Function at 0x140001130
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x140054040]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor ecx, ecx
mov esi, 1
mov eax, esi
xor edi, edi
cpuid
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x4c], edx
test ecx, ecx
jns 0x1400011a3
xor ecx, ecx
mov eax, 0x80000001
cpuid
test edx, 0x80000000
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], ebx
cmovne edi, esi
mov dword [rsp + 0x48], ecx
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.HARDWAREDESCRIPTIONSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000125c
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.SystemBiosDate
lea rax, [rsp + 0x60]
mov dword [rsp + 0x50], 0x200
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001251
lea rdx, str.Virtual
lea rcx, [rsp + 0x60]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x14000124f
lea rdx, str.VMware
lea rcx, [rsp + 0x60]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x14000124f
lea rdx, str.VirtualBox
lea rcx, [rsp + 0x60]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140001251
mov edi, esi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x30], 0
lea rcx, str.DeviceVirtualBoxGuest
mov dword [rsp + 0x28], 4
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000129e
mov rcx, rax
mov edi, esi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], 0
lea rcx, str.DeviceVMwareAcceleratedGraphics
mov dword [rsp + 0x28], 4
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400012e0
mov rcx, rax
mov edi, esi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesVBoxGuest
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140001336
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServices_vmhgfs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001343
mov rcx, qword [rsp + 0x40]
mov edi, esi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREVMware__Inc.VMware_Tools
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400013b2
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.InstallPath
lea rax, [rsp + 0x60]
mov dword [rsp + 0x50], 0x200
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
test eax, eax
cmove edi, esi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x30], 0
lea rcx, str.DeviceVMwareVMCI
mov dword [rsp + 0x28], 4
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400013f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400013f8
test edi, edi
je 0x14000141d
mov r9d, 0x10
lea r8, str..NET_Framework_Init_Error
lea rdx, str.To_run_this_application__you_first_must_install_one_of_the_following_versions_of_the_.NET_framework_v4.0.30319._If_you_already_have_the_package_please_reinstal_of_contact_publisher.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor eax, eax
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140001c90
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret