Function at 0x1400015ce
Capabilities:
Check if process is running under wine
Check os version
Hide graphical window

Disassembly:
push rbp
sub rsp, 0x570
lea rbp, [rsp + 0x80]
call fcn.140005fe0
mov word [rbp + 0x4ee], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 6
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, str.Start
mov rcx, rax
call fcn.140002557
mov edx, 0
lea rax, str.analysis_start
mov rcx, rax
call fcn.1400027f1
call fcn.14000233e
mov word [rbp + 0x4ee], ax
call fcn.1400023c6
mov dword [rbp - 0x50], 0x94
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetVersionExA]
call rax
mov ecx, dword [rbp - 0x44]
mov edx, dword [rbp - 0x48]
mov r8d, dword [rbp - 0x4c]
lea rax, [rbp + 0x4a0]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
mov r9d, r8d
lea r8, str._lu._lu_build__lu
mov edx, 0x3f
mov rcx, rax
call fcn.140001584
lea rax, [rbp + 0x93]
mov rcx, rax
call fcn.1400051f8
lea rax, [rbp + 0x86]
mov rcx, rax
call fcn.140005217
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.140005236
lea rax, [rbp + 0x4a0]
mov rdx, rax
lea rax, str.____Windows_version:__s_n
mov rcx, rax
call fcn.140001530
lea rax, str.____Running_in_WoW64:
mov rcx, rax
call fcn.140001530
call fcn.1400029e6
test eax, eax
je 0x14000171a
lea rax, str.True_n
mov rcx, rax
call fcn.140001530
lea rax, [rbp + 0x4a0]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov rdx, rax
lea rax, [rbp + 0x4a0]
add rax, rdx
movabs rdx, 0x293436576f572820
mov qword [rax], rdx
mov byte [rax + 8], 0
jmp 0x140001758
lea rax, str.False_n
mov rcx, rax
call fcn.140001530
lea rax, [rbp + 0x4a0]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov rdx, rax
lea rax, [rbp + 0x4a0]
add rax, rdx
movabs rdx, 0x65766974616e2820
mov qword [rax], rdx
mov word [rax + 8], 0x29
lea rax, [rbp + 0x93]
mov rdx, rax
lea rax, str.____CPU:__s_n
mov rcx, rax
call fcn.140001530
lea rax, [rbp + 0x86]
movzx eax, byte [rax]
test al, al
je 0x140001798
lea rax, [rbp + 0x86]
mov rdx, rax
lea rax, str.____Hypervisor:__s_n
mov rcx, rax
call fcn.140001530
lea rax, [rbp + 0x50]
mov rdx, rax
lea rax, str.____CPU_brand:__s_n
mov rcx, rax
call fcn.140001530
lea rdx, [rbp + 0x4a0]
lea rax, [rbp + 0xa0]
mov r9, rdx
lea r8, str.Windows_version:__s
mov edx, 0x3ff
mov rcx, rax
call fcn.140001584
lea rax, [rbp + 0xa0]
mov rcx, rax
call fcn.140002557
lea rax, [rbp + 0x86]
movzx eax, byte [rax]
test al, al
je 0x14000182c
lea rcx, [rbp + 0x93]
lea rax, [rbp + 0xa0]
lea rdx, [rbp + 0x50]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0x86]
mov qword [rsp + 0x20], rdx
mov r9, rcx
lea r8, str.CPU:__s__HV:__s___s
mov edx, 0x3ff
mov rcx, rax
call fcn.140001584
jmp 0x14000185a
lea rcx, [rbp + 0x93]
lea rax, [rbp + 0xa0]
lea rdx, [rbp + 0x50]
mov qword [rsp + 0x20], rdx
mov r9, rcx
lea r8, str.CPU:__s__s
mov edx, 0x3ff
mov rcx, rax
call fcn.140001584
lea rax, [rbp + 0xa0]
mov rcx, rax
call fcn.140002557
lea rax, str.Debuggers_detection
mov rcx, rax
call fcn.140002858
lea r9, str.hi_debugger_isdebuggerpresent
lea r8, str.Debugger_traced_using_IsDebuggerPresent__
mov rax, qword [0x140011570]
mov rdx, rax
lea rax, str.Using_IsDebuggerPresent__
mov rcx, rax
call fcn.140002881
lea r9, str.hi_debugger_beingdebugged_PEB
lea r8, str.Debugger_traced_using_PEB_BeingDebugged
mov rax, qword [0x140011560]
mov rdx, rax
lea rax, str.Using_BeingDebugged_via_PEB_access
mov rcx, rax
call fcn.140002881
mov eax, dword [rbp - 0x4c]
cmp eax, 5
ja 0x1400018f5
lea r9, str.hi_debugger_outputdebugstring
lea r8, str.Debugger_traced_using_OutputDebugString__
mov rax, qword [0x140011580]
mov rdx, rax
lea rax, str.Using_OutputDebugString__
mov rcx, rax
call fcn.140002881
lea rax, str.CPU_information_based_detections
mov rcx, rax
call fcn.140002858
lea r9, str.hi_CPU_VM_rdtsc
lea r8, str.CPU_VM_traced_by_checking_the_difference_between_CPU_timestamp_counters__rdtsc_
mov rax, qword [0x140011540]
mov rdx, rax
lea rax, str.Checking_the_difference_between_CPU_timestamp_counters__rdtsc_
mov rcx, rax
call fcn.140002881
lea r9, str.hi_CPU_VM_rdtsc_force_vm_exit
lea r8, str.CPU_VM_traced_by_checking_the_difference_between_CPU_timestamp_counters__rdtsc__forcing_VM_exit
mov rax, qword [0x140011550]
mov rdx, rax
lea rax, str.Checking_the_difference_between_CPU_timestamp_counters__rdtsc__forcing_VM_exit
mov rcx, rax
call fcn.140002881
lea r9, str.hi_CPU_VM_hypervisor_bit
lea r8, str.CPU_VM_traced_by_checking_hypervisor_bit_in_cpuid_feature_bits
mov rax, qword [0x140011520]
mov rdx, rax
lea rax, str.Checking_hypervisor_bit_in_cpuid_feature_bits
mov rcx, rax
call fcn.140002881
lea r9, str.hi_CPU_VM_hv_vendor_name
lea r8, str.CPU_VM_traced_by_checking_cpuid_hypervisor_vendor_for_known_VM_vendors
mov rax, qword [0x140011530]
mov rdx, rax
lea rax, str.Checking_cpuid_hypervisor_vendor_for_known_VM_vendors
mov rcx, rax
call fcn.140002881
lea rax, str.Generic_reverse_turing_tests
mov rcx, rax
call fcn.140002858
lea r9, str.hi_sandbox_mouse_presence
lea r8, str.Sandbox_traced_by_absence_of_mouse_device
mov rax, qword [0x1400116b0]
mov rdx, rax
lea rax, str.Checking_mouse_presence
mov rcx, rax
call fcn.140002881
lea r9, str.hi_sandbox_rtt_mouse_movement
lea r8, str.Sandbox_traced_by_missing_mouse_movement
mov rax, qword [0x1400116a0]
mov rdx, rax
lea rax, str.Checking_mouse_movement
mov rcx, rax
call fcn.140002881
lea r9, str.hi_sandbox_rtt_mouse_speed_limit
lea r8, str.Sandbox_traced_by_missing_mouse_movement_or_supernatural_speed
mov rax, qword [0x1400116c0]
mov rdx, rax
lea rax, str.Checking_mouse_speed
mov rcx, rax
call fcn.140002881
lea r9, str.hi_sandbox_rtt_mouse_click
lea r8, str.Sandbox_traced_by_missing_mouse_click_activity
mov rax, qword [0x140011680]
mov rdx, rax
lea rax, str.Checking_mouse_click_activity
mov rcx, rax
call fcn.140002881
lea r9, str.hi_sandbox_rtt_mouse_double_click
lea r8, str.Sandbox_traced_by_missing_double_click_activity
mov rax, qword [0x140011690]
mov rdx, rax
lea rax, str.Checking_mouse_double_click_activity
mov rcx, rax
call fcn.140002881
lea r9, str.hi_sandbox_rtt_confirm_dialog
lea r8, str.Sandbox_traced_by_missing_dialog_confirmation
mov rax, qword [0x140011670]
mov rdx, rax
lea rax, str.Checking_dialog_confirmation
mov rcx, rax
call fcn.140002881
lea r9, str.hi_sandbox_rtt_implausible_confirm_dialog
lea r8, str.Sandbox_traced_by_missing_or_implausible_dialog_confirmation
mov rax, qword [0x1400116d0]
mov rdx, rax
lea rax, str.Checking_plausible_dialog_confirmation
mov rcx, rax
call fcn.140002881
lea rax, str.Generic_sandbox_detection
mov rcx, rax
call fcn.140002858
lea r9, str.hi_sandbox_username
lea r8, str.Sandbox_traced_by_checking_username
mov rax, qword [0x140011630]
mov rdx, rax
lea rax, str.Checking_username
mov rcx, rax
call fcn.140002881
lea r9, str.hi_sandbox_path
lea r8, str.Sandbox_traced_by_checking_file_path___VirtualBox_traced_using_Reg_key_HKLMHARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0__Identifier_
mov rax, qword [0x140011600]
mov rdx, rax
lea rax, str.Checking_file_path
mov rcx, rax
call fcn.140002881
lea r9, str.hi_sandbox_common_names
lea r8, str.Sandbox_traced_by_checking_common_sample_names_in_drives_root
mov rax, qword [0x1400115a0]
mov rdx, rax
lea rax, str.Checking_common_sample_names_in_drives_root
mov rcx, rax
call fcn.140002881
lea r9, str.hi_sandbox_drive_size
lea r8, str.Sandbox_traced_by_checking_disk_size___60GB_via_DeviceIoControl__
mov rax, qword [0x1400115b0]
mov rdx, rax
lea rax, str.Checking_if_disk_size___60GB_via_DeviceIoControl__
mov rcx, rax
call fcn.140002881
lea r9, str.hi_sandbox_drive_size2
lea r8, str.Sandbox_traced_by_checking_disk_size___60GB_via_GetDiskFreeSpaceExA__
mov rax, qword [0x1400115c0]
mov rdx, rax
lea rax, str.Checking_if_disk_size___60GB_via_GetDiskFreeSpaceExA__
mov rcx, rax
call fcn.140002881
lea r9, str.hi_sandbox_sleep_gettickcount
lea r8, str.Sandbox_traced_by_checking_if_Sleep___was_patched_using_GetTickCount__
mov rax, qword [0x140011610]
mov rdx, rax
lea rax, str.Checking_if_Sleep___is_patched_using_GetTickCount__
mov rcx, rax
call fcn.140002881
lea r9, str.hi_sandbox_NumberOfProcessors_less_2_PEB
lea r8, str.Sandbox_traced_by_checking_if_NumberOfProcessors_is_less_than_2_via_PEB_access
mov rax, qword [0x1400115e0]
mov rdx, rax
lea rax, str.Checking_if_NumberOfProcessors_is___2_via_PEB_access
mov rcx, rax
call fcn.140002881
lea r9, str.hi_sandbox_NumberOfProcessors_less_2_GetSystemInfo
lea r8, str.Sandbox_traced_by_checking_if_NumberOfProcessors_is_less_than_2_via_GetSystemInfo__
mov rax, qword [0x1400115f0]
mov rdx, rax
lea rax, str.Checking_if_NumberOfProcessors_is___2_via_GetSystemInfo__
mov rcx, rax
call fcn.140002881
lea r9, str.hi_sandbox_pysicalmemory_less_1Gb
lea r8, str.Sandbox_traced_by_checking_if_pysical_memory_is_less_than_1Gb
mov rax, qword [0x1400115d0]
mov rdx, rax
lea rax, str.Checking_if_pysical_memory_is___1Gb
mov rcx, rax
call fcn.140002881
lea r9, str.hi_sandbox_uptime
lea r8, str.Sandbox_traced_by_checking_operating_system_uptime_using_GetTickCount__
mov rax, qword [0x140011620]
mov rdx, rax
lea rax, str.Checking_operating_system_uptime_using_GetTickCount__
mov rcx, rax
call fcn.140002881
lea r9, str.hi_sandbox_IsNativeVhdBoot
lea r8, str.Sandbox_traced_by_checking_IsNativeVhdBoot__
mov rax, qword [0x140011590]
mov rdx, rax
lea rax, str.Checking_if_operating_system_IsNativeVhdBoot__
mov rcx, rax
call fcn.140002881
lea rax, str.Sandboxie_detection
mov rcx, rax
call fcn.140002858
lea r9, str.hi_sandboxie
lea r8, str.Sandboxie_traced_using_GetModuleHandle_sbiedll.dll_
mov rax, qword [0x1400116e0]
mov rdx, rax
lea rax, str.Using_GetModuleHandle_sbiedll.dll_
mov rcx, rax
call fcn.140002881
lea rax, str.Wine_detection
mov rcx, rax
call fcn.140002858
lea r9, str.hi_wine
lea r8, str.Wine_traced_using_GetProcAddress_wine_get_unix_file_name__from_kernel32.dll
mov rax, qword [0x140011880]
mov rdx, rax
lea rax, str.Using_GetProcAddress_wine_get_unix_file_name__from_kernel32.dll
mov rcx, rax
call fcn.140002881
lea r9, str.hi_wine
lea r8, str.Wine_traced_using_Reg_key_HKCUSOFTWAREWine
mov rax, qword [0x140011890]
mov rdx, rax
lea rax, str.Reg_key__HKCUSOFTWAREWine_
mov rcx, rax
call fcn.140002881
lea rax, str.VirtualBox_detection
mov rcx, rax
call fcn.140002858
lea r9, str.hi_virtualbox
lea r8, str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0__Identifier_
mov rax, qword [0x140011730]
mov rdx, rax
lea rax, str.Scsi_port__bus__target_id__logical_unit_id___0_identifier
mov rcx, rax
call fcn.140002881
lea r9, str.hi_virtualbox
lea r8, str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREDescriptionSystem__SystemBiosVersion_
mov rax, qword [0x140011750]
mov rdx, rax
lea rax, str.Reg_key__HKLMHARDWAREDescriptionSystem__SystemBiosVersion__
mov rcx, rax
call fcn.140002881
lea r9, str.hi_virtualbox
lea r8, str.VirtualBox_traced_using_Reg_key_HKLMSOFTWAREOracleVirtualBox_Guest_Additions
mov rax, qword [0x140011760]
mov rdx, rax
lea rax, str.Reg_key__HKLMSOFTWAREOracleVirtualBox_Guest_Additions_
mov rcx, rax
call fcn.140002881
lea r9, str.hi_virtualbox
lea r8, str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREDescriptionSystem__VideoBiosVersion_
mov rax, qword [0x140011770]
mov rdx, rax
lea rax, str.Reg_key__HKLMHARDWAREDescriptionSystem__VideoBiosVersion__
mov rcx, rax
call fcn.140002881
lea r9, str.hi_virtualbox
lea r8, str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREACPIDSDTVBOX__
mov rax, qword [0x140011780]
mov rdx, rax
lea rax, str.Reg_key__HKLMHARDWAREACPIDSDTVBOX___
mov rcx, rax
call fcn.140002881
lea r9, str.hi_virtualbox
lea r8, str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREACPIFADTVBOX__
mov rax, qword [0x140011790]
mov rdx, rax
lea rax, str.Reg_key__HKLMHARDWAREACPIFADTVBOX___
mov rcx, rax
call fcn.140002881
lea r9, str.hi_virtualbox
lea r8, str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREACPIRSDTVBOX__
mov rax, qword [0x1400117a0]
mov rdx, rax
lea rax, str.Reg_key__HKLMHARDWAREACPIRSDTVBOX___
mov rcx, rax
call fcn.140002881
lea r9, str.hi_virtualbox
mov r8d, 0
mov rax, qword [0x1400117b0]
mov rdx, rax
lea rax, str.Reg_key__HKLMSYSTEMControlSet001ServicesVBox_
mov rcx, rax
call fcn.140002881
lea r9, str.hi_virtualbox
lea r8, str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREDESCRIPTIONSystem__SystemBiosDate_
mov rax, qword [0x140011740]
mov rdx, rax
lea rax, str.Reg_key__HKLMHARDWAREDESCRIPTIONSystem__SystemBiosDate__
mov rcx, rax
call fcn.140002881
lea r9, str.hi_virtualbox
mov r8d, 0
mov rax, qword [0x1400117c0]
mov rdx, rax
lea rax, str.Driver_files_in_C:WINDOWS_system32driversVBox
mov rcx, rax
call fcn.140002881
lea r9, str.hi_virtualbox
mov r8d, 0
mov rax, qword [0x1400117d0]
mov rdx, rax
lea rax, str.Additional_system_files
mov rcx, rax
call fcn.140002881
lea r9, str.hi_virtualbox
lea r8, str.VirtualBox_traced_using_MAC_address_starting_with_08:00:27
mov rax, qword [0x140011700]
mov rdx, rax
lea rax, str.Looking_for_a_MAC_address_starting_with_08:00:27
mov rcx, rax
call fcn.140002881
lea r9, str.hi_virtualbox
mov r8d, 0
mov rax, qword [0x1400116f0]
mov rdx, rax
lea rax, str.Looking_for_pseudo_devices
mov rcx, rax
call fcn.140002881
lea r9, str.hi_virtualbox
lea r8, str.VirtualBox_traced_using_VBoxTray_windows
mov rax, qword [0x1400117e0]
mov rdx, rax
lea rax, str.Looking_for_VBoxTray_windows
mov rcx, rax
call fcn.140002881
lea r9, str.hi_virtualbox
lea r8, str.VirtualBox_traced_using_its_network_share
mov rax, qword [0x140011710]
mov rdx, rax
lea rax, str.Looking_for_VBox_network_share
mov rcx, rax
call fcn.140002881
lea r9, str.hi_virtualbox
mov r8d, 0
mov rax, qword [0x140011720]
mov rdx, rax
lea rax, str.Looking_for_VBox_processes__vboxservice.exe__vboxtray.exe_
mov rcx, rax
call fcn.140002881
lea r9, str.hi_virtualbox
lea r8, str.VirtualBox_device_identifiers_traced_using_WMI
mov rax, qword [0x1400117f0]
mov rdx, rax
lea rax, str.Looking_for_VBox_devices_using_WMI
mov rcx, rax
call fcn.140002881
lea rax, str.VMware_detection
mov rcx, rax
call fcn.140002858
lea r9, str.hi_vmware
lea r8, str.VMWare_traced_using_Reg_key_HKLMHARDWAREDEVICEMAPScsiScsi_Port_0_1_2Scsi_Bus_0Target_Id_0Logical_Unit_Id_0__Identifier_
mov rax, qword [0x140011830]
mov rdx, rax
lea rax, str.Scsi_port_0_1_2___bus__target_id__logical_unit_id___0_identifier
mov rcx, rax
call fcn.140002881
lea r9, str.hi_vmware
lea r8, str.VMware_traced_using_Reg_key_HKLMSOFTWAREVMware__Inc.VMware_Tools
mov rax, qword [0x140011840]
mov rdx, rax
lea rax, str.Reg_key__HKLMSOFTWAREVMware__Inc.VMware_Tools_
mov rcx, rax
call fcn.140002881
lea r9, str.hi_vmware
lea r8, str.VMware_traced_using_file_C:WINDOWS_system32drivers_vmmouse.sys
mov rax, qword [0x140011850]
mov rdx, rax
lea rax, str.Looking_for_C:WINDOWS_system32drivers_vmmouse.sys
mov rcx, rax
call fcn.140002881
lea r9, str.hi_vmware
lea r8, str.VMware_traced_using_file_C:WINDOWS_system32drivers_vmhgfs.sys
mov rax, qword [0x140011860]
mov rdx, rax
lea rax, str.Looking_for_C:WINDOWS_system32drivers_vmhgfs.sys
mov rcx, rax
call fcn.140002881
lea r9, str.hi_vmware
lea r8, str.VMware_traced_using_MAC_address_starting_with_00:05:69__00:0C:29__00:1C:14_or_00:50:56
mov rax, qword [0x140011820]
mov rdx, rax
lea rax, str.Looking_for_a_MAC_address_starting_with_00:05:69__00:0C:29__00:1C:14_or_00:50:56
mov rcx, rax
call fcn.140002881
lea r9, str.hi_vmware
lea r8, str.VMware_traced_using_network_adapter_name
mov rax, qword [0x140011800]
mov rdx, rax
lea rax, str.Looking_for_network_adapter_name
mov rcx, rax
call fcn.140002881
lea r9, str.hi_vmware
mov r8d, 0
mov rax, qword [0x140011810]
mov rdx, rax
lea rax, str.Looking_for_pseudo_devices
mov rcx, rax
call fcn.140002881
lea r9, str.hi_vmware
lea r8, str.VMware_serial_number_traced_using_WMI
mov rax, qword [0x140011870]
mov rdx, rax
lea rax, str.Looking_for_VMware_serial_number
mov rcx, rax
call fcn.140002881
lea rax, str.Qemu_detection
mov rcx, rax
call fcn.140002858
lea r9, str.hi_qemu
lea r8, str.Qemu_traced_using_Reg_key_HKLMHARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0__Identifier_
mov rax, qword [0x140011650]
mov rdx, rax
lea rax, str.Scsi_port__bus__target_id__logical_unit_id___0_identifier
mov rcx, rax
call fcn.140002881
lea r9, str.hi_qemu
lea r8, str.Qemu_traced_using_Reg_key_HKLMHARDWAREDescriptionSystem__SystemBiosVersion_
mov rax, qword [0x140011660]
mov rdx, rax
lea rax, str.Reg_key__HKLMHARDWAREDescriptionSystem__SystemBiosVersion__
mov rcx, rax
call fcn.140002881
lea r9, str.hi_qemu
lea r8, str.Qemu_traced_using_CPU_brand_string_QEMU_Virtual_CPU
mov rax, qword [0x140011640]
mov rdx, rax
lea rax, str.cpuid_CPU_brand_string_QEMU_Virtual_CPU
mov rcx, rax
call fcn.140002881
lea rax, str.Bochs_detection
mov rcx, rax
call fcn.140002858
lea r9, str.hi_bochs
lea r8, str.Bochs_traced_using_Reg_key_HKLMHARDWAREDescriptionSystem__SystemBiosVersion_
mov rax, qword [0x140011510]
mov rdx, rax
lea rax, str.Reg_key__HKLMHARDWAREDescriptionSystem__SystemBiosVersion__
mov rcx, rax
call fcn.140002881
lea r9, str.hi_bochs
lea r8, str.Bochs_traced_using_CPU_AMD_wrong_value_for_processor_name
mov rax, qword [0x1400114f0]
mov rdx, rax
lea rax, str.cpuid_AMD_wrong_value_for_processor_name
mov rcx, rax
call fcn.140002881
lea r9, str.hi_bochs
lea r8, str.Bochs_traced_using_CPU_Intel_wrong_value_for_processor_name
mov rax, qword [0x140011500]
mov rdx, rax
lea rax, str.cpuid_Intel_wrong_value_for_processor_name
mov rcx, rax
call fcn.140002881
lea rax, [0x14000fd63]
mov rcx, rax
call fcn.140001530
lea rax, str.____Pafish_has_finished_analyzing_the_system__check_the_log_file_for_more_information_n
mov rcx, rax
call fcn.140001530
lea rax, str.____and_visit_the_projects_site:_n_n
mov rcx, rax
call fcn.140001530
lea rax, str.____https:__github.com_a0rtega_pafish_n
mov rcx, rax
call fcn.140001530
lea rax, [0x14000fe0f]
mov rcx, rax
call fcn.140002557
mov edx, 0
lea rax, str._analysis_end
mov rcx, rax
call fcn.1400027f1
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 9
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
call sub.msvcrt.dll_getchar
movzx eax, word [rbp + 0x4ee]
mov ecx, eax
call fcn.14000238b
mov eax, 0
add rsp, 0x570
pop rbp
ret