Function at 0x1801d2ae0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rbx, rdx
mov rdi, r8
movsxd rdx, dword [r8]
mov rsi, rcx
cmp edx, 0x1000
jg 0x1801d2833
je 0x1801d2810
cmp edx, 8
ja case.0x1801d2476.0
mov rax, rdx
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x1d2ab8]
add rcx, rdx
jmp rcx
mov rax, qword [rbx + 0xa7f0]
inc rax
mov qword [rbx + 0xa7f0], rax
rdtsc
shl rdx, 0x20
or rax, rdx
test byte [r8 + 8], 0x40
mov rbp, rax
je 0x1801d24ad
movabs rcx, 0xfffeffffffffffff
and qword [rbx + 0x19150], rcx
mov ecx, dword [r8 + 0x44]
lea rax, [rsp + 0x90]
mov r8, qword [r8 + 0x48]
and cl, 3
mov qword [rsp + 0x30], rax
cmp cl, 1
lea rax, [0x1801d1680]
mov word [rsp + 0x91], 0
mov qword [rsp + 0x28], rax
sete r9b
lea rax, [rsp + 0x40]
mov byte [rsp + 0x90], r9b
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call fcn.1801b3830
mov ecx, dword [rdi + 0x44]
and ecx, 3
test eax, eax
js 0x1801d254d
mov eax, 1
mov edx, 4
cmp ecx, eax
cmove eax, edx
test dword [rsp + 0x48], eax
je 0x1801d254d
cmp byte [rsp + 0x92], 0
je 0x1801d254d
mov r8, qword [rdi + 0x20]
mov r9, rbp
add r8, qword [rdi + 0x10]
mov edx, 0x3009
mov rcx, rbx
call fcn.1801bcc80
xor eax, eax
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r8, qword [rdi + 0x10]
xor eax, eax
add r8, qword [rdi + 0x20]
mov r9, rbp
cmp ecx, 1
mov rcx, rbx
sete al
lea edx, [rax + 6]
call fcn.1801bcc80
lea rdx, [rdi + 8]
mov rcx, rbx
mov rbp, rax
call fcn.1801d1db0
movabs r8, 0xc009e81fffc
mov rdx, rbx
mov rcx, rsi
call fcn.1801ceac0
test eax, eax
js 0x1801d2aaa
mov rcx, rbx
test rbp, rbp
jne 0x1801d25d2
movzx eax, byte [rdi + 0x30]
test al, al
je 0x1801d25c2
mov rdx, qword [rdi + 0x20]
lea r8, [rdi + 0x34]
mov r9d, eax
call sym.VBoxVMM.dll_IEMExecOneWithPrefetchedByPC
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call sym.VBoxVMM.dll_IEMExecOne
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor r8d, r8d
mov rdx, rbp
call fcn.1801bcd00
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rbx + 0xa7e8]
mov rdx, rbx
inc rax
mov rcx, rsi
mov qword [rbx + 0xa7e8], rax
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
jmp 0x1801d2f60
mov rax, qword [rbx + 0xa800]
inc rax
mov qword [rbx + 0xa800], rax
rdtsc
mov r8, qword [r8 + 0x20]
mov rcx, rbx
add r8, qword [rdi + 0x10]
shl rdx, 0x20
or rax, rdx
mov edx, 0x3002
mov r9, rax
call fcn.1801bcc80
mov eax, 0x458
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rbx + 0xa808]
inc rax
mov qword [rbx + 0xa808], rax
rdtsc
mov r8, qword [r8 + 0x20]
mov rcx, rbx
add r8, qword [rdi + 0x10]
shl rdx, 0x20
or rax, rdx
mov edx, 0x3001
mov r9, rax
call fcn.1801bcc80
lea rdx, [rdi + 8]
mov rcx, rbx
call fcn.1801d1db0
xor eax, eax
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rbx + 0xa858]
inc rax
mov qword [rbx + 0xa858], rax
rdtsc
mov r8, qword [r8 + 0x20]
mov rcx, rbx
add r8, qword [rdi + 0x10]
shl rdx, 0x20
or rax, rdx
mov edx, 0x3003
mov r9, rax
call fcn.1801bcc80
lea rdx, [rdi + 8]
mov rcx, rbx
call fcn.1801d1db0
movabs r8, 0xffffffffffc
test qword [rbx + 0x19150], r8
je 0x1801d2703
mov rcx, qword [rbx + 0x8080]
mov rdx, rbx
call fcn.1801ceac0
test eax, eax
js 0x1801d2aaa
mov rcx, rbx
call sym.VBoxVMM.dll_IEMExecOne
test eax, eax
jne 0x1801d2aaa
movabs rcx, 0xfffeffffffffffff
and qword [rbx + 0x19150], rcx
xor eax, eax
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x1550010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1801d2769
mov qword [rsp + 0x28], rdi
lea r9, str.Unimplemented_exit:_n_.Rhxd_n
mov edx, 0x10
mov dword [rsp + 0x20], 0x90
mov r8d, 0x155
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0x1550010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov r10, rax
test rax, rax
je 0x1801d27bc
xor eax, eax
lea rcx, str.int___cdecl_nemR3WinHandleExit_struct_VM__struct_VMCPU__const_struct_WHV_RUN_VP_EXIT_CONTEXT__
mov qword [rsp + 0x38], rax
lea r9, str.AssertLogRel__s__d___s:__s_n
mov qword [rsp + 0x30], rcx
mov r8d, 0x155
lea rcx, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxVMMVMMR3.._VMMAll_NEMAllNativeTemplate_win.cpp.h
mov dword [rsp + 0x28], 0x940
mov qword [rsp + 0x20], rcx
lea edx, [rax + 0x10]
mov rcx, r10
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0x1550010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1801d291a
mov ecx, dword [rdi]
lea r9, str.Unexpected_exit_on_CPU__u:__x_n_.32Rhxd_n
mov qword [rsp + 0x30], rdi
mov edx, 0x10
mov dword [rsp + 0x28], ecx
mov r8d, 0x155
mov ecx, dword [rbx + 0x80b8]
mov dword [rsp + 0x20], ecx
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov eax, 0xffffe513
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rbx + 0xa818]
mov rdx, rbx
inc rax
mov qword [rbx + 0xa818], rax
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
jmp 0x1801d3380
sub edx, 0x1001
je 0x1801d294d
sub edx, 1
je 0x1801d292a
cmp edx, 0xfff
je 0x1801d268e
mov ecx, 0x1550010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1801d288c
mov qword [rsp + 0x28], rdi
lea r9, str.Unknown_exit:_n_.Rhxd_n
mov edx, 0x10
mov dword [rsp + 0x20], 0x90
mov r8d, 0x155
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0x1550010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov r10, rax
test rax, rax
je 0x1801d28df
xor eax, eax
lea rcx, str.int___cdecl_nemR3WinHandleExit_struct_VM__struct_VMCPU__const_struct_WHV_RUN_VP_EXIT_CONTEXT__
mov qword [rsp + 0x38], rax
lea r9, str.AssertLogRel__s__d___s:__s_n
mov qword [rsp + 0x30], rcx
mov r8d, 0x155
lea rcx, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxVMMVMMR3.._VMMAll_NEMAllNativeTemplate_win.cpp.h
mov dword [rsp + 0x28], 0x946
mov qword [rsp + 0x20], rcx
lea edx, [rax + 0x10]
mov rcx, r10
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0x1550010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1801d291a
mov ecx, dword [rdi]
lea r9, str.Unknown_exit_on_CPU__u:__x__n
mov dword [rsp + 0x28], ecx
mov edx, 0x10
mov ecx, dword [rbx + 0x80b8]
mov r8d, 0x155
mov dword [rsp + 0x20], ecx
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov eax, 0xffffe513
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rbx + 0xa820]
mov rdx, rbx
inc rax
mov qword [rbx + 0xa820], rax
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
jmp 0x1801d2ae0
mov rax, qword [rbx + 0xa810]
mov qword [rsp + 0x80], r12
inc rax
mov qword [rsp + 0x88], r13
mov qword [rbx + 0xa810], rax
mov qword [rsp + 0x98], r15
rdtsc
mov r8, qword [r8 + 0x20]
mov rcx, rbx
add r8, qword [rdi + 0x10]
shl rdx, 0x20
or rax, rdx
mov edx, 0xa
mov r9, rax
call fcn.1801bcc80
lea rdx, [rdi + 8]
mov rbp, rax
lea r14, [rbx + 0x19000]
mov rcx, rbx
lea r15, [rbx + 0x19008]
lea r12, [rbx + 0x19010]
lea r13, [rbx + 0x19018]
test rax, rax
jne 0x1801d2a3d
call fcn.1801d1db0
mov edx, dword [rdi + 0x30]
mov qword [r14], rdx
mov ecx, dword [rdi + 0x38]
mov qword [r15], rcx
mov r8d, ecx
mov eax, dword [rdi + 0x40]
mov rcx, rbx
mov qword [r12], rax
mov eax, dword [rdi + 0x48]
mov qword [r13], rax
mov r9d, dword [rbx + 0x190ac]
and qword [rbx + 0x19150], 0xffffffffffffff0f
mov qword [rsp + 0x38], r12
shr r9d, 0xd
mov qword [rsp + 0x30], r15
and r9d, 1
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
call sym.VBoxVMM.dll_CPUMGetGuestCpuId
movzx eax, byte [rdi + 0xa]
and eax, 0xf
add qword [rbx + 0x19140], rax
mov eax, dword [rbx + 0x19148]
and eax, 0xff3effff
mov dword [rbx + 0x19148], eax
xor eax, eax
jmp 0x1801d2a92
call fcn.1801d1db0
mov rax, qword [rdi + 0x30]
movabs r8, 0xc009e80dffc
mov qword [r14], rax
mov rdx, rbx
mov rax, qword [rdi + 0x38]
mov rcx, rsi
mov qword [r15], rax
mov rax, qword [rdi + 0x40]
mov qword [r12], rax
mov rax, qword [rdi + 0x48]
and qword [rbx + 0x19150], 0xffffffffffffff0f
mov qword [r13], rax
call fcn.1801ceac0
test eax, eax
js 0x1801d2a92
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call fcn.1801bcd00
mov r15, qword [rsp + 0x98]
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, r8
mov rcx, rbx
lea rdx, [r8 + 8]
call fcn.1801d1db0
mov rax, qword [rbx + 0x19150]
movabs rcx, 0xfffeffffffffffff
and rax, rcx
movabs r8, 0xc00fe80dffc
mov qword [rbx + 0x19150], rax
movabs rcx, 0xc009e80dffc
cmp byte [rdi + 0x48], 1
cmovne r8, rcx
test rax, r8
je 0x1801d2b54
mov rcx, qword [rbx + 0x8080]
mov rdx, rbx
call fcn.1801ceac0
test eax, eax
js 0x1801d2e51
movzx ecx, byte [rdi + 0x48]
mov qword [rsp + 0x50], rbp
xor ebp, ebp
sub ecx, 1
je 0x1801d2df3
sub ecx, 2
je 0x1801d2dba
sub ecx, 3
je 0x1801d2cbf
cmp ecx, 7
je 0x1801d2c0e
mov ecx, 0x1550010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1801d2bd1
mov qword [rsp + 0x38], rbp
lea rdx, str.int___cdecl_nemR3WinHandleExitException_struct_VM__struct_VMCPU__const_struct_WHV_RUN_VP_EXIT_CONTEXT__
mov qword [rsp + 0x30], rdx
lea r9, str.AssertLogRel__s__d___s:__s_n
lea rdx, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxVMMVMMR3.._VMMAll_NEMAllNativeTemplate_win.cpp.h
mov dword [rsp + 0x28], 0x8c1
mov qword [rsp + 0x20], rdx
mov r8d, 0x155
lea edx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0x1550010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1801d2c04
movzx ecx, byte [rdi + 0x48]
lea r9, str.ExceptionType_x_n
mov dword [rsp + 0x20], ecx
mov edx, 0x10
mov rcx, rax
mov r8d, 0x155
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov eax, 0xffffeaec
jmp 0x1801d2e4c
mov rax, qword [rbx + 0xa838]
inc rax
test byte [rbx + 0xa7c4], 2
mov qword [rbx + 0xa838], rax
je 0x1801d2c86
movzx esi, byte [rdi + 0x30]
mov eax, 0x5658
cmp word [rbx + 0x19010], ax
jne 0x1801d2c86
cmp qword [rbx + 0x19000], 0x564d5868
jne 0x1801d2c86
mov rcx, rbx
call sym.VBoxVMM.dll_CPUMGetGuestCPL
cmp eax, 3
jne 0x1801d2c86
cmp qword [rbx + 0x190a0], rbp
jne 0x1801d2c86
cmp sil, 1
jae 0x1801d2c90
mov r8, qword [rbx + 0x19140]
lea r9d, [rax - 2]
lea rdx, [rsp + 0x58]
mov rcx, rbx
call sym.VBoxVMM.dll_PGMPhysSimpleReadGCPtr
test eax, eax
js 0x1801d2c86
cmp byte [rsp + 0x58], 0xed
je 0x1801d2c96
movzx r9d, byte [rdi + 0x30]
jmp 0x1801d2d94
cmp byte [rdi + 0x34], 0xed
jne 0x1801d2c86
mov rax, qword [rbx + 0xa840]
inc qword [rbx + 0x19140]
inc rax
and dword [rbx + 0x19148], 0xff3fffff
mov qword [rbx + 0xa840], rax
xor eax, eax
jmp 0x1801d2e4c
mov rax, qword [rbx + 0xa848]
inc rax
mov qword [rbx + 0xa848], rax
rdtsc
mov r8, qword [rdi + 0x10]
mov rcx, rbx
add r8, qword [rdi + 0x20]
shl rdx, 0x20
or rax, rdx
mov edx, 0x3005
mov r9, rax
call fcn.1801bcc80
test byte [rdi + 8], 0x10
je 0x1801d2d07
mov eax, 0x2000
test word [rdi + 0x1e], ax
je 0x1801d2d07
mov r9b, 1
jmp 0x1801d2d0a
xor r9b, r9b
movzx r11d, byte [rdi + 0x30]
lea rdx, [rdi + 0x34]
movzx r8d, r11b
cmp r11b, 3
jb case.0x1801d2d55.18
lea rsi, [0x180000000]
nop dword [rax + rax]
movzx eax, byte [rdx]
add eax, 0xfffffff1
cmp eax, 0xe4
ja case.0x1801d2d55.18
cdqe
movzx eax, byte [rsi + rax + 0x1d2e74]
mov ecx, dword [rsi + rax*4 + 0x1d2e64]
add rcx, rsi
jmp rcx
test r9b, r9b
je case.0x1801d2d55.18
add r8b, 0xff
inc rdx
cmp r8b, 3
jae 0x1801d2d30
jmp case.0x1801d2d55.18
cmp byte [rdx + 1], 1
jne case.0x1801d2d55.18
movzx ecx, byte [rdx + 2]
sub ecx, 0xc1
je 0x1801d2d91
cmp ecx, 0x18
jne case.0x1801d2d55.18
mov r9, r11
mov rdx, qword [rdi + 0x20]
lea r8, [rdi + 0x34]
mov rcx, rbx
call sym.VBoxVMM.dll_IEMExecOneWithPrefetchedByPC
mov rcx, qword [rbx + 0xa850]
inc rcx
mov qword [rbx + 0xa850], rcx
jmp 0x1801d2e4c
mov rax, qword [rbx + 0xa828]
inc rax
mov qword [rbx + 0xa828], rax
rdtsc
mov r8, qword [rdi + 0x20]
mov rcx, rbx
add r8, qword [rdi + 0x10]
shl rdx, 0x20
or rax, rdx
mov edx, 0x3007
mov r9, rax
call fcn.1801bcc80
mov ebp, 2
jmp case.0x1801d2d55.18
mov rax, qword [rbx + 0xa830]
inc rax
mov qword [rbx + 0xa830], rax
rdtsc
mov r8, qword [rdi + 0x20]
mov rcx, rbx
add r8, qword [rdi + 0x10]
shl rdx, 0x20
or rax, rdx
mov edx, 0x3006
mov r9, rax
call fcn.1801bcc80
movzx eax, byte [rdi + 0xa]
mov r8d, ebp
movzx r9d, word [rdi + 0x4c]
and al, 0xf
movzx edx, byte [rdi + 0x48]
mov rcx, rbx
mov byte [rsp + 0x28], al
mov rax, qword [rdi + 0x50]
mov qword [rsp + 0x20], rax
call fcn.1800fdc80
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
test byte [r8 + 8], 0x40
mov rsi, r8
mov rbx, rdx
mov r14, rcx
je 0x1801d2f93
movabs rax, 0xfffeffffffffffff
and qword [rdx + 0x19150], rax
rdtsc
mov r10, qword [r8 + 0x20]
add r10, qword [r8 + 0x10]
mov ecx, dword [r8 + 0x44]
mov r8d, ecx
shl rdx, 0x20
and r8d, 3
or rax, rdx
xor edx, edx
test cl, 0x10
jne 0x1801d2fc1
cmp r8d, 1
sete dl
inc edx
jmp 0x1801d2fcb
cmp r8d, 1
sete dl
add edx, 3
mov r9, rax
mov r8, r10
mov rcx, rbx
call fcn.1801bcc80
mov rdi, rax
test rax, rax
jne 0x1801d3267
mov ecx, dword [rsi + 0x44]
mov qword [rsp + 0x50], r15
test cl, 0x10
jne 0x1801d3124
movzx r8d, word [rsi + 0x48]
lea rdx, [0x18052b588]
mov eax, ecx
shr rax, 1
and eax, 7
test cl, 1
mov qword [rsp + 0x20], rax
mov rcx, r14
mov r15d, dword [rdx + rax*4]
mov rdx, rbx
je 0x1801d3070
mov r9d, dword [rsi + 0x50]
and r9d, r15d
call sym.VBoxVMM.dll_IOMIOPortWrite
mov edi, eax
test eax, eax
je 0x1801d30f4
cmp eax, 0x460
jg 0x1801d320d
cmp eax, 0x45b
je 0x1801d3215
cmp eax, 0x44c
jl 0x1801d321d
cmp eax, 0x45d
je 0x1801d3225
cmp eax, 0x45c
je 0x1801d322d
jmp 0x1801d30f4
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], 0
call sym.VBoxVMM.dll_IOMIOPortRead
mov edi, eax
test eax, eax
je 0x1801d30bf
cmp eax, 0x460
jg 0x1801d320d
cmp eax, 0x45b
je 0x1801d3215
cmp eax, 0x44c
jl 0x1801d321d
cmp eax, 0x45d
je 0x1801d3225
cmp eax, 0x45c
je 0x1801d322d
mov eax, dword [rsi + 0x44]
and al, 0xe
cmp al, 8
je 0x1801d30e1
mov rdx, qword [rsi + 0x50]
mov rax, r15
not rax
and rdx, rax
mov eax, dword [rsp + 0x60]
and rax, r15
or rdx, rax
jmp 0x1801d30e5
mov edx, dword [rsp + 0x60]
mov qword [rbx + 0x19000], rdx
and qword [rbx + 0x19150], 0xffffffffffffffef
lea rdx, [rsi + 8]
mov rcx, rbx
call fcn.1801d1db0
movzx eax, byte [rsi + 0xa]
and eax, 0xf
add qword [rbx + 0x19140], rax
mov eax, dword [rbx + 0x19148]
and eax, 0xff3effff
mov dword [rbx + 0x19148], eax
jmp 0x1801d3209
lea rdx, [rsi + 8]
mov rcx, rbx
call fcn.1801d1db0
and qword [rbx + 0x19150], 0xfffffffffffed3cf
mov ecx, 1
mov rax, qword [rsi + 0x70]
movabs r8, 0xc009e80dffc
mov qword [rbx + 0x190d0], rax
mov rdx, rbx
mov eax, dword [rsi + 0x78]
mov dword [rbx + 0x190d8], eax
movzx eax, word [rsi + 0x7c]
mov word [rbx + 0x190c8], ax
mov word [rbx + 0x190cc], ax
movzx eax, word [rsi + 0x7e]
mov word [rbx + 0x190ce], cx
mov dword [rbx + 0x190dc], eax
mov rax, qword [rsi + 0x80]
mov qword [rbx + 0x19088], rax
mov eax, dword [rsi + 0x88]
mov dword [rbx + 0x19090], eax
movzx eax, word [rsi + 0x8c]
mov word [rbx + 0x19080], ax
mov word [rbx + 0x19084], ax
movzx eax, word [rsi + 0x8e]
mov word [rbx + 0x19086], cx
mov rcx, r14
mov dword [rbx + 0x19094], eax
mov rax, qword [rsi + 0x50]
mov qword [rbx + 0x19000], rax
mov rax, qword [rsi + 0x58]
mov qword [rbx + 0x19008], rax
mov rax, qword [rsi + 0x68]
mov qword [rbx + 0x19038], rax
mov rax, qword [rsi + 0x60]
mov qword [rbx + 0x19030], rax
call fcn.1801ceac0
test eax, eax
js 0x1801d324f
mov rcx, rbx
call sym.VBoxVMM.dll_IEMExecOne
mov edi, eax
test edi, edi
je 0x1801d3235
cmp edi, 0x460
jg 0x1801d324d
cmp edi, 0x45b
je 0x1801d324d
cmp edi, 0x44c
jl 0x1801d324d
cmp edi, 0x45d
je 0x1801d324d
cmp edi, 0x45c
je 0x1801d324d
test byte [rsi + 8], 0x20
jne 0x1801d324d
mov eax, dword [rsi + 0x28]
bt rax, 8
jb 0x1801d324d
mov rcx, r14
call fcn.1800f5950
mov eax, edi
mov r15, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
lea rdx, [rsi + 8]
mov rcx, rbx
call fcn.1801d1db0
test byte [rsi + 0x44], 0x10
mov rax, qword [rbx + 0x19150]
jne 0x1801d3290
and rax, 0xffffffffffffffef
mov qword [rbx + 0x19150], rax
jmp 0x1801d333d
and rax, 0xfffffffffffed3cf
mov ecx, 1
mov qword [rbx + 0x19150], rax
mov rax, qword [rsi + 0x70]
mov qword [rbx + 0x190d0], rax
mov eax, dword [rsi + 0x78]
mov dword [rbx + 0x190d8], eax
movzx eax, word [rsi + 0x7c]
mov word [rbx + 0x190c8], ax
mov word [rbx + 0x190cc], ax
movzx eax, word [rsi + 0x7e]
mov dword [rbx + 0x190dc], eax
mov word [rbx + 0x190ce], cx
mov rax, qword [rsi + 0x80]
mov qword [rbx + 0x19088], rax
mov eax, dword [rsi + 0x88]
mov dword [rbx + 0x19090], eax
movzx eax, word [rsi + 0x8c]
mov word [rbx + 0x19080], ax
mov word [rbx + 0x19084], ax
movzx eax, word [rsi + 0x8e]
mov dword [rbx + 0x19094], eax
mov word [rbx + 0x19086], cx
mov rax, qword [rsi + 0x58]
mov qword [rbx + 0x19008], rax
mov rax, qword [rsi + 0x68]
mov qword [rbx + 0x19038], rax
mov rax, qword [rsi + 0x60]
mov qword [rbx + 0x19030], rax
mov rax, qword [rsi + 0x50]
movabs r8, 0xc009e80dffc
mov rdx, rbx
mov qword [rbx + 0x19000], rax
mov rcx, r14
call fcn.1801ceac0
test eax, eax
js 0x1801d3254
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.1801bcd00
jmp 0x1801d3254
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x60
xor r15d, r15d
mov rdi, r8
test byte [r8 + 8], 3
mov rbx, rdx
jne 0x1801d354b
rdtsc
mov r8, qword [r8 + 0x10]
mov rcx, rbx
add r8, qword [rdi + 0x20]
shl rdx, 0x20
or rax, rdx
mov edx, dword [rdi + 0x30]
and edx, 1
mov r9, rax
or edx, 8
call fcn.1801bcc80
lea rdx, [rdi + 8]
mov rcx, rbx
mov r14, rax
call fcn.1801d1db0
test r14, r14
movabs rax, 0x1f016800000
movabs r8, 0x1f09e80dffc
cmove r8, rax
test qword [rbx + 0x19150], r8
je 0x1801d34a6
mov rcx, qword [rbx + 0x8080]
mov rdx, rbx
call fcn.1801ceac0
mov esi, eax
test eax, eax
jns 0x1801d34a6
mov ecx, 0x1550010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov r10, rax
test rax, rax
je 0x1801d349f
lea rcx, [rdi + 8]
call fcn.1801d22a0
movzx r8d, word [rdi + 0x1c]
lea rcx, [0x18052b624]
test byte [rdi + 0x30], 1
lea rdx, [0x18052b628]
mov dword [rsp + 0x50], esi
lea r9, str.MsrExit__u:__04x:_08RX64__s:__sMSR__08x_____Rrc___msr_state_import_n
cmovne rdx, rcx
mov ecx, dword [rdi + 0x34]
mov dword [rsp + 0x48], ecx
mov rcx, r10
mov qword [rsp + 0x40], rdx
lea edx, [r15 + 0x10]
mov qword [rsp + 0x38], rax
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0x30], rax
mov eax, dword [rbx + 0x80b8]
mov dword [rsp + 0x28], r8d
mov r8d, 0x155
mov dword [rsp + 0x20], eax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov eax, esi
jmp 0x1801d3594
mov rcx, rbx
test r14, r14
jne 0x1801d3688
test byte [rdi + 0x30], 1
mov edx, dword [rdi + 0x34]
je 0x1801d35ae
mov r8d, dword [rdi + 0x40]
mov eax, dword [rdi + 0x38]
shl r8, 0x20
or r8, rax
call sym.VBoxVMM.dll_CPUMSetGuestMsr
mov esi, eax
test eax, eax
je 0x1801d35ed
mov ecx, 0x1550010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov r10, rax
test rax, rax
je 0x1801d354b
lea rcx, [rdi + 8]
call fcn.1801d22a0
mov ecx, dword [rdi + 0x40]
lea r9, str.MsrExit__u:__04x:_08RX64__s:_WRMSR__08x___08x:_08x_____Rrc__n
movzx edx, word [rdi + 0x1c]
mov r8d, 0x155
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], ecx
mov ecx, dword [rdi + 0x38]
mov dword [rsp + 0x48], ecx
mov ecx, dword [rdi + 0x34]
mov dword [rsp + 0x40], ecx
mov rcx, r10
mov qword [rsp + 0x38], rax
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0x30], rax
mov eax, dword [rbx + 0x80b8]
mov dword [rsp + 0x28], edx
lea edx, [r14 + 0x10]
mov dword [rsp + 0x20], eax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
movabs r8, 0xdf09e80dffc
test qword [rbx + 0x19150], r8
je 0x1801d3571
mov rcx, qword [rbx + 0x8080]
mov rdx, rbx
call fcn.1801ceac0
test eax, eax
js 0x1801d3594
xor r9d, r9d
xor r8d, r8d
mov byte [rsp + 0x28], r9b
mov dl, 0xd
mov rcx, rbx
mov qword [rsp + 0x20], r15
call fcn.1800fdc80
cmp eax, 0x45e
cmove eax, r15d
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
lea r8, [rsp + 0x90]
mov qword [rsp + 0x90], r15
call sym.VBoxVMM.dll_CPUMQueryGuestMsr
mov esi, eax
test eax, eax
jne 0x1801d3610
mov rcx, qword [rsp + 0x90]
mov eax, ecx
shr rcx, 0x20
and qword [rbx + 0x19150], 0xffffffffffffffaf
mov qword [rbx + 0x19010], rcx
mov qword [rbx + 0x19000], rax
movzx eax, byte [rdi + 0xa]
and eax, 0xf
add qword [rbx + 0x19140], rax
mov eax, dword [rbx + 0x19148]
and eax, 0xff3effff
mov dword [rbx + 0x19148], eax
xor eax, eax
jmp 0x1801d3594
mov ecx, 0x1550010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov r10, rax
test rax, rax
je 0x1801d354b
lea rcx, [rdi + 8]
call fcn.1801d22a0
mov rcx, qword [rsp + 0x90]
lea r9, str.MsrExit__u:__04x:_08RX64__s:_RDMSR__08x_____08RX64____Rrc_n
movzx edx, word [rdi + 0x1c]
mov r8d, 0x155
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x48], rcx
mov ecx, dword [rdi + 0x34]
mov dword [rsp + 0x40], ecx
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x38], rax
mov eax, dword [rbx + 0x80b8]
mov qword [rsp + 0x30], rcx
mov rcx, r10
mov dword [rsp + 0x28], edx
mov edx, 0x10
mov dword [rsp + 0x20], eax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
jmp 0x1801d354b
xor r8d, r8d
mov rdx, r14
call fcn.1801bcd00
jmp 0x1801d3594