Function at 0x4157e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42bde2
mov eax, dword fs:[0]
push eax
sub esp, 0x1e0
mov eax, dword [0x43a080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [str.e_0m]
xorps xmm0, xmm0
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x60], 4
mov dword [ebp - 0x5c], 0xf
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x6c], 0
lea eax, [ebp - 0x1c8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x30], 0
push eax
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c8], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.e_38_2_94_214_114m]
mov ecx, dword [ebp - 0x1c8]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], 0x12
movups xmmword [eax], xmm0
mov cx, word [0x432c34]
mov word [eax + 0x10], cx
mov byte [eax + 0x12], 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x118]
push 0x433678
push eax
call fcn.00404e10
add esp, 0x14
push 8
push str.DETECTED
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00413700
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x88], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x78], xmm0
mov dword [eax + 0x14], 0xf
mov dword [eax + 0x10], 0
mov byte [eax], 0
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0x160]
call fcn.0040b5a0
push 3
push 0x433668
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 4
call fcn.00413700
xorps xmm0, xmm0
mov dword [ebp - 0xf0], 0
movups xmmword [ebp - 0x100], xmm0
mov dword [ebp - 0xec], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x100], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xf0], xmm0
mov byte [ebp - 4], 6
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x14c]
cmp ecx, 0xf
jbe 0x41599a
mov edx, dword [ebp - 0x160]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x415990
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415ab9
push ecx
push edx
call fcn.00429429
add esp, 8
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0xf
mov byte [ebp - 0x160], 0
mov ecx, dword [ebp - 0x74]
mov byte [ebp - 4], 7
cmp ecx, 0xf
jbe 0x4159f0
mov edx, dword [ebp - 0x88]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4159e6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415ab9
push ecx
push edx
call fcn.00429429
add esp, 8
mov ecx, dword [ebp - 0x104]
mov byte [ebp - 4], 8
cmp ecx, 0xf
jbe 0x415a2e
mov edx, dword [ebp - 0x118]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x415a24
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415ab9
push ecx
push edx
call fcn.00429429
add esp, 8
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0xf
mov byte [ebp - 0x118], 0
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 9
cmp ecx, 0xf
jbe 0x415a7d
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x415a73
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415ab9
push ecx
push edx
call fcn.00429429
add esp, 8
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
mov ecx, dword [ebp - 0x5c]
mov byte [ebp - 4], 0xa
cmp ecx, 0xf
jbe 0x415ac9
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x415abf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x415abf
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00429429
add esp, 8
mov eax, dword [str.e_0m]
xorps xmm0, xmm0
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x60], 4
mov dword [ebp - 0x5c], 0xf
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x6c], 0
lea eax, [ebp - 0x1c8]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 0
push eax
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c8], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.e_38_2_239_75_75m]
mov ecx, dword [ebp - 0x1c8]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0x11
movups xmmword [eax], xmm0
mov cl, byte [0x432c0c]
mov byte [eax + 0x10], cl
mov byte [eax + 0x11], 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x130]
push 0x433690
push eax
call fcn.00404e10
add esp, 0x14
push 0xc
push str.NOT_DETECTED
mov ecx, eax
mov byte [ebp - 4], 0xd
call fcn.00413700
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x88], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x78], xmm0
mov dword [eax + 0x14], 0xf
mov dword [eax + 0x10], 0
mov byte [eax], 0
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0x178]
call fcn.0040b5a0
push 1
push 0x43367c
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 0xf
call fcn.00413700
xorps xmm0, xmm0
mov dword [ebp - 0xd8], 0
movups xmmword [ebp - 0xe8], xmm0
mov dword [ebp - 0xd4], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xe8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xd8], xmm0
mov byte [ebp - 4], 0x11
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x164]
cmp ecx, 0xf
jbe 0x415c51
mov edx, dword [ebp - 0x178]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x415c47
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415d70
push ecx
push edx
call fcn.00429429
add esp, 8
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x164], 0xf
mov byte [ebp - 0x178], 0
mov ecx, dword [ebp - 0x74]
mov byte [ebp - 4], 0x12
cmp ecx, 0xf
jbe 0x415ca7
mov edx, dword [ebp - 0x88]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x415c9d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415d70
push ecx
push edx
call fcn.00429429
add esp, 8
mov ecx, dword [ebp - 0x11c]
mov byte [ebp - 4], 0x13
cmp ecx, 0xf
jbe 0x415ce5
mov edx, dword [ebp - 0x130]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x415cdb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415d70
push ecx
push edx
call fcn.00429429
add esp, 8
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0x14
cmp ecx, 0xf
jbe 0x415d34
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x415d2a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415d70
push ecx
push edx
call fcn.00429429
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov ecx, dword [ebp - 0x5c]
mov byte [ebp - 4], 0x15
cmp ecx, 0xf
jbe 0x415d80
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x415d76
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x415d76
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00429429
add esp, 8
mov eax, dword [str.e_0m]
xorps xmm0, xmm0
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x60], 4
mov dword [ebp - 0x5c], 0xf
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x6c], 0
lea eax, [ebp - 0x1c8]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x48], 0
push eax
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x1c8], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.e_38_2_239_75_75m]
mov ecx, dword [ebp - 0x1c8]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x48], 0x11
movups xmmword [eax], xmm0
mov cl, byte [0x432c0c]
mov byte [eax + 0x10], cl
mov byte [eax + 0x11], 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x148]
push 0x433690
push eax
call fcn.00404e10
add esp, 0x14
push 0xb
push str._SPOOFABLE
mov ecx, eax
mov byte [ebp - 4], 0x18
call fcn.00413700
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x88], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x78], xmm0
mov dword [eax + 0x14], 0xf
mov dword [eax + 0x10], 0
mov byte [eax], 0
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0x190]
call fcn.0040b5a0
push 1
push 0x43367c
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x1a
call fcn.00413700
xorps xmm0, xmm0
mov dword [ebp - 0xc0], 0
movups xmmword [ebp - 0xd0], xmm0
mov dword [ebp - 0xbc], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xd0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xc0], xmm0
mov byte [ebp - 4], 0x1c
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x17c]
cmp ecx, 0xf
jbe 0x415f08
mov edx, dword [ebp - 0x190]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x415efe
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416027
push ecx
push edx
call fcn.00429429
add esp, 8
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x17c], 0xf
mov byte [ebp - 0x190], 0
mov ecx, dword [ebp - 0x74]
mov byte [ebp - 4], 0x1d
cmp ecx, 0xf
jbe 0x415f5e
mov edx, dword [ebp - 0x88]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x415f54
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416027
push ecx
push edx
call fcn.00429429
add esp, 8
mov ecx, dword [ebp - 0x134]
mov byte [ebp - 4], 0x1e
cmp ecx, 0xf
jbe 0x415f9c
mov edx, dword [ebp - 0x148]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x415f92
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416027
push ecx
push edx
call fcn.00429429
add esp, 8
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0xf
mov byte [ebp - 0x148], 0
mov ecx, dword [ebp - 0x44]
mov byte [ebp - 4], 0x1f
cmp ecx, 0xf
jbe 0x415feb
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x415fe1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416027
push ecx
push edx
call fcn.00429429
add esp, 8
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
mov ecx, dword [ebp - 0x5c]
mov byte [ebp - 4], 0x20
cmp ecx, 0xf
jbe 0x416037
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41602d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41602d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00429429
add esp, 8
mov eax, dword [0x4336a8]
xorps xmm0, xmm0
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x98], eax
movq xmm0, qword [str._____NOTE_____]
mov ax, word [0x4336ac]
mov dword [ebp - 0x90], 0xe
mov dword [ebp - 0x8c], 0xf
movq qword [ebp - 0xa0], xmm0
mov word [ebp - 0x94], ax
mov byte [ebp - 0x92], 0
mov eax, dword [str.e_0m]
xorps xmm0, xmm0
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x48], 4
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0
lea eax, [ebp - 0x1c8]
mov byte [ebp - 4], 0x22
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x30], 0
push eax
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c8], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.e_38_2_108_108_108m]
mov ecx, dword [ebp - 0x1c8]
mov edx, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x30], 0x13
movups xmmword [edx], xmm0
mov cx, word [0x432c70]
mov word [edx + 0x10], cx
mov al, byte [0x432c72]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x23
push eax
lea eax, [ebp - 0x130]
push 0x433690
push eax
call fcn.00404e10
push str.__NO_PERMS
push eax
lea eax, [ebp - 0x148]
mov byte [ebp - 4], 0x24
push eax
call fcn.00404da0
add esp, 0x20
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x25
push ecx
push eax
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0x88]
call fcn.0040b5a0
push 0x43367c
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0x26
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00404da0
add esp, 0xc
lea ecx, [ebp - 0x88]
call fcn.0040c3d0
lea ecx, [ebp - 0x148]
call fcn.0040c3d0
lea ecx, [ebp - 0x130]
call fcn.0040c3d0
mov eax, dword [ebp - 0x2c]
cmp eax, 0xf
jbe 0x4161af
push eax
push dword [ebp - 0x40]
lea eax, [ebp - 0x40]
push eax
call fcn.0040fab0
add esp, 0xc
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
mov eax, dword [ebp - 0x44]
cmp eax, 0xf
jbe 0x4161d9
push eax
push dword [ebp - 0x58]
lea eax, [ebp - 0x58]
push eax
call fcn.0040fab0
add esp, 0xc
mov eax, dword [str.e_0m]
xorps xmm0, xmm0
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x48], 4
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0
lea eax, [ebp - 0x1c8]
mov byte [ebp - 4], 0x2d
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x30], 0
push eax
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c8], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.e_38_2_94_214_114m]
mov ecx, dword [ebp - 0x1c8]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], 0x12
movups xmmword [eax], xmm0
mov cx, word [0x432c34]
mov word [eax + 0x10], cx
mov byte [eax + 0x12], 0
push str.TIP:
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x2e
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00404da0
add esp, 0x14
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x2f
push ecx
push eax
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0x1c0]
call fcn.0040b5a0
lea ecx, [ebp - 0x88]
call fcn.0040c3d0
mov eax, dword [ebp - 0x2c]
cmp eax, 0xf
jbe 0x4162af
push eax
push dword [ebp - 0x40]
lea eax, [ebp - 0x40]
push eax
call fcn.0040fab0
add esp, 0xc
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 0x33
cmp eax, 0xf
jbe 0x4162dd
push eax
push dword [ebp - 0x58]
lea eax, [ebp - 0x58]
push eax
call fcn.0040fab0
add esp, 0xc
lea eax, [ebp - 0xd0]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x100]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xe8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x43a6b0]
mov ecx, eax
shr ecx, 0xb
and ecx, 0xffffff01
mov dword [ebp - 0x1ec], ecx
mov ecx, eax
shr ecx, 0xa
and cl, 1
shr eax, 0xc
add cl, 0x66
and al, 1
push str.VMID
mov dword [ebp - 0x1c8], ecx
add al, 0x67
push 0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x1e4], al
call fcn.0040ccf0
push str.CPU_brand
push 1
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.CPUID_hypervisor_bit
push 2
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.hypervisor_brand
push 3
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.RDTSC
push 4
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.sidt_null_byte
push 0xf
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.processor_count
push 5
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.MAC_address
push 6
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.temperature
push 7
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.systemd_virtualisation
push 8
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.chassis_vendor
push 9
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.chassis_type
push 0xa
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.Dockerenv
push 0xb
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.dmidecode_output
push 0xc
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.dmesg_output
push 0xd
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.hwmon_presence
push 0xe
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.cursor
push 0x10
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.VMware_registry
push 0x11
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.VBox_registry
push 0x12
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.users
push 0x13
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.DLLs
push 0x14
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.registry
push 0x15
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.Sunbelt_CWSandbox_directory
push 0x16
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.Wine
push 0x1d
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.VM_files
push 0x17
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.hw.model
push 0x18
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.disk_size
push 0x19
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.VBox_default_specs
push 0x1a
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.VBox_network_provider_match
push 0x1b
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.computer_name
push 0x1c
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.hostname
push 0x1e
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.low_memory_space
push 0x1f
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.VM_processes
push 0x28
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.default_Linux_user_host
push 0x29
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.VBox_window_class
push 0x20
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.gamarue_ransomware_technique
push 0x2a
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.0x4_leaf_of_VMID
push 0x2b
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.Parallels_techniques
push 0x2c
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.RDTSC_VMEXIT
push 0x2d
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.loaded_DLLs
push 0x21
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.QEMU_CPU_brand
push 0x2e
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.BOCHS_CPU_techniques
push 0x2f
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.VirtualPC_motherboard
push 0x30
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.BIOS_serial_number
push 0x33
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.Hyper_V_registry
push 0x32
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.Hyper_V_WMI_output
push 0x31
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.VirtualBox_shared_folders
push 0x34
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.MSSMBIOS
push 0x35
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.MacOS_hw.memsize
push 0x36
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.MacOS_registry_IO_kit
push 0x37
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.IO_registry_grep
push 0x38
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.MacOS_SIP
push 0x39
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.KVM_registries
push 0x22
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.KVM_drivers
push 0x23
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.KVM_directories
push 0x24
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.HKLM_registries
push 0x3a
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.Audio_device
push 0x25
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.qemu_ga_process
push 0x3b
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.MSR_validity
push 0x3c
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.QEMU_processes
push 0x3d
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.QEMU_directories
push 0x26
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.VPC_processes
push 0x3e
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.VPC_invalid_instructions
push 0x3f
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.SIDT
push 0x40
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.SGDT
push 0x41
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.SLDT
push 0x42
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.Offensive_Security_SIDT
push 0x43
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.Offensive_Security_SGDT
push 0x44
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.Offensive_Security_SLDT
push 0x45
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.VirtualPC_SIDT
push 0x48
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.Hyper_V_motherboard
push 0x46
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.Extra_VM_files
push 0x47
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str._proc_iomem_file
push 0x49
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str._proc_ioports_file
push 0x4a
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str._proc_scsi_scsi_file
push 0x4b
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.VMware_dmesg
push 0x4c
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.STR_instruction
push 0x4d
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.VMware_IO_port_backdoor
push 0x4e
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.VMware_port_memory
push 0x4f
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.SMSW_instruction
push 0x50
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.mutex_strings
push 0x51
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.uptime
push 0x52
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.unusual_thread_count
push 0x53
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.Intel_thread_count_mismatch
push 0x54
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.Intel_Xeon_thread_count_mismatch
push 0x55
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.VM_memory_regions
push 0x56
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.CPUID_bitset
push 0x57
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.Cuckoo_directory
push 0x58
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.Cuckoo_pipe
push 0x59
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.Hyper_V_Azure_hostname
push 0x5a
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.general_VM_hostnames
push 0x5b
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.screen_resolution
push 0x5c
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.bogus_device_string
push 0x5d
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.mouse_device
push 0x27
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.BlueStacks_folders
push 0x5e
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.CPUID_signatures
push 0x5f
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.Hyper_V_CPUID_reserved_bitmask
push 0x60
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.KVM_CPUID_reserved_bitmask
push 0x61
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push str.Intel_KGT_signature
push 0x62
lea ecx, [ebp - 0x1c]
call fcn.0040ccf0
push 0x433644
call fcn.00428d40
push dword [ebp - 0x1e4]
lea eax, [ebp - 0xb8]
push 0x69
push eax
call fcn.00409210
push str.VM_brand:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov byte [ebp - 4], 0x34
call fcn.00404b40
cmp dword [ebp - 0xa4], 0xf
lea ecx, [ebp - 0xb8]
push 7
cmova ecx, dword [ebp - 0xb8]
mov esi, eax
push str.Unknown
push dword [ebp - 0xa8]
push ecx
call fcn.00408830
test al, al
mov ecx, str.e_38_2_239_75_75m
mov edi, str.e_38_2_94_214_114m
cmove ecx, edi
push ecx
push esi
call fcn.00404b40
cmp dword [ebp - 0xa4], 0xf
lea ecx, [ebp - 0xb8]
push dword [ebp - 0xa8]
cmova ecx, dword [ebp - 0xb8]
push ecx
push eax
call fcn.00406cf0
add esp, 0x3c
push 0x433644
push str.e_0m
push eax
call fcn.00404b40
add esp, 8
push eax
call fcn.00404b40
add esp, 8
lea ecx, [ebp - 0xb8]
push 0
push str._or
call fcn.00415280
cmp eax, 0xffffffff
jne 0x416aa1
push dword [ebp - 0x1e4]
lea eax, [ebp - 0x88]
push 0x69
push eax
call fcn.00409210
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0x35
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00423dd0
push str.VM_type:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov byte [ebp - 4], 0x36
call fcn.00404b40
cmp dword [ebp - 0x44], 0xf
lea eax, [ebp - 0x58]
push 7
cmova eax, dword [ebp - 0x58]
push str.Unknown
push dword [ebp - 0x48]
push eax
call fcn.00408830
add esp, 0x2c
test al, al
je 0x416a46
push str.Unknown
push str.e_38_2_239_75_75m
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00404b40
add esp, 8
push eax
call fcn.00404b40
add esp, 8
jmp 0x416a6e
push str.e_38_2_94_214_114m
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00404b40
cmp dword [ebp - 0x44], 0xf
lea ecx, [ebp - 0x58]
push dword [ebp - 0x48]
cmova ecx, dword [ebp - 0x58]
push ecx
push eax
call fcn.00406cf0
add esp, 0x14
push 0x433644
push str.e_0m
push eax
call fcn.00404b40
add esp, 8
push eax
call fcn.00404b40
add esp, 8
lea ecx, [ebp - 0x58]
call fcn.0040c3d0
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x34
call fcn.0040c3d0
mov eax, dword [ebp - 0x1e4]
lea ecx, [ebp - 0x1e8]
mov byte [ebp - 0x14], al
xorps xmm0, xmm0
mov eax, dword [ebp - 0x1c8]
mov byte [ebp - 0x1d0], al
push dword [ebp - 0x1d0]
movups xmmword [0x43a6c8], xmm0
mov dword [ebp - fcn.00417eb0], 0x4329f8
call fcn.00417eb0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1d0]
mov dword [ebp - fcn.00417eb0], 0x4329f8
call fcn.00417eb0
push 0x43a6c8
call fcn.00415460
movups xmm0, xmmword [0x43a6c8]
lea eax, [ebp - 0x38]
push 1
push eax
movups xmmword [ebp - 0x38], xmm0
call fcn.004232f0
movzx eax, ax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x38]
push 0x65
push eax
call fcn.00420850
add esp, 0x14
mov edx, 0x96
test al, al
mov ecx, 0x12c
cmove ecx, edx
mov edx, dword [ebp - 0x14]
cmp dx, cx
jb 0x416b47
mov byte [ebp - 0x1d0], 0x64
jmp 0x416b5c
cmp dx, 0x64
movzx eax, dl
mov ecx, 0x63
cmovae eax, ecx
mov dword [ebp - 0x1d0], eax
lea eax, [ebp - 0x38]
push eax
call fcn.00418b20
mov ecx, dword [ebp - 0x1d0]
xor edx, edx
add esp, 4
movzx ecx, cl
test al, al
cmove edx, ecx
mov dword [ebp - 0x1d0], edx
mov byte [ebp - 0x1d8], dl
test dl, dl
jne 0x416b8f
mov eax, str.e_38_2_239_75_75m
jmp 0x416bb2
cmp dl, 0x19
jae 0x416b9b
mov eax, str.e_38_2_247_127_40m
jmp 0x416bb2
cmp dl, 0x32
jae 0x416ba7
mov eax, str.e_38_2_255_180_5m
jmp 0x416bb2
cmp dl, 0x4b
mov eax, str.e_38_2_174_197_59m
cmovae eax, edi
push eax
push str.VM_likeliness:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00404b40
add esp, 8
push eax
call fcn.00404b40
mov ecx, dword [ebp - 0x1d0]
add esp, 8
movzx ecx, cl
push 0x433dd4
push ecx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
push eax
call fcn.00404b40
add esp, 8
push 0x433644
push str.e_0m
push eax
call fcn.00404b40
add esp, 8
push eax
call fcn.00404b40
mov eax, dword [ebp - 0x1e4]
lea ecx, [ebp - 0x1e8]
add esp, 8
mov byte [ebp - 0x1e4], al
mov eax, dword [ebp - 0x1c8]
xorps xmm0, xmm0
mov byte [ebp - 0x14], al
movups xmmword [0x43a6c8], xmm0
mov dword [ebp - fcn.00417eb0], 0x4329f8
push dword [ebp - 0x14]
call fcn.00417eb0
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x4329f8
call fcn.00417eb0
push 0x43a6c8
call fcn.00415460
movups xmm0, xmmword [0x43a6c8]
lea eax, [ebp - 0x38]
push 1
push eax
movups xmmword [ebp - 0x38], xmm0
call fcn.004232f0
movzx esi, ax
lea eax, [ebp - 0x38]
push 0x65
push eax
call fcn.00420850
add esp, 0x14
test al, al
je 0x416c96
mov eax, 0x12c
cmp si, ax
jmp 0x416c99
cmp esi, 0x64
lea eax, [ebp - 0x38]
setae byte [ebp - 0x1c2]
push eax
call fcn.00418b20
movzx ecx, byte [ebp - 0x1c2]
xor edx, edx
test al, al
push str.VM_confirmation:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmove edx, ecx
mov dword [ebp - 0x14], edx
mov byte [ebp - 0x1e8], dl
call fcn.00404b40
cmp byte [ebp - 0x14], 0
mov edx, str.e_38_2_239_75_75m
mov ecx, edi
cmove ecx, edx
push ecx
push eax
call fcn.00404b40
add esp, 0x14
mov ecx, eax
push 0x413f00
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push dword [ebp - 0x1e8]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___bool_]
push 0x4222b0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push 0x433644
push str.e_0m
push eax
call fcn.00404b40
add esp, 8
push eax
call fcn.00404b40
movzx eax, byte [0x43a6b4]
add esp, 8
cmp eax, 4
ja case.default.0x416d38
jmp dword [eax*4 + 0x4173cc]
mov eax, str.e_38_2_239_75_75m
jmp 0x416d60
mov eax, str.e_38_2_247_127_40m
jmp 0x416d60
mov eax, str.e_38_2_255_180_5m
jmp 0x416d60
mov eax, str.e_38_2_174_197_59m
jmp 0x416d60
mov eax, str.e_38_2_94_214_114m
push eax
push str.VM_detections:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00404b40
add esp, 8
push eax
call fcn.00404b40
movzx ecx, byte [0x43a6b4]
add esp, 8
push 0x433e00
push ecx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
push eax
call fcn.00404b40
add esp, 8
mov ecx, eax
push 0x64
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
push 0x433dfc
push str.e_0m
push eax
call fcn.00404b40
add esp, 8
push eax
call fcn.00404b40
movups xmm0, xmmword [0x43a710]
mov eax, dword [0x43a6fc]
add esp, 8
movups xmmword [ebp - 0x38], xmm0
cmp eax, 0x64
je 0x416deb
cmp eax, 0x63
jne 0x416dfd
push 0x10
mov ecx, 0x43a6b8
call fcn.00423c20
test al, al
jne 0x416dfd
lea eax, [ebp - 0x38]
push 0x64
push eax
call fcn.00420850
add esp, 8
test al, al
je 0x416e0b
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.004232f0
add esp, 8
lea eax, [ebp - 0x1e0]
mov dword [ebp - 0x1e0], 0
push 1
mov ecx, eax
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.00413530
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x1e0], eax
push eax
mov eax, dword [0x43a6e8]
lea ecx, [ebp - 0x1e0]
mov byte [ebp - 4], 0x4b
push dword [eax + 4]
call fcn.00405930
mov ecx, dword [ebp - 0x1e0]
mov dword [ecx + 4], eax
mov esi, dword [ebp - 0x1e0]
mov eax, dword [0x43a6ec]
mov dword [ebp - 0x1dc], eax
mov edx, dword [esi + 4]
cmp byte [edx + 0xd], 0
jne 0x416ec0
mov ecx, dword [edx]
cmp byte [ecx + 0xd], 0
jne 0x416e9c
nop dword [eax + eax]
mov eax, dword [ecx]
mov edx, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x416e90
mov dword [esi], edx
mov edx, dword [ebp - 0x1e0]
mov ecx, dword [edx + 4]
mov eax, dword [ecx + 8]
cmp byte [eax + 0xd], 0
jne 0x416ebb
mov ecx, eax
mov eax, dword [ecx + 8]
cmp byte [eax + 0xd], 0
je 0x416eb0
mov dword [edx + 8], ecx
jmp 0x416ecb
mov dword [esi], esi
mov eax, dword [ebp - 0x1e0]
mov dword [eax + 8], eax
mov eax, dword [ebp - 0x1d0]
mov byte [ebp - 4], 0x4c
test al, al
jne 0x416ee0
mov edi, str.e_38_2_239_75_75m
jmp 0x416f2a
cmp al, 0xc
ja 0x416eeb
mov edi, str.e_38_2_239_75_75m
jmp 0x416f2a
cmp al, 0x19
ja 0x416ef6
mov edi, str.e_38_2_247_127_40m
jmp 0x416f2a
cmp al, 0x32
jae 0x416f01
mov edi, str.e_38_2_247_127_40m
jmp 0x416f2a
cmp al, 0x3e
ja 0x416f0c
mov edi, str.e_38_2_255_180_5m
jmp 0x416f2a
cmp al, 0x4b
ja 0x416f17
mov edi, str.e_38_2_174_197_59m
jmp 0x416f2a
cmp al, 0x64
jae 0x416f22
mov edi, str.e_38_2_94_214_114m
jmp 0x416f2a
mov ecx, 0x42d660
cmovne edi, ecx
lea eax, [ebp - 0xb8]
push eax
push dword [ebp - 0x1d8]
lea eax, [ebp - 0x1a8]
push eax
call fcn.004210f0
add esp, 0xc
push str._CONCLUSION:
push str.e_1m
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov byte [ebp - 4], 0x4d
call fcn.00404b40
add esp, 8
push eax
call fcn.00404b40
add esp, 8
push edi
push str.e_0m
push eax
call fcn.00404b40
add esp, 8
push eax
call fcn.00404b40
cmp dword [ebp - 0x194], 0xf
lea ecx, [ebp - 0x1a8]
push dword [ebp - 0x198]
cmova ecx, dword [ebp - 0x1a8]
push ecx
push eax
call fcn.00406cf0
push 0x433e1c
push eax
call fcn.00404b40
push str.e_0m
push eax
call fcn.00404b40
add esp, 0x24
push str.
push str.e_1m
push eax
call fcn.00404b40
add esp, 8
push eax
call fcn.00404b40
add esp, 8
push 0x433dfc
push str.e_0m
push eax
call fcn.00404b40
add esp, 8
push eax
call fcn.00404b40
add esp, 8
cmp byte [ebp - 0x1c8], 0x66
jne 0x417110
mov esi, dword [ebp - 0x1e0]
xor al, al
mov byte [ebp - 0x1d1], al
mov byte [ebp - 0x1c9], al
mov byte [ebp - 0x1c2], al
mov esi, dword [esi]
mov eax, esi
mov dword [ebp - 0x1c8], eax
cmp byte [esi + 0xd], 0
jne 0x417110
nop dword [eax]
mov eax, dword [eax + 0x10]
mov edx, str.Microsoft_Hyper_V
mov dword [ebp - 0x1d0], eax
mov ecx, eax
mov al, byte [ecx]
cmp al, byte [edx]
mov byte [ebp - 0x1c1], al
mov eax, dword [ebp - 0x1d0]
jne 0x417082
cmp byte [ebp - 0x1c1], 0
je 0x41707e
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
mov byte [ebp - 0x1c1], al
mov eax, dword [ebp - 0x1d0]
jne 0x417082
add ecx, 2
add edx, 2
cmp byte [ebp - 0x1c1], 0
jne 0x417040
xor ecx, ecx
jmp 0x417087
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x417094
mov byte [ebp - 0x1d1], 1
jmp 0x4170d9
mov ecx, str.Virtual_PC
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4170c0
test dl, dl
je 0x4170bc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4170c0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4170a0
xor eax, eax
jmp 0x4170c5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4170d2
mov byte [ebp - 0x1c9], 1
jmp 0x4170d9
mov byte [ebp - 0x1c2], 1
lea ecx, [ebp - 0x1c8]
call fcn.0040cb50
mov eax, dword [ebp - 0x1c8]
cmp byte [eax + 0xd], 0
je 0x417030
cmp byte [ebp - 0x1d1], 0
jne 0x41715d
cmp byte [ebp - 0x1c9], 0
je 0x417110
mov al, byte [ebp - 0x1c2]
test al, al
jne 0x417163
cmp byte [ebp - 0x1ec], 0
jne 0x4172a2
mov eax, dword [0x43a6b0]
shr eax, 0xc
test al, 1
jne 0x41726e
cmp dword [ebp - 0x1ac], 0xf
lea eax, [ebp - 0x1c0]
push dword [ebp - 0x1b0]
cmova eax, dword [ebp - 0x1c0]
push eax
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00406cf0
push str.To_enable_spoofable_techniques__run_with_the____spoofable__argument_n_n
jmp 0x417299
mov al, byte [ebp - 0x1c2]
test al, al
jne 0x417110
mov byte [ebp - 0x1c9], al
mov dword [ebp - 0x1c8], esi
cmp byte [esi + 0xd], al
jne 0x417110
nop dword [eax + eax]
mov ecx, dword [esi + 0x10]
mov edx, str.Microsoft_Hyper_V
nop dword [eax + eax]
mov al, byte [ecx]
cmp al, byte [edx]
mov byte [ebp - 0x1c1], al
mov eax, dword [esi + 0x10]
jne 0x4171cc
cmp byte [ebp - 0x1c1], 0
je 0x4171c8
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
mov byte [ebp - 0x1c1], al
mov eax, dword [esi + 0x10]
jne 0x4171cc
add ecx, 2
add edx, 2
cmp byte [ebp - 0x1c1], 0
jne 0x417190
xor ecx, ecx
jmp 0x4171d1
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x417209
mov ecx, str.Virtual_PC
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x417200
test dl, dl
je 0x4171fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x417200
add eax, 2
add ecx, 2
test dl, dl
jne 0x4171e0
xor eax, eax
jmp 0x417205
sbb eax, eax
or eax, 1
test eax, eax
jne 0x417210
mov byte [ebp - 0x1c9], 1
lea ecx, [ebp - 0x1c8]
call fcn.0040cb50
mov esi, dword [ebp - 0x1c8]
cmp byte [esi + 0xd], 0
je 0x417180
cmp byte [ebp - 0x1c9], 0
je 0x417110
cmp byte [ebp - 0x1ec], 0
jne 0x4172a2
cmp dword [ebp - 0x8c], 0xf
lea eax, [ebp - 0xa0]
push dword [ebp - 0x90]
cmova eax, dword [ebp - 0xa0]
push eax
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00406cf0
push str._If_you_know_you_are_running_on_host__Hyper_V_virtualises_all_applications_by_default_within_the_host_system._This_result_is_in_fact_correct_and_NOT_a_false_positive._If_you_do_not_want_Hyper_Vs_default_virtualisation_to_affect_the_result__disable_Hyper_V_in_your_system._See_here_for_more_information_https:__github.com_kernelwernel_VMAware_issues_75_n_n
jmp 0x417299
cmp dword [ebp - 0x8c], 0xf
lea eax, [ebp - 0xa0]
push dword [ebp - 0x90]
cmova eax, dword [ebp - 0xa0]
push eax
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00406cf0
push str._If_you_found_a_false_positive__please_make_sure_to_create_an_issue_at_https:__github.com_kernelwernel_VMAware_issues_n_n
push eax
call fcn.00404b40
add esp, 0x14
lea ecx, [ebp - 0x1a8]
call fcn.0040c3d0
lea eax, [ebp - 0x1e0]
push eax
mov ecx, eax
call fcn.00406010
lea ecx, [ebp - 0xb8]
call fcn.0040c3d0
lea ecx, [ebp - 0x1c0]
call fcn.0040c3d0
lea ecx, [ebp - 0x118]
call fcn.0040c3d0
mov eax, dword [ebp - 0x8c]
cmp eax, 0xf
jbe 0x4172fd
push eax
push dword [ebp - 0xa0]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040fab0
add esp, 0xc
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0xf
mov byte [ebp - 0xa0], 0
cmp eax, 0xf
jbe 0x417339
push eax
push dword [ebp - 0xd0]
lea eax, [ebp - 0xd0]
push eax
call fcn.0040fab0
add esp, 0xc
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0xf
mov byte [ebp - 0xd0], 0
cmp eax, 0xf
jbe 0x417375
push eax
push dword [ebp - 0xe8]
lea eax, [ebp - 0xe8]
push eax
call fcn.0040fab0
add esp, 0xc
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0xf
mov byte [ebp - 0xe8], 0
cmp eax, 0xf
jbe 0x4173b1
push eax
push dword [ebp - 0x100]
lea eax, [ebp - 0x100]
push eax
call fcn.0040fab0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00429696
mov esp, ebp
pop ebp
ret