Function at 0x401de6
Capabilities:
Check os version

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x4e4
call dbg.__main
mov byte [ebp - 9], 0
mov dword [esp], str.Start
call sym.write_log_char_
call sym.init_cmd_colors__
call sym.print_header__
mov dword [esp + 8], 0x94
mov dword [esp + 4], 0
lea eax, [ebp - 0x4c0]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x4c0], 0x94
lea eax, [ebp - 0x4c0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetVersionExA]
call eax
sub esp, 4
mov ecx, dword [ebp - 0x4b4]
mov edx, dword [ebp - 0x4b8]
mov eax, dword [ebp - 0x4bc]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._d._d_build__d
mov dword [esp + 4], 0x20
lea eax, [ebp - 0x29]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__snprintf]
call eax
lea eax, [ebp - 0x29]
mov dword [esp + 4], eax
mov dword [esp], str.___Windows_version:__s_n
call sym._printf
lea eax, [ebp - 0x29]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Windows_version:__s
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x429]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__snprintf]
call eax
lea eax, [ebp - 0x429]
mov dword [esp], eax
call sym.write_log_char_
mov dword [esp], str.___Running_checks_...
call sym._puts
mov dword [esp], str._n____Debuggers_detection
call sym._puts
mov dword [esp], str.___Using_IsDebuggerPresent___...
call sym._printf
call sym.debug_isdebuggerpresent__
test eax, eax
sete al
test al, al
je 0x401f2c
mov dword [esp], str.Debugger_traced_using_IsDebuggerPresent__
call sym.write_log_char_
call sym.print_traced__
mov byte [ebp - 9], 1
mov dword [esp], str.hi_debugger_isdebuggerpresent
call sym.write_trace_char_
jmp 0x401f31
call sym.print_not_traced__
mov eax, dword [ebp - 0x4bc]
cmp eax, 5
ja 0x401f7e
mov dword [esp], str.___Using_OutputDebugString___...
call sym._printf
call sym.debug_outputdebugstring__
test eax, eax
sete al
test al, al
je 0x401f79
mov dword [esp], str.Debugger_traced_using_OutputDebugString__
call sym.write_log_char_
call sym.print_traced__
mov byte [ebp - 9], 1
mov dword [esp], str.hi_debugger_outputdebugstring
call sym.write_trace_char_
jmp 0x401f7e
call sym.print_not_traced__
mov dword [esp], str._n____Generic_sandbox_detection
call sym._puts
mov dword [esp], str.___Checking_username_...
call sym._printf
call sym.gensandbox_username__
test eax, eax
sete al
test al, al
je 0x401fc7
call sym.print_traced__
mov byte [ebp - 9], 1
mov dword [esp], str.Sandbox_traced_by_checking_username
call sym.write_log_char_
mov dword [esp], str.hi_sandbox_username
call sym.write_trace_char_
jmp 0x401fcc
call sym.print_not_traced__
mov dword [esp], str.___Checking_file_path_...
call sym._printf
call sym.gensandbox_path__
test eax, eax
sete al
test al, al
je 0x402009
call sym.print_traced__
mov byte [ebp - 9], 1
mov dword [esp], str.Sandbox_traced_by_checking_file_path
call sym.write_log_char_
mov dword [esp], str.hi_sandbox_path
call sym.write_trace_char_
jmp 0x40200e
call sym.print_not_traced__
mov dword [esp], str.___Checking_if_disk_size___50GB_...
call sym._printf
call sym.gensandbox_drive_size__
test eax, eax
sete al
test al, al
je 0x40204b
call sym.print_traced__
mov byte [ebp - 9], 1
mov dword [esp], str.Sandbox_traced_by_checking_disk_size___50GB
call sym.write_log_char_
mov dword [esp], str.hi_sandbox_drive_size
call sym.write_trace_char_
jmp 0x402050
call sym.print_not_traced__
mov dword [esp], str._n____Hooks_detection
call sym._puts
mov dword [esp], str.___Checking_function_DeleteFileW_method_1_...
call sym._printf
call sym.check_hook_DeleteFileW_m1__
test eax, eax
sete al
test al, al
je 0x402099
call sym.print_traced__
mov byte [ebp - 9], 1
mov dword [esp], str.Hooks_traced_using_DeleteFileW_method_1
call sym.write_log_char_
mov dword [esp], str.hi_hooks_deletefile_m1
call sym.write_trace_char_
jmp 0x40209e
call sym.print_not_traced__
mov dword [esp], str._n____Sandboxie_detection
call sym._puts
mov dword [esp], str.___Using_sbiedll.dll_...
call sym._printf
call sym.sboxie_detect_sbiedll__
test eax, eax
sete al
test al, al
je 0x4020e7
mov dword [esp], str.Sandboxie_traced_using_sbiedll.dll
call sym.write_log_char_
call sym.print_traced__
mov byte [ebp - 9], 1
mov dword [esp], str.hi_sandboxie
call sym.write_trace_char_
jmp 0x4020ec
call sym.print_not_traced__
mov dword [esp], str._n____Wine_detection
call sym._puts
mov dword [esp], str.___Using_GetProcAddress_wine_get_unix_file_name__from_kernel32.dll_...
call sym._printf
call sym.wine_detect_get_unix_file_name__
test eax, eax
sete al
test al, al
je 0x402135
mov dword [esp], str.Wine_traced_using_GetProcAddress_wine_get_unix_file_name__from_kernel32.dll
call sym.write_log_char_
call sym.print_traced__
mov byte [ebp - 9], 1
mov dword [esp], str.hi_wine
call sym.write_trace_char_
jmp 0x40213a
call sym.print_not_traced__
mov dword [esp], str._n____VirtualBox_detection
call sym._puts
mov dword [esp], str.___Scsi_port__bus__target_id__logical_unit_id___0_identifier_...
call sym._printf
call sym.vbox_reg_key1__
test eax, eax
sete al
test al, al
je 0x402183
mov dword [esp], str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0__Identifier_
call sym.write_log_char_
call sym.print_traced__
mov byte [ebp - 9], 1
mov dword [esp], str.hi_virtualbox
call sym.write_trace_char_
jmp 0x402188
call sym.print_not_traced__
mov dword [esp], str.___Reg_key__HKLMHARDWAREDescriptionSystem__SystemBiosVersion___...
call sym._printf
call sym.vbox_reg_key2__
test eax, eax
sete al
test al, al
je 0x4021c5
mov dword [esp], str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREDescriptionSystem__SystemBiosVersion_
call sym.write_log_char_
call sym.print_traced__
mov byte [ebp - 9], 1
mov dword [esp], str.hi_virtualbox
call sym.write_trace_char_
jmp 0x4021ca
call sym.print_not_traced__
mov dword [esp], str.___Reg_key__HKLMSOFTWAREOracleVirtualBox_Guest_Additions__...
call sym._printf
call sym.vbox_reg_key3__
test eax, eax
sete al
test al, al
je 0x402207
mov dword [esp], str.VirtualBox_traced_using_Reg_key_HKLMSOFTWAREOracleVirtualBox_Guest_Additions
call sym.write_log_char_
call sym.print_traced__
mov byte [ebp - 9], 1
mov dword [esp], str.hi_virtualbox
call sym.write_trace_char_
jmp 0x40220c
call sym.print_not_traced__
mov dword [esp], str.___Reg_key__HKLMHARDWAREDescriptionSystem__VideoBiosVersion___...
call sym._printf
call sym.vbox_reg_key4__
test eax, eax
sete al
test al, al
je 0x402249
mov dword [esp], str.VirtualBox_traced_using_Reg_key_HKLMHARDWAREDescriptionSystem__VideoBiosVersion_
call sym.write_log_char_
call sym.print_traced__
mov byte [ebp - 9], 1
mov dword [esp], str.hi_virtualbox
call sym.write_trace_char_
jmp 0x40224e
call sym.print_not_traced__
mov dword [esp], str.___Looking_for_C:WINDOWS_system32driversVBoxMouse.sys_...
call sym._printf
call sym.vbox_sysfile1__
test eax, eax
sete al
test al, al
je 0x40228b
mov dword [esp], str.VirtualBox_traced_using_file_C:WINDOWS_system32driversVBoxMouse.sys
call sym.write_log_char_
call sym.print_traced__
mov byte [ebp - 9], 1
mov dword [esp], str.hi_virtualbox
call sym.write_trace_char_
jmp 0x402290
call sym.print_not_traced__
mov dword [esp], str._n____VMware_detection
call sym._puts
mov dword [esp], str.___Scsi_port__bus__target_id__logical_unit_id___0_identifier_...
call sym._printf
call sym.vmware_reg_key1__
test eax, eax
sete al
test al, al
je 0x4022d9
mov dword [esp], str.VMWare_traced_using_Reg_key_HKLMHARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0__Identifier_
call sym.write_log_char_
call sym.print_traced__
mov byte [ebp - 9], 1
mov dword [esp], str.hi_vmware
call sym.write_trace_char_
jmp 0x4022de
call sym.print_not_traced__
mov dword [esp], str.___Reg_key__HKLMSOFTWAREVMware__Inc.VMware_Tools__...
call sym._printf
call sym.vmware_reg_key2__
test eax, eax
sete al
test al, al
je 0x40231b
mov dword [esp], str.VMware_traced_using_Reg_key_HKLMSOFTWAREVMware__Inc.VMware_Tools
call sym.write_log_char_
call sym.print_traced__
mov byte [ebp - 9], 1
mov dword [esp], str.hi_vmware
call sym.write_trace_char_
jmp 0x402320
call sym.print_not_traced__
mov dword [esp], str.___Looking_for_C:WINDOWS_system32drivers_vmmouse.sys_...
call sym._printf
call sym.vmware_sysfile1__
test eax, eax
sete al
test al, al
je 0x40235d
mov dword [esp], str.VMware_traced_using_file_C:WINDOWS_system32drivers_vmmouse.sys
call sym.write_log_char_
call sym.print_traced__
mov byte [ebp - 9], 1
mov dword [esp], str.hi_vmware
call sym.write_trace_char_
jmp 0x402362
call sym.print_not_traced__
mov dword [esp], str.___Looking_for_C:WINDOWS_system32drivers_vmhgfs.sys_...
call sym._printf
call sym.vmware_sysfile2__
test eax, eax
sete al
test al, al
je 0x40239f
mov dword [esp], str.VMware_traced_using_file_C:WINDOWS_system32drivers_vmhgfs.sys
call sym.write_log_char_
call sym.print_traced__
mov byte [ebp - 9], 1
mov dword [esp], str.hi_vmware
call sym.write_trace_char_
jmp 0x4023a4
call sym.print_not_traced__
mov dword [esp], str._n____Qemu_detection
call sym._puts
mov dword [esp], str.___Scsi_port__bus__target_id__logical_unit_id___0_identifier_...
call sym._printf
call sym.qemu_reg_key1__
test eax, eax
sete al
test al, al
je 0x4023ed
mov dword [esp], str.Qemu_traced_using_Reg_key_HKLMHARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0__Identifier_
call sym.write_log_char_
call sym.print_traced__
mov byte [ebp - 9], 1
mov dword [esp], str.hi_qemu
call sym.write_trace_char_
jmp 0x4023f2
call sym.print_not_traced__
mov dword [esp], str.___Reg_key__HKLMHARDWAREDescriptionSystem__SystemBiosVersion___...
call sym._printf
call sym.qemu_reg_key2__
test eax, eax
sete al
test al, al
je 0x40242f
mov dword [esp], str.Qemu_traced_using_Reg_key_HKLMHARDWAREDescriptionSystem__SystemBiosVersion_
call sym.write_log_char_
call sym.print_traced__
mov byte [ebp - 9], 1
mov dword [esp], str.hi_qemu
call sym.write_trace_char_
jmp 0x402434
call sym.print_not_traced__
movzx eax, byte [ebp - 9]
xor eax, 1
test al, al
je 0x402472
mov dword [esp], str._n____Simulated_malware_download
call sym._puts
call sym.simulate_malware_download__
mov dword [esp], str._n____Simulated_malware_mutex
call sym._puts
call sym.simulate_malware_mutex__
mov dword [esp], str._n____Simulated_malware_dropper
call sym._puts
call sym.simulate_malware_dropper__
mov dword [esp], 0x405d43
call sym._puts
mov dword [esp], str.____Finished__feel_free_to_RE_me.
call sym._puts
mov dword [esp], 0x405d6a
call sym.write_log_char_
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], eax
call sym._fflush
call sym._getchar
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret