Function at 0x40c680
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422066
mov eax, dword fs:[0]
push eax
sub esp, 0x39c
mov eax, dword [0x42c040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp eax, 1
jne 0x40c6bf
mov edx, str.No_arguments_provided._This_program_requires_at_least_one_argument._n
jmp 0x40cec6
cmp eax, 2
jne 0x40cec1
mov eax, dword [ebp + 0xc]
mov edx, 0x425ec8
mov eax, dword [eax + 4]
mov ecx, eax
mov dword [ebp - 0x38c], eax
nop dword [eax + eax]
mov al, byte [ecx]
cmp al, byte [edx]
mov byte [ebp - 0x38d], al
mov eax, dword [ebp - 0x38c]
jne 0x40c722
cmp byte [ebp - 0x38d], 0
je 0x40c71e
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
mov byte [ebp - 0x38d], al
mov eax, dword [ebp - 0x38c]
jne 0x40c722
add ecx, 2
add edx, 2
cmp byte [ebp - 0x38d], 0
jne 0x40c6e0
xor ecx, ecx
jmp 0x40c727
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x40c763
mov ecx, str.__xml
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40c750
test dl, dl
je 0x40c74c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40c750
add eax, 2
add ecx, 2
test dl, dl
jne 0x40c730
xor eax, eax
jmp 0x40c755
sbb eax, eax
or eax, 1
test eax, eax
je 0x40c763
mov edx, str.Unknown_argument_provided._Use__x_or___xml_to_save_results_to_XML._n
jmp 0x40cec6
push 0x1c0
lea eax, [ebp - 0x298]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov dword [ebp - 0x270], 0
lea eax, [ebp - 0x238]
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x23c], eax
add esp, 0xc
movups xmmword [ebp - 0x290], xmm0
lea eax, [ebp - 0x200]
mov dword [ebp - 0x268], 0
movups xmmword [ebp - 0x280], xmm0
mov dword [ebp - 0x204], eax
lea eax, [ebp - 0x1b4]
movups xmmword [ebp - 0x260], xmm0
mov dword [ebp - 0x1b8], eax
lea eax, [ebp - 0x168]
movups xmmword [ebp - 0x250], xmm0
mov dword [ebp - 0x16c], eax
lea eax, [ebp - 0x11c]
movaps xmm0, xmmword [0x426b90]
movups xmmword [ebp - 0x1d8], xmm0
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x298]
movaps xmm0, xmmword [0x426b90]
movups xmmword [ebp - 0x18c], xmm0
mov dword [ebp - fcn.0041ba10], vtable.tinyxml2::XMLDocument.0
movaps xmm0, xmmword [0x426b90]
movups xmmword [ebp - 0x140], xmm0
mov word [ebp - 0x264], 0x100
movaps xmm0, xmmword [0x426b90]
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x210], 0xa
mov dword [ebp - 0x20c], 0
mov dword [ebp - method.tinyxml2::MemPoolT_60_.virtual_0], vtable.tinyxml2::MemPoolT_60_.0
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x1c0], 0
mov dword [ebp - method.tinyxml2::MemPoolT_40_.virtual_0], vtable.tinyxml2::MemPoolT_40_.0
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x174], 0
mov dword [ebp - method.tinyxml2::MemPoolT_56_.virtual_0], vtable.tinyxml2::MemPoolT_56_.0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - method.tinyxml2::MemPoolT_52_.virtual_0], vtable.tinyxml2::MemPoolT_52_.0
movups xmmword [ebp - 0xf4], xmm0
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0x294], eax
lea eax, [ebp - 0x208]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x298]
call fcn.0041f4d0
mov esi, eax
test dword [esi + 0xc], 0x200
je 0x40c936
push dword [esi + 0x10]
call fcn.0041fb02
add esp, 4
push 0xe
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0041feab
mov dword [esi + 0x10], eax
add esp, 4
movq xmm0, qword [str.VMAwareResult]
movq qword [eax], xmm0
mov ecx, dword [0x425edc]
mov dword [eax + 8], ecx
mov cx, word [0x425ee0]
mov word [eax + 0xc], cx
mov eax, dword [esi + 0x10]
add eax, 0xd
mov dword [esi + 0xc], 0x200
mov dword [esi + 0x14], eax
mov eax, dword [esi + 4]
cmp eax, dword [ebp - 0x294]
jne 0x40c9e1
push esi
call fcn.0041cad0
mov eax, dword [ebp - 0x27c]
mov ecx, 0x24
test eax, eax
je 0x40c9bc
mov dword [eax + 0x24], esi
mov eax, dword [ebp - 0x27c]
mov dword [esi + 0x28], eax
mov dword [ebp - 0x27c], esi
jmp 0x40c9cf
mov dword [ebp - 0x278], esi
mov dword [ebp - 0x27c], esi
mov dword [esi + 0x28], 0
mov eax, esi
mov dword [ecx + eax], 0
lea eax, [ebp - 0x298]
mov dword [esi + 8], eax
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x298]
call fcn.0041f4d0
mov edi, eax
test dword [edi + 0xc], 0x200
lea eax, [edi + 0x10]
mov dword [ebp - 0x38c], eax
je 0x40ca16
push dword [eax]
call fcn.0041fb02
add esp, 4
lea eax, [edi + 0x10]
jmp 0x40ca1c
mov dword [ebp - 0x38c], eax
push 6
mov dword [edi + 0xc], 0
mov dword [eax], 0
mov dword [edi + 0x14], 0
call fcn.0041feab
mov edx, dword [ebp - 0x38c]
add esp, 4
mov dword [edx], eax
mov ecx, dword [str.Brand]
mov dword [eax], ecx
mov cx, word [0x425ee8]
mov word [eax + 4], cx
lea ecx, [ebp - 0x3a8]
mov eax, dword [edx]
add eax, 5
mov dword [edi + 0xc], 0x200
mov dword [edi + 0x14], eax
call fcn.0040c0b0
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 0xf
jbe 0x40ca7b
mov eax, dword [eax]
push eax
mov ecx, edi
call fcn.0041d210
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x394]
cmp ecx, 0xf
jbe 0x40cac3
mov edx, dword [ebp - 0x3a8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40cab9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40cab9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041fe9d
add esp, 8
mov eax, dword [edi + 4]
cmp eax, dword [esi + 4]
jne 0x40cb04
push edi
call fcn.0041cad0
mov eax, dword [esi + 0x20]
mov ecx, 0x28
test eax, eax
je 0x40caeb
mov dword [eax + 0x28], edi
mov eax, dword [esi + 0x20]
mov dword [edi + 0x24], eax
mov dword [esi + 0x20], edi
jmp 0x40caf8
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [edi + 0x24], 0
mov eax, edi
mov dword [ecx + eax], 0
mov dword [edi + 8], esi
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x298]
call fcn.0041f4d0
mov edi, eax
test dword [edi + 0xc], 0x200
lea eax, [edi + 0x10]
mov dword [ebp - 0x38c], eax
je 0x40cb39
push dword [eax]
call fcn.0041fb02
add esp, 4
lea eax, [edi + 0x10]
jmp 0x40cb3f
mov dword [ebp - 0x38c], eax
push 0xb
mov dword [edi + 0xc], 0
mov dword [eax], 0
mov dword [edi + 0x14], 0
call fcn.0041feab
mov edx, dword [ebp - 0x38c]
sub esp, 0xc
mov dword [edx], eax
movq xmm0, qword [str.Percentage]
movq qword [eax], xmm0
mov cx, word [0x425ef4]
mov word [eax + 8], cx
mov cl, byte [0x425ef6]
mov byte [eax + 0xa], cl
mov eax, dword [edx]
add eax, 0xa
mov dword [edi + 0xc], 0x200
mov dword [edi + 0x14], eax
mov eax, esp
movups xmm0, xmmword [0x42cc38]
movups xmmword [eax], xmm0
call fcn.0040bf40
movzx eax, ax
mov edx, 0x64
cmp eax, edx
movzx ecx, al
cmova ecx, edx
movzx eax, cl
push eax
push 0x4265b4
lea eax, [ebp - 0xd8]
push 0xc8
push eax
call fcn.0041bbc0
add esp, 0x20
lea eax, [ebp - 0xd8]
mov ecx, edi
push eax
call fcn.0041d210
mov eax, dword [edi + 4]
cmp eax, dword [esi + 4]
jne 0x40cc21
push edi
call fcn.0041cad0
mov eax, dword [esi + 0x20]
mov ecx, 0x28
test eax, eax
je 0x40cc08
mov dword [eax + 0x28], edi
mov eax, dword [esi + 0x20]
mov dword [edi + 0x24], eax
mov dword [esi + 0x20], edi
jmp 0x40cc15
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [edi + 0x24], 0
mov eax, edi
mov dword [eax + ecx], 0
mov dword [edi + 8], esi
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x298]
call fcn.0041f4d0
mov edi, eax
test dword [edi + 0xc], 0x200
lea eax, [edi + 0x10]
mov dword [ebp - 0x38c], eax
je 0x40cc56
push dword [eax]
call fcn.0041fb02
add esp, 4
lea eax, [edi + 0x10]
jmp 0x40cc5c
mov dword [ebp - 0x38c], eax
push 9
mov dword [edi + 0xc], 0
mov dword [eax], 0
mov dword [edi + 0x14], 0
call fcn.0041feab
mov edx, dword [ebp - 0x38c]
sub esp, 0xc
mov dword [edx], eax
movq xmm0, qword [str.Detected]
movq qword [eax], xmm0
mov cl, byte [0x425f00]
mov byte [eax + 8], cl
mov eax, dword [edx]
add eax, 8
mov dword [edi + 0xc], 0x200
mov dword [edi + 0x14], eax
mov eax, esp
movups xmm0, xmmword [0x42cc38]
movups xmmword [eax], xmm0
call fcn.0040bf40
add esp, 0x10
movzx eax, ax
mov cl, 0x56
mov dword [ebp - 0x38c], eax
call fcn.0040beb0
test al, al
je 0x40ccdb
cmp word [ebp - 0x38c], 0
seta cl
jmp 0x40cce6
cmp word [ebp - 0x38c], 0x64
setae cl
test cl, cl
mov edx, str.false
mov eax, str.true
cmove eax, edx
push eax
push 0x4265b8
lea eax, [ebp - 0xd8]
push 0xc8
push eax
call fcn.0041bbc0
add esp, 0x10
lea eax, [ebp - 0xd8]
mov ecx, edi
push eax
call fcn.0041d210
mov eax, dword [edi + 4]
cmp eax, dword [esi + 4]
jne 0x40cd5e
push edi
call fcn.0041cad0
mov eax, dword [esi + 0x20]
mov ecx, 0x28
test eax, eax
je 0x40cd45
mov dword [eax + 0x28], edi
mov eax, dword [esi + 0x20]
mov dword [edi + 0x24], eax
mov dword [esi + 0x20], edi
jmp 0x40cd52
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [edi + 0x24], 0
mov eax, edi
mov dword [eax + ecx], 0
mov dword [edi + 8], esi
push str.vmdetect_result.xml
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
push 0x426124
lea eax, [ebp - 0x38c]
mov dword [ebp - 0x38c], 0
push str.vmdetect_result.xml
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0x10
test eax, eax
jne 0x40ce95
mov esi, dword [ebp - 0x38c]
test esi, esi
je 0x40ce95
test dword [ebp - 0x258], 0x200
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x24c], eax
je 0x40cdc9
push dword [ebp - 0x254]
call fcn.0041fb02
add esp, 4
push 0xf0
lea eax, [ebp - 0x388]
mov dword [ebp - 0x258], 0
push 0
push eax
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0
call sub.VCRUNTIME140.dll_memset
add esp, 4
lea ecx, [ebp - 0x388]
push esi
call fcn.0041dd00
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x298]
mov eax, dword [eax + 0x38]
cmp eax, fcn.0041c460
jne 0x40ce31
lea eax, [ebp - 0x388]
push eax
lea ecx, [ebp - 0x298]
call fcn.0041c460
jmp 0x40ce40
lea ecx, [ebp - 0x388]
push ecx
lea ecx, [ebp - 0x298]
call eax
mov eax, dword [ebp - 0x2b8]
lea ecx, [ebp - 0x2b4]
mov dword [ebp - method.tinyxml2::XMLPrinter.virtual_0], vtable.tinyxml2::XMLPrinter.0
cmp eax, ecx
je 0x40ce63
push eax
call fcn.0041fb02
add esp, 4
mov eax, dword [ebp - 0x380]
lea ecx, [ebp - 0x37c]
cmp eax, ecx
je 0x40ce7c
push eax
call fcn.0041fb02
add esp, 4
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
lea ecx, [ebp - 0x298]
call fcn.0041d910
xor eax, eax
jmp 0x40ced6
push str.vmdetect_result.xml
push str.filename_s
push 0
lea eax, [ebp - 0x298]
push 4
push eax
call fcn.0041dba0
add esp, 0x14
lea ecx, [ebp - 0x298]
call fcn.0041d910
xor eax, eax
jmp 0x40ced6
mov edx, str.Too_many_arguments_provided._Use__x_or___xml_to_save_results_to_XML._n
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.0040f0a0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041faf4
mov esp, ebp
pop ebp
ret