Function at 0x140001430
Capabilities:
Access peb ldr_data
Check for debugger via api
Check for outputdebugstring error
Check for peb beingdebugged flag
Check for peb ntglobalflag flag
Check for software breakpoints
Check for time delay via gettickcount
Check for unmoving mouse cursor
Check if file exists
Check if process is running under wine
Check os version
Create thread
Encode data using base64
Enumerate process modules
Execute anti-debugging instructions
Get common file path
Get disk size
Get file attributes
Get memory capacity
Get ntdll base address
Get number of processor cores
Get program files directory
Get system information on windows
Print debug messages
Query environment variable
Query or enumerate registry value
Reference processor manufacturer constants
Reference wmi statements
Send icmp echo request
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x14a0]
mov eax, 0x15a0
call fcn.140017160
sub rsp, rax
mov rax, qword [0x140027040]
xor rax, rsp
mov qword [rbp + 0x1490], rax
movsxd rsi, ecx
xor r8d, r8d
mov r12d, 1
mov r15, rdx
cmp esi, r12d
jle 0x140001510
mov ebx, r12d
cmp rsi, r12
jbe 0x140001587
mov edi, 2
lea r13, str.__check
nop
mov rdx, qword [r15 + rbx*8]
mov rcx, r8
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rcx + r13 - 1]
jne 0x140001502
cmp rcx, 8
jne 0x1400014b0
cmp edi, esi
jge 0x140001502
mov rdx, qword [r15 + rbx*8 + 8]
xorps xmm0, xmm0
mov qword [rbp + 8], r8
mov qword [rbp + 0x10], r8
mov r8, 0xffffffffffffffff
movups xmmword [rbp - 8], xmm0
inc r8
cmp byte [rdx + r8], 0
jne 0x1400014e3
lea rcx, [rbp - 8]
call fcn.140008c00
lea rcx, [rbp - 8]
call fcn.140001010
xor r8d, r8d
add edi, 2
add rbx, 2
cmp rbx, rsi
jl 0x1400014a0
jmp 0x140001587
mov dword [0x1400400a4], r12d
mov dword [0x1400400a0], r12d
mov dword [0x14004009c], r12d
mov dword [0x140040098], r12d
mov dword [0x140040094], r12d
mov dword [0x140040090], r12d
mov dword [0x14004008c], r12d
mov dword [0x140040088], r12d
mov dword [0x140040084], r12d
mov dword [0x140040080], r12d
mov dword [0x14004007c], r12d
mov dword [0x140040078], r12d
mov dword [0x140040074], r12d
mov dword [0x14004006c], r12d
mov dword [0x140040068], r12d
mov dword [0x140040064], r12d
mov dword [0x140040060], r12d
lea rcx, str.Al_Khaser___by_Lord_Noteworthy
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 0x64
mov dword [rsp + 0x28], r12d
mov r8d, edx
mov dword [rsp + 0x20], 0x384
mov r9d, 0x384
mov rcx, rax
call qword [sym.imp.USER32.dll_MoveWindow]
lea rcx, str._al_khaser_version_0.82_
call fcn.140008d70
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x28]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x28]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x30]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Initialisation
lea rcx, str._n___________________________s___________________________n
call fcn.140008d70
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor ecx, ecx
lea rsi, [0x14003f20c]
mov r13d, ecx
nop
test dword [rsi - 4], 0xfffffffd
mov r15d, dword [rsi + 4]
mov r12d, dword [rsi]
jne 0x1400016e1
xor r14b, r14b
lea rbx, [0x14003f7c8]
mov rdi, rcx
xor al, al
lea rcx, [0x14003f898]
nop word [rax + rax]
test rdi, rdi
je 0x140001677
cmp dword [rbx - 8], r12d
jne 0x140001677
mov r14b, 1
call qword [rbx]
lea rcx, [0x14003f898]
inc rdi
add rbx, 0x10
cmp rbx, rcx
jl 0x140001660
test r14b, r14b
jne 0x140001691
lea rcx, str.ERROR:_Minimum_version_value_was_invalid._n
jmp 0x1400016dc
test al, al
je 0x1400016e1
test r15d, r15d
jne 0x14000169e
mov al, 1
jmp 0x1400016e3
xor dil, dil
lea rbx, [0x14003f7c8]
xor al, al
nop word [rax + rax]
cmp dword [rbx - 8], r15d
jne 0x1400016c7
mov dil, 1
call qword [rbx]
test al, al
lea rcx, [0x14003f898]
sete al
add rbx, 0x10
cmp rbx, rcx
jl 0x1400016b0
test dil, dil
jne 0x1400016e3
lea rcx, str.ERROR:_Removed_version_value_was_invalid._n
call fcn.140008d00
xor al, al
mov rcx, qword [rsi - 0x14]
mov byte [rsi + 9], al
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x1400016fa
mov byte [rsi + 8], al
jmp 0x140001714
mov rdx, qword [rsi - 0xc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rsi + 0xc], rax
setne al
mov byte [rsi + 8], al
inc r13d
add rsi, 0x30
mov ecx, 0
cmp r13d, 0x1f
jb 0x140001630
xor r12d, r12d
lea rcx, [rbp + 0x282]
xor edx, edx
mov word [rbp + 0x280], r12w
mov r8d, 0x206
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x280]
call fcn.1400137f0
test eax, eax
je 0x14000176c
lea rdx, [rbp + 0x280]
lea rcx, str._n___You_are_running:__s_n
call fcn.140008d70
mov esi, r12d
lea rbx, [0x14003f214]
mov edi, r12d
nop dword [rax]
cmp byte [rbx + 1], r12b
je 0x1400017a1
cmp byte [rbx], r12b
jne 0x1400017a1
mov r8, qword [rbx - 0x14]
lea rcx, str.___Warning:_API__s__s_was_expected_to_exist_but_was_not_found._n
mov rdx, qword [rbx - 0x1c]
call fcn.140008d00
inc esi
inc edi
add rbx, 0x30
cmp edi, 0x1f
jb 0x140001780
test esi, esi
jne 0x1400017bc
lea rcx, str.___All_APIs_present_and_accounted_for._n
call fcn.140008d00
call fcn.1400134f0
test eax, eax
je 0x1400017d1
lea rcx, str.Process_is_running_under_WOW64_n_n
call fcn.140008d70
cmp dword [0x1400400a0], r12d
je 0x1400018b4
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [rbp + 0x74]
lea r8, [rbp - 0x48]
xorps xmm0, xmm0
lea rdx, [fcn.140009450]
mov ecx, 4
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x1400018b4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp - 0x48]
lea r8, [rbp - 0x68]
mov rcx, rax
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetElement
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x1400018b4
mov rdi, r12
cmp dword [rbp - 0x60], r12d
jbe 0x1400018b4
mov rbx, qword [rbp - 0x68]
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rbp - 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
jb 0x1400018a6
mov eax, dword [rbp + 0x1c]
test al, 0x10
jne 0x14000187c
test al, 0x20
jne 0x14000187c
test al, al
js 0x14000187c
test al, 0x40
je 0x1400018a6
mov rdx, qword [0x1400400c8]
cmp rdx, qword [0x1400400d0]
mov qword [rbp + 0x28], rbx
je 0x14000189d
mov qword [rdx], rbx
add qword [0x1400400c8], 8
jmp 0x1400018a6
lea r8, [rbp + 0x28]
call fcn.140009630
mov eax, dword [rbp - 0x60]
add rdi, rsi
add rbx, rsi
cmp rdi, rax
jb 0x140001850
cmp dword [0x1400400a4], r12d
mov r14d, 0x43
mov qword [rbp - 0x20], r14
mov r15d, 0x3e8
mov r13d, 0xdeadbeef
je 0x140001b59
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x28]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x28]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x30]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.TLS_Callbacks
lea rcx, str._n___________________________s___________________________n
call fcn.140008d70
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.TLS_process_attach_callback
lea rcx, str.____s
call fcn.140008d70
mov ebx, r14d
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140001950
mov rax, qword [0x1400400e0]
mov ebx, r12d
test rax, rax
jne 0x1400019a8
inc ebx
cmp ebx, r15d
je 0x14000198f
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov rax, qword [0x1400400e0]
test rax, rax
je 0x140001971
cmp ebx, r15d
jl 0x1400019a8
lea rcx, str.TLSCallbackProcess_timeout_on_event_creation.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, 1
mov ecx, edi
jmp 0x140001a30
mov rcx, qword [0x1400400e0]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400019fd
cmp eax, 0xffffffff
jne 0x1400019d9
lea rcx, str.TLSCallbackProcess_wait_failed.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, 1
mov ecx, edi
jmp 0x140001a30
lea rcx, str.TLSCallbackProcess_wait_abandoned.
cmp eax, 0x80
je 0x140001996
lea rcx, str.TLSCallbackProcess_timeout_on_event_wait.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, 1
mov ecx, edi
jmp 0x140001a30
mov eax, dword [0x1400400e8]
lea rcx, str.TLSCallbackProcess_data_did_not_match.
cmp eax, r13d
jne 0x140001a16
lea rcx, str.All_seems_fine_for_TLSCallbackProcess.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x1400400e8]
mov ecx, r12d
cmp eax, r13d
mov edi, 1
setne cl
lea rdx, str.TLS_process_attach_callback
call fcn.140012eb0
lea rdx, str.TLS_thread_attach_callback
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x44
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140001a54
mov qword [rsp + 0x28], r12
lea r8, [0x14000d9e0]
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x140001a96
lea rcx, str.TLS_callback:_couldnt_start_dummy_thread
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, qword [0x1400400d8]
mov ebx, r12d
test rax, rax
jne 0x140001ad4
inc ebx
cmp ebx, r15d
je 0x140001ac3
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov rax, qword [0x1400400d8]
test rax, rax
je 0x140001aa5
cmp ebx, r15d
jl 0x140001ad4
lea rcx, str.TLSCallbackThread_timeout_on_event_creation.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, edi
jmp 0x140001b4d
mov rcx, qword [0x1400400d8]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140001b1f
cmp eax, 0xffffffff
jne 0x140001b00
lea rcx, str.TLSCallbackThread_wait_failed.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, edi
jmp 0x140001b4d
lea rcx, str.TLSCallbackThread_wait_abandoned.
cmp eax, 0x80
je 0x140001b15
lea rcx, str.TLSCallbackThread_timeout_on_event_wait.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, edi
jmp 0x140001b4d
mov eax, dword [0x1400400bc]
lea rcx, str.TLSCallbackThread_data_did_not_match.
cmp eax, r13d
jne 0x140001b38
lea rcx, str.All_seems_fine_for_TLSCallbackThread.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x1400400bc]
mov ecx, r12d
cmp eax, r13d
setne cl
lea rdx, str.TLS_thread_attach_callback
call fcn.140012eb0
cmp dword [0x1400400a0], 0
mov r14d, 0x4b
mov qword [rbp + 0x58], r14
mov r13d, 0x40
mov r12d, 0x37
mov qword [rsp + 0x40], 7
mov r15d, 0x25
mov qword [rbp - 0x48], 0x24
mov qword [rsp + 0x48], 0x42
mov qword [rbp - 0x68], 0x41
mov qword [rbp + 0x28], 0x2d
mov qword [rbp - 0x50], 0x31
je 0x140003477
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x40]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x40]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x48]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Debugger_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008d70
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Checking_IsDebuggerPresent_API
lea rcx, str.____s
call fcn.140008d70
mov ebx, r13d
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140001c23
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, eax
lea rdx, str.Checking_IsDebuggerPresent_API
call fcn.140012eb0
lea rdx, str.Checking_PEB.BeingDebugged
lea rcx, str.____s
call fcn.140008d70
mov edi, 0x44
mov ebx, edi
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140001c63
mov rax, qword gs:[0x60]
lea rdx, str.Checking_PEB.BeingDebugged
xor esi, esi
mov ecx, esi
cmp byte [rax + 2], 1
sete cl
call fcn.140012eb0
lea rdx, str.Checking_CheckRemoteDebuggerPresent_API
lea rcx, str.____s
call fcn.140008d70
mov rbx, r12
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140001cb0
mov dword [rbp - 0x40], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov ecx, dword [rbp - 0x40]
lea rdx, str.Checking_CheckRemoteDebuggerPresent_API
call fcn.140012eb0
lea rdx, str.Checking_PEB.NtGlobalFlag
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x45
nop
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140001d00
mov rax, qword gs:[0x60]
add rax, 0xbc
je 0x140001d31
test byte [rax], 0x70
je 0x140001d31
mov esi, 1
mov ecx, esi
jmp 0x140001d38
mov ecx, esi
mov esi, 1
lea rdx, str.Checking_PEB.NtGlobalFlag
call fcn.140012eb0
lea rdx, str.Checking_ProcessHeap.Flags
lea rcx, str.____s
call fcn.140008d70
mov rbx, rdi
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140001d60
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.140009360
mov rcx, qword gs:[0x60]
test al, al
mov rax, qword [rcx + 0x30]
je 0x140001d98
add rax, 0x70
jmp 0x140001d9c
add rax, 0x14
xor edi, edi
lea rdx, str.Checking_ProcessHeap.Flags
cmp dword [rax], 2
mov ecx, edi
seta cl
call fcn.140012eb0
lea rdx, str.Checking_ProcessHeap.ForceFlags
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x3f
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140001dd0
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.140009360
mov rcx, qword gs:[0x60]
test al, al
mov rax, qword [rcx + 0x30]
je 0x140001e08
add rax, 0x74
jmp 0x140001e0c
add rax, 0x18
cmp dword [rax], edi
lea rdx, str.Checking_ProcessHeap.ForceFlags
mov ecx, edi
seta cl
call fcn.140012eb0
lea rdx, str.Checking_Low_Fragmentation_Heap
lea rcx, str.____s
call fcn.140008d70
mov rbx, r13
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140001e40
mov rbx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea rcx, [rbp + 0x7c]
mov r8d, 0x110
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov r8b, 1
mov dword [rbp + 0x70], 0x11c
mov edx, 2
mov qword [rbp + 0x74], 6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 1
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 3
lea rcx, [rbp + 0x70]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x140001f08
xor edx, edx
lea rcx, [rbp + 0x7c]
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memset
mov r8b, 1
mov dword [rbp + 0x70], 0x11c
mov edx, 2
mov dword [rbp + 0x74], 6
xor ecx, ecx
mov dword [rbp + 0x78], esi
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 1
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 3
lea rcx, [rbp + 0x70]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x140001f0f
lea rbx, [rdi + 0x178]
xor edx, edx
lea rcx, [rbp + 0x7c]
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memset
mov r8b, 1
mov dword [rbp + 0x70], 0x11c
mov edx, 2
mov dword [rbp + 0x74], 6
xor ecx, ecx
mov dword [rbp + 0x78], 2
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov esi, 3
lea rcx, [rbp + 0x70]
mov r8, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x140001f72
lea rbx, [rdi + 0x170]
test rbx, rbx
je 0x140001f86
cmp qword [rbx], 0
jne 0x140001f86
mov edi, 1
mov ecx, edi
jmp 0x140001f8f
xor eax, eax
mov edi, 1
mov ecx, eax
lea rdx, str.Checking_Low_Fragmentation_Heap
call fcn.140012eb0
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugPort
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x26
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140001fb3
xor edx, edx
lea rbx, [0x14003f1f0]
mov eax, edx
mov rcx, rbx
cmp dword [rcx], 0x10
je 0x14000201a
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140001fd3
mov rbx, rdx
mov qword [rbp - 0x38], rdx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
lea r8, [rbp - 0x38]
mov rcx, rax
mov edx, 7
xor eax, eax
mov qword [rsp + 0x20], rax
call rbx
test eax, eax
jne 0x140002030
cmp qword [rbp - 0x38], 0
je 0x140002030
mov ecx, edi
jmp 0x140002034
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rbx + rcx*8 + 0x24], dl
je 0x140001fe3
mov rbx, qword [rbx + rcx*8 + 0x28]
jmp 0x140001fe6
xor eax, eax
mov ecx, eax
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugPort
call fcn.140012eb0
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugFlags
lea rcx, str.____s
call fcn.140008d70
mov rbx, r15
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140002060
xor edx, edx
lea rbx, [0x14003f1f0]
mov eax, edx
mov rcx, rbx
cmp dword [rcx], 0x10
je 0x1400020c4
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002080
mov rbx, rdx
mov dword [rbp - 0x40], edx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
lea r8, [rbp - 0x40]
mov rcx, rax
mov edx, 0x1f
xor eax, eax
mov qword [rsp + 0x20], rax
call rbx
test eax, eax
jne 0x1400020da
cmp dword [rbp - 0x40], eax
jne 0x1400020da
mov ecx, edi
jmp 0x1400020de
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rbx + rcx*8 + 0x24], dl
je 0x140002090
mov rbx, qword [rbx + rcx*8 + 0x28]
jmp 0x140002093
xor eax, eax
mov ecx, eax
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugFlags
call fcn.140012eb0
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugObject
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x24
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140002102
xor edx, edx
lea rbx, [0x14003f1f0]
mov eax, edx
mov rcx, rbx
cmp dword [rcx], 0x10
je 0x140002165
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002122
mov rbx, rdx
mov qword [rbp - 0x80], rdx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
lea r8, [rbp - 0x80]
mov rcx, rax
mov edx, 0x1e
xor eax, eax
mov qword [rsp + 0x20], rax
call rbx
cmp eax, 0xc0000353
je 0x14000217b
mov ecx, edi
jmp 0x1400021c9
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rbx + rcx*8 + 0x24], dl
je 0x140002132
mov rbx, qword [rbx + rcx*8 + 0x28]
jmp 0x140002135
cmp qword [rbp - 0x80], 0
je 0x140002186
mov ecx, edi
jmp 0x1400021c9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
lea r8, [rbp - 0x80]
mov rcx, rax
mov edx, 0x1e
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
call rbx
cmp eax, 0xc0000353
je 0x1400021b4
mov ecx, edi
jmp 0x1400021c9
mov rax, qword [rbp - 0x80]
test rax, rax
jne 0x1400021c1
mov ecx, edi
jmp 0x1400021c9
xor ecx, ecx
cmp eax, 8
setne cl
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugObject
call fcn.140012eb0
lea rdx, str.Checking_WudfIsAnyDebuggerPresent_API
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x39
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x1400021f0
lea rdx, [0x14003f1f0]
mov eax, ebx
mov rcx, rdx
nop
cmp dword [rcx], 0x1c
je 0x1400025e4
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002210
mov ecx, ebx
lea rdx, str.Checking_WudfIsAnyDebuggerPresent_API
call fcn.140012eb0
lea rdx, str.Checking_WudfIsKernelDebuggerPresent_API
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x36
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140002250
lea rdx, [0x14003f1f0]
mov eax, ebx
mov rcx, rdx
nop
cmp dword [rcx], 0x1d
je 0x140002643
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002270
mov ecx, ebx
lea rdx, str.Checking_WudfIsKernelDebuggerPresent_API
call fcn.140012eb0
lea rdx, str.Checking_WudfIsUserDebuggerPresent_API
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x38
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x1400022b0
lea rdx, [0x14003f1f0]
mov eax, ebx
mov rcx, rdx
nop
cmp dword [rcx], 0x1e
je 0x1400026a3
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x1400022d0
mov ecx, ebx
lea rdx, str.Checking_WudfIsUserDebuggerPresent_API
call fcn.140012eb0
lea rdx, str.Checking_NtSetInformationThread_with_ThreadHideFromDebugger
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x23
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140002310
call fcn.140009130
lea rdx, str.Checking_NtSetInformationThread_with_ThreadHideFromDebugger
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Checking_CloseHandle_with_an_invalide_handle
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x32
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140002350
call fcn.140008ef0
lea rdx, str.Checking_CloseHandle_with_an_invalide_handle
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Checking_NtSystemDebugControl
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x42
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140002390
lea rdx, [0x14003f1f0]
mov eax, ebx
mov rcx, rdx
nop
cmp dword [rcx], 0xb
je 0x140002703
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x1400023b0
mov rax, rbx
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
call rax
cmp eax, 0xc0000354
lea rdx, str.Checking_NtSystemDebugControl
mov ecx, ebx
setne cl
call fcn.140012eb0
lea rdx, str.Checking_UnhandledExcepFilterTest
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x3d
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140002410
lea rcx, [0x14000da20]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc000008e
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_RaiseException]
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], bl
je 0x140002224
mov eax, ebx
mov rcx, rdx
nop dword [rax]
cmp dword [rcx], 0x1c
je 0x140002621
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002600
mov rax, rbx
call rax
test eax, eax
mov ecx, ebx
setne cl
jmp 0x140002226
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], bl
je 0x140002610
mov rax, qword [rdx + rcx*8 + 0x28]
call rax
test eax, eax
mov ecx, ebx
setne cl
jmp 0x140002226
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], bl
je 0x140002284
mov eax, ebx
mov rcx, rdx
nop dword [rax + rax]
cmp dword [rcx], 0x1d
je 0x140002681
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002660
mov rax, rbx
call rax
test eax, eax
mov ecx, ebx
setne cl
jmp 0x140002286
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], bl
je 0x140002670
mov rax, qword [rdx + rcx*8 + 0x28]
call rax
test eax, eax
mov ecx, ebx
setne cl
jmp 0x140002286
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], bl
je 0x1400022e4
mov eax, ebx
mov rcx, rdx
nop dword [rax + rax]
cmp dword [rcx], 0x1e
je 0x1400026e1
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x1400026c0
mov rax, rbx
call rax
test eax, eax
mov ecx, ebx
setne cl
jmp 0x1400022e6
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], bl
je 0x1400026d0
mov rax, qword [rdx + rcx*8 + 0x28]
call rax
test eax, eax
mov ecx, ebx
setne cl
jmp 0x1400022e6
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], bl
je 0x1400023c4
mov rax, qword [rdx + rcx*8 + 0x28]
jmp 0x1400023c7
cmp dword [0x14004009c], 0
mov r14d, 0x28
mov qword [rbp + 0x40], 0x2b
mov r12d, 0x2e
mov r13d, 0x35
je 0x140003907
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp - 0x38]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp - 0x38]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp - 0x30]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.DLL_Injection_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008d70
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__32_bit_
lea rcx, str.____s
call fcn.140008d70
mov ebx, r14d
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140003510
mov ecx, 1
call fcn.14000c070
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__32_bit_
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__64_bit_
lea rcx, str.____s
call fcn.140008d70
mov rbx, r14
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140003550
mov ecx, 2
call fcn.14000c070
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__64_bit_
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__ALL_
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x2b
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140003592
mov ecx, 3
call fcn.14000c070
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__ALL_
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Enumerating_modules_with_ToolHelp32
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x3b
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x1400035d4
xor dil, dil
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000361e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_snapshot._Last_error:__u_n
call fcn.140008d00
jmp 0x1400036b1
xor edx, edx
lea rcx, [rbp + 0x494]
mov r8d, 0x434
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x490]
mov dword [rbp + 0x490], 0x438
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140003694
mov edx, 0xffffffff
lea rcx, [rbp + 0x6c0]
call fcn.14000bcd0
movzx ebx, al
test al, al
je 0x14000367b
lea rdx, [rbp + 0x6c0]
lea rcx, str._____Injected_library:__S_n
call fcn.140008d00
lea rdx, [rbp + 0x490]
mov rcx, rsi
or dil, bl
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140003650
jmp 0x1400036a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_first_module._Last_error:__u_n
call fcn.140008d00
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea rdx, str.Enumerating_modules_with_ToolHelp32
mov ecx, eax
test dil, dil
setne cl
call fcn.140012eb0
lea rdx, str.Enumerating_the_process_LDR_via_LdrEnumerateLoadedModules
lea rcx, str.____s
call fcn.140008d70
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub r15, 1
jne 0x1400036e0
lea rdx, [0x14003f1f0]
mov eax, r15d
mov rcx, rdx
nop
cmp dword [rcx], 9
je 0x140003718
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140003700
mov ecx, r15d
jmp 0x1400037f2
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], r15b
jne 0x140003730
mov ecx, r15d
jmp 0x1400037f2
mov eax, r15d
mov rcx, rdx
cmp dword [rcx], 9
je 0x14000378e
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140003736
mov rbx, r15
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.140016068
mov r8, rax
lea rdx, [0x14000d1f0]
xor ecx, ecx
mov rdi, rax
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
call rbx
test eax, eax
je 0x1400037a5
mov edx, eax
lea rcx, str.LdrEnumerateLoadedModules_failed._Status:__x_n
call fcn.140008d00
mov rcx, rdi
call fcn.14000d2d0
mov ecx, r15d
jmp 0x1400037f2
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], r15b
je 0x140003746
mov rbx, qword [rdx + rcx*8 + 0x28]
jmp 0x140003749
mov r14, qword [rdi + 8]
xor sil, sil
mov rbx, qword [rdi]
cmp rbx, r14
je 0x1400037e1
nop dword [rax]
nop dword [rax + rax]
movups xmm2, xmmword [rbx + 0x40]
mov rcx, qword [rbx + 0x50]
pextrw edx, xmm2, 4
call fcn.14000bcd0
or sil, al
add rbx, 0x88
cmp rbx, r14
jne 0x1400037c0
mov rcx, rdi
call fcn.14000d2d0
test sil, sil
mov ecx, r15d
setne cl
lea rdx, str.Enumerating_the_process_LDR_via_LdrEnumerateLoadedModules
call fcn.140012eb0
lea rdx, str.Enumerating_the_process_LDR_directly
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x3a
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140003820
call fcn.14000caa0
lea rdx, str.Enumerating_the_process_LDR_directly
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Walking_process_memory_with_GetModuleInformation
lea rcx, str.____s
call fcn.140008d70
mov rbx, r12
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140003860
call fcn.14000c2f0
lea rdx, str.Walking_process_memory_with_GetModuleInformation
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Walking_process_memory_for_hidden_modules
lea rcx, str.____s
call fcn.140008d70
mov rbx, r13
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x1400038a0
call fcn.14000c580
lea rdx, str.Walking_process_memory_for_hidden_modules
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Walking_process_memory_for_.NET_module_structures
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x2d
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x1400038e0
call fcn.14000c850
lea rdx, str.Walking_process_memory_for_.NET_module_structures
mov ecx, eax
call fcn.140012eb0
jmp 0x14000390a
xor r15d, r15d
cmp dword [0x140040098], 0
je 0x140005297
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp - 0x38]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp - 0x38]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp - 0x30]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Generic_Sandboxe_VM_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008d70
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.avghookx.dll
mov esi, 0xc
mov qword [rbp + 0x70], rax
lea rdi, [rbp + 0x70]
lea rax, str.avghooka.dll
mov qword [rbp + 0x78], rax
lea rax, str.snxhk.dll
mov qword [rbp + 0x80], rax
lea rax, str.sbiedll.dll
mov qword [rbp + 0x88], rax
lea rax, str.dbghelp.dll
mov qword [rbp + 0x90], rax
lea rax, str.api_log.dll
mov qword [rbp + 0x98], rax
lea rax, str.dir_watch.dll
mov qword [rbp + 0xa0], rax
lea rax, str.pstorec.dll
mov qword [rbp + 0xa8], rax
lea rax, str.vmcheck.dll
mov qword [rbp + 0xb0], rax
lea rax, str.wpespy.dll
mov qword [rbp + 0xb8], rax
lea rax, str.cmdvrt64.dll
mov qword [rbp + 0xc0], rax
lea rax, str.cmdvrt32.dll
mov qword [rbp + 0xc8], rax
nop dword [rax + rax]
xor edx, edx
mov word [rbp + 0x280], r15w
mov r8d, 0x1fe
lea rcx, [rbp + 0x282]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_if_process_loaded_modules_contains:__s
mov edx, 0x100
lea rcx, [rbp + 0x280]
call fcn.140008e30
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rbp + 0x280]
lea rcx, str.____s
test rax, rax
jne 0x140003ab7
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140003a86
mov ebx, 0x5f
sub rbx, rax
je 0x140003ab2
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140003aa0
mov ecx, r15d
jmp 0x140003afb
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140003ad0
mov ebx, 0x5f
sub rbx, rax
je 0x140003af6
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140003ae4
mov ecx, 1
lea rdx, [rbp + 0x280]
call fcn.140012eb0
add rdi, 8
sub rsi, 1
jne 0x140003a20
call fcn.14000dcc0
lea rax, str.CurrentUser
mov qword [rbp + 0x70], rax
lea rax, str.Sandbox
mov qword [rbp + 0x78], rax
lea rax, str.Emily
mov qword [rbp + 0x80], rax
lea rax, str.HAPUBWS
mov qword [rbp + 0x88], rax
lea rax, str.Hong_Lee
mov qword [rbp + 0x90], rax
lea rax, str.IT_ADMIN
mov qword [rbp + 0x98], rax
lea rax, str.Johnson
mov qword [rbp + 0xa0], rax
lea rax, str.Miller
mov qword [rbp + 0xa8], rax
lea rax, str.milozs
mov qword [rbp + 0xb0], rax
lea rax, str.Peter_Wilson
mov qword [rbp + 0xb8], rax
lea rax, str.timmy
mov qword [rbp + 0xc0], rax
lea rax, str.user
mov qword [rbp + 0xc8], rax
lea rax, str.sand_box
mov qword [rbp + 0xd0], rax
lea rax, str.malware
mov qword [rbp + 0xd8], rax
lea rax, str.maltest
mov qword [rbp + 0xe0], rax
lea rax, str.test_user
mov qword [rbp + 0xe8], rax
lea rax, str.virus
mov qword [rbp + 0xf0], rax
lea rax, str.John_Doe
mov qword [rbp + 0xf8], rax
call fcn.14000e0b0
mov r15, rax
test rax, rax
je 0x140003cdd
lea rdi, [rbp + 0x70]
mov r14d, SafeArrayLock
xor r12d, r12d
nop
mov r9, qword [rdi]
lea r8, str.Checking_if_username_matches_:__s
mov edx, 0x100
lea rcx, [rbp + 0x280]
call fcn.140008e30
mov rcx, qword [rdi]
mov rdx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov esi, r12d
lea rdx, [rbp + 0x280]
test eax, eax
lea rcx, str.____s
sete sil
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140003c81
mov ebx, 0x5f
sub rbx, rax
je 0x140003cb2
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140003ca0
lea rdx, [rbp + 0x280]
mov ecx, esi
call fcn.140012eb0
add rdi, 8
sub r14, 1
jne 0x140003c30
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r12d, 0x2e
lea rax, str.SANDBOX
mov qword [rbp + 0x70], rax
lea rax, str.7SILVIA
mov qword [rbp + 0x78], rax
lea rax, str.HANSPETER_PC
mov qword [rbp + 0x80], rax
lea rax, str.JOHN_PC
mov qword [rbp + 0x88], rax
lea rax, str.MUELLER_PC
mov qword [rbp + 0x90], rax
lea rax, str.WIN7_TRAPS
mov qword [rbp + 0x98], rax
lea rax, str.FORTINET
mov qword [rbp + 0xa0], rax
lea rax, str.TEQUILABOOMBOOM
mov qword [rbp + 0xa8], rax
call fcn.14000e130
mov r15, rax
test rax, rax
je 0x140003e4e
call fcn.14000e1b0
mov r12, rax
test rax, rax
jne 0x140003d73
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140003e48
lea rsi, [rbp + 0x70]
mov r14d, 8
mov r13d, 1
mov rbx, qword [rsi]
lea r8, str.Checking_if_hostname_matches_:__s
mov r9, rbx
lea rcx, [rbp + 0x280]
mov edx, 0x100
call fcn.140008e30
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140003db6
mov edi, r13d
jmp 0x140003dcc
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor ecx, ecx
test eax, eax
mov edi, ecx
cmove edi, r13d
lea rdx, [rbp + 0x280]
lea rcx, str.____s
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140003df0
mov ebx, 0x5f
sub rbx, rax
je 0x140003e15
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, r13
jne 0x140003e04
lea rdx, [rbp + 0x280]
mov ecx, edi
call fcn.140012eb0
add rsi, 8
sub r14, r13
jne 0x140003d83
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r13d, 0x35
mov r12d, 0x2e
call fcn.14000e260
lea rdx, str.Checking_Number_of_processors_in_machine
lea rcx, str.____s
call fcn.140008d70
mov edi, 0x36
mov ebx, edi
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140003e70
mov rax, qword gs:[0x60]
lea rdx, str.Checking_Number_of_processors_in_machine
xor r14d, r14d
mov ecx, r14d
cmp dword [rax + 0xb8], 2
setb cl
call fcn.140012eb0
lea rdx, str.Checking_Interupt_Descriptor_Table_location
lea rcx, str.____s
call fcn.140008d70
mov esi, 0x33
mov ebx, esi
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140003ec1
mov eax, dword [rbp - 0x80]
lea rdx, str.Checking_Interupt_Descriptor_Table_location
and eax, 0xff000000
mov ecx, r14d
cmp eax, 0xff000000
sete cl
call fcn.140012eb0
lea rdx, str.Checking_Local_Descriptor_Table_location
lea rcx, str.____s
call fcn.140008d70
mov rbx, rdi
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140003f10
mov r15d, 1
lea rdx, str.Checking_Local_Descriptor_Table_location
mov ecx, r15d
call fcn.140012eb0
lea rdx, str.Checking_Global_Descriptor_Table_location
lea rcx, str.____s
call fcn.140008d70
mov rbx, r13
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, r15
jne 0x140003f50
mov eax, dword [rbp - 0x80]
lea rdx, str.Checking_Global_Descriptor_Table_location
and eax, 0xff000000
mov ecx, r14d
cmp eax, 0xff000000
sete cl
call fcn.140012eb0
lea rdx, str.Checking_Store_Task_Register
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x42
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, r15
jne 0x140003fa0
lea rdx, str.Checking_Store_Task_Register
xor ecx, ecx
call fcn.140012eb0
lea rdx, str.Checking_Number_of_cores_in_machine_using_WMI
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x31
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, r15
jne 0x140003fe0
lea r8, [0x14001dc40]
mov qword [rbp - 0x78], r14
lea rdx, [rbp - 0x38]
mov qword [rbp - 0x38], r14
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x80], r14
mov edi, r14d
call fcn.1400156f0
test eax, eax
je 0x140004182
lea rcx, [0x140021ee0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_Processor
mov r14, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
test r14, r14
je 0x1400040a6
test rax, rax
je 0x14000409d
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
xor r13d, r13d
mov r9d, 0x30
mov qword [rsp + 0x20], r13
mov r8, rsi
mov rdx, r14
mov rbx, qword [rcx]
call qword [rbx + 0xa0]
test eax, eax
jns 0x14000409d
lea rcx, str.ExecQuery
mov r15d, r13d
call fcn.140012fe0
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rsi, rsi
je 0x1400040b4
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor r14d, r14d
test r15d, r15d
mov r15d, 1
je 0x14000417d
mov rcx, qword [rbp - 0x80]
mov qword [rbp - 0x70], r14
mov dword [rbp - 0x40], r14d
test rcx, rcx
je 0x14000415d
nop dword [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x70]
mov edx, 0xffffffff
mov r8d, r15d
call qword [rax + 0x20]
cmp dword [rbp - 0x40], r14d
je 0x140004159
mov rcx, qword [rbp - 0x70]
lea r9, [rbp - 8]
mov qword [rsp + 0x28], r14
lea rdx, str.NumberOfCores
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x140004140
cmp word [rbp - 8], r15w
je 0x140004140
cmp dword [rbp], 2
lea rcx, [rbp - 8]
cmovb edi, r15d
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
test edi, edi
jne 0x140004159
mov rcx, qword [rbp - 0x80]
test rcx, rcx
jne 0x1400040e0
jmp 0x14000415d
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov esi, 0x33
lea rdx, str.Checking_Number_of_cores_in_machine_using_WMI
mov ecx, edi
call fcn.140012eb0
lea rdx, str.Checking_hard_disk_size_using_WMI
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x3d
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x1400041b0
call fcn.14000e620
lea rdx, str.Checking_hard_disk_size_using_WMI
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Checking_hard_disk_size_using_DeviceIoControl
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x31
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x1400041f0
call fcn.14000e8d0
lea rdx, str.Checking_hard_disk_size_using_DeviceIoControl
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Checking_SetupDi_diskdrive
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x44
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004230
call fcn.14000ec00
lea rdx, str.Checking_SetupDi_diskdrive
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Checking_mouse_movement
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x47
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004270
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x38], r14
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rbp - 0x38]
cmp dword [rbp - 0x70], eax
jne 0x1400042bc
mov eax, dword [rbp - 0x34]
mov ecx, r15d
cmp dword [rbp - 0x6c], eax
je 0x1400042bf
mov ecx, r14d
lea rdx, str.Checking_mouse_movement
call fcn.140012eb0
lea rdx, str.Checking_lack_of_user_input
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x43
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x1400042e3
mov ebx, r14d
mov dword [rbp - 0x38], 8
mov edi, r14d
mov ecx, 0xb
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x140004344
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rbp - 0x34]
cmp eax, ecx
jb 0x140004344
sub eax, ecx
cmp eax, 0x64
jae 0x14000433a
inc ebx
cmp ebx, 0xa
jge 0x1400045f5
inc edi
cmp edi, 0x80
jl 0x140004302
mov ecx, r15d
lea rdx, str.Checking_lack_of_user_input
call fcn.140012eb0
lea rdx, str.Checking_memory_space_using_GlobalMemoryStatusEx
lea rcx, str.____s
call fcn.140008d70
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub r12, 1
jne 0x140004370
xorps xmm0, xmm0
lea rcx, [rbp + 0x70]
movups xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x70], 0x40
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp qword [rbp + 0x78], 0x40000000
lea rdx, str.Checking_memory_space_using_GlobalMemoryStatusEx
mov ecx, r14d
setb cl
call fcn.140012eb0
lea rdx, str.Checking_disk_size_using_GetDiskFreeSpaceEx
lea rcx, str.____s
call fcn.140008d70
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rsi, 1
jne 0x1400043e0
xor r9d, r9d
lea r8, [rbp - 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x14000441a
movabs rax, 0x1400000000
mov ecx, r15d
cmp qword [rbp - 0x38], rax
jb 0x14000441d
mov ecx, r14d
lea rdx, str.Checking_disk_size_using_GetDiskFreeSpaceEx
call fcn.140012eb0
lea rdx, str.Checking_if_CPU_hypervisor_field_is_set_using_cpuid_0x1_
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x27
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004441
xor eax, eax
xor ecx, ecx
mov qword [rbp - 0x34], rax
mov eax, r15d
cpuid
sar ecx, 0x1f
mov dword [rbp - 0x2c], edx
and ecx, 1
lea rdx, str.Checking_if_CPU_hypervisor_field_is_set_using_cpuid_0x1_
mov dword [rbp - 0x38], eax
mov dword [rbp - 0x34], ebx
call fcn.140012eb0
lea rdx, str.Checking_hypervisor_vendor_using_cpuid_0x40000000_
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x2d
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004493
xor ecx, ecx
mov qword [rbp + 0x7c], r14
mov qword [rbp - 0x34], rcx
lea r12, [rsp + 0x50]
mov dword [rbp - 0x2c], ecx
mov eax, 0x40000000
lea rcx, str.KVMKVMKVM
mov qword [rbp + 0x84], r14
mov qword [rsp + 0x50], rcx
mov r15d, r14d
lea rcx, str.Microsoft_Hv
mov qword [rbp + 0x8c], r14
mov qword [rsp + 0x58], rcx
lea rcx, str.VMwareVMware
mov qword [rsp + 0x60], rcx
lea rcx, str.XenVMMXenVMM
mov qword [rsp + 0x68], rcx
lea rcx, str.prl_hyperv
mov qword [rsp + 0x70], rcx
lea rcx, str.VBoxVBoxVBox
mov qword [rsp + 0x78], rcx
xor ecx, ecx
cpuid
mov dword [rbp - 0x34], ebx
mov dword [rbp - 0x30], ecx
movsd xmm0, qword [rbp - 0x34]
movsd qword [rbp + 0x70], xmm0
mov dword [rbp - 0x38], eax
mov qword [rbp + 0x94], r14
mov qword [rbp + 0x9c], r14
mov qword [rbp + 0xa4], r14
mov dword [rbp + 0xac], r14d
mov dword [rbp + 0x78], edx
nop dword [rax + rax]
mov dword [rsp + 0x28], r14d
lea r8, [rbp + 0x70]
mov r9d, 0xffffffff
mov qword [rsp + 0x20], r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
lea ecx, [rax + 1]
movsxd rbx, ecx
add rbx, rbx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x1400045e0
mov rdi, rax
mov dword [rsp + 0x28], esi
xor eax, eax
mov qword [rsp + 0x20], r14
mov rcx, rbx
lea r8, [rbp + 0x70]
rep stosb byte [rdi], al
xor ecx, ecx
mov r9d, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, qword [r12]
mov rax, r14
sub rdx, r14
nop dword [rax + rax]
movzx ebx, word [rax]
movzx ecx, word [rax + rdx]
sub ebx, ecx
jne 0x1400045d3
add rax, 2
test ecx, ecx
jne 0x1400045c0
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test ebx, ebx
je 0x1400045fd
inc r15d
add r12, 8
cmp r15d, 6
jge 0x140004606
xor r14d, r14d
jmp 0x140004550
mov ecx, r14d
jmp 0x140004347
mov ecx, 1
xor esi, esi
jmp 0x14000460a
xor esi, esi
mov ecx, esi
lea rdx, str.Checking_hypervisor_vendor_using_cpuid_0x40000000_
call fcn.140012eb0
lea rdx, str.Check_if_time_has_been_accelerated
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x3c
nop
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004630
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0xea60
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
lea rdx, str.Check_if_time_has_been_accelerated
sub eax, ebx
cmp eax, 0xe678
setbe cl
call fcn.140012eb0
lea rdx, str.VM_Driver_Services
lea rcx, str.____s
call fcn.140008d70
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub qword [rbp + 0x58], 1
jne 0x140004690
call fcn.14000ffe0
lea rdx, str.VM_Driver_Services
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Checking_SerialNumber_from_BIOS_using_WMI
lea rcx, str.____s
call fcn.140008d70
mov r13d, 0x35
nop
lea rcx, [0x140021238]
call fcn.140008d70
sub r13, 1
jne 0x1400046d0
call fcn.14000ee10
lea rdx, str.Checking_SerialNumber_from_BIOS_using_WMI
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Checking_Model_from_ComputerSystem_using_WMI
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x32
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004710
call fcn.14000f090
lea rdx, str.Checking_Model_from_ComputerSystem_using_WMI
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Checking_Manufacturer_from_ComputerSystem_using_WMI
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x2b
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004750
call fcn.14000f2f0
lea rdx, str.Checking_Manufacturer_from_ComputerSystem_using_WMI
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Checking_Current_Temperature_using_WMI
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x38
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004790
call fcn.14000f560
lea rdx, str.Checking_Current_Temperature_using_WMI
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Checking_ProcessId_using_WMI
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x42
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x1400047d0
call fcn.14000f770
lea rdx, str.Checking_ProcessId_using_WMI
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Checking_power_capabilities
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x43
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004810
lea rcx, [rbp + 0x70]
mov ebx, esi
call qword [sym.imp.POWRPROF.dll_GetPwrCapabilities]
cmp al, 1
jne 0x140004847
movzx eax, byte [rbp + 0x76]
or al, byte [rbp + 0x75]
or al, byte [rbp + 0x74]
or al, byte [rbp + 0x73]
jne 0x140004847
cmp byte [rbp + 0x7d], al
sete bl
lea rdx, str.Checking_power_capabilities
mov ecx, ebx
call fcn.140012eb0
lea rdx, str.Checking_CPU_fan_using_WMI
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x44
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004870
lea r8, [0x14001dc40]
mov qword [rbp - 0x78], rsi
lea rdx, [rbp - 0x38]
mov qword [rbp - 0x38], rsi
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x80], rsi
mov r12d, esi
mov edi, esi
call fcn.1400156f0
test eax, eax
je 0x1400049d0
lea rcx, [0x140021ee0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_Fan
mov r14, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r15d, 1
mov rsi, rax
test r14, r14
je 0x140004940
test rax, rax
je 0x140004937
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov r9d, 0x30
xor eax, eax
mov r8, rsi
mov rdx, r14
mov qword [rsp + 0x20], rax
mov rbx, qword [rcx]
call qword [rbx + 0xa0]
test eax, eax
jns 0x140004937
xor eax, eax
lea rcx, str.ExecQuery
mov r15d, eax
call fcn.140012fe0
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rsi, rsi
je 0x14000494e
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
test r15d, r15d
je 0x1400049d0
mov rcx, qword [rbp - 0x80]
mov qword [rbp + 0x58], rsi
mov dword [rbp - 0x40], esi
test rcx, rcx
je 0x1400049a8
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x58]
mov edx, 0xffffffff
mov r8d, 1
call qword [rax + 0x20]
cmp dword [rbp - 0x40], esi
je 0x1400049a8
mov rcx, qword [rbp + 0x58]
inc edi
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
jne 0x140004970
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
test edi, edi
jne 0x1400049d6
mov r12d, 1
lea rdx, str.Checking_CPU_fan_using_WMI
mov ecx, r12d
call fcn.140012eb0
lea rdx, str.Checking_NtQueryLicenseValue_with_Kernel_VMDetection_Private
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x22
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004a00
lea rdx, [0x14003f1f0]
mov ecx, esi
mov rax, rdx
nop
cmp dword [rax], 0x1b
je 0x140004a8f
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140004a20
mov rdi, rsi
mov ecx, esi
mov rax, rdx
cmp dword [rax], 0x11
je 0x140004aa7
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140004a38
mov rbx, rsi
test rdi, rdi
je 0x140004abf
test rbx, rbx
je 0x140004abf
lea rdx, str.Kernel_VMDetection_Private
lea rcx, [rbp + 0x58]
call rdi
lea rax, [rbp - 0x80]
mov dword [rbp - 0x40], esi
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x40]
xor edx, edx
lea rcx, [rbp + 0x58]
call rbx
mov ecx, esi
test eax, eax
js 0x140004ac1
cmp dword [rbp - 0x40], 0
setne cl
jmp 0x140004ac1
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
je 0x140004a30
mov rdi, qword [rdx + rcx*8 + 0x28]
jmp 0x140004a33
movsxd rax, ecx
lea rbx, [rax + rax*2]
add rbx, rbx
cmp byte [rdx + rbx*8 + 0x24], 0
je 0x140004a48
mov rbx, qword [rdx + rbx*8 + 0x28]
jmp 0x140004a4b
mov ecx, esi
lea rdx, str.Checking_NtQueryLicenseValue_with_Kernel_VMDetection_Private
call fcn.140012eb0
lea rdx, str.Checking_Win32_CacheMemory_with_WMI
lea rcx, str.____s
call fcn.140008d70
mov r14d, 0x3b
mov ebx, r14d
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004af0
lea rcx, str.SELECT__FROM_Win32_CacheMemory
call fcn.14000f980
test eax, eax
lea rdx, str.Checking_Win32_CacheMemory_with_WMI
mov ecx, esi
sete cl
call fcn.140012eb0
lea rdx, str.Checking_Win32_PhysicalMemory_with_WMI
lea rcx, str.____s
call fcn.140008d70
mov r15d, 0x38
mov ebx, r15d
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004b40
lea rcx, str.SELECT__FROM_Win32_PhysicalMemory
call fcn.14000f980
test eax, eax
lea rdx, str.Checking_Win32_PhysicalMemory_with_WMI
mov ecx, esi
sete cl
call fcn.140012eb0
lea rdx, str.Checking_Win32_MemoryDevice_with_WMI
lea rcx, str.____s
call fcn.140008d70
mov edi, 0x3a
mov ebx, edi
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004b90
lea rcx, str.SELECT__FROM_Win32_MemoryDevice
call fcn.14000f980
test eax, eax
lea rdx, str.Checking_Win32_MemoryDevice_with_WMI
mov ecx, esi
sete cl
call fcn.140012eb0
lea rdx, str.Checking_Win32_MemoryArray_with_WMI
lea rcx, str.____s
call fcn.140008d70
mov rbx, r14
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004be0
lea rcx, str.SELECT__FROM_Win32_MemoryArray
call fcn.14000f980
test eax, eax
lea rdx, str.Checking_Win32_MemoryArray_with_WMI
mov ecx, esi
sete cl
call fcn.140012eb0
lea rdx, str.Checking_Win32_VoltageProbe_with_WMI
lea rcx, str.____s
call fcn.140008d70
mov rbx, rdi
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004c30
lea rcx, str.SELECT__FROM_Win32_VoltageProbe
call fcn.14000f980
test eax, eax
lea rdx, str.Checking_Win32_VoltageProbe_with_WMI
mov ecx, esi
sete cl
call fcn.140012eb0
lea rdx, str.Checking_Win32_PortConnector_with_WMI
lea rcx, str.____s
call fcn.140008d70
mov r13d, 0x39
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub r13, 1
jne 0x140004c80
lea rcx, str.SELECT__FROM_Win32_PortConnector
call fcn.14000f980
test eax, eax
lea rdx, str.Checking_Win32_PortConnector_with_WMI
mov ecx, esi
sete cl
call fcn.140012eb0
lea rdx, str.Checking_Win32_SMBIOSMemory_with_WMI
lea rcx, str.____s
call fcn.140008d70
mov rbx, rdi
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004cd0
lea rcx, str.SELECT__FROM_Win32_SMBIOSMemory
call fcn.14000f980
test eax, eax
lea rdx, str.Checking_Win32_SMBIOSMemory_with_WMI
mov ecx, esi
sete cl
call fcn.140012eb0
lea rdx, str.Checking_ThermalZoneInfo_performance_counters_with_WMI
lea rcx, str.____s
call fcn.140008d70
mov edi, 0x28
mov ebx, edi
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004d20
lea rcx, str.SELECT__FROM_Win32_PerfFormattedData_Counters_ThermalZoneInformation
call fcn.14000f980
test eax, eax
lea rdx, str.Checking_ThermalZoneInfo_performance_counters_with_WMI
mov ecx, esi
sete cl
call fcn.140012eb0
lea rdx, str.Checking_CIM_Memory_with_WMI
lea rcx, str.____s
call fcn.140008d70
mov esi, 0x42
mov ebx, esi
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004d70
lea rcx, str.SELECT__FROM_CIM_Memory
call fcn.14000f980
xor r12d, r12d
lea rdx, str.Checking_CIM_Memory_with_WMI
test eax, eax
mov ecx, r12d
sete cl
call fcn.140012eb0
lea rdx, str.Checking_CIM_Sensor_with_WMI
lea rcx, str.____s
call fcn.140008d70
mov rbx, rsi
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004dc0
lea rcx, str.SELECT__FROM_CIM_Sensor
call fcn.14000f980
test eax, eax
lea rdx, str.Checking_CIM_Sensor_with_WMI
mov ecx, r12d
sete cl
call fcn.140012eb0
lea rdx, str.Checking_CIM_NumericSensor_with_WMI
lea rcx, str.____s
call fcn.140008d70
mov rbx, r14
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004e10
lea rcx, str.SELECT__FROM_CIM_NumericSensor
call fcn.14000f980
test eax, eax
lea rdx, str.Checking_CIM_NumericSensor_with_WMI
mov ecx, r12d
sete cl
call fcn.140012eb0
lea rdx, str.Checking_CIM_TemperatureSensor_with_WMI
lea rcx, str.____s
call fcn.140008d70
mov esi, 0x37
mov ebx, esi
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004e60
lea rcx, str.SELECT__FROM_CIM_TemperatureSensor
call fcn.14000f980
test eax, eax
lea rdx, str.Checking_CIM_TemperatureSensor_with_WMI
mov ecx, r12d
sete cl
call fcn.140012eb0
lea rdx, str.Checking_CIM_VoltageSensor_with_WMI
lea rcx, str.____s
call fcn.140008d70
mov rbx, r14
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004eb0
lea rcx, str.SELECT__FROM_CIM_VoltageSensor
call fcn.14000f980
test eax, eax
lea rdx, str.Checking_CIM_VoltageSensor_with_WMI
mov ecx, r12d
sete cl
call fcn.140012eb0
lea rdx, str.Checking_CIM_PhysicalConnector_with_WMI
lea rcx, str.____s
call fcn.140008d70
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rsi, 1
jne 0x140004f00
lea rcx, str.SELECT__FROM_CIM_PhysicalConnector
call fcn.14000f980
test eax, eax
lea rdx, str.Checking_CIM_PhysicalConnector_with_WMI
mov ecx, esi
sete cl
call fcn.140012eb0
lea rdx, str.Checking_CIM_Slot_with_WMI
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x44
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140004f50
lea rcx, str.SELECT__FROM_CIM_Slot
call fcn.14000f980
test eax, eax
lea rdx, str.Checking_CIM_Slot_with_WMI
mov ecx, esi
sete cl
call fcn.140012eb0
lea rdx, str.Checking_if_Windows_is_Genuine
lea rcx, str.____s
call fcn.140008d70
mov r13d, 0x40
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub r13, 1
jne 0x140004fa0
xor r8d, r8d
mov dword [rbp + 0x58], 0x55c92734
lea rdx, [rbp - 0x40]
mov dword [rbp + 0x5c], 0x4d71d682
lea rcx, [rbp + 0x58]
mov dword [rbp + 0x60], 0xecd63e98
mov dword [rbp + 0x64], 0x9f05163f
call qword [sym.imp.SLWGA.dll_SLIsGenuineLocal]
mov r13d, 0x47
test eax, eax
jne 0x140004ff9
cmp dword [rbp - 0x40], esi
je 0x140004ff9
mov r12d, 1
mov ecx, r12d
jmp 0x140005001
mov ecx, esi
mov r12d, 1
lea rdx, str.Checking_if_Windows_is_Genuine
call fcn.140012eb0
lea rdx, str.Checking_ServicesDiskEnum_entries_for_VM_strings
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x2c
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140005030
lea rax, str.qemu
mov qword [rbp - 0x78], rsi
mov qword [rbp + 0x70], rax
lea rdx, str.SystemCurrentControlSetServicesDiskEnum
lea rax, str.virtio
mov dword [rbp - 0x40], esi
mov qword [rbp + 0x78], rax
mov r9d, 0x20019
lea rax, str.vmware
mov dword [rbp - 0x80], 4
mov qword [rbp + 0x80], rax
xor r8d, r8d
lea rax, str.vbox
mov rcx, 0xffffffff80000002
mov qword [rbp + 0x88], rax
mov r14d, esi
lea rax, [0x14001e5d8]
mov qword [rbp + 0x90], rax
lea rax, [0x14001e5e0]
mov qword [rbp + 0x98], rax
lea rax, str.Virtual
mov qword [rbp + 0xa0], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005118
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.Count
lea rax, [rbp - 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x78]
test eax, eax
je 0x140005112
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140005175
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp - 0x40], esi
jbe 0x140005173
nop dword [rax]
mov r9d, esi
lea r8, [0x14001e5f4]
mov edx, 0xb
lea rcx, [rbp + 0x58]
call fcn.140008e30
xor eax, eax
lea rbx, [rbp + 0x70]
mov edi, eax
mov r9, qword [rbx]
lea r8, [rbp + 0x58]
lea rdx, str.SystemCurrentControlSetServicesDiskEnum
call fcn.1400135b0
test eax, eax
jne 0x14000516b
inc edi
add rbx, 8
cmp edi, 7
jb 0x140005140
inc esi
cmp esi, dword [rbp - 0x40]
jb 0x140005120
jmp 0x14000516e
mov r14d, r12d
mov edi, 0x28
xor esi, esi
lea rdx, str.Checking_ServicesDiskEnum_entries_for_VM_strings
mov ecx, r14d
call fcn.140012eb0
lea rdx, str.Checking_EnumIDE_and_EnumSCSI_entries_for_VM_strings
lea rcx, str.____s
call fcn.140008d70
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rdi, 1
jne 0x1400051a0
call fcn.14000fb50
lea rdx, str.Checking_EnumIDE_and_EnumSCSI_entries_for_VM_strings
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Checking_SMBIOS_tables
lea rcx, str.____s
call fcn.140008d70
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub r13, 1
jne 0x1400051e0
lea r8, [rbp - 0x80]
mov dword [rbp - 0x80], esi
xor edx, edx
mov ecx, 0x52534d42
mov ebx, esi
call fcn.1400159d0
mov r11, rax
test rax, rax
je 0x140005287
mov r9d, dword [rax + 4]
lea r8, [rax + 8]
add r9, 8
mov r10d, esi
add r9, rax
cmp r8, r9
jae 0x14000527b
inc r10d
cmp byte [r8], 0x7f
je 0x140005273
movzx edi, byte [r8 + 1]
mov edx, esi
add rdi, r8
nop dword [rax]
mov ebx, edx
lea ecx, [rdx + 1]
cmp byte [rbx + rdi], 0
jne 0x140005251
cmp byte [rcx + rdi], 0
je 0x140005261
lea rax, [rdi + 1]
add rax, rbx
cmp rax, r9
jae 0x140005261
mov edx, ecx
jmp 0x140005240
movzx eax, byte [r8 + 1]
add eax, 2
add eax, edx
add r8, rax
cmp r8, r9
jb 0x140005226
mov ebx, esi
cmp r10d, 0x28
ja 0x14000527e
mov ebx, r12d
mov rcx, r11
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_SMBIOS_tables
mov ecx, ebx
call fcn.140012eb0
jmp 0x14000529d
mov r15d, 0x38
cmp dword [0x140040094], 0
lea r13, [0x14001ed80]
lea r14, str.Identifier
je 0x140006021
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x58]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x58]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x60]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.VirtualBox_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008d70
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.VBOX
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x80], rax
lea rcx, str.HARDWAREDescriptionSystem
mov qword [rbp + 0x98], rax
lea rdx, str.SystemBiosVersion
lea rax, str.VideoBiosVersion
mov qword [rbp + 0x78], r14
mov qword [rbp + 0xa8], rax
lea rsi, [rbp + 0x78]
lea rax, str.VIRTUALBOX
mov qword [rbp + 0x88], rcx
mov qword [rbp + 0xb0], rax
mov r14d, 4
lea rax, str.SystemBiosDate
mov qword [rbp + 0x90], rdx
mov qword [rbp + 0xc0], rax
mov r12d, 1
lea rax, str.06_23_99
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0xc8], rax
xor r13d, r13d
mov qword [rbp + 0xb8], rcx
nop dword [rax]
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x280], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0x282]
call sub.VCRUNTIME140.dll_memset
mov rbx, qword [rsi + 8]
lea r8, str.Checking_reg_key_HARDWAREDescriptionSystem____s_is_set_to__s
mov r9, qword [rsi]
lea rcx, [rbp + 0x280]
mov edx, 0x100
mov qword [rsp + 0x20], rbx
call fcn.140008e30
mov r8, qword [rsi]
mov r9, rbx
mov rdx, qword [rsi - 8]
call fcn.1400135b0
lea rdx, [rbp + 0x280]
lea rcx, str.____s
test eax, eax
je 0x140005456
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140005424
mov ebx, 0x5f
sub rbx, rax
je 0x140005451
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, r12
jne 0x140005440
mov ecx, r12d
jmp 0x140005497
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140005470
mov ebx, 0x5f
sub rbx, rax
je 0x140005495
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, r12
jne 0x140005484
xor ecx, ecx
lea rdx, [rbp + 0x280]
call fcn.140012eb0
add rsi, 0x18
sub r14, r12
jne 0x1400053b0
lea rdx, str.Checking_VirtualBox_Guest_Additions_directory
lea rcx, str.____s
call fcn.140008d70
mov r12d, 0x49
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub qword [rbp - 0x50], 1
jne 0x1400054d0
xor edx, edx
mov word [rbp + 0x70], r13w
mov r8d, 0x206
lea rcx, [rbp + 0x72]
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [str.oracle_virtualbox_guest_additions_]
lea rcx, [rbp + 0x2c6]
movaps xmm1, xmmword [0x14001f8b0]
xor edx, edx
mov eax, dword [0x14001f8e0]
mov r8d, 0x1c2
movaps xmmword [rbp + 0x280], xmm0
movaps xmm0, xmmword [0x14001f8c0]
movaps xmmword [rbp + 0x290], xmm1
movaps xmm1, xmmword [0x14001f8d0]
mov dword [rbp + 0x2c0], eax
movzx eax, word [0x14001f8e4]
movaps xmmword [rbp + 0x2a0], xmm0
movaps xmmword [rbp + 0x2b0], xmm1
mov word [rbp + 0x2c4], ax
call sub.VCRUNTIME140.dll_memset
call fcn.1400134f0
lea rdx, [rbp + 0x490]
test eax, eax
je 0x140005584
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140005595
xor r9d, r9d
mov r8d, 0x26
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x280]
lea rdx, [rbp + 0x490]
lea rcx, [rbp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400055cb
test al, 0x10
je 0x1400055cb
mov r14d, 1
mov ecx, r14d
jmp 0x1400055d4
mov ecx, r13d
mov r14d, 1
lea rdx, str.Checking_VirtualBox_Guest_Additions_directory
call fcn.140012eb0
call fcn.140010290
lea rax, str.HARDWAREACPIDSDTVBOX__
mov esi, 9
mov qword [rbp + 0x70], rax
lea rdi, [rbp + 0x70]
lea rax, str.HARDWAREACPIFADTVBOX__
mov qword [rbp + 0x78], rax
lea rax, str.HARDWAREACPIRSDTVBOX__
mov qword [rbp + 0x80], rax
lea rax, str.SOFTWAREOracleVirtualBox_Guest_Additions
mov qword [rbp + 0x88], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxGuest
mov qword [rbp + 0x90], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxMouse
mov qword [rbp + 0x98], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxService
mov qword [rbp + 0xa0], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxSF
mov qword [rbp + 0xa8], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxVideo
mov qword [rbp + 0xb0], rax
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x280], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0x282]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, [0x14001ea00]
mov edx, 0x100
lea rcx, [rbp + 0x280]
call fcn.140008e30
mov rdx, qword [rdi]
lea rax, [rbp - 0x50]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 0x50], r13
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000572b
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x280]
lea rcx, str.____s
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140005700
mov ebx, 0x5f
sub rbx, rax
je 0x140005726
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140005714
mov ecx, r14d
jmp 0x140005778
lea rdx, [rbp + 0x280]
lea rcx, str.____s
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140005750
mov ebx, 0x5f
sub rbx, rax
je 0x140005776
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140005764
xor ecx, ecx
lea rdx, [rbp + 0x280]
call fcn.140012eb0
add rdi, 8
sub rsi, 1
jne 0x140005670
lea rdx, str.Checking_Mac_Address_start_with_08:00:27
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x36
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x1400057b0
lea rcx, [0x14001f8e8]
call fcn.1400136a0
lea rdx, str.Checking_Mac_Address_start_with_08:00:27
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Checking_MAC_address__Hybrid_Analysis_
lea rcx, str.____s
call fcn.140008d70
nop
lea rcx, [0x140021238]
call fcn.140008d70
sub r15, 1
jne 0x1400057f0
lea rcx, [0x14001dc38]
call fcn.1400136a0
lea rdx, str.Checking_MAC_address__Hybrid_Analysis_
mov ecx, eax
call fcn.140012eb0
lea rax, [0x14001f8f0]
mov r13d, 5
mov qword [rbp - 8], rax
lea rsi, [rbp - 8]
lea rax, str..VBoxGuest
mov r14d, r13d
mov qword [rbp], rax
mov r15d, 1
lea rax, str..pipeVBoxMiniRdDN
mov qword [rbp + 8], rax
lea rax, str..VBoxTrayIPC
mov qword [rbp + 0x10], rax
lea rax, str..pipeVBoxTrayIPC
mov qword [rbp + 0x18], rax
nop word [rax + rax]
mov rcx, qword [rsi]
xor eax, eax
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov r8d, r15d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
lea rcx, [rbp + 0x282]
mov rdi, rax
mov r8d, 0x1fe
xor eax, eax
mov word [rbp + 0x280], ax
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rsi]
lea r8, str.Checking_device__s
mov edx, 0x100
lea rcx, [rbp + 0x280]
call fcn.140008e30
cmp rdi, 0xffffffffffffffff
je 0x140005936
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x280]
lea rcx, str.____s
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005906
mov ebx, 0x5f
sub rbx, rax
je 0x140005931
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, r15
jne 0x140005920
mov ecx, r15d
jmp 0x140005987
lea rdx, [rbp + 0x280]
lea rcx, str.____s
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005960
mov ebx, 0x5f
sub rbx, rax
je 0x140005985
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, r15
jne 0x140005974
xor ecx, ecx
lea rdx, [rbp + 0x280]
call fcn.140012eb0
add rsi, 8
sub r14, r15
jne 0x140005870
lea rdx, str.Checking_VBoxTrayToolWndClass___VBoxTrayToolWnd
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x2f
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, r15
jne 0x1400059c0
xor edx, edx
lea rcx, str.VBoxTrayToolWndClass
call qword [sym.imp.USER32.dll_FindWindowW]
lea rdx, str.VBoxTrayToolWnd
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowW]
test rbx, rbx
jne 0x140005a00
test rax, rax
jne 0x140005a00
mov ecx, eax
jmp 0x140005a03
mov ecx, r15d
lea rdx, str.Checking_VBoxTrayToolWndClass___VBoxTrayToolWnd
call fcn.140012eb0
lea rdx, str.Checking_VirtualBox_Shared_Folders_network_provider
lea rcx, str.____s
call fcn.140008d70
lea rcx, [0x140021238]
call fcn.140008d70
sub qword [rbp + 0x40], r15
jne 0x140005a22
xor r12d, r12d
lea rcx, [rbp + 0x282]
xor edx, edx
mov word [rbp + 0x280], r12w
mov r8d, 0x206
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp - 0x80]
mov dword [rbp - 0x80], 0x104
lea rdx, [rbp + 0x280]
mov ecx, 0x250000
call qword [sym.imp.MPR.dll_WNetGetProviderNameW]
test eax, eax
jne 0x140005a92
lea rdx, str.VirtualBox_Shared_Folders
lea rcx, [rbp + 0x280]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
mov ecx, r12d
sete cl
jmp 0x140005a95
mov ecx, r12d
lea rdx, str.Checking_VirtualBox_Shared_Folders_network_provider
call fcn.140012eb0
lea rax, str.vboxservice.exe
mov esi, 2
mov qword [rbp + 0x40], rax
lea rdi, [rbp + 0x40]
lea rax, str.vboxtray.exe
mov qword [rbp + 0x48], rax
xor edx, edx
mov word [rbp + 0x280], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x282]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_VirtualBox_process__s
mov edx, 0x100
lea rcx, [rbp + 0x280]
call fcn.140008e30
mov rcx, qword [rdi]
call fcn.1400155e0
lea rdx, [rbp + 0x280]
lea rcx, str.____s
test eax, eax
je 0x140005b56
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140005b24
mov ebx, 0x5f
sub rbx, rax
je 0x140005b51
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, r15
jne 0x140005b40
mov ecx, r15d
jmp 0x140005b97
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140005b70
mov ebx, 0x5f
sub rbx, rax
je 0x140005b95
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, r15
jne 0x140005b84
xor ecx, ecx
lea rdx, [rbp + 0x280]
call fcn.140012eb0
add rdi, 8
sub rsi, r15
jne 0x140005ac0
lea rdx, str.Checking_Win32_PnPDevice_DeviceId_from_WMI_for_VBox_PCI_device
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x20
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, r15
jne 0x140005bd0
xor esi, esi
lea r8, [0x14001dc40]
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x78], rsi
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x80], rsi
mov edi, esi
call fcn.1400156f0
test eax, eax
je 0x140005d7e
lea rcx, [0x140021ee0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_PnPEntity
mov r14, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
test r14, r14
je 0x140005c98
test rax, rax
je 0x140005c8f
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov r9d, 0x30
xor eax, eax
mov r8, rsi
mov rdx, r14
mov qword [rsp + 0x20], rax
mov rbx, qword [rcx]
call qword [rbx + 0xa0]
test eax, eax
jns 0x140005c8f
xor eax, eax
lea rcx, str.ExecQuery
mov r15d, eax
call fcn.140012fe0
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rsi, rsi
je 0x140005ca6
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
test r15d, r15d
mov r15d, 1
je 0x140005d7e
mov rcx, qword [rbp - 0x80]
mov qword [rbp - 0x38], rsi
mov dword [rbp - 0x40], esi
test rcx, rcx
je 0x140005d5a
nop dword [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x38]
mov edx, 0xffffffff
mov r8d, r15d
call qword [rax + 0x20]
cmp dword [rbp - 0x40], esi
je 0x140005d5a
mov rcx, qword [rbp - 0x38]
lea r9, [rbp - 8]
mov qword [rsp + 0x28], rsi
lea rdx, str.DeviceId
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x140005d3f
cmp word [rbp - 8], 8
jne 0x140005d35
mov rcx, qword [rbp]
lea rdx, str.PCIVEN_80EEDEV_CAFE
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
cmovne edi, r15d
lea rcx, [rbp - 8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
test edi, edi
jne 0x140005d5a
mov rcx, qword [rbp - 0x80]
test rcx, rcx
jne 0x140005cd0
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.Checking_Win32_PnPDevice_DeviceId_from_WMI_for_VBox_PCI_device
mov ecx, edi
call fcn.140012eb0
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBox_controller_hardware
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x1b
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140005da4
call fcn.140010c10
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBox_controller_hardware
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBOX_names
lea rcx, str.____s
call fcn.140008d70
mov r12d, 0x29
lea rcx, [0x140021238]
call fcn.140008d70
sub r12, 1
jne 0x140005de2
call fcn.140011370
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBOX_names
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Checking_Win32_Bus_from_WMI
lea rcx, str.____s
call fcn.140008d70
mov r12d, 0x49
lea rcx, [0x140021238]
call fcn.140008d70
sub qword [rbp - 0x20], 1
jne 0x140005e20
call fcn.140010e70
lea rdx, str.Checking_Win32_Bus_from_WMI
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Checking_Win32_BaseBoard_from_WMI
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x3d
nop
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140005e60
call fcn.1400110d0
lea rdx, str.Checking_Win32_BaseBoard_from_WMI
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Checking_MAC_address_from_WMI
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x41
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140005ea0
call fcn.140010540
lea rdx, str.Checking_MAC_address_from_WMI
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Checking_NTEventLog_from_WMI
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x42
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140005ee0
call fcn.140010760
lea rdx, str.Checking_NTEventLog_from_WMI
mov ecx, eax
call fcn.140012eb0
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x45
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140005f20
lea r8, [rbp - 0x40]
mov dword [rbp - 0x40], esi
xor edx, edx
mov ecx, 0x52534d42
mov edi, esi
call fcn.1400159d0
mov rdx, rax
test rax, rax
je 0x140005fcf
mov ebx, dword [rbp - 0x40]
mov rcx, rsi
mov eax, ebx
sub rax, 0xa
je 0x140005f87
movabs r8, 0x426c617574726956
nop dword [rax + rax]
cmp qword [rcx + rdx], r8
jne 0x140005f7f
cmp word [rcx + rdx + 8], 0x786f
je 0x140005fc3
inc rcx
cmp rcx, rax
jb 0x140005f70
mov rcx, rbx
mov rax, rsi
sub rcx, 4
je 0x140005fc6
cmp dword [rax + rdx], 0x786f6276
je 0x140005fc3
inc rax
cmp rax, rcx
jb 0x140005f93
mov rax, rsi
lea rcx, [rbx - 4]
nop dword [rax + rax]
cmp dword [rax + rdx], 0x584f4256
je 0x140005fc3
inc rax
cmp rax, rcx
jb 0x140005fb0
jmp 0x140005fc6
mov edi, r15d
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_SMBIOS_firmware
mov ecx, edi
call fcn.140012eb0
lea rdx, str.Checking_ACPI_tables
lea rcx, str.____s
call fcn.140008d70
mov rbx, r12
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140005ff3
call fcn.140010aa0
lea rdx, str.Checking_ACPI_tables
mov ecx, eax
call fcn.140012eb0
lea r14, str.Identifier
jmp 0x140006027
mov r13d, 5
cmp dword [0x140040090], 0
je 0x140006a05
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp - 0x20]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp - 0x20]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp - 0x18]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.VMWare_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008d70
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.VMWARE
mov qword [rbp + 0x78], r14
lea rax, [0x14001ed80]
mov qword [rbp + 0x90], r14
mov qword [rbp + 0x70], rax
lea rcx, str.SYSTEMControlSet001ControlSystemInformation
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_1Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp + 0xa8], r14
mov qword [rbp + 0x88], rax
lea rdi, [rbp + 0x80]
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_2Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp + 0x80], rdx
mov qword [rbp + 0xa0], rax
mov r12d, 1
lea rax, str.SystemManufacturer
mov qword [rbp + 0x98], rdx
mov qword [rbp + 0xc0], rax
xor r14d, r14d
lea rax, str.SystemProductName
mov qword [rbp + 0xb0], rdx
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xb8], rcx
mov qword [rbp + 0xc8], rdx
mov qword [rbp + 0xd0], rcx
mov qword [rbp + 0xe0], rdx
nop dword [rax]
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x280], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x282]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi - 0x10]
lea r8, str.Checking_reg_key__s
mov edx, 0x100
lea rcx, [rbp + 0x280]
call fcn.140008e30
mov r9, qword [rdi]
mov r8, qword [rdi - 8]
mov rdx, qword [rdi - 0x10]
call fcn.1400135b0
lea rdx, [rbp + 0x280]
lea rcx, str.____s
test eax, eax
je 0x1400061da
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400061b0
mov ebx, 0x5f
sub rbx, rax
je 0x1400061d5
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, r12
jne 0x1400061c4
mov ecx, r12d
jmp 0x140006217
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400061f0
mov ebx, 0x5f
sub rbx, rax
je 0x140006215
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, r12
jne 0x140006204
xor ecx, ecx
lea rdx, [rbp + 0x280]
call fcn.140012eb0
add rdi, 0x18
sub r13, r12
jne 0x140006140
xor edx, edx
mov word [rbp + 0x280], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x282]
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREVMware__Inc.VMware_Tools
mov edx, 0x100
lea r8, [0x14001ea00]
lea rcx, [rbp + 0x280]
call fcn.140008e30
lea rax, [rbp - 0x20]
mov qword [rbp - 0x20], r14
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREVMware__Inc.VMware_Tools
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006305
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x280]
lea rcx, str.____s
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400062c4
mov ebx, 0x5f
sub rbx, rax
je 0x1400062f1
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, r12
jne 0x1400062e0
lea rdx, [rbp + 0x280]
mov ecx, r12d
mov r13, r12
call fcn.140012eb0
jmp 0x140006362
lea rdx, [rbp + 0x280]
lea rcx, str.____s
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140006326
mov ebx, 0x5f
sub rbx, rax
je 0x140006351
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, r12
jne 0x140006340
lea rdx, [rbp + 0x280]
xor ecx, ecx
call fcn.140012eb0
mov r13, r12
call fcn.140011640
lea rax, [0x140020518]
mov esi, 4
mov qword [rbp + 0x70], rax
lea rdi, [rbp + 0x70]
lea rax, [0x140020520]
mov qword [rbp + 0x78], rax
lea rax, [0x140020538]
mov qword [rbp + 0x80], rax
lea rax, [0x140020540]
mov qword [rbp + 0x88], rax
lea rax, [0x140020558]
mov qword [rbp + 0x90], rax
lea rax, str.00:1C:14
mov qword [rbp + 0x98], rax
lea rax, [0x140020578]
mov qword [rbp + 0xa0], rax
lea rax, [0x140020580]
mov qword [rbp + 0xa8], rax
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x280], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x282]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi + 8]
lea r8, str.Checking_MAC_starting_with__s
mov edx, 0x100
lea rcx, [rbp + 0x280]
call fcn.140008e30
mov rcx, qword [rdi]
call fcn.1400136a0
lea rdx, [rbp + 0x280]
lea rcx, str.____s
test eax, eax
je 0x140006477
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140006445
mov ebx, 0x5f
sub rbx, rax
je 0x140006472
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140006460
mov ecx, r13d
jmp 0x1400064b8
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140006490
mov ebx, 0x5f
sub rbx, rax
je 0x1400064b6
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x1400064a4
xor ecx, ecx
lea rdx, [rbp + 0x280]
call fcn.140012eb0
add rdi, 0x10
sub rsi, 1
jne 0x1400063e0
lea rdx, str.Checking_VMWare_network_adapter_name
lea rcx, str.____s
call fcn.140008d70
mov ebx, 0x3a
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x1400064f0
mov dword [rbp - 0x40], 0x2c0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x2c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x14000653c
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo._n
call fcn.140008d70
mov ecx, r13d
jmp 0x140006605
lea rdx, [rbp - 0x40]
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x14000659f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x140006592
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.140008d00
mov ecx, r13d
jmp 0x140006605
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1400065ee
mov rdi, rsi
nop word [rax + rax]
lea rcx, [rdi + 0x110]
call fcn.1400130e0
mov rbx, rax
test rax, rax
je 0x1400065e6
lea rdx, str.VMWare
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov rcx, rbx
test rax, rax
jne 0x1400066fb
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [rdi]
test rdi, rdi
jne 0x1400065b0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, r14d
lea rdx, str.Checking_VMWare_network_adapter_name
call fcn.140012eb0
lea rax, str..HGFS
mov r14d, 2
mov qword [rbp - 0x20], rax
lea rsi, [rbp - 0x20]
lea rax, str.._vmci
mov r15d, 3
mov qword [rbp - 0x18], rax
xor r12d, r12d
nop word [rax + rax]
mov rcx, qword [rsi]
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov r8d, r13d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
mov word [rbp + 0x280], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x282]
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rsi]
lea r8, str.Checking_device__s
mov edx, 0x100
lea rcx, [rbp + 0x280]
call fcn.140008e30
cmp rdi, 0xffffffffffffffff
je 0x14000671d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x280]
lea rcx, str.____s
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x1400066d0
mov ebx, 0x5f
sub rbx, rax
je 0x1400066f6
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x1400066e4
mov ecx, r13d
jmp 0x140006768
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, r13d
jmp 0x140006605
lea rdx, [rbp + 0x280]
lea rcx, str.____s
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140006740
mov ebx, 0x5f
sub rbx, rax
je 0x140006766
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140006754
xor ecx, ecx
lea rdx, [rbp + 0x280]
call fcn.140012eb0
add rsi, 8
sub r14, 1
jne 0x140006640
lea rdx, str.Checking_VMWare_directory
lea rcx, str.____s
call fcn.140008d70
mov edi, 0x45
mov r12d, 0x49
mov ebx, edi
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x1400067a2
xor esi, esi
lea rcx, [rbp + 0x282]
xor edx, edx
mov word [rbp + 0x280], si
mov r8d, 0x206
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.VMWare_]
xor edx, edx
lea rcx, [rbp + 0x4a0]
mov r8d, 0x1f8
movaps xmmword [rbp + 0x490], xmm0
call sub.VCRUNTIME140.dll_memset
call fcn.1400134f0
lea rdx, [rbp + 0x70]
test eax, eax
je 0x140006815
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140006826
xor r9d, r9d
mov r8d, 0x26
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x490]
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x280]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140006857
mov ecx, r13d
test al, 0x10
jne 0x140006859
mov ecx, esi
lea rdx, str.Checking_VMWare_directory
call fcn.140012eb0
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, str.____s
call fcn.140008d70
mov rbx, rdi
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140006880
lea r8, [rbp - 0x40]
mov dword [rbp - 0x40], esi
xor edx, edx
mov ecx, 0x52534d42
mov ebx, esi
call fcn.1400159d0
test rax, rax
je 0x1400068e8
mov edx, dword [rbp - 0x40]
mov rcx, rsi
sub rdx, 6
je 0x1400068df
nop dword [rax + rax]
cmp dword [rax + rcx], 0x61774d56
jne 0x1400068d2
cmp word [rax + rcx + 4], 0x6572
je 0x1400068dc
inc rcx
cmp rcx, rdx
jb 0x1400068c0
jmp 0x1400068df
mov ebx, r13d
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_SMBIOS_firmware
mov ecx, ebx
call fcn.140012eb0
lea rdx, str.Checking_ACPI_tables
lea rcx, str.____s
call fcn.140008d70
mov rbx, r12
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140006910
mov ecx, 0x1000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
jne 0x140006948
lea rdx, str.Checking_ACPI_tables
mov ecx, esi
call fcn.140012eb0
jmp 0x140006a11
xor eax, eax
mov rdi, r14
mov ecx, 0x1000
mov rdx, r14
rep stosb byte [rdi], al
call fcn.140015940
mov ecx, eax
cmp eax, 0xffffffff
jne 0x140006978
xor eax, eax
lea rdx, str.Checking_ACPI_tables
mov ecx, esi
call fcn.140012eb0
jmp 0x140006a11
shr eax, 2
cmp ecx, 4
jb 0x1400069e9
test eax, eax
je 0x1400069e9
mov rbx, r14
mov edi, eax
xor r12d, r12d
nop dword [rax]
mov edx, dword [rbx]
lea r8, [rbp - 0x40]
mov ecx, 0x41435049
mov dword [rbp - 0x40], r12d
call fcn.1400159d0
test rax, rax
je 0x1400069dd
mov edx, dword [rbp - 0x40]
mov rcx, r12
sub rdx, 6
je 0x1400069d4
cmp dword [rcx + rax], 0x41574d56
jne 0x1400069c7
cmp word [rcx + rax + 4], 0x4552
je 0x1400069d1
inc rcx
cmp rcx, rdx
jb 0x1400069b5
jmp 0x1400069d4
mov esi, r13d
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add rbx, 4
sub rdi, 1
jne 0x140006990
jmp 0x1400069ec
mov esi, r13d
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_ACPI_tables
mov ecx, esi
call fcn.140012eb0
jmp 0x140006a11
mov r13d, 1
mov r15d, 3
cmp dword [0x14004008c], 0
je 0x140006cc2
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp - 0x20]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp - 0x20]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp - 0x18]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Virtual_PC_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008d70
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.VMSrvc.exe
mov esi, 2
mov qword [rbp - 0x20], rax
lea rdi, [rbp - 0x20]
lea rax, str.VMUSrvc.exe
xor r14d, r14d
mov qword [rbp - 0x18], rax
nop dword [rax]
xor edx, edx
mov word [rbp + 0x280], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x282]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_Virtual_PC_processes__s
mov edx, 0x100
lea rcx, [rbp + 0x280]
call fcn.140008e30
mov rcx, qword [rdi]
call fcn.1400155e0
lea rdx, [rbp + 0x280]
lea rcx, str.____s
test eax, eax
je 0x140006b37
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140006b04
mov ebx, 0x5f
sub rbx, rax
je 0x140006b32
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140006b20
mov ecx, r13d
jmp 0x140006b78
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140006b50
mov ebx, 0x5f
sub rbx, rax
je 0x140006b76
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140006b64
xor ecx, ecx
lea rdx, [rbp + 0x280]
call fcn.140012eb0
add rdi, 8
sub rsi, 1
jne 0x140006aa0
xor edx, edx
mov word [rbp + 0x280], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x282]
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
mov edx, 0x100
lea r8, [0x14001ea00]
lea rcx, [rbp + 0x280]
call fcn.140008e30
lea rax, [rbp - 0x20]
mov qword [rbp - 0x20], r14
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006c63
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x280]
lea rcx, str.____s
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140006c26
mov ebx, 0x5f
sub rbx, rax
je 0x140006c52
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140006c40
mov ecx, r13d
lea rdx, [rbp + 0x280]
call fcn.140012eb0
jmp 0x140006cc5
lea rdx, [rbp + 0x280]
lea rcx, str.____s
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140006c84
mov ebx, 0x5f
sub rbx, rax
je 0x140006cb2
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140006ca0
xor ecx, ecx
lea rdx, [rbp + 0x280]
call fcn.140012eb0
jmp 0x140006cc5
xor r14d, r14d
cmp dword [0x140040088], 0
je 0x1400072c6
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp - 0x20]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp - 0x20]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp - 0x18]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.QEMU_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008d70
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, [0x14001ed80]
mov esi, 2
mov qword [rbp - 8], rax
lea rcx, str.HARDWAREDescriptionSystem
lea rax, str.Identifier
mov qword [rbp + 0x10], rcx
mov qword [rbp], rax
lea rcx, str.SystemBiosVersion
lea rax, str.QEMU
mov qword [rbp + 0x18], rcx
mov qword [rbp + 8], rax
lea rdi, [rbp + 8]
mov qword [rbp + 0x20], rax
nop
xor edx, edx
mov word [rbp + 0x280], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x282]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi - 0x10]
lea r8, [0x14001ea00]
mov edx, 0x100
lea rcx, [rbp + 0x280]
call fcn.140008e30
mov r9, qword [rdi]
mov r8, qword [rdi - 8]
mov rdx, qword [rdi - 0x10]
call fcn.1400135b0
lea rdx, [rbp + 0x280]
lea rcx, str.____s
test eax, eax
je 0x140006e0b
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006de0
mov ebx, 0x5f
sub rbx, rax
je 0x140006e06
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140006df4
mov ecx, r13d
jmp 0x140006e48
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006e20
mov ebx, 0x5f
sub rbx, rax
je 0x140006e46
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140006e34
xor ecx, ecx
lea rdx, [rbp + 0x280]
call fcn.140012eb0
add rdi, 0x18
sub rsi, 1
jne 0x140006d70
lea rax, str.qemu_ga.exe
mov qword [rbp - 8], rax
lea rdi, [rbp - 8]
lea rax, str.vdagent.exe
mov qword [rbp], rax
lea rax, str.vdservice.exe
mov qword [rbp + 8], rax
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x280], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x282]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_qemu_processes__s
mov edx, 0x100
lea rcx, [rbp + 0x280]
call fcn.140008e30
mov rcx, qword [rdi]
call fcn.1400155e0
lea rdx, [rbp + 0x280]
lea rcx, str.____s
test eax, eax
je 0x140006f27
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x140006ef3
mov ebx, 0x5f
sub rbx, rax
je 0x140006f22
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140006f10
mov ecx, r13d
jmp 0x140006f67
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], si
jne 0x140006f40
mov ebx, 0x5f
sub rbx, rax
je 0x140006f65
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140006f53
xor ecx, ecx
lea rdx, [rbp + 0x280]
call fcn.140012eb0
add rdi, 8
sub r15, 1
jne 0x140006e90
xor edx, edx
mov word [rbp + 0x70], si
mov r8d, 0x206
lea rcx, [rbp + 0x72]
call sub.VCRUNTIME140.dll_memset
lea rax, str.qemu_ga
mov rdi, rsi
mov qword [rbp - 0x20], rax
lea rax, str.SPICE_Guest_Tools
mov qword [rbp - 0x18], rax
nop
xor edx, edx
mov word [rbp + 0x280], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x282]
call sub.VCRUNTIME140.dll_memset
call fcn.1400134f0
lea rdx, [rbp + 0x490]
test eax, eax
je 0x140006ff0
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140007001
xor r9d, r9d
mov r8d, 0x26
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov r8, qword [rbp + rdi*8 - 0x20]
lea rdx, [rbp + 0x490]
lea rcx, [rbp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea r9, [rbp + 0x70]
mov edx, 0x100
lea r8, str.Checking_QEMU_directory__s
lea rcx, [rbp + 0x280]
call fcn.140008e30
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140007097
test al, 0x10
je 0x140007097
lea rdx, [rbp + 0x280]
lea rcx, str.____s
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x140007067
mov ebx, 0x5f
sub rbx, rax
je 0x140007092
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140007080
mov ecx, r13d
jmp 0x1400070e7
lea rdx, [rbp + 0x280]
lea rcx, str.____s
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], si
jne 0x1400070c0
mov ebx, 0x5f
sub rbx, rax
je 0x1400070e5
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x1400070d3
xor ecx, ecx
lea rdx, [rbp + 0x280]
call fcn.140012eb0
inc rdi
cmp rdi, 2
jl 0x140006fb0
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, str.____s
call fcn.140008d70
mov r12d, 0x45
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub r12, 1
jne 0x140007120
lea r8, [rbp - 0x40]
mov dword [rbp - 0x40], esi
xor edx, edx
mov ecx, 0x52534d42
mov edi, esi
call fcn.1400159d0
mov rdx, rax
mov r12d, 0x49
test rax, rax
je 0x14000719f
mov ebx, dword [rbp - 0x40]
mov rcx, rsi
mov eax, ebx
sub rax, 4
je 0x140007196
cmp dword [rcx + rdx], 0x756d6571
je 0x140007193
inc rcx
cmp rcx, rax
jb 0x140007163
mov rax, rsi
lea rcx, [rbx - 4]
nop dword [rax + rax]
cmp dword [rax + rdx], 0x554d4551
je 0x140007193
inc rax
cmp rax, rcx
jb 0x140007180
jmp 0x140007196
mov edi, r13d
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_SMBIOS_firmware
mov ecx, edi
call fcn.140012eb0
lea rdx, str.Checking_ACPI_tables
lea rcx, str.____s
call fcn.140008d70
lea rcx, [0x140021238]
call fcn.140008d70
sub r12, 1
jne 0x1400071c0
mov ecx, 0x1000
mov r14d, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
test rax, rax
je 0x1400072b7
mov rdi, rax
mov ecx, 0x1000
xor eax, eax
mov rdx, r15
rep stosb byte [rdi], al
call fcn.140015940
mov ecx, eax
cmp eax, 0xffffffff
je 0x1400072b7
shr eax, 2
cmp ecx, 4
jb 0x1400072ab
test eax, eax
je 0x1400072ab
mov rdi, r15
mov esi, eax
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [rdi]
lea r8, [rbp - 0x40]
mov ecx, 0x41435049
mov dword [rbp - 0x40], r12d
call fcn.1400159d0
mov rdx, rax
test rax, rax
je 0x14000729f
mov ebx, dword [rbp - 0x40]
mov rcx, r12
mov eax, ebx
sub rax, 4
je 0x140007296
nop word [rax + rax]
cmp dword [rcx + rdx], 0x48434f42
je 0x140007293
inc rcx
cmp rcx, rax
jb 0x140007260
mov rax, r12
lea rcx, [rbx - 4]
nop dword [rax + rax]
cmp dword [rax + rdx], 0x43505842
je 0x140007293
inc rax
cmp rax, rcx
jb 0x140007280
jmp 0x140007296
mov r14d, r13d
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add rdi, 4
sub rsi, 1
jne 0x140007230
jmp 0x1400072ae
mov r14d, r13d
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_ACPI_tables
mov ecx, r14d
call fcn.140012eb0
cmp dword [0x140040080], 0
je 0x14000745e
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp - 0x20]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp - 0x20]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp - 0x18]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Xen_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008d70
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor eax, eax
lea rcx, [rbp + 0x282]
xor edx, edx
mov word [rbp + 0x280], ax
mov r8d, 0x1fe
call sub.VCRUNTIME140.dll_memset
lea r9, str.xenservice.exe
mov edx, 0x100
lea r8, str.Checking_Citrix_Xen_process__s
lea rcx, [rbp + 0x280]
call fcn.140008e30
lea rcx, str.xenservice.exe
call fcn.1400155e0
lea rdx, [rbp + 0x280]
lea rcx, str.____s
test eax, eax
je 0x1400073cb
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400073a0
mov ebx, 0x5f
sub rbx, rax
je 0x1400073c6
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x1400073b4
mov ecx, r13d
jmp 0x140007408
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400073e0
mov ebx, 0x5f
sub rbx, rax
je 0x140007406
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x1400073f4
xor ecx, ecx
lea rdx, [rbp + 0x280]
call fcn.140012eb0
lea rdx, str.Checking_Mac_Address_start_with_08:16:3E
lea rcx, str.____s
call fcn.140008d70
mov r15d, 0x36
mov ebx, r15d
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140007430
lea rcx, [0x1400206c0]
call fcn.1400136a0
lea rdx, str.Checking_Mac_Address_start_with_08:16:3E
mov ecx, eax
call fcn.140012eb0
jmp 0x140007464
mov r15d, 0x36
cmp dword [0x140040084], 0
je 0x14000773d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp - 0x20]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp - 0x20]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp - 0x18]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Xen_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008d70
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call fcn.14000fd80
lea rax, str.SYSTEMControlSet001Services_vioscsi
xor esi, esi
mov qword [rbp + 0x70], rax
lea rdi, [rbp + 0x70]
lea rax, str.SYSTEMControlSet001Services_viostor
mov qword [rbp + 0x78], rax
lea rax, str.SYSTEMControlSet001ServicesVirtIO_FS_Service
mov qword [rbp + 0x80], rax
lea rax, str.SYSTEMControlSet001ServicesVirtioSerial
mov qword [rbp + 0x88], rax
lea rax, str.SYSTEMControlSet001ServicesBALLOON
mov qword [rbp + 0x90], rax
lea rax, str.SYSTEMControlSet001ServicesBalloonService
mov qword [rbp + 0x98], rax
lea rax, str.SYSTEMControlSet001Services_netkvm
mov qword [rbp + 0xa0], rax
xor edx, edx
mov word [rbp + 0x280], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x282]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, [0x14001ea00]
mov edx, 0x100
lea rcx, [rbp + 0x280]
call fcn.140008e30
mov rdx, qword [rdi]
lea rax, [rbp - 0x20]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 0x20], rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400075ea
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x280]
lea rcx, str.____s
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], si
jne 0x1400075c0
mov ebx, 0x5f
sub rbx, rax
je 0x1400075e5
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x1400075d3
mov ecx, r13d
jmp 0x140007637
lea rdx, [rbp + 0x280]
lea rcx, str.____s
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], si
jne 0x140007610
mov ebx, 0x5f
sub rbx, rax
je 0x140007635
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140007623
xor ecx, ecx
lea rdx, [rbp + 0x280]
call fcn.140012eb0
add rdi, 8
sub qword [rsp + 0x40], 1
jne 0x140007531
lea rdx, str.Checking_KVM_virio_directory
lea rcx, str.____s
call fcn.140008d70
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub qword [rsp + 0x48], 1
jne 0x140007670
xor edx, edx
mov word [rbp + 0x70], si
mov r8d, 0x206
lea rcx, [rbp + 0x72]
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.Virtio_Win_]
xor edx, edx
lea rcx, [rbp + 0x298]
mov r8d, 0x1f0
movaps xmmword [rbp + 0x280], xmm0
movsd xmm0, qword [0x14001ecc8]
movsd qword [rbp + 0x290], xmm0
call sub.VCRUNTIME140.dll_memset
call fcn.1400134f0
lea rdx, [rbp + 0x490]
test eax, eax
je 0x1400076f0
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140007701
xor r9d, r9d
mov r8d, 0x26
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x280]
lea rdx, [rbp + 0x490]
lea rcx, [rbp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000772f
mov ecx, r13d
test al, 0x10
jne 0x140007731
mov ecx, esi
lea rdx, str.Checking_KVM_virio_directory
call fcn.140012eb0
cmp dword [0x14004007c], 0
je 0x140007934
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp - 0x20]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp - 0x20]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp - 0x18]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Wine_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008d70
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Checking_Wine_via_dll_exports
lea rcx, str.____s
call fcn.140008d70
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub qword [rbp - 0x68], 1
jne 0x1400077c0
lea rcx, [0x14001c1e8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x1400077f7
lea rcx, str.GetModuleHandle
call fcn.140012fe0
xor esi, esi
mov ecx, esi
jmp 0x140007811
lea rdx, str.wine_get_unix_file_name
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor esi, esi
test rax, rax
mov ecx, esi
setne cl
lea rdx, str.Checking_Wine_via_dll_exports
call fcn.140012eb0
xor edx, edx
mov word [rbp + 0x280], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x282]
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREWine
mov edx, 0x100
lea r8, [0x14001ea00]
lea rcx, [rbp + 0x280]
call fcn.140008e30
lea rax, [rbp - 0x68]
mov qword [rbp - 0x68], rsi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREWine
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400078db
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x280]
lea rcx, str.____s
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400078b0
mov ebx, 0x5f
sub rbx, rax
je 0x1400078d6
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x1400078c4
mov ecx, r13d
jmp 0x140007928
lea rdx, [rbp + 0x280]
lea rcx, str.____s
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007900
mov ebx, 0x5f
sub rbx, rax
je 0x140007926
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140007914
xor ecx, ecx
lea rdx, [rbp + 0x280]
call fcn.140012eb0
cmp dword [0x140040078], 0
je 0x140007afe
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp - 0x68]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp - 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp - 0x60]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Paralles_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008d70
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.prl_cc.exe
mov esi, 2
mov qword [rbp - 0x68], rax
lea rdi, [rbp - 0x68]
lea rax, str.prl_tools.exe
xor r14d, r14d
mov qword [rbp - 0x60], rax
nop dword [rax]
xor edx, edx
mov word [rbp + 0x280], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x282]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_Parallels_processes:__s
mov edx, 0x100
lea rcx, [rbp + 0x280]
call fcn.140008e30
mov rcx, qword [rdi]
call fcn.1400155e0
lea rdx, [rbp + 0x280]
lea rcx, str.____s
test eax, eax
je 0x140007a57
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140007a24
mov ebx, 0x5f
sub rbx, rax
je 0x140007a52
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140007a40
mov ecx, r13d
jmp 0x140007a98
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140007a70
mov ebx, 0x5f
sub rbx, rax
je 0x140007a96
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140007a84
xor ecx, ecx
lea rdx, [rbp + 0x280]
call fcn.140012eb0
add rdi, 8
sub rsi, 1
jne 0x1400079c0
lea rdx, str.Checking_Mac_Address_start_with_00:1C:42
lea rcx, str.____s
call fcn.140008d70
mov rbx, r15
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140007ad0
lea rcx, [0x14001ed78]
call fcn.1400136a0
lea rdx, str.Checking_Mac_Address_start_with_00:1C:42
mov ecx, eax
call fcn.140012eb0
jmp 0x140007b01
xor r14d, r14d
cmp dword [0x140040074], 0
je 0x140007d3c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp - 0x68]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp - 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp - 0x60]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Hyper_V_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008d70
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Checking_for_Hyper_V_driver_objects
lea rcx, str.____s
call fcn.140008d70
mov edi, 0x3b
mov ebx, edi
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140007b81
lea rcx, str.Driver
call fcn.140015cd0
test rax, rax
je 0x140007c65
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
cmp rdi, rsi
je 0x140007c60
nop dword [rax + rax]
mov rbx, qword [rdi]
lea rdx, str.VMBusHID
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140007e35
lea rdx, str.vmbus
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140007e35
lea rdx, str.vmgid
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140007e35
lea rdx, str.IndirectKmd
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140007e35
lea rdx, str.HyperVideo
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140007e35
lea rdx, str.hyperkbd
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140007e35
add rdi, 8
cmp rdi, rsi
jne 0x140007bc0
mov edi, 0x3b
mov ecx, r14d
lea rdx, str.Checking_for_Hyper_V_driver_objects
call fcn.140012eb0
lea rdx, str.Checking_for_Hyper_V_global_objects
lea rcx, str.____s
call fcn.140008d70
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rdi, 1
jne 0x140007c90
lea rcx, str.GLOBAL__
call fcn.140015cd0
test rax, rax
je 0x140007d2d
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
cmp rdi, rsi
je 0x140007d2d
nop
mov rbx, qword [rdi]
lea rdx, str.VMBUS
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
jne 0x140007e42
lea rdx, str.VDRVROOT
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140007e42
lea rdx, str.VmGenerationCounter
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140007e42
lea rdx, str.VmGid
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140007e42
add rdi, 8
cmp rdi, rsi
jne 0x140007cc0
mov ecx, r14d
lea rdx, str.Checking_for_Hyper_V_global_objects
call fcn.140012eb0
cmp dword [0x140040070], 0
je 0x140007d5e
call fcn.1400118c0
call fcn.140012a90
call fcn.140011cd0
call fcn.140012660
call fcn.140012120
cmp dword [0x14004006c], 0
je 0x140008532
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp - 0x68]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp - 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp - 0x60]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Timing_attacks
lea rcx, str._n___________________________s___________________________n
call fcn.140008d70
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, 0xa
lea rcx, str._n___Delay_value_is_set_to__u_minutes_..._n
call fcn.140008d00
lea rdx, str.Performing_a_sleep_using_NtDelayExecution_...
lea rcx, str.____s
call fcn.140008d70
mov r12d, 0x32
mov ebx, r12d
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140007df1
movabs rax, 0xfffffffe9a5f4400
lea rdx, [0x14003f1f0]
xor edi, edi
mov qword [rbp - 0x68], rax
mov eax, edi
mov rcx, rdx
nop
cmp dword [rcx], 0xd
je 0x140007e4a
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140007e20
mov ecx, r13d
jmp 0x140007e85
mov ecx, r13d
mov edi, 0x3b
jmp 0x140007c68
mov ecx, r13d
jmp 0x140007d30
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], dil
jne 0x140007e5f
mov ecx, r13d
jmp 0x140007e85
mov eax, edi
mov rcx, rdx
cmp dword [rcx], 0xd
je 0x140007f49
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140007e64
mov rax, rdi
lea rdx, [rbp - 0x68]
xor ecx, ecx
call rax
mov ecx, edi
lea rdx, str.Performing_a_sleep_using_NtDelayExecution_...
call fcn.140012eb0
lea rdx, str.Performing_a_sleep___in_a_loop_...
lea rcx, str.____s
call fcn.140008d70
mov r14d, 0x3d
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub r14, 1
jne 0x140007eb0
mov ebx, 0x3e8
nop word [rax + rax]
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rbx, 1
jne 0x140007ed0
lea rdx, str.Performing_a_sleep___in_a_loop_...
xor ecx, ecx
call fcn.140012eb0
lea rdx, str.Delaying_execution_using_SetTimer_...
lea rcx, str.____s
call fcn.140008d70
mov r14d, 0x3a
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub r14, 1
jne 0x140007f10
lea r9, [0x140015f80]
xor edx, edx
xor ecx, ecx
mov r8d, 0x927c0
call qword [sym.imp.USER32.dll_SetTimer]
mov rbx, rax
test rax, rax
jne 0x140007f67
mov ecx, r13d
jmp 0x140007fd2
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], dil
je 0x140007e78
mov rax, qword [rdx + rcx*8 + 0x28]
jmp 0x140007e7b
xor r9d, r9d
lea rcx, [rbp - 8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp dword [0x1400400b8], edi
mov ecx, edi
sete cl
test ecx, eax
je 0x140007fc5
nop dword [rax + rax]
lea rcx, [rbp - 8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 8]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rbp - 8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp dword [0x1400400b8], edi
mov ecx, edi
sete cl
test ecx, eax
jne 0x140007f90
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
mov ecx, edi
lea rdx, str.Delaying_execution_using_SetTimer_...
call fcn.140012eb0
lea rdx, str.Delaying_execution_using_timeSetEvent_...
lea rcx, str.____s
call fcn.140008d70
mov rbx, r15
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140007ff4
mov edx, 8
lea rcx, [rbp - 0x68]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
mov rax, qword [rbp - 0x68]
lea r8, [0x140015f80]
mov ebx, dword [rbp - 0x64]
test eax, eax
mov ecx, edi
mov dword [rsp + 0x20], edi
cmovne ecx, eax
cmp ecx, ebx
cmovb ebx, ecx
xor r9d, r9d
mov edx, ebx
mov ecx, 0x927c0
call qword [sym.imp.WINMM.dll_timeSetEvent]
test eax, eax
jne 0x140008050
mov ecx, r13d
jmp 0x140008062
mov ecx, eax
call qword [sym.imp.WINMM.dll_timeKillEvent]
mov ecx, ebx
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ecx, edi
lea rdx, str.Delaying_execution_using_timeSetEvent_...
call fcn.140012eb0
lea rdx, str.Delaying_execution_using_WaitForSingleObject_...
lea rcx, str.____s
call fcn.140008d70
mov esi, 0x2f
mov ebx, esi
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140008090
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
jne 0x1400080c9
lea rcx, [0x140021f80]
call fcn.140012fe0
mov ecx, r13d
jmp 0x1400080d9
mov edx, 0x927c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, edi
lea rdx, str.Delaying_execution_using_WaitForSingleObject_...
call fcn.140012eb0
lea rdx, str.Delaying_execution_using_WaitForMultipleObjects_...
lea rcx, str.____s
call fcn.140008d70
mov r14d, 0x2c
nop
lea rcx, [0x140021238]
call fcn.140008d70
sub r14, 1
jne 0x140008100
mov ebx, edi
lea rdi, [rbp - 0x68]
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi], rax
test rax, rax
je 0x140008161
inc ebx
add rdi, 8
cmp ebx, 2
jb 0x140008120
mov r9d, 0x927c0
lea rdx, [rbp - 0x68]
xor r8d, r8d
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor eax, eax
mov ecx, eax
jmp 0x140008170
lea rcx, [0x140021f80]
call fcn.140012fe0
mov ecx, r13d
lea rdx, str.Delaying_execution_using_WaitForMultipleObjects_...
call fcn.140012eb0
lea rdx, str.Delaying_execution_using_IcmpSendEcho_...
lea rcx, str.____s
call fcn.140008d70
nop
lea rcx, [0x140021238]
call fcn.140008d70
sub r15, 1
jne 0x140008190
movsd xmm0, qword [str.Data_Buffer]
mov eax, dword [0x140021fa0]
movsd qword [rbp - 8], xmm0
xorps xmm0, xmm0
mov dword [rbp], eax
xor eax, eax
movups xmmword [rbp + 4], xmm0
mov dword [rbp + 0x14], eax
call qword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400081f8
lea rcx, str._tUnable_to_open_handle._n
call fcn.140008d00
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.IcmpCreatefile_returned_error:__u_n
call fcn.140008d00
mov ecx, r13d
jmp 0x14000826f
mov ecx, 0x50
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
mov rcx, rbx
test rax, rax
jne 0x140008228
call qword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
lea rcx, str._tUnable_to_allocate_memory_n
call fcn.140008d00
mov ecx, r13d
xor r15d, r15d
jmp 0x14000826f
mov dword [rsp + 0x38], 0x927c0
lea r8, [rbp - 8]
mov dword [rsp + 0x30], 0x50
xor r15d, r15d
mov qword [rsp + 0x28], rdi
mov r9d, 0x20
mov edx, 0xffffffff
mov qword [rsp + 0x20], r15
call qword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
mov rcx, rbx
call qword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, r15d
lea rdx, str.Delaying_execution_using_IcmpSendEcho_...
call fcn.140012eb0
lea rdx, str.Delaying_execution_using_CreateWaitableTimer_...
lea rcx, str.____s
call fcn.140008d70
nop
lea rcx, [0x140021238]
call fcn.140008d70
sub rsi, 1
jne 0x140008290
movabs rax, 0xfffffffe9a5f4400
xor r8d, r8d
mov edx, r13d
mov qword [rbp - 0x68], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov rdi, rax
test rax, rax
jne 0x1400082cb
mov ebx, r13d
jmp 0x14000831a
mov dword [rsp + 0x28], r15d
lea rdx, [rbp - 0x68]
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
test eax, eax
jne 0x1400082f1
mov ebx, r13d
jmp 0x140008308
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov ebx, r15d
cmovne ebx, r13d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Delaying_execution_using_CreateWaitableTimer_...
mov ecx, ebx
call fcn.140012eb0
lea rdx, str.Delaying_execution_using_CreateTimerQueueTimer_...
lea rcx, str.____s
call fcn.140008d70
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub qword [rbp + 0x28], 1
jne 0x140008340
xor r9d, r9d
mov qword [rbp + 0x28], r15
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1400400b0], rax
test rax, rax
jne 0x140008378
mov ebx, r15d
jmp 0x1400083f3
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
mov rdi, rax
test rax, rax
jne 0x14000838b
mov ebx, r13d
jmp 0x1400083f3
mov dword [rsp + 0x30], r15d
lea r8, [0x140015f90]
mov dword [rsp + 0x28], r15d
lea rcx, [rbp + 0x28]
mov r9d, 0xdeadbeef
mov dword [rsp + 0x20], 0x927c0
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
test eax, eax
jne 0x1400083c0
mov ebx, r13d
jmp 0x1400083db
mov rcx, qword [0x1400400b0]
mov edx, 0x5b8d80
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov ebx, r15d
cmovne ebx, r15d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
mov rcx, qword [0x1400400b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Delaying_execution_using_CreateTimerQueueTimer_...
mov ecx, ebx
call fcn.140012eb0
lea rdx, str.Checking_RDTSC_Locky_trick
lea rcx, str.____s
call fcn.140008d70
mov r14d, 0x44
nop word [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub r14, 1
jne 0x140008420
mov esi, r15d
mov r14d, 0xa
nop dword [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
rdtsc
shl rdx, 0x20
xor ecx, ecx
or rax, rdx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
rdtsc
shl rdx, 0x20
mov ecx, ebx
or rax, rdx
sub ecx, edi
sub eax, ebx
xor edx, edx
div ecx
cmp eax, r14d
jae 0x14000848a
inc esi
cmp esi, r14d
jb 0x140008440
mov ecx, r13d
jmp 0x14000848d
mov ecx, r15d
lea rdx, str.Checking_RDTSC_Locky_trick
call fcn.140012eb0
lea rdx, str.Checking_RDTSC_which_force_a_VM_Exit__cpuid_
lea rcx, str.____s
call fcn.140008d70
nop dword [rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub r12, 1
jne 0x1400084b0
mov r8, r15
nop word [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdi, rax
xor eax, eax
xor ecx, ecx
cpuid
mov dword [rbp + 0x28], eax
mov dword [rbp + 0x2c], ebx
mov dword [rbp + 0x30], ecx
mov dword [rbp + 0x34], edx
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rdi
add r8, rax
sub r14, 1
jne 0x1400084d0
mov ecx, r15d
movabs rax, 0xcccccccccccccccd
mul r8
shr rdx, 3
lea rax, [rdx - 1]
cmp rax, 0x3e6
lea rdx, str.Checking_RDTSC_which_force_a_VM_Exit__cpuid_
seta cl
call fcn.140012eb0
jmp 0x140008535
xor r15d, r15d
cmp dword [0x140040064], 0
je 0x140008883
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x28]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x28]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x30]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Analysis_tools
lea rcx, str._n___________________________s___________________________n
call fcn.140008d70
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.ollydbg.exe
mov qword [rbp + 0x70], rax
lea rax, str.ProcessHacker.exe
mov qword [rbp + 0x78], rax
lea rax, str.tcpview.exe
mov qword [rbp + 0x80], rax
lea rax, str.autoruns.exe
mov qword [rbp + 0x88], rax
lea rax, str.autorunsc.exe
mov qword [rbp + 0x90], rax
lea rax, str.filemon.exe
mov qword [rbp + 0x98], rax
lea rax, str.procmon.exe
mov qword [rbp + 0xa0], rax
lea rax, str.regmon.exe
mov qword [rbp + 0xa8], rax
lea rax, str.procexp.exe
mov qword [rbp + 0xb0], rax
lea rax, str.idaq.exe
mov qword [rbp + 0xb8], rax
lea rax, str.idaq64.exe
mov qword [rbp + 0xc0], rax
lea rax, str.ImmunityDebugger.exe
mov qword [rbp + 0xc8], rax
lea rax, str.Wireshark.exe
mov qword [rbp + 0xd0], rax
lea rax, str.dumpcap.exe
mov qword [rbp + 0xd8], rax
lea rax, str.HookExplorer.exe
mov qword [rbp + 0xe0], rax
lea rax, str.ImportREC.exe
mov qword [rbp + 0xe8], rax
lea rax, str.PETools.exe
mov qword [rbp + 0xf0], rax
lea rax, str.LordPE.exe
mov qword [rbp + 0xf8], rax
lea rax, str.SysInspector.exe
mov qword [rbp + 0x100], rax
lea rax, str.proc_analyzer.exe
mov qword [rbp + 0x108], rax
lea rax, str.sysAnalyzer.exe
mov qword [rbp + 0x110], rax
lea rax, str.sniff_hit.exe
mov qword [rbp + 0x118], rax
lea rax, str.windbg.exe
mov qword [rbp + 0x120], rax
lea rax, str.joeboxcontrol.exe
mov qword [rbp + 0x128], rax
lea rax, str.joeboxserver.exe
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x138], rax
lea rax, str.ResourceHacker.exe
mov qword [rbp + 0x140], rax
lea rax, str.x32dbg.exe
mov qword [rbp + 0x148], rax
lea rax, str.x64dbg.exe
mov qword [rbp + 0x150], rax
lea rax, str.Fiddler.exe
mov qword [rbp + 0x158], rax
lea rax, str.httpdebugger.exe
mov qword [rbp + 0x160], rax
lea rax, str.cheatengine_i386.exe
mov qword [rbp + 0x168], rax
lea rdi, [rbp + 0x70]
lea rax, str.cheatengine_x86_64.exe
mov qword [rbp + 0x170], rax
lea rax, str.cheatengine_x86_64_SSE4_AVX2.exe
mov qword [rbp + 0x178], rax
lea rax, str.frida_helper_32.exe
mov qword [rbp + 0x180], rax
lea rax, str.frida_helper_64.exe
mov qword [rbp + 0x188], rax
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x280], r15w
mov r8d, 0x1fe
lea rcx, [rbp + 0x282]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_process_of_malware_analysis_tool:__s
mov edx, 0x100
lea rcx, [rbp + 0x280]
call fcn.140008e30
mov rcx, qword [rdi]
call fcn.1400155e0
lea rdx, [rbp + 0x280]
lea rcx, str.____s
test eax, eax
je 0x140008827
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400087f4
mov ebx, 0x5f
sub rbx, rax
je 0x140008822
nop dword [rax + rax]
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140008810
mov ecx, r13d
jmp 0x140008868
call fcn.140008d70
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008840
mov ebx, 0x5f
sub rbx, rax
je 0x140008866
lea rcx, [0x140021238]
call fcn.140008d70
sub rbx, 1
jne 0x140008854
xor ecx, ecx
lea rdx, [rbp + 0x280]
call fcn.140012eb0
add rdi, 8
sub qword [rbp - 0x48], 1
jne 0x140008790
cmp dword [0x140040060], 0
je 0x1400088eb
lea rcx, str.Begin_AntiDisassmConstantCondition_n
call fcn.140008d70
call fcn.140015fc0
lea rcx, str.Begin_AntiDisassmAsmJmpSameTarget_n
call fcn.140008d70
call fcn.140015fc8
lea rcx, str.Begin_AntiDisassmImpossibleDiasassm_n
call fcn.140008d70
call fcn.140015fcf
lea rcx, str.Begin_AntiDisassmFunctionPointer_n
call fcn.140008d70
mov ecx, 2
call fcn.140015fe3
lea rcx, str.Begin_AntiDisassmReturnPointerAbuse_n
call fcn.140008d70
mov ecx, 0x29a
call fcn.14001600e
cmp dword [0x140040068], 0
je 0x1400089b5
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x28]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x28]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x30]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Anti_Dumping
lea rcx, str._n___________________________s___________________________n
call fcn.140008d70
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.___Erasing_PE_header_from_memory_n
call fcn.140008d70
xor ecx, ecx
mov dword [rbp - 0x80], r15d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9, [rbp - 0x80]
mov edx, 0x1000
mov rcx, rax
mov r8d, 4
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
mov rbx, qword gs:[0x60]
lea rcx, str.___Increasing_SizeOfImage_in_PE_Header_to:_0x100000_n
call fcn.140008d70
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x30]
add eax, 0x100000
mov dword [rcx + 0x40], eax
lea rcx, str._n_nAnalysis_done__I_hope_you_didnt_get_red_flags_:_
call fcn.140008d70
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
mov rcx, qword [rbp + 0x1490]
xor rcx, rsp
call fcn.140016040
lea r11, [rsp + 0x15a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret