Function at 0x417150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e282
mov eax, dword fs:[0]
push eax
sub esp, 0x1d4
mov eax, dword [0x43e080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [str.e_0m]
xorps xmm0, xmm0
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x60], 4
mov dword [ebp - 0x5c], 0xf
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x6c], 0
lea eax, [ebp - 0x1c8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x48], 0
push eax
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x1c8], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.e_38_2_94_214_114m]
mov ecx, dword [ebp - 0x1c8]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x48], 0x12
movups xmmword [eax], xmm0
mov cx, word [0x435f10]
mov word [eax + 0x10], cx
mov byte [eax + 0x12], 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x118]
push 0x436988
push eax
call fcn.004054c0
add esp, 0x14
push 8
push str.DETECTED
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00414bd0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xa0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x90], xmm0
mov dword [eax + 0x14], 0xf
mov dword [eax + 0x10], 0
mov byte [eax], 0
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0x160]
call fcn.0040c130
push 3
push 0x436978
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 4
call fcn.00414bd0
xorps xmm0, xmm0
mov dword [ebp - 0xf0], 0
movups xmmword [ebp - 0x100], xmm0
mov dword [ebp - 0xec], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x100], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xf0], xmm0
mov byte [ebp - 4], 6
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x14c]
cmp ecx, 0xf
jbe 0x41730d
mov edx, dword [ebp - 0x160]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417303
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41742f
push ecx
push edx
call fcn.0042b5b1
add esp, 8
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0xf
mov byte [ebp - 0x160], 0
mov ecx, dword [ebp - 0x8c]
mov byte [ebp - 4], 7
cmp ecx, 0xf
jbe 0x417366
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41735c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41742f
push ecx
push edx
call fcn.0042b5b1
add esp, 8
mov ecx, dword [ebp - 0x104]
mov byte [ebp - 4], 8
cmp ecx, 0xf
jbe 0x4173a4
mov edx, dword [ebp - 0x118]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41739a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41742f
push ecx
push edx
call fcn.0042b5b1
add esp, 8
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0xf
mov byte [ebp - 0x118], 0
mov ecx, dword [ebp - 0x44]
mov byte [ebp - 4], 9
cmp ecx, 0xf
jbe 0x4173f3
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4173e9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41742f
push ecx
push edx
call fcn.0042b5b1
add esp, 8
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
mov ecx, dword [ebp - 0x5c]
mov byte [ebp - 4], 0xa
cmp ecx, 0xf
jbe 0x41743f
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417435
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x417435
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0042b5b1
add esp, 8
mov eax, dword [str.e_0m]
xorps xmm0, xmm0
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x60], 4
mov dword [ebp - 0x5c], 0xf
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x6c], 0
lea eax, [ebp - 0x1c8]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 0
push eax
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c8], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.e_38_2_239_75_75m]
mov ecx, dword [ebp - 0x1c8]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0x11
movups xmmword [eax], xmm0
mov cl, byte [0x435ee8]
mov byte [eax + 0x10], cl
mov byte [eax + 0x11], 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x130]
push 0x4369a0
push eax
call fcn.004054c0
add esp, 0x14
push 0xc
push str.NOT_DETECTED
mov ecx, eax
mov byte [ebp - 4], 0xd
call fcn.00414bd0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xa0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x90], xmm0
mov dword [eax + 0x14], 0xf
mov dword [eax + 0x10], 0
mov byte [eax], 0
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0x178]
call fcn.0040c130
push 1
push 0x43698c
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 0xf
call fcn.00414bd0
xorps xmm0, xmm0
mov dword [ebp - 0xd8], 0
movups xmmword [ebp - 0xe8], xmm0
mov dword [ebp - 0xd4], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xe8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xd8], xmm0
mov byte [ebp - 4], 0x11
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x164]
cmp ecx, 0xf
jbe 0x4175ca
mov edx, dword [ebp - 0x178]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4175c0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4176ec
push ecx
push edx
call fcn.0042b5b1
add esp, 8
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x164], 0xf
mov byte [ebp - 0x178], 0
mov ecx, dword [ebp - 0x8c]
mov byte [ebp - 4], 0x12
cmp ecx, 0xf
jbe 0x417623
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417619
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4176ec
push ecx
push edx
call fcn.0042b5b1
add esp, 8
mov ecx, dword [ebp - 0x11c]
mov byte [ebp - 4], 0x13
cmp ecx, 0xf
jbe 0x417661
mov edx, dword [ebp - 0x130]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417657
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4176ec
push ecx
push edx
call fcn.0042b5b1
add esp, 8
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0x14
cmp ecx, 0xf
jbe 0x4176b0
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4176a6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4176ec
push ecx
push edx
call fcn.0042b5b1
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov ecx, dword [ebp - 0x5c]
mov byte [ebp - 4], 0x15
cmp ecx, 0xf
jbe 0x4176fc
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4176f2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4176f2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0042b5b1
add esp, 8
mov eax, dword [str.e_0m]
xorps xmm0, xmm0
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x60], 4
mov dword [ebp - 0x5c], 0xf
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x6c], 0
lea eax, [ebp - 0x1c8]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x30], 0
push eax
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c8], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.e_38_2_239_75_75m]
mov ecx, dword [ebp - 0x1c8]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], 0x11
movups xmmword [eax], xmm0
mov cl, byte [0x435ee8]
mov byte [eax + 0x10], cl
mov byte [eax + 0x11], 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x148]
push 0x4369a0
push eax
call fcn.004054c0
add esp, 0x14
push 0xb
push str._SPOOFABLE
mov ecx, eax
mov byte [ebp - 4], 0x18
call fcn.00414bd0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xa0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x90], xmm0
mov dword [eax + 0x14], 0xf
mov dword [eax + 0x10], 0
mov byte [eax], 0
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0x190]
call fcn.0040c130
push 1
push 0x43698c
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x1a
call fcn.00414bd0
xorps xmm0, xmm0
mov dword [ebp - 0xc0], 0
movups xmmword [ebp - 0xd0], xmm0
mov dword [ebp - 0xbc], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xd0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xc0], xmm0
mov byte [ebp - 4], 0x1c
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x17c]
cmp ecx, 0xf
jbe 0x417887
mov edx, dword [ebp - 0x190]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41787d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4179a9
push ecx
push edx
call fcn.0042b5b1
add esp, 8
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x17c], 0xf
mov byte [ebp - 0x190], 0
mov ecx, dword [ebp - 0x8c]
mov byte [ebp - 4], 0x1d
cmp ecx, 0xf
jbe 0x4178e0
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4178d6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4179a9
push ecx
push edx
call fcn.0042b5b1
add esp, 8
mov ecx, dword [ebp - 0x134]
mov byte [ebp - 4], 0x1e
cmp ecx, 0xf
jbe 0x41791e
mov edx, dword [ebp - 0x148]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417914
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4179a9
push ecx
push edx
call fcn.0042b5b1
add esp, 8
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0xf
mov byte [ebp - 0x148], 0
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x1f
cmp ecx, 0xf
jbe 0x41796d
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417963
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4179a9
push ecx
push edx
call fcn.0042b5b1
add esp, 8
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
mov ecx, dword [ebp - 0x5c]
mov byte [ebp - 4], 0x20
cmp ecx, 0xf
jbe 0x4179b9
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4179af
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4179af
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0042b5b1
add esp, 8
mov eax, dword [0x4369b8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x88], xmm0
mov dword [ebp - 0x80], eax
movq xmm0, qword [str._____NOTE_____]
mov ax, word [0x4369bc]
mov dword [ebp - 0x78], 0xe
mov dword [ebp - 0x74], 0xf
movq qword [ebp - 0x88], xmm0
mov word [ebp - 0x7c], ax
mov byte [ebp - 0x7a], 0
mov eax, dword [str.e_0m]
xorps xmm0, xmm0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
lea eax, [ebp - 0x1c8]
mov byte [ebp - 4], 0x22
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 0
push eax
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c8], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.e_38_2_108_108_108m]
mov ecx, dword [ebp - 0x1c8]
mov edx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x18], 0x13
movups xmmword [edx], xmm0
mov cx, word [0x435f4c]
mov word [edx + 0x10], cx
mov al, byte [0x435f4e]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x23
push eax
lea eax, [ebp - 0x130]
push 0x4369a0
push eax
call fcn.004054c0
push str.__NO_PERMS
push eax
lea eax, [ebp - 0x148]
mov byte [ebp - 4], 0x24
push eax
call fcn.00405450
add esp, 0x20
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x25
push ecx
push eax
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0xa0]
call fcn.0040c130
push 0x43698c
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x26
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00405450
add esp, 0xc
lea ecx, [ebp - 0xa0]
call fcn.0040d330
lea ecx, [ebp - 0x148]
call fcn.0040d330
lea ecx, [ebp - 0x130]
call fcn.0040d330
mov eax, dword [ebp - 0x14]
cmp eax, 0xf
jbe 0x417b22
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x28]
push eax
call fcn.00410f10
add esp, 0xc
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov eax, dword [ebp - 0x2c]
cmp eax, 0xf
jbe 0x417b4c
push eax
push dword [ebp - 0x40]
lea eax, [ebp - 0x40]
push eax
call fcn.00410f10
add esp, 0xc
mov eax, dword [str.e_0m]
xorps xmm0, xmm0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
lea eax, [ebp - 0x1c8]
mov byte [ebp - 4], 0x2d
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x48], 0
push eax
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x1c8], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.e_38_2_94_214_114m]
mov ecx, dword [ebp - 0x1c8]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x48], 0x12
movups xmmword [eax], xmm0
mov cx, word [0x435f10]
mov word [eax + 0x10], cx
mov byte [eax + 0x12], 0
push str.TIP:
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x2e
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.00405450
add esp, 0x14
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x2f
push ecx
push eax
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0x1c0]
call fcn.0040c130
lea ecx, [ebp - 0xa0]
call fcn.0040d330
mov eax, dword [ebp - 0x44]
cmp eax, 0xf
jbe 0x417c22
push eax
push dword [ebp - 0x58]
lea eax, [ebp - 0x58]
push eax
call fcn.00410f10
add esp, 0xc
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x33
cmp eax, 0xf
jbe 0x417c50
push eax
push dword [ebp - 0x40]
lea eax, [ebp - 0x40]
push eax
call fcn.00410f10
add esp, 0xc
lea eax, [ebp - 0xd0]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x100]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xe8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x43e670]
mov ecx, eax
shr ecx, 0xb
shr eax, 0xc
and ecx, 0xffffff01
and al, 1
mov dword [ebp - 0x1d8], ecx
push str.VMID
add al, 0x75
lea ecx, [ebp - 0x1c]
push 0
mov byte [ebp - 0x1c8], al
call fcn.0040dd20
push str.CPU_brand
push 1
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.CPUID_hypervisor_bit
push 2
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.hypervisor_str
push 3
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.RDTSC
push 4
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.sidt_null_byte
push 0xf
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.processor_count
push 5
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.MAC_address
push 6
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.temperature
push 7
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.systemd_virtualisation
push 8
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.chassis_vendor
push 9
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.chassis_type
push 0xa
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Dockerenv
push 0xb
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.dmidecode_output
push 0xc
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.dmesg_output
push 0xd
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.hwmon_presence
push 0xe
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.cursor
push 0x10
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.VMware_registry
push 0x11
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.VBox_registry
push 0x12
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.users
push 0x13
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.DLLs
push 0x14
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.registry
push 0x15
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Sunbelt_CWSandbox_directory
push 0x16
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Wine
push 0x1d
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.VM_files
push 0x17
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.hw.model
push 0x18
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.disk_size
push 0x19
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.VBox_default_specs
push 0x1a
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.VBox_network_provider_match
push 0x1b
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.computer_name
push 0x1c
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.hostname
push 0x1e
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.low_memory_space
push 0x1f
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.VM_processes
push 0x28
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.default_Linux_user_host
push 0x29
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.VBox_window_class
push 0x20
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.gamarue_ransomware_technique
push 0x2a
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.0x4_leaf_of_VMID
push 0x2b
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Parallels_techniques
push 0x2c
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.RDTSC_VMEXIT
push 0x2d
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.loaded_DLLs
push 0x21
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.QEMU_CPU_brand
push 0x2e
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.BOCHS_CPU_techniques
push 0x2f
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.VirtualPC_motherboard
push 0x30
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.BIOS_serial_number
push 0x33
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Hyper_V_registry
push 0x32
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Hyper_V_WMI_output
push 0x31
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.VirtualBox_shared_folders
push 0x34
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.MSSMBIOS
push 0x35
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.MacOS_hw.memsize
push 0x36
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.MacOS_registry_IO_kit
push 0x37
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.IO_registry_grep
push 0x38
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.MacOS_SIP
push 0x39
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.KVM_registries
push 0x22
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.KVM_drivers
push 0x23
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.KVM_directories
push 0x24
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.HKLM_registries
push 0x3a
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Audio_device
push 0x25
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.qemu_ga_process
push 0x3b
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.MSR_validity
push 0x3c
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.QEMU_processes
push 0x3d
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.QEMU_directories
push 0x26
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.VPC_processes
push 0x3e
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.VPC_invalid_instructions
push 0x3f
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.SIDT
push 0x40
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.SGDT
push 0x41
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.SLDT
push 0x42
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Offensive_Security_SIDT
push 0x43
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Offensive_Security_SGDT
push 0x44
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Offensive_Security_SLDT
push 0x45
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.VirtualPC_SIDT
push 0x48
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Hyper_V_motherboard
push 0x46
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Extra_VM_files
push 0x47
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str._proc_iomem_file
push 0x49
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str._proc_ioports_file
push 0x4a
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str._proc_scsi_scsi_file
push 0x4b
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.VMware_dmesg
push 0x4c
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.STR_instruction
push 0x4d
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.VMware_IO_port_backdoor
push 0x4e
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.VMware_port_memory
push 0x4f
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.SMSW_instruction
push 0x50
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.mutex_strings
push 0x51
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.uptime
push 0x52
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.unusual_thread_count
push 0x53
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Intel_thread_count_mismatch
push 0x54
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Intel_Xeon_thread_count_mismatch
push 0x55
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.VM_memory_regions
push 0x56
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.CPUID_bitset
push 0x57
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Cuckoo_directory
push 0x58
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Cuckoo_pipe
push 0x59
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Hyper_V_Azure_hostname
push 0x5a
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.general_VM_hostnames
push 0x5b
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.screen_resolution
push 0x5c
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.bogus_device_string
push 0x5d
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.mouse_device
push 0x27
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.BlueStacks_folders
push 0x5e
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.CPUID_signatures
push 0x5f
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Hyper_V_CPUID_reserved_bitmask
push 0x60
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.KVM_CPUID_reserved_bitmask
push 0x61
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Intel_KGT_signature
push 0x62
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.VMware_DMI
push 0x63
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Hyper_V_event_logs
push 0x64
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.QEMU_virtual_DMI_directory
push 0x65
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.QEMU_USB
push 0x66
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Hypervisor_directory__Linux_
push 0x67
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.User_mode_Linux_CPU
push 0x68
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str._dev_kmsg_hypervisor_message
push 0x69
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.various_VM_files_in__proc
push 0x6a
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.VBox_kernel_module
push 0x6b
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str._proc_sysinfo
push 0x6c
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str._proc_device_tree
push 0x6d
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.DMI_scan
push 0x6e
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.SMBIOS_VM_bit
push 0x6f
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.Podman_file
push 0x70
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push str.WSL_string_in__proc
push 0x71
lea ecx, [ebp - 0x1c]
call fcn.0040dd20
push 0x436954
call fcn.0042aef0
push dword [ebp - 0x1c8]
lea eax, [ebp - 0xb8]
push 0x77
push eax
call fcn.00409be0
push str.VM_brand:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov byte [ebp - 4], 0x34
call fcn.00404f70
mov esi, dword [ebp - 0xa4]
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x1d4], eax
mov edi, dword [ebp - 0xb8]
cmp esi, 0xf
push 7
push str.Unknown
push dword [ebp - 0xa8]
cmova ecx, edi
push ecx
call fcn.004090f0
add esp, 0x28
test al, al
jne 0x4183d1
push 0x23
push str.Hyper_V_artifact__not_an_actual_VM_
push dword [ebp - 0xa8]
cmp esi, 0xf
lea eax, [ebp - 0xb8]
cmova eax, edi
push eax
call fcn.004090f0
add esp, 0x10
test al, al
mov eax, str.e_38_2_94_214_114m
je 0x4183d6
mov eax, str.e_38_2_239_75_75m
push eax
push dword [ebp - 0x1d4]
call fcn.00404f70
cmp dword [ebp - 0xa4], 0xf
lea ecx, [ebp - 0xb8]
push dword [ebp - 0xa8]
cmova ecx, dword [ebp - 0xb8]
push ecx
push eax
call fcn.004073b0
add esp, 0x14
push 0x436954
push str.e_0m
push eax
call fcn.00404f70
add esp, 8
push eax
call fcn.00404f70
add esp, 8
lea ecx, [ebp - 0xb8]
push 0
push str._or
call fcn.00416c50
cmp eax, 0xffffffff
jne 0x41853e
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00426360
push str.VM_type:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov byte [ebp - 4], 0x35
call fcn.00404f70
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x40]
mov edi, dword [ebp - 0x40]
cmp esi, 0xf
push 7
push str.Unknown
push dword [ebp - 0x30]
cmova eax, edi
mov byte [ebp - 4], 0x36
push eax
call fcn.004090f0
add esp, 0x20
test al, al
jne 0x4184cd
push 5
push str.No_VM
push dword [ebp - 0x30]
cmp esi, 0xf
lea eax, [ebp - 0x40]
cmova eax, edi
push eax
call fcn.004090f0
add esp, 0x10
test al, al
jne 0x4184cd
push 0x12
push str.e_38_2_94_214_114m
jmp 0x4184d4
push 0x11
push str.e_38_2_239_75_75m
lea ecx, [ebp - 0x58]
call fcn.00414d30
cmp dword [ebp - 0x44], 0xf
lea eax, [ebp - 0x58]
push dword [ebp - 0x48]
cmova eax, dword [ebp - 0x58]
push eax
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.004073b0
cmp dword [ebp - 0x2c], 0xf
lea ecx, [ebp - 0x40]
push dword [ebp - 0x30]
cmova ecx, dword [ebp - 0x40]
push ecx
push eax
call fcn.004073b0
add esp, 0x18
push 0x436954
push str.e_0m
push eax
call fcn.00404f70
add esp, 8
push eax
call fcn.00404f70
add esp, 8
lea ecx, [ebp - 0x58]
call fcn.0040d330
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x34
call fcn.0040d330
mov eax, dword [ebp - 0x1c8]
mov byte [ebp - 0x1c4], al
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00409220
lea eax, [ebp - 0x20]
push 1
push eax
call fcn.00425910
movzx ecx, ax
lea eax, [ebp - 0x20]
push 0x73
push eax
mov dword [ebp - 0x1d0], ecx
call fcn.00422410
add esp, 0x18
mov edi, 0x12c
test al, al
mov ecx, edi
mov eax, dword [ebp - 0x1d0]
mov edx, 0x96
cmove ecx, edx
cmp ax, cx
jb 0x418646
mov al, 0x64
mov dword [ebp - 0x1d0], eax
mov byte [ebp - 0x1d4], al
mov ecx, str.e_38_2_94_214_114m
push ecx
push str.VM_likeliness:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00404f70
add esp, 8
push eax
call fcn.00404f70
mov ecx, dword [ebp - 0x1d0]
add esp, 8
movzx ecx, cl
push 0x43720c
push ecx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
push eax
call fcn.00404f70
add esp, 8
push 0x436954
push str.e_0m
push eax
call fcn.00404f70
add esp, 8
push eax
call fcn.00404f70
mov eax, dword [ebp - 0x1c8]
mov byte [ebp - 0x1c4], al
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00409220
lea eax, [ebp - 0x20]
push 1
push eax
call fcn.00425910
movzx esi, ax
lea eax, [ebp - 0x20]
push 0x73
push eax
call fcn.00422410
add esp, 0x20
test al, al
je 0x4186ac
cmp si, di
jmp 0x4186b4
cmp ax, 0x64
jb 0x418653
mov al, 0x63
jmp 0x41859e
mov byte [ebp - 0x1d4], al
test al, al
jne 0x418667
mov ecx, str.e_38_2_239_75_75m
jmp 0x4185af
mov dword [ebp - 0x1d0], eax
cmp al, 0x19
jae 0x41867b
mov ecx, str.e_38_2_247_127_40m
jmp 0x4185af
mov dl, al
cmp al, 0x32
jae 0x41868b
mov ecx, str.e_38_2_255_180_5m
jmp 0x4185af
cmp dl, 0x4b
jae 0x4185aa
mov al, dl
mov ecx, str.e_38_2_174_197_59m
mov dword [ebp - 0x1d0], eax
mov byte [ebp - 0x1d4], al
jmp 0x4185af
mov eax, 0x96
cmp si, ax
push str.VM_confirmation:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
setae byte [ebp - 0x1c8]
call fcn.00404f70
cmp byte [ebp - 0x1c8], 0
mov esi, str.e_38_2_94_214_114m
mov edx, str.e_38_2_239_75_75m
mov ecx, esi
cmove ecx, edx
push ecx
push eax
call fcn.00404f70
add esp, 0x10
mov ecx, eax
push 0x4153e0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push dword [ebp - 0x1c8]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___bool_]
push 0x424290
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push 0x436954
push str.e_0m
push eax
call fcn.00404f70
add esp, 8
push eax
call fcn.00404f70
movzx eax, byte [0x43e674]
add esp, 8
cmp eax, 4
ja case.default.0x41873b
jmp dword [eax*4 + 0x418bec]
mov eax, str.e_38_2_239_75_75m
jmp 0x418763
mov eax, str.e_38_2_247_127_40m
jmp 0x418763
mov eax, str.e_38_2_255_180_5m
jmp 0x418763
mov eax, str.e_38_2_174_197_59m
jmp 0x418763
mov eax, str.e_38_2_94_214_114m
push eax
push str.VM_detections:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00404f70
add esp, 8
push eax
call fcn.00404f70
movzx ecx, byte [0x43e674]
add esp, 8
push 0x437238
push ecx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
push eax
call fcn.00404f70
add esp, 8
mov ecx, eax
push 0x72
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
push 0x437234
push str.e_0m
push eax
call fcn.00404f70
add esp, 8
push eax
call fcn.00404f70
movups xmm0, xmmword [0x43e6d0]
mov eax, dword [0x43e6e4]
add esp, 8
movups xmmword [ebp - 0x20], xmm0
cmp eax, 0x72
je 0x4187f7
cmp eax, 0x71
jne 0x418809
mov eax, dword [0x43e688]
and eax, 0x10000
or eax, 0
je 0x4187f1
xor al, al
jmp 0x4187f3
mov al, 1
test al, al
je 0x418809
lea eax, [ebp - 0x20]
push 0x72
push eax
call fcn.00422410
add esp, 8
test al, al
je 0x418817
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.00425910
add esp, 8
lea eax, [ebp - 0x1e0]
mov dword [ebp - 0x1e0], 0
push 1
mov ecx, eax
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x1c8], eax
call fcn.00414a00
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x1e0], eax
push eax
mov eax, dword [0x43e6c8]
lea ecx, [ebp - 0x1e0]
mov byte [ebp - 4], 0x37
push dword [eax + 4]
call fcn.00406090
mov ecx, dword [ebp - 0x1e0]
mov dword [ecx + 4], eax
mov edi, dword [ebp - 0x1e0]
mov eax, dword [0x43e6cc]
mov dword [ebp - 0x1dc], eax
mov edx, dword [edi + 4]
cmp byte [edx + 0xd], 0
jne 0x4188d0
mov ecx, dword [edx]
cmp byte [ecx + 0xd], 0
jne 0x4188ac
nop dword [eax]
mov eax, dword [ecx]
mov edx, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x4188a0
mov dword [edi], edx
mov edx, dword [ebp - 0x1e0]
mov ecx, dword [edx + 4]
mov eax, dword [ecx + 8]
cmp byte [eax + 0xd], 0
jne 0x4188cb
mov ecx, eax
mov eax, dword [ecx + 8]
cmp byte [eax + 0xd], 0
je 0x4188c0
mov dword [edx + 8], ecx
jmp 0x4188db
mov dword [edi], edi
mov eax, dword [ebp - 0x1e0]
mov dword [eax + 8], eax
mov eax, dword [ebp - 0x1d0]
mov byte [ebp - 4], 0x38
test al, al
jne 0x4188f0
mov esi, str.e_38_2_239_75_75m
jmp 0x41893a
cmp al, 0xc
ja 0x4188fb
mov esi, str.e_38_2_239_75_75m
jmp 0x41893a
cmp al, 0x19
ja 0x418906
mov esi, str.e_38_2_247_127_40m
jmp 0x41893a
cmp al, 0x32
jae 0x418911
mov esi, str.e_38_2_247_127_40m
jmp 0x41893a
cmp al, 0x3e
ja 0x41891c
mov esi, str.e_38_2_255_180_5m
jmp 0x41893a
cmp al, 0x4b
ja 0x418927
mov esi, str.e_38_2_174_197_59m
jmp 0x41893a
cmp al, 0x64
jae 0x418932
mov esi, str.e_38_2_94_214_114m
jmp 0x41893a
mov ecx, 0x430976
cmovne esi, ecx
lea eax, [ebp - 0xb8]
push eax
push dword [ebp - 0x1d4]
lea eax, [ebp - 0x1a8]
push eax
call fcn.00422cb0
add esp, 0xc
push str._CONCLUSION:
push str.e_1m
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov byte [ebp - 4], 0x39
call fcn.00404f70
add esp, 8
push eax
call fcn.00404f70
add esp, 8
push esi
push str.e_0m
push eax
call fcn.00404f70
add esp, 8
push eax
call fcn.00404f70
cmp dword [ebp - 0x194], 0xf
lea ecx, [ebp - 0x1a8]
push dword [ebp - 0x198]
cmova ecx, dword [ebp - 0x1a8]
push ecx
push eax
call fcn.004073b0
push 0x437254
push eax
call fcn.00404f70
push str.e_0m
push eax
call fcn.00404f70
add esp, 0x24
push str.
push str.e_1m
push eax
call fcn.00404f70
add esp, 8
push eax
call fcn.00404f70
add esp, 8
push 0x437234
push str.e_0m
push eax
call fcn.00404f70
add esp, 8
push eax
call fcn.00404f70
cmp dword [ebp - 0xa4], 0xf
lea eax, [ebp - 0xb8]
push 0x23
cmova eax, dword [ebp - 0xb8]
push str.Hyper_V_artifact__not_an_actual_VM_
push dword [ebp - 0xa8]
push eax
call fcn.004090f0
add esp, 0x18
cmp byte [ebp - 0x1d8], 0
jne 0x418ac8
test al, al
je 0x418a61
cmp dword [ebp - 0x74], 0xf
lea eax, [ebp - 0x88]
push dword [ebp - 0x78]
cmova eax, dword [ebp - 0x88]
push eax
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.004073b0
push str._The_result_means_that_the_CLI_has_found_Hyper_V__but_as_an_artifact_instead_of_an_actual_VM._This_means_that_although_the_hardware_values_in_fact_match_with_Hyper_V_due_to_how_its_designed_by_Microsoft__the_CLI_has_determined_you_are_NOT_in_a_Hyper_V_VM._n_n
jmp 0x418abf
mov eax, dword [0x43e670]
shr eax, 0xc
test al, 1
jne 0x418a9a
cmp dword [ebp - 0x1ac], 0xf
lea eax, [ebp - 0x1c0]
push dword [ebp - 0x1b0]
cmova eax, dword [ebp - 0x1c0]
push eax
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.004073b0
push str.To_enable_spoofable_techniques__run_with_the____spoofable__argument_n_n
jmp 0x418abf
cmp dword [ebp - 0x74], 0xf
lea eax, [ebp - 0x88]
push dword [ebp - 0x78]
cmova eax, dword [ebp - 0x88]
push eax
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.004073b0
push str._If_you_found_a_false_positive__please_make_sure_to_create_an_issue_at_https:__github.com_kernelwernel_VMAware_issues_n_n
push eax
call fcn.00404f70
add esp, 0x14
lea ecx, [ebp - 0x1a8]
call fcn.0040d330
lea eax, [ebp - 0x1e0]
push eax
mov ecx, eax
call fcn.004066d0
lea ecx, [ebp - 0xb8]
call fcn.0040d330
lea ecx, [ebp - 0x1c0]
call fcn.0040d330
lea ecx, [ebp - 0x118]
call fcn.0040d330
mov eax, dword [ebp - 0x74]
cmp eax, 0xf
jbe 0x418b20
push eax
push dword [ebp - 0x88]
lea eax, [ebp - 0x88]
push eax
call fcn.00410f10
add esp, 0xc
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
cmp eax, 0xf
jbe 0x418b56
push eax
push dword [ebp - 0xd0]
lea eax, [ebp - 0xd0]
push eax
call fcn.00410f10
add esp, 0xc
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0xf
mov byte [ebp - 0xd0], 0
cmp eax, 0xf
jbe 0x418b92
push eax
push dword [ebp - 0xe8]
lea eax, [ebp - 0xe8]
push eax
call fcn.00410f10
add esp, 0xc
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0xf
mov byte [ebp - 0xe8], 0
cmp eax, 0xf
jbe 0x418bce
push eax
push dword [ebp - 0x100]
lea eax, [ebp - 0x100]
push eax
call fcn.00410f10
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042b81e
mov esp, ebp
pop ebp
ret