Function at 0x401090
Capabilities:
Check for sandbox username or hostname
Check os version
Enumerate files on windows
Enumerate process modules
Get disk information
Get hostname
Get session user name
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x5764
call fcn.004125e0
mov eax, dword [0x41a004]
xor eax, esp
mov dword [esp + 0x5760], eax
push ebx
push esi
push edi
push 0x100
lea eax, [esp + 0x126c]
mov edi, ecx
push 0
push eax
mov dword [esp + 0x20], edi
call fcn.004029e0
add esp, 0xc
mov dword [esp + 0x18], 0x100
lea eax, [esp + 0x377c]
push 0x1fec
push 0
push eax
call fcn.004029e0
add esp, 0xc
lea eax, [esp + 0x1768]
push 0x2000
push 0
push eax
call fcn.004029e0
add esp, 0xc
lea eax, [esp + 0x1468]
push 0x100
push 0
push eax
call fcn.004029e0
add esp, 0xc
mov dword [esp + 0x10], 0x100
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1064]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x40115e
lea eax, [esp + 0x1060]
push eax
push str.Computer_Name:__s_n
lea eax, [esp + 0x1270]
push 0xffff
push eax
call fcn.00401050
add esp, 0x10
jmp 0x401196
movups xmm0, xmmword [str.Unable_to_get_computer_name_n]
mov eax, dword [0x418c78]
mov dword [esp + 0x1280], eax
mov al, byte [0x418c7c]
movups xmmword [esp + 0x1268], xmm0
mov byte [esp + 0x1284], al
movq xmm0, qword [0x418c70]
movq qword [esp + 0x1278], xmm0
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4011a0
sub ecx, edx
mov eax, 0xfffe
sub eax, ecx
push eax
lea eax, [esp + 0x126c]
push eax
push edi
call fcn.004053f0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x156c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x40121c
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4011e0
sub ecx, edx
mov edx, edi
lea esi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x4011f0
lea eax, [esp + 0x1568]
sub edx, esi
push eax
mov eax, 0xffff
sub eax, ecx
push str.Username:__s_n
push eax
lea eax, [edi + edx]
push eax
call fcn.00401050
add esp, 0x10
jmp 0x401233
movups xmm0, xmmword [str.Unable_to_get_username_n]
movups xmmword [edi], xmm0
movq xmm0, qword [0x418cbc]
movq qword [edi + 0x10], xmm0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401243
sub ecx, edx
mov edx, edi
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x401251
push dword [esp + 0x3c]
sub edx, esi
mov eax, 0xffff
sub eax, ecx
push str.CPU_Cores:__d_n
push eax
lea eax, [edi + edx]
push eax
call fcn.00401050
push 0x38
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.004029e0
add esp, 0x1c
lea eax, [esp + 0x28]
push 0x38
push eax
call dword [sym.imp.KERNEL32.dll_K32GetPerformanceInfo]
test eax, eax
je 0x4012ce
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x50]
imul eax, ecx
imul ecx, dword [esp + 0x38]
push 0
shr eax, 0x14
push eax
push 0
shr ecx, 0x14
lea eax, [esp + 0x1374]
push ecx
push str.Total_physical_memory:__llu_MB_nAvailable_physical_memory:__llu_MB_n
push 0x100
push eax
call fcn.00401050
add esp, 0x1c
jmp 0x401312
movups xmm0, xmmword [str.Failed_to_retrieve_memory_information_n]
mov eax, dword [0x418b74]
mov dword [esp + 0x1388], eax
mov ax, word [0x418b78]
movups xmmword [esp + 0x1368], xmm0
mov word [esp + 0x138c], ax
movups xmm0, xmmword [0x418b64]
mov al, byte [0x418b7a]
mov byte [esp + 0x138e], al
movups xmmword [esp + 0x1378], xmm0
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401317
mov esi, 0xfffe
sub ecx, edx
mov eax, esi
sub eax, ecx
push eax
lea eax, [esp + 0x136c]
push eax
push edi
call fcn.004053f0
mov ax, word [0x418b84]
add esp, 0xc
movq xmm0, qword [str._unknown_]
mov word [esp + 0x1168], ax
lea eax, [esp + 0x116a]
movq qword [esp + 0x1160], xmm0
push 0xfa
push 0
push eax
call fcn.004029e0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x1000
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x4013d5
movups xmm0, xmmword [str.Unable_to_enumerate_processes_n]
mov eax, dword [0x418ba0]
mov dword [esp + 0x3780], eax
mov ax, word [0x418ba4]
movups xmmword [esp + 0x3768], xmm0
mov word [esp + 0x3784], ax
movq xmm0, qword [0x418b98]
mov al, byte [0x418ba6]
movq qword [esp + 0x3778], xmm0
mov byte [esp + 0x3786], al
jmp 0x4014bf
mov ebx, dword [esp + 0x10]
xor edi, edi
movups xmm0, xmmword [str.Processes_running:_n]
mov eax, dword [0x418bb8]
shr ebx, 2
mov dword [esp + 0x3778], eax
movups xmmword [esp + 0x3768], xmm0
test ebx, ebx
je 0x4014bb
mov eax, dword [esp + edi*4 + 0x60]
test eax, eax
je 0x4014b2
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x401457
lea eax, [esp + 0x20]
push eax
push 4
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x401450
push 0x104
lea eax, [esp + 0x1164]
push eax
push dword [esp + 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + edi*4 + 0x60]
lea eax, [esp + 0x1164]
push eax
push str._s__PID:__u__n
lea eax, [esp + 0x106c]
push 0x100
push eax
call fcn.00401050
lea ecx, [esp + 0x377c]
add esp, 0x14
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401487
mov esi, 0xfffe
sub ecx, edx
mov eax, esi
sub eax, ecx
push eax
lea eax, [esp + 0x1064]
push eax
lea eax, [esp + 0x3770]
push eax
call fcn.004053f0
add esp, 0xc
inc edi
cmp edi, ebx
jb 0x401401
mov edi, dword [esp + 0x14]
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4014c4
sub ecx, edx
mov eax, esi
sub eax, ecx
push eax
lea eax, [esp + 0x376c]
push eax
push edi
call fcn.004053f0
add esp, 0xc
lea eax, [esp + 0x1060]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
jne 0x401539
movups xmm0, xmmword [str.Unable_to_get_logical_drives_n]
mov eax, dword [0x418c20]
mov dword [esp + 0x1780], eax
mov ax, word [0x418c24]
movups xmmword [esp + 0x1768], xmm0
mov word [esp + 0x1784], ax
movq xmm0, qword [0x418c18]
movq qword [esp + 0x1778], xmm0
jmp 0x401701
lea ecx, [esp + 0x1768]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401543
sub ecx, edx
mov eax, esi
sub eax, ecx
push eax
lea eax, [esp + 0x176c]
push str.Drives_and_root_directories:_n
push eax
call fcn.004053f0
add esp, 0xc
lea ebx, [esp + 0x1060]
cmp byte [esp + 0x1060], 0
mov dword [esp + 0x10], ebx
je 0x401701
nop
lea ecx, [esp + 0x1768]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401590
sub ecx, edx
cmp ecx, 0xfffe
jae 0x4016fd
mov eax, esi
sub eax, ecx
push eax
lea eax, [esp + 0x176c]
push ebx
push eax
call fcn.004053f0
lea ecx, [esp + 0x1774]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4015c5
sub ecx, edx
mov eax, esi
sub eax, ecx
push eax
lea eax, [esp + 0x176c]
push 0x418c48
push eax
call fcn.004053f0
lea ecx, [esp + 0x1774]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4015f2
push ebx
push str._s.
lea eax, [esp + 0x1168]
sub ecx, edx
push 0x104
mov esi, 0xffff
push eax
sub esi, ecx
call fcn.00401050
add esp, 0x10
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x1164]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x401655
lea eax, [esi - 1]
push eax
lea eax, [esp + 0x176c]
push str.Unable_to_open_drive_root_n
push eax
call fcn.004053f0
add esp, 0xc
jmp 0x4016d7
mov ebx, str.Dir:__s_n
nop word [eax + eax]
test byte [esp + 0x60], 0x10
lea eax, [esp + 0x8c]
push eax
mov eax, str.File:__s_n
cmovne eax, ebx
push eax
lea eax, [esp + 0x1168]
push 0x104
push eax
call fcn.00401050
lea ecx, [esp + 0x1778]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401695
sub ecx, edx
mov eax, esi
sub eax, ecx
dec eax
push eax
lea eax, [esp + 0x1164]
push eax
lea eax, [esp + 0x1770]
push eax
call fcn.004053f0
add esp, 0xc
lea eax, [esp + 0x60]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401660
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [esp + 0x10]
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4016e0
sub ecx, edx
inc ebx
add ebx, ecx
mov esi, 0xfffe
mov dword [esp + 0x10], ebx
cmp byte [ebx], al
jne 0x401580
mov edi, dword [esp + 0x14]
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401706
sub ecx, edx
lea eax, [esp + 0x1768]
sub esi, ecx
push esi
push eax
push edi
call fcn.004053f0
add esp, 0xc
lea eax, [esp + 0x1064]
xor esi, esi
push 0x98
push esi
push eax
call fcn.004029e0
add esp, 0xc
mov dword [esp + 0x1060], 0x9c
lea eax, [esp + 0x1060]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4017a7
lea eax, [esp + 0x10]
mov dword [esp + 0x10], esi
push eax
push esi
push esi
push dword [esp + 0x1074]
push dword [esp + 0x1074]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
test eax, eax
je 0x4017a7
mov eax, dword [esp + 0x10]
cmp eax, 8
je 0x4017e2
cmp eax, 7
je 0x4017e2
cmp eax, 0xa
je 0x4017e2
cmp eax, 0x11
je 0x4017e2
cmp eax, 0xc
je 0x4017e2
cmp eax, 0xd
je 0x4017e2
cmp eax, 0xe
je 0x4017e2
cmp eax, 0x1d
je 0x4017e2
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x4017e0
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
cmp ecx, dword [0x41b2d8]
jne 0x4017ce
cmp eax, dword [0x41b2dc]
je 0x4017e0
mov dword [0x41b2d8], ecx
mov esi, 1
mov dword [0x41b2dc], eax
jmp 0x4017e2
xor esi, esi
test esi, esi
mov eax, 0x418c80
mov ebx, 0x418c84
cmove eax, ebx
push eax
push str.Mouse_Moved:__s_n
lea eax, [esp + 0x1470]
push 0xffff
push eax
call fcn.00401050
mov ecx, edi
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401811
sub ecx, edx
mov eax, 0xfffe
sub eax, ecx
push eax
lea eax, [esp + 0x146c]
push eax
push edi
call fcn.004053f0
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
add esp, 0xc
call esi
push 0x493e0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
sub eax, edi
movd xmm0, eax
shr eax, 0x1f
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x418e10]
xor eax, eax
comisd xmm0, xmmword [0x418e00]
setb al
test eax, eax
mov eax, 0x418c80
cmove ebx, eax
lea eax, [esp + 0x1668]
push ebx
push str.Sandbox_Time_Acceleration_Detected:__s_n
push 0x100
push eax
call fcn.00401050
mov esi, dword [esp + 0x24]
add esp, 0x10
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4018a0
sub ecx, edx
mov eax, 0xfffe
sub eax, ecx
push eax
lea eax, [esp + 0x166c]
push eax
push esi
call fcn.004053f0
mov ecx, dword [esp + 0x5778]
add esp, 0xc
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401bb5
mov esp, ebp
pop ebp
ret