Function at 0x140003ac1
Capabilities:
Check for unmoving mouse cursor
Enumerate process modules
Get file size
Query or enumerate registry key
Read file via mapping

Disassembly:
push rbp
push rbx
mov eax, 0x1188
call fcn.140005e80
sub rsp, rax
lea rbp, [rsp + 0x80]
movups xmmword [rbp + 0x10f0], xmm6
call dbg.checkSystemSpecs()
test eax, eax
sete al
test al, al
je 0x140003b22
lea rax, str.Failed_system_specs_check.
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cout]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [0x1400410b0]
mov rdx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov ebx, 0
jmp 0x140004252
lea rax, [rbp + 0x1010]
mov rcx, rax
call dbg.getMacAddresses[abi:cxx11]()
lea rax, [rbp + 0x1010]
mov rcx, rax
call dbg.isRunningInVM(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&)
test al, al
je 0x140003b79
lea rax, str.Running_in_a_virtual_machine.
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cout]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [0x1400410b0]
mov rdx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov ebx, 0
jmp 0x140004243
call dbg.checkHDDName()
test al, al
je 0x140003bb7
lea rax, str.HDD_name_indicates_a_virtual_machine.
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cout]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [0x1400410b0]
mov rdx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov ebx, 0
jmp 0x140004243
call dbg.checkForDebuggingProcesses()
test al, al
je 0x140003bf5
lea rax, str.Suspicious_debugging_processes_detected.
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cout]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [0x1400410b0]
mov rdx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov ebx, 0
jmp 0x140004243
call dbg.checkComputerName()
test al, al
je 0x140003c33
lea rax, str.Computer_name_indicates_potential_VM.
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cout]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [0x1400410b0]
mov rdx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov ebx, 0
jmp 0x140004243
call dbg.checkRecentFiles()
test al, al
je 0x140003c71
lea rax, str.Too_few_recent_files_detected.
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cout]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [0x1400410b0]
mov rdx, rax
call sym.std::ostream::operator___std::ostream____std::ostream__
mov ebx, 0
jmp 0x140004243
lea rax, [rbp + 0x1000]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetCursorPos]
call rax
pxor xmm0, xmm0
movsd qword [rbp + 0x10e8], xmm0
lea rax, [rbp + 0x1008]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetCursorPos]
call rax
mov eax, dword [rbp + 0x1008]
mov edx, dword [rbp + 0x1000]
sub eax, edx
mov edx, 2
mov ecx, eax
call sym._ZSt3powIliEN9__gnu_cxx11__promote_2IDTplcvNS1_IT_XsrSt12__is_integerIS2_E7__valueEE6__typeELi0EcvNS1_IT0_XsrS3_IS7_E7__valueE
movapd xmm6, xmm0
mov eax, dword [rbp + 0x100c]
mov edx, dword [rbp + 0x1004]
sub eax, edx
mov edx, 2
mov ecx, eax
call sym._ZSt3powIliEN9__gnu_cxx11__promote_2IDTplcvNS1_IT_XsrSt12__is_integerIS2_E7__valueEE6__typeELi0EcvNS1_IT0_XsrS3_IS7_E7__valueE
addsd xmm6, xmm0
movq rax, xmm6
movq xmm0, rax
call sym.sqrt
movsd xmm1, qword [rbp + 0x10e8]
addsd xmm0, xmm1
movsd qword [rbp + 0x10e8], xmm0
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp + 0x1008]
mov qword [rbp + 0x1000], rax
movsd xmm0, qword [rbp + 0x10e8]
comisd xmm0, xmmword [0x140040860]
ja 0x140003d35
jmp 0x140003c90
nop
lea rdx, [rbp - 4]
mov rax, rbp
mov r8, rdx
mov edx, 0x1000
mov rcx, rax
call sym.K32EnumProcesses
mov eax, dword [rbp - 4]
shr eax, 2
mov dword [rbp + 0x10d8], eax
cmp dword [rbp + 0x10d8], 0x31
ja 0x140003d6c
mov ebx, 0
jmp 0x140004243
mov r9d, 3
lea r8, str.Restart_required
lea rax, str.Do_you_want_to_restart_your_computer_now_
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
mov dword [rbp + 0x10d4], eax
cmp dword [rbp + 0x10d4], 6
jne 0x140003daa
mov ebx, 0
jmp 0x140004243
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rax, str.SYSTEMControlSet001EnumUSBSTOR
mov rdx, rax
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rdx, [rbp - 0x14]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
call rax
mov eax, dword [rbp - 0x14]
test eax, eax
jne 0x140003e53
mov ebx, 0
jmp 0x140004243
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount64]
call rax
mov qword [rbp + 0x10c8], rax
lea rax, str.ntdll.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov rcx, rax
lea rax, str.NtDelayExecution
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x10c0], rax
mov qword [rbp - 0x20], 0xffffffffc4653600
mov r8, qword [rbp + 0x10c0]
lea rax, [rbp - 0x20]
mov rdx, rax
mov ecx, 0
call r8
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount64]
call rax
mov qword [rbp + 0x10b8], rax
mov rax, qword [rbp + 0x10b8]
sub rax, qword [rbp + 0x10c8]
cmp rax, 0x1869f
ja 0x140003ee1
mov ebx, 0
jmp 0x140004243
mov ecx, 0xf4240
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov qword [rbp + 0x10b0], 0x7ffe0004
mov qword [rbp + 0x10a8], 0x7ffe0324
mov qword [rbp + 0x10a0], 0x7ffe0320
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount64]
call rax
mov dword [rbp + 0x109c], eax
mov rax, qword [rbp + 0x10b0]
mov eax, dword [rax]
mov rdx, qword [rbp + 0x10a8]
mov edx, dword [rdx]
shl edx, 8
imul edx, eax
mov rax, qword [rbp + 0x10a0]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [rbp + 0x10b0]
mov eax, dword [rax]
mov eax, eax
imul rax, rcx
shr rax, 0x18
add eax, edx
mov dword [rbp + 0x1098], eax
mov eax, dword [rbp + 0x109c]
sub eax, dword [rbp + 0x1098]
cmp eax, 0x64
jbe 0x140003f89
mov eax, dword [rbp + 0x1098]
sub eax, dword [rbp + 0x109c]
cmp eax, 0x64
jbe 0x140003f89
mov ebx, 0
jmp 0x140004243
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rax, str.C:WindowsSystem32_ntdll.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x1090], rax
mov rax, qword [rbp + 0x1090]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSize]
call rax
mov dword [rbp + 0x108c], eax
mov rax, qword [rbp + 0x1090]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x1000002
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
call rax
mov qword [rbp + 0x1080], rax
mov rax, qword [rbp + 0x1080]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 4
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MapViewOfFile]
call rax
mov qword [rbp + 0x1078], rax
mov rax, qword [rbp + 0x1090]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x1078]
mov qword [rbp + 0x1070], rax
mov rax, qword [rbp + 0x1070]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x1078]
add rax, rdx
mov qword [rbp + 0x1068], rax
mov rax, qword [rbp + 0x1068]
add rax, 0x18
mov qword [rbp + 0x1060], rax
mov rax, qword [rbp + 0x1060]
mov eax, dword [rax + 0x70]
mov edx, eax
mov rax, qword [rbp + 0x1078]
add rax, rdx
mov qword [rbp + 0x1058], rax
mov rax, qword [rbp + 0x1058]
mov eax, dword [rax + 0x1c]
mov edx, eax
mov rax, qword [rbp + 0x1078]
add rax, rdx
mov qword [rbp + 0x1050], rax
mov rax, qword [rbp + 0x1058]
mov eax, dword [rax + 0x20]
mov edx, eax
mov rax, qword [rbp + 0x1078]
add rax, rdx
mov qword [rbp + 0x1048], rax
mov rax, qword [rbp + 0x1058]
mov eax, dword [rax + 0x24]
mov edx, eax
mov rax, qword [rbp + 0x1078]
add rax, rdx
mov qword [rbp + 0x1040], rax
mov qword [rbp + 0x10e0], 0
mov dword [rbp + 0x10dc], 0
jmp 0x1400041cf
mov eax, dword [rbp + 0x10dc]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x1048]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x1078]
add rax, rdx
mov qword [rbp + 0x1038], rax
mov rax, qword [rbp + 0x1038]
lea rdx, str.NtCreateThreadEx
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x1400041c8
mov eax, dword [rbp + 0x10dc]
cdqe
lea rdx, [rax + rax]
mov rax, qword [rbp + 0x1040]
add rax, rdx
movzx eax, word [rax]
movzx eax, ax
lea rdx, [rax*4]
mov rax, qword [rbp + 0x1050]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x1078]
add rax, rdx
mov qword [rbp + 0x10e0], rax
jmp 0x1400041e7
add dword [rbp + 0x10dc], 1
mov rax, qword [rbp + 0x1058]
mov eax, dword [rax + 0x18]
mov edx, dword [rbp + 0x10dc]
cmp edx, eax
jb 0x14000413a
lea rax, str.ntdll.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov rcx, rax
lea rax, str.NtCreateThreadEx
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x1030], rax
mov rdx, qword [rbp + 0x10e0]
mov rax, qword [rbp + 0x1030]
mov r8d, 0x10
mov rcx, rax
call sym.memcmp
test eax, eax
je 0x14000423e
mov ebx, 0
jmp 0x140004243
mov ebx, 1
lea rax, [rbp + 0x1010]
mov rcx, rax
call dbg.std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >::~vector()
mov eax, ebx
jmp 0x140004273
movups xmm6, xmmword [rbp + 0x10f0]
add rsp, 0x1188
pop rbx
pop rbp
ret