Function at 0x140093d30
Capabilities:
Check for sandbox and av modules
Check if process is running under wine
Contain obfuscated stackstrings
Reference wmi statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x690
mov rax, qword [0x1400c1008]
xor rax, rsp
mov qword [rsp + 0x680], rax
mov rsi, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x480]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x280]
call sub.VCRUNTIME140.dll_memset
xor r12d, r12d
mov qword [rsp + 0x50], r12
mov r14d, r12d
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov dword [rsi + 0xd98], r12d
mov dword [rsi + 0xda0], r12d
mov dword [rsp + 0x58], 0x61774d56
mov dword [rsp + 0x5c], 0x4d566572
mov dword [rsp + 0x60], 0x65726177
mov qword [rsi], r12
mov qword [rsi + 8], r12
movups xmmword [rsp + 0x68], xmm0
mov r15d, 1
mov eax, r15d
xor ecx, ecx
cpuid
mov dword [rsp + 0x6c], ebx
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x74], edx
test eax, eax
jns 0x140093e4f
movups xmmword [rsp + 0x68], xmm0
mov eax, 0x40000000
xor ecx, ecx
cpuid
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], ebx
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x74], edx
mov rax, qword [rsp + 0x68]
cmp rax, qword [rsp + 0x58]
jne 0x140093e4f
mov rax, qword [rsp + 0x70]
cmp rax, qword [rsp + 0x60]
jne 0x140093e4f
mov dword [rsi], r15d
lea rax, str.SELECT__FROM_Win32_BaseBoard
mov qword [rsp + 0x20], rax
lea r9, [0x1400ffc24]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x480]
call fcn.140001140
mov word [rsp + 0x67c], r12w
lea rax, str.SerialNumber
mov qword [rsp + 0x20], rax
lea r9, [0x1400ffb68]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x280]
call fcn.140001140
mov word [rsp + 0x47c], r12w
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x280]
lea rcx, [rsp + 0x480]
call fcn.14008eb60
test eax, eax
jne 0x140093f28
cmp word [rsp + 0x38], 8
jne 0x140093f84
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x1400ffb08]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x80]
call fcn.140001140
lea rcx, [rsp + 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov word [rsp + 0x27c], r12w
jmp 0x140093f84
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
call fcn.140093a60
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140094e2f
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, str.BIOSVendor
mov rcx, r14
call fcn.140092fa0
cmp eax, r15d
je 0x140094e2f
mov rcx, r14
call fcn.1400965f0
cmp eax, r15d
je 0x140094e2f
mov r14, r12
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x10]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x10]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rdx, str.VMware_
lea rcx, [rsi + 0x10]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
mov rbx, rax
lea rdx, [0x1400fe65c]
lea rcx, [rsi + 0x10]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rbx, rbx
jne 0x140093fea
test rax, rax
je 0x140093fee
mov dword [rsi + 4], r15d
cmp dword [rsi], r15d
je 0x140094f7e
cmp dword [rsi + 4], 0
jne 0x140094f7e
mov qword [rsi + 0x114], r12
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x480]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x280]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
lea rax, [0x1401002d8]
mov qword [rsp + 0x20], rax
lea r9, [0x1400ff9d8]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x480]
call fcn.140001140
mov word [rsp + 0x67c], r12w
lea rax, str.Manufacturer
mov qword [rsp + 0x20], rax
lea r9, [0x1400ff978]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x280]
call fcn.140001140
mov word [rsp + 0x47c], r12w
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x280]
lea rcx, [rsp + 0x480]
call fcn.14008eb60
test eax, eax
jne 0x14009416a
cmp word [rsp + 0x38], 8
jne 0x14009416a
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x1400ff918]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x80]
call fcn.140001140
lea rcx, [rsp + 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov word [rsp + 0x27c], r12w
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x11c]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x11c]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rdx, str.Microsoft_Corporation
lea rcx, [rsi + 0x11c]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14009430c
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x480]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x280]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
lea rax, [0x140100248]
mov qword [rsp + 0x20], rax
lea r9, [0x1400ff2a4]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x480]
call fcn.140001140
mov word [rsp + 0x67c], r12w
lea rax, str.Product
mov qword [rsp + 0x20], rax
lea r9, [0x1400fecdc]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x280]
call fcn.140001140
mov word [rsp + 0x47c], r12w
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x280]
lea rcx, [rsp + 0x480]
call fcn.14008eb60
test eax, eax
jne 0x1400942e9
cmp word [rsp + 0x38], 8
jne 0x1400942e9
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x1400febcc]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x80]
call fcn.140001140
lea rcx, [rsp + 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov word [rsp + 0x27c], r12w
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x11c]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x11c]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rdx, str.Surface
lea rcx, [rsi + 0x11c]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
mov ecx, r12d
test rax, rax
sete cl
mov dword [rsi + 0x114], ecx
cmp dword [rsi + 0x114], r15d
jne 0x14009432b
mov dword [rsi + 0x118], r15d
mov dword [rsi + 0xda0], 2
jmp 0x140094f89
mov dword [rsi + 0x220], r12d
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14009436f
lea rdx, str.wine_get_unix_file_name
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14009436f
mov dword [rsi + 0x220], r15d
mov dword [rsi + 0xda0], 3
jmp 0x140094f89
mov qword [rsi + 0x234], r12
mov qword [rsi + 0x228], r12
mov dword [rsi + 0x230], r12d
lea rdx, str.HARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
call fcn.140093a60
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140094462
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, str.Identifier
mov rcx, r14
call fcn.140092fa0
cmp eax, r15d
je 0x140094462
mov rcx, r14
call fcn.1400965f0
cmp eax, r15d
je 0x140094e2f
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x23c]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x23c]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov edx, 0xff
lea rcx, [rsp + 0x80]
call fcn.140093690
lea rdx, str.VBOX
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140094462
mov dword [rsi + 0x228], r15d
lea rdx, str.HARDWAREDESCRIPTIONSystem
call fcn.140093a60
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140094540
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, str.SystemBiosVersion
mov rcx, r14
call fcn.140092fa0
cmp eax, r15d
je 0x140094540
mov rcx, r14
call fcn.1400965f0
cmp eax, r15d
je 0x140094e2f
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x340]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x340]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov edx, 0xff
lea rcx, [rsp + 0x80]
call fcn.140093690
lea rdx, [0x140100688]
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140094540
mov dword [rsi + 0x22c], r15d
lea rdx, [0x1400ff588]
call fcn.140093a60
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14009461e
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, str.VideoBiosVersion
mov rcx, r14
call fcn.140092fa0
cmp eax, r15d
je 0x14009461e
mov rcx, r14
call fcn.1400965f0
cmp eax, r15d
je 0x140094e2f
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x444]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x444]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov edx, 0xff
lea rcx, [rsp + 0x80]
call fcn.140093690
lea rdx, str.VIRTUALBOX
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14009461e
mov dword [rsi + 0x230], r15d
lea rdx, str.SOFTWAREOracleVirtualBox_Guest_Additions
call fcn.140093a60
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140094657
mov dword [rsi + 0x234], r15d
mov rcx, rax
call fcn.1400965f0
cmp eax, r15d
je 0x140094e2f
mov r14, r12
mov qword [rsp + 0x30], r12
xor edx, edx
lea rcx, str.C:WINDOWS_system32driversVBoxMouse.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
test eax, eax
jne 0x140094676
mov dword [rsi + 0x238], r15d
mov eax, r15d
jmp 0x14009467c
mov eax, dword [rsi + 0x238]
cmp eax, r15d
je 0x140094f6b
cmp dword [rsi + 0x234], r15d
je 0x140094f6b
cmp dword [rsi + 0x228], r15d
je 0x140094f6b
cmp dword [rsi + 0x22c], r15d
je 0x140094f6b
cmp dword [rsi + 0x230], r15d
je 0x140094f6b
mov qword [rsi + 0x54c], r12
lea rdx, [0x140100520]
call fcn.140093a60
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14009479e
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, [0x1400ff428]
mov rcx, r14
call fcn.140092fa0
cmp eax, r15d
je 0x14009479e
mov rcx, r14
call fcn.1400965f0
cmp eax, r15d
je 0x140094e2f
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x554]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x554]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov edx, 0xff
lea rcx, [rsp + 0x80]
call fcn.140093690
lea rdx, [0x140100510]
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14009479e
mov dword [rsi + 0x54c], r15d
lea rdx, [0x1400ff398]
call fcn.140093a60
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14009487f
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, [0x1400ff318]
mov rcx, r14
call fcn.140092fa0
cmp eax, r15d
je 0x14009487f
mov rcx, r14
call fcn.1400965f0
cmp eax, r15d
je 0x140094e2f
mov r14, r12
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x658]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x658]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov edx, 0xff
lea rcx, [rsp + 0x80]
call fcn.140093690
lea rdx, [0x140100500]
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14009487f
mov dword [rsi + 0x550], r15d
cmp dword [rsi + 0x54c], r15d
je 0x140094f58
cmp dword [rsi + 0x550], r15d
je 0x140094f58
mov dword [rsi + 0x75c], r12d
lea rcx, str.SbieDll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400948c8
mov dword [rsi + 0x75c], r15d
mov dword [rsi + 0xda0], 6
jmp 0x140094f89
mov qword [rsi + 0x764], r12
mov qword [rsi + 0x76c], r12
mov qword [rsi + 0x774], r12
mov dword [rsi + 0x77c], r12d
lea rdx, [0x140100460]
call fcn.140093a60
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400949c2
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, [0x1400ff188]
mov rcx, r14
call fcn.140092fa0
cmp eax, r15d
je 0x1400949c2
mov rcx, r14
call fcn.1400965f0
cmp eax, r15d
je 0x140094e2f
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0xb90]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0xb90]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov edx, 0xff
lea rcx, [rsp + 0x80]
call fcn.140093690
lea rdx, str.MSFT____VIRTUAL_DISK
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x1400949c2
mov dword [rsi + 0x77c], r15d
cmp dword [rsi + 0x77c], 0
jne 0x140094a26
lea rdx, str.MSFT
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rbx, rax
lea rdx, str.VIRTUAL
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rdi, rax
lea rdx, str.DISK
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rbx, rbx
je 0x140094a26
test rdi, rdi
je 0x140094a26
test rax, rax
je 0x140094a26
mov dword [rsi + 0x77c], r15d
lea rdx, [0x1401003b0]
call fcn.140093a60
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140094b04
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, [0x1400ff108]
mov rcx, r14
call fcn.140092fa0
cmp eax, r15d
je 0x140094b04
mov rcx, r14
call fcn.1400965f0
cmp eax, r15d
je 0x140094e2f
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x780]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x780]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov edx, 0xff
lea rcx, [rsp + 0x80]
call fcn.140093690
lea rdx, str.MICROSOFT_CORPORATION
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140094b04
mov dword [rsi + 0x764], r15d
lea rdx, [0x140100320]
call fcn.140093a60
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140094be2
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, str.BaseBoardManufacturer
mov rcx, r14
call fcn.140092fa0
cmp eax, r15d
je 0x140094be2
mov rcx, r14
call fcn.1400965f0
cmp eax, r15d
je 0x140094e2f
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0xa8c]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0xa8c]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov edx, 0xff
lea rcx, [rsp + 0x80]
call fcn.140093690
lea rdx, [0x1400ffbf8]
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140094be2
mov dword [rsi + 0x778], r15d
lea rdx, [0x140100290]
call fcn.140093a60
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140094cc0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, str.BaseBoardProduct
mov rcx, r14
call fcn.140092fa0
cmp eax, r15d
je 0x140094cc0
mov rcx, r14
call fcn.1400965f0
cmp eax, r15d
je 0x140094e2f
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x988]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x988]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov edx, 0xff
lea rcx, [rsp + 0x80]
call fcn.140093690
lea rdx, str.VIRTUAL_MACHINE
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140094cc0
mov dword [rsi + 0x76c], r15d
cmp word [rsp + 0x80], 0
je 0x140094cec
lea rdx, str.SURFACE
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140094cec
mov dword [rsi + 0x770], r15d
lea rdx, [0x140100200]
call fcn.140093a60
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140094dca
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, str.SystemProductName
mov rcx, r14
call fcn.140092fa0
cmp eax, r15d
je 0x140094dca
mov rcx, r14
call fcn.1400965f0
cmp eax, r15d
je 0x140094e2f
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0xc94]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0xc94]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov edx, 0xff
lea rcx, [rsp + 0x80]
call fcn.140093690
lea rdx, [0x1400ff0e8]
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140094dca
mov dword [rsi + 0x774], r15d
lea rdx, [0x140100180]
call fcn.140093a60
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140094eda
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, str.SystemFamily
mov rcx, r14
call fcn.140092fa0
cmp eax, r15d
je 0x140094eda
mov rcx, r14
call fcn.1400965f0
cmp eax, r15d
jne 0x140094e62
nop
test r14, r14
je 0x140094e42
mov rcx, r14
call fcn.1400965f0
mov qword [rsp + 0x30], r12
mov dword [rsi + 0xd98], r12d
mov dword [rsi + 0xd9c], r15d
mov eax, r15d
jmp 0x140094ff1
mov r14, r12
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x884]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x884]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov edx, 0xff
lea rcx, [rsp + 0x80]
call fcn.140093690
lea rdx, [0x1400ff048]
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140094eda
mov dword [rsi + 0x768], r15d
cmp word [rsp + 0x80], 0
je 0x140094f06
lea rdx, [0x1400fefb8]
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140094f06
mov dword [rsi + 0x770], r15d
cmp dword [rsi + 0x770], 0
jne 0x140094f89
cmp dword [rsi + 0x764], r15d
je 0x140094f45
cmp dword [rsi + 0x768], r15d
je 0x140094f45
cmp dword [rsi + 0x76c], r15d
je 0x140094f45
cmp dword [rsi + 0x774], r15d
je 0x140094f45
cmp dword [rsi + 0x778], r15d
je 0x140094f45
cmp dword [rsi + 0x77c], r15d
jne 0x140094f89
mov dword [rsi + 0x760], r15d
mov dword [rsi + 0xda0], 7
jmp 0x140094f89
mov dword [rsi + 0x548], r15d
mov dword [rsi + 0xda0], 5
jmp 0x140094f89
mov dword [rsi + 0x224], r15d
mov dword [rsi + 0xda0], 4
jmp 0x140094f89
mov dword [rsi + 0xc], r15d
mov dword [rsi + 0xda0], r15d
test r14, r14
je 0x140094f9b
mov rcx, r14
call fcn.1400965f0
mov qword [rsp + 0x30], r12
cmp dword [rsi + 0xc], 0
jne 0x140094fda
cmp dword [rsi + 0x118], 0
jne 0x140094fda
cmp dword [rsi + 0x220], 0
jne 0x140094fda
cmp dword [rsi + 0x224], 0
jne 0x140094fda
cmp dword [rsi + 0x548], 0
jne 0x140094fda
cmp dword [rsi + 0x75c], 0
jne 0x140094fda
cmp dword [rsi + 0x760], 0
jne 0x140094fda
mov r15d, r12d
mov dword [rsi + 0xd98], r15d
mov dword [rsi + 0xd9c], r12d
xor eax, eax
jmp 0x140094ff1
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.140001ea0
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret