Function at 0x140099eb0
Capabilities:
Encode data using base64
Enumerate processes
Enumerate threads
Execute anti-debugging instructions

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x838
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x7a0], xmm15
movapd xmmword [rbp + 0x790], xmm14
movdqa xmmword [rbp + 0x780], xmm13
movapd xmmword [rbp + 0x770], xmm12
movapd xmmword [rbp + 0x760], xmm11
movdqa xmmword [rbp + 0x750], xmm10
movapd xmmword [rbp + 0x740], xmm9
movdqa xmmword [rbp + 0x730], xmm8
movaps xmmword [rbp + 0x720], xmm7
movapd xmmword [rbp + 0x710], xmm6
and rsp, 0xffffffffffffff80
mov rbx, rsp
mov qword [rbx + 0x780], rbp
mov qword [rbp + 0x708], 0xfffffffffffffffe
mov qword [rbx + 0x3c0], rcx
call fcn.1400ff360
mov qword [rbx + 0x3c8], rax
mov qword [rbx + 0x320], 0
mov qword [rbx + 0x328], 8
mov qword [rbx + 0x330], 0
mov byte [rbx + 0x37], 1
lea rcx, [rbx + 0x660]
call fcn.140101cd0
lea rcx, [rbx + 0x660]
call fcn.140101ea0
xorps xmm7, xmm7
movq xmm13, qword [0x14029f8a0]
movapd xmm14, xmmword [0x14029f8b0]
movdqa xmm15, xmmword [0x1402a20a0]
pcmpeqd xmm8, xmm8
movapd xmm9, xmmword [0x14029f8b0]
mov qword [rbx + 0x3a0], 0
nop word cs:[rax + rax]
cmp qword [rbx + 0x3a0], 2
jae 0x14009d5f6
mov dword [rbx + 0x360], esi
movss xmm0, dword [rbx + 0x6c8]
movss dword [rbx + 0x364], xmm0
mov rax, qword [rbx + 0x720]
mov qword [rbx + 0x3d0], rax
mov qword [rbx + 0x2d8], 0
mov qword [rbx + 0x2e0], 4
mov qword [rbx + 0x2e8], 0
mov ecx, 2
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
lea rcx, [rax + 1]
cmp rcx, 1
ja 0x14009a170
mov byte [rbx + 0x36], 1
call fcn.140203920
mov qword [rbx + 0x98], rax
test edx, edx
je 0x14009a177
mov rcx, qword [rbx + 0x98]
mov qword [rbx + 0x248], rcx
mov dword [rbx + 0x250], edx
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 3
jb 0x14009a12e
lea rax, [rbx + 0x248]
mov qword [rbx + 0x40], rax
lea rax, [0x140203d70]
mov qword [rbx + 0x48], rax
lea rax, str.Failed_to_create_process_snapshot:
mov qword [rbx + 0x400], rax
mov qword [rbx + 0x408], 1
mov qword [rbx + 0x420], 0
lea rax, [rbx + 0x40]
mov qword [rbx + 0x410], rax
mov qword [rbx + 0x418], 1
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x100], rcx
mov qword [rbx + 0x108], 8
mov qword [rbx + 0x110], rcx
mov qword [rbx + 0x118], 8
mov qword [rbx + 0x120], rax
mov edx, 3
lea rcx, [rbx + 0x400]
lea r8, [rbx + 0x100]
xor r9d, r9d
call fcn.1401a7b20
mov rcx, qword [rbx + 0x248]
mov rax, qword [rbx + 0x2d8]
mov qword [rbx + 0x98], rax
mov rdi, qword [rbx + 0x2e0]
mov rsi, qword [rbx + 0x2e8]
test rcx, rcx
je 0x14009c941
mov byte [rbx + 0x36], 0
lea rcx, [rbx + 0x248]
call fcn.14010c210
jmp 0x14009c941
mov qword [rbx + 0x98], rax
mov byte [rbx + 0x36], 1
lea rcx, [rbx + 0x400]
call fcn.1402034e0
mov dword [rbx + 0x400], 0x130
mov rsi, qword [rbx + 0x98]
mov rcx, rsi
lea rdx, [rbx + 0x400]
call qword [sym.imp.kernel32.dll_Process32First]
test eax, eax
je 0x14009c840
mov edi, dword [rbx + 0x408]
call qword [sym.imp.kernel32.dll_GetCurrentProcessId]
cmp edi, eax
jne 0x14009a1fa
mov rcx, rsi
lea rdx, [rbx + 0x400]
call qword [sym.imp.kernel32.dll_Process32Next]
test eax, eax
jne 0x14009a1b0
mov byte [rbx + 0x36], 1
call fcn.140203920
mov qword [rbx + 0x100], rax
mov dword [rbx + 0x108], edx
test edx, edx
mov rsi, qword [rbx + 0x98]
je 0x14009a1b0
jmp 0x14009c820
call qword [sym.imp.kernel32.dll_GetCurrentProcessId]
pxor xmm10, xmm10
mov dword [rbx + 0xa8], 0
xorpd xmm6, xmm6
mov dword [rbx + 0xac], edi
cmp eax, edi
je 0x14009a32f
mov ecx, 4
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov r14, rax
inc rax
cmp rax, 1
ja 0x14009a34d
mov byte [rbx + 0x36], 1
call fcn.140203920
mov r14, rax
test edx, edx
je 0x14009a34d
mov qword [rbx + 0xb0], r14
mov dword [rbx + 0xb8], edx
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 3
jb 0x14009a31a
lea rax, [rbx + 0xb0]
mov qword [rbx + 0x248], rax
lea rax, [0x140203d70]
mov qword [rbx + 0x250], rax
lea rax, str.Failed_to_create_thread_snapshot:
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 1
mov qword [rbx + 0x120], 0
lea rax, [rbx + 0x248]
mov qword [rbx + 0x110], rax
mov qword [rbx + 0x118], 1
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], 8
mov qword [rbx + 0x60], rax
mov edx, 3
lea rcx, [rbx + 0x100]
lea r8, [rbx + 0x40]
xor r9d, r9d
call fcn.1401a7b20
mov r14, qword [rbx + 0xb0]
test r14, r14
je 0x14009a32f
mov byte [rbx + 0x36], 1
lea rcx, [rbx + 0xb0]
call fcn.14010c210
xorpd xmm11, xmm11
mov rsi, qword [rbx + 0x2e8]
cmp rsi, qword [rbx + 0x2d8]
je 0x14009c76c
jmp 0x14009c77c
mov byte [rbx + 0x36], 1
lea rcx, [rbx + 0x338]
call fcn.1402034d0
mov dword [rbx + 0x338], 0x1c
mov rcx, r14
lea rdx, [rbx + 0x338]
call qword [sym.imp.kernel32.dll_Thread32First]
test eax, eax
je 0x14009a876
xorpd xmm0, xmm0
movapd xmmword [rbx + 0x3b0], xmm0
mov dword [rbx + 0xa8], 0
xorpd xmm0, xmm0
movsd qword [rbx + 0x2f0], xmm0
nop word cs:[rax + rax]
mov eax, dword [rbx + 0xac]
cmp dword [rbx + 0x344], eax
jne 0x14009a647
mov r8d, dword [rbx + 0x340]
mov ecx, 0x4a
xor edx, edx
call qword [sym.imp.kernel32.dll_OpenThread]
lea rcx, [rax + 1]
cmp rcx, 1
ja 0x14009a507
mov byte [rbx + 0x36], 1
call fcn.140203920
test edx, edx
je 0x14009a507
mov qword [rbx + 0xb0], rax
mov dword [rbx + 0xb8], edx
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 3
jb 0x14009a4b6
lea rax, [rbx + 0xb0]
mov qword [rbx + 0x248], rax
lea rax, [0x140203d70]
mov qword [rbx + 0x250], rax
lea rax, str.Failed_to_open_thread:
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 1
mov qword [rbx + 0x120], 0
lea rax, [rbx + 0x248]
mov qword [rbx + 0x110], rax
mov qword [rbx + 0x118], 1
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], 8
mov qword [rbx + 0x60], rax
mov edx, 3
lea rcx, [rbx + 0x100]
lea r8, [rbx + 0x40]
xor r9d, r9d
call fcn.1401a7b20
mov rcx, r14
lea rdx, [rbx + 0x338]
call qword [sym.imp.kernel32.dll_Thread32Next]
test eax, eax
jne 0x14009a4e4
call fcn.140203920
mov qword [rbx + 0x100], rax
mov dword [rbx + 0x108], edx
test edx, edx
jne 0x14009a842
cmp qword [rbx + 0xb0], 0
je 0x14009a3b0
mov byte [rbx + 0x36], 1
lea rcx, [rbx + 0xb0]
call fcn.14010c210
jmp 0x14009a3b0
mov rsi, rax
mov byte [rbx + 0x36], 1
call fcn.1402034c0
mov dword [rbx + 0x308], eax
mov dword [rbx + 0x30c], edx
mov byte [rbx + 0x36], 1
call fcn.1402034c0
mov dword [rbx + 0x368], eax
mov dword [rbx + 0x36c], edx
mov byte [rbx + 0x36], 1
call fcn.1402034c0
mov dword [rbx + 0x2a0], eax
mov dword [rbx + 0x2a4], edx
mov byte [rbx + 0x36], 1
call fcn.1402034c0
mov rcx, rsi
mov dword [rbx + 0xb0], eax
mov dword [rbx + 0xb4], edx
lea rax, [rbx + 0xb0]
mov qword [rsp + 0x20], rax
lea rdx, [rbx + 0x308]
lea r8, [rbx + 0x368]
lea r9, [rbx + 0x2a0]
call qword [sym.imp.kernel32.dll_GetThreadTimes]
test eax, eax
je 0x14009a682
mov rax, qword [rbx + 0x2a0]
mov rcx, qword [rbx + 0xb0]
lea rdx, [rcx + rax]
movq xmm0, rdx
movq xmm1, rax
punpcklqdq xmm0, xmm1
movdqa xmm1, xmm0
pand xmm1, xmmword [0x1402ade50]
por xmm1, xmmword [0x1402ade60]
psrlq xmm0, 0x20
por xmm0, xmmword [0x1402ade70]
subpd xmm0, xmmword [0x1402ade80]
addpd xmm0, xmm1
divpd xmm0, xmmword [0x1402ade90]
movapd xmm1, xmmword [rbx + 0x3b0]
addpd xmm1, xmm0
movapd xmmword [rbx + 0x3b0], xmm1
movq xmm0, rcx
punpckldq xmm0, xmm13
subpd xmm0, xmm14
movapd xmm1, xmm0
unpckhpd xmm1, xmm0
addsd xmm1, xmm0
divsd xmm1, qword [0x1402adea0]
movsd xmm0, qword [rbx + 0x2f0]
addsd xmm0, xmm1
movsd qword [rbx + 0x2f0], xmm0
mov rcx, rsi
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x14009a77c
inc dword [rbx + 0xa8]
mov rcx, r14
lea rdx, [rbx + 0x338]
call qword [sym.imp.kernel32.dll_Thread32Next]
test eax, eax
jne 0x14009a3b0
mov byte [rbx + 0x36], 1
call fcn.140203920
mov qword [rbx + 0x100], rax
mov dword [rbx + 0x108], edx
test edx, edx
je 0x14009a3b0
jmp 0x14009a95b
mov byte [rbx + 0x36], 1
call fcn.140203920
mov qword [rbx + 0x100], rax
mov dword [rbx + 0x108], edx
test edx, edx
je 0x14009a590
test rax, rax
mov rcx, rsi
je 0x14009a6bb
mov byte [rbx + 0x36], 1
lea rcx, [rbx + 0x100]
call fcn.14010c210
mov rcx, rsi
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 2
jbe 0x14009a633
lea rax, [rbx + 0x340]
mov qword [rbx + 0x248], rax
lea rax, [0x14023efa0]
mov qword [rbx + 0x250], rax
lea rax, str.Failed_to_get_thread_times_for_thread_ID:
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 1
mov qword [rbx + 0x120], 0
lea rax, [rbx + 0x248]
mov qword [rbx + 0x110], rax
mov qword [rbx + 0x118], 1
mov byte [rbx + 0x36], 1
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], 8
mov qword [rbx + 0x60], rax
mov byte [rbx + 0x36], 1
mov edx, 3
lea rcx, [rbx + 0x100]
lea r8, [rbx + 0x40]
xor r9d, r9d
call fcn.1401a7b20
jmp 0x14009a630
mov byte [rbx + 0x36], 1
call fcn.140203920
mov qword [rbx + 0x100], rax
mov dword [rbx + 0x108], edx
test edx, edx
je 0x14009a641
test rax, rax
je 0x14009a7af
mov byte [rbx + 0x36], 1
lea rcx, [rbx + 0x100]
call fcn.14010c210
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 2
jbe 0x14009a641
lea rax, str.Warning:_Failed_to_close_thread_handle_properly
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 1
mov qword [rbx + 0x110], 8
movups xmmword [rbx + 0x118], xmm7
mov byte [rbx + 0x36], 1
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], 8
mov qword [rbx + 0x60], rax
mov byte [rbx + 0x36], 1
mov edx, 3
lea rcx, [rbx + 0x100]
lea r8, [rbx + 0x40]
xor r9d, r9d
call fcn.1401a7b20
jmp 0x14009a641
test rax, rax
je 0x14009a853
lea rcx, [rbx + 0x100]
call fcn.14010c210
cmp qword [rbx + 0xb0], 0
je 0x14009a970
mov byte [rbx + 0x36], 1
lea rcx, [rbx + 0xb0]
call fcn.14010c210
jmp 0x14009a970
mov byte [rbx + 0x36], 1
call fcn.140203920
mov qword [rbx + 0x100], rax
mov dword [rbx + 0x108], edx
test edx, edx
je 0x14009a37f
test rax, rax
je 0x14009a8a9
mov byte [rbx + 0x36], 1
lea rcx, [rbx + 0x100]
call fcn.14010c210
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
xorpd xmm0, xmm0
movapd xmmword [rbx + 0x3b0], xmm0
mov dword [rbx + 0xa8], 0
xorpd xmm0, xmm0
movsd qword [rbx + 0x2f0], xmm0
cmp rax, 3
jb 0x14009a970
lea rax, str.Failed_to_get_the_first_thread_entry
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 1
mov qword [rbx + 0x110], 8
movups xmmword [rbx + 0x118], xmm7
mov byte [rbx + 0x36], 1
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], 8
mov qword [rbx + 0x60], rax
mov byte [rbx + 0x36], 1
mov edx, 3
lea rcx, [rbx + 0x100]
lea r8, [rbx + 0x40]
xor r9d, r9d
call fcn.1401a7b20
jmp 0x14009a970
test rax, rax
je 0x14009a970
mov byte [rbx + 0x36], 1
lea rcx, [rbx + 0x100]
call fcn.14010c210
mov rcx, r14
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x14009acb8
mov qword [rbx + 0x298], 0
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 3
jb 0x14009aa3e
lea rax, [0x1402ae930]
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 1
mov qword [rbx + 0x110], 8
movups xmmword [rbx + 0x118], xmm7
mov qword [rbx + 0x88], 0
mov qword [rbx + 0x90], 1
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], 8
mov qword [rbx + 0x60], rax
mov qword [rbx + 0x88], 0
mov qword [rbx + 0x90], 1
mov edx, 3
lea rcx, [rbx + 0x100]
lea r8, [rbx + 0x40]
xor r9d, r9d
call fcn.1401a7b20
mov eax, 0x40000000
xor ecx, ecx
mov r14, rbx
cpuid
xchg rbx, r14
mov esi, ecx
mov edi, edx
movzx eax, byte [0x1403d2ea1]
mov ecx, 0xc
mov edx, 1
call fcn.1400fcbc0
test rax, rax
je 0x14009d796
mov dword [rax], r14d
mov dword [rax + 4], esi
mov dword [rax + 8], edi
mov r8d, 0xc
lea rcx, [rbx + 0x40]
mov qword [rbx + 0xa0], rax
mov rdx, rax
call fcn.14022fe20
lea rax, str.KVMKVMKVMVMwareVMwareXenVMMXenVMMprl_hypervVBoxVBoxVBox
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 9
lea rax, str.Microsoft_HvOther_hypervisor_detected__adding_6.0_to_suspicion_score.
mov qword [rbx + 0x110], rax
mov qword [rbx + 0x118], 0xc
lea rax, [0x1402af119]
mov qword [rbx + 0x120], rax
mov qword [rbx + 0x128], 0xc
lea rax, [0x1402af125]
mov qword [rbx + 0x130], rax
mov qword [rbx + 0x138], 0xc
lea rax, [0x1402af131]
mov qword [rbx + 0x140], rax
mov qword [rbx + 0x148], 0xa
lea rax, [0x1402af13b]
mov qword [rbx + 0x150], rax
mov qword [rbx + 0x158], 0xc
mov r8, qword [rbx + 0x48]
mov rsi, qword [rbx + 0x50]
xor edi, edi
mov qword [rbx + 0x38], r8
nop word cs:[rax + rax]
cmp rdi, 0x60
je 0x14009aba6
mov rcx, qword [rbx + rdi + 0x100]
mov rdx, qword [rbx + rdi + 0x108]
mov r9, rsi
call fcn.140098500
add rdi, 0x10
test al, al
mov r8, qword [rbx + 0x38]
je 0x14009ab40
test rsi, rsi
js 0x14009d7bd
je 0x14009ad7e
mov r14, r8
movzx eax, byte [0x1403d2ea1]
mov edi, 1
mov edx, 1
mov rcx, rsi
call fcn.1400fcbc0
test rax, rax
je 0x14009d7c1
mov r8, r14
jmp 0x14009ad83
mov rdx, qword [rbx + 0x40]
lea rax, [rdx*2]
test rax, rax
je 0x14009abc5
mov rcx, r8
mov r8d, 1
call fcn.1400fcbd0
mov eax, 1
mov qword [rbx + 0x80], rax
mov edx, 0xc
mov r8d, 1
mov rcx, qword [rbx + 0xa0]
call fcn.1400fcbd0
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
xorpd xmm0, xmm0
movsd qword [rbx + 0x290], xmm0
cmp rax, 3
jb 0x14009aca6
lea rax, [0x1402ae998]
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 1
mov qword [rbx + 0x110], 8
movups xmmword [rbx + 0x118], xmm7
mov qword [rbx + 0x88], 0
mov qword [rbx + 0x90], 1
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], 8
mov qword [rbx + 0x60], rax
mov qword [rbx + 0x88], 0
mov qword [rbx + 0x90], 1
mov edx, 3
lea rcx, [rbx + 0x100]
lea r8, [rbx + 0x40]
xor r9d, r9d
call fcn.1401a7b20
xor esi, esi
mov qword [rbx + 0x318], 0
jmp 0x14009b119
mov byte [rbx + 0x36], 1
call fcn.140203920
mov qword [rbx + 0x100], rax
mov dword [rbx + 0x108], edx
test edx, edx
je 0x14009a981
test rax, rax
je 0x14009aceb
mov byte [rbx + 0x36], 1
lea rcx, [rbx + 0x100]
call fcn.14010c210
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 2
jbe 0x14009a981
lea rax, str.Warning:_Failed_to_close_thread_snapshot_handle_properly
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 1
mov qword [rbx + 0x110], 8
movups xmmword [rbx + 0x118], xmm7
mov byte [rbx + 0x36], 1
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], 8
mov qword [rbx + 0x60], rax
mov byte [rbx + 0x36], 1
mov edx, 3
lea rcx, [rbx + 0x100]
lea r8, [rbx + 0x40]
xor r9d, r9d
call fcn.1401a7b20
jmp 0x14009a981
mov eax, 1
mov rcx, rax
mov r14, r8
mov rdx, r8
mov r8, rsi
mov rdi, rax
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rbx + 0x40]
lea rax, [rdx*2]
test rax, rax
je 0x14009adb6
mov r8d, 1
mov rcx, r14
call fcn.1400fcbd0
mov edx, 0xc
mov r8d, 1
mov rcx, qword [rbx + 0xa0]
call fcn.1400fcbd0
mov qword [rbx + 0x248], rsi
mov qword [rbx + 0x390], rdi
mov qword [rbx + 0x250], rdi
mov qword [rbx + 0x258], rsi
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 3
jb 0x14009aec9
lea rax, [rbx + 0x248]
mov qword [rbx + 0xb0], rax
lea rax, [0x1400895a0]
mov qword [rbx + 0xb8], rax
lea rax, str.Detected_hypervisor_signature:
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 1
mov qword [rbx + 0x120], 0
lea rax, [rbx + 0xb0]
mov qword [rbx + 0x110], rax
mov qword [rbx + 0x118], 1
mov qword [rbx + 0xf0], 0
mov qword [rbx + 0xf8], 1
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], 8
mov qword [rbx + 0x60], rax
mov qword [rbx + 0xf0], 0
mov qword [rbx + 0xf8], 1
mov edx, 3
lea rcx, [rbx + 0x100]
lea r8, [rbx + 0x40]
xor r9d, r9d
call fcn.1401a7b20
mov qword [rbx + 0xf0], 0
mov qword [rbx + 0xf8], 1
lea rcx, [rbx + 0x100]
lea rdx, [rbx + 0x248]
call fcn.140230490
mov rsi, qword [rbx + 0x100]
mov r8, qword [rbx + 0x108]
mov r9, qword [rbx + 0x110]
mov qword [rbx + 0xf0], rsi
mov qword [rbx + 0xf8], r8
mov edx, 0xc
lea rcx, str.Microsoft_HvOther_hypervisor_detected__adding_6.0_to_suspicion_score.
mov qword [rbx + 0x80], r8
mov qword [rbx + 0x318], r9
call fcn.140098500
test al, al
je 0x14009b01a
movabs rax, 0x3ff0000000000000
mov qword [rbx + 0x298], rax
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
movsd xmm0, qword [0x1402aa330]
movsd qword [rbx + 0x290], xmm0
cmp rax, 3
jb 0x14009b0fb
lea rax, str.Hyper_V_detected__adding_1.0_to_suspicion_score.x
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 1
mov qword [rbx + 0x110], 8
movups xmmword [rbx + 0x118], xmm7
mov qword [rbx + 0xf0], rsi
mov rax, qword [rbx + 0x80]
mov qword [rbx + 0xf8], rax
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], 8
mov qword [rbx + 0x60], rax
mov qword [rbx + 0xf0], rsi
mov rax, qword [rbx + 0x80]
mov qword [rbx + 0xf8], rax
mov edx, 3
lea rcx, [rbx + 0x100]
lea r8, [rbx + 0x40]
xor r9d, r9d
call fcn.1401a7b20
movsd xmm0, qword [0x1402aa330]
jmp 0x14009b0f3
movabs rax, 0x4018000000000000
mov qword [rbx + 0x298], rax
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
movsd xmm0, qword [0x1402adea8]
movsd qword [rbx + 0x290], xmm0
cmp rax, 3
jb 0x14009b0fb
lea rax, [0x1402aea50]
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 1
mov qword [rbx + 0x110], 8
movups xmmword [rbx + 0x118], xmm7
mov qword [rbx + 0xf0], rsi
mov rax, qword [rbx + 0x80]
mov qword [rbx + 0xf8], rax
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], 8
mov qword [rbx + 0x60], rax
mov qword [rbx + 0xf0], rsi
mov rax, qword [rbx + 0x80]
mov qword [rbx + 0xf8], rax
mov edx, 3
lea rcx, [rbx + 0x100]
lea r8, [rbx + 0x40]
xor r9d, r9d
call fcn.1401a7b20
movsd xmm0, qword [0x1402adea8]
movsd qword [rbx + 0x290], xmm0
mov rdx, qword [rbx + 0x248]
test rdx, rdx
je 0x14009b119
mov rcx, qword [rbx + 0x250]
mov r8d, 1
call fcn.1400fcbd0
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 3
jb 0x14009b1c9
lea rax, str.Starting_privileged_instruction_timing_analysis...
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 1
mov qword [rbx + 0x110], 8
movups xmmword [rbx + 0x118], xmm7
mov qword [rbx + 0x88], rsi
mov rax, qword [rbx + 0x80]
mov qword [rbx + 0x90], rax
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], 8
mov qword [rbx + 0x60], rax
mov qword [rbx + 0x88], rsi
mov rax, qword [rbx + 0x80]
mov qword [rbx + 0x90], rax
mov edx, 3
lea rcx, [rbx + 0x100]
lea r8, [rbx + 0x40]
xor r9d, r9d
call fcn.1401a7b20
mov qword [rbx + 0x398], rsi
lea rax, str.cpuidsgdtsidtrdtscSuspicion_score_after_timing_analysis:
mov qword [rbx + 0x248], rax
mov qword [rbx + 0x250], 5
lea rax, [0x1402aedb5]
mov qword [rbx + 0x258], rax
mov qword [rbx + 0x260], 4
lea rax, [0x1402aedb9]
mov qword [rbx + 0x268], rax
mov qword [rbx + 0x270], 4
lea rax, [0x1402aedbd]
mov qword [rbx + 0x278], rax
mov qword [rbx + 0x280], 5
call fcn.140205080
mov rsi, rax
cmp dword [rax], 1
jne 0x14009b252
mov rdx, rsi
add rdx, 8
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
jmp 0x14009b28f
movaps xmmword [rbx + 0x100], xmm7
mov edx, 0x10
lea rcx, [rbx + 0x100]
call qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
mov rax, qword [rbx + 0x100]
mov rcx, qword [rbx + 0x108]
mov rdx, rsi
add rdx, 8
mov qword [rsi], 1
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
lea r8, [rax + 1]
mov qword [rdx], r8
movups xmm0, xmmword [0x1402ae460]
movaps xmmword [rbx + 0x2b0], xmm0
movdqu xmm0, xmmword [0x1402ae450]
movdqa xmmword [rbx + 0x2a0], xmm0
mov qword [rbx + 0x2c0], rax
mov qword [rbx + 0x2c8], rcx
mov qword [rbx + 0x300], 0
xor esi, esi
jmp 0x14009b2e4
add rsi, 0x10
cmp rsi, 0x40
je 0x14009b35a
mov r8, qword [rbx + rsi + 0x248]
mov r9, qword [rbx + rsi + 0x250]
mov qword [rbx + 0x100], 0
mov qword [rbx + 0x108], 8
mov qword [rbx + 0x110], 0
lea rax, [rbx + 0x100]
mov qword [rsp + 0x20], rax
lea rcx, [rbx + 0x40]
lea rdx, [rbx + 0x2a0]
call fcn.1400d1350
mov rdx, qword [rbx + 0x40]
mov rax, rdx
neg rax
jo 0x14009b2e0
jae 0x14009b2e0
mov rcx, qword [rbx + 0x48]
shl rdx, 3
mov r8d, 8
call fcn.1400fcbd0
jmp 0x14009b2e0
xor r14d, r14d
nop dword [rax]
cmp r14d, 0xa
jae 0x14009b903
mov dword [rbx + 0x368], r14d
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 3
jb 0x14009b425
lea rax, [rbx + 0x368]
mov qword [rbx + 0xb0], rax
lea rax, [0x14023ee60]
mov qword [rbx + 0xb8], rax
lea rax, str.Iteration:
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 1
mov qword [rbx + 0x120], 0
lea rax, [rbx + 0xb0]
mov qword [rbx + 0x110], rax
mov qword [rbx + 0x118], 1
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], 8
mov qword [rbx + 0x60], rax
mov edx, 3
lea rcx, [rbx + 0x100]
lea r8, [rbx + 0x40]
xor r9d, r9d
call fcn.1401a7b20
inc r14d
xor r13d, r13d
mov dword [rbx + 0x2f8], r14d
jmp 0x14009b45a
lea rax, [rax + rsi*8]
mov rcx, qword [rax - 0x10]
mov rdx, qword [rbx + 0x288]
mov qword [rcx + rdi*8], rdx
inc rdi
mov qword [rax - 8], rdi
cmp r13, 0x40
je 0x14009b360
mov r9, qword [rbx + r13 + 0x248]
mov r12, qword [rbx + r13 + 0x250]
rdtsc
mov rsi, rdx
mov r15, rax
cmp r12, 4
mov qword [rbx + 0x38], r9
je 0x14009b4f0
cmp r12, 5
jne 0x14009d6f7
mov eax, dword [r9]
mov ecx, 0x69757063
xor eax, ecx
movzx ecx, byte [r9 + 4]
xor ecx, 0x64
or ecx, eax
je 0x14009b8db
mov eax, dword [r9]
mov ecx, 0x73746472
xor eax, ecx
movzx ecx, byte [r9 + 4]
xor ecx, 0x63
or ecx, eax
jne 0x14009d6f7
rdtsc
mov qword [rbx + 0xe0], r13
rdtsc
cmp qword [rbx + 0x2b8], 0
jne 0x14009b632
jmp 0x14009d686
cmp dword [r9], 0x74646773
je 0x14009b595
cmp dword [r9], 0x74646973
jne 0x14009d6f7
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 3
jb 0x14009b61b
lea rax, str.Executing_sidt_instruction
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 1
mov qword [rbx + 0x110], 8
movups xmmword [rbx + 0x118], xmm7
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], 8
mov qword [rbx + 0x60], rax
mov edx, 3
lea rcx, [rbx + 0x100]
lea r8, [rbx + 0x40]
xor r9d, r9d
call fcn.1401a7b20
jmp 0x14009b617
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 3
jb 0x14009b61b
lea rax, str.Executing_sgdt_instruction
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 1
mov qword [rbx + 0x110], 8
movups xmmword [rbx + 0x118], xmm7
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], 8
mov qword [rbx + 0x60], rax
mov edx, 3
lea rcx, [rbx + 0x100]
lea r8, [rbx + 0x40]
xor r9d, r9d
call fcn.1401a7b20
mov r9, qword [rbx + 0x38]
mov qword [rbx + 0xe0], r13
rdtsc
cmp qword [rbx + 0x2b8], 0
je 0x14009d686
add qword [rbx + 0xe0], 0x10
shl rsi, 0x20
or r15, rsi
shl rdx, 0x20
or rax, rdx
sub rax, r15
mov qword [rbx + 0x288], rax
movdqa xmm0, xmmword [rbx + 0x2c0]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmmword [rbx + 0x100], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmm15
movdqa xmmword [rbx + 0x110], xmm1
movdqa xmmword [rbx + 0x120], xmm0
lea rax, [rbx + 0x108]
movaps xmmword [rax + 0x28], xmm7
mov qword [rax + 0x38], 0
lea rsi, [rbx + 0x100]
mov rcx, rsi
mov rdx, r9
mov r8, r12
call fcn.140046610
mov byte [rbx + 0x40], 0xff
mov r8d, 1
mov rcx, rsi
lea rdx, [rbx + 0x40]
call fcn.140046610
mov r9, qword [rbx + 0x130]
shl r9, 0x38
or r9, qword [rbx + 0x138]
mov r10, qword [rbx + 0x110]
mov rax, qword [rbx + 0x118]
xor rax, r9
mov r8, qword [rbx + 0x100]
add r8, r10
mov rdx, qword [rbx + 0x108]
rol r10, 0xd
add rdx, rax
xor r10, r8
rol rax, 0x10
xor rax, rdx
rol r8, 0x20
add rdx, r10
add r8, rax
rol r10, 0x11
xor r10, rdx
rol rax, 0x15
rol rdx, 0x20
xor rax, r8
xor r8, r9
mov rcx, qword [rbx + 0x38]
xor rdx, 0xff
add r8, r10
add rdx, rax
rol r10, 0xd
xor r10, r8
rol rax, 0x10
rol r8, 0x20
xor rax, rdx
add rdx, r10
rol r10, 0x11
add r8, rax
xor r10, rdx
rol rax, 0x15
xor rax, r8
rol rdx, 0x20
add r8, r10
add rdx, rax
rol r10, 0xd
xor r10, r8
rol rax, 0x10
rol r8, 0x20
xor rax, rdx
add rdx, r10
rol r10, 0x11
add r8, rax
xor r10, rdx
rol rax, 0x15
xor rax, r8
rol rdx, 0x20
add r8, r10
add rdx, rax
rol r10, 0xd
xor r10, r8
rol rax, 0x10
xor rax, rdx
add rdx, r10
rol r10, 0x11
rol rax, 0x15
mov r15, rdx
rol r15, 0x20
xor r15, r10
xor r15, rax
xor r15, rdx
mov rax, r15
shr rax, 0x39
mov rdx, qword [rbx + 0x2a0]
mov r13, qword [rbx + 0x2a8]
movd xmm0, eax
mov rax, rdx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm6, xmm0, 0
lea rdi, [rdx - 0x28]
mov qword [rbx + 0xa0], 0
mov qword [rbx + 0xe8], rdx
and r15, r13
movdqu xmm10, xmmword [rax + r15]
movdqa xmm0, xmm10
pcmpeqb xmm0, xmm6
pmovmskb r14d, xmm0
test r14d, r14d
jne 0x14009b86d
pcmpeqb xmm10, xmm8
pmovmskb eax, xmm10
test eax, eax
jne 0x14009d686
mov rax, qword [rbx + 0xa0]
add r15, rax
add r15, 0x10
add rax, 0x10
mov qword [rbx + 0xa0], rax
mov rax, qword [rbx + 0xe8]
jmp 0x14009b805
lea eax, [r14 - 1]
and ax, r14w
mov r14d, eax
je 0x14009b821
tzcnt eax, r14d
add rax, r15
and rax, r13
neg rax
lea rsi, [rax + rax*4]
cmp qword [rdi + rsi*8 + 8], r12
jne 0x14009b860
lea rax, [rdi + rsi*8]
mov rdx, qword [rax]
mov r8, r12
call sub.VCRUNTIME140.dll_memcmp
mov rcx, qword [rbx + 0x38]
test eax, eax
jne 0x14009b860
mov rax, qword [rbx + 0xe8]
mov rdi, qword [rax + rsi*8 - 8]
cmp rdi, qword [rax + rsi*8 - 0x18]
mov r14d, dword [rbx + 0x2f8]
mov r13, qword [rbx + 0xe0]
jne 0x14009b440
lea rcx, [rax + rsi*8]
add rcx, 0xffffffffffffffe8
call fcn.140009160
mov rax, qword [rbx + 0xe8]
jmp 0x14009b440
xor eax, eax
xor ecx, ecx
mov r8, rbx
cpuid
xchg rbx, r8
mov qword [rbx + 0xe0], r13
rdtsc
cmp qword [rbx + 0x2b8], 0
jne 0x14009b632
jmp 0x14009d686
mov r12, qword [rbx + 0x2a0]
mov rsi, qword [rbx + 0x2b8]
movdqa xmm0, xmmword [r12]
pmovmskb eax, xmm0
not eax
lea r13, [r12 + 0x10]
xorpd xmm6, xmm6
jmp 0x14009b948
addsd xmm12, xmm12
addsd xmm6, xmm12
movsd qword [rbx + 0x300], xmm6
mov eax, dword [rbx + 0x288]
sub rsi, 1
jb 0x14009c266
test ax, ax
mov qword [rbx + 0xa0], rsi
je 0x14009b970
lea ecx, [rax - 1]
and ecx, eax
mov dword [rbx + 0x288], ecx
jmp 0x14009b99f
movdqa xmm0, xmmword [r13]
pmovmskb eax, xmm0
add r12, 0xfffffffffffffd80
add r13, 0x10
cmp eax, 0xffff
je 0x14009b970
mov ecx, 0xfffffffe
sub ecx, eax
not eax
mov edx, eax
and edx, ecx
mov dword [rbx + 0x288], edx
tzcnt eax, eax
neg rax
lea rax, [rax + rax*4]
movdqu xmm0, xmmword [r12 + rax*8 - 0x28]
movdqu xmmword [rbx + 0x308], xmm0
mov rsi, qword [r12 + rax*8 - 0x10]
mov r14, qword [r12 + rax*8 - 8]
test r14, r14
mov qword [rbx + 0xe8], rax
je 0x14009b9e0
cmp r14, 4
jae 0x14009b9f0
xor ecx, ecx
xor eax, eax
jmp 0x14009ba40
xor ecx, ecx
jmp 0x14009ba4c
mov rax, r14
and rax, 0xfffffffffffffffc
pxor xmm0, xmm0
xor ecx, ecx
xorpd xmm1, xmm1
nop word cs:[rax + rax]
movdqu xmm2, xmmword [rsi + rcx*8]
paddq xmm0, xmm2
movdqu xmm2, xmmword [rsi + rcx*8 + 0x10]
paddq xmm1, xmm2
add rcx, 4
cmp rax, rcx
jne 0x14009ba10
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rcx, xmm0
jmp 0x14009ba47
add rcx, qword [rsi + rax*8]
inc rax
cmp r14, rax
jne 0x14009ba40
movq xmm0, rcx
punpckldq xmm0, xmm13
subpd xmm0, xmm9
movapd xmm1, xmm0
unpckhpd xmm1, xmm0
addsd xmm1, xmm0
movq xmm0, r14
punpckldq xmm0, xmm13
subpd xmm0, xmm9
movapd xmm2, xmm0
unpckhpd xmm2, xmm0
addsd xmm2, xmm0
divsd xmm1, xmm2
movsd qword [rbx + 0x358], xmm1
lea rdi, [r14*8]
mov rax, r14
shr rax, 0x3d
jne 0x14009d775
mov r15d, 0
movabs rax, 0x7ffffffffffffff8
cmp rdi, rax
ja 0x14009d778
test rdi, rdi
je 0x14009baf0
movzx eax, byte [0x1403d2ea1]
mov r15d, 8
mov edx, 8
mov rcx, rdi
call fcn.1400fcbc0
test rax, rax
je 0x14009d778
mov rcx, rax
mov qword [rbx + 0xe0], r14
jmp 0x14009bb00
mov ecx, 8
mov qword [rbx + 0xe0], 0
mov qword [rbx + 0x38], rcx
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
cmp r14, 2
jb 0x14009bba0
cmp r14, 0x15
jae 0x14009bb60
test r14b, 1
mov r8, qword [rbx + 0x38]
jne 0x14009bb75
mov rdx, qword [r8]
mov rax, qword [r8 + 8]
cmp rax, rdx
jae 0x14009bb8a
mov ecx, 8
nop word [rax + rax]
mov qword [r8 + rcx], rdx
cmp rcx, 8
je 0x14009bb84
mov rdx, qword [r8 + rcx - 0x10]
add rcx, 0xfffffffffffffff8
cmp rax, rdx
jb 0x14009bb40
add rcx, r8
jmp 0x14009bb87
mov rcx, qword [rbx + 0x38]
mov rdx, r14
lea r8, [rbx + 0x100]
call fcn.140006e60
jmp 0x14009bba0
lea rax, [r8 + 8]
cmp rdi, 0x10
je 0x14009bba0
jmp 0x14009c198
mov rcx, r8
mov qword [rcx], rax
lea rax, [r8 + 0x10]
cmp rdi, 0x10
jne 0x14009c198
nop dword [rax + rax]
mov rax, r14
shr rax, 1
test r14b, 1
jne 0x14009bc20
lea rcx, [rax - 1]
cmp rcx, r14
mov r9, qword [rbx + 0x38]
jae 0x14009d785
movdqu xmm0, xmmword [r9 + rax*8 - 8]
movdqa xmm1, xmm0
pand xmm1, xmmword [0x1402ade50]
por xmm1, xmmword [0x1402ade60]
psrlq xmm0, 0x20
por xmm0, xmmword [0x1402ade70]
subpd xmm0, xmmword [0x1402ade80]
addpd xmm0, xmm1
movapd xmm10, xmm0
unpckhpd xmm10, xmm0
addsd xmm10, xmm0
mulsd xmm10, qword [0x1402a20c0]
mov rdx, qword [rbx + 0xe0]
test rdx, rdx
mov rsi, qword [rbx + 0xa0]
jne 0x14009bc56
jmp 0x14009bc68
mov r9, qword [rbx + 0x38]
movq xmm0, qword [r9 + rax*8]
punpckldq xmm0, xmm13
subpd xmm0, xmm14
movapd xmm10, xmm0
unpckhpd xmm10, xmm0
addsd xmm10, xmm0
mov rdx, qword [rbx + 0xe0]
test rdx, rdx
mov rsi, qword [rbx + 0xa0]
je 0x14009bc68
shl rdx, 3
mov r8d, 8
mov rcx, r9
call fcn.1400fcbd0
mov rax, qword [rbx + 0xe8]
lea rcx, [r12 + rax*8]
movsd qword [rbx + 0x3d8], xmm10
mov rax, qword [rcx - 8]
test rax, rax
je 0x14009bce0
movsd xmm1, qword [rbx + 0x358]
mov rcx, qword [rcx - 0x10]
lea rdx, [rax*8]
xorpd xmm0, xmm0
xor r8d, r8d
movq xmm2, qword [rcx + r8]
punpckldq xmm2, xmm13
subpd xmm2, xmm14
movapd xmm3, xmm2
unpckhpd xmm3, xmm2
addsd xmm3, xmm2
subsd xmm3, xmm1
mulsd xmm3, xmm3
addsd xmm0, xmm3
add r8, 8
cmp rdx, r8
jne 0x14009bca0
jmp 0x14009bce4
xorpd xmm0, xmm0
movq xmm1, rax
punpckldq xmm1, xmm13
subpd xmm1, xmm14
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm0, xmm2
movsd qword [rbx + 0x3a8], xmm0
mov rax, qword [rbx + 0x308]
mov rcx, qword [rbx + 0x310]
cmp rcx, 4
je 0x14009bd90
movsd xmm11, qword [0x1402adeb8]
movsd xmm10, qword [0x1402adeb0]
cmp rcx, 5
jne 0x14009bdd6
mov ecx, dword [rax]
mov edx, 0x69757063
xor ecx, edx
movzx edx, byte [rax + 4]
xor edx, 0x64
or edx, ecx
movsd xmm11, qword [0x1402aded8]
movsd xmm10, qword [0x1402aded0]
je 0x14009bdd6
mov ecx, dword [rax]
bswap ecx
cmp ecx, 0x72647473
jne 0x14009c23d
movzx eax, byte [rax + 4]
add eax, 0xffffff9d
movsd xmm11, qword [0x1402adee8]
movsd xmm10, qword [0x1402adee0]
test eax, eax
jne 0x14009bdc4
jmp 0x14009bdd6
cmp dword [rax], 0x74646773
movsd xmm11, qword [0x1402adec8]
movsd xmm10, qword [0x1402adec0]
je 0x14009bdd6
cmp dword [rax], 0x74646973
movsd xmm11, qword [0x1402adec8]
movsd xmm10, qword [0x1402adec0]
je 0x14009bdd6
movsd xmm11, qword [0x1402adeb8]
movsd xmm10, qword [0x1402adeb0]
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 3
jb 0x14009bfb7
lea rax, [rbx + 0x308]
mov qword [rbx + 0x40], rax
lea rax, [0x14003b630]
mov qword [rbx + 0x48], rax
lea rax, [rbx + 0x358]
mov qword [rbx + 0x50], rax
lea rax, [0x14023de90]
mov qword [rbx + 0x58], rax
lea rcx, [rbx + 0x3d8]
mov qword [rbx + 0x60], rcx
mov qword [rbx + 0x68], rax
lea rcx, [rbx + 0x3a8]
mov qword [rbx + 0x70], rcx
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x100], 2
mov qword [rbx + 0x110], 2
mov qword [rbx + 0x120], 0
mov qword [rbx + 0x128], 0x20
mov byte [rbx + 0x130], 3
mov qword [rbx + 0x138], 0
mov qword [rbx + 0x140], 2
mov qword [rbx + 0x148], 2
mov qword [rbx + 0x158], 1
mov qword [rbx + 0x160], 0x20
mov byte [rbx + 0x168], 3
mov qword [rbx + 0x170], 2
mov qword [rbx + 0x180], 2
mov qword [rbx + 0x190], 2
mov qword [rbx + 0x198], 0x20
mov byte [rbx + 0x1a0], 3
mov qword [rbx + 0x1a8], 0
mov qword [rbx + 0x1b0], 2
mov qword [rbx + 0x1b8], 2
mov qword [rbx + 0x1c8], 3
mov qword [rbx + 0x1d0], 0x20
mov byte [rbx + 0x1d8], 3
lea rax, [0x1402aee38]
mov qword [rbx + 0xb0], rax
mov qword [rbx + 0xb8], 4
lea rax, [rbx + 0x100]
mov qword [rbx + 0xd0], rax
mov qword [rbx + 0xd8], 4
lea rax, [rbx + 0x40]
mov qword [rbx + 0xc0], rax
mov qword [rbx + 0xc8], 4
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x368], rcx
mov qword [rbx + 0x370], 8
mov qword [rbx + 0x378], rcx
mov qword [rbx + 0x380], 8
mov qword [rbx + 0x388], rax
mov edx, 3
lea rcx, [rbx + 0xb0]
lea r8, [rbx + 0x368]
xor r9d, r9d
call fcn.1401a7b20
mov edx, 0xc
lea rcx, str.Microsoft_HvOther_hypervisor_detected__adding_6.0_to_suspicion_score.
mov r8, qword [rbx + 0x80]
mov r9, qword [rbx + 0x318]
call fcn.140098500
movsd xmm12, qword [0x1402adef0]
test al, al
jne 0x14009bfec
movsd xmm12, qword [0x1402adef8]
movsd xmm0, qword [rbx + 0x358]
ucomisd xmm0, xmm11
jbe 0x14009c0cc
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 3
jb 0x14009c0b3
lea rax, [rbx + 0x308]
mov qword [rbx + 0xb0], rax
lea rax, [0x14003b630]
mov qword [rbx + 0xb8], rax
lea rax, [0x1402aeec8]
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 2
mov qword [rbx + 0x120], 0
lea rax, [rbx + 0xb0]
mov qword [rbx + 0x110], rax
mov qword [rbx + 0x118], 1
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], 8
mov qword [rbx + 0x60], rax
mov edx, 3
lea rcx, [rbx + 0x100]
lea r8, [rbx + 0x40]
xor r9d, r9d
call fcn.1401a7b20
movapd xmm0, xmm12
mulsd xmm0, qword [0x1402adf00]
addsd xmm6, xmm0
movsd qword [rbx + 0x300], xmm6
movsd xmm0, qword [rbx + 0x3a8]
ucomisd xmm0, xmm10
jbe 0x14009b942
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 3
jb 0x14009b930
lea rax, [rbx + 0x308]
mov qword [rbx + 0xb0], rax
lea rax, [0x14003b630]
mov qword [rbx + 0xb8], rax
lea rax, [0x1402aef40]
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 2
mov qword [rbx + 0x120], 0
lea rax, [rbx + 0xb0]
mov qword [rbx + 0x110], rax
mov qword [rbx + 0x118], 1
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], 8
mov qword [rbx + 0x60], rax
mov edx, 3
lea rcx, [rbx + 0x100]
lea r8, [rbx + 0x40]
xor r9d, r9d
call fcn.1401a7b20
jmp 0x14009b930
mov rcx, qword [rbx + 0x38]
lea rcx, [rcx + r14*8]
lea rdx, [rax + 8]
jmp 0x14009c1c7
mov r10, rsi
mov qword [r10], r8
add rax, 0x10
add rdx, 0x10
cmp rax, rcx
je 0x14009bba0
mov r9, qword [rax - 8]
mov r8, qword [rax]
cmp r8, r9
jae 0x14009c206
mov r11, rax
mov rsi, qword [rbx + 0x38]
nop word [rax + rax]
lea r10, [r11 - 8]
mov qword [r11], r9
cmp r10, rsi
je 0x14009c200
mov r9, qword [r11 - 0x10]
mov r11, r10
cmp r8, r9
jb 0x14009c1e0
jmp 0x14009c203
mov r10, rsi
mov qword [r10], r8
mov r9, qword [rax]
mov r8, qword [rax + 8]
cmp r8, r9
jae 0x14009c1b6
mov r11, rdx
mov rsi, qword [rbx + 0x38]
nop dword [rax]
lea r10, [r11 - 8]
mov qword [r11], r9
cmp r10, rsi
je 0x14009c1b0
mov r9, qword [r11 - 0x10]
mov r11, r10
cmp r8, r9
jb 0x14009c220
jmp 0x14009c1b3
mov eax, 0
sbb eax, eax
or eax, 1
movsd xmm11, qword [0x1402adee8]
movsd xmm10, qword [0x1402adee0]
test eax, eax
jne 0x14009bdc4
jmp 0x14009bdd6
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 3
jb 0x14009c36b
lea rax, [rbx + 0x300]
mov qword [rbx + 0x368], rax
lea rax, [0x14023de90]
mov qword [rbx + 0x370], rax
mov qword [rbx + 0x100], 0
mov qword [rbx + 0x108], 2
mov qword [rbx + 0x110], 2
mov qword [rbx + 0x120], 0
mov qword [rbx + 0x128], 0x20
mov byte [rbx + 0x130], 3
lea rax, [0x1402aedf0]
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x48], 1
lea rax, [rbx + 0x100]
mov qword [rbx + 0x60], rax
mov qword [rbx + 0x68], 1
lea rax, [rbx + 0x368]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], 1
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0xb0], rcx
mov qword [rbx + 0xb8], 8
mov qword [rbx + 0xc0], rcx
mov qword [rbx + 0xc8], 8
mov qword [rbx + 0xd0], rax
mov edx, 3
lea rcx, [rbx + 0x40]
lea r8, [rbx + 0xb0]
xor r9d, r9d
call fcn.1401a7b20
movsd xmm6, qword [rbx + 0x300]
mov rsi, qword [rbx + 0x2a8]
test rsi, rsi
je 0x14009c455
mov rdi, qword [rbx + 0x2b8]
test rdi, rdi
je 0x14009c420
mov r14, qword [rbx + 0x2a0]
movdqa xmm0, xmmword [r14]
pmovmskb r12d, xmm0
not r12d
lea r15, [r14 + 0x10]
jmp 0x14009c3c3
dec rdi
lea eax, [r12 - 1]
and eax, r12d
mov r12d, eax
test rdi, rdi
je 0x14009c420
test r12w, r12w
jne 0x14009c3f1
nop dword [rax]
movdqa xmm0, xmmword [r15]
pmovmskb r12d, xmm0
add r14, 0xfffffffffffffd80
add r15, 0x10
cmp r12d, 0xffff
je 0x14009c3d0
not r12d
tzcnt eax, r12d
neg rax
lea rax, [rax + rax*4]
mov rdx, qword [r14 + rax*8 - 0x18]
test rdx, rdx
je 0x14009c3b0
lea rax, [r14 + rax*8]
mov rcx, qword [rax - 0x10]
shl rdx, 3
mov r8d, 8
call fcn.1400fcbd0
jmp 0x14009c3b0
lea rax, [rsi + 1]
mov ecx, 0x28
mul rcx
add rax, 0xf
and rax, 0xfffffffffffffff0
add rsi, rax
add rsi, 0x11
je 0x14009c455
mov rcx, qword [rbx + 0x2a0]
sub rcx, rax
mov r8d, 0x10
mov rdx, rsi
call fcn.1400fcbd0
movsd qword [rbx + 0x2a0], xmm6
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 3
mov rsi, qword [rbx + 0x398]
jb 0x14009c593
lea rax, [rbx + 0x2a0]
mov qword [rbx + 0xb0], rax
lea rax, [0x14023de90]
mov qword [rbx + 0xb8], rax
mov qword [rbx + 0x100], 0
mov qword [rbx + 0x108], 2
mov qword [rbx + 0x110], 2
mov qword [rbx + 0x120], 0
mov qword [rbx + 0x128], 0x20
mov byte [rbx + 0x130], 3
lea rax, str.Timing_suspicion_score:_0
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x48], 1
lea rax, [rbx + 0x100]
mov qword [rbx + 0x60], rax
mov qword [rbx + 0x68], 1
lea rax, [rbx + 0xb0]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], 1
mov qword [rbx + 0x88], rsi
mov rax, qword [rbx + 0x80]
mov qword [rbx + 0x90], rax
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x248], rcx
mov qword [rbx + 0x250], 8
mov qword [rbx + 0x258], rcx
mov qword [rbx + 0x260], 8
mov qword [rbx + 0x268], rax
mov qword [rbx + 0x88], rsi
mov rax, qword [rbx + 0x80]
mov qword [rbx + 0x90], rax
mov edx, 3
lea rcx, [rbx + 0x40]
lea r8, [rbx + 0x248]
xor r9d, r9d
call fcn.1401a7b20
movsd xmm6, qword [rbx + 0x2a0]
movsd xmm0, qword [rbx + 0x290]
addsd xmm0, xmm6
movapd xmm11, xmm0
movsd qword [rbx + 0x298], xmm0
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 3
jb 0x14009c6dc
lea rax, [rbx + 0x298]
mov qword [rbx + 0xb0], rax
lea rax, [0x14023de90]
mov qword [rbx + 0xb8], rax
mov qword [rbx + 0x100], 0
mov qword [rbx + 0x108], 2
mov qword [rbx + 0x110], 2
mov qword [rbx + 0x120], 0
mov qword [rbx + 0x128], 0x20
mov byte [rbx + 0x130], 3
lea rax, str.Total_Suspicion_Score_after_all_checks:_p
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x48], 1
lea rax, [rbx + 0x100]
mov qword [rbx + 0x60], rax
mov qword [rbx + 0x68], 1
lea rax, [rbx + 0xb0]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], 1
mov qword [rbx + 0x88], rsi
mov rax, qword [rbx + 0x80]
mov qword [rbx + 0x90], rax
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x248], rcx
mov qword [rbx + 0x250], 8
mov qword [rbx + 0x258], rcx
mov qword [rbx + 0x260], 8
mov qword [rbx + 0x268], rax
mov qword [rbx + 0x88], rsi
mov rax, qword [rbx + 0x80]
mov qword [rbx + 0x90], rax
mov edx, 3
lea rcx, [rbx + 0x40]
lea r8, [rbx + 0x248]
xor r9d, r9d
call fcn.1401a7b20
movsd xmm11, qword [rbx + 0x298]
test rsi, rsi
je 0x14009c6f6
mov r8d, 1
mov rcx, qword [rbx + 0x80]
mov rdx, rsi
call fcn.1400fcbd0
mov ecx, dword [rbx + 0xa8]
mov eax, ecx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
xor eax, eax
xorpd xmm6, xmm6
test ecx, ecx
sete cl
je 0x14009c726
movsd xmm1, qword [rbx + 0x2f0]
divsd xmm1, xmm0
xorps xmm6, xmm6
cvtsd2ss xmm6, xmm1
movddup xmm0, xmm0
movapd xmm1, xmmword [rbx + 0x3b0]
divpd xmm1, xmm0
cvtpd2ps xmm0, xmm1
mov al, cl
movd xmm1, eax
pshufd xmm10, xmm1, 0x50
pslld xmm10, 0x1f
psrad xmm10, 0x1f
pandn xmm10, xmm0
cvtsd2ss xmm11, xmm11
mov rsi, qword [rbx + 0x2e8]
cmp rsi, qword [rbx + 0x2d8]
jne 0x14009c77c
mov byte [rbx + 0x36], 1
lea rcx, [rbx + 0x2d8]
call fcn.1400097b0
mov rax, qword [rbx + 0x2e0]
lea rcx, [rsi + rsi*2]
mov edx, dword [rbx + 0xac]
mov dword [rax + rcx*8], edx
mov edx, dword [rbx + 0xa8]
mov dword [rax + rcx*8 + 4], edx
movq qword [rax + rcx*8 + 8], xmm10
movss dword [rax + rcx*8 + 0x10], xmm6
movss dword [rax + rcx*8 + 0x14], xmm11
inc rsi
mov qword [rbx + 0x2e8], rsi
mov rsi, qword [rbx + 0x98]
mov rcx, rsi
lea rdx, [rbx + 0x400]
call qword [sym.imp.kernel32.dll_Process32Next]
test eax, eax
jne 0x14009a1b0
mov byte [rbx + 0x36], 1
call fcn.140203920
mov qword [rbx + 0x100], rax
mov dword [rbx + 0x108], edx
test edx, edx
mov rsi, qword [rbx + 0x98]
je 0x14009a1b0
test rax, rax
je 0x14009c910
mov byte [rbx + 0x36], 1
lea rcx, [rbx + 0x100]
call fcn.14010c210
jmp 0x14009c910
test rax, rax
je 0x14009c910
mov byte [rbx + 0x36], 1
lea rcx, [rbx + 0x100]
call fcn.14010c210
jmp 0x14009c910
mov byte [rbx + 0x36], 1
call fcn.140203920
mov qword [rbx + 0x100], rax
mov dword [rbx + 0x108], edx
test edx, edx
mov rsi, qword [rbx + 0x98]
je 0x14009a1b0
test rax, rax
je 0x14009c87a
mov byte [rbx + 0x36], 1
lea rcx, [rbx + 0x100]
call fcn.14010c210
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 3
jb 0x14009c910
lea rax, str.Failed_to_get_the_first_process_entry
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 1
mov qword [rbx + 0x110], 8
movups xmmword [rbx + 0x118], xmm7
mov byte [rbx + 0x36], 1
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], 8
mov qword [rbx + 0x60], rax
mov byte [rbx + 0x36], 1
mov edx, 3
lea rcx, [rbx + 0x100]
lea r8, [rbx + 0x40]
xor r9d, r9d
call fcn.1401a7b20
nop dword [rax + rax]
mov rcx, qword [rbx + 0x98]
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x14009d530
mov rax, qword [rbx + 0x2d8]
mov qword [rbx + 0x98], rax
mov rdi, qword [rbx + 0x2e0]
mov rsi, qword [rbx + 0x2e8]
inc qword [rbx + 0x3a0]
lea rax, [rsi + rsi*2]
lea rax, [rdi + rax*8]
mov qword [rbx + 0x288], rax
mov esi, dword [rbx + 0x360]
mov r14d, esi
and r14d, 0xffff0000
mov r15, rdi
mov qword [rbx + 0x2f8], rdi
mov dword [rbx + 0xac], r14d
cmp r15, qword [rbx + 0x288]
je 0x14009d505
nop word cs:[rax + rax]
mov rax, qword [r15 + 0x10]
mov qword [rbx + 0x3f0], rax
movdqu xmm0, xmmword [r15]
movdqa xmmword [rbx + 0x3e0], xmm0
movaps xmmword [rbx + 0x100], xmm7
lea rax, [rbx + 0x108]
movaps xmmword [rax + 0x78], xmm7
lea rax, [rbx + 0x518]
movups xmmword [rax], xmm7
mov qword [rbx + 0x580], 1
mov qword [rbx + 0x588], 1
mov byte [rbx + 0x590], 0
mov r8d, 0x100
lea rsi, [rbx + 0x400]
mov rcx, rsi
lea rdx, [rbx + 0x100]
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + 0x500], 0
mov qword [rbx + 0x508], 0
mov qword [rbx + 0x510], 8
mov qword [rbx + 0x528], 8
mov qword [rbx + 0x530], 0
mov byte [rbx + 0x538], 1
movzx eax, byte [0x1403d2ea1]
mov ecx, 0x200
mov edx, 0x80
call fcn.1400fcbc0
test rax, rax
je 0x14009d73f
mov rdi, rax
mov r8d, 0x200
mov rcx, rax
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbx + 0x368], 1
mov qword [rbx + 0x370], rdi
mov qword [rbx + 0x2a0], 1
mov qword [rbx + 0x2a8], rdi
movzx eax, byte [0x1403d2ea1]
mov ecx, 0x18
mov edx, 8
call fcn.1400fcbc0
test rax, rax
je 0x14009d753
mov qword [rax], 1
mov qword [rax + 8], 1
mov dword [rax + 0x10], r14d
mov dword [rax + 0x14], 0
mov qword [rbx + 0x338], rax
movzx eax, byte [0x1403d2ea1]
mov ecx, 0x30
mov edx, 8
call fcn.1400fcbc0
test rax, rax
je 0x14009d764
mov qword [rbx + 0x40], 2
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], 0
lea rcx, [rbx + 0x368]
mov qword [rbx + 0x100], rcx
lea rcx, [rbx + 0x338]
mov qword [rbx + 0x108], rcx
movabs rcx, 0x200000000
mov qword [rbx + 0x110], rcx
lea rcx, [rbx + 0x50]
mov qword [rbx + 0x400], rcx
mov qword [rbx + 0x408], 0
mov qword [rbx + 0x410], rax
lea rcx, [rbx + 0x100]
lea rdx, [rbx + 0x400]
call fcn.1400a23f0
add r15, 0x18
mov qword [rbx + 0xe0], r15
movdqu xmm0, xmmword [rbx + 0x40]
movdqa xmmword [rbx + 0xb0], xmm0
mov rax, qword [rbx + 0x50]
mov qword [rbx + 0xc0], rax
mov qword [rbx + 0x248], 0
mov qword [rbx + 0x250], 8
mov qword [rbx + 0x258], 0
mov qword [rbx + 0x40], 0
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], 0
mov r13, qword [rbx + 0xb8]
lea rax, [rax + rax*2]
lea rax, [r13 + rax*8]
mov qword [rbx + 0xa0], rax
pxor xmm10, xmm10
mov r14, r13
mov qword [rbx + 0xe8], 0
nop word cs:[rax + rax]
lea rcx, [rbx + 0x400]
mov qword [rbx + 0x38], r14
cmp r14, qword [rbx + 0xa0]
je 0x14009ccb0
mov rdx, rdi
mov r9d, 0x3b9aca00
call fcn.140001d60
mov rax, qword [rbx + 0x38]
lea r14, [rax + 0x18]
cmp byte [rbx + 0x400], 1
je 0x14009cbf0
mov rsi, qword [rbx + 0x408]
mov r15, qword [rbx + 0x410]
mov rax, qword [rbx + 0x418]
mov qword [rbx + 0xe8], rax
movq xmm10, qword [rbx + 0x420]
mov r12, qword [rbx + 0x258]
cmp r12, qword [rbx + 0x248]
jne 0x14009cc68
lea rcx, [rbx + 0x248]
call fcn.140009160
mov rax, qword [rbx + 0x250]
mov qword [rax + r12*8], rsi
inc r12
mov qword [rbx + 0x258], r12
mov rsi, qword [rbx + 0x50]
cmp rsi, qword [rbx + 0x40]
jne 0x14009cc90
lea rcx, [rbx + 0x40]
call fcn.140009160
mov rax, qword [rbx + 0x48]
mov qword [rax + rsi*8], r15
inc rsi
mov qword [rbx + 0x50], rsi
jmp 0x14009cbf0
mov rax, qword [rbx + 0xb0]
mov qword [rbx + 0x400], r13
mov qword [rbx + 0x408], r13
mov qword [rbx + 0x410], rax
mov rax, qword [rbx + 0xa0]
mov qword [rbx + 0x418], rax
mov rsi, 0xffffffffffffffff
cmp r13, rax
je 0x14009cdcd
nop word [rax + rax]
lea rax, [r13 + 0x18]
mov qword [rbx + 0x408], rax
mov rax, qword [r13]
test rax, rax
je 0x14009cdcd
movdqu xmm0, xmmword [r13 + 8]
lea rcx, [rbx + 0x108]
movdqu xmmword [rcx], xmm0
mov qword [rbx + 0x100], rax
mov rcx, qword [rbx + 0x110]
call case.0x140213f19.330
mov rcx, qword [rbx + 0x108]
mov eax, 1
lock cmpxchg qword [rcx + 8], rsi
jne 0x14009d697
mov rax, qword [rcx]
mov qword [rcx + 8], 1
cmp rax, 1
jne 0x14009d697
mov rax, qword [rbx + 0x108]
mov rdi, qword [rax + 0x20]
mov r14, qword [rax + 0x28]
cmp qword [rax + 0x18], 0
mov qword [rax + 0x18], 0
je 0x14009d6e6
mov rax, qword [rbx + 0x100]
lock dec qword [rax]
jne 0x14009cd94
lea rcx, [rbx + 0x100]
call fcn.140008aa0
mov rax, qword [rbx + 0x108]
lock dec qword [rax]
jne 0x14009cdad
lea rcx, [rbx + 0x108]
call fcn.1400087f0
test rdi, rdi
jne 0x14009d6a8
mov r13, qword [rbx + 0x408]
mov rax, qword [rbx + 0x418]
cmp r13, rax
jne 0x14009ccf0
mov r12, 0xffffffffffffffff
lea rcx, [rbx + 0x400]
call fcn.14008a470
mov rcx, qword [rbx + 0x258]
xorps xmm11, xmm11
test rcx, rcx
je 0x14009ce10
mov r15, qword [rbx + 0x250]
cmp rcx, 4
jae 0x14009ce30
xor edx, edx
xor eax, eax
jmp 0x14009ce90
xor edi, edi
xor r13d, r13d
xorpd xmm12, xmm12
xorpd xmm6, xmm6
mov rax, qword [rbx + 0x50]
test rax, rax
jne 0x14009d1da
jmp 0x14009d29a
mov rax, rcx
and rax, 0xfffffffffffffffc
pxor xmm0, xmm0
xor edx, edx
pxor xmm1, xmm1
nop word cs:[rax + rax]
movdqu xmm2, xmmword [r15 + rdx*8]
paddq xmm0, xmm2
movdqu xmm2, xmmword [r15 + rdx*8 + 0x10]
paddq xmm1, xmm2
add rdx, 4
cmp rax, rdx
jne 0x14009ce50
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rdx, xmm0
jmp 0x14009ce97
add rdx, qword [r15 + rax*8]
inc rax
cmp rcx, rax
jne 0x14009ce90
movq xmm0, rdx
punpckldq xmm0, xmm13
subpd xmm0, xmm9
movapd xmm6, xmm0
unpckhpd xmm6, xmm0
addsd xmm6, xmm0
movq xmm1, rcx
punpckldq xmm1, xmm13
subpd xmm1, xmm9
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
divsd xmm6, xmm0
cmp rcx, 4
jae 0x14009cef0
movsd xmm1, qword [0x1402adf08]
xor edx, edx
jmp 0x14009cfc0
mov r8, rcx
and r8, 0xfffffffffffffffc
movsd xmm1, qword [0x1402adf08]
xor edx, edx
nop word cs:[rax + rax]
movq xmm2, qword [r15 + rdx*8]
punpckldq xmm2, xmm13
subpd xmm2, xmm9
movapd xmm3, xmm2
unpckhpd xmm3, xmm2
addsd xmm3, xmm2
subsd xmm3, xmm6
mulsd xmm3, xmm3
addsd xmm3, xmm1
movq xmm1, qword [r15 + rdx*8 + 8]
punpckldq xmm1, xmm13
subpd xmm1, xmm9
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
subsd xmm2, xmm6
mulsd xmm2, xmm2
addsd xmm2, xmm3
movq xmm1, qword [r15 + rdx*8 + 0x10]
punpckldq xmm1, xmm13
subpd xmm1, xmm9
movapd xmm3, xmm1
unpckhpd xmm3, xmm1
addsd xmm3, xmm1
subsd xmm3, xmm6
mulsd xmm3, xmm3
addsd xmm3, xmm2
movq xmm2, qword [r15 + rdx*8 + 0x18]
punpckldq xmm2, xmm13
subpd xmm2, xmm9
movapd xmm1, xmm2
unpckhpd xmm1, xmm2
addsd xmm1, xmm2
subsd xmm1, xmm6
mulsd xmm1, xmm1
addsd xmm1, xmm3
add rdx, 4
cmp r8, rdx
jne 0x14009cf10
mov eax, ecx
and eax, 3
je 0x14009d000
lea rdx, [r15 + rdx*8]
xor r8d, r8d
nop
movq xmm2, qword [rdx + r8*8]
punpckldq xmm2, xmm13
subpd xmm2, xmm14
movapd xmm3, xmm2
unpckhpd xmm3, xmm2
addsd xmm3, xmm2
subsd xmm3, xmm6
mulsd xmm3, xmm3
addsd xmm1, xmm3
inc r8
cmp rax, r8
jne 0x14009cfd0
divsd xmm1, xmm0
sqrtsd xmm12, xmm1
cmp rcx, 1
jne 0x14009d030
mov rdi, qword [r15]
mov r13, rdi
mov rax, qword [rbx + 0x50]
test rax, rax
jne 0x14009d1da
jmp 0x14009d29a
movabs rax, 0x1fffffffffffffff
add rcx, rax
mov r14, rcx
and r14, rax
mov r8, qword [r15]
lea r11, [r14 - 1]
mov edx, ecx
and edx, 3
cmp r11, 3
jae 0x14009d09f
mov rdi, r8
mov rax, r15
xor r13d, r13d
test rdx, rdx
je 0x14009d087
lea r9, [r15 + r13*8]
add r9, 8
mov r10, rdx
nop
mov rsi, qword [r9]
cmp rdi, rsi
cmovbe rdi, rsi
cmovbe rax, r9
add r9, 8
dec r10
jne 0x14009d070
and ecx, 3
cmp r11, 3
jae 0x14009d129
mov r11, r15
xor r9d, r9d
jmp 0x14009d197
mov r10, r14
sub r10, rdx
lea r9, [r15 + 0x20]
mov rdi, r8
mov rax, r15
xor r13d, r13d
jmp 0x14009d0cd
add r13, 4
add r9, 0x20
cmp r10, r13
je 0x14009d05e
mov rsi, qword [r9 - 0x18]
cmp rdi, rsi
ja 0x14009d100
lea rax, [r9 - 0x18]
mov rdi, rsi
mov rsi, qword [r9 - 0x10]
cmp rdi, rsi
jbe 0x14009d109
mov rsi, qword [r9 - 8]
cmp rdi, rsi
ja 0x14009d119
lea rax, [r9 - 8]
mov rdi, rsi
mov rsi, qword [r9]
cmp rdi, rsi
ja 0x14009d0c0
jmp 0x14009d121
mov rsi, qword [r9 - 0x10]
cmp rdi, rsi
ja 0x14009d0e6
lea rax, [r9 - 0x10]
mov rdi, rsi
mov rsi, qword [r9 - 8]
cmp rdi, rsi
jbe 0x14009d0ef
mov rsi, qword [r9]
cmp rdi, rsi
ja 0x14009d0c0
mov rdi, rsi
mov rax, r9
jmp 0x14009d0c0
sub r14, rcx
lea r10, [r15 + 0x20]
mov rdi, r8
mov r11, r15
xor r9d, r9d
nop dword [rax]
mov r8, qword [r10 - 0x18]
cmp rdi, r8
cmovb r8, rdi
lea rsi, [r10 - 0x18]
cmovbe rsi, r11
mov r11, qword [r10 - 0x10]
cmp r8, r11
cmovae r8, r11
lea rdi, [r10 - 0x10]
cmovbe rdi, rsi
mov r11, qword [r10 - 8]
cmp r8, r11
cmovae r8, r11
lea r11, [r10 - 8]
cmovbe r11, rdi
mov rsi, qword [r10]
cmp r8, rsi
cmovae r8, rsi
cmova r11, r10
add r9, 4
add r10, 0x20
mov rdi, r8
cmp r14, r9
jne 0x14009d140
test rcx, rcx
je 0x14009d1c7
lea rcx, [r15 + r9*8]
add rcx, 8
nop word cs:[rax + rax]
mov r9, qword [rcx]
cmp r8, r9
cmova r11, rcx
cmovae r8, r9
add rcx, 8
dec rdx
jne 0x14009d1b0
mov r13, qword [rax]
mov rdi, qword [r11]
mov rax, qword [rbx + 0x50]
test rax, rax
je 0x14009d29a
mov rcx, qword [rbx + 0x48]
cmp rax, 4
jae 0x14009d1f0
xor r8d, r8d
xor edx, edx
jmp 0x14009d250
mov rdx, rax
and rdx, 0xfffffffffffffffc
xorpd xmm0, xmm0
xor r8d, r8d
xorpd xmm1, xmm1
nop word cs:[rax + rax]
movdqu xmm2, xmmword [rcx + r8*8]
paddq xmm0, xmm2
movdqu xmm2, xmmword [rcx + r8*8 + 0x10]
paddq xmm1, xmm2
add r8, 4
cmp rdx, r8
jne 0x14009d210
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq r8, xmm0
jmp 0x14009d257
add r8, qword [rcx + rdx*8]
inc rdx
cmp rax, rdx
jne 0x14009d250
movq xmm0, rax
punpckldq xmm0, xmm13
subpd xmm0, xmm9
movapd xmm1, xmm0
unpckhpd xmm1, xmm0
addsd xmm1, xmm0
movq xmm0, r8
punpckldq xmm0, xmm13
subpd xmm0, xmm9
movapd xmm11, xmm0
unpckhpd xmm11, xmm0
addsd xmm11, xmm0
divsd xmm11, xmm1
movapd xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_round
cvttsd2si rax, xmm0
mov rcx, rax
sar rcx, 0x3f
movapd xmm1, xmm0
subsd xmm1, qword [0x14029f8c0]
cvttsd2si rdx, xmm1
and rdx, rcx
or rdx, rax
ucomisd xmm0, qword [0x1402adf18]
mov r15d, 0
cmovae r15, rdx
ucomisd xmm0, qword [0x14029f8c8]
cmova r15, r12
mov r14, qword [rbx + 0x330]
cmp r14, qword [rbx + 0x320]
jne 0x14009d300
lea rcx, [rbx + 0x320]
call fcn.140009880
xorpd xmm0, xmm0
maxsd xmm0, xmm11
movsd xmm1, qword [0x1402adf10]
minsd xmm1, xmm0
cvttsd2si rax, xmm1
mov rcx, qword [rbx + 0x328]
imul rdx, r14, 0x68
mov r8, qword [rbx + 0x3d0]
mov qword [rcx + rdx], r8
movss xmm0, dword [rbx + 0x364]
movss dword [rcx + rdx + 8], xmm0
movsd qword [rcx + rdx + 0x10], xmm6
movsd qword [rcx + rdx + 0x18], xmm12
mov qword [rcx + rdx + 0x20], r13
mov qword [rcx + rdx + 0x28], rdi
mov qword [rcx + rdx + 0x30], r15
mov r8, qword [rbx + 0xe8]
mov qword [rcx + rdx + 0x38], r8
movdqa xmm0, xmmword [rbx + 0x3e0]
movdqu xmmword [rcx + rdx + 0x40], xmm0
mov r8, qword [rbx + 0x3f0]
mov qword [rcx + rdx + 0x50], r8
mov dword [rcx + rdx + 0x58], eax
mov dword [rcx + rdx + 0x5c], 0
mov rax, qword [rbx + 0x3c8]
mov word [rcx + rdx + 0x60], ax
movd dword [rcx + rdx + 0x62], xmm10
inc r14
mov qword [rbx + 0x330], r14
mov rdx, qword [rbx + 0x40]
test rdx, rdx
je 0x14009d3c5
mov rcx, qword [rbx + 0x48]
shl rdx, 3
mov r8d, 8
call fcn.1400fcbd0
mov rdx, qword [rbx + 0x248]
test rdx, rdx
mov r14d, dword [rbx + 0xac]
mov r15, qword [rbx + 0xe0]
je 0x14009d3f5
mov rcx, qword [rbx + 0x250]
shl rdx, 3
mov r8d, 8
call fcn.1400fcbd0
mov rax, qword [rbx + 0x338]
lock dec qword [rax]
jne 0x14009d40e
lea rcx, [rbx + 0x338]
call fcn.140008cb0
mov rax, qword [rbx + 0x2a0]
test rax, rax
je 0x14009d470
cmp eax, 1
jne 0x14009d4a0
mov rsi, qword [rbx + 0x2a8]
lock dec qword [rsi + 0x188]
jne 0x14009d4e2
mov rcx, rsi
call fcn.140001790
mov al, 1
xchg byte [rsi + 0x190], al
test al, al
je 0x14009d4e2
mov qword [rbx + 0x38], rsi
mov rcx, rsi
call fcn.1400a6300
mov edx, 0x200
mov r8d, 0x80
jmp 0x14009d4d9
mov rsi, qword [rbx + 0x2a8]
lock dec qword [rsi + 0x208]
jne 0x14009d4e2
mov rcx, rsi
call fcn.140003860
mov al, 1
xchg byte [rsi + 0x210], al
test al, al
je 0x14009d4e2
mov rcx, rsi
call fcn.1400a6620
jmp 0x14009d4e2
mov rsi, qword [rbx + 0x2a8]
lock dec qword [rsi + 0x78]
jne 0x14009d4e2
mov rcx, rsi
call fcn.1400b4300
mov al, 1
xchg byte [rsi + 0x80], al
test al, al
je 0x14009d4e2
mov qword [rbx + 0x38], rsi
mov rcx, rsi
call fcn.1400a8040
mov edx, 0x88
mov r8d, 8
mov rcx, qword [rbx + 0x38]
call fcn.1400fcbd0
lea rcx, [rbx + 0x368]
call fcn.14007f040
mov esi, r14d
mov rdi, qword [rbx + 0x2f8]
cmp r15, qword [rbx + 0x288]
jne 0x14009c990
mov rax, qword [rbx + 0x98]
test rax, rax
je 0x140099fd0
shl rax, 3
lea rdx, [rax + rax*2]
mov r8d, 4
mov rcx, rdi
call fcn.1400fcbd0
jmp 0x140099fd0
mov byte [rbx + 0x36], 1
call fcn.140203920
mov qword [rbx + 0x100], rax
mov dword [rbx + 0x108], edx
test edx, edx
je 0x14009c925
test rax, rax
je 0x14009d563
mov byte [rbx + 0x36], 1
lea rcx, [rbx + 0x100]
call fcn.14010c210
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 3
jb 0x14009c925
lea rax, str.Warning:_Failed_to_close_process_snapshot_handle_properly
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 1
mov qword [rbx + 0x110], 8
movups xmmword [rbx + 0x118], xmm7
mov byte [rbx + 0x36], 1
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], 8
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], 8
mov qword [rbx + 0x60], rax
mov byte [rbx + 0x36], 1
mov edx, 3
lea rcx, [rbx + 0x100]
lea r8, [rbx + 0x40]
xor r9d, r9d
call fcn.1401a7b20
jmp 0x14009c925
mov rax, qword [rbx + 0x330]
mov rcx, qword [rbx + 0x3c0]
mov qword [rcx + 0x10], rax
movupd xmm0, xmmword [rbx + 0x320]
movupd xmmword [rcx], xmm0
mov byte [rbx + 0x37], 0
lea rcx, [rbx + 0x660]
call fcn.140094170
movaps xmm6, xmmword [rbp + 0x710]
movaps xmm7, xmmword [rbp + 0x720]
movaps xmm8, xmmword [rbp + 0x730]
movaps xmm9, xmmword [rbp + 0x740]
movaps xmm10, xmmword [rbp + 0x750]
movaps xmm11, xmmword [rbp + 0x760]
movaps xmm12, xmmword [rbp + 0x770]
movaps xmm13, xmmword [rbp + 0x780]
movaps xmm14, xmmword [rbp + 0x790]
movaps xmm15, xmmword [rbp + 0x7a0]
lea rsp, [rbp + 0x7b8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.srcml.rs
call fcn.14029d730
jmp 0x14009d7d7
lea rcx, str._rustc_f6e511eec7342f59a25f7c0534f1dbea00d01b14library_std_src_threadmod.rs
call fcn.14029d730
jmp 0x14009d7d7
mov qword [rbx + 0x100], rdi
mov qword [rbx + 0x108], r14
lea rax, str.srcml.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1402ae238]
lea r9, [0x1402ae268]
lea r8, [rbx + 0x100]
mov edx, 0x2b
call fcn.14029dbe0
jmp 0x14009d7d7
lea rcx, str._rustc_f6e511eec7342f59a25f7c0534f1dbea00d01b14library_std_src_threadmod.rs
call fcn.14029d730
jmp 0x14009d7d7
lea rax, str.Unsupported_instruction.
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], 1
mov qword [rbx + 0x110], 8
pxor xmm0, xmm0
movdqu xmmword [rbx + 0x118], xmm0
lea rdx, str.srcml.rs
lea rcx, [rbx + 0x100]
call fcn.14029d7b0
jmp 0x14009d7d7
mov ecx, 0x80
mov edx, 0x200
call fcn.14029d5b0
jmp 0x14009d7d7
mov ecx, 8
mov edx, 0x18
call fcn.14029d5b0
jmp 0x14009d7d7
mov ecx, 8
mov edx, 0x30
call fcn.14029d590
jmp 0x14009d7d7
xor r15d, r15d
mov rcx, r15
mov rdx, rdi
call fcn.14029d590
jmp 0x14009d7d7
lea r8, str.srcml.rs
mov rdx, r14
call fcn.14029d940
jmp 0x14009d7d7
mov qword [rbx + 0x88], 0
mov qword [rbx + 0x90], 1
mov ecx, 1
mov edx, 0xc
call fcn.14029d590
jmp 0x14009d7d7
xor edi, edi
jmp 0x14009d7c8
mov qword [rbx + 0x390], rsi
mov rcx, rdi
mov rdx, qword [rbx + 0x390]
call fcn.14029d590
ud2