Function at 0x401080
Capabilities:
Check for sandbox and av modules
Check for sandbox username or hostname
Check for time delay via gettickcount
Check if process is running under wine
Get disk information
Get disk size
Get memory capacity
Get session user name
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x524
mov eax, dword [0x41f004]
xor eax, esp
mov dword [esp + 0x520], eax
push ebx
push esi
push edi
push 6
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.Start
call fcn.00401010
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push 8
push esi
call ebx
push 0xfffffffffffffff5
call edi
push str._Pafish__
mov esi, eax
call fcn.00401010
add esp, 4
push 0xb
push esi
call ebx
push str.Paranoid_Fish
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.___n_n
call fcn.00401010
push str.Debuggers_detection
push str._n_____s_n
call fcn.00401010
push str.Using_IsDebuggerPresent__
push str.____s_...
call fcn.00401010
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40115d
push str.Debugger_traced_using_IsDebuggerPresent__
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x40116d
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Generic_sandbox_detection
push str._n_____s_n
call fcn.00401010
push str.Checking_username
push str.____s_...
call fcn.00401010
add esp, 0x10
mov dword [esp + 0xc], 0xc8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ecx, [esp + 0x58]
xor esi, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4011c0
sub ecx, edx
je 0x4011fd
nop dword [eax + eax]
movsx eax, byte [esp + esi + 0x58]
push eax
call fcn.0040822b
lea ecx, [esp + 0x5c]
mov byte [esp + esi + 0x5c], al
add esp, 4
lea edx, [ecx + 1]
inc esi
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4011f0
sub ecx, edx
cmp esi, ecx
jb 0x4011d0
lea eax, [esp + 0x58]
push str.SANDBOX
push eax
call fcn.00403110
add esp, 8
test eax, eax
jne 0x401251
lea eax, [esp + 0x58]
push 0x41b958
push eax
call fcn.00403110
add esp, 8
test eax, eax
jne 0x401251
lea eax, [esp + 0x58]
push str.MALWARE
push eax
call fcn.00403110
add esp, 8
test eax, eax
jne 0x401251
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
jmp 0x401271
push str.Sandbox_traced_by_checking_username
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Checking_file_path
push str.____s_...
call fcn.00401010
add esp, 8
lea eax, [esp + 0x228]
push 0x1f4
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x228]
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4012b1
sub ecx, edx
je 0x4012f0
nop dword [eax]
movsx eax, byte [esp + esi + 0x228]
push eax
call fcn.0040822b
lea ecx, [esp + 0x22c]
mov byte [esp + esi + 0x22c], al
add esp, 4
lea edx, [ecx + 1]
inc esi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4012e3
sub ecx, edx
cmp esi, ecx
jb 0x4012c0
lea eax, [esp + 0x228]
push str.SAMPLE
push eax
call fcn.00403110
add esp, 8
test eax, eax
jne 0x40134d
lea eax, [esp + 0x228]
push str.VIRUS
push eax
call fcn.00403110
add esp, 8
test eax, eax
jne 0x40134d
lea eax, [esp + 0x228]
push str.SANDBOX
push eax
call fcn.00403110
add esp, 8
test eax, eax
jne 0x40134d
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
jmp 0x40136d
push str.Sandbox_traced_by_checking_file_path
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Checking_common_sample_names_in_drives_root
push str.____s_...
call fcn.00401010
push 0x104
lea eax, [esp + 0x42c]
push 0
push eax
call fcn.00403750
add esp, 0x14
lea eax, [esp + 0x420]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x401471
cmp eax, 0x104
ja 0x401471
push 0x104
lea eax, [esp + 0x124]
push 0
push eax
lea esi, [esp + 0x42c]
call fcn.00403750
add esp, 0xc
cmp byte [esp + 0x420], 0
je 0x401471
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x40145c
push esi
push str._ssample.exe
lea eax, [esp + 0x128]
push 0x104
push eax
call fcn.00401040
add esp, 0x10
lea ecx, [esp + 0x120]
call fcn.00402500
test eax, eax
jne 0x40155c
push esi
push str._smalware.exe
lea eax, [esp + 0x128]
push 0x104
push eax
call fcn.00401040
add esp, 0x10
lea ecx, [esp + 0x120]
call fcn.00402500
test eax, eax
jne 0x40155c
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401461
sub ecx, edx
inc esi
add esi, ecx
cmp byte [esi], al
jne 0x4013f2
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Checking_if_disk_size___60GB_via_DeviceIoControl__
push str.____s_...
call fcn.00401010
add esp, 8
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push str..PhysicalDrive0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
jne 0x401581
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Checking_if_disk_size___60GB_via_GetDiskFreeSpaceExA__
push str.____s_...
call fcn.00401010
add esp, 8
lea eax, [esp + 0x18]
push 0
push eax
push 0
push 0x41b9ac
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x4015ff
mov eax, dword [esp + 0x18]
and eax, 0xc0000000
cmp dword [esp + 0x1c], 0xf
ja 0x4015ff
jb 0x401537
test eax, eax
jne 0x4015ff
push str.Sandbox_traced_by_checking_disk_size___60GB_via_GetDiskFreeSpaceExA__
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x40160f
push str.Sandbox_traced_by_checking_common_sample_names_in_drives_root
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x401481
push 0
lea ecx, [esp + 0x14]
push ecx
push 8
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push 0x7405c
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4014ce
push 0
push 0x40000000
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.00415680
test edx, edx
jg 0x4014ce
jl 0x4015da
cmp eax, 0x3c
ja 0x4014ce
push str.Sandbox_traced_by_checking_disk_size___60GB_via_DeviceIoControl__
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x4014de
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Checking_if_Sleep___is_patched_using_GetTickCount__
push str.____s_...
call fcn.00401010
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1f4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x1c2
jbe 0x401662
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
jmp 0x401682
push str.Sandbox_traced_by_checking_if_Sleep___was_patched_using_GetTickCount__
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Checking_if_NumberOfProcessors_is___2_via_GetSystemInfo__
push str.____s_...
call fcn.00401010
add esp, 8
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x2c], 2
jae 0x4016d5
push str.Sandbox_traced_by_checking_if_NumberOfProcessors_is_less_than_2_via_GetSystemInfo__
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x4016e5
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Checking_if_pysical_memory_is___1Gb
push str.____s_...
call fcn.00401010
add esp, 8
mov dword [esp + 0x18], 0x40
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [esp + 0x20]
and eax, 0xfffffc00
cmp dword [esp + 0x24], 0
ja 0x401752
jb 0x401730
cmp eax, 0x40000000
jae 0x401752
push str.Sandbox_traced_by_checking_if_pysical_memory_is_less_than_1Gb
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x401762
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Checking_operating_system_uptime_using_GetTickCount__
push str.____s_...
call fcn.00401010
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0xafe74
jae 0x4017b0
push str.Sandbox_traced_by_checking_operating_system_uptime_using_GetTickCount__
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x4017c0
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Checking_if_operating_system_IsNativeVhdBoot__
push str.____s_...
call fcn.00401010
add esp, 8
mov dword [esp + 0xc], 0
push str.IsNativeVhdBoot
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401809
lea ecx, [esp + 0xc]
push ecx
call eax
cmp dword [esp + 0xc], 0
je 0x401832
push str.Sandbox_traced_by_checking_IsNativeVhdBoot__
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x401842
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Sandboxie_detection
push str._n_____s_n
call fcn.00401010
push str.Using_GetModuleHandle_sbiedll.dll_
push str.____s_...
call fcn.00401010
add esp, 0x10
push str.sbiedll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4018a1
push str.Sandboxie_traced_using_GetModuleHandle_sbiedll.dll_
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x4018b1
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Wine_detection
push str._n_____s_n
call fcn.00401010
push str.Using_GetProcAddress_wine_get_unix_file_name__from_kernel32.dll
push str.____s_...
call fcn.00401010
add esp, 0x10
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401920
push str.wine_get_unix_file_name
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401920
push str.Wine_traced_using_GetProcAddress_wine_get_unix_file_name__from_kernel32.dll
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x401930
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Reg_key__HKCUSOFTWAREWine_
push str.____s_...
call fcn.00401010
add esp, 8
mov edx, str.SOFTWAREWine
mov ecx, 0x80000001
call fcn.00402270
cmp eax, 1
jne 0x401985
push str.Wine_traced_using_Reg_key_HKCUSOFTWAREWine
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x401995
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.VirtualBox_detection
push str._n_____s_n
call fcn.00401010
push str.Scsi_port__bus__target_id__logical_unit_id___0_identifier
push str.____s_...
call fcn.00401010
push str.VBOX
push str.Identifier
mov edx, str.HARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
call fcn.00402320
add esp, 0x18
cmp eax, 1
jne 0x4019fe
push str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0__Identifier_
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x401a0e
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Reg_key__HKLMHARDWAREDescriptionSystem__SystemBiosVersion__
push str.____s_...
call fcn.00401010
push str.VBOX
push str.SystemBiosVersion
mov edx, str.HARDWAREDescriptionSystem
call fcn.00402320
add esp, 0x10
cmp eax, 1
jne 0x401a68
push str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREDescriptionSystem__SystemBiosVersion_
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x401a78
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Reg_key__HKLMSOFTWAREOracleVirtualBox_Guest_Additions_
push str.____s_...
call fcn.00401010
add esp, 8
mov edx, str.SOFTWAREOracleVirtualBox_Guest_Additions
mov ecx, 0x80000002
call fcn.00402270
cmp eax, 1
jne 0x401acd
push str.VirtualBox_traced_using_Reg_key_HKLMSOFTWAREOracleVirtualBox_Guest_Additions
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x401add
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Reg_key__HKLMHARDWAREDescriptionSystem__VideoBiosVersion__
push str.____s_...
call fcn.00401010
push str.VIRTUALBOX
push str.VideoBiosVersion
mov edx, str.HARDWAREDescriptionSystem
call fcn.00402320
add esp, 0x10
cmp eax, 1
jne 0x401b37
push str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREDescriptionSystem__VideoBiosVersion_
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x401b47
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Reg_key__HKLMHARDWAREACPIDSDTVBOX___
push str.____s_...
call fcn.00401010
add esp, 8
mov edx, str.HARDWAREACPIDSDTVBOX__
mov ecx, 0x80000002
call fcn.00402270
cmp eax, 1
jne 0x401b9c
push str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREACPIDSDTVBOX__
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x401bac
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Reg_key__HKLMHARDWAREACPIFADTVBOX___
push str.____s_...
call fcn.00401010
add esp, 8
mov edx, str.HARDWAREACPIFADTVBOX__
mov ecx, 0x80000002
call fcn.00402270
cmp eax, 1
jne 0x401c01
push str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREACPIFADTVBOX__
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x401c11
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Reg_key__HKLMHARDWAREACPIRSDTVBOX___
push str.____s_...
call fcn.00401010
add esp, 8
mov edx, str.HARDWAREACPIRSDTVBOX__
mov ecx, 0x80000002
call fcn.00402270
cmp eax, 1
jne 0x401c66
push str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREACPIRSDTVBOX__
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x401c76
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Reg_key__HKLMHARDWAREDESCRIPTIONSystem__SystemBiosDate__
push str.____s_...
call fcn.00401010
push str.06_23_99
push str.SystemBiosDate
mov edx, str.HARDWAREDESCRIPTIONSystem
call fcn.00402320
add esp, 0x10
cmp eax, 1
jne 0x401cd0
push str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREDESCRIPTIONSystem__SystemBiosDate_
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x401ce0
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Looking_for_pseudo_devices
push str.____s_...
call fcn.00401010
add esp, 8
mov dword [esp + 0x18], str..VBoxMiniRdrDN
xor edi, edi
mov dword [esp + 0x1c], str..pipeVBoxMiniRdDN
mov dword [esp + 0x20], str..VBoxTrayIPC
xor esi, esi
mov dword [esp + 0x24], str..pipeVBoxTrayIPC
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [esp + esi*4 + 0x30]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x401d74
push dword [esp + esi*4 + 0x18]
lea eax, [esp + 0x124]
push str.VirtualBox_traced_using_device__s
push 0xc7
push eax
call fcn.00401040
lea eax, [esp + 0x130]
push eax
call fcn.00401010
add esp, 0x14
mov edi, 1
inc esi
cmp esi, 4
jl 0x401d23
cmp edi, 1
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
jne 0x401da4
push 0
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x401db4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Looking_for_VBoxTray_windows
push str.____s_...
call fcn.00401010
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
add esp, 8
push 0
push str.VBoxTrayToolWndClass
call esi
push str.VBoxTrayToolWnd
push 0
mov edi, eax
call esi
test edi, edi
jne 0x401e0d
test eax, eax
jne 0x401e0d
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
jmp 0x401e33
push str.VirtualBox_traced_using_VBoxTray_windows
call fcn.00401010
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.VMware_detection
push str._n_____s_n
call fcn.00401010
push str.Scsi_port_0_1_2___bus__target_id__logical_unit_id___0_identifier
push str.____s_...
call fcn.00401010
push str.VMWARE
push str.Identifier
mov edx, str.HARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
call fcn.00402320
add esp, 0x18
test eax, eax
jne 0x401ec1
push str.VMWARE
push str.Identifier
mov edx, str.HARDWAREDEVICEMAPScsiScsi_Port_1Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
call fcn.00402320
add esp, 8
test eax, eax
jne 0x401ec1
push str.VMWARE
push str.Identifier
mov edx, str.HARDWAREDEVICEMAPScsiScsi_Port_2Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
call fcn.00402320
add esp, 8
test eax, eax
jne 0x401ec1
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
jmp 0x401ee1
push str.VMWare_traced_using_Reg_key_HKLMHARDWAREDEVICEMAPScsiScsi_Port_0_1_2Scsi_Bus_0Target_Id_0Logical_Unit_Id_0__Identifier_
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Reg_key__HKLMSOFTWAREVMware__Inc.VMware_Tools_
push str.____s_...
call fcn.00401010
add esp, 8
mov edx, str.SOFTWAREVMware__Inc.VMware_Tools
mov ecx, 0x80000002
call fcn.00402270
cmp eax, 1
jne 0x401f36
push str.VMware_traced_using_Reg_key_HKLMSOFTWAREVMware__Inc.VMware_Tools
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x401f46
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Looking_for_C:WINDOWS_system32drivers_vmmouse.sys
push str.____s_...
call fcn.00401010
add esp, 8
mov ecx, str.C:WINDOWS_system32drivers_vmmouse.sys
call fcn.00402500
cmp eax, 1
jne 0x401f96
push str.VMware_traced_using_file_C:WINDOWS_system32drivers_vmmouse.sys
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x401fa6
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Looking_for_C:WINDOWS_system32drivers_vmhgfs.sys
push str.____s_...
call fcn.00401010
add esp, 8
mov ecx, str.C:WINDOWS_system32drivers_vmhgfs.sys
call fcn.00402500
cmp eax, 1
jne 0x401ff6
push str.VMware_traced_using_file_C:WINDOWS_system32drivers_vmhgfs.sys
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x402006
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Looking_for_pseudo_devices
push str.____s_...
call fcn.00401010
add esp, 8
mov dword [esp + 0x10], str..HGFS
xor edi, edi
mov dword [esp + 0x14], str.._vmci
xor esi, esi
nop dword [eax]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [esp + esi*4 + 0x28]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x402091
push dword [esp + esi*4 + 0x10]
lea eax, [esp + 0x124]
push str.VMWare_traced_using_device__s
push 0xc7
push eax
call fcn.00401040
lea eax, [esp + 0x130]
push eax
call fcn.00401010
add esp, 0x14
mov edi, 1
inc esi
cmp esi, 2
jl 0x402040
cmp edi, 1
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
jne 0x4020c1
push 0
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x4020d1
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Qemu_detection
push str._n_____s_n
call fcn.00401010
push str.Scsi_port__bus__target_id__logical_unit_id___0_identifier
push str.____s_...
call fcn.00401010
push str.QEMU
push str.Identifier
mov edx, str.HARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
call fcn.00402320
add esp, 0x18
cmp eax, 1
jne 0x40213a
push str.Qemu_traced_using_Reg_key_HKLMHARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0__Identifier_
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x40214a
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Reg_key__HKLMHARDWAREDescriptionSystem__SystemBiosVersion__
push str.____s_...
call fcn.00401010
push str.QEMU
push str.SystemBiosVersion
mov edx, str.HARDWAREDescriptionSystem
call fcn.00402320
add esp, 0x10
cmp eax, 1
jne 0x4021a4
push str.Qemu_traced_using_Reg_key_HKLMHARDWAREDescriptionSystem__SystemBiosVersion_
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x4021b4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push str.Bochs_detection
push str._n_____s_n
call fcn.00401010
push str.Reg_key__HKLMHARDWAREDescriptionSystem__SystemBiosVersion__
push str.____s_...
call fcn.00401010
push str.BOCHS
push str.SystemBiosVersion
mov edx, str.HARDWAREDescriptionSystem
call fcn.00402320
add esp, 0x18
cmp eax, 1
jne 0x40221d
push str.Bochs_traced_using_Reg_key_HKLMHARDWAREDescriptionSystem__SystemBiosVersion_
call fcn.00401010
add esp, 4
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xcf
push esi
call ebx
push str.traced__n
jmp 0x40222d
push 0xfffffffffffffff5
call edi
mov esi, eax
push 0xa
push esi
call ebx
push 0x41b934
call fcn.00401010
add esp, 4
push 8
push esi
call ebx
push 0x41c838
call fcn.00401010
push 0x41c83c
call fcn.00401010
mov ecx, dword [esp + 0x534]
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004025cd
mov esp, ebp
pop ebp
ret