Function at 0x140001420
Capabilities:
Access peb ldr_data
Check for debugger via api
Check for outputdebugstring error
Check for peb beingdebugged flag
Check for peb ntglobalflag flag
Check for software breakpoints
Check if file exists
Check if process is running under wine
Create thread
Enumerate process modules
Get common file path
Get file attributes
Get ntdll base address
Get program files directory
Get system information on windows
Print debug messages
Query environment variable
Query or enumerate registry value
Reference processor manufacturer constants
Reference wmi statements
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x15c0]
mov eax, 0x16c0
call fcn.140012700
sub rsp, rax
mov rax, qword [0x14001e010]
xor rax, rsp
mov qword [rbp + 0x15b0], rax
xor r9d, r9d
movsxd r14, ecx
mov r8d, 8
mov rsi, rdx
mov qword [rsp + 0x30], r8
lea r12d, [r9 + 1]
cmp r14d, r12d
jle 0x14000151a
mov edi, r12d
cmp r14, r12
jbe 0x14000158a
lea ebx, [r9 + 2]
lea r13, str.__check
nop word [rax + rax]
mov rdx, qword [rsi + rdi*8]
mov rcx, r9
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rcx + r13 - 1]
jne 0x14000150c
cmp rcx, r8
jne 0x1400014b0
cmp ebx, r14d
jge 0x14000150c
mov rdx, qword [rsi + rdi*8 + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r9
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x80], r9
inc r8
cmp byte [rdx + r8], 0
jne 0x1400014e5
lea rcx, [rsp + 0x68]
call fcn.1400065f0
lea rcx, [rsp + 0x68]
call fcn.140001010
mov r8d, 8
xor r9d, r9d
add ebx, 2
add rdi, 2
cmp rdi, r14
jl 0x1400014a0
jmp 0x14000158a
mov dword [0x140037030], r12d
mov dword [0x14003702c], r12d
mov dword [0x140037028], r12d
mov dword [0x140037024], r12d
mov dword [0x140037020], r12d
mov dword [0x14003701c], r12d
mov dword [0x140037018], r12d
mov dword [0x140037014], r12d
mov dword [0x140037010], r12d
mov dword [0x14003700c], r12d
mov dword [0x140037008], r12d
mov dword [0x140037004], r12d
mov dword [0x140037000], r12d
mov dword [0x140036ff8], r12d
mov dword [0x140036ff4], r12d
mov dword [0x140036ff0], r12d
lea rcx, str.Al_Khaser___by_Lord_Noteworthy
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 0x64
mov dword [rsp + 0x28], r12d
mov r8d, edx
mov dword [rsp + 0x20], 0x384
mov r9d, 0x384
mov rcx, rax
call qword [sym.imp.USER32.dll_MoveWindow]
lea rcx, str._al_khaser_version_0.82_
call fcn.1400063d0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x18]
mov ecx, 0x16
mov rbx, rax
lea rdx, [rbp + 0x18]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edi, word [rbp + 0x20]
mov edx, 0xd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Initialisation
lea rcx, str._n___________________________s___________________________n
call fcn.1400063d0
movzx edx, di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor ecx, ecx
lea rsi, [0x14003619c]
mov r13d, ecx
test dword [rsi - 4], 0xfffffffd
mov r15d, dword [rsi + 4]
mov r12d, dword [rsi]
jne 0x1400016df
xor r14b, r14b
lea rdi, [0x140036758]
mov rbx, rcx
xor al, al
lea rcx, [0x140036828]
nop dword [rax]
test rbx, rbx
je 0x140001677
cmp dword [rdi - 8], r12d
jne 0x140001677
mov r14b, 1
call qword [rdi]
lea rcx, [0x140036828]
inc rbx
add rdi, 0x10
cmp rdi, rcx
jl 0x140001660
test r14b, r14b
jne 0x140001691
lea rcx, str.ERROR:_Minimum_version_value_was_invalid._n
jmp 0x1400016da
test al, al
je 0x1400016df
test r15d, r15d
jne 0x14000169e
mov al, 1
jmp 0x1400016e1
xor bl, bl
lea rdi, [0x140036758]
xor al, al
nop dword [rax]
cmp dword [rdi - 8], r15d
jne 0x1400016c6
mov bl, 1
call qword [rdi]
test al, al
lea rcx, [0x140036828]
sete al
add rdi, 0x10
cmp rdi, rcx
jl 0x1400016b0
test bl, bl
jne 0x1400016e1
lea rcx, str.ERROR:_Removed_version_value_was_invalid._n
call fcn.14000b0e0
xor al, al
mov rcx, qword [rsi - 0x14]
mov byte [rsi + 9], al
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x1400016f8
mov byte [rsi + 8], al
jmp 0x140001712
mov rdx, qword [rsi - 0xc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rsi + 0xc], rax
setne al
mov byte [rsi + 8], al
inc r13d
add rsi, 0x30
mov ecx, 0
cmp r13d, 0x1f
jb 0x140001632
xor r14d, r14d
lea rcx, [rbp + 0x3a2]
xor edx, edx
mov word [rbp + 0x3a0], r14w
mov r8d, 0x206
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x3a0]
call fcn.14000eee0
test eax, eax
je 0x14000176a
lea rdx, [rbp + 0x3a0]
lea rcx, str._n___You_are_running:__s_n
call fcn.1400063d0
mov esi, r14d
lea rdi, [0x1400361a4]
mov ebx, r14d
cmp byte [rdi + 1], r14b
je 0x140001798
cmp byte [rdi], r14b
jne 0x140001798
mov r8, qword [rdi - 0x14]
lea rcx, str.___Warning:_API__s__s_was_expected_to_exist_but_was_not_found._n
mov rdx, qword [rdi - 0x1c]
call fcn.14000b0e0
inc esi
inc ebx
add rdi, 0x30
cmp ebx, 0x1f
jb 0x140001777
test esi, esi
jne 0x1400017b3
lea rcx, str.___All_APIs_present_and_accounted_for._n
call fcn.14000b0e0
call fcn.14000ebf0
test eax, eax
je 0x1400017c8
lea rcx, str.Process_is_running_under_WOW64_n_n
call fcn.1400063d0
cmp dword [0x14003702c], r14d
je 0x1400018cb
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [rbp + 0x44]
lea r8, [rbp - 0x30]
xorps xmm0, xmm0
lea rdx, [fcn.140006cc0]
mov ecx, 4
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x1400018cb
mov rdi, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x68]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x1400018cb
mov rbx, r14
cmp dword [rsp + 0x70], r14d
jbe 0x1400018cb
mov rdi, qword [rsp + 0x68]
nop dword [rax]
nop dword [rax + rax]
mov r8d, 0x30
lea rdx, [rbp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
jb 0x1400018bc
mov eax, dword [rbp + 0x184]
test al, 0x10
jne 0x140001892
test al, 0x20
jne 0x140001892
test al, al
js 0x140001892
test al, 0x40
je 0x1400018bc
mov rdx, qword [0x140037040]
cmp rdx, qword [0x140037048]
mov qword [rbp - 0x48], rdi
je 0x1400018b3
mov qword [rdx], rdi
add qword [0x140037040], 8
jmp 0x1400018bc
lea r8, [rbp - 0x48]
call fcn.140006eb0
mov eax, dword [rsp + 0x70]
add rbx, rsi
add rdi, rsi
cmp rbx, rax
jb 0x140001860
cmp dword [0x140037030], r14d
mov esi, 0x44
je 0x140001b6f
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x18]
mov ecx, 0x16
mov rbx, rax
lea rdx, [rbp + 0x18]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edi, word [rbp + 0x20]
lea edx, [rsi - 0x37]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.TLS_Callbacks
lea rcx, str._n___________________________s___________________________n
call fcn.1400063d0
movzx edx, di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.TLS_process_attach_callback
lea rcx, str.____s
call fcn.1400063d0
lea edi, [rsi - 1]
nop word [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140001950
mov rax, qword [0x140037058]
mov edi, r14d
test rax, rax
jne 0x1400019ae
inc edi
cmp edi, 0x3e8
je 0x140001995
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov rax, qword [0x140037058]
test rax, rax
je 0x140001971
cmp edi, 0x3e8
jl 0x1400019ae
lea rcx, str.TLSCallbackProcess_timeout_on_event_creation.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, 1
mov ecx, ebx
jmp 0x140001a3a
mov rcx, qword [0x140037058]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140001a03
cmp eax, 0xffffffff
jne 0x1400019df
lea rcx, str.TLSCallbackProcess_wait_failed.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, 1
mov ecx, ebx
jmp 0x140001a3a
lea rcx, str.TLSCallbackProcess_wait_abandoned.
cmp eax, 0x80
je 0x14000199c
lea rcx, str.TLSCallbackProcess_timeout_on_event_wait.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, 1
mov ecx, ebx
jmp 0x140001a3a
mov eax, dword [0x140037064]
lea rcx, str.TLSCallbackProcess_data_did_not_match.
cmp eax, 0xdeadbeef
jne 0x140001a1e
lea rcx, str.All_seems_fine_for_TLSCallbackProcess.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x140037064]
mov ecx, r14d
cmp eax, 0xdeadbeef
mov ebx, 1
setne cl
lea rdx, str.TLS_process_attach_callback
call fcn.14000e640
lea rdx, str.TLS_thread_attach_callback
lea rcx, str.____s
call fcn.1400063d0
mov rdi, rsi
nop dword [rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140001a60
mov qword [rsp + 0x28], r14
lea r8, [0x14000b3e0]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x140001aa2
lea rcx, str.TLS_callback:_couldnt_start_dummy_thread
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, qword [0x140037050]
mov edi, r14d
test rax, rax
jne 0x140001ae6
inc edi
cmp edi, 0x3e8
je 0x140001ad5
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov rax, qword [0x140037050]
test rax, rax
je 0x140001ab1
cmp edi, 0x3e8
jl 0x140001ae6
lea rcx, str.TLSCallbackThread_timeout_on_event_creation.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, ebx
jmp 0x140001b63
mov rcx, qword [0x140037050]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140001b31
cmp eax, 0xffffffff
jne 0x140001b12
lea rcx, str.TLSCallbackThread_wait_failed.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, ebx
jmp 0x140001b63
lea rcx, str.TLSCallbackThread_wait_abandoned.
cmp eax, 0x80
je 0x140001b27
lea rcx, str.TLSCallbackThread_timeout_on_event_wait.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, ebx
jmp 0x140001b63
mov eax, dword [0x140037060]
lea rcx, str.TLSCallbackThread_data_did_not_match.
cmp eax, 0xdeadbeef
jne 0x140001b4c
lea rcx, str.All_seems_fine_for_TLSCallbackThread.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x140037060]
mov ecx, r14d
cmp eax, 0xdeadbeef
setne cl
lea rdx, str.TLS_thread_attach_callback
call fcn.14000e640
cmp dword [0x14003702c], 0
mov r13d, 0x37
mov qword [rbp - 0x50], 3
mov qword [rsp + 0x38], 7
mov qword [rbp - 0x30], 0x1f
lea r14d, [r13 - 0x12]
mov qword [rsp + 0x40], 0x42
lea r15d, [r13 + 1]
mov qword [rbp - 0x68], 0x3d
lea r12d, [r13 - 5]
mov qword [rbp - 0x48], 0x41
mov qword [rbp - 0x38], 0x31
je 0x140003326
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rsp + 0x68]
mov ecx, 0x16
mov rbx, rax
lea rdx, [rsp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edi, word [rsp + 0x70]
lea edx, [r13 - 0x2a]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Debugger_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.1400063d0
movzx edx, di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Checking_IsDebuggerPresent_API
lea rcx, str.____s
call fcn.1400063d0
mov ebx, 0x40
mov edi, ebx
nop dword [rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140001c40
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, eax
lea rdx, str.Checking_IsDebuggerPresent_API
call fcn.14000e640
lea rdx, str.Checking_PEB.BeingDebugged
lea rcx, str.____s
call fcn.1400063d0
mov rdi, rsi
nop dword [rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140001c80
mov rax, qword gs:[0x60]
lea rdx, str.Checking_PEB.BeingDebugged
xor ecx, ecx
cmp byte [rax + 2], 1
sete cl
call fcn.14000e640
lea rdx, str.Checking_CheckRemoteDebuggerPresent_API
lea rcx, str.____s
call fcn.1400063d0
mov rdi, r13
nop word [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140001cd0
mov dword [rbp - 0x18], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov ecx, dword [rbp - 0x18]
lea rdx, str.Checking_CheckRemoteDebuggerPresent_API
call fcn.14000e640
lea rdx, str.Checking_PEB.NtGlobalFlag
lea rcx, str.____s
call fcn.1400063d0
mov edi, 0x45
nop
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140001d20
mov rax, qword gs:[0x60]
add rax, 0xbc
je 0x140001d4d
test byte [rax], 0x70
je 0x140001d4d
lea ecx, [rdi + 1]
jmp 0x140001d4f
xor ecx, ecx
lea rdx, str.Checking_PEB.NtGlobalFlag
call fcn.14000e640
lea rdx, str.Checking_ProcessHeap.Flags
lea rcx, str.____s
call fcn.1400063d0
mov rdi, rsi
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140001d71
xor r8d, r8d
lea ecx, [rdi + 6]
xor edx, edx
call fcn.140006bd0
mov rcx, qword gs:[0x60]
test al, al
mov rax, qword [rcx + 0x30]
je 0x140001da7
add rax, 0x70
jmp 0x140001dab
add rax, 0x14
xor ecx, ecx
lea rdx, str.Checking_ProcessHeap.Flags
cmp dword [rax], 2
seta cl
call fcn.14000e640
lea rdx, str.Checking_ProcessHeap.ForceFlags
lea rcx, str.____s
call fcn.1400063d0
mov edi, 0x3f
nop word [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140001de0
xor r8d, r8d
lea ecx, [rdi + 6]
xor edx, edx
call fcn.140006bd0
mov rcx, qword gs:[0x60]
test al, al
mov rax, qword [rcx + 0x30]
je 0x140001e16
add rax, 0x74
jmp 0x140001e1a
add rax, 0x18
xor ecx, ecx
lea rdx, str.Checking_ProcessHeap.ForceFlags
cmp dword [rax], ecx
seta cl
call fcn.14000e640
lea rdx, str.Checking_Low_Fragmentation_Heap
lea rcx, str.____s
call fcn.1400063d0
mov rdi, rbx
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140001e43
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea rcx, [rbp + 0x4c]
mov r8d, 0x110
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
mov r8b, 1
mov dword [rbp + 0x40], 0x11c
lea edx, [rdi + 2]
mov qword [rbp + 0x44], 6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 1
lea edx, [rdi + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8, rax
lea edx, [rdi + 3]
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x140001f15
xor edx, edx
lea rcx, [rbp + 0x19c]
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memset
mov r8b, 1
mov dword [rbp + 0x190], 0x11c
lea edx, [rdi + 2]
mov dword [rbp + 0x194], 6
xor ecx, ecx
mov dword [rbp + 0x198], 1
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 1
lea edx, [rdi + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8, rax
lea edx, [rdi + 3]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x140001f1c
lea rdi, [rbx + 0x178]
xor edx, edx
lea rcx, [rbp + 0x19c]
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memset
mov r8b, 1
mov dword [rbp + 0x190], 0x11c
mov edx, 2
mov dword [rbp + 0x194], 6
xor ecx, ecx
mov dword [rbp + 0x198], 2
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 3
lea rcx, [rbp + 0x190]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x140001f8f
lea rdi, [rbx + 0x170]
test rdi, rdi
je 0x140001fa3
cmp qword [rdi], 0
jne 0x140001fa3
mov ecx, 1
xor ebx, ebx
jmp 0x140001fa7
xor ebx, ebx
mov ecx, ebx
lea rdx, str.Checking_Low_Fragmentation_Heap
call fcn.14000e640
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugPort
lea rcx, str.____s
call fcn.1400063d0
mov edi, 0x26
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140001fd0
lea rdx, [0x140036180]
mov ecx, ebx
mov rax, rdx
nop
cmp dword [rax], 0x10
je 0x140002036
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140001ff0
mov rdi, rbx
mov qword [rbp - 0x18], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], rbx
lea r8, [rbp - 0x18]
mov ebx, 8
mov rcx, rax
mov r9d, ebx
lea edx, [rbx - 1]
call rdi
test eax, eax
jne 0x14000204e
cmp qword [rbp - 0x18], 0
je 0x14000204e
lea ecx, [rbx - 7]
jmp 0x140002050
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
je 0x140002000
mov rdi, qword [rdx + rcx*8 + 0x28]
jmp 0x140002003
xor ecx, ecx
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugPort
call fcn.14000e640
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugFlags
lea rcx, str.____s
call fcn.1400063d0
mov rdi, r14
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140002072
xor r8d, r8d
lea rdx, [0x140036180]
mov ecx, r8d
mov rax, rdx
cmp dword [rax], 0x10
je 0x1400020db
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140002094
mov rdi, r8
mov dword [rbp - 0x18], r8d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
mov qword [rsp + 0x20], 0
mov rcx, rax
lea r8, [rbp - 0x18]
lea edx, [r9 + 0x1b]
call rdi
test eax, eax
jne 0x1400020f3
cmp dword [rbp - 0x18], eax
jne 0x1400020f3
lea ecx, [rax + 1]
jmp 0x1400020f5
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], r8b
je 0x1400020a4
mov rdi, qword [rdx + rcx*8 + 0x28]
jmp 0x1400020a7
xor ecx, ecx
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugFlags
call fcn.14000e640
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugObject
lea rcx, str.____s
call fcn.1400063d0
mov edi, 0x24
nop dword [rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140002120
xor r8d, r8d
lea rdx, [0x140036180]
mov ecx, r8d
mov rax, rdx
cmp dword [rax], 0x10
je 0x140002189
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140002142
mov rdi, r8
mov qword [rbp - 0x18], r8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov rcx, rax
lea r8, [rbp - 0x18]
mov edx, 0x1e
call rdi
cmp eax, 0xc0000353
je 0x1400021a1
mov ebx, 1
mov ecx, ebx
jmp 0x1400021ff
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], r8b
je 0x140002152
mov rdi, qword [rdx + rcx*8 + 0x28]
jmp 0x140002155
cmp qword [rbp - 0x18], 0
je 0x1400021b1
mov ebx, 1
mov ecx, ebx
jmp 0x1400021ff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, ebx
lea r8, [rbp - 0x18]
mov rcx, rax
mov edx, 0x1e
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
call rdi
cmp eax, 0xc0000353
je 0x1400021e1
mov ebx, 1
mov ecx, ebx
jmp 0x1400021ff
mov rax, qword [rbp - 0x18]
test rax, rax
jne 0x1400021f3
mov ebx, 1
mov ecx, ebx
jmp 0x1400021ff
xor ecx, ecx
cmp eax, ebx
mov ebx, 1
setne cl
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugObject
call fcn.14000e640
lea rdx, str.Checking_WudfIsAnyDebuggerPresent_API
lea rcx, str.____s
call fcn.1400063d0
mov edi, 0x39
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140002223
lea rdx, [0x140036180]
mov ecx, edi
mov rax, rdx
cmp dword [rax], 0x1c
je 0x140002883
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140002241
mov ecx, edi
lea rdx, str.Checking_WudfIsAnyDebuggerPresent_API
call fcn.14000e640
lea rdx, str.Checking_WudfIsKernelDebuggerPresent_API
lea rcx, str.____s
call fcn.1400063d0
mov edi, 0x36
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140002280
lea rdx, [0x140036180]
mov ecx, edi
mov rax, rdx
nop
cmp dword [rax], 0x1d
je 0x1400028e5
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x1400022a0
mov ecx, edi
lea rdx, str.Checking_WudfIsKernelDebuggerPresent_API
call fcn.14000e640
lea rdx, str.Checking_WudfIsUserDebuggerPresent_API
lea rcx, str.____s
call fcn.1400063d0
mov rdi, r15
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x1400022e0
lea rdx, [0x140036180]
mov ecx, edi
mov rax, rdx
nop
cmp dword [rax], 0x1e
je 0x140002945
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140002300
mov ecx, edi
lea rdx, str.Checking_WudfIsUserDebuggerPresent_API
call fcn.14000e640
lea rdx, str.Checking_NtSetInformationThread_with_ThreadHideFromDebugger
lea rcx, str.____s
call fcn.1400063d0
mov edi, 0x23
nop word [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140002340
call fcn.1400069b0
lea rdx, str.Checking_NtSetInformationThread_with_ThreadHideFromDebugger
mov ecx, eax
call fcn.14000e640
lea rdx, str.Checking_CloseHandle_with_an_invalide_handle
lea rcx, str.____s
call fcn.1400063d0
mov rdi, r12
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140002380
call fcn.140006850
lea rdx, str.Checking_CloseHandle_with_an_invalide_handle
mov ecx, eax
call fcn.14000e640
lea rdx, str.Checking_NtSystemDebugControl
lea rcx, str.____s
call fcn.1400063d0
mov edi, 0x42
nop dword [rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x1400023c0
lea rdx, [0x140036180]
mov ecx, edi
mov rax, rdx
nop
cmp dword [rax], 0xb
je 0x1400029a5
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x1400023e0
mov rax, rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea ecx, [rdx + 0x14]
call rax
cmp eax, 0xc0000354
lea rdx, str.Checking_NtSystemDebugControl
mov ecx, edi
setne cl
call fcn.14000e640
lea rdx, str.Checking_UnhandledExcepFilterTest
lea rcx, str.____s
call fcn.1400063d0
mov edi, 0x3d
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140002440
lea rcx, [0x14000b420]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc000008e
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_RaiseException]
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], dil
je 0x140002255
mov ecx, edi
mov rax, rdx
nop dword [rax]
cmp dword [rax], 0x1c
je 0x1400028c1
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x1400028a0
mov rax, rdi
call rax
test eax, eax
mov ecx, edi
setne cl
jmp 0x140002257
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], dil
je 0x1400028b0
mov rax, qword [rdx + rcx*8 + 0x28]
call rax
test eax, eax
mov ecx, edi
setne cl
jmp 0x140002257
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], dil
je 0x1400022b4
mov ecx, edi
mov rax, rdx
nop
cmp dword [rax], 0x1d
je 0x140002921
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140002900
mov rax, rdi
call rax
test eax, eax
mov ecx, edi
setne cl
jmp 0x1400022b6
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], dil
je 0x140002910
mov rax, qword [rdx + rcx*8 + 0x28]
call rax
test eax, eax
mov ecx, edi
setne cl
jmp 0x1400022b6
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], dil
je 0x140002314
mov ecx, edi
mov rax, rdx
nop
cmp dword [rax], 0x1e
je 0x140002981
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140002960
mov rax, rdi
call rax
test eax, eax
mov ecx, edi
setne cl
jmp 0x140002316
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], dil
je 0x140002970
mov rax, qword [rdx + rcx*8 + 0x28]
call rax
test eax, eax
mov ecx, edi
setne cl
jmp 0x140002316
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], dil
je 0x1400023f4
mov rax, qword [rdx + rcx*8 + 0x28]
jmp 0x1400023f7
cmp dword [0x140037028], 0
mov esi, 0x28
lea r12d, [rsi + 3]
lea r13d, [rsi + 0x12]
lea r15d, [rsi + 0xd]
je 0x14000379b
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rsp + 0x68]
mov ecx, 0x16
mov rbx, rax
lea rdx, [rsp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edi, word [rsp + 0x70]
lea edx, [rsi - 0x1b]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.DLL_Injection_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.1400063d0
movzx edx, di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__32_bit_
lea rcx, str.____s
call fcn.1400063d0
mov edi, esi
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x1400033b3
lea ecx, [rdi + 1]
call fcn.140009a10
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__32_bit_
mov ecx, eax
call fcn.14000e640
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__64_bit_
lea rcx, str.____s
call fcn.1400063d0
mov rdi, rsi
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x1400033f1
lea ecx, [rdi + 2]
call fcn.140009a10
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__64_bit_
mov ecx, eax
call fcn.14000e640
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__ALL_
lea rcx, str.____s
call fcn.1400063d0
mov rdi, r12
nop
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140003430
lea ecx, [rdi + 3]
call fcn.140009a10
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__ALL_
mov ecx, eax
call fcn.14000e640
lea rdx, str.Enumerating_modules_with_ToolHelp32
lea rcx, str.____s
call fcn.1400063d0
mov edi, 0x3b
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140003470
xor bl, bl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400034b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_snapshot._Last_error:__u_n
call fcn.14000b0e0
jmp 0x140003551
xor edx, edx
lea rcx, [rbp + 0x5b4]
mov r8d, 0x434
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x5b0]
mov dword [rbp + 0x5b0], 0x438
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140003534
nop dword [rax]
mov edx, 0xffffffff
lea rcx, [rbp + 0x7e0]
call fcn.140009670
movzx edi, al
test al, al
je 0x14000351b
lea rdx, [rbp + 0x7e0]
lea rcx, str._____Injected_library:__S_n
call fcn.14000b0e0
lea rdx, [rbp + 0x5b0]
mov rcx, rsi
or bl, dil
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400034f0
jmp 0x140003548
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_first_module._Last_error:__u_n
call fcn.14000b0e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
lea rdx, str.Enumerating_modules_with_ToolHelp32
mov ecx, esi
test bl, bl
setne cl
call fcn.14000e640
lea rdx, str.Enumerating_the_process_LDR_via_LdrEnumerateLoadedModules
lea rcx, str.____s
call fcn.1400063d0
nop dword [rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub r14, 1
jne 0x140003580
lea rdx, [0x140036180]
mov ecx, esi
mov rax, rdx
nop
cmp dword [rax], 9
je 0x1400035b7
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x1400035a0
mov ecx, esi
jmp 0x140003683
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], sil
jne 0x1400035cf
mov ecx, esi
jmp 0x140003683
mov ecx, esi
mov rax, rdx
cmp dword [rax], 9
je 0x14000362b
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x1400035d4
mov rdi, rsi
mov ecx, 0x18
call fcn.140011720
mov r8, rax
lea rdx, [0x14000ab80]
xor ecx, ecx
mov rbx, rax
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
call rdi
test eax, eax
je 0x140003643
mov edx, eax
lea rcx, str.LdrEnumerateLoadedModules_failed._Status:__x_n
call fcn.14000b0e0
mov rcx, rbx
call fcn.14000ac60
mov ecx, esi
jmp 0x140003683
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], sil
je 0x1400035e4
mov rdi, qword [rdx + rcx*8 + 0x28]
jmp 0x1400035e7
mov r14, qword [rbx + 8]
mov rdi, qword [rbx]
cmp rdi, r14
je 0x140003671
nop
movups xmm2, xmmword [rdi + 0x40]
mov rcx, qword [rdi + 0x50]
pextrw edx, xmm2, 4
call fcn.140009670
or sil, al
add rdi, 0x88
cmp rdi, r14
jne 0x140003650
mov rcx, rbx
call fcn.14000ac60
xor eax, eax
test sil, sil
mov ecx, eax
setne cl
lea rdx, str.Enumerating_the_process_LDR_via_LdrEnumerateLoadedModules
call fcn.14000e640
lea rdx, str.Enumerating_the_process_LDR_directly
lea rcx, str.____s
call fcn.1400063d0
mov rdi, r13
nop word [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x1400036b0
call fcn.14000a440
lea rdx, str.Enumerating_the_process_LDR_directly
mov ecx, eax
call fcn.14000e640
lea rdx, str.Walking_process_memory_with_GetModuleInformation
lea rcx, str.____s
call fcn.1400063d0
mov edi, 0x2e
nop dword [rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x1400036f0
call fcn.140009c90
lea rdx, str.Walking_process_memory_with_GetModuleInformation
mov ecx, eax
call fcn.14000e640
lea rdx, str.Walking_process_memory_for_hidden_modules
lea rcx, str.____s
call fcn.1400063d0
mov rdi, r15
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140003730
call fcn.140009f20
lea rdx, str.Walking_process_memory_for_hidden_modules
mov ecx, eax
call fcn.14000e640
lea rdx, str.Walking_process_memory_for_.NET_module_structures
lea rcx, str.____s
call fcn.1400063d0
lea r12d, [rdi + 0x2d]
nop dword [rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub r12, 1
jne 0x140003770
call fcn.14000a200
lea rdx, str.Walking_process_memory_for_.NET_module_structures
mov ecx, eax
call fcn.14000e640
mov r12d, 0x2b
cmp dword [0x140037024], 0
je 0x140003f77
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rsp + 0x68]
mov ecx, 0x16
mov rbx, rax
lea rdx, [rsp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edi, word [rsp + 0x70]
mov edx, 0xd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Generic_Sandboxe_VM_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.1400063d0
movzx edx, di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Checking_SetupDi_diskdrive
lea rcx, str.____s
call fcn.1400063d0
mov ebx, 0x44
mov edi, ebx
nop
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140003820
call fcn.14000b6c0
lea rdx, str.Checking_SetupDi_diskdrive
mov ecx, eax
call fcn.14000e640
lea rdx, str.Checking_SerialNumber_from_BIOS_using_WMI
lea rcx, str.____s
call fcn.1400063d0
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub r15, 1
jne 0x140003860
call fcn.14000b8d0
lea rdx, str.Checking_SerialNumber_from_BIOS_using_WMI
mov ecx, eax
call fcn.14000e640
lea rdx, str.Checking_Model_from_ComputerSystem_using_WMI
lea rcx, str.____s
call fcn.1400063d0
lea r13d, [r15 + 0x32]
nop dword [rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub r13, 1
jne 0x1400038a0
call fcn.14000bb40
lea rdx, str.Checking_Model_from_ComputerSystem_using_WMI
mov ecx, eax
call fcn.14000e640
lea rdx, str.Checking_Manufacturer_from_ComputerSystem_using_WMI
lea rcx, str.____s
call fcn.1400063d0
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub r12, 1
jne 0x1400038e0
call fcn.14000bd90
lea rdx, str.Checking_Manufacturer_from_ComputerSystem_using_WMI
mov ecx, eax
call fcn.14000e640
lea rdx, str.Checking_Current_Temperature_using_WMI
lea rcx, str.____s
call fcn.1400063d0
lea r13d, [r12 + 0x38]
nop dword [rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub r13, 1
jne 0x140003920
call fcn.14000bff0
lea rdx, str.Checking_Current_Temperature_using_WMI
mov ecx, eax
call fcn.14000e640
lea rdx, str.Checking_CPU_fan_using_WMI
lea rcx, str.____s
call fcn.1400063d0
mov r13d, 0x3a
nop
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rbx, 1
jne 0x140003960
xor r15d, r15d
lea r8, str.ROOTCIMV2
lea rdx, [rbp - 0x28]
mov qword [rbp - 0x58], r15
lea rcx, [rbp - 0x58]
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x60], r15
mov r12d, r15d
mov ebx, r15d
call fcn.140010de0
test eax, eax
je 0x140003ac4
lea rcx, [0x140019b50]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_Fan
mov r14, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r15d, 1
mov rsi, rax
test r14, r14
je 0x140003a35
test rax, rax
je 0x140003a2c
mov rcx, qword [rbp - 0x58]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
lea r9d, [r15 + 0x2f]
xor eax, eax
mov r8, rsi
mov qword [rsp + 0x20], rax
mov rdx, qword [rcx]
mov rdi, qword [rdx + 0xa0]
mov rdx, r14
call rdi
test eax, eax
jns 0x140003a2c
xor eax, eax
lea rcx, str.ExecQuery
mov r15d, eax
call fcn.14000e770
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rsi, rsi
je 0x140003a43
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r15d, r15d
je 0x140003ac1
mov rcx, qword [rbp - 0x60]
xor r15d, r15d
mov qword [rbp - 0x40], r15
mov dword [rbp - 0x18], r15d
test rcx, rcx
je 0x140003a97
nop dword [rax]
mov rax, qword [rcx]
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x40]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
cmp dword [rbp - 0x18], r12d
je 0x140003a97
mov rcx, qword [rbp - 0x40]
inc ebx
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
jne 0x140003a60
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
test ebx, ebx
jne 0x140003aca
jmp 0x140003ac4
xor r15d, r15d
mov r12d, 1
lea rdx, str.Checking_CPU_fan_using_WMI
mov ecx, r12d
call fcn.14000e640
lea rdx, str.Checking_Win32_VoltageProbe_with_WMI
lea rcx, str.____s
call fcn.1400063d0
nop dword [rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub r13, 1
jne 0x140003af0
lea rcx, str.SELECT__FROM_Win32_VoltageProbe
call fcn.14000c1f0
test eax, eax
lea rdx, str.Checking_Win32_VoltageProbe_with_WMI
mov ecx, r15d
sete cl
call fcn.14000e640
lea rdx, str.Checking_ThermalZoneInfo_performance_counters_with_WMI
lea rcx, str.____s
call fcn.1400063d0
lea edi, [r13 + 0x28]
nop dword [rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140003b40
lea rcx, str.SELECT__FROM_Win32_PerfFormattedData_Counters_ThermalZoneInformation
call fcn.14000c1f0
test eax, eax
lea rdx, str.Checking_ThermalZoneInfo_performance_counters_with_WMI
mov ecx, r15d
sete cl
call fcn.14000e640
lea rdx, str.Checking_CIM_Sensor_with_WMI
lea rcx, str.____s
call fcn.1400063d0
mov edi, 0x42
nop word [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140003b90
lea rcx, str.SELECT__FROM_CIM_Sensor
call fcn.14000c1f0
test eax, eax
lea rdx, str.Checking_CIM_Sensor_with_WMI
mov ecx, r15d
sete cl
call fcn.14000e640
lea rdx, str.Checking_CIM_NumericSensor_with_WMI
lea rcx, str.____s
call fcn.1400063d0
mov r12d, 0x3b
mov edi, r12d
nop
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140003be0
lea rcx, str.SELECT__FROM_CIM_NumericSensor
call fcn.14000c1f0
test eax, eax
lea rdx, str.Checking_CIM_NumericSensor_with_WMI
mov ecx, r15d
sete cl
call fcn.14000e640
lea rdx, str.Checking_CIM_TemperatureSensor_with_WMI
lea rcx, str.____s
call fcn.1400063d0
lea ebx, [rdi + 0x37]
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rbx, 1
jne 0x140003c30
lea rcx, str.SELECT__FROM_CIM_TemperatureSensor
call fcn.14000c1f0
test eax, eax
lea rdx, str.Checking_CIM_TemperatureSensor_with_WMI
mov ecx, r15d
sete cl
call fcn.14000e640
lea rdx, str.Checking_CIM_VoltageSensor_with_WMI
lea rcx, str.____s
call fcn.1400063d0
mov rdi, r12
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140003c80
lea rcx, str.SELECT__FROM_CIM_VoltageSensor
call fcn.14000c1f0
test eax, eax
lea rdx, str.Checking_CIM_VoltageSensor_with_WMI
mov ecx, r15d
sete cl
call fcn.14000e640
lea rdx, str.Checking_if_Windows_is_Genuine
lea rcx, str.____s
call fcn.1400063d0
lea ebx, [rdi + 0x40]
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rbx, 1
jne 0x140003cd0
xor r8d, r8d
mov dword [rbp], 0x55c92734
lea rdx, [rbp - 8]
mov dword [rbp + 4], 0x4d71d682
lea rcx, [rbp]
mov dword [rbp + 8], 0xecd63e98
mov dword [rbp + 0xc], 0x9f05163f
call qword [sym.imp.SLWGA.dll_SLIsGenuineLocal]
mov ebx, 0x28
test eax, eax
jne 0x140003d21
cmp dword [rbp - 8], 0
lea ecx, [rbx - 0x27]
jne 0x140003d24
mov ecx, r15d
lea rdx, str.Checking_if_Windows_is_Genuine
call fcn.14000e640
lea rdx, str.Checking_ServicesDiskEnum_entries_for_VM_strings
lea rcx, str.____s
call fcn.1400063d0
mov edi, 0x2c
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140003d50
lea rax, str.qemu
mov qword [rbp - 0x58], r15
mov qword [rbp + 0x40], rax
lea rdx, str.SystemCurrentControlSetServicesDiskEnum
lea rax, str.virtio
mov dword [rbp - 0x10], r15d
mov qword [rbp + 0x48], rax
mov r9d, 0x20019
lea rax, str.vmware
mov dword [rbp - 8], 4
mov qword [rbp + 0x50], rax
xor r8d, r8d
lea rax, str.vbox
mov rcx, 0xffffffff80000002
mov qword [rbp + 0x58], rax
mov r14d, r15d
lea rax, [0x140017028]
mov qword [rbp + 0x60], rax
lea rax, [0x140017030]
mov qword [rbp + 0x68], rax
lea rax, str.Virtual
mov qword [rbp + 0x70], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003e2d
mov rcx, qword [rbp - 0x58]
lea rax, [rbp - 8]
mov qword [rsp + 0x28], rax
lea rdx, str.Count
lea rax, [rbp - 0x10]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x58]
test eax, eax
je 0x140003e27
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140003f27
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp - 0x10], 0
mov esi, r15d
jbe 0x140003f27
nop word [rax + rax]
mov r9d, esi
lea r8, [0x140017044]
mov edx, 0xb
lea rcx, [rsp + 0x68]
call fcn.140006790
mov ebx, r15d
lea rdi, [rbp + 0x40]
xor edx, edx
mov qword [rbp - 0x60], r15
mov r8d, 0x800
lea rcx, [rbp + 0x5b0]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp - 0x60]
mov dword [rbp - 0x18], 0x104
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetServicesDiskEnum
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003ef6
mov rcx, qword [rbp - 0x60]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x68]
lea rax, [rbp + 0x5b0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003eec
mov rdx, qword [rdi]
lea rcx, [rbp + 0x5b0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140003f12
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
add rdi, 8
cmp ebx, 7
jb 0x140003e60
inc esi
cmp esi, dword [rbp - 0x10]
jb 0x140003e40
jmp 0x140003f22
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14d, 1
mov ebx, 0x28
lea rdx, str.Checking_ServicesDiskEnum_entries_for_VM_strings
mov ecx, r14d
call fcn.14000e640
lea rdx, str.Checking_EnumIDE_and_EnumSCSI_entries_for_VM_strings
lea rcx, str.____s
call fcn.1400063d0
nop dword [rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rbx, 1
jne 0x140003f50
call fcn.14000c3c0
lea rdx, str.Checking_EnumIDE_and_EnumSCSI_entries_for_VM_strings
mov ecx, eax
call fcn.14000e640
jmp 0x140003f7d
mov r12d, 0x3b
cmp dword [0x140037020], 0
lea rsi, [0x140017760]
lea r14, str.Identifier
lea r13, str.HARDWAREDescriptionSystem
je 0x140004627
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rsp + 0x68]
mov ecx, 0x16
mov rbx, rax
lea rdx, [rsp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edi, word [rsp + 0x70]
mov edx, 0xd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.VirtualBox_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.1400063d0
movzx edx, di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.VBOX
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x50], rax
lea rcx, str.SystemBiosVersion
mov qword [rbp + 0x68], rax
mov r14d, 3
lea rax, str.SystemBiosDate
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x78], rax
lea rsi, [rbp + 0x48]
lea rax, str.06_23_99
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x70], r13
lea r15d, [r14 - 2]
mov qword [rbp + 0x80], rax
xor r13d, r13d
mov qword [rbp + 0x60], rcx
nop
xor edx, edx
mov word [rbp + 0x190], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0x192]
call sub.VCRUNTIME140.dll_memset
mov rdi, qword [rsi + 8]
lea r8, str.Checking_reg_key_HARDWAREDescriptionSystem____s_is_set_to__s
mov r9, qword [rsi]
lea rcx, [rbp + 0x190]
mov edx, pe_nt_image_headers64
mov qword [rsp + 0x20], rdi
call fcn.140006790
mov r8, qword [rsi]
mov r9, rdi
mov rdx, qword [rsi - 8]
call fcn.14000ecb0
lea rdx, [rbp + 0x190]
lea rcx, str.____s
test eax, eax
je 0x1400040f6
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x1400040c4
mov edi, 0x5f
sub rdi, rax
je 0x1400040f1
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, r15
jne 0x1400040e0
mov ecx, r15d
jmp 0x140004137
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140004110
mov edi, 0x5f
sub rdi, rax
je 0x140004135
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, r15
jne 0x140004124
xor ecx, ecx
lea rdx, [rbp + 0x190]
call fcn.14000e640
add rsi, 0x18
sub r14, r15
jne 0x140004050
lea rdx, str.Checking_VirtualBox_Guest_Additions_directory
lea rcx, str.____s
call fcn.1400063d0
lea r15d, [r14 + 0x49]
lea r13, str.HARDWAREDescriptionSystem
nop
lea rcx, [0x140018e78]
call fcn.1400063d0
sub qword [rbp - 0x38], 1
jne 0x140004170
xor r14d, r14d
lea rcx, [rbp + 0x3a2]
xor edx, edx
mov word [rbp + 0x3a0], r14w
mov r8d, 0x206
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [str.oracle_virtualbox_guest_additions_]
lea rcx, [rbp + 0x1d6]
movaps xmm1, xmmword [0x140017cb0]
xor edx, edx
mov eax, dword [0x140017ce0]
mov r8d, 0x1c2
movaps xmmword [rbp + 0x190], xmm0
movaps xmm0, xmmword [0x140017cc0]
movaps xmmword [rbp + 0x1a0], xmm1
movaps xmm1, xmmword [0x140017cd0]
mov dword [rbp + 0x1d0], eax
movzx eax, word [0x140017ce4]
movaps xmmword [rbp + 0x1b0], xmm0
movaps xmmword [rbp + 0x1c0], xmm1
mov word [rbp + 0x1d4], ax
call sub.VCRUNTIME140.dll_memset
call fcn.14000ebf0
lea rdx, [rbp + 0x5b0]
test eax, eax
je 0x14000422d
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x14000423c
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x190]
lea rdx, [rbp + 0x5b0]
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140004276
test al, 0x10
je 0x140004276
mov esi, 1
mov ecx, esi
jmp 0x14000427e
mov ecx, r14d
mov esi, 1
lea rdx, str.Checking_VirtualBox_Guest_Additions_directory
call fcn.14000e640
lea rax, str.HARDWAREACPIDSDTVBOX__
mov qword [rbp + 0x40], rax
lea rbx, [rbp + 0x40]
lea rax, str.HARDWAREACPIFADTVBOX__
mov qword [rbp + 0x48], rax
lea rax, str.HARDWAREACPIRSDTVBOX__
mov qword [rbp + 0x50], rax
lea rax, str.SOFTWAREOracleVirtualBox_Guest_Additions
mov qword [rbp + 0x58], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxGuest
mov qword [rbp + 0x60], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxMouse
mov qword [rbp + 0x68], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxService
mov qword [rbp + 0x70], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxSF
mov qword [rbp + 0x78], rax
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x190], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x192]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, [0x1400173e0]
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x190]
call fcn.140006790
mov rdx, qword [rbx]
lea rax, [rbp - 0x38]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 0x38], r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400043aa
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x190]
lea rcx, str.____s
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140004380
mov edi, 0x5f
sub rdi, rax
je 0x1400043a6
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140004394
mov ecx, esi
jmp 0x1400043f8
lea rdx, [rbp + 0x190]
lea rcx, str.____s
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400043d0
mov edi, 0x5f
sub rdi, rax
je 0x1400043f6
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x1400043e4
xor ecx, ecx
lea rdx, [rbp + 0x190]
call fcn.14000e640
add rbx, 8
sub qword [rsp + 0x30], 1
jne 0x1400042f0
lea rdx, str.Checking_Mac_Address_start_with_08:00:27
lea rcx, str.____s
call fcn.1400063d0
mov edi, 0x36
nop dword [rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140004430
lea rcx, [0x140017ce8]
call fcn.14000eda0
lea rdx, str.Checking_Mac_Address_start_with_08:00:27
mov ecx, eax
call fcn.14000e640
lea rdx, str.Checking_Win32_PnPDevice_DeviceId_from_WMI_for_VBox_PCI_device
lea rcx, str.____s
call fcn.1400063d0
mov edi, 0x20
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140004474
call fcn.14000cbf0
lea rdx, str.Checking_Win32_PnPDevice_DeviceId_from_WMI_for_VBox_PCI_device
mov ecx, eax
call fcn.14000e640
lea rdx, str.Checking_Win32_BaseBoard_from_WMI
lea rcx, str.____s
call fcn.1400063d0
nop dword [rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub qword [rbp - 0x68], 1
jne 0x1400044b0
call fcn.14000ce20
lea rdx, str.Checking_Win32_BaseBoard_from_WMI
mov ecx, eax
call fcn.14000e640
lea rdx, str.Checking_MAC_address_from_WMI
lea rcx, str.____s
call fcn.1400063d0
mov edi, 0x41
nop
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x1400044f0
call fcn.14000c850
lea rdx, str.Checking_MAC_address_from_WMI
mov ecx, eax
call fcn.14000e640
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, str.____s
call fcn.1400063d0
mov edi, 0x45
nop dword [rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140004530
lea r8, [rbp - 0x18]
mov dword [rbp - 0x18], r14d
xor edx, edx
mov ecx, 0x52534d42
mov ebx, r14d
call fcn.1400110b0
mov rdx, rax
test rax, rax
je 0x1400045d5
mov edi, dword [rbp - 0x18]
mov rcx, r14
lea rax, [rdi - 0xa]
test rax, rax
je 0x140004597
movabs r8, 0x426c617574726956
nop word [rax + rax]
cmp qword [rcx + rdx], r8
jne 0x14000458f
cmp word [rcx + rdx + 8], 0x786f
je 0x1400045ca
inc rcx
cmp rcx, rax
jb 0x140004580
lea rcx, [rdi - 4]
mov rax, r14
test rcx, rcx
je 0x1400045cc
cmp dword [rax + rdx], 0x786f6276
je 0x1400045ca
inc rax
cmp rax, rcx
jb 0x1400045a3
mov rax, r14
cmp dword [rax + rdx], 0x584f4256
je 0x1400045ca
inc rax
cmp rax, rcx
jb 0x1400045b7
jmp 0x1400045cc
mov ebx, esi
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_SMBIOS_firmware
mov ecx, ebx
call fcn.14000e640
lea rdx, str.Checking_ACPI_tables
lea rcx, str.____s
call fcn.1400063d0
mov rdi, r15
nop dword [rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140004600
call fcn.14000ca80
lea rdx, str.Checking_ACPI_tables
mov ecx, eax
call fcn.14000e640
jmp 0x14000462a
xor r14d, r14d
cmp dword [0x14003701c], 0
je 0x140004c7b
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rsp + 0x68]
mov ecx, 0x16
mov rbx, rax
lea rdx, [rsp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edi, word [rsp + 0x70]
mov edx, 0xd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.VMWare_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.1400063d0
movzx edx, di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.SystemManufacturer
mov esi, 2
lea rdx, str.SYSTEMControlSet001ControlSystemInformation
mov qword [rsp + 0x70], rax
lea rcx, str.VMWARE
mov qword [rsp + 0x68], rdx
lea rax, str.SystemProductName
mov qword [rsp + 0x78], rcx
mov qword [rbp - 0x78], rax
lea rbx, [rsp + 0x78]
mov qword [rbp - 0x80], rdx
lea r15d, [rsi - 1]
mov qword [rbp - 0x70], rcx
nop dword [rax + rax]
xor edx, edx
mov word [rbp + 0x190], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x192]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx - 0x10]
lea r8, str.Checking_reg_key__s
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x190]
call fcn.140006790
mov r9, qword [rbx]
mov r8, qword [rbx - 8]
mov rdx, qword [rbx - 0x10]
call fcn.14000ecb0
lea rdx, [rbp + 0x190]
lea rcx, str.____s
test eax, eax
je 0x14000477a
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140004750
mov edi, 0x5f
sub rdi, rax
je 0x140004775
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, r15
jne 0x140004764
mov ecx, r15d
jmp 0x1400047b7
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140004790
mov edi, 0x5f
sub rdi, rax
je 0x1400047b5
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, r15
jne 0x1400047a4
xor ecx, ecx
lea rdx, [rbp + 0x190]
call fcn.14000e640
add rbx, 0x18
sub rsi, r15
jne 0x1400046e0
xor edx, edx
mov word [rbp + 0x190], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x192]
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREVMware__Inc.VMware_Tools
mov edx, pe_nt_image_headers64
lea r8, [0x1400173e0]
lea rcx, [rbp + 0x190]
call fcn.140006790
lea rax, [rbp - 0x68]
mov qword [rbp - 0x68], r14
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREVMware__Inc.VMware_Tools
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004896
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x190]
lea rcx, str.____s
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140004864
mov edi, 0x5f
sub rdi, rax
je 0x140004891
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, r15
jne 0x140004880
mov ecx, r15d
jmp 0x1400048e7
lea rdx, [rbp + 0x190]
lea rcx, str.____s
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400048c0
mov edi, 0x5f
sub rdi, rax
je 0x1400048e5
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, r15
jne 0x1400048d4
xor ecx, ecx
lea rdx, [rbp + 0x190]
call fcn.14000e640
lea rax, str.System32drivers_vmmouse.sys
mov word [rbp + 0x5b0], r14w
mov qword [rbp + 0x40], rax
lea rcx, [rbp + 0x5b2]
lea rax, str.System32drivers_vm3dmp.sys
xor edx, edx
mov qword [rbp + 0x48], rax
mov r8d, 0x206
lea rax, str.System32drivers_vmci.sys
mov qword [rbp + 0x50], rax
lea rax, str.System32drivers_vmhgfs.sys
mov qword [rbp + 0x58], rax
lea rax, str.System32drivers_vmmemctl.sys
mov qword [rbp + 0x60], rax
lea rax, str.System32drivers_vmrawdsk.sys
mov qword [rbp + 0x68], rax
lea rax, str.System32drivers_vmusbmouse.sys
mov qword [rbp + 0x70], rax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov word [rbp + 0x3a0], r14w
mov r8d, 0x206
lea rcx, [rbp + 0x3a2]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x104
mov qword [rbp - 0x68], r14
lea rcx, [rbp + 0x5b0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call fcn.14000ebf0
test eax, eax
je 0x1400049a1
lea rcx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov rbx, r14
mov r15d, 1
nop word [rax + rax]
mov r8, qword [rbp + rbx*8 + 0x40]
lea rdx, [rbp + 0x5b0]
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edx, edx
mov word [rbp + 0x190], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x192]
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x3a0]
mov edx, pe_nt_image_headers64
lea r8, str.Checking_file__s
lea rcx, [rbp + 0x190]
call fcn.140006790
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140004a6a
test al, 0x10
jne 0x140004a6a
lea rdx, [rbp + 0x190]
lea rcx, str.____s
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140004a40
mov edi, 0x5f
sub rdi, rax
je 0x140004a65
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, r15
jne 0x140004a54
mov ecx, r15d
jmp 0x140004ab7
lea rdx, [rbp + 0x190]
lea rcx, str.____s
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140004a90
mov edi, 0x5f
sub rdi, rax
je 0x140004ab5
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, r15
jne 0x140004aa4
xor ecx, ecx
lea rdx, [rbp + 0x190]
call fcn.14000e640
inc rbx
cmp rbx, 7
jl 0x1400049b0
call fcn.14000ebf0
mov r15d, 0x49
test eax, eax
je 0x140004ae9
lea rcx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, str.____s
call fcn.1400063d0
mov edi, 0x45
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140004b01
lea r8, [rbp - 0x18]
mov dword [rbp - 0x18], r14d
xor edx, edx
mov ecx, 0x52534d42
mov edi, r14d
call fcn.1400110b0
test rax, rax
je 0x140004b6a
mov edx, dword [rbp - 0x18]
mov rcx, r14
sub rdx, 6
je 0x140004b61
nop dword [rax + rax]
cmp dword [rcx + rax], 0x61774d56
jne 0x140004b52
cmp word [rcx + rax + 4], 0x6572
je 0x140004b5c
inc rcx
cmp rcx, rdx
jb 0x140004b40
jmp 0x140004b61
mov edi, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_SMBIOS_firmware
mov ecx, edi
call fcn.14000e640
lea rdx, str.Checking_ACPI_tables
lea rcx, str.____s
call fcn.1400063d0
mov rdi, r15
nop
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140004b90
mov ecx, 0x1000
mov esi, r14d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
jne 0x140004bbf
mov esi, eax
jmp 0x140004c6d
xor eax, eax
mov rdi, r14
mov ecx, 0x1000
mov rdx, r14
rep stosb byte [rdi], al
call fcn.140011020
mov ecx, eax
cmp eax, 0xffffffff
jne 0x140004be3
xor eax, eax
mov esi, eax
jmp 0x140004c6d
shr eax, 2
cmp ecx, 4
jb 0x140004c5f
test eax, eax
je 0x140004c5f
mov rdi, r14
mov ebx, eax
mov r15d, 1
xor r13d, r13d
nop dword [rax]
mov edx, dword [rdi]
lea r8, [rbp - 0x18]
mov ecx, 0x41435049
mov dword [rbp - 0x18], r13d
call fcn.1400110b0
test rax, rax
je 0x140004c4d
mov edx, dword [rbp - 0x18]
mov rcx, r13
sub rdx, 6
je 0x140004c44
cmp dword [rcx + rax], 0x41574d56
jne 0x140004c37
cmp word [rcx + rax + 4], 0x4552
je 0x140004c41
inc rcx
cmp rcx, rdx
jb 0x140004c25
jmp 0x140004c44
mov esi, r15d
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add rdi, 4
sub rbx, r15
jne 0x140004c00
lea r13, str.HARDWAREDescriptionSystem
jmp 0x140004c64
mov esi, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_ACPI_tables
mov ecx, esi
call fcn.14000e640
cmp dword [0x140037018], 0
je 0x140004f31
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rsp + 0x68]
mov ecx, 0x16
mov rbx, rax
lea rdx, [rsp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edi, word [rsp + 0x70]
mov edx, 0xd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Virtual_PC_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.1400063d0
movzx edx, di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.VMSrvc.exe
mov esi, 2
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x48]
lea rax, str.VMUSrvc.exe
xor r14d, r14d
mov qword [rsp + 0x50], rax
lea r15d, [rsi - 1]
nop dword [rax]
xor edx, edx
mov word [rbp + 0x190], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x192]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, str.Checking_Virtual_PC_processes__s
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x190]
call fcn.140006790
mov rcx, qword [rbx]
call fcn.140010cd0
lea rdx, [rbp + 0x190]
lea rcx, str.____s
test eax, eax
je 0x140004da6
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140004d74
mov edi, 0x5f
sub rdi, rax
je 0x140004da1
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, r15
jne 0x140004d90
mov ecx, r15d
jmp 0x140004de7
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140004dc0
mov edi, 0x5f
sub rdi, rax
je 0x140004de5
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, r15
jne 0x140004dd4
xor ecx, ecx
lea rdx, [rbp + 0x190]
call fcn.14000e640
add rbx, 8
sub rsi, r15
jne 0x140004d10
xor edx, edx
mov word [rbp + 0x190], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x192]
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
mov edx, pe_nt_image_headers64
lea r8, [0x1400173e0]
lea rcx, [rbp + 0x190]
call fcn.140006790
lea rax, [rbp - 0x68]
mov qword [rbp - 0x68], r14
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004ed2
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x190]
lea rcx, str.____s
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140004e94
mov edi, 0x5f
sub rdi, rax
je 0x140004ec1
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, r15
jne 0x140004eb0
mov ecx, r15d
lea rdx, [rbp + 0x190]
call fcn.14000e640
jmp 0x140004f34
lea rdx, [rbp + 0x190]
lea rcx, str.____s
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140004ef3
mov edi, 0x5f
sub rdi, rax
je 0x140004f21
nop word [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, r15
jne 0x140004f10
xor ecx, ecx
lea rdx, [rbp + 0x190]
call fcn.14000e640
jmp 0x140004f34
xor r14d, r14d
cmp dword [0x140037014], 0
je 0x14000555e
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rsp + 0x68]
mov ecx, 0x16
mov rbx, rax
lea rdx, [rsp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edi, word [rsp + 0x70]
mov edx, 0xd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.QEMU_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.1400063d0
movzx edx, di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, [0x140017760]
mov qword [rbp - 0x80], r13
mov qword [rsp + 0x68], rax
lea rcx, str.SystemBiosVersion
lea rax, str.Identifier
mov qword [rbp - 0x78], rcx
mov esi, 2
mov qword [rsp + 0x70], rax
lea rax, str.QEMU
mov qword [rsp + 0x78], rax
lea rbx, [rsp + 0x78]
mov qword [rbp - 0x70], rax
lea r15d, [rsi - 1]
nop dword [rax]
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x190], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x192]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx - 0x10]
lea r8, [0x1400173e0]
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x190]
call fcn.140006790
mov r9, qword [rbx]
mov r8, qword [rbx - 8]
mov rdx, qword [rbx - 0x10]
call fcn.14000ecb0
lea rdx, [rbp + 0x190]
lea rcx, str.____s
test eax, eax
je 0x14000508a
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005060
mov edi, 0x5f
sub rdi, rax
je 0x140005085
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, r15
jne 0x140005074
mov ecx, r15d
jmp 0x1400050c7
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400050a0
mov edi, 0x5f
sub rdi, rax
je 0x1400050c5
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, r15
jne 0x1400050b4
xor ecx, ecx
lea rdx, [rbp + 0x190]
call fcn.14000e640
add rbx, 0x18
sub rsi, r15
jne 0x140004ff0
lea rax, str.qemu_ga.exe
mov qword [rsp + 0x68], rax
lea rbx, [rsp + 0x68]
lea rax, str.vdagent.exe
mov qword [rsp + 0x70], rax
lea rax, str.vdservice.exe
mov qword [rsp + 0x78], rax
nop dword [rax]
xor edx, edx
mov word [rbp + 0x190], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x192]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, str.Checking_qemu_processes__s
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x190]
call fcn.140006790
mov rcx, qword [rbx]
call fcn.140010cd0
lea rdx, [rbp + 0x190]
lea rcx, str.____s
test eax, eax
je 0x1400051b9
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005174
mov edi, 0x5f
sub rdi, rax
je 0x1400051a2
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140005190
mov r13d, 1
lea rdx, [rbp + 0x190]
mov ecx, r13d
call fcn.14000e640
jmp 0x14000520a
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400051d0
mov edi, 0x5f
sub rdi, rax
je 0x1400051f6
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x1400051e4
lea rdx, [rbp + 0x190]
xor ecx, ecx
call fcn.14000e640
mov r13d, 1
add rbx, 8
sub qword [rbp - 0x50], 1
jne 0x140005110
xor edx, edx
mov word [rbp + 0x3a0], r14w
mov r8d, 0x206
lea rcx, [rbp + 0x3a2]
call sub.VCRUNTIME140.dll_memset
lea rax, str.qemu_ga
mov rbx, r14
mov qword [rsp + 0x58], rax
lea rax, str.SPICE_Guest_Tools
mov qword [rsp + 0x60], rax
xor edx, edx
mov word [rbp + 0x190], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x192]
call sub.VCRUNTIME140.dll_memset
call fcn.14000ebf0
lea rdx, [rbp + 0x5b0]
test eax, eax
je 0x140005291
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x1400052a0
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov r8, qword [rsp + rbx*8 + 0x58]
lea rdx, [rbp + 0x5b0]
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea r9, [rbp + 0x3a0]
mov edx, pe_nt_image_headers64
lea r8, str.Checking_QEMU_directory__s
lea rcx, [rbp + 0x190]
call fcn.140006790
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000533b
test al, 0x10
je 0x14000533b
lea rdx, [rbp + 0x190]
lea rcx, str.____s
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005310
mov edi, 0x5f
sub rdi, rax
je 0x140005336
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140005324
mov ecx, r13d
jmp 0x140005388
lea rdx, [rbp + 0x190]
lea rcx, str.____s
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005360
mov edi, 0x5f
sub rdi, rax
je 0x140005386
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140005374
xor ecx, ecx
lea rdx, [rbp + 0x190]
call fcn.14000e640
inc rbx
cmp rbx, 2
jl 0x140005250
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, str.____s
call fcn.1400063d0
mov r15d, 0x45
nop word [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub r15, 1
jne 0x1400053c0
lea r8, [rbp - 0x18]
mov dword [rbp - 0x18], r14d
xor edx, edx
mov ecx, 0x52534d42
mov ebx, r14d
call fcn.1400110b0
mov rdi, rax
mov r15d, 0x49
test rax, rax
je 0x140005436
mov ecx, dword [rbp - 0x18]
mov rdx, r14
add rcx, 0xfffffffffffffffc
je 0x14000542d
cmp dword [rdx + rax], 0x756d6571
je 0x14000542a
inc rdx
cmp rdx, rcx
jb 0x140005403
mov rax, r14
cmp dword [rax + rdi], 0x554d4551
je 0x14000542a
inc rax
cmp rax, rcx
jb 0x140005417
jmp 0x14000542d
mov ebx, r13d
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_SMBIOS_firmware
mov ecx, ebx
call fcn.14000e640
lea rdx, str.Checking_ACPI_tables
lea rcx, str.____s
call fcn.1400063d0
nop word [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub r15, 1
jne 0x140005460
mov ecx, 0x1000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp - 0x50], rax
mov r15, rax
test rax, rax
je 0x14000554f
mov rdi, rax
mov ecx, 0x1000
xor eax, eax
mov rdx, r15
rep stosb byte [rdi], al
call fcn.140011020
mov ecx, eax
cmp eax, 0xffffffff
jne 0x1400054b2
xor eax, eax
mov r14d, eax
jmp 0x14000554f
shr eax, 2
cmp ecx, 4
jb 0x140005543
test eax, eax
je 0x140005543
mov rbx, r15
mov esi, eax
xor r15d, r15d
nop
mov edx, dword [rbx]
lea r8, [rbp - 0x18]
mov ecx, 0x41435049
mov dword [rbp - 0x18], r15d
call fcn.1400110b0
mov rdi, rax
test rax, rax
je 0x140005533
mov ecx, dword [rbp - 0x18]
mov rdx, r15
add rcx, 0xfffffffffffffffc
je 0x14000552a
nop dword [rax + rax]
cmp dword [rdx + rax], 0x48434f42
je 0x140005527
inc rdx
cmp rdx, rcx
jb 0x140005500
mov rax, r15
cmp dword [rax + rdi], 0x43505842
je 0x140005527
inc rax
cmp rax, rcx
jb 0x140005514
jmp 0x14000552a
mov r14d, r13d
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add rbx, 4
sub rsi, 1
jne 0x1400054d0
mov r15, qword [rbp - 0x50]
jmp 0x140005546
mov r14d, r13d
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_ACPI_tables
mov ecx, r14d
call fcn.14000e640
cmp dword [0x14003700c], 0
je 0x1400056fe
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rsp + 0x68]
mov ecx, 0x16
mov rbx, rax
lea rdx, [rsp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edi, word [rsp + 0x70]
mov edx, 0xd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Xen_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.1400063d0
movzx edx, di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor r15d, r15d
lea rcx, [rbp + 0x192]
xor edx, edx
mov word [rbp + 0x190], r15w
mov r8d, 0x1fe
call sub.VCRUNTIME140.dll_memset
lea r9, str.xenservice.exe
mov edx, pe_nt_image_headers64
lea r8, str.Checking_Citrix_Xen_process__s
lea rcx, [rbp + 0x190]
call fcn.140006790
lea rcx, str.xenservice.exe
call fcn.140010cd0
lea rdx, [rbp + 0x190]
lea rcx, str.____s
test eax, eax
je 0x140005669
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140005636
mov edi, 0x5f
sub rdi, rax
je 0x140005662
nop word [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140005650
mov ecx, 1
jmp 0x1400056a8
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140005680
mov edi, 0x5f
sub rdi, rax
je 0x1400056a6
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140005694
xor ecx, ecx
lea rdx, [rbp + 0x190]
call fcn.14000e640
lea rdx, str.Checking_Mac_Address_start_with_08:16:3E
lea rcx, str.____s
call fcn.1400063d0
mov r14d, 0x36
mov edi, r14d
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x1400056d0
lea rcx, [0x140018308]
call fcn.14000eda0
lea rdx, str.Checking_Mac_Address_start_with_08:16:3E
mov ecx, eax
call fcn.14000e640
jmp 0x140005707
mov r14d, 0x36
xor r15d, r15d
cmp dword [0x140037010], 0
je 0x1400059eb
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rsp + 0x68]
mov ecx, 0x16
mov rbx, rax
lea rdx, [rsp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edi, word [rsp + 0x70]
mov edx, 0xd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Xen_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.1400063d0
movzx edx, di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call fcn.14000c5f0
lea rax, str.SYSTEMControlSet001Services_vioscsi
mov qword [rbp + 0x40], rax
lea rbx, [rbp + 0x40]
lea rax, str.SYSTEMControlSet001Services_viostor
mov qword [rbp + 0x48], rax
lea rax, str.SYSTEMControlSet001ServicesVirtIO_FS_Service
mov qword [rbp + 0x50], rax
lea rax, str.SYSTEMControlSet001ServicesVirtioSerial
mov qword [rbp + 0x58], rax
lea rax, str.SYSTEMControlSet001ServicesBALLOON
mov qword [rbp + 0x60], rax
lea rax, str.SYSTEMControlSet001ServicesBalloonService
mov qword [rbp + 0x68], rax
lea rax, str.SYSTEMControlSet001Services_netkvm
mov qword [rbp + 0x70], rax
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x190], r15w
mov r8d, 0x1fe
lea rcx, [rbp + 0x192]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, [0x1400173e0]
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x190]
call fcn.140006790
mov rdx, qword [rbx]
lea rax, [rbp - 0x50]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 0x50], r15
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000588d
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x190]
lea rcx, str.____s
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005860
mov edi, 0x5f
sub rdi, rax
je 0x140005886
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140005874
mov ecx, 1
jmp 0x1400058d8
lea rdx, [rbp + 0x190]
lea rcx, str.____s
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400058b0
mov edi, 0x5f
sub rdi, rax
je 0x1400058d6
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x1400058c4
xor ecx, ecx
lea rdx, [rbp + 0x190]
call fcn.14000e640
add rbx, 8
sub qword [rsp + 0x38], 1
jne 0x1400057d0
lea rdx, str.Checking_KVM_virio_directory
lea rcx, str.____s
call fcn.1400063d0
nop word [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub qword [rsp + 0x40], 1
jne 0x140005910
xor edx, edx
mov word [rbp + 0x3a0], r15w
mov r8d, 0x206
lea rcx, [rbp + 0x3a2]
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.Virtio_Win_]
xor edx, edx
lea rcx, [rbp + 0x5c8]
mov r8d, 0x1f0
movaps xmmword [rbp + 0x5b0], xmm0
movsd xmm0, qword [0x1400176a8]
movsd qword [rbp + 0x5c0], xmm0
call sub.VCRUNTIME140.dll_memset
call fcn.14000ebf0
lea rdx, [rbp + 0x190]
test eax, eax
je 0x140005997
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x1400059a6
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x5b0]
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400059dc
mov ecx, 1
test al, 0x10
jne 0x1400059df
mov ecx, r15d
lea rdx, str.Checking_KVM_virio_directory
call fcn.14000e640
cmp dword [0x140037008], 0
je 0x140005be4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rsp + 0x68]
mov ecx, 0x16
mov rbx, rax
lea rdx, [rsp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edi, word [rsp + 0x70]
mov edx, 0xd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Wine_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.1400063d0
movzx edx, di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Checking_Wine_via_dll_exports
lea rcx, str.____s
call fcn.1400063d0
nop word [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub qword [rbp - 0x48], 1
jne 0x140005a70
lea rcx, [0x140015c10]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140005aa6
lea rcx, str.GetModuleHandle
call fcn.14000e770
mov ecx, r15d
jmp 0x140005abf
lea rdx, str.wine_get_unix_file_name
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov ecx, r15d
setne cl
lea rdx, str.Checking_Wine_via_dll_exports
call fcn.14000e640
xor edx, edx
mov word [rbp + 0x190], r15w
mov r8d, 0x1fe
lea rcx, [rbp + 0x192]
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREWine
mov edx, pe_nt_image_headers64
lea r8, [0x1400173e0]
lea rcx, [rbp + 0x190]
call fcn.140006790
lea rax, [rbp - 0x48]
mov qword [rbp - 0x48], r15
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREWine
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005b8d
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x190]
lea rcx, str.____s
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005b60
mov edi, 0x5f
sub rdi, rax
je 0x140005b86
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140005b74
mov ecx, 1
jmp 0x140005bd8
lea rdx, [rbp + 0x190]
lea rcx, str.____s
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005bb0
mov edi, 0x5f
sub rdi, rax
je 0x140005bd6
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140005bc4
xor ecx, ecx
lea rdx, [rbp + 0x190]
call fcn.14000e640
cmp dword [0x140037004], 0
je 0x140005dac
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rsp + 0x68]
mov ecx, 0x16
mov rbx, rax
lea rdx, [rsp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edi, word [rsp + 0x70]
mov edx, 0xd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Paralles_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.1400063d0
movzx edx, di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.prl_cc.exe
mov esi, 2
mov qword [rbp + 0x18], rax
lea rbx, [rbp + 0x18]
lea rax, str.prl_tools.exe
mov qword [rbp + 0x20], rax
nop dword [rax]
xor edx, edx
mov word [rbp + 0x190], r15w
mov r8d, 0x1fe
lea rcx, [rbp + 0x192]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, str.Checking_Parallels_processes:__s
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x190]
call fcn.140006790
mov rcx, qword [rbx]
call fcn.140010cd0
lea rdx, [rbp + 0x190]
lea rcx, str.____s
test eax, eax
je 0x140005d09
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005cd4
mov edi, 0x5f
sub rdi, rax
je 0x140005d02
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140005cf0
mov ecx, 1
jmp 0x140005d48
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005d20
mov edi, 0x5f
sub rdi, rax
je 0x140005d46
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140005d34
xor ecx, ecx
lea rdx, [rbp + 0x190]
call fcn.14000e640
add rbx, 8
sub rsi, 1
jne 0x140005c70
lea rdx, str.Checking_Mac_Address_start_with_00:1C:42
lea rcx, str.____s
call fcn.1400063d0
nop word [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub r14, 1
jne 0x140005d80
lea rcx, [0x140017758]
call fcn.14000eda0
lea rdx, str.Checking_Mac_Address_start_with_00:1C:42
mov ecx, eax
call fcn.14000e640
cmp dword [0x140037000], 0
je 0x140005f0f
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rsp + 0x68]
mov ecx, 0x16
mov rbx, rax
lea rdx, [rsp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edi, word [rsp + 0x70]
mov edx, 0xd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Hyper_V_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.1400063d0
movzx edx, di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Checking_for_Hyper_V_driver_objects
lea rcx, str.____s
call fcn.1400063d0
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub r12, 1
jne 0x140005e30
call fcn.1400113b0
test rax, rax
je 0x140005f00
mov rbx, qword [rax]
mov rsi, qword [rax + 8]
cmp rbx, rsi
je 0x140005f00
mov rdi, qword [rbx]
lea rdx, str.VMBusHID
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x1400061d9
lea rdx, str.vmbus
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x1400061d9
lea rdx, str.vmgid
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x1400061d9
lea rdx, str.IndirectKmd
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x1400061d9
lea rdx, str.HyperVideo
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x1400061d9
lea rdx, str.hyperkbd
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x1400061d9
add rbx, 8
cmp rbx, rsi
jne 0x140005e60
mov ecx, r15d
lea rdx, str.Checking_for_Hyper_V_driver_objects
call fcn.14000e640
cmp dword [0x140036ffc], 0
je 0x140005f31
call fcn.14000d0c0
call fcn.14000e290
call fcn.14000d4d0
call fcn.14000de50
call fcn.14000d930
cmp dword [0x140036ff4], 0
je 0x14000623f
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rsp + 0x68]
mov ecx, 0x16
mov rbx, rax
lea rdx, [rsp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edi, word [rsp + 0x70]
mov edx, 0xd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Analysis_tools
lea rcx, str._n___________________________s___________________________n
call fcn.1400063d0
movzx edx, di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.ollydbg.exe
mov qword [rbp + 0x40], rax
lea rax, str.ProcessHacker.exe
mov qword [rbp + 0x48], rax
lea rax, str.tcpview.exe
mov qword [rbp + 0x50], rax
lea rax, str.autoruns.exe
mov qword [rbp + 0x58], rax
lea rax, str.autorunsc.exe
mov qword [rbp + 0x60], rax
lea rax, str.filemon.exe
mov qword [rbp + 0x68], rax
lea rax, str.procmon.exe
mov qword [rbp + 0x70], rax
lea rax, str.regmon.exe
mov qword [rbp + 0x78], rax
lea rax, str.procexp.exe
mov qword [rbp + 0x80], rax
lea rax, str.idaq.exe
mov qword [rbp + 0x88], rax
lea rax, str.idaq64.exe
mov qword [rbp + 0x90], rax
lea rax, str.ImmunityDebugger.exe
mov qword [rbp + 0x98], rax
lea rax, str.Wireshark.exe
mov qword [rbp + 0xa0], rax
lea rax, str.dumpcap.exe
mov qword [rbp + 0xa8], rax
lea rax, str.HookExplorer.exe
mov qword [rbp + 0xb0], rax
lea rax, str.ImportREC.exe
mov qword [rbp + 0xb8], rax
lea rax, str.PETools.exe
mov qword [rbp + 0xc0], rax
lea rax, str.LordPE.exe
mov qword [rbp + 0xc8], rax
lea rax, str.SysInspector.exe
mov qword [rbp + 0xd0], rax
lea rax, str.proc_analyzer.exe
mov qword [rbp + 0xd8], rax
lea rax, str.sysAnalyzer.exe
mov qword [rbp + 0xe0], rax
lea rax, str.sniff_hit.exe
mov qword [rbp + 0xe8], rax
lea rax, str.windbg.exe
mov qword [rbp + 0xf0], rax
lea rax, str.joeboxcontrol.exe
mov qword [rbp + 0xf8], rax
lea rax, str.joeboxserver.exe
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], rax
lea rax, str.ResourceHacker.exe
mov qword [rbp + 0x110], rax
lea rax, str.x32dbg.exe
mov qword [rbp + 0x118], rax
lea rax, str.x64dbg.exe
mov qword [rbp + 0x120], rax
lea rax, str.Fiddler.exe
mov qword [rbp + 0x128], rax
lea rax, str.httpdebugger.exe
mov qword [rbp + 0x130], rax
lea rbx, [rbp + 0x40]
nop dword [rax]
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x190], r15w
mov r8d, 0x1fe
lea rcx, [rbp + 0x192]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, str.Checking_process_of_malware_analysis_tool:__s
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x190]
call fcn.140006790
mov rcx, qword [rbx]
call fcn.140010cd0
lea rdx, [rbp + 0x190]
lea rcx, str.____s
test eax, eax
je 0x1400061e3
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400061a4
mov edi, 0x5f
sub rdi, rax
je 0x1400061d2
nop dword [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x1400061c0
mov ecx, 1
jmp 0x140006224
mov ecx, 1
jmp 0x140005f03
call fcn.1400063d0
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400061f6
mov edi, 0x5f
sub rdi, rax
je 0x140006222
nop word [rax + rax]
lea rcx, [0x140018e78]
call fcn.1400063d0
sub rdi, 1
jne 0x140006210
xor ecx, ecx
lea rdx, [rbp + 0x190]
call fcn.14000e640
add rbx, 8
sub qword [rbp - 0x30], 1
jne 0x140006140
cmp dword [0x140036ff0], 0
je 0x1400062a7
lea rcx, str.Begin_AntiDisassmConstantCondition_n
call fcn.1400063d0
call fcn.140011670
lea rcx, str.Begin_AntiDisassmAsmJmpSameTarget_n
call fcn.1400063d0
call fcn.140011678
lea rcx, str.Begin_AntiDisassmImpossibleDiasassm_n
call fcn.1400063d0
call fcn.14001167f
lea rcx, str.Begin_AntiDisassmFunctionPointer_n
call fcn.1400063d0
mov ecx, 2
call fcn.140011693
lea rcx, str.Begin_AntiDisassmReturnPointerAbuse_n
call fcn.1400063d0
mov ecx, 0x29a
call fcn.1400116be
cmp dword [0x140036ff8], 0
je 0x140006374
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rsp + 0x68]
mov ecx, 0x16
mov rbx, rax
lea rdx, [rsp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edi, word [rsp + 0x70]
mov edx, 0xd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Anti_Dumping
lea rcx, str._n___________________________s___________________________n
call fcn.1400063d0
movzx edx, di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.___Erasing_PE_header_from_memory_n
call fcn.1400063d0
xor ecx, ecx
mov dword [rbp + 0x10], r15d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9, [rbp + 0x10]
mov edx, 0x1000
mov rcx, rax
mov r8d, 4
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
mov rdi, qword gs:[0x60]
lea rcx, str.___Increasing_SizeOfImage_in_PE_Header_to:_0x100000_n
call fcn.1400063d0
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x30]
add eax, 0x100000
mov dword [rcx + 0x40], eax
lea rcx, str._n_nAnalysis_done__I_hope_you_didnt_get_red_flags_:_
call fcn.1400063d0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
mov rcx, qword [rbp + 0x15b0]
xor rcx, rsp
call fcn.1400116f0
lea r11, [rsp + 0x16c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret