Function at 0x14000ecf0
Capabilities:
Check if file exists
Create http request
Enumerate processes
Get file attributes
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2a8]
sub rsp, 0x380
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1400da880]
xor rax, rsp
mov qword [rbp + 0x260], rax
lea rdx, str._DEBUG__Starting_Advanced_Sandbox_Detection..._n
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
xor esi, esi
mov qword [rsp + 0x78], rsi
lea rdx, str._DEBUG__Checking_for_virtualization..._n
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov eax, 1
xor ecx, ecx
cpuid
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], ebx
mov dword [rsp + 0x64], edx
test ecx, 0x80000000
lea r13, str.detected
lea r12, str.not_detected
mov rbx, r12
cmovne rbx, r13
lea rdx, str._DEBUG__Hypervisor
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
mov rcx, rax
mov rdx, rbx
call fcn.14000aa90
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.14000aa90
xor r14b, r14b
lea rax, str.SANDBOX
mov qword [rbp + 0x1c0], rax
lea rax, str.VIRTUAL
mov qword [rbp + 0x1c8], rax
lea rax, str.EMULATOR
mov qword [rbp + 0x1d0], rax
lea rbx, [rbp + 0x1c0]
nop word [rax + rax]
mov rdi, qword [rbx]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x14000ee27
add rbx, 8
lea rax, [rbp + 0x1d8]
cmp rbx, rax
jne 0x14000ee00
jmp 0x14000ee57
lea rdx, str._DEBUG__Sandbox_specific_environment_variable_detected:
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
mov rcx, rax
mov rdx, rdi
call fcn.14000aa90
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.14000aa90
mov r14b, 1
lea rax, str.C:_sample.exe
mov qword [rbp + 0x1d8], rax
lea rax, str.C:_sandbox_sample.exe
mov qword [rbp + 0x1e0], rax
lea rax, str.C:_analysis_sample.exe
mov qword [rbp + 0x1e8], rax
lea rbx, [rbp + 0x1d8]
nop dword [rax + rax]
mov rdi, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000eeb3
add rbx, 8
lea rax, [rbp + 0x1f0]
cmp rbx, rax
jne 0x14000ee90
jmp 0x14000eee3
lea rdx, str._DEBUG__Suspicious_file_detected:
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
mov rcx, rax
mov rdx, rdi
call fcn.14000aa90
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.14000aa90
mov r14b, 1
lea rax, [0x1400ca718]
lea rbx, [0x1400ca720]
test r14b, r14b
cmovne rbx, rax
lea rdx, str._DEBUG__Is_likely_sandbox:
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
mov rcx, rax
mov rdx, rbx
call fcn.14000aa90
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.14000aa90
mov byte [rsp + 0x30], r14b
mov dword [rsp + 0x34], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8d, send
lea rdx, str.Virtualization
lea rcx, [rsp + 0x38]
call fcn.14000b460
nop
mov r15d, 7
mov rdx, qword [rsp + 0x70]
cmp rdx, qword [rsp + 0x78]
je 0x14000ef9d
movzx eax, byte [rsp + 0x30]
mov byte [rdx], al
mov eax, dword [rsp + 0x34]
mov dword [rdx + 4], eax
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdx + 8], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdx + 0x18], xmm1
mov edx, r15d
mov word [rsp + 0x38], si
add qword [rsp + 0x70], 0x28
jmp 0x14000efb1
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.140010a90
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x14000efee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000efe9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fc70
call fcn.140077c10
lea rdx, str._DEBUG__Checking_for_debugger..._n
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne dil
mov rbx, r12
test eax, eax
cmovne rbx, r13
lea rdx, str._DEBUG__Debugger
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
mov rcx, rax
mov rdx, rbx
call fcn.14000aa90
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.14000aa90
mov byte [rsp + 0x30], dil
mov dword [rsp + 0x34], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8d, 8
lea rdx, str.Debugger
lea rcx, [rsp + 0x38]
call fcn.14000b460
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, qword [rsp + 0x78]
je 0x14000f0b5
movzx eax, byte [rsp + 0x30]
mov byte [rdx], al
mov eax, dword [rsp + 0x34]
mov dword [rdx + 4], eax
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdx + 8], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdx + 0x18], xmm1
mov rdx, r15
mov word [rsp + 0x38], si
add qword [rsp + 0x70], 0x28
jmp 0x14000f0c9
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.140010a90
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x14000f106
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f101
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fc70
call fcn.140077c10
lea rdx, str._DEBUG__Checking_sandbox_registry_keys..._n
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp + 0x1f0], rax
lea rax, str.SYSTEMCurrentControlSetEnumSCSIDiskVen_VMwareProd_VMware_Virtual_S
mov qword [rbp + 0x1f8], rax
lea rax, str.SYSTEMCurrentControlSetControlVirtualDeviceDrivers
mov qword [rbp + 0x200], rax
lea rax, str.SOFTWAREVMware__Inc.VMware_Tools
mov qword [rbp + 0x208], rax
lea rax, str.SOFTWAREOracleVirtualBox_Guest_Additions
mov qword [rbp + 0x210], rax
lea rbx, [rbp + 0x1f0]
mov rdi, qword [rbx]
lea rdx, str._DEBUG__Checking_registry_key:
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
mov rcx, rax
mov rdx, rdi
call fcn.14000aa90
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.14000aa90
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000f1e4
add rbx, 8
lea rax, [rbp + 0x218]
cmp rbx, rax
jne 0x14000f166
lea rdx, str._DEBUG__No_suspicious_registry_keys_detected_n
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
xor al, al
jmp 0x14000f21e
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str._DEBUG__Suspicious_registry_key_detected:
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
mov rcx, rax
mov rdx, rdi
call fcn.14000aa90
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.14000aa90
mov al, 1
mov byte [rsp + 0x30], al
mov dword [rsp + 0x34], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.Sandbox_Registry_Keys
lea rcx, [rsp + 0x38]
call fcn.14000b460
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, qword [rsp + 0x78]
je 0x14000f28f
movzx eax, byte [rsp + 0x30]
mov byte [rdx], al
mov eax, dword [rsp + 0x34]
mov dword [rdx + 4], eax
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdx + 8], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdx + 0x18], xmm1
mov rdx, r15
mov word [rsp + 0x38], si
add qword [rsp + 0x70], 0x28
jmp 0x14000f2a3
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.140010a90
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x14000f2e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f2db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fc70
call fcn.140077c10
lea rdx, str._DEBUG__Checking_for_suspicious_processes..._n
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
lea rax, str.vboxservice.exe
mov qword [rbp + 0x220], rax
lea rax, str.vboxtray.exe
mov qword [rbp + 0x228], rax
lea rax, str.vmtoolsd.exe
mov qword [rbp + 0x230], rax
lea rax, str.vmwaretray.exe
mov qword [rbp + 0x238], rax
lea rax, str.vmwareuser.exe
mov qword [rbp + 0x240], rax
lea rax, str.VGAuthService.exe
mov qword [rbp + 0x248], rax
lea rax, str.vmacthlp.exe
mov qword [rbp + 0x250], rax
lea rax, str.vmsrvc.exe
mov qword [rbp + 0x258], rax
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
lea rcx, [0x1400dc4b0]
cmp rax, 0xffffffffffffffff
je 0x14000f469
lea rdx, str._DEBUG__Successfully_created_process_snapshot_n
call fcn.14000aa90
mov dword [rbp - 0x80], 0x238
lea rdx, [rbp - 0x80]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000f424
nop dword [rax + rax]
lea rdx, str._DEBUG__Checking_process:
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
mov rcx, rax
lea rdx, [rbp - 0x54]
call fcn.14000aa90
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.14000aa90
lea rbx, [rbp + 0x220]
nop word [rax + rax]
mov rdi, qword [rbx]
mov rdx, rdi
lea rcx, [rbp - 0x54]
call fcn.140085174
test eax, eax
je 0x14000f42f
add rbx, 8
lea rax, [rbp + 0x260]
cmp rbx, rax
jne 0x14000f3f0
lea rdx, [rbp - 0x80]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000f3b0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000f475
lea rdx, str._DEBUG__Suspicious_process_detected:
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
mov rcx, rax
mov rdx, rdi
call fcn.14000aa90
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.14000aa90
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14000f48a
lea rdx, str._DEBUG__Failed_to_create_process_snapshot_n
call fcn.14000aa90
lea rdx, str._DEBUG__No_suspicious_processes_detected_n
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
xor al, al
mov byte [rsp + 0x30], al
mov dword [rsp + 0x34], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.Suspicious_Processes
lea rcx, [rsp + 0x38]
call fcn.14000b460
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, qword [rsp + 0x78]
je 0x14000f4fb
movzx eax, byte [rsp + 0x30]
mov byte [rdx], al
mov eax, dword [rsp + 0x34]
mov dword [rdx + 4], eax
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdx + 8], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdx + 0x18], xmm1
mov rdx, r15
mov word [rsp + 0x38], si
add qword [rsp + 0x70], 0x28
jmp 0x14000f50f
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.140010a90
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x14000f54c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f547
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fc70
call fcn.140077c10
call fcn.14000e480
mov byte [rsp + 0x30], al
mov dword [rsp + 0x34], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.Suspicious_MAC_Address
lea rcx, [rsp + 0x38]
call fcn.14000b460
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, qword [rsp + 0x78]
je 0x14000f5c2
movzx eax, byte [rsp + 0x30]
mov byte [rdx], al
mov eax, dword [rsp + 0x34]
mov dword [rdx + 4], eax
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdx + 8], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdx + 0x18], xmm1
mov rdx, r15
mov word [rsp + 0x38], si
add qword [rsp + 0x70], 0x28
jmp 0x14000f5d6
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.140010a90
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x14000f613
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f60e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fc70
call fcn.140077c10
call fcn.14000e6a0
mov byte [rsp + 0x30], al
mov dword [rsp + 0x34], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.Suspicious_PE_File_Name
lea rcx, [rsp + 0x38]
call fcn.14000b460
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, qword [rsp + 0x78]
je 0x14000f689
movzx eax, byte [rsp + 0x30]
mov byte [rdx], al
mov eax, dword [rsp + 0x34]
mov dword [rdx + 4], eax
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdx + 8], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdx + 0x18], xmm1
mov rdx, r15
mov word [rsp + 0x38], si
add qword [rsp + 0x70], 0x28
jmp 0x14000f69d
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.140010a90
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x14000f6da
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f6d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fc70
call fcn.140077c10
call fcn.14000e9d0
mov byte [rsp + 0x30], al
mov dword [rsp + 0x34], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.Suspicious_Hostname
lea rcx, [rsp + 0x38]
call fcn.14000b460
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, qword [rsp + 0x78]
je 0x14000f750
movzx eax, byte [rsp + 0x30]
mov byte [rdx], al
mov eax, dword [rsp + 0x34]
mov dword [rdx + 4], eax
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdx + 8], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdx + 0x18], xmm1
mov rdx, r15
mov word [rsp + 0x38], si
add qword [rsp + 0x70], 0x28
jmp 0x14000f764
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.140010a90
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x14000f7a1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f79c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fc70
call fcn.140077c10
lea rdx, str._DEBUG__Attempting_to_send_web_request_to_non_existing_domain..._n
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.SandboxDetection
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbx, rax
lea rcx, [0x1400dc4b0]
test rax, rax
je 0x14000f856
lea rdx, str._DEBUG__Successfully_opened_Internet_handle_n
call fcn.14000aa90
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
lea rdx, str.http:__thisshouldnotexist12345.com
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rdi, rax
lea rcx, [0x1400dc4b0]
test rax, rax
je 0x14000f83f
lea rdx, str._DEBUG__Successfully_opened_URL__suspicious_behavior__n
call fcn.14000aa90
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, 1
jmp 0x14000f877
lea rdx, str._DEBUG__Failed_to_open_URL__expected_behavior__n
call fcn.14000aa90
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14000f862
lea rdx, str._DEBUG__Failed_to_open_Internet_handle_n
call fcn.14000aa90
lea rdx, str._DEBUG__No_suspicious_web_behavior_detected_n
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
xor al, al
mov byte [rsp + 0x30], al
mov dword [rsp + 0x34], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8d, Ordinal_35
lea rdx, str.Web_Request_to_Non_existing_Domain
lea rcx, [rsp + 0x38]
call fcn.14000b460
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, qword [rsp + 0x78]
je 0x14000f8e8
movzx eax, byte [rsp + 0x30]
mov byte [rdx], al
mov eax, dword [rsp + 0x34]
mov dword [rdx + 4], eax
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdx + 8], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdx + 0x18], xmm1
mov rdx, r15
mov word [rsp + 0x38], si
add qword [rsp + 0x70], 0x28
jmp 0x14000f8fc
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.140010a90
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x14000f939
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f934
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fc70
call fcn.140077c10
lea rdx, str._DEBUG__Starting_sleep_function_test..._n
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rbx, rax
lea rdx, str._DEBUG__Starting_sleep_for_3000_ms_n
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rdi, rax
sub rdi, rbx
lea rdx, str._DEBUG__Sleep_duration:
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
mov rcx, rax
mov rdx, rdi
call fcn.14000ffa0
mov rcx, rax
lea rdx, str._ms_n
call fcn.14000aa90
cmp rdi, 0xb54
setb bl
cmovb r12, r13
lea rdx, str._DEBUG__Sleep_acceleration
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
mov rcx, rax
mov rdx, r12
call fcn.14000aa90
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.14000aa90
mov byte [rsp + 0x30], bl
mov dword [rsp + 0x34], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_27
lea rdx, str.Sleep_Function_Acceleration
lea rcx, [rsp + 0x38]
call fcn.14000b460
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, qword [rsp + 0x78]
je 0x14000fa55
movzx eax, byte [rsp + 0x30]
mov byte [rdx], al
mov eax, dword [rsp + 0x34]
mov dword [rdx + 4], eax
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdx + 8], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdx + 0x18], xmm1
mov word [rsp + 0x38], si
add qword [rsp + 0x70], 0x28
jmp 0x14000fa69
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.140010a90
mov r15, qword [rsp + 0x50]
cmp r15, 7
jbe 0x14000faa6
lea rdx, [r15*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000faa1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fc70
call fcn.140077c10
mov edi, esi
mov r14, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
cmp rbx, r14
je 0x14000fb2f
add rbx, 8
nop dword [rax + rax]
mov eax, dword [rbx - 4]
add esi, eax
cmp byte [rbx - 8], 0
je 0x14000fb22
add edi, eax
lea rdx, str._DEBUG__Detected:
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14000faed
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.1400107d0
lea rdx, str.__Weight:
mov rcx, rax
call fcn.14000aa90
mov rcx, rax
mov edx, dword [rbx - 4]
call fcn.1400101a0
mov rcx, rax
lea rdx, [0x1400ca2c4]
call fcn.14000aa90
add rbx, 0x28
lea rax, [rbx - 8]
cmp rax, r14
jne 0x14000fac0
movd xmm6, edi
cvtdq2ps xmm6, xmm6
movd xmm0, esi
cvtdq2ps xmm0, xmm0
divss xmm6, xmm0
mulss xmm6, dword [0x1400cc794]
lea rdx, str._DEBUG__Detection_percentage:
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
mov rcx, rax
movaps xmm1, xmm6
call fcn.14000fd80
mov rcx, rax
lea rdx, [0x1400cbb60]
call fcn.14000aa90
comiss xmm6, dword [0x1400cc790]
setae dil
lea rax, str.Sandbox_Detected
lea rbx, str.No_Sandbox_Detected
test dil, dil
cmovne rbx, rax
lea rdx, str._DEBUG__Advanced_Sandbox_Detection_result:
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
mov rcx, rax
mov rdx, rbx
call fcn.14000aa90
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.14000aa90
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000fc31
mov rdx, qword [rsp + 0x70]
call fcn.140010730
mov rcx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x68]
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000fc29
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fc6a
mov rcx, rbx
call fcn.140077c10
movzx eax, dil
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.140077bf0
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400850bc
nop
call fcn.1400850bc
nop
int3