Function at 0x423dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c543
mov eax, dword fs:[0]
push eax
sub esp, 0x884
mov eax, dword [0x43a080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov ecx, edi
mov esi, dword [ebp + 8]
push 0
push str._or
mov dword [ebp - 0x884], esi
call fcn.00415280
xorps xmm0, xmm0
cmp eax, 0xffffffff
je 0x423e63
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 7
mov dword [esi + 0x14], 0xf
mov ecx, dword [str.Unknown]
mov dword [esi], ecx
mov cx, word [0x43268c]
mov word [esi + 4], cx
mov cl, byte [0x43268e]
mov byte [esi + 6], cl
mov byte [esi + 7], 0
jmp 0x424fd0
mov eax, dword [str.Xen_HVM]
movups xmmword [ebp - 0x880], xmm0
mov dword [ebp - 0x880], eax
movzx eax, word [0x4307b8]
mov word [ebp - 0x87c], ax
movzx eax, byte [0x4307ba]
mov dword [ebp - 0x870], 7
mov dword [ebp - 0x86c], 0xf
mov byte [ebp - 0x87a], al
mov byte [ebp - 0x879], 0
lea eax, [ebp - 0x884]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x868]
mov dword [ebp - 0x858], 0
push eax
push ecx
movups xmmword [ebp - 0x868], xmm0
mov dword [ebp - 0x854], 0
mov dword [ebp - 0x884], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0x884]
mov edx, eax
mov dword [ebp - 0x854], ecx
mov dword [ebp - 0x868], edx
mov dword [ebp - 0x858], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x433560]
mov word [edx + 0x10], cx
movzx eax, byte [0x433562]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
movzx eax, word [0x430734]
xorps xmm0, xmm0
movups xmmword [ebp - 0x850], xmm0
mov dword [ebp - 4], 1
movq xmm0, qword [str.VMware_ESX]
mov dword [ebp - 0x840], 0xa
mov dword [ebp - 0x83c], 0xf
movq qword [ebp - 0x850], xmm0
mov word [ebp - 0x848], ax
mov byte [ebp - 0x846], 0
lea eax, [ebp - 0x884]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x838]
mov dword [ebp - 0x828], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x824], 0
push ecx
movups xmmword [ebp - 0x838], xmm0
mov dword [ebp - 0x884], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0x884]
mov edx, eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x838], edx
mov dword [ebp - 0x828], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x433560]
mov word [edx + 0x10], cx
movzx eax, byte [0x433562]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
mov eax, dword [str.ACRN]
xorps xmm0, xmm0
movups xmmword [ebp - 0x820], xmm0
mov dword [ebp - 0x810], 4
mov dword [ebp - 0x80c], 0xf
mov dword [ebp - 0x820], eax
mov byte [ebp - 0x81c], 0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x808]
movups xmmword [ebp - 0x808], xmm0
mov dword [ebp - 0x7f8], 0
lea eax, [ebp - 0x884]
mov dword [ebp - 0x7f4], 0
push eax
push ecx
mov dword [ebp - 0x884], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0x884]
mov edx, eax
mov dword [ebp - 0x7f4], ecx
mov dword [ebp - 0x808], edx
mov dword [ebp - 0x7f8], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x433560]
mov word [edx + 0x10], cx
movzx eax, byte [0x433562]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
mov eax, dword [0x4307cc]
xorps xmm0, xmm0
movups xmmword [ebp - 0x7f0], xmm0
mov dword [ebp - 0x7e8], eax
movq xmm0, qword [str.QNX_hypervisor]
movzx eax, word [0x4307d0]
mov dword [ebp - 0x7e0], 0xe
mov dword [ebp - 0x7dc], 0xf
movq qword [ebp - 0x7f0], xmm0
mov word [ebp - 0x7e4], ax
mov byte [ebp - 0x7e2], 0
lea eax, [ebp - 0x884]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x7d8]
mov dword [ebp - 0x7c8], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x7c4], 0
push ecx
movups xmmword [ebp - 0x7d8], xmm0
mov dword [ebp - 0x884], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0x884]
mov edx, eax
mov dword [ebp - 0x7c4], ecx
mov dword [ebp - 0x7d8], edx
mov dword [ebp - 0x7c8], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x433560]
mov word [edx + 0x10], cx
movzx eax, byte [0x433562]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
lea eax, [ebp - 0x884]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x7c0]
mov dword [ebp - 0x7b0], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x7ac], 0
push ecx
movups xmmword [ebp - 0x7c0], xmm0
mov dword [ebp - 0x884], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.Microsoft_Hyper_V]
mov ecx, dword [ebp - 0x884]
mov dword [ebp - 0x7ac], ecx
mov dword [ebp - 0x7c0], eax
mov dword [ebp - 0x7b0], 0x11
movups xmmword [eax], xmm0
mov cl, byte [0x43078c]
mov byte [eax + 0x10], cl
mov byte [eax + 0x11], 0
xorps xmm0, xmm0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x7a8]
mov dword [ebp - 0x798], 0
movups xmmword [ebp - 0x7a8], xmm0
lea eax, [ebp - 0x884]
mov dword [ebp - 0x794], 0
push eax
push ecx
mov dword [ebp - 0x884], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0x884]
mov edx, eax
mov dword [ebp - 0x794], ecx
mov dword [ebp - 0x7a8], edx
mov dword [ebp - 0x798], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x433560]
mov word [edx + 0x10], cx
movzx eax, byte [0x433562]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
lea eax, [ebp - 0x884]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x790]
mov dword [ebp - 0x780], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x77c], 0
push ecx
movups xmmword [ebp - 0x790], xmm0
mov dword [ebp - 0x884], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.Microsoft_Azure_Hyper_V]
mov ecx, dword [ebp - 0x884]
mov edx, eax
mov dword [ebp - 0x77c], ecx
mov dword [ebp - 0x790], edx
mov dword [ebp - 0x780], 0x17
movups xmmword [edx], xmm0
mov ecx, dword [0x430910]
mov dword [edx + 0x10], ecx
movzx eax, word [0x430914]
mov word [edx + 0x14], ax
movzx eax, byte [0x430916]
mov byte [edx + 0x16], al
mov byte [edx + 0x17], 0
lea eax, [ebp - 0x884]
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x778]
mov dword [ebp - 0x768], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x764], 0
push ecx
movups xmmword [ebp - 0x778], xmm0
mov dword [ebp - 0x884], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0x884]
mov edx, eax
mov dword [ebp - 0x764], ecx
add esp, 0x40
mov dword [ebp - 0x778], edx
mov dword [ebp - 0x768], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x433560]
mov word [edx + 0x10], cx
movzx eax, byte [0x433562]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
lea eax, [ebp - 0x884]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x760]
mov dword [ebp - 0x750], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x74c], 0
push ecx
movups xmmword [ebp - 0x760], xmm0
mov dword [ebp - 0x884], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.Xbox_NanoVisor__Hyper_V_]
mov ecx, dword [ebp - 0x884]
mov dword [ebp - 0x760], eax
mov dword [ebp - 0x750], 0x18
mov dword [ebp - 0x74c], ecx
movups xmmword [eax], xmm0
movq xmm0, qword [0x430934]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x884]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x748]
mov dword [ebp - 0x738], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x734], 0
push ecx
movups xmmword [ebp - 0x748], xmm0
mov dword [ebp - 0x884], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0x884]
mov edx, eax
mov dword [ebp - 0x734], ecx
mov dword [ebp - 0x748], edx
mov dword [ebp - 0x738], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x433560]
mov word [edx + 0x10], cx
movzx eax, byte [0x433562]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
xorps xmm0, xmm0
mov dword [ebp - 0x720], 4
movups xmmword [ebp - 0x730], xmm0
mov dword [ebp - 0x71c], 0xf
mov dword [ebp - 0x730], 0x204d564b
mov byte [ebp - 0x72c], 0
lea eax, [ebp - 0x884]
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x718]
mov dword [ebp - 0x708], 0
push eax
push ecx
movups xmmword [ebp - 0x718], xmm0
mov dword [ebp - 0x704], 0
mov dword [ebp - 0x884], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0x884]
mov edx, eax
mov dword [ebp - 0x704], ecx
mov dword [ebp - 0x718], edx
mov dword [ebp - 0x708], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x433560]
mov word [edx + 0x10], cx
movzx eax, byte [0x433562]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
mov eax, dword [str.bhyve]
xorps xmm0, xmm0
movups xmmword [ebp - 0x700], xmm0
mov dword [ebp - 0x700], eax
movzx eax, byte [0x430770]
mov dword [ebp - 0x6f0], 5
mov dword [ebp - 0x6ec], 0xf
mov byte [ebp - 0x6fc], al
mov byte [ebp - 0x6fb], 0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x6e8]
movups xmmword [ebp - 0x6e8], xmm0
mov dword [ebp - 0x6d8], 0
lea eax, [ebp - 0x884]
mov dword [ebp - 0x6d4], 0
mov dword [ebp - 0x884], 0x1f
push eax
push ecx
call fcn.004051b0
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0x884]
mov edx, eax
mov dword [ebp - 0x6d4], ecx
mov dword [ebp - 0x6e8], edx
mov dword [ebp - 0x6d8], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x433560]
mov word [edx + 0x10], cx
movzx eax, byte [0x433562]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
lea eax, [ebp - 0x884]
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x6d0]
mov dword [ebp - 0x6c0], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x6bc], 0
push ecx
movups xmmword [ebp - 0x6d0], xmm0
mov dword [ebp - 0x884], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.KVM_Hyper_V_Enlightenment]
mov ecx, dword [ebp - 0x884]
mov edx, eax
mov dword [ebp - 0x6d0], edx
mov dword [ebp - 0x6c0], 0x19
mov dword [ebp - 0x6bc], ecx
movups xmmword [edx], xmm0
movq xmm0, qword [0x430868]
movq qword [edx + 0x10], xmm0
movzx eax, byte [0x430870]
mov byte [edx + 0x18], al
mov byte [edx + 0x19], 0
lea eax, [ebp - 0x884]
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x6b8]
mov dword [ebp - 0x6a8], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x6a4], 0
push ecx
movups xmmword [ebp - 0x6b8], xmm0
mov dword [ebp - 0x884], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0x884]
mov edx, eax
mov dword [ebp - 0x6a4], ecx
mov dword [ebp - 0x6b8], edx
mov dword [ebp - 0x6a8], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x433560]
mov word [edx + 0x10], cx
movzx eax, byte [0x433562]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
lea eax, [ebp - 0x884]
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x6a0]
mov dword [ebp - 0x690], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x68c], 0
push ecx
movups xmmword [ebp - 0x6a0], xmm0
mov dword [ebp - 0x884], 0x1f
call fcn.004051b0
mov ecx, dword [ebp - 0x884]
mov edx, eax
movups xmm0, xmmword [str.QEMUKVM_Hyper_V_Enlightenment]
mov dword [ebp - 0x6a0], edx
mov dword [ebp - 0x690], 0x1e
mov dword [ebp - 0x68c], ecx
movups xmmword [edx], xmm0
movq xmm0, qword [0x433574]
movq qword [edx + 0x10], xmm0
mov eax, dword [0x43357c]
mov dword [edx + 0x18], eax
movzx eax, word [0x433580]
mov word [edx + 0x1c], ax
mov byte [edx + 0x1e], 0
lea eax, [ebp - 0x884]
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x688]
mov dword [ebp - 0x678], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x674], 0
push ecx
movups xmmword [ebp - 0x688], xmm0
mov dword [ebp - 0x884], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0x884]
mov edx, eax
mov dword [ebp - 0x674], ecx
add esp, 0x40
mov dword [ebp - 0x688], edx
mov dword [ebp - 0x678], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x433560]
mov word [edx + 0x10], cx
movzx eax, byte [0x433562]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
xorps xmm0, xmm0
mov dword [ebp - 0x660], 8
movups xmmword [ebp - 0x670], xmm0
mov dword [ebp - 0x65c], 0xf
mov dword [ebp - 0x670], 0x554d4551
mov dword [ebp - 0x66c], 0x4d564b2b
mov byte [ebp - 0x668], 0
lea eax, [ebp - 0x884]
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x658]
mov dword [ebp - 0x648], 0
push eax
push ecx
movups xmmword [ebp - 0x658], xmm0
mov dword [ebp - 0x644], 0
mov dword [ebp - 0x884], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0x884]
mov edx, eax
mov dword [ebp - 0x644], ecx
add esp, 8
mov dword [ebp - 0x658], edx
mov dword [ebp - 0x648], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x433560]
mov word [edx + 0x10], cx
movzx eax, byte [0x433562]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
push str.Hypervisor__type_1_
push str.Intel_HAXM
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 0x17
call fcn.00404950
push str.Hypervisor__type_1_
push str.Intel_KGT__Trusty_
lea ecx, [ebp - 0x610]
mov byte [ebp - 4], 0x18
call fcn.00404950
push str.Hypervisor__type_1_
mov byte [ebp - 4], 0x19
push str.SimpleVisor
lea ecx, [ebp - 0x5e0]
call fcn.00404950
push str.Hypervisor__type_2_
push str.VirtualBox
lea ecx, [ebp - 0x5b0]
mov byte [ebp - 4], 0x1a
call fcn.00404950
mov eax, dword [0x430714]
xorps xmm0, xmm0
movups xmmword [ebp - 0x580], xmm0
mov dword [ebp - 0x580], eax
movzx eax, word [0x430718]
mov dword [ebp - 0x570], 6
mov dword [ebp - 0x56c], 0xf
mov word [ebp - 0x57c], ax
mov byte [ebp - 0x57a], 0
lea eax, [ebp - 0x884]
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x568]
mov dword [ebp - 0x558], 0
push eax
push ecx
movups xmmword [ebp - 0x568], xmm0
mov dword [ebp - 0x554], 0
mov dword [ebp - 0x884], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.Hypervisor__type_2_]
mov ecx, dword [ebp - 0x884]
mov edx, eax
mov dword [ebp - 0x554], ecx
add esp, 8
mov dword [ebp - 0x568], edx
mov dword [ebp - 0x558], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x4335a0]
mov word [edx + 0x10], cx
movzx eax, byte [0x4335a2]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
push str.Hypervisor__type_2_
push str.VMware_Express
lea ecx, [ebp - 0x550]
mov byte [ebp - 4], 0x1d
call fcn.00404950
push str.Hypervisor__type_2_
push str.VMware_GSX
lea ecx, [ebp - 0x520]
mov byte [ebp - 4], 0x1e
call fcn.00404950
push str.Hypervisor__type_2_
push str.VMware_Workstation
lea ecx, [ebp - 0x4f0]
mov byte [ebp - 4], 0x1f
call fcn.00404950
push str.Hypervisor__type_2_
push str.VMware_Fusion
lea ecx, [ebp - 0x4c0]
mov byte [ebp - 4], 0x20
call fcn.00404950
movzx eax, byte [0x4307b0]
xorps xmm0, xmm0
movups xmmword [ebp - 0x490], xmm0
mov dword [ebp - 0x480], 9
movq xmm0, qword [str.Parallels]
mov dword [ebp - 0x47c], 0xf
movq qword [ebp - 0x490], xmm0
mov byte [ebp - 0x488], al
mov byte [ebp - 0x487], 0
xorps xmm0, xmm0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x478]
movups xmmword [ebp - 0x478], xmm0
lea eax, [ebp - 0x884]
mov dword [ebp - 0x468], 0
push eax
push ecx
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x884], 0x1f
call fcn.004051b0
movups xmm0, xmmword [str.Hypervisor__type_2_]
mov ecx, dword [ebp - 0x884]
mov edx, eax
mov dword [ebp - 0x464], ecx
add esp, 8
mov dword [ebp - 0x478], edx
mov dword [ebp - 0x468], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x4335a0]
mov word [edx + 0x10], cx
movzx eax, byte [0x4335a2]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
push str.Hypervisor__type_2_
push str.Virtual_PC
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 0x23
call fcn.00404950
push str.Hypervisor__type_2_
push str.Virtual_Apple
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], 0x24
call fcn.00404950
push str.Hypervisor__type_2_
push str.NetBSD_NVMM
lea ecx, [ebp - 0x400]
mov byte [ebp - 4], 0x25
call fcn.00404950
push str.Hypervisor__type_2_
push str.OpenBSD_VMM
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 0x26
call fcn.00404950
push str.Sandbox
push str.Cuckoo
lea ecx, [ebp - 0x3a0]
mov byte [ebp - 4], 0x27
call fcn.00404950
push str.Sandbox
push str.Sandboxie
lea ecx, [ebp - 0x370]
mov byte [ebp - 4], 0x28
call fcn.00404950
mov eax, dword [0x4307dc]
xorps xmm0, xmm0
movups xmmword [ebp - 0x340], xmm0
mov dword [ebp - 0x338], eax
movzx eax, word [0x4307e0]
movq xmm0, qword [str.Hybrid_Analysis]
mov word [ebp - 0x334], ax
movzx eax, byte [0x4307e2]
mov dword [ebp - 0x330], 0xf
mov dword [ebp - 0x32c], 0xf
movq qword [ebp - 0x340], xmm0
mov byte [ebp - 0x332], al
mov byte [ebp - 0x331], 0
mov eax, dword [str.Sandbox]
xorps xmm0, xmm0
movups xmmword [ebp - 0x328], xmm0
mov dword [ebp - 0x328], eax
movzx eax, word [0x430960]
mov word [ebp - 0x324], ax
movzx eax, byte [0x430962]
mov dword [ebp - 0x318], 7
mov dword [ebp - 0x314], 0xf
mov byte [ebp - 0x322], al
mov byte [ebp - 0x321], 0
push str.Sandbox
push str.CWSandbox
lea ecx, [ebp - 0x310]
mov byte [ebp - 4], 0x2b
call fcn.00404950
push str.Sandbox
push str.JoeBox
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0x2c
call fcn.00404950
push str.Sandbox
push str.Anubis
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0x2d
call fcn.00404950
push str.Sandbox
push str.Comodo
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 0x2e
call fcn.00404950
mov eax, dword [0x430834]
xorps xmm0, xmm0
movups xmmword [ebp - 0x250], xmm0
mov dword [ebp - 0x240], 0xc
movq xmm0, qword [str.ThreatExpert]
mov dword [ebp - 0x23c], 0xf
movq qword [ebp - 0x250], xmm0
mov dword [ebp - 0x248], eax
mov byte [ebp - 0x244], 0
mov eax, dword [str.Sandbox]
xorps xmm0, xmm0
movups xmmword [ebp - 0x238], xmm0
mov dword [ebp - 0x238], eax
movzx eax, word [0x430960]
mov word [ebp - 0x234], ax
movzx eax, byte [0x430962]
mov dword [ebp - 0x228], 7
mov dword [ebp - 0x224], 0xf
mov byte [ebp - 0x232], al
mov byte [ebp - 0x231], 0
mov eax, dword [str.Bochs]
movups xmmword [ebp - 0x220], xmm0
mov dword [ebp - 0x220], eax
movzx eax, byte [0x430854]
mov dword [ebp - 0x210], 5
mov dword [ebp - 0x20c], 0xf
mov byte [ebp - 0x21c], al
mov byte [ebp - 0x21b], 0
movups xmmword [ebp - 0x208], xmm0
mov dword [ebp - 0x1f8], 8
mov dword [ebp - 0x1f4], 0xf
mov dword [ebp - 0x208], 0x6c756d45
mov dword [ebp - 0x204], 0x726f7461
mov byte [ebp - 0x200], 0
push 0xa
push str.BlueStacks
lea ecx, [ebp - 0x1f0]
mov byte [ebp - 4], 0x33
movups xmmword [ebp - 0x1f0], xmm0
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x1dc], 0
call fcn.004058a0
xorps xmm0, xmm0
mov byte [ebp - 4], 0x34
push 8
movups xmmword [ebp - 0x1d8], xmm0
mov dword [ebp - 0x1c8], 0
lea ecx, [ebp - 0x1d8]
mov dword [ebp - 0x1c4], 0
push str.Emulator
call fcn.004058a0
push 0x14
xorps xmm0, xmm0
mov byte [ebp - 4], 0x35
push str.Microsoft_x86_to_ARM
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x1b0], 0
movups xmmword [ebp - 0x1c0], xmm0
mov dword [ebp - 0x1ac], 0
call fcn.004058a0
push 8
xorps xmm0, xmm0
mov byte [ebp - 4], 0x36
push str.Emulator
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x198], 0
movups xmmword [ebp - 0x1a8], xmm0
mov dword [ebp - 0x194], 0
call fcn.004058a0
push 4
xorps xmm0, xmm0
mov byte [ebp - 4], 0x37
push str.QEMU
lea ecx, [ebp - 0x190]
mov dword [ebp - 0x180], 0
movups xmmword [ebp - 0x190], xmm0
mov dword [ebp - 0x17c], 0
call fcn.004058a0
push 8
xorps xmm0, xmm0
mov byte [ebp - 4], 0x38
push str.Emulator
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x168], 0
movups xmmword [ebp - 0x178], xmm0
mov dword [ebp - 0x164], 0
call fcn.004058a0
push str.Partitioning_Hypervisor
push str.Jailhouse
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x39
call fcn.00404950
push str.Partitioning_Hypervisor
push str.Unisys_s_Par
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x3a
call fcn.00404950
push str.Container
push str.Docker
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0x3b
call fcn.00404950
push str.Hypervisor__either_type_1_or_2_
push str.Microsoft_Virtual_PC_Hyper_V
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x3c
call fcn.00404950
push str.Hypervisor__unknown_type_
push str.Lockheed_Martin_LMHS
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x3d
call fcn.00404950
push str.Compatibility_layer
push str.Wine
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x3e
call fcn.00404950
push str.Unknown
mov byte [ebp - 4], 0x3f
push str.Apple_VZ
lea ecx, [ebp - 0x40]
call fcn.00404950
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x40
lea ecx, [ebp - 0x880]
push eax
push ecx
lea ecx, [ebp - 0x88c]
call fcn.0040b820
push fcn.0040c530
push 0x2d
push 0x30
lea eax, [ebp - 0x880]
mov byte [ebp - 4], 0x42
push eax
call fcn.004292e4
push edi
lea eax, [ebp - 0x884]
push eax
lea ecx, [ebp - 0x88c]
call fcn.00415230
mov eax, dword [ebp - 0x884]
mov ecx, esi
cmp eax, dword [ebp - 0x88c]
je 0x424fbb
add eax, 0x28
push eax
call fcn.0040b4b0
jmp 0x424fc5
push str.Unknown
call fcn.0040b560
lea ecx, [ebp - 0x88c]
call fcn.0040c2e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00429696
mov esp, ebp
pop ebp
ret