Function at 0x140001440
Capabilities:
Access peb ldr_data
Check for debugger via api
Check for outputdebugstring error
Check for peb beingdebugged flag
Check for peb ntglobalflag flag
Check for software breakpoints
Check for time delay via gettickcount
Check for unmoving mouse cursor
Check if file exists
Check if process is running under wine
Check os version
Create thread
Encode data using base64
Enumerate process modules
Execute anti-debugging instructions
Get common file path
Get disk size
Get file attributes
Get memory capacity
Get ntdll base address
Get number of processor cores
Get program files directory
Get system information on windows
Print debug messages
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Reference processor manufacturer constants
Reference wmi statements
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70f0]
mov eax, 0x71f0
call fcn.140017140
sub rsp, rax
mov rax, qword [0x140027010]
xor rax, rsp
mov qword [rbp + 0x70e0], rax
xor r8d, r8d
movsxd r14, ecx
mov rsi, rdx
lea r12d, [r8 + 1]
cmp r14d, r12d
jle 0x140001522
mov ebx, r12d
cmp r14, r12
jbe 0x140001599
lea edi, [r8 + 2]
lea r13, str.__check
nop dword [rax + rax]
mov rdx, qword [rsi + rbx*8]
mov rcx, r8
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rcx + r13 - 1]
jne 0x140001514
cmp rcx, 8
jne 0x1400014c0
cmp edi, r14d
jge 0x140001514
mov rdx, qword [rsi + rbx*8 + 8]
mov qword [rbp - 0x68], r8
mov qword [rbp - 0x58], r8
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x50], SafeArrayLock
inc r8
cmp byte [rdx + r8], 0
jne 0x1400014f5
lea rcx, [rbp - 0x68]
call fcn.140008ea0
lea rcx, [rbp - 0x68]
call fcn.140001010
xor r8d, r8d
add edi, 2
add rbx, 2
cmp rbx, r14
jl 0x1400014b0
jmp 0x140001599
mov dword [0x140040044], r12d
mov dword [0x140040040], r12d
mov dword [0x14004003c], r12d
mov dword [0x140040038], r12d
mov dword [0x140040034], r12d
mov dword [0x140040030], r12d
mov dword [0x14004002c], r12d
mov dword [0x140040028], r12d
mov dword [0x140040024], r12d
mov dword [0x140040020], r12d
mov dword [0x14004001c], r12d
mov dword [0x140040018], r12d
mov dword [0x140040014], r12d
mov dword [0x14004000c], r12d
mov dword [0x140040008], r12d
mov dword [0x140040004], r12d
mov dword [0x140040000], r12d
lea rcx, str.Al_Khaser___by_Lord_Noteworthy
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 0x64
mov dword [rsp + 0x28], r12d
mov r8d, edx
mov dword [rsp + 0x20], 0x384
mov r9d, 0x384
mov rcx, rax
call qword [sym.imp.USER32.dll_MoveWindow]
lea rcx, str._al_khaser_version_0.82_
call fcn.140008c80
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x650]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x650]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x658]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Initialisation
lea rcx, str._n___________________________s___________________________n
call fcn.140008c80
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor ecx, ecx
lea rsi, [0x14003f19c]
mov r13d, ecx
nop word [rax + rax]
test dword [rsi - 4], 0xfffffffd
mov r15d, dword [rsi + 4]
mov r12d, dword [rsi]
jne 0x140001701
xor r14b, r14b
lea rbx, [0x14003f758]
mov rdi, rcx
xor al, al
lea rcx, [0x14003f828]
nop word [rax + rax]
test rdi, rdi
je 0x140001697
cmp dword [rbx - 8], r12d
jne 0x140001697
mov r14b, 1
call qword [rbx]
lea rcx, [0x14003f828]
inc rdi
add rbx, 0x10
cmp rbx, rcx
jl 0x140001680
test r14b, r14b
jne 0x1400016b1
lea rcx, str.ERROR:_Minimum_version_value_was_invalid._n
jmp 0x1400016fc
test al, al
je 0x140001701
test r15d, r15d
jne 0x1400016be
mov al, 1
jmp 0x140001703
xor dil, dil
lea rbx, [0x14003f758]
xor al, al
nop word [rax + rax]
cmp dword [rbx - 8], r15d
jne 0x1400016e7
mov dil, 1
call qword [rbx]
test al, al
lea rcx, [0x14003f828]
sete al
add rbx, 0x10
cmp rbx, rcx
jl 0x1400016d0
test dil, dil
jne 0x140001703
lea rcx, str.ERROR:_Removed_version_value_was_invalid._n
call fcn.140008c10
xor al, al
mov rcx, qword [rsi - 0x14]
mov byte [rsi + 9], al
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x14000171a
mov byte [rsi + 8], al
jmp 0x140001734
mov rdx, qword [rsi - 0xc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rsi + 0xc], rax
setne al
mov byte [rsi + 8], al
inc r13d
add rsi, 0x30
mov ecx, 0
cmp r13d, 0x1f
jb 0x140001650
xor edx, edx
lea rcx, [rbp + 0x3df0]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x3df0]
call fcn.140013370
test eax, eax
je 0x140001781
lea rdx, [rbp + 0x3df0]
lea rcx, str._n___You_are_running:__s_n
call fcn.140008c80
xor r12d, r12d
lea rbx, [0x14003f1a4]
mov esi, r12d
mov edi, r12d
cmp byte [rbx + 1], r12b
je 0x1400017b2
cmp byte [rbx], r12b
jne 0x1400017b2
mov r8, qword [rbx - 0x14]
lea rcx, str.___Warning:_API__s__s_was_expected_to_exist_but_was_not_found._n
mov rdx, qword [rbx - 0x1c]
call fcn.140008c10
inc esi
inc edi
add rbx, 0x30
cmp edi, 0x1f
jb 0x140001791
test esi, esi
jne 0x1400017cd
lea rcx, str.___All_APIs_present_and_accounted_for._n
call fcn.140008c10
call fcn.140013080
test eax, eax
je 0x1400017e2
lea rcx, str.Process_is_running_under_WOW64_n_n
call fcn.140008c80
cmp dword [0x140040040], r12d
je 0x1400018ef
lea rcx, [rbp + 0x698]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [rbp + 0x69c]
lea r8, [rbp + 0x5b8]
xorps xmm0, xmm0
lea rdx, [fcn.1400096b0]
mov ecx, 4
movups xmmword [rbp + 0x668], xmm0
movups xmmword [rbp + 0x678], xmm0
movups xmmword [rbp + 0x688], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x1400018ef
mov rbx, qword [rbp + 0x5b8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetElement
lea r8, [rbp + 0x5c8]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x1400018ef
mov rdi, r12
cmp dword [rbp + 0x5d0], r12d
jbe 0x1400018ef
mov rbx, qword [rbp + 0x5c8]
nop dword [rax]
mov r8d, 0x30
lea rdx, [rbp + 0x668]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
jb 0x1400018de
mov eax, dword [rbp + 0x68c]
test al, 0x10
jne 0x1400018b2
test al, 0x20
jne 0x1400018b2
test al, al
js 0x1400018b2
test al, 0x40
je 0x1400018de
mov rdx, qword [0x140040068]
cmp rdx, qword [0x140040070]
mov qword [rsp + 0x70], rbx
je 0x1400018d4
mov qword [rdx], rbx
add qword [0x140040068], 8
jmp 0x1400018de
lea r8, [rsp + 0x70]
call fcn.1400098a0
mov eax, dword [rbp + 0x5d0]
add rdi, rsi
add rbx, rsi
cmp rdi, rax
jb 0x140001880
cmp dword [0x140040044], r12d
mov r14d, 0x43
mov r15d, 0x44
mov qword [rbp + 0x588], r14
mov qword [rsp + 0x70], r15
je 0x140001baf
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x650]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x650]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x658]
lea edx, [r14 - 0x36]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.TLS_Callbacks
lea rcx, str._n___________________________s___________________________n
call fcn.140008c80
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.TLS_process_attach_callback
lea rcx, str.____s
call fcn.140008c80
mov ebx, r14d
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140001990
mov rax, qword [0x140040080]
mov ebx, r12d
test rax, rax
jne 0x1400019ee
inc ebx
cmp ebx, 0x3e8
je 0x1400019d5
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov rax, qword [0x140040080]
test rax, rax
je 0x1400019b1
cmp ebx, 0x3e8
jl 0x1400019ee
lea rcx, str.TLSCallbackProcess_timeout_on_event_creation.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, 1
mov ecx, edi
jmp 0x140001a7a
mov rcx, qword [0x140040080]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140001a43
cmp eax, 0xffffffff
jne 0x140001a1f
lea rcx, str.TLSCallbackProcess_wait_failed.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, 1
mov ecx, edi
jmp 0x140001a7a
lea rcx, str.TLSCallbackProcess_wait_abandoned.
cmp eax, 0x80
je 0x1400019dc
lea rcx, str.TLSCallbackProcess_timeout_on_event_wait.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, 1
mov ecx, edi
jmp 0x140001a7a
mov eax, dword [0x140040088]
lea rcx, str.TLSCallbackProcess_data_did_not_match.
cmp eax, 0xdeadbeef
jne 0x140001a5e
lea rcx, str.All_seems_fine_for_TLSCallbackProcess.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x140040088]
mov ecx, r12d
cmp eax, 0xdeadbeef
mov edi, 1
setne cl
lea rdx, str.TLS_process_attach_callback
call fcn.140012a30
lea rdx, str.TLS_thread_attach_callback
lea rcx, str.____s
call fcn.140008c80
mov rbx, r15
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140001aa0
mov qword [rsp + 0x28], r12
lea r8, [0x14000db30]
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x140001ae2
lea rcx, str.TLS_callback:_couldnt_start_dummy_thread
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, qword [0x140040078]
mov ebx, r12d
test rax, rax
jne 0x140001b26
inc ebx
cmp ebx, 0x3e8
je 0x140001b15
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov rax, qword [0x140040078]
test rax, rax
je 0x140001af1
cmp ebx, 0x3e8
jl 0x140001b26
lea rcx, str.TLSCallbackThread_timeout_on_event_creation.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, edi
jmp 0x140001ba3
mov rcx, qword [0x140040078]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140001b71
cmp eax, 0xffffffff
jne 0x140001b52
lea rcx, str.TLSCallbackThread_wait_failed.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, edi
jmp 0x140001ba3
lea rcx, str.TLSCallbackThread_wait_abandoned.
cmp eax, 0x80
je 0x140001b67
lea rcx, str.TLSCallbackThread_timeout_on_event_wait.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, edi
jmp 0x140001ba3
mov eax, dword [0x14004005c]
lea rcx, str.TLSCallbackThread_data_did_not_match.
cmp eax, 0xdeadbeef
jne 0x140001b8c
lea rcx, str.All_seems_fine_for_TLSCallbackThread.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x14004005c]
mov ecx, r12d
cmp eax, 0xdeadbeef
setne cl
lea rdx, str.TLS_thread_attach_callback
call fcn.140012a30
cmp dword [0x140040040], 0
mov r13d, 0x40
mov r14d, 0x39
mov qword [rbp - 0x78], 7
mov qword [rbp + 0x5b8], 0x1f
mov qword [rsp + 0x78], r14
lea r12d, [r13 - 9]
mov qword [rbp - 0x70], 0x42
lea r15d, [r13 - 0x1b]
mov qword [rbp - 0x80], 0x3d
mov qword [rbp + 0x5a0], 0x41
mov qword [rbp + 0x5b0], 0x31
je 0x140003577
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x758]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x758]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x760]
lea edx, [r13 - 0x33]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Debugger_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008c80
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Checking_IsDebuggerPresent_API
lea rcx, str.____s
call fcn.140008c80
mov ebx, r13d
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140001c90
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, eax
lea rdx, str.Checking_IsDebuggerPresent_API
call fcn.140012a30
lea rdx, str.Checking_PEB.BeingDebugged
lea rcx, str.____s
call fcn.140008c80
mov edi, 0x44
mov ebx, edi
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140001cd0
mov rax, qword gs:[0x60]
lea rdx, str.Checking_PEB.BeingDebugged
xor esi, esi
mov ecx, esi
cmp byte [rax + 2], 1
sete cl
call fcn.140012a30
lea rdx, str.Checking_CheckRemoteDebuggerPresent_API
lea rcx, str.____s
call fcn.140008c80
mov rbx, r12
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140001d20
mov dword [rbp + 0x5e8], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x5e8]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov ecx, dword [rbp + 0x5e8]
lea rdx, str.Checking_CheckRemoteDebuggerPresent_API
call fcn.140012a30
lea rdx, str.Checking_PEB.NtGlobalFlag
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x45
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140001d80
mov rax, qword gs:[0x60]
add rax, 0xbc
je 0x140001db1
test byte [rax], 0x70
je 0x140001db1
mov esi, 1
mov ecx, esi
jmp 0x140001db8
mov ecx, esi
mov esi, 1
lea rdx, str.Checking_PEB.NtGlobalFlag
call fcn.140012a30
lea rdx, str.Checking_ProcessHeap.Flags
lea rcx, str.____s
call fcn.140008c80
mov rbx, rdi
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140001de0
xor r8d, r8d
lea ecx, [rbx + 6]
xor edx, edx
call fcn.1400095c0
mov rcx, qword gs:[0x60]
test al, al
mov rax, qword [rcx + 0x30]
je 0x140001e16
add rax, 0x70
jmp 0x140001e1a
add rax, 0x14
xor edi, edi
lea rdx, str.Checking_ProcessHeap.Flags
cmp dword [rax], 2
mov ecx, edi
seta cl
call fcn.140012a30
lea rdx, str.Checking_ProcessHeap.ForceFlags
lea rcx, str.____s
call fcn.140008c80
lea ebx, [rdi + 0x3f]
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140001e50
xor r8d, r8d
lea ecx, [rbx + 6]
xor edx, edx
call fcn.1400095c0
mov rcx, qword gs:[0x60]
test al, al
mov rax, qword [rcx + 0x30]
je 0x140001e86
add rax, 0x74
jmp 0x140001e8a
add rax, 0x18
cmp dword [rax], edi
lea rdx, str.Checking_ProcessHeap.ForceFlags
mov ecx, edi
seta cl
call fcn.140012a30
lea rdx, str.Checking_Low_Fragmentation_Heap
lea rcx, str.____s
call fcn.140008c80
mov rbx, r13
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140001eb3
mov rbx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea rcx, [rbp + 0xa0c]
mov r8d, 0x110
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov r8b, 1
mov dword [rbp + 0xa00], 0x11c
mov edx, 2
mov qword [rbp + 0xa04], 6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 1
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 3
lea rcx, [rbp + 0xa00]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x140001f96
xor edx, edx
lea rcx, [rbp + 0xb2c]
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memset
mov r8b, 1
mov dword [rbp + 0xb20], 0x11c
mov edx, 2
mov dword [rbp + 0xb24], 6
xor ecx, ecx
mov dword [rbp + 0xb28], esi
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 1
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 3
lea rcx, [rbp + 0xb20]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x140001f9d
lea rbx, [rdi + 0x178]
xor edx, edx
lea rcx, [rbp + 0xc4c]
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memset
mov r8b, 1
mov dword [rbp + 0xc40], 0x11c
mov edx, 2
mov dword [rbp + 0xc44], 6
xor ecx, ecx
mov dword [rbp + 0xc48], 2
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 3
lea rcx, [rbp + 0xc40]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x14000200d
lea rbx, [rdi + 0x170]
test rbx, rbx
je 0x140002021
cmp qword [rbx], 0
jne 0x140002021
mov edi, 1
mov ecx, edi
jmp 0x140002028
xor eax, eax
mov ecx, eax
lea edi, [rax + 1]
lea rdx, str.Checking_Low_Fragmentation_Heap
call fcn.140012a30
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugPort
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x26
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140002050
xor edx, edx
lea rsi, [0x14003f180]
mov eax, edx
mov rcx, rsi
cmp dword [rcx], 0x10
je 0x1400020bc
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002070
mov rbx, rdx
mov qword [rbp + 0x5e8], rdx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x5e8]
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9d, [rax + 8]
lea edx, [rax + 7]
call rbx
test eax, eax
jne 0x1400020d2
cmp qword [rbp + 0x5e8], 0
je 0x1400020d2
mov ecx, edi
jmp 0x1400020d6
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rsi + rcx*8 + 0x24], dl
je 0x140002080
mov rbx, qword [rsi + rcx*8 + 0x28]
jmp 0x140002083
xor eax, eax
mov ecx, eax
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugPort
call fcn.140012a30
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugFlags
lea rcx, str.____s
call fcn.140008c80
mov rbx, r15
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140002100
xor edx, edx
mov rcx, rsi
mov eax, edx
nop dword [rax]
cmp dword [rcx], 0x10
je 0x140002169
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002120
mov rbx, rdx
mov dword [rbp + 0x5e8], edx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x5e8]
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9d, [rax + 4]
lea edx, [rax + 0x1f]
call rbx
test eax, eax
jne 0x14000217f
cmp dword [rbp + 0x5e8], eax
jne 0x14000217f
mov ecx, edi
jmp 0x140002183
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rsi + rcx*8 + 0x24], dl
je 0x140002130
mov rbx, qword [rsi + rcx*8 + 0x28]
jmp 0x140002133
xor eax, eax
mov ecx, eax
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugFlags
call fcn.140012a30
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugObject
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x24
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400021b0
xor edx, edx
mov rcx, rsi
mov eax, edx
nop dword [rax]
cmp dword [rcx], 0x10
je 0x140002215
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x1400021d0
mov rbx, rdx
mov qword [rbp + 0x5e8], rdx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x5e8]
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9d, [rax + 8]
lea edx, [rax + 0x1e]
call rbx
cmp eax, 0xc0000353
je 0x14000222b
mov ecx, edi
jmp 0x140002284
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rsi + rcx*8 + 0x24], dl
je 0x1400021e0
mov rbx, qword [rsi + rcx*8 + 0x28]
jmp 0x1400021e3
cmp qword [rbp + 0x5e8], 0
je 0x140002239
mov ecx, edi
jmp 0x140002284
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
lea r8, [rbp + 0x5e8]
mov rcx, rax
lea rax, [rbp + 0x5e8]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x16]
call rbx
cmp eax, 0xc0000353
je 0x14000226c
mov ecx, edi
jmp 0x140002284
mov rax, qword [rbp + 0x5e8]
test rax, rax
jne 0x14000227c
mov ecx, edi
jmp 0x140002284
xor ecx, ecx
cmp eax, 8
setne cl
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugObject
call fcn.140012a30
lea rdx, str.Checking_WudfIsAnyDebuggerPresent_API
lea rcx, str.____s
call fcn.140008c80
mov rbx, r14
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400022b0
xor r14d, r14d
mov rcx, rsi
mov eax, r14d
nop dword [rax + rax]
cmp dword [rcx], 0x1c
je 0x1400026be
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x1400022d0
mov ecx, r14d
lea rdx, str.Checking_WudfIsAnyDebuggerPresent_API
call fcn.140012a30
lea rdx, str.Checking_WudfIsKernelDebuggerPresent_API
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x36
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140002310
mov eax, r14d
mov rcx, rsi
nop dword [rax + rax]
cmp dword [rcx], 0x1d
je 0x14000271e
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002330
mov ecx, r14d
lea rdx, str.Checking_WudfIsKernelDebuggerPresent_API
call fcn.140012a30
lea rdx, str.Checking_WudfIsUserDebuggerPresent_API
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x38
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140002370
mov eax, r14d
mov rcx, rsi
nop dword [rax + rax]
cmp dword [rcx], 0x1e
je 0x14000277e
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002390
mov ecx, r14d
lea rdx, str.Checking_WudfIsUserDebuggerPresent_API
call fcn.140012a30
lea rdx, str.Checking_NtSetInformationThread_with_ThreadHideFromDebugger
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x23
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400023d0
call fcn.1400093a0
lea rdx, str.Checking_NtSetInformationThread_with_ThreadHideFromDebugger
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_CloseHandle_with_an_invalide_handle
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x32
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140002410
call fcn.140009160
lea rdx, str.Checking_CloseHandle_with_an_invalide_handle
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_NtSystemDebugControl
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x42
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140002450
mov eax, r14d
mov rcx, rsi
nop dword [rax + rax]
cmp dword [rcx], 0xb
je 0x1400027de
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002470
mov rax, r14
xor edx, edx
mov qword [rsp + 0x28], r14
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor r8d, r8d
lea ecx, [rdx + 0x14]
call rax
cmp eax, 0xc0000354
lea rdx, str.Checking_NtSystemDebugControl
mov ecx, r14d
setne cl
call fcn.140012a30
lea rdx, str.Checking_UnhandledExcepFilterTest
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x3d
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400024d0
lea rcx, [0x14000db70]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc000008e
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_RaiseException]
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rsi + rcx*8 + 0x24], r14b
je 0x1400022e4
mov eax, r14d
mov rcx, rsi
cmp dword [rcx], 0x1c
je 0x1400026fa
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x1400026d8
mov rax, r14
call rax
test eax, eax
mov ecx, r14d
setne cl
jmp 0x1400022e7
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rsi + rcx*8 + 0x24], r14b
je 0x1400026e8
mov rax, qword [rsi + rcx*8 + 0x28]
call rax
test eax, eax
mov ecx, r14d
setne cl
jmp 0x1400022e7
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rsi + rcx*8 + 0x24], r14b
je 0x140002344
mov eax, r14d
mov rcx, rsi
cmp dword [rcx], 0x1d
je 0x14000275a
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002738
mov rax, r14
call rax
test eax, eax
mov ecx, r14d
setne cl
jmp 0x140002347
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rsi + rcx*8 + 0x24], r14b
je 0x140002748
mov rax, qword [rsi + rcx*8 + 0x28]
call rax
test eax, eax
mov ecx, r14d
setne cl
jmp 0x140002347
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rsi + rcx*8 + 0x24], r14b
je 0x1400023a4
mov eax, r14d
mov rcx, rsi
cmp dword [rcx], 0x1e
je 0x1400027ba
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002798
mov rax, r14
call rax
test eax, eax
mov ecx, r14d
setne cl
jmp 0x1400023a7
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rsi + rcx*8 + 0x24], r14b
je 0x1400027a8
mov rax, qword [rsi + rcx*8 + 0x28]
call rax
test eax, eax
mov ecx, r14d
setne cl
jmp 0x1400023a7
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rsi + rcx*8 + 0x24], r14b
je 0x140002484
mov rax, qword [rsi + rcx*8 + 0x28]
jmp 0x140002487
cmp dword [0x14004003c], 0
mov r14d, 0x28
mov r12d, 0x35
mov qword [rbp + 0x620], 0x2b
mov qword [rbp + 0x628], r12
lea r13d, [r14 + 6]
je 0x140003a17
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x770]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x770]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x778]
lea edx, [r14 - 0x1b]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.DLL_Injection_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008c80
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__32_bit_
lea rcx, str.____s
call fcn.140008c80
mov ebx, r14d
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140003620
lea ecx, [rbx + 1]
call fcn.14000c1f0
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__32_bit_
mov ecx, eax
call fcn.140012a30
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__64_bit_
lea rcx, str.____s
call fcn.140008c80
mov rbx, r14
nop
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140003660
lea ecx, [rbx + 2]
call fcn.14000c1f0
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__64_bit_
mov ecx, eax
call fcn.140012a30
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__ALL_
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x2b
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400036a0
lea ecx, [rbx + 3]
call fcn.14000c1f0
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__ALL_
mov ecx, eax
call fcn.140012a30
lea rdx, str.Enumerating_modules_with_ToolHelp32
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x3b
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400036e0
xor dil, dil
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140003728
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_snapshot._Last_error:__u_n
call fcn.140008c10
jmp 0x1400037c1
xor edx, edx
lea rcx, [rbp + 0xd64]
mov r8d, 0x434
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0xd60]
mov dword [rbp + 0xd60], 0x438
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400037a4
nop word [rax + rax]
mov edx, 0xffffffff
lea rcx, [rbp + 0xf90]
call fcn.14000be60
movzx ebx, al
test al, al
je 0x14000378b
lea rdx, [rbp + 0xf90]
lea rcx, str._____Injected_library:__S_n
call fcn.140008c10
lea rdx, [rbp + 0xd60]
mov rcx, rsi
or dil, bl
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140003760
jmp 0x1400037b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_first_module._Last_error:__u_n
call fcn.140008c10
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea rdx, str.Enumerating_modules_with_ToolHelp32
mov ecx, eax
test dil, dil
setne cl
call fcn.140012a30
lea rdx, str.Enumerating_the_process_LDR_via_LdrEnumerateLoadedModules
lea rcx, str.____s
call fcn.140008c80
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub r15, 1
jne 0x1400037f0
lea rdx, [0x14003f180]
mov ecx, r15d
mov rax, rdx
nop
cmp dword [rax], 9
je 0x140003828
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140003810
mov ecx, r15d
jmp 0x140003905
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], r15b
jne 0x140003841
mov ecx, r15d
jmp 0x140003905
mov ecx, r15d
mov rax, rdx
cmp dword [rax], 9
je 0x14000389f
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140003847
mov rbx, r15
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.140016168
mov r8, rax
lea rdx, [0x14000d330]
xor ecx, ecx
mov rdi, rax
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
call rbx
test eax, eax
je 0x1400038b7
mov edx, eax
lea rcx, str.LdrEnumerateLoadedModules_failed._Status:__x_n
call fcn.140008c10
mov rcx, rdi
call fcn.14000d410
mov ecx, r15d
jmp 0x140003905
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], r15b
je 0x140003857
mov rbx, qword [rdx + rcx*8 + 0x28]
jmp 0x14000385a
mov r14, qword [rdi + 8]
xor sil, sil
mov rbx, qword [rdi]
cmp rbx, r14
je 0x1400038f4
nop word [rax + rax]
movups xmm2, xmmword [rbx + 0x40]
mov rcx, qword [rbx + 0x50]
pextrw eax, xmm2, 4
movzx edx, ax
call fcn.14000be60
or sil, al
add rbx, 0x88
cmp rbx, r14
jne 0x1400038d0
mov rcx, rdi
call fcn.14000d410
test sil, sil
mov ecx, r15d
setne cl
lea rdx, str.Enumerating_the_process_LDR_via_LdrEnumerateLoadedModules
call fcn.140012a30
lea rdx, str.Enumerating_the_process_LDR_directly
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x3a
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140003930
call fcn.14000cc50
lea rdx, str.Enumerating_the_process_LDR_directly
mov ecx, eax
call fcn.140012a30
lea rdx, str.Walking_process_memory_with_GetModuleInformation
lea rcx, str.____s
call fcn.140008c80
mov rbx, r13
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140003970
call fcn.14000c470
lea rdx, str.Walking_process_memory_with_GetModuleInformation
mov ecx, eax
call fcn.140012a30
lea rdx, str.Walking_process_memory_for_hidden_modules
lea rcx, str.____s
call fcn.140008c80
mov rbx, r12
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400039b0
call fcn.14000c710
lea rdx, str.Walking_process_memory_for_hidden_modules
mov ecx, eax
call fcn.140012a30
lea rdx, str.Walking_process_memory_for_.NET_module_structures
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x2d
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400039f0
call fcn.14000ca00
lea rdx, str.Walking_process_memory_for_.NET_module_structures
mov ecx, eax
call fcn.140012a30
jmp 0x140003a1a
xor r15d, r15d
cmp dword [0x140040038], 0
je 0x14000562e
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x788]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x788]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x790]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Generic_Sandboxe_VM_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008c80
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.avghookx.dll
mov esi, 0xc
mov qword [rbp + 0x2a0], rax
lea rdi, [rbp + 0x2a0]
lea rax, str.avghooka.dll
mov qword [rbp + 0x2a8], rax
lea rax, str.snxhk.dll
mov qword [rbp + 0x2b0], rax
lea rax, str.sbiedll.dll
mov qword [rbp + 0x2b8], rax
lea rax, str.dbghelp.dll
mov qword [rbp + 0x2c0], rax
lea rax, str.api_log.dll
mov qword [rbp + 0x2c8], rax
lea rax, str.dir_watch.dll
mov qword [rbp + 0x2d0], rax
lea rax, str.pstorec.dll
mov qword [rbp + 0x2d8], rax
lea rax, str.vmcheck.dll
mov qword [rbp + 0x2e0], rax
lea rax, str.wpespy.dll
mov qword [rbp + 0x2e8], rax
lea rax, str.cmdvrt64.dll
mov qword [rbp + 0x2f0], rax
lea rax, str.cmdvrt32.dll
mov qword [rbp + 0x2f8], rax
nop dword [rax]
xor edx, edx
lea rcx, [rbp + 0x3bf0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_if_process_loaded_modules_contains:__s
mov edx, 0x100
lea rcx, [rbp + 0x3bf0]
call fcn.1400090a0
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rbp + 0x3bf0]
lea rcx, str.____s
test rax, rax
jne 0x140003bcb
call fcn.140008c80
lea rcx, [rbp + 0x3bf0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140003ba0
mov ebx, 0x5f
sub rbx, rax
je 0x140003bc6
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140003bb4
mov ecx, r15d
jmp 0x140003c0b
call fcn.140008c80
lea rcx, [rbp + 0x3bf0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140003be0
mov ebx, 0x5f
sub rbx, rax
je 0x140003c06
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140003bf4
mov ecx, 1
lea rdx, [rbp + 0x3bf0]
call fcn.140012a30
add rdi, 8
sub rsi, 1
jne 0x140003b40
call fcn.14000de10
lea rax, str.CurrentUser
mov qword [rbp + 0x3f0], rax
lea rax, str.Sandbox
mov qword [rbp + 0x3f8], rax
lea rax, str.Emily
mov qword [rbp + 0x400], rax
lea rax, str.HAPUBWS
mov qword [rbp + 0x408], rax
lea rax, str.Hong_Lee
mov qword [rbp + 0x410], rax
lea rax, str.IT_ADMIN
mov qword [rbp + 0x418], rax
lea rax, str.Johnson
mov qword [rbp + 0x420], rax
lea rax, str.Miller
mov qword [rbp + 0x428], rax
lea rax, str.milozs
mov qword [rbp + 0x430], rax
lea rax, str.Peter_Wilson
mov qword [rbp + 0x438], rax
lea rax, str.timmy
mov qword [rbp + 0x440], rax
lea rax, str.user
mov qword [rbp + 0x448], rax
lea rax, str.sand_box
mov qword [rbp + 0x450], rax
lea rax, str.malware
mov qword [rbp + 0x458], rax
lea rax, str.maltest
mov qword [rbp + 0x460], rax
lea rax, str.test_user
mov qword [rbp + 0x468], rax
lea rax, str.virus
mov qword [rbp + 0x470], rax
lea rax, str.John_Doe
mov qword [rbp + 0x478], rax
call fcn.14000e220
mov r15, rax
test rax, rax
je 0x140003dfd
lea rdi, [rbp + 0x3f0]
xor r13d, r13d
lea r14d, [rsi + 0x12]
lea r12d, [rsi + 1]
nop dword [rax]
mov r9, qword [rdi]
lea r8, str.Checking_if_username_matches_:__s
mov edx, 0x100
lea rcx, [rbp + 0x4830]
call fcn.1400090a0
mov rcx, qword [rdi]
mov rdx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov esi, r13d
lea rdx, [rbp + 0x4830]
test eax, eax
lea rcx, str.____s
cmove esi, r12d
call fcn.140008c80
lea rcx, [rbp + 0x4830]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140003da1
mov ebx, 0x5f
sub rbx, rax
je 0x140003dd1
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, r12
jne 0x140003dc0
lea rdx, [rbp + 0x4830]
mov ecx, esi
call fcn.140012a30
add rdi, 8
sub r14, r12
jne 0x140003d50
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea r13d, [r14 + 0x2e]
lea r12d, [r14 + 0x35]
lea rax, str.SANDBOX
mov qword [rbp + 0x120], rax
lea rax, str.7SILVIA
mov qword [rbp + 0x128], rax
lea rax, str.HANSPETER_PC
mov qword [rbp + 0x130], rax
lea rax, str.JOHN_PC
mov qword [rbp + 0x138], rax
lea rax, str.MUELLER_PC
mov qword [rbp + 0x140], rax
lea rax, str.WIN7_TRAPS
mov qword [rbp + 0x148], rax
lea rax, str.FORTINET
mov qword [rbp + 0x150], rax
lea rax, str.TEQUILABOOMBOOM
mov qword [rbp + 0x158], rax
call fcn.14000e2a0
mov r15, rax
test rax, rax
je 0x140003f7c
call fcn.14000e320
mov r12, rax
test rax, rax
jne 0x140003e99
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140003f76
mov r14d, 8
lea rsi, [rbp + 0x120]
lea r13d, [r14 - 7]
nop word [rax + rax]
mov rbx, qword [rsi]
lea r8, str.Checking_if_hostname_matches_:__s
mov r9, rbx
lea rcx, [rbp + 0x4000]
mov edx, 0x100
call fcn.1400090a0
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140003ee3
mov edi, r13d
jmp 0x140003ef9
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor ecx, ecx
test eax, eax
mov edi, ecx
cmove edi, r13d
lea rdx, [rbp + 0x4000]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x4000]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140003f20
mov ebx, 0x5f
sub rbx, rax
je 0x140003f45
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, r13
jne 0x140003f34
lea rdx, [rbp + 0x4000]
mov ecx, edi
call fcn.140012a30
add rsi, 8
sub r14, r13
jne 0x140003eb0
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea r13d, [r14 + 0x2e]
mov r12d, 0x35
call fcn.14000e3d0
lea rdx, str.Checking_Number_of_processors_in_machine
lea rcx, str.____s
call fcn.140008c80
mov edi, 0x36
mov ebx, edi
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140003fa0
mov rax, qword gs:[0x60]
lea rdx, str.Checking_Number_of_processors_in_machine
xor r15d, r15d
mov ecx, r15d
cmp dword [rax + 0xb8], 2
setb cl
call fcn.140012a30
lea rdx, str.Checking_Interupt_Descriptor_Table_location
lea rcx, str.____s
call fcn.140008c80
mov esi, 0x33
mov ebx, esi
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140003ff1
mov eax, dword [rbp + 0x5f0]
lea rdx, str.Checking_Interupt_Descriptor_Table_location
and eax, 0xff000000
mov ecx, r15d
cmp eax, 0xff000000
sete cl
call fcn.140012a30
lea rdx, str.Checking_Local_Descriptor_Table_location
lea rcx, str.____s
call fcn.140008c80
mov rbx, rdi
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004040
cmp dword [0x140021b7c], 0xdead0000
lea rdx, str.Checking_Local_Descriptor_Table_location
movzx eax, byte [0x140021b80]
mov ecx, r15d
setne cl
mov byte [rbp + 0x5f4], al
call fcn.140012a30
lea rdx, str.Checking_Global_Descriptor_Table_location
lea rcx, str.____s
call fcn.140008c80
mov rbx, r12
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004091
mov eax, dword [rbp + 0x5f0]
lea rdx, str.Checking_Global_Descriptor_Table_location
and eax, 0xff000000
mov ecx, r15d
cmp eax, 0xff000000
sete cl
call fcn.140012a30
lea rdx, str.Checking_Store_Task_Register
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x42
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400040e0
lea rdx, str.Checking_Store_Task_Register
xor ecx, ecx
call fcn.140012a30
lea rdx, str.Checking_Number_of_cores_in_machine_using_WMI
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x31
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004120
lea r8, [0x14001d8e0]
mov qword [rbp + 0x5f8], r15
lea rdx, [rbp + 0x580]
mov qword [rbp + 0x580], r15
lea rcx, [rbp + 0x5f8]
mov qword [rbp + 0x5f0], r15
mov edi, r15d
call fcn.140015270
test eax, eax
je 0x140004321
lea rcx, [0x140021b60]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_Processor
mov r14, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, 1
mov rsi, rax
mov r15d, ebx
test r14, r14
je 0x140004211
test rax, rax
je 0x140004208
mov rcx, qword [rbp + 0x5f8]
lea rax, [rbp + 0x5f0]
mov qword [rsp + 0x28], rax
mov r8, rsi
xor eax, eax
mov qword [rsp + 0x20], rax
mov rdx, qword [rcx]
lea r9d, [rax + 0x30]
mov rbx, qword [rdx + 0xa0]
mov rdx, r14
call rbx
test eax, eax
jns 0x140004203
xor eax, eax
lea rcx, str.ExecQuery
mov r15d, eax
call fcn.140012b60
mov rcx, qword [rbp + 0x5f8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x580]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov ebx, 1
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rsi, rsi
je 0x14000421f
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r15d, r15d
je 0x140004319
mov rcx, qword [rbp + 0x5f0]
xor r15d, r15d
mov qword [rbp + 0x598], r15
mov dword [rbp + 0x5e8], r15d
test rcx, rcx
je 0x1400042f1
nop dword [rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x5e8]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x598]
mov edx, 0xffffffff
mov r8d, ebx
call qword [rax + 0x20]
cmp dword [rbp + 0x5e8], r15d
je 0x1400042ea
mov rcx, qword [rbp + 0x598]
lea r9, [rbp + 0x6c8]
mov qword [rsp + 0x28], r15
lea rdx, str.NumberOfCores
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x1400042c7
cmp word [rbp + 0x6c8], 1
je 0x1400042c7
cmp dword [rbp + 0x6d0], 2
lea rcx, [rbp + 0x6c8]
cmovb edi, ebx
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x598]
mov rax, qword [rcx]
call qword [rax + 0x10]
test edi, edi
jne 0x1400042ea
mov rcx, qword [rbp + 0x5f0]
test rcx, rcx
jne 0x140004250
jmp 0x1400042f1
mov rcx, qword [rbp + 0x5f0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x5f8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x580]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x14000431c
xor r15d, r15d
mov esi, 0x33
lea rdx, str.Checking_Number_of_cores_in_machine_using_WMI
mov ecx, edi
call fcn.140012a30
lea rdx, str.Checking_hard_disk_size_using_WMI
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x3d
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004350
call fcn.14000e790
lea rdx, str.Checking_hard_disk_size_using_WMI
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_hard_disk_size_using_DeviceIoControl
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x31
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004390
call fcn.14000e9e0
lea rdx, str.Checking_hard_disk_size_using_DeviceIoControl
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_SetupDi_diskdrive
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x44
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400043d0
call fcn.14000ed10
lea rdx, str.Checking_SetupDi_diskdrive
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_mouse_movement
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x47
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004410
lea rcx, [rbp + 0x5f8]
mov qword [rbp + 0x5f8], r15
mov qword [rbp + 0x5f0], r15
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x5f0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rbp + 0x5f0]
cmp dword [rbp + 0x5f8], eax
jne 0x14000447c
mov eax, dword [rbp + 0x5f4]
cmp dword [rbp + 0x5fc], eax
jne 0x14000447c
mov r14d, 1
mov ecx, r14d
jmp 0x140004485
mov ecx, r15d
mov r14d, 1
lea rdx, str.Checking_mouse_movement
call fcn.140012a30
lea rdx, str.Checking_lack_of_user_input
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x43
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400044b0
mov ebx, r15d
mov dword [rbp + 0x5a8], 8
mov edi, r15d
mov ecx, 0xb
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x5a8]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x14000451a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rbp + 0x5ac]
cmp eax, ecx
jb 0x14000451a
sub eax, ecx
cmp eax, 0x64
jae 0x140004510
inc ebx
cmp ebx, 0xa
jge 0x140004bf1
inc edi
cmp edi, 0x80
jl 0x1400044d2
mov ecx, r14d
lea rdx, str.Checking_lack_of_user_input
call fcn.140012a30
lea rdx, str.Checking_memory_space_using_GlobalMemoryStatusEx
lea rcx, str.____s
call fcn.140008c80
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub r13, 1
jne 0x140004540
xorps xmm0, xmm0
lea rcx, [rbp + 0x850]
movups xmmword [rbp + 0x850], xmm0
mov r13d, 0x40
mov dword [rbp + 0x850], r13d
movups xmmword [rbp + 0x860], xmm0
movups xmmword [rbp + 0x870], xmm0
movups xmmword [rbp + 0x880], xmm0
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp qword [rbp + 0x858], 0x40000000
lea rdx, str.Checking_memory_space_using_GlobalMemoryStatusEx
mov ecx, r15d
setb cl
call fcn.140012a30
lea rdx, str.Checking_disk_size_using_GetDiskFreeSpaceEx
lea rcx, str.____s
call fcn.140008c80
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rsi, 1
jne 0x1400045c0
xor r9d, r9d
lea r8, [rbp + 0x638]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x140004600
movabs rax, 0x1400000000
mov ecx, r14d
cmp qword [rbp + 0x638], rax
jb 0x140004603
mov ecx, r15d
lea rdx, str.Checking_disk_size_using_GetDiskFreeSpaceEx
call fcn.140012a30
lea rdx, str.Checking_if_CPU_hypervisor_field_is_set_using_cpuid_0x1_
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x27
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004630
xor ecx, ecx
mov eax, r14d
cpuid
sar ecx, 0x1f
lea rdx, str.Checking_if_CPU_hypervisor_field_is_set_using_cpuid_0x1_
and ecx, 1
call fcn.140012a30
lea rdx, str.Checking_hypervisor_vendor_using_cpuid_0x40000000_
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x2d
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004673
xor ecx, ecx
mov qword [rbp + 0x11ac], r15
mov qword [rsp + 0x64], rcx
mov eax, 0x40000000
lea rcx, str.KVMKVMKVM
mov qword [rbp + 0x11b4], r15
mov qword [rbp + 0x40], rcx
lea rcx, str.Microsoft_Hv
mov qword [rbp + 0x48], rcx
lea rcx, str.VMwareVMware
mov qword [rbp + 0x50], rcx
lea rcx, str.XenVMMXenVMM
mov qword [rbp + 0x58], rcx
lea rcx, str.prl_hyperv
mov qword [rbp + 0x60], rcx
lea rcx, str.VBoxVBoxVBox
mov qword [rbp + 0x68], rcx
xor ecx, ecx
cpuid
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x68], ecx
movsd xmm0, qword [rsp + 0x64]
movsd qword [rbp + 0x11a0], xmm0
mov qword [rbp + 0x11bc], r15
mov qword [rbp + 0x11c4], r15
mov qword [rbp + 0x11cc], r15
mov qword [rbp + 0x11d4], r15
mov dword [rbp + 0x11dc], r15d
mov dword [rbp + 0x11a8], edx
nop dword [rax]
nop dword [rax + rax]
xor eax, eax
lea r8, [rbp + 0x11a0]
mov dword [rsp + 0x28], eax
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r9d, [rax - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
lea ecx, [rax + 1]
movsxd rbx, ecx
add rbx, rbx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x1400047c4
mov rdi, rax
mov dword [rsp + 0x28], esi
xor eax, eax
mov qword [rsp + 0x20], r14
mov rcx, rbx
lea r8, [rbp + 0x11a0]
rep stosb byte [rdi], al
lea r9d, [rax - 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, qword [rbp + r15*8 + 0x40]
mov rax, r14
sub rdx, r14
nop
movzx ebx, word [rax]
movzx ecx, word [rax + rdx]
sub ebx, ecx
jne 0x1400047b3
add rax, 2
test ecx, ecx
jne 0x1400047a0
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test ebx, ebx
je 0x140004bf9
inc r15
cmp r15, 6
jl 0x140004730
xor esi, esi
mov ecx, esi
lea rdx, str.Checking_hypervisor_vendor_using_cpuid_0x40000000_
call fcn.140012a30
lea rdx, str.Check_if_time_has_been_accelerated
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x3c
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004800
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0xea60
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
lea rdx, str.Check_if_time_has_been_accelerated
sub eax, ebx
cmp eax, 0xe678
setbe cl
call fcn.140012a30
lea rdx, str.VM_Driver_Services
lea rcx, str.____s
call fcn.140008c80
mov r12d, 0x4b
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub r12, 1
jne 0x140004860
call fcn.14000fc20
lea rdx, str.VM_Driver_Services
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_SerialNumber_from_BIOS_using_WMI
lea rcx, str.____s
call fcn.140008c80
mov r12, qword [rbp + 0x628]
nop
lea rcx, [0x140020ec8]
call fcn.140008c80
sub r12, 1
jne 0x1400048a0
call fcn.14000ef20
lea rdx, str.Checking_SerialNumber_from_BIOS_using_WMI
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_Model_from_ComputerSystem_using_WMI
lea rcx, str.____s
call fcn.140008c80
lea ebx, [r12 + 0x32]
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400048e0
call fcn.14000f190
lea rdx, str.Checking_Model_from_ComputerSystem_using_WMI
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_Manufacturer_from_ComputerSystem_using_WMI
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x2b
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004920
call fcn.14000f3e0
lea rdx, str.Checking_Manufacturer_from_ComputerSystem_using_WMI
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_Current_Temperature_using_WMI
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x38
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004960
call fcn.14000f640
lea rdx, str.Checking_Current_Temperature_using_WMI
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_ProcessId_using_WMI
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x42
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400049a0
call fcn.14000f840
lea rdx, str.Checking_ProcessId_using_WMI
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_power_capabilities
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x43
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400049e0
lea rcx, [rbp + 0x890]
mov ebx, esi
call qword [sym.imp.POWRPROF.dll_GetPwrCapabilities]
cmp al, 1
jne 0x140004a29
movzx eax, byte [rbp + 0x896]
or al, byte [rbp + 0x895]
or al, byte [rbp + 0x894]
or al, byte [rbp + 0x893]
jne 0x140004a29
cmp byte [rbp + 0x89d], al
sete bl
lea rdx, str.Checking_power_capabilities
mov ecx, ebx
call fcn.140012a30
lea rdx, str.Checking_CPU_fan_using_WMI
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x44
nop
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004a50
lea r8, [0x14001d8e0]
mov qword [rbp + 0x5f0], rsi
lea rdx, [rbp + 0x598]
mov qword [rbp + 0x598], rsi
lea rcx, [rbp + 0x5f0]
mov qword [rbp + 0x5f8], rsi
mov r12d, esi
mov edi, esi
call fcn.140015270
test eax, eax
je 0x140004be6
lea rcx, [0x140021b60]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_Fan
mov r14, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea r15d, [rbx + 1]
mov rsi, rax
test r14, r14
je 0x140004b3a
test rax, rax
je 0x140004b31
mov rcx, qword [rbp + 0x5f0]
lea rax, [rbp + 0x5f8]
mov qword [rsp + 0x28], rax
lea r9d, [r15 + 0x2f]
xor eax, eax
mov r8, rsi
mov qword [rsp + 0x20], rax
mov rdx, qword [rcx]
mov rbx, qword [rdx + 0xa0]
mov rdx, r14
call rbx
test eax, eax
jns 0x140004b31
xor eax, eax
lea rcx, str.ExecQuery
mov r15d, eax
call fcn.140012b60
mov rcx, qword [rbp + 0x5f0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x598]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rsi, rsi
je 0x140004b48
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
test r15d, r15d
je 0x140004be6
mov rcx, qword [rbp + 0x5f8]
mov qword [rbp + 0x5a8], rsi
mov dword [rbp + 0x5e8], esi
test rcx, rcx
je 0x140004bb5
nop dword [rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x5e8]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x5a8]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
cmp dword [rbp + 0x5e8], esi
je 0x140004bb5
mov rcx, qword [rbp + 0x5a8]
inc edi
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x5f8]
test rcx, rcx
jne 0x140004b70
mov rcx, qword [rbp + 0x5f0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x598]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x5f8]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
test edi, edi
jne 0x140004c05
mov r15d, 1
mov r12d, r15d
jmp 0x140004c0b
mov ecx, r15d
jmp 0x14000451d
mov ecx, 1
xor esi, esi
jmp 0x1400047d5
mov r15d, 1
lea rdx, str.Checking_CPU_fan_using_WMI
mov ecx, r12d
call fcn.140012a30
lea rdx, str.Checking_NtQueryLicenseValue_with_Kernel_VMDetection_Private
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x22
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004c32
lea rdx, [0x14003f180]
mov eax, esi
mov rcx, rdx
cmp dword [rcx], 0x1b
je 0x140004ce5
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140004c50
mov rdi, rsi
mov eax, esi
mov rcx, rdx
nop dword [rax]
cmp dword [rcx], 0x11
je 0x140004d03
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140004c70
mov rbx, rsi
test rdi, rdi
je 0x140004d21
test rbx, rbx
je 0x140004d21
lea rdx, str.Kernel_VMDetection_Private
lea rcx, [rbp + 0x650]
call rdi
lea rax, [rbp + 0x590]
mov dword [rbp + 0x5e0], esi
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x5e0]
xor edx, edx
lea rcx, [rbp + 0x650]
call rbx
mov ecx, esi
test eax, eax
js 0x140004d23
cmp dword [rbp + 0x5e0], 0
setne cl
jmp 0x140004d23
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
je 0x140004c64
mov rdi, qword [rdx + rcx*8 + 0x28]
jmp 0x140004c67
cdqe
lea rbx, [rax + rax*2]
add rbx, rbx
cmp byte [rdx + rbx*8 + 0x24], 0
je 0x140004c84
mov rbx, qword [rdx + rbx*8 + 0x28]
jmp 0x140004c87
mov ecx, esi
lea rdx, str.Checking_NtQueryLicenseValue_with_Kernel_VMDetection_Private
call fcn.140012a30
lea rdx, str.Checking_Win32_CacheMemory_with_WMI
lea rcx, str.____s
call fcn.140008c80
mov r14d, 0x3b
mov ebx, r14d
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004d50
lea rcx, str.SELECT__FROM_Win32_CacheMemory
call fcn.14000fa50
test eax, eax
lea rdx, str.Checking_Win32_CacheMemory_with_WMI
mov ecx, esi
sete cl
call fcn.140012a30
lea rdx, str.Checking_Win32_PhysicalMemory_with_WMI
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x38
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004da0
lea rcx, str.SELECT__FROM_Win32_PhysicalMemory
call fcn.14000fa50
test eax, eax
lea rdx, str.Checking_Win32_PhysicalMemory_with_WMI
mov ecx, esi
sete cl
call fcn.140012a30
lea rdx, str.Checking_Win32_MemoryDevice_with_WMI
lea rcx, str.____s
call fcn.140008c80
mov edi, 0x3a
mov ebx, edi
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004df0
lea rcx, str.SELECT__FROM_Win32_MemoryDevice
call fcn.14000fa50
test eax, eax
lea rdx, str.Checking_Win32_MemoryDevice_with_WMI
mov ecx, esi
sete cl
call fcn.140012a30
lea rdx, str.Checking_Win32_MemoryArray_with_WMI
lea rcx, str.____s
call fcn.140008c80
mov rbx, r14
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004e40
lea rcx, str.SELECT__FROM_Win32_MemoryArray
call fcn.14000fa50
test eax, eax
lea rdx, str.Checking_Win32_MemoryArray_with_WMI
mov ecx, esi
sete cl
call fcn.140012a30
lea rdx, str.Checking_Win32_VoltageProbe_with_WMI
lea rcx, str.____s
call fcn.140008c80
mov rbx, rdi
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004e90
lea rcx, str.SELECT__FROM_Win32_VoltageProbe
call fcn.14000fa50
test eax, eax
lea rdx, str.Checking_Win32_VoltageProbe_with_WMI
mov ecx, esi
sete cl
call fcn.140012a30
lea rdx, str.Checking_Win32_PortConnector_with_WMI
lea rcx, str.____s
call fcn.140008c80
lea rcx, [0x140020ec8]
call fcn.140008c80
sub qword [rsp + 0x78], 1
jne 0x140004ed4
lea rcx, str.SELECT__FROM_Win32_PortConnector
call fcn.14000fa50
test eax, eax
lea rdx, str.Checking_Win32_PortConnector_with_WMI
mov ecx, esi
sete cl
call fcn.140012a30
lea rdx, str.Checking_Win32_SMBIOSMemory_with_WMI
lea rcx, str.____s
call fcn.140008c80
mov rbx, rdi
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004f20
lea rcx, str.SELECT__FROM_Win32_SMBIOSMemory
call fcn.14000fa50
test eax, eax
lea rdx, str.Checking_Win32_SMBIOSMemory_with_WMI
mov ecx, esi
sete cl
call fcn.140012a30
lea rdx, str.Checking_ThermalZoneInfo_performance_counters_with_WMI
lea rcx, str.____s
call fcn.140008c80
mov edi, 0x28
mov ebx, edi
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004f70
lea rcx, str.SELECT__FROM_Win32_PerfFormattedData_Counters_ThermalZoneInformation
call fcn.14000fa50
test eax, eax
lea rdx, str.Checking_ThermalZoneInfo_performance_counters_with_WMI
mov ecx, esi
sete cl
call fcn.140012a30
lea rdx, str.Checking_CIM_Memory_with_WMI
lea rcx, str.____s
call fcn.140008c80
mov esi, 0x42
mov ebx, esi
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140004fc0
lea rcx, str.SELECT__FROM_CIM_Memory
call fcn.14000fa50
xor r12d, r12d
lea rdx, str.Checking_CIM_Memory_with_WMI
test eax, eax
mov ecx, r12d
sete cl
call fcn.140012a30
lea rdx, str.Checking_CIM_Sensor_with_WMI
lea rcx, str.____s
call fcn.140008c80
mov rbx, rsi
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140005010
lea rcx, str.SELECT__FROM_CIM_Sensor
call fcn.14000fa50
test eax, eax
lea rdx, str.Checking_CIM_Sensor_with_WMI
mov ecx, r12d
sete cl
call fcn.140012a30
lea rdx, str.Checking_CIM_NumericSensor_with_WMI
lea rcx, str.____s
call fcn.140008c80
mov rbx, r14
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140005060
lea rcx, str.SELECT__FROM_CIM_NumericSensor
call fcn.14000fa50
test eax, eax
lea rdx, str.Checking_CIM_NumericSensor_with_WMI
mov ecx, r12d
sete cl
call fcn.140012a30
lea rdx, str.Checking_CIM_TemperatureSensor_with_WMI
lea rcx, str.____s
call fcn.140008c80
mov esi, 0x37
mov ebx, esi
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400050b0
lea rcx, str.SELECT__FROM_CIM_TemperatureSensor
call fcn.14000fa50
test eax, eax
lea rdx, str.Checking_CIM_TemperatureSensor_with_WMI
mov ecx, r12d
sete cl
call fcn.140012a30
lea rdx, str.Checking_CIM_VoltageSensor_with_WMI
lea rcx, str.____s
call fcn.140008c80
mov rbx, r14
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140005100
lea rcx, str.SELECT__FROM_CIM_VoltageSensor
call fcn.14000fa50
test eax, eax
lea rdx, str.Checking_CIM_VoltageSensor_with_WMI
mov ecx, r12d
sete cl
call fcn.140012a30
lea rdx, str.Checking_CIM_PhysicalConnector_with_WMI
lea rcx, str.____s
call fcn.140008c80
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rsi, 1
jne 0x140005150
lea rcx, str.SELECT__FROM_CIM_PhysicalConnector
call fcn.14000fa50
test eax, eax
lea rdx, str.Checking_CIM_PhysicalConnector_with_WMI
mov ecx, r12d
sete cl
call fcn.140012a30
lea rdx, str.Checking_CIM_Slot_with_WMI
lea rcx, str.____s
call fcn.140008c80
lea ebx, [rsi + 0x44]
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400051a0
lea rcx, str.SELECT__FROM_CIM_Slot
call fcn.14000fa50
test eax, eax
lea rdx, str.Checking_CIM_Slot_with_WMI
mov ecx, r12d
sete cl
call fcn.140012a30
lea rdx, str.Checking_if_Windows_is_Genuine
lea rcx, str.____s
call fcn.140008c80
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub r13, 1
jne 0x1400051f0
xor r8d, r8d
mov dword [rbp + 0x610], 0x55c92734
lea rdx, [rbp + 0x604]
mov dword [rbp + 0x614], 0x4d71d682
lea rcx, [rbp + 0x610]
mov dword [rbp + 0x618], 0xecd63e98
mov dword [rbp + 0x61c], 0x9f05163f
call qword [sym.imp.SLWGA.dll_SLIsGenuineLocal]
test eax, eax
jne 0x140005251
mov ecx, r15d
cmp dword [rbp + 0x604], r12d
jne 0x140005254
mov ecx, r12d
lea rdx, str.Checking_if_Windows_is_Genuine
call fcn.140012a30
lea rdx, str.Checking_ServicesDiskEnum_entries_for_VM_strings
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x2c
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140005280
lea rax, [0x14001e268]
mov qword [rbp + 0x590], r12
mov qword [rbp + 0x100], rax
lea r13, str.virtio
lea rax, [0x14001e270]
mov dword [rbp + 0x580], r12d
mov qword [rbp + 0x108], rax
lea r12, str.qemu
lea rax, str.Virtual
mov dword [rbp + 0x604], 4
mov qword [rbp + 0x110], rax
lea rbx, str.vmware
xor eax, eax
mov qword [rbp + 0xe0], r12
mov r14d, eax
mov qword [rbp + 0xe8], r13
lea rax, [rbp + 0x590]
mov qword [rbp + 0xf0], rbx
lea rsi, str.vbox
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov qword [rbp + 0xf8], rsi
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetServicesDiskEnum
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000538e
mov rcx, qword [rbp + 0x590]
lea rax, [rbp + 0x604]
mov qword [rsp + 0x28], rax
lea rdx, str.Count
lea rax, [rbp + 0x580]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x590]
test eax, eax
je 0x140005388
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x14000540d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esi, eax
cmp dword [rbp + 0x580], eax
jbe 0x140005406
nop word [rax + rax]
mov r9d, esi
lea r8, [0x14001e284]
mov edx, 0xb
lea rcx, [rbp + 0x5c8]
call fcn.1400090a0
xor eax, eax
lea rbx, [rbp + 0xe0]
mov edi, eax
mov r9, qword [rbx]
lea r8, [rbp + 0x5c8]
lea rdx, str.SystemCurrentControlSetServicesDiskEnum
call fcn.140013140
test eax, eax
jne 0x1400053f7
inc edi
add rbx, 8
cmp edi, 7
jb 0x1400053c6
inc esi
cmp esi, dword [rbp + 0x580]
jb 0x1400053a0
jmp 0x1400053fa
mov r14d, r15d
lea rbx, str.vmware
mov edi, 0x28
lea rsi, str.vbox
lea rdx, str.Checking_ServicesDiskEnum_entries_for_VM_strings
mov ecx, r14d
call fcn.140012a30
lea rdx, str.Checking_EnumIDE_and_EnumSCSI_entries_for_VM_strings
lea rcx, str.____s
call fcn.140008c80
nop
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rdi, 1
jne 0x140005430
lea rax, str.SystemCurrentControlSetEnumIDE
mov qword [rbp + 0x70], r12
mov qword [rbp - 0x48], rax
lea r12, [rbp - 0x48]
lea rax, str.SystemCurrentControlSetEnumSCSI
mov qword [rbp + 0x78], r13
mov qword [rbp - 0x40], rax
mov r13d, edi
lea rax, [0x14001e268]
mov qword [rbp + 0x590], rdi
mov qword [rbp + 0x90], rax
lea rax, [0x14001e270]
mov qword [rbp + 0x98], rax
lea rax, str.Virtual
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], rsi
nop word [rax + rax]
mov rdx, qword [r12]
lea rax, [rbp + 0x590]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x580], edi
mov rcx, 0xffffffff80000002
mov dword [rbp + 0x5e0], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400055f0
mov rcx, qword [rbp + 0x590]
lea rax, [rbp + 0x5e0]
mov qword [rsp + 0x58], rdi
xor r9d, r9d
mov qword [rsp + 0x50], rdi
xor r8d, r8d
mov qword [rsp + 0x48], rdi
xor edx, edx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x580]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1400055e3
mov eax, dword [rbp + 0x5e0]
lea r15d, [rax*2 + 2]
mov ecx, r15d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1400055e3
cmp dword [rbp + 0x580], 0
mov r14d, edi
jbe 0x1400055da
nop dword [rax]
mov rcx, qword [rbp + 0x590]
lea r9, [rbp + 0x608]
mov qword [rsp + 0x38], rdi
mov r8, rsi
mov qword [rsp + 0x30], rdi
mov edx, r14d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov dword [rbp + 0x608], r15d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400055ce
lea rbx, [rbp + 0x70]
nop dword [rax]
mov rdx, qword [rbx]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140005605
inc edi
add rbx, 8
cmp edi, 7
jb 0x1400055b0
xor edi, edi
inc r14d
cmp r14d, dword [rbp + 0x580]
jb 0x140005570
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp + 0x590]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r13d
add r12, 8
mov ebx, edi
cmp r13d, 2
jb 0x1400054b0
jmp 0x140005620
mov rcx, rsi
mov ebx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp + 0x590]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Checking_EnumIDE_and_EnumSCSI_entries_for_VM_strings
mov ecx, ebx
call fcn.140012a30
cmp dword [0x140040034], 0
lea r12, [0x14001ea10]
lea r14, str.Identifier
lea r13, str.HARDWAREDescriptionSystem
je 0x1400061f1
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x6e0]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x6e0]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x6e8]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.VirtualBox_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008c80
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.VBOX
mov qword [rbp + 0x248], r14
mov qword [rbp + 0x250], rax
lea rcx, str.SystemBiosVersion
mov qword [rbp + 0x268], rax
lea rsi, [rbp + 0x248]
lea rax, str.VideoBiosVersion
mov qword [rbp + 0x240], r12
mov qword [rbp + 0x278], rax
mov r14d, 4
lea rax, str.VIRTUALBOX
mov qword [rbp + 0x258], r13
mov qword [rbp + 0x280], rax
lea rax, str.SystemBiosDate
mov qword [rbp + 0x290], rax
lea rax, str.06_23_99
mov qword [rbp + 0x298], rax
lea r15d, [r14 - 3]
mov qword [rbp + 0x260], rcx
mov qword [rbp + 0x270], r13
mov qword [rbp + 0x288], r13
xor edx, edx
lea rcx, [rbp + 0x39f0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov rbx, qword [rsi + 8]
lea r8, str.Checking_reg_key_HARDWAREDescriptionSystem____s_is_set_to__s
mov r9, qword [rsi]
lea rcx, [rbp + 0x39f0]
mov edx, 0x100
mov qword [rsp + 0x20], rbx
call fcn.1400090a0
mov r8, qword [rsi]
mov r9, rbx
mov rdx, qword [rsi - 8]
call fcn.140013140
lea rdx, [rbp + 0x39f0]
lea rcx, str.____s
test eax, eax
je 0x1400057da
call fcn.140008c80
lea rcx, [rbp + 0x39f0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400057b0
mov ebx, 0x5f
sub rbx, rax
je 0x1400057d5
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, r15
jne 0x1400057c4
mov ecx, r15d
jmp 0x140005817
call fcn.140008c80
lea rcx, [rbp + 0x39f0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400057f0
mov ebx, 0x5f
sub rbx, rax
je 0x140005815
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, r15
jne 0x140005804
xor ecx, ecx
lea rdx, [rbp + 0x39f0]
call fcn.140012a30
add rsi, 0x18
sub r14, r15
jne 0x140005741
lea rdx, str.Checking_VirtualBox_Guest_Additions_directory
lea rcx, str.____s
call fcn.140008c80
lea rcx, [0x140020ec8]
call fcn.140008c80
sub qword [rbp + 0x5b0], 1
jne 0x140005843
xor edx, edx
lea rcx, [rbp + 0x4c40]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [str.oracle_virtualbox_guest_additions_]
lea rcx, [rbp + 0x3826]
movaps xmm1, xmmword [0x14001f540]
xor edx, edx
mov eax, dword [0x14001f570]
mov r8d, 0x1c2
movaps xmmword [rbp + 0x37e0], xmm0
movaps xmm0, xmmword [0x14001f550]
movaps xmmword [rbp + 0x37f0], xmm1
movaps xmm1, xmmword [0x14001f560]
mov dword [rbp + 0x3820], eax
movzx eax, word [0x14001f574]
movaps xmmword [rbp + 0x3800], xmm0
movaps xmmword [rbp + 0x3810], xmm1
mov word [rbp + 0x3824], ax
call sub.VCRUNTIME140.dll_memset
call fcn.140013080
lea rdx, [rbp + 0x4a30]
test eax, eax
je 0x1400058f8
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140005907
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x37e0]
lea rdx, [rbp + 0x4a30]
lea rcx, [rbp + 0x4c40]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x4c40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140005946
test al, 0x10
je 0x140005946
mov r13d, 1
xor r14d, r14d
mov ecx, r13d
jmp 0x140005950
xor r14d, r14d
mov ecx, r14d
lea r13d, [r14 + 1]
lea rdx, str.Checking_VirtualBox_Guest_Additions_directory
call fcn.140012a30
call fcn.14000fec0
lea rax, str.HARDWAREACPIDSDTVBOX__
mov esi, 9
mov qword [rbp + 0x1a0], rax
lea rdi, [rbp + 0x1a0]
lea rax, str.HARDWAREACPIFADTVBOX__
mov qword [rbp + 0x1a8], rax
lea rax, str.HARDWAREACPIRSDTVBOX__
mov qword [rbp + 0x1b0], rax
lea rax, str.SOFTWAREOracleVirtualBox_Guest_Additions
mov qword [rbp + 0x1b8], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxGuest
mov qword [rbp + 0x1c0], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxMouse
mov qword [rbp + 0x1c8], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxService
mov qword [rbp + 0x1d0], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxSF
mov qword [rbp + 0x1d8], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxVideo
mov qword [rbp + 0x1e0], rax
nop dword [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x11e0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, [0x14001e690]
mov edx, 0x100
lea rcx, [rbp + 0x11e0]
call fcn.1400090a0
mov rdx, qword [rdi]
lea rax, [rbp + 0x5b0]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp + 0x5b0], r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005aab
mov rcx, qword [rbp + 0x5b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x11e0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x11e0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005a80
mov ebx, 0x5f
sub rbx, rax
je 0x140005aa6
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140005a94
mov ecx, r13d
jmp 0x140005af8
lea rdx, [rbp + 0x11e0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x11e0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005ad0
mov ebx, 0x5f
sub rbx, rax
je 0x140005af6
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140005ae4
xor ecx, ecx
lea rdx, [rbp + 0x11e0]
call fcn.140012a30
add rdi, 8
sub rsi, 1
jne 0x1400059f0
lea rdx, str.Checking_Mac_Address_start_with_08:00:27
lea rcx, str.____s
call fcn.140008c80
lea ebx, [rsi + 0x36]
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140005b30
lea rcx, [0x14001f578]
call fcn.140013230
lea rdx, str.Checking_Mac_Address_start_with_08:00:27
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_MAC_address__Hybrid_Analysis_
lea rcx, str.____s
call fcn.140008c80
lea r15d, [rbx + 0x38]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub r15, 1
jne 0x140005b73
lea rcx, [0x14001d8d8]
call fcn.140013230
lea rdx, str.Checking_MAC_address__Hybrid_Analysis_
mov ecx, eax
call fcn.140012a30
lea rax, [0x14001f580]
mov r12d, 5
mov qword [rbp + 0x18], rax
lea rsi, [rbp + 0x18]
lea rax, str..VBoxGuest
mov r14d, r12d
mov qword [rbp + 0x20], rax
lea rax, str..pipeVBoxMiniRdDN
mov qword [rbp + 0x28], rax
lea rax, str..VBoxTrayIPC
mov qword [rbp + 0x30], rax
lea rax, str..pipeVBoxTrayIPC
mov qword [rbp + 0x38], rax
mov rcx, qword [rsi]
xor eax, eax
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov r8d, r13d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
lea rcx, [rbp + 0x13e0]
mov r8d, 0x200
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rsi]
lea r8, str.Checking_device__s
mov edx, 0x100
lea rcx, [rbp + 0x13e0]
call fcn.1400090a0
cmp rdi, 0xffffffffffffffff
je 0x140005c9b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x13e0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x13e0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005c70
mov ebx, 0x5f
sub rbx, rax
je 0x140005c96
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140005c84
mov ecx, r13d
jmp 0x140005ce8
lea rdx, [rbp + 0x13e0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x13e0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005cc0
mov ebx, 0x5f
sub rbx, rax
je 0x140005ce6
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140005cd4
xor ecx, ecx
lea rdx, [rbp + 0x13e0]
call fcn.140012a30
add rsi, 8
sub r14, 1
jne 0x140005be3
lea rdx, str.Checking_VBoxTrayToolWndClass___VBoxTrayToolWnd
lea rcx, str.____s
call fcn.140008c80
lea ebx, [r14 + 0x2f]
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140005d20
xor edx, edx
lea rcx, str.VBoxTrayToolWndClass
call qword [sym.imp.USER32.dll_FindWindowW]
lea rdx, str.VBoxTrayToolWnd
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowW]
test rbx, rbx
jne 0x140005d65
test rax, rax
jne 0x140005d65
xor r14d, r14d
mov ecx, r14d
jmp 0x140005d6b
mov ecx, r13d
xor r14d, r14d
lea rdx, str.Checking_VBoxTrayToolWndClass___VBoxTrayToolWnd
call fcn.140012a30
lea rdx, str.Checking_VirtualBox_Shared_Folders_network_provider
lea rcx, str.____s
call fcn.140008c80
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub qword [rbp + 0x620], 1
jne 0x140005d90
xor edx, edx
lea rcx, [rbp + 0x4e50]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x608]
mov dword [rbp + 0x608], 0x104
lea rdx, [rbp + 0x4e50]
mov ecx, 0x250000
call qword [sym.imp.MPR.dll_WNetGetProviderNameW]
test eax, eax
jne 0x140005dff
lea rdx, str.VirtualBox_Shared_Folders
lea rcx, [rbp + 0x4e50]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
mov ecx, r14d
sete cl
jmp 0x140005e02
mov ecx, r14d
lea rdx, str.Checking_VirtualBox_Shared_Folders_network_provider
call fcn.140012a30
lea rax, str.vboxservice.exe
mov esi, 2
mov qword [rbp + 8], rax
lea rdi, [rbp + 8]
lea rax, str.vboxtray.exe
mov qword [rbp + 0x10], rax
nop dword [rax]
xor edx, edx
lea rcx, [rbp + 0x15e0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_VirtualBox_process__s
mov edx, 0x100
lea rcx, [rbp + 0x15e0]
call fcn.1400090a0
mov rcx, qword [rdi]
call fcn.140015160
lea rdx, [rbp + 0x15e0]
lea rcx, str.____s
test eax, eax
je 0x140005ebb
call fcn.140008c80
lea rcx, [rbp + 0x15e0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005e90
mov ebx, 0x5f
sub rbx, rax
je 0x140005eb6
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140005ea4
mov ecx, r13d
jmp 0x140005ef8
call fcn.140008c80
lea rcx, [rbp + 0x15e0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005ed0
mov ebx, 0x5f
sub rbx, rax
je 0x140005ef6
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140005ee4
xor ecx, ecx
lea rdx, [rbp + 0x15e0]
call fcn.140012a30
add rdi, 8
sub rsi, 1
jne 0x140005e30
lea rdx, str.Checking_Win32_PnPDevice_DeviceId_from_WMI_for_VBox_PCI_device
lea rcx, str.____s
call fcn.140008c80
lea r15d, [rsi + 0x20]
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub r15, 1
jne 0x140005f30
call fcn.140010840
lea rdx, str.Checking_Win32_PnPDevice_DeviceId_from_WMI_for_VBox_PCI_device
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBox_controller_hardware
lea rcx, str.____s
call fcn.140008c80
lea ebx, [r15 + 0x1b]
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140005f70
call fcn.140010a70
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBox_controller_hardware
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBOX_names
lea rcx, str.____s
call fcn.140008c80
lea r15d, [rbx + 0x29]
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub r15, 1
jne 0x140005fb0
call fcn.1400111d0
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBOX_names
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_Win32_Bus_from_WMI
lea rcx, str.____s
call fcn.140008c80
mov r15d, 0x49
nop
lea rcx, [0x140020ec8]
call fcn.140008c80
sub qword [rbp + 0x588], 1
jne 0x140005ff0
call fcn.140010cd0
lea rdx, str.Checking_Win32_Bus_from_WMI
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_Win32_BaseBoard_from_WMI
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x3d
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140006031
call fcn.140010f30
lea rdx, str.Checking_Win32_BaseBoard_from_WMI
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_MAC_address_from_WMI
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x41
nop
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140006070
call fcn.140010160
lea rdx, str.Checking_MAC_address_from_WMI
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_NTEventLog_from_WMI
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x42
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400060b0
call fcn.140010390
lea rdx, str.Checking_NTEventLog_from_WMI
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, str.____s
call fcn.140008c80
mov ebx, 0x45
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400060f0
lea r8, [rbp + 0x5e0]
mov dword [rbp + 0x5e0], r14d
xor edx, edx
mov ecx, 0x52534d42
mov edi, r14d
call fcn.140015540
mov rdx, rax
test rax, rax
je 0x14000619f
mov ebx, dword [rbp + 0x5e0]
mov rcx, r14
lea rax, [rbx - 0xa]
test rax, rax
je 0x14000615a
movabs r8, 0x426c617574726956
cmp qword [rcx + rdx], r8
jne 0x140006152
cmp word [rcx + rdx + 8], 0x786f
je 0x140006193
inc rcx
cmp rcx, rax
jb 0x140006143
lea rcx, [rbx - 4]
mov rax, r14
test rcx, rcx
je 0x140006196
cmp dword [rax + rdx], 0x786f6276
je 0x140006193
inc rax
cmp rax, rcx
jb 0x140006166
mov rax, r14
nop word [rax + rax]
cmp dword [rax + rdx], 0x584f4256
je 0x140006193
inc rax
cmp rax, rcx
jb 0x140006180
jmp 0x140006196
mov edi, r13d
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_SMBIOS_firmware
mov ecx, edi
call fcn.140012a30
lea rdx, str.Checking_ACPI_tables
lea rcx, str.____s
call fcn.140008c80
mov rbx, r15
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400061c3
call fcn.1400106d0
lea rdx, str.Checking_ACPI_tables
mov ecx, eax
call fcn.140012a30
lea r14, str.Identifier
jmp 0x1400061fc
mov r12d, 5
lea r13d, [r12 - 4]
cmp dword [0x140040030], 0
je 0x140006e20
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x6f8]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x6f8]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x700]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.VMWare_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008c80
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.VMWARE
mov qword [rbp + 0x378], r14
lea rax, [0x14001ea10]
mov qword [rbp + 0x380], rdx
mov qword [rbp + 0x370], rax
lea rcx, str.SYSTEMControlSet001ControlSystemInformation
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_1Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp + 0x390], r14
mov qword [rbp + 0x388], rax
lea rdi, [rbp + 0x380]
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_2Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp + 0x398], rdx
mov qword [rbp + 0x3a0], rax
lea rax, str.SystemManufacturer
mov qword [rbp + 0x3c0], rax
lea rax, str.SystemProductName
mov qword [rbp + 0x3d8], rax
mov qword [rbp + 0x3a8], r14
mov qword [rbp + 0x3b0], rdx
mov qword [rbp + 0x3b8], rcx
mov qword [rbp + 0x3c8], rdx
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3e0], rdx
nop dword [rax]
xor edx, edx
lea rcx, [rbp + 0x17e0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi - 0x10]
lea r8, str.Checking_reg_key__s
mov edx, 0x100
lea rcx, [rbp + 0x17e0]
call fcn.1400090a0
mov r9, qword [rdi]
mov r8, qword [rdi - 8]
mov rdx, qword [rdi - 0x10]
call fcn.140013140
lea rdx, [rbp + 0x17e0]
lea rcx, str.____s
test eax, eax
je 0x1400063a7
call fcn.140008c80
lea rcx, [rbp + 0x17e0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006375
mov ebx, 0x5f
sub rbx, rax
je 0x1400063a2
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140006390
mov ecx, r13d
jmp 0x1400063e8
call fcn.140008c80
lea rcx, [rbp + 0x17e0]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400063c0
mov ebx, 0x5f
sub rbx, rax
je 0x1400063e6
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400063d4
xor ecx, ecx
lea rdx, [rbp + 0x17e0]
call fcn.140012a30
add rdi, 0x18
sub r12, 1
jne 0x140006310
xor edx, edx
lea rcx, [rbp + 0x19e0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREVMware__Inc.VMware_Tools
mov edx, 0x100
lea r8, [0x14001e690]
lea rcx, [rbp + 0x19e0]
call fcn.1400090a0
lea rax, [rbp + 0x588]
xor edi, edi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp + 0x588], rdi
lea rdx, str.SOFTWAREVMware__Inc.VMware_Tools
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400064ca
mov rcx, qword [rbp + 0x588]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x19e0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x19e0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], di
jne 0x1400064a0
mov ebx, 0x5f
sub rbx, rax
je 0x1400064c5
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400064b3
mov ecx, r13d
jmp 0x140006517
lea rdx, [rbp + 0x19e0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x19e0]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], di
jne 0x1400064f0
mov ebx, 0x5f
sub rbx, rax
je 0x140006515
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140006503
xor ecx, ecx
lea rdx, [rbp + 0x19e0]
call fcn.140012a30
lea rax, str.System32drivers_vmnet.sys
xor edx, edx
mov qword [rbp + 0x300], rax
lea rcx, [rbp + 0x5060]
lea rax, str.System32drivers_vmmouse.sys
mov r8d, 0x208
mov qword [rbp + 0x308], rax
lea rax, str.System32drivers_vmusb.sys
mov qword [rbp + 0x310], rax
lea rax, str.System32drivers_vm3dmp.sys
mov qword [rbp + 0x318], rax
lea rax, str.System32drivers_vmci.sys
mov qword [rbp + 0x320], rax
lea rax, str.System32drivers_vmhgfs.sys
mov qword [rbp + 0x328], rax
lea rax, str.System32drivers_vmmemctl.sys
mov qword [rbp + 0x330], rax
lea rax, str.System32drivers_vmx86.sys
mov qword [rbp + 0x338], rax
lea rax, str.System32drivers_vmrawdsk.sys
mov qword [rbp + 0x340], rax
lea rax, str.System32drivers_vmusbmouse.sys
mov qword [rbp + 0x348], rax
lea rax, str.System32drivers_vmkdb.sys
mov qword [rbp + 0x350], rax
lea rax, str.System32drivers_vmnetuserif.sys
mov qword [rbp + 0x358], rax
lea rax, str.System32drivers_vmnetadapter.sys
mov qword [rbp + 0x360], rax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x4200]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov edx, 0x104
mov qword [rbp + 0x588], rdi
lea rcx, [rbp + 0x5060]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call fcn.140013080
test eax, eax
je 0x140006630
lea rcx, [rbp + 0x588]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov r8, qword [rbp + rdi*8 + 0x300]
lea rdx, [rbp + 0x5060]
lea rcx, [rbp + 0x4200]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edx, edx
lea rcx, [rbp + 0x1be0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x4200]
mov edx, 0x100
lea r8, str.Checking_file__s
lea rcx, [rbp + 0x1be0]
call fcn.1400090a0
lea rcx, [rbp + 0x4200]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400066e7
test al, 0x10
jne 0x1400066e7
lea rdx, [rbp + 0x1be0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x1be0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400066b6
mov ebx, 0x5f
sub rbx, rax
je 0x1400066e2
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400066d0
mov ecx, r13d
jmp 0x140006738
lea rdx, [rbp + 0x1be0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x1be0]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006710
mov ebx, 0x5f
sub rbx, rax
je 0x140006736
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140006724
xor ecx, ecx
lea rdx, [rbp + 0x1be0]
call fcn.140012a30
inc rdi
cmp rdi, 0xd
jl 0x140006630
call fcn.140013080
test eax, eax
je 0x140006767
lea rcx, [rbp + 0x588]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
lea rax, [0x1400201a8]
mov esi, 4
mov qword [rbp + 0x160], rax
lea rdi, [rbp + 0x160]
lea rax, [0x1400201b0]
mov qword [rbp + 0x168], rax
lea rax, [0x1400201c8]
mov qword [rbp + 0x170], rax
lea rax, [0x1400201d0]
mov qword [rbp + 0x178], rax
lea rax, [0x1400201e8]
mov qword [rbp + 0x180], rax
lea rax, str.00:1C:14
mov qword [rbp + 0x188], rax
lea rax, [0x140020208]
mov qword [rbp + 0x190], rax
lea rax, [0x140020210]
mov qword [rbp + 0x198], rax
nop dword [rax]
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x1de0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi + 8]
lea r8, str.Checking_MAC_starting_with__s
mov edx, 0x100
lea rcx, [rbp + 0x1de0]
call fcn.1400090a0
mov rcx, qword [rdi]
call fcn.140013230
lea rdx, [rbp + 0x1de0]
lea rcx, str.____s
test eax, eax
je 0x14000687b
call fcn.140008c80
lea rcx, [rbp + 0x1de0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006850
mov ebx, 0x5f
sub rbx, rax
je 0x140006876
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140006864
mov ecx, r13d
jmp 0x1400068b8
call fcn.140008c80
lea rcx, [rbp + 0x1de0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006890
mov ebx, 0x5f
sub rbx, rax
je 0x1400068b6
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400068a4
xor ecx, ecx
lea rdx, [rbp + 0x1de0]
call fcn.140012a30
add rdi, 0x10
sub rsi, 1
jne 0x1400067f0
lea rdx, str.Checking_VMWare_network_adapter_name
lea rcx, str.____s
call fcn.140008c80
lea ebx, [rsi + 0x3a]
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400068f0
mov dword [rbp + 0x580], 0x2c0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x2c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x140006942
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo._n
call fcn.140008c80
mov ecx, r13d
xor r15d, r15d
jmp 0x140006a18
lea rdx, [rbp + 0x580]
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x1400069b1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [rbp + 0x580]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x1400069a1
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.140008c10
mov ecx, r13d
xor r15d, r15d
jmp 0x140006a18
lea rdx, [rbp + 0x580]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1400069fe
mov rdi, rsi
nop dword [rax + rax]
lea rcx, [rdi + 0x110]
call fcn.140012c70
mov rbx, rax
test rax, rax
je 0x1400069f6
lea rdx, str.VMWare
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov rcx, rbx
test rax, rax
jne 0x140006b0b
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [rdi]
test rdi, rdi
jne 0x1400069c0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor r15d, r15d
mov ecx, r15d
lea rdx, str.Checking_VMWare_network_adapter_name
call fcn.140012a30
lea rax, str..HGFS
mov r14d, 2
mov qword [rbp - 8], rax
lea rsi, [rbp - 8]
lea rax, str.._vmci
mov r12d, 3
mov qword [rbp], rax
nop word [rax + rax]
mov rcx, qword [rsi]
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov r8d, r13d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
lea rcx, [rbp + 0x1fe0]
mov r8d, 0x200
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rsi]
lea r8, str.Checking_device__s
mov edx, 0x100
lea rcx, [rbp + 0x1fe0]
call fcn.1400090a0
cmp rdi, 0xffffffffffffffff
je 0x140006b30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x1fe0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x1fe0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006ae0
mov ebx, 0x5f
sub rbx, rax
je 0x140006b06
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140006af4
mov ecx, r13d
jmp 0x140006b84
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, r13d
xor r15d, r15d
jmp 0x140006a18
lea rdx, [rbp + 0x1fe0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x1fe0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006b51
mov ebx, 0x5f
sub rbx, rax
je 0x140006b82
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140006b70
xor ecx, ecx
lea rdx, [rbp + 0x1fe0]
call fcn.140012a30
add rsi, 8
sub r14, 1
jne 0x140006a50
lea rdx, str.Checking_VMWare_directory
lea rcx, str.____s
call fcn.140008c80
mov edi, 0x45
lea r15d, [r14 + 0x49]
mov ebx, edi
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140006bc0
xor edx, edx
lea rcx, [rbp + 0x5690]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.VMWare_]
xor edx, edx
lea rcx, [rbp + 0x5280]
mov r8d, 0x1f8
movaps xmmword [rbp + 0x5270], xmm0
call sub.VCRUNTIME140.dll_memset
call fcn.140013080
lea rdx, [rbp + 0x5480]
test eax, eax
je 0x140006c2d
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140006c3c
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x5270]
lea rdx, [rbp + 0x5480]
lea rcx, [rbp + 0x5690]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x5690]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140006c72
test al, 0x10
je 0x140006c72
mov ecx, r13d
jmp 0x140006c76
xor eax, eax
mov ecx, eax
lea rdx, str.Checking_VMWare_directory
call fcn.140012a30
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, str.____s
call fcn.140008c80
mov rbx, rdi
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140006ca0
xor edi, edi
lea r8, [rbp + 0x5e0]
xor edx, edx
mov dword [rbp + 0x5e0], edi
mov ecx, 0x52534d42
mov ebx, edi
call fcn.140015540
test rax, rax
je 0x140006d0a
mov edx, dword [rbp + 0x5e0]
mov ecx, edi
sub rdx, 6
je 0x140006d01
cmp dword [rcx + rax], 0x61774d56
jne 0x140006cf4
cmp word [rcx + rax + 4], 0x6572
je 0x140006cfe
inc rcx
cmp rcx, rdx
jb 0x140006ce2
jmp 0x140006d01
mov ebx, r13d
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_SMBIOS_firmware
mov ecx, ebx
call fcn.140012a30
lea rdx, str.Checking_ACPI_tables
lea rcx, str.____s
call fcn.140008c80
mov rbx, r15
nop
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140006d30
mov ecx, 0x1000
mov esi, edi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x140006e10
mov rdi, rax
mov ecx, 0x1000
xor eax, eax
mov rdx, r14
rep stosb byte [rdi], al
call fcn.1400154b0
mov ecx, eax
cmp eax, 0xffffffff
jne 0x140006d8b
xor eax, eax
lea rdx, str.Checking_ACPI_tables
mov ecx, esi
call fcn.140012a30
jmp 0x140006e26
shr eax, 2
cmp ecx, 4
jb 0x140006e04
test eax, eax
je 0x140006e04
mov rbx, r14
mov edi, eax
xor r15d, r15d
nop
mov edx, dword [rbx]
lea r8, [rbp + 0x5e0]
mov ecx, 0x41435049
mov dword [rbp + 0x5e0], r15d
call fcn.140015540
test rax, rax
je 0x140006df8
mov edx, dword [rbp + 0x5e0]
mov rcx, r15
sub rdx, 6
je 0x140006def
nop
cmp dword [rcx + rax], 0x41574d56
jne 0x140006de2
cmp word [rcx + rax + 4], 0x4552
je 0x140006dec
inc rcx
cmp rcx, rdx
jb 0x140006dd0
jmp 0x140006def
mov esi, r13d
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add rbx, 4
sub rdi, 1
jne 0x140006da0
jmp 0x140006e07
mov esi, r13d
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_ACPI_tables
mov ecx, esi
call fcn.140012a30
jmp 0x140006e26
mov r12d, 3
cmp dword [0x14004002c], 0
je 0x1400070c4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x710]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x710]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x718]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Virtual_PC_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008c80
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.VMSrvc.exe
mov esi, 2
mov qword [rbp - 0x38], rax
lea rdi, [rbp - 0x38]
lea rax, str.VMUSrvc.exe
mov qword [rbp - 0x30], rax
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x21e0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_Virtual_PC_processes__s
mov edx, 0x100
lea rcx, [rbp + 0x21e0]
call fcn.1400090a0
mov rcx, qword [rdi]
call fcn.140015160
lea rdx, [rbp + 0x21e0]
lea rcx, str.____s
test eax, eax
je 0x140006f4b
call fcn.140008c80
lea rcx, [rbp + 0x21e0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006f20
mov ebx, 0x5f
sub rbx, rax
je 0x140006f46
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140006f34
mov ecx, r13d
jmp 0x140006f88
call fcn.140008c80
lea rcx, [rbp + 0x21e0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006f60
mov ebx, 0x5f
sub rbx, rax
je 0x140006f86
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140006f74
xor ecx, ecx
lea rdx, [rbp + 0x21e0]
call fcn.140012a30
add rdi, 8
sub rsi, 1
jne 0x140006ec0
xor edx, edx
lea rcx, [rbp + 0x23e0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
mov edx, 0x100
lea r8, [0x14001e690]
lea rcx, [rbp + 0x23e0]
call fcn.1400090a0
xor eax, eax
lea rdx, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
mov qword [rbp + 0x588], rax
mov r9d, 0x20019
lea rax, [rbp + 0x588]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000706b
mov rcx, qword [rbp + 0x588]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x23e0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x23e0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007040
mov ebx, 0x5f
sub rbx, rax
je 0x140007066
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140007054
mov ecx, r13d
jmp 0x1400070b8
lea rdx, [rbp + 0x23e0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x23e0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007090
mov ebx, 0x5f
sub rbx, rax
je 0x1400070b6
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400070a4
xor ecx, ecx
lea rdx, [rbp + 0x23e0]
call fcn.140012a30
cmp dword [0x140040028], 0
je 0x1400076bd
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x728]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x728]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x730]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.QEMU_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008c80
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, [0x14001ea10]
mov esi, 2
mov qword [rbp + 0x698], rax
lea rcx, str.HARDWAREDescriptionSystem
lea rax, str.Identifier
mov qword [rbp + 0x6b0], rcx
mov qword [rbp + 0x6a0], rax
lea rcx, str.SystemBiosVersion
lea rax, str.QEMU
mov qword [rbp + 0x6b8], rcx
mov qword [rbp + 0x6a8], rax
lea rdi, [rbp + 0x6a8]
mov qword [rbp + 0x6c0], rax
nop dword [rax]
xor edx, edx
lea rcx, [rbp + 0x25e0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi - 0x10]
lea r8, [0x14001e690]
mov edx, 0x100
lea rcx, [rbp + 0x25e0]
call fcn.1400090a0
mov r9, qword [rdi]
mov r8, qword [rdi - 8]
mov rdx, qword [rdi - 0x10]
call fcn.140013140
lea rdx, [rbp + 0x25e0]
lea rcx, str.____s
test eax, eax
je 0x140007227
call fcn.140008c80
lea rcx, [rbp + 0x25e0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400071f5
mov ebx, 0x5f
sub rbx, rax
je 0x140007222
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140007210
mov ecx, r13d
jmp 0x140007268
call fcn.140008c80
lea rcx, [rbp + 0x25e0]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007240
mov ebx, 0x5f
sub rbx, rax
je 0x140007266
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140007254
xor ecx, ecx
lea rdx, [rbp + 0x25e0]
call fcn.140012a30
add rdi, 0x18
sub rsi, 1
jne 0x140007190
lea rax, str.qemu_ga.exe
mov qword [rbp - 0x68], rax
lea rdi, [rbp - 0x68]
lea rax, str.vdagent.exe
mov qword [rbp - 0x60], rax
lea rax, str.vdservice.exe
mov qword [rbp - 0x58], rax
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x27e0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_qemu_processes__s
mov edx, 0x100
lea rcx, [rbp + 0x27e0]
call fcn.1400090a0
mov rcx, qword [rdi]
call fcn.140015160
lea rdx, [rbp + 0x27e0]
lea rcx, str.____s
test eax, eax
je 0x14000733b
call fcn.140008c80
lea rcx, [rbp + 0x27e0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007310
mov ebx, 0x5f
sub rbx, rax
je 0x140007336
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140007324
mov ecx, r13d
jmp 0x140007378
call fcn.140008c80
lea rcx, [rbp + 0x27e0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007350
mov ebx, 0x5f
sub rbx, rax
je 0x140007376
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140007364
xor ecx, ecx
lea rdx, [rbp + 0x27e0]
call fcn.140012a30
add rdi, 8
sub r12, 1
jne 0x1400072b0
xor edx, edx
lea rcx, [rbp + 0x4410]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rax, str.qemu_ga
mov rdi, r12
mov qword [rbp - 0x18], rax
lea rax, str.SPICE_Guest_Tools
mov qword [rbp - 0x10], rax
nop
xor edx, edx
lea rcx, [rbp + 0x29e0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
call fcn.140013080
lea rdx, [rbp + 0x58a0]
test eax, eax
je 0x1400073f9
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140007408
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov r8, qword [rbp + rdi*8 - 0x18]
lea rdx, [rbp + 0x58a0]
lea rcx, [rbp + 0x4410]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea r9, [rbp + 0x4410]
mov edx, 0x100
lea r8, str.Checking_QEMU_directory__s
lea rcx, [rbp + 0x29e0]
call fcn.1400090a0
lea rcx, [rbp + 0x4410]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400074ab
test al, 0x10
je 0x1400074ab
lea rdx, [rbp + 0x29e0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x29e0]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140007480
mov ebx, 0x5f
sub rbx, rax
je 0x1400074a6
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140007494
mov ecx, r13d
jmp 0x1400074f8
lea rdx, [rbp + 0x29e0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x29e0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r12w
jne 0x1400074d0
mov ebx, 0x5f
sub rbx, rax
je 0x1400074f6
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400074e4
xor ecx, ecx
lea rdx, [rbp + 0x29e0]
call fcn.140012a30
inc rdi
cmp rdi, 2
jl 0x1400073c0
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, str.____s
call fcn.140008c80
mov r15d, 0x45
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub r15, 1
jne 0x140007530
lea r8, [rbp + 0x5e0]
mov dword [rbp + 0x5e0], r12d
xor edx, edx
mov ecx, 0x52534d42
mov edi, r12d
call fcn.140015540
mov rbx, rax
mov r15d, 0x49
test rax, rax
je 0x1400075b3
mov ecx, dword [rbp + 0x5e0]
mov rdx, r12
add rcx, 0xfffffffffffffffc
je 0x1400075aa
nop dword [rax]
cmp dword [rdx + rax], 0x756d6571
je 0x1400075a7
inc rdx
cmp rdx, rcx
jb 0x140007580
mov rax, r12
cmp dword [rax + rbx], 0x554d4551
je 0x1400075a7
inc rax
cmp rax, rcx
jb 0x140007594
jmp 0x1400075aa
mov edi, r13d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_SMBIOS_firmware
mov ecx, edi
call fcn.140012a30
lea rdx, str.Checking_ACPI_tables
lea rcx, str.____s
call fcn.140008c80
lea rcx, [0x140020ec8]
call fcn.140008c80
sub r15, 1
jne 0x1400075d4
mov ecx, 0x1000
mov r14d, r12d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
test rax, rax
je 0x1400076ac
mov rdi, rax
mov ecx, 0x1000
xor eax, eax
mov rdx, r15
rep stosb byte [rdi], al
call fcn.1400154b0
mov ecx, eax
cmp eax, 0xffffffff
je 0x1400076ac
shr eax, 2
cmp ecx, 4
jb 0x1400076a0
test eax, eax
je 0x1400076a0
mov rdi, r15
mov esi, eax
mov edx, dword [rdi]
lea r8, [rbp + 0x5e0]
mov ecx, 0x41435049
mov dword [rbp + 0x5e0], r12d
call fcn.140015540
mov rbx, rax
test rax, rax
je 0x140007694
mov ecx, dword [rbp + 0x5e0]
mov rdx, r12
add rcx, 0xfffffffffffffffc
je 0x14000768b
cmp dword [rdx + rax], 0x48434f42
je 0x140007688
inc rdx
cmp rdx, rcx
jb 0x140007661
mov rax, r12
cmp dword [rax + rbx], 0x43505842
je 0x140007688
inc rax
cmp rax, rcx
jb 0x140007675
jmp 0x14000768b
mov r14d, r13d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add rdi, 4
sub rsi, 1
jne 0x140007630
jmp 0x1400076a3
mov r14d, r13d
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_ACPI_tables
mov ecx, r14d
call fcn.140012a30
jmp 0x1400076c0
xor r12d, r12d
cmp dword [0x140040020], 0
je 0x14000785e
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x740]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x740]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x748]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Xen_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008c80
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor edx, edx
lea rcx, [rbp + 0x2be0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
lea r9, str.xenservice.exe
mov edx, 0x100
lea r8, str.Checking_Citrix_Xen_process__s
lea rcx, [rbp + 0x2be0]
call fcn.1400090a0
lea rcx, str.xenservice.exe
call fcn.140015160
lea rdx, [rbp + 0x2be0]
lea rcx, str.____s
test eax, eax
je 0x1400077c7
call fcn.140008c80
lea rcx, [rbp + 0x2be0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007793
mov ebx, 0x5f
sub rbx, rax
je 0x1400077c2
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400077b0
mov ecx, r13d
jmp 0x140007808
call fcn.140008c80
lea rcx, [rbp + 0x2be0]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400077e0
mov ebx, 0x5f
sub rbx, rax
je 0x140007806
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400077f4
xor ecx, ecx
lea rdx, [rbp + 0x2be0]
call fcn.140012a30
lea rdx, str.Checking_Mac_Address_start_with_08:16:3E
lea rcx, str.____s
call fcn.140008c80
mov r15d, 0x36
mov ebx, r15d
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140007830
lea rcx, [0x140020350]
call fcn.140013230
lea rdx, str.Checking_Mac_Address_start_with_08:16:3E
mov ecx, eax
call fcn.140012a30
jmp 0x140007864
mov r15d, 0x36
cmp dword [0x140040024], 0
je 0x140007d70
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x818]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x818]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x820]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Xen_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008c80
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.System32drivers_balloon.sys
xor edx, edx
mov qword [rbp + 0x1f0], rax
lea rcx, [rbp + 0x5ab0]
lea rax, str.System32drivers_netkvm.sys
mov r8d, 0x208
mov qword [rbp + 0x1f8], rax
lea rax, str.System32driverspvpanic.sys
mov qword [rbp + 0x200], rax
lea rax, str.System32drivers_viofs.sys
mov qword [rbp + 0x208], rax
lea rax, str.System32drivers_viogpudo.sys
mov qword [rbp + 0x210], rax
lea rax, str.System32drivers_vioinput.sys
mov qword [rbp + 0x218], rax
lea rax, str.System32drivers_viorng.sys
mov qword [rbp + 0x220], rax
lea rax, str.System32drivers_vioscsi.sys
mov qword [rbp + 0x228], rax
lea rax, str.System32drivers_vioser.sys
mov qword [rbp + 0x230], rax
lea rax, str.System32drivers_viostor.sys
mov qword [rbp + 0x238], rax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x4620]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov edx, 0x104
mov qword [rbp + 0x588], r12
lea rcx, [rbp + 0x5ab0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call fcn.140013080
test eax, eax
je 0x1400079b6
lea rcx, [rbp + 0x588]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov rdi, r12
nop dword [rax]
mov r8, qword [rbp + rdi*8 + 0x1f0]
lea rdx, [rbp + 0x5ab0]
lea rcx, [rbp + 0x4620]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edx, edx
lea rcx, [rbp + 0x2de0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x4620]
mov edx, 0x100
lea r8, str.Checking_file__s
lea rcx, [rbp + 0x2de0]
call fcn.1400090a0
lea rcx, [rbp + 0x4620]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140007a77
test al, 0x10
jne 0x140007a77
lea rdx, [rbp + 0x2de0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x2de0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007a46
mov ebx, 0x5f
sub rbx, rax
je 0x140007a72
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140007a60
mov ecx, r13d
jmp 0x140007ac8
lea rdx, [rbp + 0x2de0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x2de0]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007aa0
mov ebx, 0x5f
sub rbx, rax
je 0x140007ac6
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140007ab4
xor ecx, ecx
lea rdx, [rbp + 0x2de0]
call fcn.140012a30
inc rdi
cmp rdi, 0xa
jl 0x1400079c0
call fcn.140013080
test eax, eax
je 0x140007af7
lea rcx, [rbp + 0x588]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
lea rax, str.SYSTEMControlSet001Services_vioscsi
mov qword [rbp + 0xa8], rax
lea rdi, [rbp + 0xa8]
lea rax, str.SYSTEMControlSet001Services_viostor
mov qword [rbp + 0xb0], rax
lea rax, str.SYSTEMControlSet001ServicesVirtIO_FS_Service
mov qword [rbp + 0xb8], rax
lea rax, str.SYSTEMControlSet001ServicesVirtioSerial
mov qword [rbp + 0xc0], rax
lea rax, str.SYSTEMControlSet001ServicesBALLOON
mov qword [rbp + 0xc8], rax
lea rax, str.SYSTEMControlSet001ServicesBalloonService
mov qword [rbp + 0xd0], rax
lea rax, str.SYSTEMControlSet001Services_netkvm
mov qword [rbp + 0xd8], rax
xor edx, edx
lea rcx, [rbp + 0x2fe0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, [0x14001e690]
mov edx, 0x100
lea rcx, [rbp + 0x2fe0]
call fcn.1400090a0
mov rdx, qword [rdi]
lea rax, [rbp + 0x588]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp + 0x588], r12
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007c1b
mov rcx, qword [rbp + 0x588]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x2fe0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x2fe0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007bf0
mov ebx, 0x5f
sub rbx, rax
je 0x140007c16
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140007c04
mov ecx, r13d
jmp 0x140007c68
lea rdx, [rbp + 0x2fe0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x2fe0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007c40
mov ebx, 0x5f
sub rbx, rax
je 0x140007c66
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140007c54
xor ecx, ecx
lea rdx, [rbp + 0x2fe0]
call fcn.140012a30
add rdi, 8
sub qword [rbp - 0x78], 1
jne 0x140007b60
lea rdx, str.Checking_KVM_virio_directory
lea rcx, str.____s
call fcn.140008c80
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub qword [rbp - 0x70], 1
jne 0x140007ca0
xor edx, edx
lea rcx, [rbp + 0x5ed0]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.Virtio_Win_]
lea rcx, [rbp + 0x3e08]
xor edx, edx
movsd xmm1, qword [0x14001e958]
mov r8d, 0x1f0
movaps xmmword [rbp + 0x3df0], xmm0
movsd qword [rbp + 0x3e00], xmm1
call sub.VCRUNTIME140.dll_memset
call fcn.140013080
lea rdx, [rbp + 0x5cc0]
test eax, eax
je 0x140007d1e
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140007d2d
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x3df0]
lea rdx, [rbp + 0x5cc0]
lea rcx, [rbp + 0x5ed0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x5ed0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140007d61
mov ecx, r13d
test al, 0x10
jne 0x140007d64
mov ecx, r12d
lea rdx, str.Checking_KVM_virio_directory
call fcn.140012a30
cmp dword [0x14004001c], 0
je 0x140007f74
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x800]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x800]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x808]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Wine_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008c80
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Checking_Wine_via_dll_exports
lea rcx, str.____s
call fcn.140008c80
lea rcx, [0x140020ec8]
call fcn.140008c80
sub qword [rbp + 0x5a0], 1
jne 0x140007df2
lea rcx, [0x14001be80]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140007e2b
lea rcx, str.GetModuleHandle
call fcn.140012b60
mov ecx, r12d
jmp 0x140007e44
lea rdx, str.wine_get_unix_file_name
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov ecx, r12d
setne cl
lea rdx, str.Checking_Wine_via_dll_exports
call fcn.140012a30
xor edx, edx
lea rcx, [rbp + 0x31e0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREWine
mov edx, 0x100
lea r8, [0x14001e690]
lea rcx, [rbp + 0x31e0]
call fcn.1400090a0
lea rax, [rbp + 0x5a0]
mov qword [rbp + 0x5a0], r12
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREWine
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007f17
mov rcx, qword [rbp + 0x5a0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x31e0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x31e0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007ee5
mov ebx, 0x5f
sub rbx, rax
je 0x140007f12
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140007f00
mov ecx, r13d
jmp 0x140007f68
lea rdx, [rbp + 0x31e0]
lea rcx, str.____s
call fcn.140008c80
lea rcx, [rbp + 0x31e0]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007f40
mov ebx, 0x5f
sub rbx, rax
je 0x140007f66
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140007f54
xor ecx, ecx
lea rdx, [rbp + 0x31e0]
call fcn.140012a30
cmp dword [0x140040018], 0
je 0x14000813c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x830]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x830]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x838]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Paralles_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008c80
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.prl_cc.exe
mov esi, 2
mov qword [rbp - 0x28], rax
lea rdi, [rbp - 0x28]
lea rax, str.prl_tools.exe
mov qword [rbp - 0x20], rax
nop dword [rax]
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x33e0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_Parallels_processes:__s
mov edx, 0x100
lea rcx, [rbp + 0x33e0]
call fcn.1400090a0
mov rcx, qword [rdi]
call fcn.140015160
lea rdx, [rbp + 0x33e0]
lea rcx, str.____s
test eax, eax
je 0x14000809b
call fcn.140008c80
lea rcx, [rbp + 0x33e0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008070
mov ebx, 0x5f
sub rbx, rax
je 0x140008096
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140008084
mov ecx, r13d
jmp 0x1400080d8
call fcn.140008c80
lea rcx, [rbp + 0x33e0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400080b0
mov ebx, 0x5f
sub rbx, rax
je 0x1400080d6
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400080c4
xor ecx, ecx
lea rdx, [rbp + 0x33e0]
call fcn.140012a30
add rdi, 8
sub rsi, 1
jne 0x140008010
lea rdx, str.Checking_Mac_Address_start_with_00:1C:42
lea rcx, str.____s
call fcn.140008c80
mov rbx, r15
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140008110
lea rcx, [0x14001ea08]
call fcn.140013230
lea rdx, str.Checking_Mac_Address_start_with_00:1C:42
mov ecx, eax
call fcn.140012a30
cmp dword [0x140040014], 0
je 0x14000838c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x7e8]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x7e8]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x7f0]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Hyper_V_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008c80
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Checking_for_Hyper_V_driver_objects
lea rcx, str.____s
call fcn.140008c80
mov edi, 0x3b
mov ebx, edi
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x1400081d0
lea rcx, str.Driver
call fcn.140015860
test rax, rax
je 0x1400082b5
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
cmp rdi, rsi
je 0x1400082b0
nop word [rax + rax]
mov rbx, qword [rdi]
lea rdx, str.VMBusHID
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x1400086ca
lea rdx, str.vmbus
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x1400086ca
lea rdx, str.vmgid
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x1400086ca
lea rdx, str.IndirectKmd
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x1400086ca
lea rdx, str.HyperVideo
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x1400086ca
lea rdx, str.hyperkbd
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x1400086ca
add rdi, 8
cmp rdi, rsi
jne 0x140008210
mov edi, 0x3b
mov ecx, r12d
lea rdx, str.Checking_for_Hyper_V_driver_objects
call fcn.140012a30
lea rdx, str.Checking_for_Hyper_V_global_objects
lea rcx, str.____s
call fcn.140008c80
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rdi, 1
jne 0x1400082e0
lea rcx, str.GLOBAL__
call fcn.140015860
test rax, rax
je 0x14000837d
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
cmp rdi, rsi
je 0x14000837d
nop
mov rbx, qword [rdi]
lea rdx, str.VMBUS
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
jne 0x1400086d7
lea rdx, str.VDRVROOT
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x1400086d7
lea rdx, str.VmGenerationCounter
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x1400086d7
lea rdx, str.VmGid
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x1400086d7
add rdi, 8
cmp rdi, rsi
jne 0x140008310
mov ecx, r12d
lea rdx, str.Checking_for_Hyper_V_global_objects
call fcn.140012a30
cmp dword [0x140040010], 0
je 0x1400083ae
call fcn.1400114b0
call fcn.140012680
call fcn.1400118c0
call fcn.140012240
call fcn.140011d10
cmp dword [0x14004000c], 0
je 0x140008774
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x7d0]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x7d0]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x7d8]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Timing_attacks
lea rcx, str._n___________________________s___________________________n
call fcn.140008c80
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, 0xa
lea rcx, str._n___Delay_value_is_set_to__u_minutes_..._n
call fcn.140008c10
lea rdx, str.Performing_a_sleep_using_NtDelayExecution_...
lea rcx, str.____s
call fcn.140008c80
mov r12d, 0x32
mov ebx, r12d
nop word [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140008450
mov ecx, 0x927c0
call fcn.140015b10
lea rdx, str.Performing_a_sleep_using_NtDelayExecution_...
mov ecx, eax
call fcn.140012a30
lea rdx, str.Performing_a_sleep___in_a_loop_...
lea rcx, str.____s
call fcn.140008c80
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub qword [rbp - 0x80], 1
jne 0x140008490
mov ecx, 0x927c0
call fcn.140015db0
lea rdx, str.Performing_a_sleep___in_a_loop_...
mov ecx, eax
call fcn.140012a30
lea rdx, str.Delaying_execution_using_SetTimer_...
lea rcx, str.____s
call fcn.140008c80
mov r14d, 0x3a
lea rcx, [0x140020ec8]
call fcn.140008c80
sub r14, 1
jne 0x1400084d4
mov ecx, 0x927c0
call fcn.140015bf0
lea rdx, str.Delaying_execution_using_SetTimer_...
mov ecx, eax
call fcn.140012a30
lea rdx, str.Delaying_execution_using_timeSetEvent_...
lea rcx, str.____s
call fcn.140008c80
mov rbx, r15
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140008514
mov ecx, 0x927c0
call fcn.140015cc0
lea rdx, str.Delaying_execution_using_timeSetEvent_...
mov ecx, eax
call fcn.140012a30
lea rdx, str.Delaying_execution_using_WaitForSingleObject_...
lea rcx, str.____s
call fcn.140008c80
mov edi, 0x2f
mov ebx, edi
nop dword [rax + rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140008560
mov ecx, 0x927c0
call fcn.140015d60
lea rdx, str.Delaying_execution_using_WaitForSingleObject_...
mov ecx, eax
call fcn.140012a30
lea rdx, str.Delaying_execution_using_IcmpSendEcho_...
lea rcx, str.____s
call fcn.140008c80
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub r15, 1
jne 0x1400085a0
mov ecx, 0x927c0
call fcn.140015df0
lea rdx, str.Delaying_execution_using_IcmpSendEcho_...
mov ecx, eax
call fcn.140012a30
lea rdx, str.Delaying_execution_using_CreateWaitableTimer_...
lea rcx, str.____s
call fcn.140008c80
nop dword [rax]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rdi, 1
jne 0x1400085e0
mov ecx, 0x927c0
call fcn.140015f10
lea rdx, str.Delaying_execution_using_CreateWaitableTimer_...
mov ecx, eax
call fcn.140012a30
lea rdx, str.Delaying_execution_using_CreateTimerQueueTimer_...
lea rcx, str.____s
call fcn.140008c80
lea r14d, [rdi + 0x2d]
lea rcx, [0x140020ec8]
call fcn.140008c80
sub r14, 1
jne 0x140008621
mov ecx, 0x927c0
call fcn.140015fc0
lea rdx, str.Delaying_execution_using_CreateTimerQueueTimer_...
mov ecx, eax
call fcn.140012a30
lea rdx, str.Checking_RDTSC_Locky_trick
lea rcx, str.____s
call fcn.140008c80
mov r14d, 0xa
lea rcx, [0x140020ec8]
call fcn.140008c80
sub qword [rsp + 0x70], 1
jne 0x140008664
xor r15d, r15d
mov esi, r15d
nop
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
rdtsc
shl rdx, 0x20
xor ecx, ecx
or rax, rdx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
rdtsc
shl rdx, 0x20
mov ecx, ebx
or rax, rdx
sub ecx, edi
sub eax, ebx
xor edx, edx
div ecx
cmp eax, r14d
jae 0x1400086df
inc esi
cmp esi, r14d
jb 0x140008680
mov ecx, r13d
jmp 0x1400086e2
mov ecx, r13d
mov edi, 0x3b
jmp 0x1400082b8
mov ecx, r13d
jmp 0x140008380
mov ecx, r15d
lea rdx, str.Checking_RDTSC_Locky_trick
call fcn.140012a30
lea rdx, str.Checking_RDTSC_which_force_a_VM_Exit__cpuid_
lea rcx, str.____s
call fcn.140008c80
lea rcx, [0x140020ec8]
call fcn.140008c80
sub r12, 1
jne 0x140008701
mov r8, r12
nop word [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdi, rax
xor eax, eax
xor ecx, ecx
cpuid
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rdi
add r8, rax
sub r14, 1
jne 0x140008720
mov ecx, r12d
movabs rax, 0xcccccccccccccccd
mul r8
shr rdx, 3
lea rax, [rdx - 1]
cmp rax, 0x3e6
lea rdx, str.Checking_RDTSC_which_force_a_VM_Exit__cpuid_
seta cl
call fcn.140012a30
cmp dword [0x140040004], 0
je 0x140008a86
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x7b8]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x7b8]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x7c0]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Analysis_tools
lea rcx, str._n___________________________s___________________________n
call fcn.140008c80
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.ollydbg.exe
mov qword [rbp + 0x480], rax
lea rax, str.ProcessHacker.exe
mov qword [rbp + 0x488], rax
lea rax, str.tcpview.exe
mov qword [rbp + 0x490], rax
lea rax, str.autoruns.exe
mov qword [rbp + 0x498], rax
lea rax, str.autorunsc.exe
mov qword [rbp + 0x4a0], rax
lea rax, str.filemon.exe
mov qword [rbp + 0x4a8], rax
lea rax, str.procmon.exe
mov qword [rbp + 0x4b0], rax
lea rax, str.regmon.exe
mov qword [rbp + 0x4b8], rax
lea rax, str.procexp.exe
mov qword [rbp + 0x4c0], rax
lea rax, str.idaq.exe
mov qword [rbp + 0x4c8], rax
lea rax, str.idaq64.exe
mov qword [rbp + 0x4d0], rax
lea rax, str.ImmunityDebugger.exe
mov qword [rbp + 0x4d8], rax
lea rax, str.Wireshark.exe
mov qword [rbp + 0x4e0], rax
lea rax, str.dumpcap.exe
mov qword [rbp + 0x4e8], rax
lea rax, str.HookExplorer.exe
mov qword [rbp + 0x4f0], rax
lea rax, str.ImportREC.exe
mov qword [rbp + 0x4f8], rax
lea rax, str.PETools.exe
mov qword [rbp + 0x500], rax
lea rax, str.LordPE.exe
mov qword [rbp + 0x508], rax
lea rax, str.SysInspector.exe
mov qword [rbp + 0x510], rax
lea rax, str.proc_analyzer.exe
mov qword [rbp + 0x518], rax
lea rax, str.sysAnalyzer.exe
mov qword [rbp + 0x520], rax
lea rax, str.sniff_hit.exe
mov qword [rbp + 0x528], rax
lea rax, str.windbg.exe
mov qword [rbp + 0x530], rax
lea rax, str.joeboxcontrol.exe
mov qword [rbp + 0x538], rax
lea rax, str.joeboxserver.exe
mov qword [rbp + 0x540], rax
mov qword [rbp + 0x548], rax
lea rax, str.ResourceHacker.exe
mov qword [rbp + 0x550], rax
lea rax, str.x32dbg.exe
mov qword [rbp + 0x558], rax
lea rax, str.x64dbg.exe
mov qword [rbp + 0x560], rax
lea rax, str.Fiddler.exe
mov qword [rbp + 0x568], rax
lea rax, str.httpdebugger.exe
mov qword [rbp + 0x570], rax
lea rdi, [rbp + 0x480]
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x35e0]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_process_of_malware_analysis_tool:__s
mov edx, 0x100
lea rcx, [rbp + 0x35e0]
call fcn.1400090a0
mov rcx, qword [rdi]
call fcn.140015160
lea rdx, [rbp + 0x35e0]
lea rcx, str.____s
test eax, eax
je 0x140008a2b
call fcn.140008c80
lea rcx, [rbp + 0x35e0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008a00
mov ebx, 0x5f
sub rbx, rax
je 0x140008a26
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140008a14
mov ecx, r13d
jmp 0x140008a68
call fcn.140008c80
lea rcx, [rbp + 0x35e0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008a40
mov ebx, 0x5f
sub rbx, rax
je 0x140008a66
lea rcx, [0x140020ec8]
call fcn.140008c80
sub rbx, 1
jne 0x140008a54
xor ecx, ecx
lea rdx, [rbp + 0x35e0]
call fcn.140012a30
add rdi, 8
sub qword [rbp + 0x5b8], 1
jne 0x1400089a0
cmp dword [0x140040000], 0
je 0x140008aee
lea rcx, str.Begin_AntiDisassmConstantCondition_n
call fcn.140008c80
call fcn.1400160c0
lea rcx, str.Begin_AntiDisassmAsmJmpSameTarget_n
call fcn.140008c80
call fcn.1400160c8
lea rcx, str.Begin_AntiDisassmImpossibleDiasassm_n
call fcn.140008c80
call fcn.1400160cf
lea rcx, str.Begin_AntiDisassmFunctionPointer_n
call fcn.140008c80
mov ecx, 2
call fcn.1400160e3
lea rcx, str.Begin_AntiDisassmReturnPointerAbuse_n
call fcn.140008c80
mov ecx, 0x29a
call fcn.14001610e
cmp dword [0x140040008], 0
je 0x140008bc7
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x7a0]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x7a0]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x7a8]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Anti_Dumping
lea rcx, str._n___________________________s___________________________n
call fcn.140008c80
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.___Erasing_PE_header_from_memory_n
call fcn.140008c80
xor ecx, ecx
mov dword [rbp + 0x630], r12d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9, [rbp + 0x630]
mov edx, 0x1000
mov rcx, rax
mov r8d, 4
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
mov rbx, qword gs:[0x60]
lea rcx, str.___Increasing_SizeOfImage_in_PE_Header_to:_0x100000_n
call fcn.140008c80
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x30]
add eax, 0x100000
mov dword [rcx + 0x40], eax
lea rcx, str._n_nAnalysis_done__I_hope_you_didnt_get_red_flags_:_
call fcn.140008c80
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
mov rcx, qword [rbp + 0x70e0]
xor rcx, rsp
call fcn.140016140
lea r11, [rsp + 0x71f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret