Function at 0x18006df70
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea rcx, [rdx + 0x32060]
mov rdx, rsp
call sub.VCRUNTIME140.dll___intrinsic_setjmp
mov esi, eax
test eax, eax
jne 0x18006eae0
mov rbx, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rdx, rbx
mov rcx, rsi
call sym.VBoxVMM.dll_TMR3NotifyResume
mov eax, dword [rbx + 0x32000]
xor r15d, r15d
mov byte [rsp + 0x40], 0
mov edi, r15d
cmp eax, 8
jne 0x18006dfee
mov ecx, dword [rbx + 0x32004]
lea eax, [rcx - 6]
cmp eax, 1
ja 0x18006dfee
mov dword [rbx + 0x32000], ecx
jmp 0x18006dfff
mov rdx, rbx
mov rcx, rsi
call fcn.180070c50
mov dword [rbx + 0x32000], eax
mov dword [rbx + 0x3200c], r15d
rdtsc
shl rdx, 0x20
lea r12, [0x180000000]
or rax, rdx
mov r13d, 0xfffffb83
mov qword [rbx + 0x324b0], rax
lea rbp, str.int___cdecl_EMR3ExecuteVM_struct_VM__struct_VMCPU__
nop word [rax + rax]
cmp byte [rsp + 0x40], r15b
jne 0x18006e06f
test edi, edi
js 0x18006e06f
cmp edi, 0x44c
je 0x18006e06f
cmp edi, 0x455
je 0x18006e06f
mov eax, dword [rsi + 4]
test eax, eax
jne 0x18006e05d
mov rax, qword [rbx]
test rax, 0xfffffffffff4ff9f
je 0x18006e06f
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call fcn.18006ff10
mov edi, eax
jmp 0x18006e074
mov byte [rsp + 0x40], r15b
mov r14d, dword [rbx + 0x32000]
cmp edi, 0x44c
jg 0x18006e0a2
je 0x18006e6fa
cmp edi, 0xfffff573
je 0x18006e2a6
test edi, edi
jne 0x18006e2a2
jmp 0x18006e2b0
lea eax, [rdi - 0x44d]
cmp eax, 0x36
ja case.0x18006e0c7.1115
cdqe
movzx eax, byte [r12 + rax + 0x6ebe8]
mov ecx, dword [r12 + rax*4 + 0x6ebac]
add rcx, r12
jmp rcx
mov ecx, 0x880010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x18006e110
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x8bb
mov edx, 0x10
lea rcx, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxVMMVMMR3EM.cpp
mov qword [rsp + 0x20], rcx
lea r9, str.AssertLogRel__s__d___s:__s_n
mov rcx, rax
lea r8d, [rdx + 0x78]
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov dword [rbx + 0x32000], 1
jmp 0x18006e2b0
movzx eax, byte [rsi + 0x50]
cmp al, 2
jne 0x18006e153
lea r8, [rbx + 0x19000]
mov rdx, rbx
mov rcx, rsi
call sym.VBoxVMM.dll_HMCanExecuteGuest
test al, al
mov ecx, 0x10
mov eax, 3
cmovne ecx, eax
mov dword [rbx + 0x32000], ecx
jmp 0x18006e2b0
cmp al, 3
jne 0x18006e166
mov dword [rbx + 0x32000], 0x11
jmp 0x18006e2b0
mov ecx, 0x880010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x18006e110
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x8d8
jmp 0x18006e0eb
mov eax, dword [rbx + 0x32000]
cmp eax, 0x10
je 0x18006e2b0
mov dword [rbx + 0x32000], 0x10
mov dword [rbx + 0x3200c], r15d
jmp 0x18006e2b0
mov ecx, dword [rbx + 0x32004]
lea eax, [rcx - 6]
cmp eax, 1
ja case.0x18006e0c7.1112
mov dword [rbx + 0x32000], ecx
jmp 0x18006e2b0
mov dword [rbx + 0x32000], 6
jmp 0x18006e2b0
mov dword [rbx + 0x32000], 7
jmp 0x18006e2b0
mov dword [rbx + 0x32004], r14d
mov dword [rbx + 0x32000], 8
jmp 0x18006e2b0
cmp dword [rbx + 0x80b8], r15d
jne case.0x18006e0c7.1113
mov rdx, rbx
mov rcx, rsi
call fcn.180070c50
mov ecx, dword [rbx + 0x32000]
cmp ecx, eax
je 0x18006e229
cmp eax, 0x10
jne 0x18006e229
mov dword [rbx + 0x3200c], r15d
mov dword [rbx + 0x32000], eax
jmp 0x18006e2b0
cmp r14d, 2
jne 0x18006e243
mov dword [rbx + 0x32000], 0xa
jmp 0x18006e2b0
cmp r14d, 3
jne 0x18006e255
mov dword [rbx + 0x32000], 0xb
jmp 0x18006e2b0
cmp r14d, 0x11
jne 0x18006e267
mov dword [rbx + 0x32000], 0x12
jmp 0x18006e2b0
cmp r14d, 5
mov eax, r15d
sete al
add eax, 0xc
mov dword [rbx + 0x32000], eax
jmp 0x18006e2b0
mov dword [rbx + 0x32000], 0xe
jmp 0x18006e2b0
cmp byte [rsi + 0x119601], r15b
jne 0x18006e2a6
mov rcx, rsi
call fcn.1800d9a80
mov edi, eax
jmp 0x18006e030
test edi, edi
cmovns edi, r13d
mov dword [rbx + 0x32000], 0xf
mov ebp, dword [rbx + 0x32000]
cmp r14d, ebp
je 0x18006e307
cmp r14d, 6
jne 0x18006e307
test byte [rbx + 0x32030], 1
jne 0x18006e2d1
mov rax, qword [rbx]
test al, 0x40
je 0x18006e307
cmp ebp, 0x12
ja 0x18006e307
mov eax, 0x73c2c
bt eax, ebp
jae 0x18006e307
mov eax, dword [rbx + 0x32030]
test al, 1
je 0x18006e2f3
and eax, 0xfffffffc
mov dword [rbx + 0x32030], eax
mov rax, qword [rbx]
test al, 0x40
je 0x18006e307
mov edx, 6
mov rcx, rbx
call fcn.180203fdb
lea eax, [rbp - 1]
cmp eax, 0x11
ja case.0x18006e320.1
cdqe
mov ecx, dword [r12 + rax*4 + 0x6ec20]
add rcx, r12
jmp rcx
mov ecx, 0x880010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
lea rbp, str.int___cdecl_EMR3ExecuteVM_struct_VM__struct_VMCPU__
test rax, rax
je 0x18006e370
mov qword [rsp + 0x38], r15
lea rcx, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxVMMVMMR3EM.cpp
mov edx, 0x10
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x9eb
lea r9, str.AssertLogRel__s__d___s:__s_n
mov qword [rsp + 0x20], rcx
mov rcx, rax
lea r8d, [rdx + 0x78]
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0x880010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x18006e39d
mov edx, 0x10
mov dword [rsp + 0x20], edi
lea r9, str._Rrc_n
mov rcx, rax
lea r8d, [rdx + 0x78]
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov edi, r13d
jmp 0x18006e030
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
call fcn.180072030
mov edi, eax
jmp 0x18006e023
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
call fcn.180072570
mov edi, eax
jmp 0x18006e023
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
call fcn.18006d8d0
mov edi, eax
jmp 0x18006e023
lea r9, [rsp + 0x44]
mov dword [rsp + 0x44], r15d
mov edx, 0x1000
mov r8d, 0x7ff
mov rcx, rbx
call sym.VBoxVMM.dll_IEMExecLots
mov edi, eax
cmp byte [rsi + 0x119600], r15b
je 0x18006e427
cmp dword [rsp + 0x44], 0x800
jae 0x18006e427
mov rdx, rbx
mov rcx, rsi
call fcn.1801c23d0
mov byte [rsp + 0x40], r15b
jmp 0x18006e023
mov byte [rsp + 0x40], r15b
mov eax, dword [rbx + 0x3200c]
cmp eax, 0x400
jae 0x18006e511
mov edx, 0x400
lea r9, [rsp + 0x48]
sub edx, eax
mov r8d, 0x7fffffff
mov rcx, rbx
call sym.VBoxVMM.dll_IEMExecLots
mov edi, eax
mov eax, dword [rsp + 0x48]
add dword [rbx + 0x3200c], eax
test edi, edi
jne 0x18006e4fd
mov eax, dword [rbx + 0x32000]
cmp eax, 7
je 0x18006e4de
cmp byte [rsi + 0x119600], r15b
jne 0x18006e4d7
movzx eax, byte [rsi + 0x50]
cmp al, 1
je 0x18006e4d7
mov rdx, rbx
mov rcx, rsi
cmp al, 2
jne 0x18006e4b0
lea r8, [rbx + 0x19000]
call sym.VBoxVMM.dll_HMCanExecuteGuest
test al, al
je 0x18006e4b9
lea ecx, [rdi + 3]
jmp 0x18006e4e3
call fcn.1801d5c60
test al, al
jne 0x18006e4d0
mov eax, dword [rsi + 4]
test eax, eax
jne 0x18006e4f5
mov rax, qword [rbx]
test rax, 0xfffffffffff4ff9f
jne 0x18006e4f5
jmp 0x18006e436
mov ecx, 0x11
jmp 0x18006e4e3
mov ecx, 4
jmp 0x18006e4e3
mov ecx, 7
mov eax, dword [rbx + 0x32000]
mov dword [rbx + 0x32004], eax
mov dword [rbx + 0x32000], ecx
mov edi, r15d
jmp 0x18006e023
cmp edi, 0xffffeaf2
je 0x18006e511
cmp edi, 0xffffeb4c
jne 0x18006e023
mov dword [rbx + 0x32000], 5
mov edi, r15d
jmp 0x18006e023
rdtsc
shl rdx, 0x20
mov rcx, rbx
or rax, rdx
mov rbp, rax
call sym.VBoxVMM.dll_TRPMHasTrap
test al, al
je 0x18006e542
mov edi, 0x45e
jmp 0x18006e5ba
mov eax, dword [rbx + 0x32030]
and eax, 3
cmp al, 3
jne 0x18006e589
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.1800dc4a0
mov edi, eax
test eax, eax
jne 0x18006e5ba
lock btr dword [rbx], 8
setb al
test al, al
je 0x18006e577
mov rcx, rbx
call sym.VBoxVMM.dll_APICUpdatePendingInterrupts
mov rax, qword [rbx]
test rax, 0x85b
je 0x18006e5ba
mov edi, 0x45e
jmp 0x18006e5ba
mov rcx, rbx
call sym.VBoxVMM.dll_CPUMGetGuestEFlags
shr eax, 9
mov rdx, rbx
not al
mov rcx, rsi
and al, 1
movzx r8d, al
call fcn.1800dc4a0
mov edi, eax
test eax, eax
jne 0x18006e5ba
mov rax, qword [rbx]
test al, 0x58
mov eax, 0x45e
cmovne edi, eax
rdtsc
mov rcx, qword [rbx + 0x32260]
shl rdx, 0x20
or rdx, rax
sub rdx, rbp
add rcx, rdx
mov qword [rbx + 0x32260], rcx
mov rcx, qword [rbx + 0x32258]
inc rcx
mov qword [rbx + 0x32258], rcx
mov rcx, qword [rbx + 0x32268]
cmp rcx, rdx
jae 0x18006e5fb
mov qword [rbx + 0x32268], rdx
mov rax, qword [rbx + 0x32270]
lea rbp, str.int___cdecl_EMR3ExecuteVM_struct_VM__struct_VMCPU__
cmp rax, rdx
jbe 0x18006e030
mov qword [rbx + 0x32270], rdx
jmp 0x18006e023
mov rdx, rbx
mov rcx, rsi
call sym.VBoxVMM.dll_TMR3NotifySuspend
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call fcn.18006d150
mov rdx, rbx
mov rcx, rsi
mov edi, eax
call sym.VBoxVMM.dll_TMR3NotifyResume
jmp 0x18006e023
mov rdx, rbx
mov rcx, rsi
call sym.VBoxVMM.dll_TMR3NotifySuspend
mov rax, qword [rbx + 0x324b0]
test rax, rax
je 0x18006e6c2
rdtsc
mov rcx, qword [rbx + 0x324b0]
mov qword [rbx + 0x324b0], r15
shl rdx, 0x20
or rdx, rax
sub rdx, rcx
mov rcx, qword [rbx + 0x32498]
add rcx, rdx
mov qword [rbx + 0x32498], rcx
mov rcx, qword [rbx + 0x32490]
inc rcx
mov qword [rbx + 0x32490], rcx
mov rcx, qword [rbx + 0x324a0]
cmp rcx, rdx
jae 0x18006e6af
mov qword [rbx + 0x324a0], rdx
mov rax, qword [rbx + 0x324a8]
cmp rax, rdx
jbe 0x18006e6c2
mov qword [rbx + 0x324a8], rdx
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call fcn.18006d150
mov edi, eax
test eax, eax
jne 0x18006e956
rdtsc
shl rdx, 0x20
mov rcx, rsi
or rax, rdx
mov rdx, rbx
mov qword [rbx + 0x324b0], rax
call sym.VBoxVMM.dll_TMR3NotifyResume
jmp 0x18006e023
mov dword [rbx + 0x32000], 9
mov eax, dword [rsi]
cmp eax, 0x1e
jge 0x18006e716
mov rdx, rbx
mov rcx, rsi
call sym.VBoxVMM.dll_TMR3NotifySuspend
mov rax, qword [rbx + 0x324b0]
test rax, rax
je 0x18006e784
rdtsc
mov rcx, qword [rbx + 0x324b0]
mov qword [rbx + 0x324b0], r15
shl rdx, 0x20
or rax, rdx
sub rax, rcx
mov rcx, qword [rbx + 0x32498]
add rcx, rax
mov qword [rbx + 0x32498], rcx
mov rcx, qword [rbx + 0x32490]
inc rcx
mov qword [rbx + 0x32490], rcx
mov rcx, qword [rbx + 0x324a0]
cmp rcx, rax
jae 0x18006e771
mov qword [rbx + 0x324a0], rax
mov rcx, qword [rbx + 0x324a8]
cmp rcx, rax
jbe 0x18006e784
mov qword [rbx + 0x324a8], rax
mov eax, 0x44c
jmp 0x18006eb92
mov rdx, rbx
mov dword [rbx + 0x32000], 9
mov rcx, rsi
call sym.VBoxVMM.dll_TMR3NotifySuspend
mov rax, qword [rbx + 0x324b0]
test rax, rax
je 0x18006e811
rdtsc
mov rcx, qword [rbx + 0x324b0]
mov qword [rbx + 0x324b0], r15
shl rdx, 0x20
or rdx, rax
sub rdx, rcx
mov rcx, qword [rbx + 0x32498]
add rcx, rdx
mov qword [rbx + 0x32498], rcx
mov rcx, qword [rbx + 0x32490]
inc rcx
mov qword [rbx + 0x32490], rcx
mov rcx, qword [rbx + 0x324a0]
cmp rcx, rdx
jae 0x18006e7fe
mov qword [rbx + 0x324a0], rdx
mov rax, qword [rbx + 0x324a8]
cmp rax, rdx
jbe 0x18006e811
mov qword [rbx + 0x324a8], rdx
mov eax, edi
jmp 0x18006eb92
mov dword [rbx + 0x32004], r14d
mov rdx, rbx
mov rcx, rsi
mov dword [rbx + 0x32000], 8
call sym.VBoxVMM.dll_TMR3NotifySuspend
mov rax, qword [rbx + 0x324b0]
test rax, rax
je 0x18006e8a2
rdtsc
mov rcx, qword [rbx + 0x324b0]
mov qword [rbx + 0x324b0], r15
shl rdx, 0x20
or rdx, rax
sub rdx, rcx
mov rcx, qword [rbx + 0x32498]
add rcx, rdx
mov qword [rbx + 0x32498], rcx
mov rcx, qword [rbx + 0x32490]
inc rcx
mov qword [rbx + 0x32490], rcx
mov rcx, qword [rbx + 0x324a0]
cmp rcx, rdx
jae 0x18006e88f
mov qword [rbx + 0x324a0], rdx
mov rax, qword [rbx + 0x324a8]
cmp rax, rdx
jbe 0x18006e8a2
mov qword [rbx + 0x324a8], rdx
lea r9, str.Unable_to_allocate_and_lock_memory._The_virtual_machine_will_be_paused._Please_close_applications_to_free_up_memory_or_close_the_VM
mov edx, 2
lea r8, str.HostMemoryLow
mov rcx, rsi
call sym.VBoxVMM.dll_VMSetRuntimeError
mov edi, eax
cmp eax, 0x456
je 0x18006e94f
test eax, eax
js 0x18006e945
mov ecx, 0x880010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x18006e915
mov qword [rsp + 0x38], r15
lea rcx, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxVMMVMMR3EM.cpp
mov edx, 0x10
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x960
lea r9, str.AssertLogRel__s__d___s:__s_n
mov qword [rsp + 0x20], rcx
mov rcx, rax
lea r8d, [rdx + 0x78]
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0x880010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x18006e942
mov edx, 0x10
mov dword [rsp + 0x20], edi
lea r9, str._Rrc_n
mov rcx, rax
lea r8d, [rdx + 0x78]
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov edi, r13d
mov dword [rbx + 0x32000], 0xf
mov eax, edi
jmp 0x18006eb92
cmp edi, 0x455
je 0x18006e98d
cmp edi, 0x44c
je 0x18006e98d
mov rcx, rsi
mov dword [rbx + 0x32000], 0xf
call fcn.1800d9f20
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call sym.VBoxVMM.dll_VMMR3FatalDump
mov eax, edi
jmp 0x18006eb92
mov dword [rbx + 0x32000], 9
mov eax, edi
jmp 0x18006eb92
mov rdx, rbx
mov rcx, rsi
call sym.VBoxVMM.dll_TMR3NotifySuspend
mov rax, qword [rbx + 0x324b0]
test rax, rax
je 0x18006ea17
rdtsc
mov rcx, qword [rbx + 0x324b0]
mov qword [rbx + 0x324b0], r15
shl rdx, 0x20
or rdx, rax
sub rdx, rcx
mov rcx, qword [rbx + 0x32498]
add rcx, rdx
mov qword [rbx + 0x32498], rcx
mov rcx, qword [rbx + 0x32490]
inc rcx
mov qword [rbx + 0x32490], rcx
mov rcx, qword [rbx + 0x324a0]
cmp rcx, rdx
jae 0x18006ea04
mov qword [rbx + 0x324a0], rdx
mov rax, qword [rbx + 0x324a8]
cmp rax, rdx
jbe 0x18006ea17
mov qword [rbx + 0x324a8], rdx
mov eax, 0x456
jmp 0x18006eb92
mov rdx, rbx
mov rcx, rsi
call sym.VBoxVMM.dll_TMR3NotifySuspend
mov rcx, rsi
call fcn.1800d9f20
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call sym.VBoxVMM.dll_VMMR3FatalDump
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call fcn.18006d150
jmp 0x18006e7a3
mov rdx, rbx
mov dword [rbx + 0x32000], 0xf
mov rcx, rsi
call sym.VBoxVMM.dll_TMR3NotifySuspend
mov rax, qword [rbx + 0x324b0]
test rax, rax
je 0x18006ead8
rdtsc
mov rcx, qword [rbx + 0x324b0]
mov qword [rbx + 0x324b0], r15
shl rdx, 0x20
or rax, rdx
sub rax, rcx
mov rcx, qword [rbx + 0x32498]
add rcx, rax
mov qword [rbx + 0x32498], rcx
mov rcx, qword [rbx + 0x32490]
inc rcx
mov qword [rbx + 0x32490], rcx
mov rcx, qword [rbx + 0x324a0]
cmp rcx, rax
jae 0x18006eac5
mov qword [rbx + 0x324a0], rax
mov rcx, qword [rbx + 0x324a8]
cmp rcx, rax
jbe 0x18006ead8
mov qword [rbx + 0x324a8], rax
mov eax, r13d
jmp 0x18006eb92
mov rdi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rdx, rdi
mov rcx, rbx
call sym.VBoxVMM.dll_TMR3NotifySuspend
mov rcx, rbx
call fcn.1800d9f20
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call sym.VBoxVMM.dll_VMMR3FatalDump
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call fcn.18006d150
mov rax, qword [rdi + 0x324b0]
test rax, rax
je 0x18006eb90
rdtsc
mov rcx, qword [rdi + 0x324b0]
xor r15d, r15d
mov qword [rdi + 0x324b0], r15
shl rdx, 0x20
or rdx, rax
sub rdx, rcx
mov rcx, qword [rdi + 0x32498]
add rcx, rdx
mov qword [rdi + 0x32498], rcx
mov rcx, qword [rdi + 0x32490]
inc rcx
mov qword [rdi + 0x32490], rcx
mov rcx, qword [rdi + 0x324a0]
cmp rcx, rdx
jae 0x18006eb7d
mov qword [rdi + 0x324a0], rdx
mov rax, qword [rdi + 0x324a8]
cmp rax, rdx
jbe 0x18006eb90
mov qword [rdi + 0x324a8], rdx
mov eax, esi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret