Function at 0x14007ba90
Capabilities:
Check for sandbox and av modules
Check if process is running under wine
Contain obfuscated stackstrings
Reference wmi statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x690
mov rax, qword [0x1400b1008]
xor rax, rsp
mov qword [rsp + 0x680], rax
mov rsi, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x480]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x280]
call sub.VCRUNTIME140.dll_memset
xor r12d, r12d
mov qword [rsp + 0x50], r12
mov r14d, r12d
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov dword [rsi + 0xd98], r12d
mov dword [rsi + 0xda0], r12d
mov dword [rsp + 0x58], 0x61774d56
mov dword [rsp + 0x5c], 0x4d566572
mov dword [rsp + 0x60], 0x65726177
mov qword [rsi], r12
mov qword [rsi + 8], r12
movups xmmword [rsp + 0x68], xmm0
mov r15d, 1
mov eax, r15d
xor ecx, ecx
cpuid
mov dword [rsp + 0x6c], ebx
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x74], edx
test eax, eax
jns 0x14007bbaf
movups xmmword [rsp + 0x68], xmm0
mov eax, 0x40000000
xor ecx, ecx
cpuid
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], ebx
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x74], edx
mov rax, qword [rsp + 0x68]
cmp rax, qword [rsp + 0x58]
jne 0x14007bbaf
mov rax, qword [rsp + 0x70]
cmp rax, qword [rsp + 0x60]
jne 0x14007bbaf
mov dword [rsi], r15d
lea rax, str.SELECT__FROM_Win32_BaseBoard
mov qword [rsp + 0x20], rax
lea r9, [0x1400f3248]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x480]
call fcn.140001140
mov word [rsp + 0x67c], r12w
lea rax, str.SerialNumber
mov qword [rsp + 0x20], rax
lea r9, [0x1400f31e8]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x280]
call fcn.140001140
mov word [rsp + 0x47c], r12w
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x280]
lea rcx, [rsp + 0x480]
call fcn.140076ba0
test eax, eax
jne 0x14007bc88
cmp word [rsp + 0x38], 8
jne 0x14007bce4
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x1400f3188]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x80]
call fcn.140001140
lea rcx, [rsp + 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov word [rsp + 0x27c], r12w
jmp 0x14007bce4
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
call fcn.14007b7c0
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14007cb5d
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, str.BIOSVendor
mov rcx, r14
call fcn.14007afc0
cmp eax, r15d
je 0x14007cb5d
mov rcx, r14
call fcn.14007ddf0
cmp eax, r15d
je 0x14007cb5d
mov r14, r12
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x10]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x10]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rdx, str.VMware_
lea rcx, [rsi + 0x10]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
mov rbx, rax
lea rdx, [0x1400f1fb4]
lea rcx, [rsi + 0x10]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rbx, rbx
jne 0x14007bd4a
test rax, rax
je 0x14007bd4e
mov dword [rsi + 4], r15d
cmp dword [rsi], r15d
je 0x14007cca7
cmp dword [rsi + 4], 0
jne 0x14007cca7
mov qword [rsi + 0x114], r12
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x480]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x280]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
lea rax, [0x1400f4198]
mov qword [rsp + 0x20], rax
lea r9, [0x1400f3058]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x480]
call fcn.140001140
mov word [rsp + 0x67c], r12w
lea rax, [0x1400f4710]
mov qword [rsp + 0x20], rax
lea r9, [0x1400f2ff8]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x280]
call fcn.140001140
mov word [rsp + 0x47c], r12w
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x280]
lea rcx, [rsp + 0x480]
call fcn.140076ba0
test eax, eax
jne 0x14007beca
cmp word [rsp + 0x38], 8
jne 0x14007beca
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x1400f2f98]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x80]
call fcn.140001140
lea rcx, [rsp + 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov word [rsp + 0x27c], r12w
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x11c]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x11c]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rdx, str.Microsoft_Corporation
lea rcx, [rsi + 0x11c]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14007c06c
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x480]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x280]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
lea rax, [0x1400f4108]
mov qword [rsp + 0x20], rax
lea r9, [0x1400f2e58]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x480]
call fcn.140001140
mov word [rsp + 0x67c], r12w
lea rax, str.Product
mov qword [rsp + 0x20], rax
lea r9, [0x1400f2df8]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x280]
call fcn.140001140
mov word [rsp + 0x47c], r12w
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x280]
lea rcx, [rsp + 0x480]
call fcn.140076ba0
test eax, eax
jne 0x14007c049
cmp word [rsp + 0x38], 8
jne 0x14007c049
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x1400f2d98]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x80]
call fcn.140001140
lea rcx, [rsp + 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov word [rsp + 0x27c], r12w
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x11c]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x11c]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rdx, str.Surface
lea rcx, [rsi + 0x11c]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
mov ecx, r12d
test rax, rax
sete cl
mov dword [rsi + 0x114], ecx
cmp dword [rsi + 0x114], r15d
jne 0x14007c08b
mov dword [rsi + 0x118], r15d
mov dword [rsi + 0xda0], 2
jmp 0x14007ccb2
mov dword [rsi + 0x220], r12d
lea rcx, [0x1400f46f0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007c0cf
lea rdx, str.wine_get_unix_file_name
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14007c0cf
mov dword [rsi + 0x220], r15d
mov dword [rsi + 0xda0], 3
jmp 0x14007ccb2
mov qword [rsi + 0x234], r12
mov qword [rsi + 0x228], r12
mov dword [rsi + 0x230], r12d
lea rdx, str.HARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
call fcn.14007b7c0
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14007c1bd
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, str.Identifier
mov rcx, r14
call fcn.14007afc0
cmp eax, r15d
je 0x14007c1bd
mov rcx, r14
call fcn.14007ddf0
cmp eax, r15d
je 0x14007cb5d
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x23c]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x23c]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rcx, [rsp + 0x80]
call fcn.1400778c0
lea rdx, str.VBOX
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14007c1bd
mov dword [rsi + 0x228], r15d
lea rdx, str.HARDWAREDESCRIPTIONSystem
call fcn.14007b7c0
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14007c296
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, str.SystemBiosVersion
mov rcx, r14
call fcn.14007afc0
cmp eax, r15d
je 0x14007c296
mov rcx, r14
call fcn.14007ddf0
cmp eax, r15d
je 0x14007cb5d
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x340]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x340]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rcx, [rsp + 0x80]
call fcn.1400778c0
lea rdx, [0x1400f45f8]
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14007c296
mov dword [rsi + 0x22c], r15d
lea rdx, [0x1400f2a78]
call fcn.14007b7c0
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14007c36f
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, str.VideoBiosVersion
mov rcx, r14
call fcn.14007afc0
cmp eax, r15d
je 0x14007c36f
mov rcx, r14
call fcn.14007ddf0
cmp eax, r15d
je 0x14007cb5d
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x444]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x444]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rcx, [rsp + 0x80]
call fcn.1400778c0
lea rdx, str.VIRTUALBOX
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14007c36f
mov dword [rsi + 0x230], r15d
lea rdx, str.SOFTWAREOracleVirtualBox_Guest_Additions
call fcn.14007b7c0
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14007c3a8
mov dword [rsi + 0x234], r15d
mov rcx, rax
call fcn.14007ddf0
cmp eax, r15d
je 0x14007cb5d
mov r14, r12
mov qword [rsp + 0x30], r12
xor edx, edx
lea rcx, str.C:WINDOWS_system32driversVBoxMouse.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
test eax, eax
jne 0x14007c3c7
mov dword [rsi + 0x238], r15d
mov eax, r15d
jmp 0x14007c3cd
mov eax, dword [rsi + 0x238]
cmp eax, r15d
je 0x14007cc94
cmp dword [rsi + 0x234], r15d
je 0x14007cc94
cmp dword [rsi + 0x228], r15d
je 0x14007cc94
cmp dword [rsi + 0x22c], r15d
je 0x14007cc94
cmp dword [rsi + 0x230], r15d
je 0x14007cc94
mov qword [rsi + 0x54c], r12
lea rdx, [0x1400f44d0]
call fcn.14007b7c0
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14007c4ea
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, [0x1400f2918]
mov rcx, r14
call fcn.14007afc0
cmp eax, r15d
je 0x14007c4ea
mov rcx, r14
call fcn.14007ddf0
cmp eax, r15d
je 0x14007cb5d
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x554]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x554]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rcx, [rsp + 0x80]
call fcn.1400778c0
lea rdx, str.QEMU
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14007c4ea
mov dword [rsi + 0x54c], r15d
lea rdx, [0x1400f2888]
call fcn.14007b7c0
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14007c5c6
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, [0x1400f2808]
mov rcx, r14
call fcn.14007afc0
cmp eax, r15d
je 0x14007c5c6
mov rcx, r14
call fcn.14007ddf0
cmp eax, r15d
je 0x14007cb5d
mov r14, r12
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x658]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x658]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rcx, [rsp + 0x80]
call fcn.1400778c0
lea rdx, [0x1400f44b0]
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14007c5c6
mov dword [rsi + 0x550], r15d
cmp dword [rsi + 0x54c], r15d
je 0x14007cc81
cmp dword [rsi + 0x550], r15d
je 0x14007cc81
mov dword [rsi + 0x75c], r12d
lea rcx, str.SbieDll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007c60f
mov dword [rsi + 0x75c], r15d
mov dword [rsi + 0xda0], 6
jmp 0x14007ccb2
mov qword [rsi + 0x764], r12
mov qword [rsi + 0x76c], r12
mov qword [rsi + 0x774], r12
mov dword [rsi + 0x77c], r12d
lea rdx, [0x1400f4410]
call fcn.14007b7c0
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14007c704
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, [0x1400f2728]
mov rcx, r14
call fcn.14007afc0
cmp eax, r15d
je 0x14007c704
mov rcx, r14
call fcn.14007ddf0
cmp eax, r15d
je 0x14007cb5d
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0xb90]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0xb90]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rcx, [rsp + 0x80]
call fcn.1400778c0
lea rdx, str.MSFT____VIRTUAL_DISK
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14007c704
mov dword [rsi + 0x77c], r15d
cmp dword [rsi + 0x77c], 0
jne 0x14007c768
lea rdx, [0x1400f4398]
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rbx, rax
lea rdx, str.VIRTUAL
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rdi, rax
lea rdx, [0x1400f4388]
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rbx, rbx
je 0x14007c768
test rdi, rdi
je 0x14007c768
test rax, rax
je 0x14007c768
mov dword [rsi + 0x77c], r15d
lea rdx, [0x1400f4340]
call fcn.14007b7c0
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14007c841
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, [0x1400f26b8]
mov rcx, r14
call fcn.14007afc0
cmp eax, r15d
je 0x14007c841
mov rcx, r14
call fcn.14007ddf0
cmp eax, r15d
je 0x14007cb5d
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x780]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x780]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rcx, [rsp + 0x80]
call fcn.1400778c0
lea rdx, str.MICROSOFT_CORPORATION
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14007c841
mov dword [rsi + 0x764], r15d
lea rdx, [0x1400f42e0]
call fcn.14007b7c0
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14007c91a
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, str.BaseBoardManufacturer
mov rcx, r14
call fcn.14007afc0
cmp eax, r15d
je 0x14007c91a
mov rcx, r14
call fcn.14007ddf0
cmp eax, r15d
je 0x14007cb5d
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0xa8c]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0xa8c]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rcx, [rsp + 0x80]
call fcn.1400778c0
lea rdx, [0x1400f3838]
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14007c91a
mov dword [rsi + 0x778], r15d
lea rdx, [0x1400f4270]
call fcn.14007b7c0
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14007c9f3
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, str.BaseBoardProduct
mov rcx, r14
call fcn.14007afc0
cmp eax, r15d
je 0x14007c9f3
mov rcx, r14
call fcn.14007ddf0
cmp eax, r15d
je 0x14007cb5d
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x988]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x988]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rcx, [rsp + 0x80]
call fcn.1400778c0
lea rdx, str.VIRTUAL_MACHINE
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14007c9f3
mov dword [rsi + 0x76c], r15d
cmp word [rsp + 0x80], 0
je 0x14007ca1f
lea rdx, str.SURFACE
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14007ca1f
mov dword [rsi + 0x770], r15d
lea rdx, [0x1400f41e0]
call fcn.14007b7c0
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14007caf8
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, str.SystemProductName
mov rcx, r14
call fcn.14007afc0
cmp eax, r15d
je 0x14007caf8
mov rcx, r14
call fcn.14007ddf0
cmp eax, r15d
je 0x14007cb5d
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0xc94]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0xc94]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rcx, [rsp + 0x80]
call fcn.1400778c0
lea rdx, [0x1400f3308]
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14007caf8
mov dword [rsi + 0x774], r15d
lea rdx, [0x1400f4150]
call fcn.14007b7c0
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14007cc03
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1fe
lea r8, [rsp + 0x80]
lea rdx, str.SystemFamily
mov rcx, r14
call fcn.14007afc0
cmp eax, r15d
je 0x14007cc03
mov rcx, r14
call fcn.14007ddf0
cmp eax, r15d
jne 0x14007cb90
nop
test r14, r14
je 0x14007cb70
mov rcx, r14
call fcn.14007ddf0
mov qword [rsp + 0x30], r12
mov dword [rsi + 0xd98], r12d
mov dword [rsi + 0xd9c], r15d
mov eax, r15d
jmp 0x14007cd1a
mov r14, r12
mov qword [rsp + 0x30], r12
xor edx, edx
mov r8d, 0x104
lea rcx, [rsi + 0x884]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov r8d, 0x104
lea rdx, [rsi + 0x884]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rcx, [rsp + 0x80]
call fcn.1400778c0
lea rdx, [0x1400f2f78]
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14007cc03
mov dword [rsi + 0x768], r15d
cmp word [rsp + 0x80], 0
je 0x14007cc2f
lea rdx, [0x1400f2bb8]
lea rcx, [rsp + 0x80]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14007cc2f
mov dword [rsi + 0x770], r15d
cmp dword [rsi + 0x770], 0
jne 0x14007ccb2
cmp dword [rsi + 0x764], r15d
je 0x14007cc6e
cmp dword [rsi + 0x768], r15d
je 0x14007cc6e
cmp dword [rsi + 0x76c], r15d
je 0x14007cc6e
cmp dword [rsi + 0x774], r15d
je 0x14007cc6e
cmp dword [rsi + 0x778], r15d
je 0x14007cc6e
cmp dword [rsi + 0x77c], r15d
jne 0x14007ccb2
mov dword [rsi + 0x760], r15d
mov dword [rsi + 0xda0], 7
jmp 0x14007ccb2
mov dword [rsi + 0x548], r15d
mov dword [rsi + 0xda0], 5
jmp 0x14007ccb2
mov dword [rsi + 0x224], r15d
mov dword [rsi + 0xda0], 4
jmp 0x14007ccb2
mov dword [rsi + 0xc], r15d
mov dword [rsi + 0xda0], r15d
test r14, r14
je 0x14007ccc4
mov rcx, r14
call fcn.14007ddf0
mov qword [rsp + 0x30], r12
cmp dword [rsi + 0xc], 0
jne 0x14007cd03
cmp dword [rsi + 0x118], 0
jne 0x14007cd03
cmp dword [rsi + 0x220], 0
jne 0x14007cd03
cmp dword [rsi + 0x224], 0
jne 0x14007cd03
cmp dword [rsi + 0x548], 0
jne 0x14007cd03
cmp dword [rsi + 0x75c], 0
jne 0x14007cd03
cmp dword [rsi + 0x760], 0
jne 0x14007cd03
mov r15d, r12d
mov dword [rsi + 0xd98], r15d
mov dword [rsi + 0xd9c], r12d
xor eax, eax
jmp 0x14007cd1a
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.140001ea0
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret