Function at 0x4014c0
Capabilities:
Check if process is running under wine
Check os version
Hide graphical window

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x554
call fcn.004057a0
mov word [ebp - 0xa], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call eax
mov dword [esp + 4], 6
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov dword [esp], str.Start
call fcn.004023b6
mov dword [esp], 0x40e006
call fcn.00402466
mov dword [esp + 4], 0
mov dword [esp], str.analysis_start
call fcn.00402575
call fcn.004021a8
mov word [ebp - 0xa], ax
call fcn.00402233
mov dword [ebp - 0x52c], 0x94
lea eax, [ebp - 0x52c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetVersionExA]
call eax
sub esp, 4
mov ecx, dword [ebp - 0x520]
mov edx, dword [ebp - 0x524]
mov eax, dword [ebp - 0x528]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._lu._lu_build__lu
mov dword [esp + 4], 0x3f
lea eax, [ebp - 0x4a]
mov dword [esp], eax
call fcn.0040148c
lea eax, [ebp - 0x457]
mov dword [esp], eax
call fcn.00404a43
lea eax, [ebp - 0x464]
mov dword [esp], eax
call fcn.00404a57
lea eax, [ebp - 0x495]
mov dword [esp], eax
call fcn.00404a6b
lea eax, [ebp - 0x4a]
mov dword [esp + 4], eax
mov dword [esp], str.____Windows_version:__s_n
call fcn.00401450
mov dword [esp], str.____Running_in_WoW64:
call fcn.00401450
call fcn.004026fa
test eax, eax
je 0x40160e
mov dword [esp], str.True_n
call fcn.00401450
lea eax, [ebp - 0x4a]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, eax
lea eax, [ebp - 0x4a]
add eax, edx
mov dword [eax], 0x6f572820
mov dword [eax + 4], 0x29343657
mov byte [eax + 8], 0
jmp 0x40163f
mov dword [esp], str.False_n
call fcn.00401450
lea eax, [ebp - 0x4a]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, eax
lea eax, [ebp - 0x4a]
add eax, edx
mov dword [eax], 0x616e2820
mov dword [eax + 4], 0x65766974
mov word [eax + 8], 0x29
lea eax, [ebp - 0x457]
mov dword [esp + 4], eax
mov dword [esp], str.____CPU:__s_n
call fcn.00401450
lea eax, [ebp - 0x464]
movzx eax, byte [eax]
test al, al
je 0x401678
lea eax, [ebp - 0x464]
mov dword [esp + 4], eax
mov dword [esp], str.____Hypervisor:__s_n
call fcn.00401450
lea eax, [ebp - 0x495]
mov dword [esp + 4], eax
mov dword [esp], str.____CPU_brand:__s_n
call fcn.00401450
lea eax, [ebp - 0x4a]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Windows_version:__s
mov dword [esp + 4], 0x3ff
lea eax, [ebp - 0x44a]
mov dword [esp], eax
call fcn.0040148c
lea eax, [ebp - 0x44a]
mov dword [esp], eax
call fcn.004023b6
lea eax, [ebp - 0x464]
movzx eax, byte [eax]
test al, al
je 0x40170c
lea eax, [ebp - 0x495]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x464]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x457]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.CPU:__s__HV:__s___s
mov dword [esp + 4], 0x3ff
lea eax, [ebp - 0x44a]
mov dword [esp], eax
call fcn.0040148c
jmp 0x40173e
lea eax, [ebp - 0x495]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x457]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.CPU:__s__s
mov dword [esp + 4], 0x3ff
lea eax, [ebp - 0x44a]
mov dword [esp], eax
call fcn.0040148c
lea eax, [ebp - 0x44a]
mov dword [esp], eax
call fcn.004023b6
mov dword [esp], str.Debuggers_detection
call fcn.004025c2
mov dword [esp + 0xc], str.hi_debugger_isdebuggerpresent
mov dword [esp + 8], str.Debugger_traced_using_IsDebuggerPresent__
mov dword [esp + 4], 0x402fb4
mov dword [esp], str.Using_IsDebuggerPresent__
call fcn.004025de
mov dword [esp + 0xc], str.hi_debugger_beingdebugged_PEB
mov dword [esp + 8], str.Debugger_traced_using_PEB_BeingDebugged
mov dword [esp + 4], 0x40301b
mov dword [esp], str.Using_BeingDebugged_via_PEB_access
call fcn.004025de
mov eax, dword [ebp - 0x528]
cmp eax, 5
ja 0x4017cf
mov dword [esp + 0xc], str.hi_debugger_outputdebugstring
mov dword [esp + 8], str.Debugger_traced_using_OutputDebugString__
mov dword [esp + 4], 0x402fd3
mov dword [esp], str.Using_OutputDebugString__
call fcn.004025de
mov dword [esp], str.CPU_information_based_detections
call fcn.004025c2
mov dword [esp + 0xc], str.hi_CPU_VM_rdtsc
mov dword [esp + 8], str.CPU_VM_traced_by_checking_the_difference_between_CPU_timestamp_counters__rdtsc_
mov dword [esp + 4], 0x4048dd
mov dword [esp], str.Checking_the_difference_between_CPU_timestamp_counters__rdtsc_
call fcn.004025de
mov dword [esp + 0xc], str.hi_CPU_VM_rdtsc_force_vm_exit
mov dword [esp + 8], str.CPU_VM_traced_by_checking_the_difference_between_CPU_timestamp_counters__rdtsc__forcing_VM_exit
mov dword [esp + 4], 0x404987
mov dword [esp], str.Checking_the_difference_between_CPU_timestamp_counters__rdtsc__forcing_VM_exit
call fcn.004025de
mov dword [esp + 0xc], str.hi_CPU_VM_hypervisor_bit
mov dword [esp + 8], str.CPU_VM_traced_by_checking_hypervisor_bit_in_cpuid_feature_bits
mov dword [esp + 4], 0x404a31
mov dword [esp], str.Checking_hypervisor_bit_in_cpuid_feature_bits
call fcn.004025de
mov dword [esp + 0xc], str.hi_CPU_VM_hv_vendor_name
mov dword [esp + 8], str.CPU_VM_traced_by_checking_cpuid_hypervisor_vendor_for_known_VM_vendors
mov dword [esp + 4], 0x404ad6
mov dword [esp], str.Checking_cpuid_hypervisor_vendor_for_known_VM_vendors
call fcn.004025de
mov dword [esp], str.Generic_reverse_turing_tests
call fcn.004025c2
mov dword [esp + 0xc], str.hi_sandbox_mouse_presence
mov dword [esp + 8], str.Sandbox_traced_by_absence_of_mouse_device
mov dword [esp + 4], 0x404d00
mov dword [esp], str.Checking_mouse_presence
call fcn.004025de
mov dword [esp + 0xc], str.hi_sandbox_rtt_mouse_movement
mov dword [esp + 8], str.Sandbox_traced_by_missing_mouse_movement
mov dword [esp + 4], 0x404d26
mov dword [esp], str.Checking_mouse_movement
call fcn.004025de
mov dword [esp + 0xc], str.hi_sandbox_rtt_mouse_speed_limit
mov dword [esp + 8], str.Sandbox_traced_by_missing_mouse_movement_or_supernatural_speed
mov dword [esp + 4], 0x404ddf
mov dword [esp], str.Checking_mouse_speed
call fcn.004025de
mov dword [esp + 0xc], str.hi_sandbox_rtt_mouse_click
mov dword [esp + 8], str.Sandbox_traced_by_missing_mouse_click_activity
mov dword [esp + 4], 0x4051c5
mov dword [esp], str.Checking_mouse_click_activity
call fcn.004025de
mov dword [esp + 0xc], str.hi_sandbox_rtt_mouse_double_click
mov dword [esp + 8], str.Sandbox_traced_by_missing_double_click_activity
mov dword [esp + 4], 0x4051d9
mov dword [esp], str.Checking_mouse_double_click_activity
call fcn.004025de
mov dword [esp + 0xc], str.hi_sandbox_rtt_confirm_dialog
mov dword [esp + 8], str.Sandbox_traced_by_missing_dialog_confirmation
mov dword [esp + 4], 0x4056c5
mov dword [esp], str.Checking_dialog_confirmation
call fcn.004025de
mov dword [esp + 0xc], str.hi_sandbox_rtt_implausible_confirm_dialog
mov dword [esp + 8], str.Sandbox_traced_by_missing_or_implausible_dialog_confirmation
mov dword [esp + 4], 0x4056d9
mov dword [esp], str.Checking_plausible_dialog_confirmation
call fcn.004025de
mov dword [esp], str.Generic_sandbox_detection
call fcn.004025c2
mov dword [esp + 0xc], str.hi_sandbox_username
mov dword [esp + 8], str.Sandbox_traced_by_checking_username
mov dword [esp + 4], 0x4039cc
mov dword [esp], str.Checking_username
call fcn.004025de
mov dword [esp + 0xc], str.hi_sandbox_path
mov dword [esp + 8], str.Sandbox_traced_by_checking_file_path
mov dword [esp + 4], 0x403ab0
mov dword [esp], str.Checking_file_path
call fcn.004025de
mov dword [esp + 0xc], str.hi_sandbox_common_names
mov dword [esp + 8], str.Sandbox_traced_by_checking_common_sample_names_in_drives_root
mov dword [esp + 4], 0x403b96
mov dword [esp], str.Checking_common_sample_names_in_drives_root
call fcn.004025de
mov dword [esp + 0xc], str.hi_sandbox_drive_size
mov dword [esp + 8], str.Sandbox_traced_by_checking_disk_size___60GB_via_DeviceIoControl__
mov dword [esp + 4], 0x403ced
mov dword [esp], str.Checking_if_disk_size___60GB_via_DeviceIoControl__
call fcn.004025de
mov dword [esp + 0xc], str.hi_sandbox_drive_size2
mov dword [esp + 8], str.Sandbox_traced_by_checking_disk_size___60GB_via_GetDiskFreeSpaceExA__
mov dword [esp + 4], 0x403dde
mov dword [esp], str.Checking_if_disk_size___60GB_via_GetDiskFreeSpaceExA__
call fcn.004025de
mov dword [esp + 0xc], str.hi_sandbox_sleep_gettickcount
mov dword [esp + 8], str.Sandbox_traced_by_checking_if_Sleep___was_patched_using_GetTickCount__
mov dword [esp + 4], 0x403e38
mov dword [esp], str.Checking_if_Sleep___is_patched_using_GetTickCount__
call fcn.004025de
mov dword [esp + 0xc], str.hi_sandbox_NumberOfProcessors_less_2_PEB
mov dword [esp + 8], str.Sandbox_traced_by_checking_if_NumberOfProcessors_is_less_than_2_via_PEB_access
mov dword [esp + 4], 0x403e78
mov dword [esp], str.Checking_if_NumberOfProcessors_is___2_via_PEB_access
call fcn.004025de
mov dword [esp + 0xc], str.hi_sandbox_NumberOfProcessors_less_2_GetSystemInfo
mov dword [esp + 8], str.Sandbox_traced_by_checking_if_NumberOfProcessors_is_less_than_2_via_GetSystemInfo__
mov dword [esp + 4], 0x403e97
mov dword [esp], str.Checking_if_NumberOfProcessors_is___2_via_GetSystemInfo__
call fcn.004025de
mov dword [esp + 0xc], str.hi_sandbox_pysicalmemory_less_1Gb
mov dword [esp + 8], str.Sandbox_traced_by_checking_if_pysical_memory_is_less_than_1Gb
mov dword [esp + 4], 0x403ebb
mov dword [esp], str.Checking_if_pysical_memory_is___1Gb
call fcn.004025de
mov dword [esp + 0xc], str.hi_sandbox_uptime
mov dword [esp + 8], str.Sandbox_traced_by_checking_operating_system_uptime_using_GetTickCount__
mov dword [esp + 4], 0x403f04
mov dword [esp], str.Checking_operating_system_uptime_using_GetTickCount__
call fcn.004025de
mov dword [esp + 0xc], str.hi_sandbox_IsNativeVhdBoot
mov dword [esp + 8], str.Sandbox_traced_by_checking_IsNativeVhdBoot__
mov dword [esp + 4], 0x403f1e
mov dword [esp], str.Checking_if_operating_system_IsNativeVhdBoot__
call fcn.004025de
mov dword [esp], str.Hooks_detection
call fcn.004025c2
mov dword [esp + 0xc], str.hi_hooks_shellexecuteexw_m1
mov dword [esp + 8], str.Hooks_traced_using_ShellExecuteExW_method_1
mov dword [esp + 4], 0x40445a
mov dword [esp], str.Checking_function_ShellExecuteExW_method_1
call fcn.004025de
mov dword [esp + 0xc], str.hi_hooks_createprocessa_m1
mov dword [esp + 8], str.Hooks_traced_using_CreateProcessA_method_1
mov dword [esp + 4], 0x40446f
mov dword [esp], str.Checking_function_CreateProcessA_method_1
call fcn.004025de
mov dword [esp], str.Sandboxie_detection
call fcn.004025c2
mov dword [esp + 0xc], str.hi_sandboxie
mov dword [esp + 8], str.Sandboxie_traced_using_GetModuleHandle_sbiedll.dll_
mov dword [esp + 4], 0x40303c
mov dword [esp], str.Using_GetModuleHandle_sbiedll.dll_
call fcn.004025de
mov dword [esp], str.Wine_detection
call fcn.004025c2
mov dword [esp + 0xc], str.hi_wine
mov dword [esp + 8], str.Wine_traced_using_GetProcAddress_wine_get_unix_file_name__from_kernel32.dll
mov dword [esp + 4], 0x403f78
mov dword [esp], str.Using_GetProcAddress_wine_get_unix_file_name__from_kernel32.dll
call fcn.004025de
mov dword [esp + 0xc], str.hi_wine
mov dword [esp + 8], str.Wine_traced_using_Reg_key_HKCUSOFTWAREWine
mov dword [esp + 4], 0x403fc9
mov dword [esp], str.Reg_key__HKCUSOFTWAREWine_
call fcn.004025de
mov dword [esp], str.VirtualBox_detection
call fcn.004025c2
mov dword [esp + 0xc], str.hi_virtualbox
mov dword [esp + 8], str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0__Identifier_
mov dword [esp + 4], 0x40309c
mov dword [esp], str.Scsi_port__bus__target_id__logical_unit_id___0_identifier
call fcn.004025de
mov dword [esp + 0xc], str.hi_virtualbox
mov dword [esp + 8], str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREDescriptionSystem__SystemBiosVersion_
mov dword [esp + 4], 0x4030c8
mov dword [esp], str.Reg_key__HKLMHARDWAREDescriptionSystem__SystemBiosVersion__
call fcn.004025de
mov dword [esp + 0xc], str.hi_virtualbox
mov dword [esp + 8], str.VirtualBox_traced_using_Reg_key_HKLMSOFTWAREOracleVirtualBox_Guest_Additions
mov dword [esp + 4], 0x4030f4
mov dword [esp], str.Reg_key__HKLMSOFTWAREOracleVirtualBox_Guest_Additions_
call fcn.004025de
mov dword [esp + 0xc], str.hi_virtualbox
mov dword [esp + 8], str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREDescriptionSystem__VideoBiosVersion_
mov dword [esp + 4], 0x403110
mov dword [esp], str.Reg_key__HKLMHARDWAREDescriptionSystem__VideoBiosVersion__
call fcn.004025de
mov dword [esp + 0xc], str.hi_virtualbox
mov dword [esp + 8], str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREACPIDSDTVBOX__
mov dword [esp + 4], 0x40313c
mov dword [esp], str.Reg_key__HKLMHARDWAREACPIDSDTVBOX___
call fcn.004025de
mov dword [esp + 0xc], str.hi_virtualbox
mov dword [esp + 8], str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREACPIFADTVBOX__
mov dword [esp + 4], 0x403158
mov dword [esp], str.Reg_key__HKLMHARDWAREACPIFADTVBOX___
call fcn.004025de
mov dword [esp + 0xc], str.hi_virtualbox
mov dword [esp + 8], str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREACPIRSDTVBOX__
mov dword [esp + 4], 0x403174
mov dword [esp], str.Reg_key__HKLMHARDWAREACPIRSDTVBOX___
call fcn.004025de
mov dword [esp + 0xc], str.hi_virtualbox
mov dword [esp + 8], 0
mov dword [esp + 4], 0x403190
mov dword [esp], str.Reg_key__HKLMSYSTEMControlSet001ServicesVBox_
call fcn.004025de
mov dword [esp + 0xc], str.hi_virtualbox
mov dword [esp + 8], str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREDESCRIPTIONSystem__SystemBiosDate_
mov dword [esp + 4], 0x4032a2
mov dword [esp], str.Reg_key__HKLMHARDWAREDESCRIPTIONSystem__SystemBiosDate__
call fcn.004025de
mov dword [esp + 0xc], str.hi_virtualbox
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4032ce
mov dword [esp], str.Driver_files_in_C:WINDOWS_system32driversVBox
call fcn.004025de
mov dword [esp + 0xc], str.hi_virtualbox
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4033d5
mov dword [esp], str.Additional_system_files
call fcn.004025de
mov dword [esp + 0xc], str.hi_virtualbox
mov dword [esp + 8], str.VirtualBox_traced_using_MAC_address_starting_with_08:00:27
mov dword [esp + 4], 0x403540
mov dword [esp], str.Looking_for_a_MAC_address_starting_with_08:00:27
call fcn.004025de
mov dword [esp + 0xc], str.hi_virtualbox
mov dword [esp + 8], 0
mov dword [esp + 4], 0x403554
mov dword [esp], str.Looking_for_pseudo_devices
call fcn.004025de
mov dword [esp + 0xc], str.hi_virtualbox
mov dword [esp + 8], str.VirtualBox_traced_using_VBoxTray_windows
mov dword [esp + 4], 0x40369c
mov dword [esp], str.Looking_for_VBoxTray_windows
call fcn.004025de
mov dword [esp + 0xc], str.hi_virtualbox
mov dword [esp + 8], str.VirtualBox_traced_using_its_network_share
mov dword [esp + 4], 0x4036f4
mov dword [esp], str.Looking_for_VBox_network_share
call fcn.004025de
mov dword [esp + 0xc], str.hi_virtualbox
mov dword [esp + 8], 0
mov dword [esp + 4], 0x403797
mov dword [esp], str.Looking_for_VBox_processes__vboxservice.exe__vboxtray.exe_
call fcn.004025de
mov dword [esp + 0xc], str.hi_virtualbox
mov dword [esp + 8], str.VirtualBox_device_identifiers_traced_using_WMI
mov dword [esp + 4], 0x403933
mov dword [esp], str.Looking_for_VBox_devices_using_WMI
call fcn.004025de
mov dword [esp], str.VMware_detection
call fcn.004025c2
mov dword [esp + 0xc], str.hi_vmware
mov dword [esp + 8], str.VMWare_traced_using_Reg_key_HKLMHARDWAREDEVICEMAPScsiScsi_Port_0_1_2Scsi_Bus_0Target_Id_0Logical_Unit_Id_0__Identifier_
mov dword [esp + 4], 0x40401c
mov dword [esp], str.Scsi_port_0_1_2___bus__target_id__logical_unit_id___0_identifier
call fcn.004025de
mov dword [esp + 0xc], str.hi_vmware
mov dword [esp + 8], str.VMware_traced_using_Reg_key_HKLMSOFTWAREVMware__Inc.VMware_Tools
mov dword [esp + 4], 0x4040a8
mov dword [esp], str.Reg_key__HKLMSOFTWAREVMware__Inc.VMware_Tools_
call fcn.004025de
mov dword [esp + 0xc], str.hi_vmware
mov dword [esp + 8], str.VMware_traced_using_file_C:WINDOWS_system32drivers_vmmouse.sys
mov dword [esp + 4], 0x4040c4
mov dword [esp], str.Looking_for_C:WINDOWS_system32drivers_vmmouse.sys
call fcn.004025de
mov dword [esp + 0xc], str.hi_vmware
mov dword [esp + 8], str.VMware_traced_using_file_C:WINDOWS_system32drivers_vmhgfs.sys
mov dword [esp + 4], 0x4040d8
mov dword [esp], str.Looking_for_C:WINDOWS_system32drivers_vmhgfs.sys
call fcn.004025de
mov dword [esp + 0xc], str.hi_vmware
mov dword [esp + 8], str.VMware_traced_using_MAC_address_starting_with_00:05:69__00:0C:29__00:1C:14_or_00:50:56
mov dword [esp + 4], 0x4040ec
mov dword [esp], str.Looking_for_a_MAC_address_starting_with_00:05:69__00:0C:29__00:1C:14_or_00:50:56
call fcn.004025de
mov dword [esp + 0xc], str.hi_vmware
mov dword [esp + 8], str.VMware_traced_using_network_adapter_name
mov dword [esp + 4], 0x404155
mov dword [esp], str.Looking_for_network_adapter_name
call fcn.004025de
mov dword [esp + 0xc], str.hi_vmware
mov dword [esp + 8], 0
mov dword [esp + 4], 0x404169
mov dword [esp], str.Looking_for_pseudo_devices
call fcn.004025de
mov dword [esp + 0xc], str.hi_vmware
mov dword [esp + 8], str.VMware_serial_number_traced_using_WMI
mov dword [esp + 4], 0x404322
mov dword [esp], str.Looking_for_VMware_serial_number
call fcn.004025de
mov dword [esp], str.Qemu_detection
call fcn.004025c2
mov dword [esp + 0xc], str.hi_qemu
mov dword [esp + 8], str.Qemu_traced_using_Reg_key_HKLMHARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0__Identifier_
mov dword [esp + 4], 0x404384
mov dword [esp], str.Scsi_port__bus__target_id__logical_unit_id___0_identifier
call fcn.004025de
mov dword [esp + 0xc], str.hi_qemu
mov dword [esp + 8], str.Qemu_traced_using_Reg_key_HKLMHARDWAREDescriptionSystem__SystemBiosVersion_
mov dword [esp + 4], 0x4043b0
mov dword [esp], str.Reg_key__HKLMHARDWAREDescriptionSystem__SystemBiosVersion__
call fcn.004025de
mov dword [esp + 0xc], str.hi_qemu
mov dword [esp + 8], str.Qemu_traced_using_CPU_brand_string_QEMU_Virtual_CPU
mov dword [esp + 4], 0x4043dc
mov dword [esp], str.cpuid_CPU_brand_string_QEMU_Virtual_CPU
call fcn.004025de
mov dword [esp], str.Bochs_detection
call fcn.004025c2
mov dword [esp + 0xc], str.hi_bochs
mov dword [esp + 8], str.Bochs_traced_using_Reg_key_HKLMHARDWAREDescriptionSystem__SystemBiosVersion_
mov dword [esp + 4], 0x404c34
mov dword [esp], str.Reg_key__HKLMHARDWAREDescriptionSystem__SystemBiosVersion__
call fcn.004025de
mov dword [esp + 0xc], str.hi_bochs
mov dword [esp + 8], str.Bochs_traced_using_CPU_AMD_wrong_value_for_processor_name
mov dword [esp + 4], 0x404c60
mov dword [esp], str.cpuid_AMD_wrong_value_for_processor_name
call fcn.004025de
mov dword [esp + 0xc], str.hi_bochs
mov dword [esp + 8], str.Bochs_traced_using_CPU_Intel_wrong_value_for_processor_name
mov dword [esp + 4], 0x404cca
mov dword [esp], str.cpuid_Intel_wrong_value_for_processor_name
call fcn.004025de
mov dword [esp], str.Cuckoo_detection
call fcn.004025c2
mov dword [esp + 0xc], str.hi_cuckoo
mov dword [esp + 8], str.Cuckoo_hooks_information_structure_traced_in_the_TLS
mov dword [esp + 4], 0x404bdb
mov dword [esp], str.Looking_in_the_TLS_for_the_hooks_information_structure
call fcn.004025de
mov dword [esp], 0x40fda3
call fcn.00401450
mov dword [esp], str.____Pafish_has_finished_analyzing_the_system__check_the_log_file_for_more_information_n
call fcn.00401450
mov dword [esp], str.____and_visit_the_projects_site:_n_n
call fcn.00401450
mov dword [esp], str.____https:__github.com_a0rtega_pafish_n
call fcn.00401450
mov dword [esp], 0x40fe4b
call fcn.004023b6
mov dword [esp], str.analysis_end
call fcn.00402466
mov dword [esp + 4], 0
mov dword [esp], str._analysis_end
call fcn.00402575
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call eax
mov dword [esp + 4], 9
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
call sub.msvcrt.dll_getchar
movzx eax, word [ebp - 0xa]
mov dword [esp], eax
call fcn.004021f7
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret