je 0x14000ac35
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [rsp + 0x21], 1
lea rcx, [rsp + 0xb8]
call fcn.14000289c
nop
lea rcx, [rsp + 0x98]
call fcn.14000289c
mov al, byte [rsp + 0x21]
jmp 0x14000ac65
jmp 0x14000abb9
lea rcx, [rsp + 0xb8]
call fcn.14000289c
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [rsp + 0x22], 0
lea rcx, [rsp + 0x98]
call fcn.14000289c
mov al, byte [rsp + 0x22]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.140043850
add rsp, 0x238
ret