Function at 0x140001440
Capabilities:
Access peb ldr_data
Check for debugger via api
Check for outputdebugstring error
Check for peb beingdebugged flag
Check for peb ntglobalflag flag
Check for software breakpoints
Check for time delay via gettickcount
Check for unmoving mouse cursor
Check if file exists
Check if process is running under wine
Check os version
Create thread
Encode data using base64
Enumerate process modules
Execute anti-debugging instructions
Get common file path
Get disk size
Get file attributes
Get memory capacity
Get ntdll base address
Get number of processor cores
Get program files directory
Get system information on windows
Print debug messages
Query environment variable
Query or enumerate registry value
Reference processor manufacturer constants
Reference wmi statements
Send icmp echo request
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x14b0]
mov eax, 0x15b0
call fcn.140016dd0
sub rsp, rax
mov rax, qword [0x140027010]
xor rax, rsp
mov qword [rbp + 0x14a0], rax
movsxd r14, ecx
xor r13d, r13d
mov rsi, rdx
cmp r14d, 1
jle 0x14000151d
mov ebx, 1
cmp r14, rbx
jbe 0x140001531
lea edi, [rbx + 1]
lea r12, str.__check
nop dword [rax]
mov rdx, qword [rsi + rbx*8]
mov rax, r13
nop word [rax + rax]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r12 + rax - 1]
jne 0x14000150f
cmp rax, 8
jne 0x1400014c0
cmp edi, r14d
jge 0x14000150f
mov rdx, qword [rsi + rbx*8 + 8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov r8, 0xffffffffffffffff
mov qword [rbp - 8], r13
inc r8
cmp byte [rdx + r8], r13b
jne 0x1400014f4
lea rcx, [rbp - 0x20]
call fcn.140008a20
lea rcx, [rbp - 0x20]
call fcn.140001010
add edi, 2
add rbx, 2
cmp rbx, r14
jl 0x1400014b0
jmp 0x140001531
mov dword [0x140040034], 1
mov dword [0x140040030], 1
lea rcx, str.Al_Khaser___by_Lord_Noteworthy
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 0x64
mov dword [rsp + 0x28], 1
mov r8d, edx
mov dword [rsp + 0x20], 0x384
mov r9d, 0x384
mov rcx, rax
call qword [sym.imp.USER32.dll_MoveWindow]
lea rcx, str._al_khaser_version_0.82_
call fcn.140008b90
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp - 0x40]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp - 0x40]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp - 0x38]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Initialisation
lea rcx, str._n___________________________s___________________________n
call fcn.140008b90
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rsi, [0x14003f19c]
nop word [rax + rax]
mov r15d, dword [rsi + 4]
xor al, al
test dword [rsi - 4], 0xfffffffd
mov r12d, dword [rsi]
jne 0x140001693
xor r14b, r14b
lea rbx, [0x14003f758]
xor edi, edi
lea rcx, [0x14003f828]
nop dword [rax]
test rdi, rdi
je 0x140001627
cmp dword [rbx - 8], r12d
jne 0x140001627
mov r14b, 1
call qword [rbx]
lea rcx, [0x14003f828]
inc rdi
add rbx, 0x10
cmp rbx, rcx
jl 0x140001610
test r14b, r14b
jne 0x140001641
lea rcx, str.ERROR:_Minimum_version_value_was_invalid._n
jmp 0x14000168c
test al, al
je 0x140001691
test r15d, r15d
jne 0x14000164e
mov al, 1
jmp 0x140001693
xor dil, dil
lea rbx, [0x14003f758]
xor al, al
nop word [rax + rax]
cmp dword [rbx - 8], r15d
jne 0x140001677
mov dil, 1
call qword [rbx]
test al, al
lea rcx, [0x14003f828]
sete al
add rbx, 0x10
cmp rbx, rcx
jl 0x140001660
test dil, dil
jne 0x140001693
lea rcx, str.ERROR:_Removed_version_value_was_invalid._n
call fcn.140008b20
xor al, al
mov rcx, qword [rsi - 0x14]
mov byte [rsi + 9], al
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x1400016aa
mov byte [rsi + 8], al
jmp 0x1400016c4
mov rdx, qword [rsi - 0xc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rsi + 0xc], rax
setne al
mov byte [rsi + 8], al
inc r13d
add rsi, 0x30
cmp r13d, 0x1f
jb 0x1400015e0
xor r12d, r12d
lea rcx, [rbp + 0x82]
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x206
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x80]
call fcn.140013580
test eax, eax
je 0x140001717
lea rdx, [rbp + 0x80]
lea rcx, str._n___You_are_running:__s_n
call fcn.140008b90
mov esi, r12d
lea rbx, [0x14003f1a4]
mov edi, r12d
cmp byte [rbx + 1], r12b
je 0x140001745
cmp byte [rbx], r12b
jne 0x140001745
mov r8, qword [rbx - 0x14]
lea rcx, str.___Warning:_API__s__s_was_expected_to_exist_but_was_not_found._n
mov rdx, qword [rbx - 0x1c]
call fcn.140008b20
inc esi
inc edi
add rbx, 0x30
cmp edi, 0x1f
jb 0x140001724
test esi, esi
jne 0x140001760
lea rcx, str.___All_APIs_present_and_accounted_for._n
call fcn.140008b20
call fcn.140013290
test eax, eax
je 0x140001775
lea rcx, str.Process_is_running_under_WOW64_n_n
call fcn.140008b90
cmp dword [0x140040030], r12d
je 0x140001854
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [rbp + 0x294]
lea r8, [rbp - 0x50]
xorps xmm0, xmm0
lea rdx, [fcn.140009300]
mov ecx, 4
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x140001854
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp - 0x50]
lea r8, [rbp - 0x40]
mov rcx, rax
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetElement
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x140001854
mov rdi, r12
cmp dword [rbp - 0x38], r12d
jbe 0x140001854
mov rbx, qword [rbp - 0x40]
mov r8d, 0x30
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
jb 0x140001846
mov eax, dword [rbp + 4]
test al, 0x10
jne 0x14000181c
test al, 0x20
jne 0x14000181c
test al, al
js 0x14000181c
test al, 0x40
je 0x140001846
mov rdx, qword [0x140040058]
cmp rdx, qword [0x140040060]
mov qword [rbp + 0x28], rbx
je 0x14000183d
mov qword [rdx], rbx
add qword [0x140040058], 8
jmp 0x140001846
lea r8, [rbp + 0x28]
call fcn.1400094e0
mov eax, dword [rbp - 0x38]
add rdi, rsi
add rbx, rsi
cmp rdi, rax
jb 0x1400017f0
lea r15, [0x14003f180]
cmp dword [0x140040034], 0
mov r14d, 0xdeadbeef
je 0x140001af4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.TLS_Callbacks
lea rcx, str._n___________________________s___________________________n
call fcn.140008b90
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.TLS_process_attach_callback
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x43
nop
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400018e0
mov rax, qword [0x140040070]
mov ebx, r12d
test rax, rax
jne 0x140001939
inc ebx
cmp ebx, 0x3e8
je 0x140001925
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov rax, qword [0x140040070]
test rax, rax
je 0x140001901
cmp ebx, 0x3e8
jl 0x140001939
lea rcx, str.TLSCallbackProcess_timeout_on_event_creation.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, 1
jmp 0x1400019b8
mov rcx, qword [0x140040070]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000198a
cmp eax, 0xffffffff
jne 0x140001968
lea rcx, str.TLSCallbackProcess_wait_failed.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, 1
jmp 0x1400019b8
lea rcx, str.TLSCallbackProcess_wait_abandoned.
cmp eax, 0x80
je 0x14000197d
lea rcx, str.TLSCallbackProcess_timeout_on_event_wait.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, 1
jmp 0x1400019b8
mov eax, dword [0x140040078]
lea rcx, str.TLSCallbackProcess_data_did_not_match.
cmp eax, r14d
jne 0x1400019a3
lea rcx, str.All_seems_fine_for_TLSCallbackProcess.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x140040078]
mov ecx, r12d
cmp eax, r14d
setne cl
lea rdx, str.TLS_process_attach_callback
call fcn.140012c50
lea rdx, str.TLS_thread_attach_callback
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x44
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400019e0
mov qword [rsp + 0x28], r12
lea r8, [0x14000d870]
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x140001a22
lea rcx, str.TLS_callback:_couldnt_start_dummy_thread
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, qword [0x140040068]
mov ebx, r12d
test rax, rax
jne 0x140001a69
inc ebx
cmp ebx, 0x3e8
je 0x140001a55
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov rax, qword [0x140040068]
test rax, rax
je 0x140001a31
cmp ebx, 0x3e8
jl 0x140001a69
lea rcx, str.TLSCallbackThread_timeout_on_event_creation.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, 1
jmp 0x140001ae8
mov rcx, qword [0x140040068]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140001aba
cmp eax, 0xffffffff
jne 0x140001a98
lea rcx, str.TLSCallbackThread_wait_failed.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, 1
jmp 0x140001ae8
lea rcx, str.TLSCallbackThread_wait_abandoned.
cmp eax, 0x80
je 0x140001aad
lea rcx, str.TLSCallbackThread_timeout_on_event_wait.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, 1
jmp 0x140001ae8
mov eax, dword [0x14004004c]
lea rcx, str.TLSCallbackThread_data_did_not_match.
cmp eax, r14d
jne 0x140001ad3
lea rcx, str.All_seems_fine_for_TLSCallbackThread.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x14004004c]
mov ecx, r12d
cmp eax, r14d
setne cl
lea rdx, str.TLS_thread_attach_callback
call fcn.140012c50
cmp dword [0x140040030], 0
je 0x1400033d8
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Debugger_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008b90
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Checking_Hardware_Breakpoints
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x41
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140001b72
call fcn.140008d40
lea rdx, str.Checking_Hardware_Breakpoints
mov ecx, eax
call fcn.140012c50
lea rdx, str.Checking_IsDebuggerPresent_API
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x40
nop
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140001bb0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, eax
lea rdx, str.Checking_IsDebuggerPresent_API
call fcn.140012c50
lea rdx, str.Checking_PEB.BeingDebugged
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x44
nop
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140001bf0
mov rax, qword gs:[0x60]
lea rdx, str.Checking_PEB.BeingDebugged
mov ecx, r12d
cmp byte [rax + 2], 1
sete cl
call fcn.140012c50
lea rdx, str.Checking_CheckRemoteDebuggerPresent_API
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x37
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140001c40
mov dword [rbp - 0x28], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov ecx, dword [rbp - 0x28]
lea rdx, str.Checking_CheckRemoteDebuggerPresent_API
call fcn.140012c50
lea rdx, str.Checking_PEB.NtGlobalFlag
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x45
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140001c90
mov rax, qword gs:[0x60]
add rax, 0xbc
je 0x140001cc3
test byte [rax], 0x70
je 0x140001cc3
mov r13d, 1
mov ecx, r13d
jmp 0x140001ccc
mov ecx, r12d
mov r13d, 1
lea rdx, str.Checking_PEB.NtGlobalFlag
call fcn.140012c50
lea rdx, str.Checking_ProcessHeap.Flags
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x44
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140001cf0
xor r8d, r8d
lea ecx, [rbx + 6]
xor edx, edx
call fcn.140009210
mov rcx, qword gs:[0x60]
test al, al
mov rax, qword [rcx + 0x30]
je 0x140001d26
add rax, 0x70
jmp 0x140001d2a
add rax, 0x14
cmp dword [rax], 2
lea rdx, str.Checking_ProcessHeap.Flags
mov ecx, r12d
seta cl
call fcn.140012c50
lea rdx, str.Checking_ProcessHeap.ForceFlags
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x3f
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140001d60
xor r8d, r8d
lea ecx, [rbx + 6]
xor edx, edx
call fcn.140009210
mov rcx, qword gs:[0x60]
test al, al
mov rax, qword [rcx + 0x30]
je 0x140001d96
add rax, 0x74
jmp 0x140001d9a
add rax, 0x18
cmp dword [rax], 0
lea rdx, str.Checking_ProcessHeap.ForceFlags
mov ecx, r12d
seta cl
call fcn.140012c50
lea rdx, str.Checking_Low_Fragmentation_Heap
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x40
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140001dd0
mov rbx, r12
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea rcx, [rbp + 0x29c]
mov r8d, 0x110
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov r8b, 1
mov dword [rbp + 0x290], 0x11c
mov edx, 2
mov qword [rbp + 0x294], 6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 1
mov edx, r13d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 3
lea rcx, [rbp + 0x290]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x140001eb6
xor edx, edx
lea rcx, [rbp + 0x8c]
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memset
mov r8b, 1
mov dword [rbp + 0x80], 0x11c
mov edx, 2
mov dword [rbp + 0x84], 6
xor ecx, ecx
mov dword [rbp + 0x88], r13d
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 1
mov edx, r13d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 3
lea rcx, [rbp + 0x80]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x140001ebd
lea rbx, [rdi + 0x178]
xor edx, edx
lea rcx, [rbp + 0x8c]
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memset
mov r8b, 1
mov dword [rbp + 0x80], 0x11c
mov edx, 2
mov dword [rbp + 0x84], 6
xor ecx, ecx
mov dword [rbp + 0x88], 2
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
mov edx, r13d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 3
lea rcx, [rbp + 0x80]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x140001f2e
lea rbx, [rdi + 0x170]
test rbx, rbx
je 0x140001f3c
cmp qword [rbx], 0
mov ecx, r13d
je 0x140001f3f
mov ecx, r12d
lea rdx, str.Checking_Low_Fragmentation_Heap
call fcn.140012c50
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugPort
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x26
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140001f63
mov ecx, r12d
mov rdx, r12
mov rax, r15
nop
cmp dword [rax], 0x10
je 0x1400020e7
inc ecx
inc rdx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140001f80
mov rbx, r12
mov qword [rbp + 0x68], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
mov qword [rsp + 0x20], r12
mov rcx, rax
lea r8, [rbp + 0x68]
lea edx, [r9 - 1]
call rbx
test eax, eax
jne 0x140001fca
cmp qword [rbp + 0x68], 0
mov ecx, r13d
jne 0x140001fcd
mov ecx, r12d
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugPort
call fcn.140012c50
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugFlags
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x25
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140001ff1
mov ecx, r12d
mov rdx, r12
mov rax, r15
nop dword [rax]
cmp dword [rax], 0x10
je 0x140002104
inc ecx
inc rdx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140002010
mov rbx, r12
mov dword [rbp - 0x28], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
mov qword [rsp + 0x20], r12
mov rcx, rax
lea r8, [rbp - 0x28]
lea edx, [r9 + 0x1b]
call rbx
test eax, eax
jne 0x140002058
mov ecx, r13d
cmp dword [rbp - 0x28], eax
je 0x14000205b
mov ecx, r12d
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugFlags
call fcn.140012c50
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugObject
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x24
nop
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140002080
mov ecx, r12d
mov rdx, r12
mov rax, r15
nop dword [rax + rax]
cmp dword [rax], 0x10
je 0x140002121
inc ecx
inc rdx
add rax, 0x30
cmp ecx, 0x1f
jb 0x1400020a0
mov rbx, r12
mov qword [rbp - 0x70], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
mov qword [rsp + 0x20], r12
mov rcx, rax
lea r8, [rbp - 0x70]
lea edx, [r9 + 0x16]
call rbx
cmp eax, 0xc0000353
je 0x14000213a
mov ecx, r13d
jmp 0x14000218b
lea rax, [rdx + rdx*2]
add rax, rax
cmp byte [r15 + rax*8 + 0x24], 0
je 0x140001f97
mov rbx, qword [r15 + rax*8 + 0x28]
jmp 0x140001f9a
lea rax, [rdx + rdx*2]
add rax, rax
cmp byte [r15 + rax*8 + 0x24], 0
je 0x140002027
mov rbx, qword [r15 + rax*8 + 0x28]
jmp 0x14000202a
lea rax, [rdx + rdx*2]
add rax, rax
cmp byte [r15 + rax*8 + 0x24], 0
je 0x1400020b3
mov rbx, qword [r15 + rax*8 + 0x28]
jmp 0x1400020b6
cmp qword [rbp - 0x70], 0
je 0x140002146
mov ecx, r13d
jmp 0x14000218b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
lea r8, [rbp - 0x70]
mov rcx, rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x16]
call rbx
cmp eax, 0xc0000353
je 0x140002174
mov ecx, r13d
jmp 0x14000218b
mov rax, qword [rbp - 0x70]
test rax, rax
jne 0x140002182
mov ecx, r13d
jmp 0x14000218b
cmp eax, 8
mov ecx, r12d
setne cl
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugObject
call fcn.140012c50
lea rdx, str.Checking_WudfIsAnyDebuggerPresent_API
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x39
nop
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400021b0
mov ecx, r12d
mov rdx, r12
mov rax, r15
nop dword [rax + rax]
cmp dword [rax], 0x1c
je 0x1400027d1
inc ecx
inc rdx
add rax, 0x30
cmp ecx, 0x1f
jb 0x1400021d0
mov ecx, r12d
lea rdx, str.Checking_WudfIsAnyDebuggerPresent_API
call fcn.140012c50
lea rdx, str.Checking_WudfIsKernelDebuggerPresent_API
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x36
nop
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140002210
mov ecx, r12d
mov rdx, r12
mov rax, r15
nop dword [rax + rax]
cmp dword [rax], 0x1d
je 0x140002838
inc ecx
inc rdx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140002230
mov ecx, r12d
lea rdx, str.Checking_WudfIsKernelDebuggerPresent_API
call fcn.140012c50
lea rdx, str.Checking_WudfIsUserDebuggerPresent_API
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x38
nop
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140002270
mov ecx, r12d
mov rdx, r12
mov rax, r15
nop dword [rax + rax]
cmp dword [rax], 0x1e
je 0x14000289c
inc ecx
inc rdx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140002290
mov ecx, r12d
lea rdx, str.Checking_WudfIsUserDebuggerPresent_API
call fcn.140012c50
lea rdx, str.Checking_NtSetInformationThread_with_ThreadHideFromDebugger
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x23
nop
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400022d0
call fcn.140008ff0
lea rdx, str.Checking_NtSetInformationThread_with_ThreadHideFromDebugger
mov ecx, eax
call fcn.140012c50
lea rdx, str.Checking_CloseHandle_with_an_invalide_handle
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x32
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140002310
call fcn.140008d10
lea rdx, str.Checking_CloseHandle_with_an_invalide_handle
mov ecx, eax
call fcn.140012c50
lea rdx, str.Checking_NtSystemDebugControl
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x42
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140002350
mov ecx, r12d
mov rdx, r12
mov rax, r15
nop dword [rax + rax]
cmp dword [rax], 0xb
je 0x140002900
inc ecx
inc rdx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140002370
mov rax, r12
xor edx, edx
mov qword [rsp + 0x28], r12
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
lea ecx, [rdx + 0x14]
call rax
cmp eax, 0xc0000354
lea rdx, str.Checking_NtSystemDebugControl
mov ecx, r12d
setne cl
call fcn.140012c50
lea rdx, str.Checking_UnhandledExcepFilterTest
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x3d
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400023d0
lea rcx, [0x14000d8b0]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc000008e
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_RaiseException]
lea rax, [rdx + rdx*2]
add rax, rax
cmp byte [r15 + rax*8 + 0x24], 0
je 0x1400021e7
mov ecx, r12d
mov rdx, r12
mov rax, r15
nop dword [rax]
cmp dword [rax], 0x1c
je 0x140002815
inc ecx
inc rdx
add rax, 0x30
cmp ecx, 0x1f
jb 0x1400027f0
mov rax, r12
call rax
test eax, eax
mov ecx, r12d
setne cl
jmp 0x1400021ea
lea rax, [rdx + rdx*2]
add rax, rax
cmp byte [r15 + rax*8 + 0x24], 0
je 0x140002803
mov rax, qword [r15 + rax*8 + 0x28]
call rax
test eax, eax
mov ecx, r12d
setne cl
jmp 0x1400021ea
lea rax, [rdx + rdx*2]
add rax, rax
cmp byte [r15 + rax*8 + 0x24], 0
je 0x140002247
mov ecx, r12d
mov rdx, r12
mov rax, r15
cmp dword [rax], 0x1d
je 0x140002879
inc ecx
inc rdx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140002854
mov rax, r12
call rax
test eax, eax
mov ecx, r12d
setne cl
jmp 0x14000224a
lea rax, [rdx + rdx*2]
add rax, rax
cmp byte [r15 + rax*8 + 0x24], 0
je 0x140002867
mov rax, qword [r15 + rax*8 + 0x28]
call rax
test eax, eax
mov ecx, r12d
setne cl
jmp 0x14000224a
lea rax, [rdx + rdx*2]
add rax, rax
cmp byte [r15 + rax*8 + 0x24], 0
je 0x1400022a7
mov ecx, r12d
mov rdx, r12
mov rax, r15
cmp dword [rax], 0x1e
je 0x1400028dd
inc ecx
inc rdx
add rax, 0x30
cmp ecx, 0x1f
jb 0x1400028b8
mov rax, r12
call rax
test eax, eax
mov ecx, r12d
setne cl
jmp 0x1400022aa
lea rax, [rdx + rdx*2]
add rax, rax
cmp byte [r15 + rax*8 + 0x24], 0
je 0x1400028cb
mov rax, qword [r15 + rax*8 + 0x28]
call rax
test eax, eax
mov ecx, r12d
setne cl
jmp 0x1400022aa
lea rax, [rdx + rdx*2]
add rax, rax
cmp byte [r15 + rax*8 + 0x24], 0
je 0x140002387
mov rax, qword [r15 + rax*8 + 0x28]
jmp 0x14000238a
mov r13d, 1
cmp dword [0x14004002c], 0
je 0x140003855
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.DLL_Injection_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008b90
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__32_bit_
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x28
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140003460
mov ecx, r13d
call fcn.14000bf20
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__32_bit_
mov ecx, eax
call fcn.140012c50
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__64_bit_
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x28
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400034a0
lea ecx, [rbx + 2]
call fcn.14000bf20
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__64_bit_
mov ecx, eax
call fcn.140012c50
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__ALL_
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x2b
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400034e0
lea ecx, [rbx + 3]
call fcn.14000bf20
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__ALL_
mov ecx, eax
call fcn.140012c50
lea rdx, str.Enumerating_modules_with_ToolHelp32
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x3b
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140003520
xor sil, sil
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140003568
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_snapshot._Last_error:__u_n
call fcn.140008b20
jmp 0x140003601
xor edx, edx
lea rcx, [rbp + 0x4a4]
mov r8d, 0x434
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x4a0]
mov dword [rbp + 0x4a0], 0x438
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400035e4
nop word [rax + rax]
mov edx, 0xffffffff
lea rcx, [rbp + 0x6d0]
call fcn.14000bb80
movzx ebx, al
test al, al
je 0x1400035cb
lea rdx, [rbp + 0x6d0]
lea rcx, str._____Injected_library:__S_n
call fcn.140008b20
lea rdx, [rbp + 0x4a0]
mov rcx, rdi
or sil, bl
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400035a0
jmp 0x1400035f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_first_module._Last_error:__u_n
call fcn.140008b20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, r12d
lea rdx, str.Enumerating_modules_with_ToolHelp32
test sil, sil
setne cl
call fcn.140012c50
lea rdx, str.Enumerating_the_process_LDR_via_LdrEnumerateLoadedModules
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x25
nop
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140003630
mov ecx, r12d
mov rdx, r12
mov rax, r15
nop dword [rax + rax]
cmp dword [rax], 9
je 0x14000366b
inc ecx
inc rdx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140003650
mov ecx, r12d
jmp 0x140003742
lea rax, [rdx + rdx*2]
add rax, rax
cmp byte [r15 + rax*8 + 0x24], 0
jne 0x140003682
mov ecx, r12d
jmp 0x140003742
mov ecx, r12d
mov rdx, r12
mov rax, r15
nop dword [rax + rax]
cmp dword [rax], 9
je 0x1400036eb
inc ecx
inc rdx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140003690
mov rbx, r12
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.140015de8
mov r8, rax
lea rdx, [0x14000d080]
xor ecx, ecx
mov r14, rax
mov qword [rax], r12
mov qword [rax + 8], r12
mov qword [rax + 0x10], r12
call rbx
test eax, eax
je 0x140003701
mov edx, eax
lea rcx, str.LdrEnumerateLoadedModules_failed._Status:__x_n
call fcn.140008b20
mov rcx, r14
call fcn.14000d160
mov ecx, r12d
jmp 0x140003742
lea rax, [rdx + rdx*2]
add rax, rax
cmp byte [r15 + rax*8 + 0x24], 0
je 0x1400036a3
mov rbx, qword [r15 + rax*8 + 0x28]
jmp 0x1400036a6
mov rdi, qword [r14 + 8]
xor sil, sil
mov rbx, qword [r14]
cmp rbx, rdi
je 0x140003731
movups xmm2, xmmword [rbx + 0x40]
mov rcx, qword [rbx + 0x50]
pextrw edx, xmm2, 4
call fcn.14000bb80
or sil, al
add rbx, 0x88
cmp rbx, rdi
jne 0x140003710
mov rcx, r14
call fcn.14000d160
test sil, sil
mov ecx, r12d
setne cl
lea rdx, str.Enumerating_the_process_LDR_via_LdrEnumerateLoadedModules
call fcn.140012c50
lea rdx, str.Enumerating_the_process_LDR_directly
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x3a
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140003770
call fcn.14000c940
lea rdx, str.Enumerating_the_process_LDR_directly
mov ecx, eax
call fcn.140012c50
lea rdx, str.Walking_process_memory_with_GetModuleInformation
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x2e
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400037b0
call fcn.14000c1a0
lea rdx, str.Walking_process_memory_with_GetModuleInformation
mov ecx, eax
call fcn.140012c50
lea rdx, str.Walking_process_memory_for_hidden_modules
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x35
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400037f0
call fcn.14000c430
lea rdx, str.Walking_process_memory_for_hidden_modules
mov ecx, eax
call fcn.140012c50
lea rdx, str.Walking_process_memory_for_.NET_module_structures
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x2d
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140003830
call fcn.14000c700
lea rdx, str.Walking_process_memory_for_.NET_module_structures
mov ecx, eax
call fcn.140012c50
cmp dword [0x140040028], 0
je 0x140005155
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Generic_Sandboxe_VM_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008b90
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.avghookx.dll
mov esi, 0xc
mov qword [rbp + 0x290], rax
lea rdi, [rbp + 0x290]
lea rax, str.avghooka.dll
mov qword [rbp + 0x298], rax
lea rax, str.snxhk.dll
mov qword [rbp + 0x2a0], rax
lea rax, str.sbiedll.dll
mov qword [rbp + 0x2a8], rax
lea rax, str.dbghelp.dll
mov qword [rbp + 0x2b0], rax
lea rax, str.api_log.dll
mov qword [rbp + 0x2b8], rax
lea rax, str.dir_watch.dll
mov qword [rbp + 0x2c0], rax
lea rax, str.pstorec.dll
mov qword [rbp + 0x2c8], rax
lea rax, str.vmcheck.dll
mov qword [rbp + 0x2d0], rax
lea rax, str.wpespy.dll
mov qword [rbp + 0x2d8], rax
lea rax, str.cmdvrt64.dll
mov qword [rbp + 0x2e0], rax
lea rax, str.cmdvrt32.dll
mov qword [rbp + 0x2e8], rax
nop
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x82]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_if_process_loaded_modules_contains:__s
mov edx, 0x100
lea rcx, [rbp + 0x80]
call fcn.140008c50
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rbp + 0x80]
lea rcx, str.____s
test rax, rax
jne 0x140003a07
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400039d6
mov ebx, 0x5f
sub rbx, rax
je 0x140003a02
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400039f0
mov ecx, r12d
jmp 0x140003a49
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140003a20
mov ebx, 0x5f
sub rbx, rax
je 0x140003a46
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140003a34
mov ecx, r13d
lea rdx, [rbp + 0x80]
call fcn.140012c50
add rdi, 8
sub rsi, 1
jne 0x140003970
call fcn.14000db50
lea rax, str.CurrentUser
mov qword [rbp + 0x290], rax
lea rax, str.Sandbox
mov qword [rbp + 0x298], rax
lea rax, str.Emily
mov qword [rbp + 0x2a0], rax
lea rax, str.HAPUBWS
mov qword [rbp + 0x2a8], rax
lea rax, str.Hong_Lee
mov qword [rbp + 0x2b0], rax
lea rax, str.IT_ADMIN
mov qword [rbp + 0x2b8], rax
lea rax, str.Johnson
mov qword [rbp + 0x2c0], rax
lea rax, str.Miller
mov qword [rbp + 0x2c8], rax
lea rax, str.milozs
mov qword [rbp + 0x2d0], rax
lea rax, str.Peter_Wilson
mov qword [rbp + 0x2d8], rax
lea rax, str.timmy
mov qword [rbp + 0x2e0], rax
lea rax, str.user
mov qword [rbp + 0x2e8], rax
lea rax, str.sand_box
mov qword [rbp + 0x2f0], rax
lea rax, str.malware
mov qword [rbp + 0x2f8], rax
lea rax, str.maltest
mov qword [rbp + 0x300], rax
lea rax, str.test_user
mov qword [rbp + 0x308], rax
lea rax, str.virus
mov qword [rbp + 0x310], rax
lea rax, str.John_Doe
mov qword [rbp + 0x318], rax
call fcn.14000df30
mov r15, rax
test rax, rax
je 0x140003c37
lea rsi, [rbp + 0x290]
mov r14d, SafeArrayLock
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rsi]
lea r8, str.Checking_if_username_matches_:__s
mov edx, 0x100
lea rcx, [rbp + 0x80]
call fcn.140008c50
mov rcx, qword [rsi]
mov rdx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov edi, r12d
lea rdx, [rbp + 0x80]
test eax, eax
lea rcx, str.____s
cmove edi, r13d
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140003be1
mov ebx, 0x5f
sub rbx, rax
je 0x140003c12
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140003c00
lea rdx, [rbp + 0x80]
mov ecx, edi
call fcn.140012c50
add rsi, 8
sub r14, 1
jne 0x140003b90
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rax, str.SANDBOX
mov qword [rbp + 0x290], rax
lea rax, str.7SILVIA
mov qword [rbp + 0x298], rax
lea rax, str.HANSPETER_PC
mov qword [rbp + 0x2a0], rax
lea rax, str.JOHN_PC
mov qword [rbp + 0x2a8], rax
lea rax, str.MUELLER_PC
mov qword [rbp + 0x2b0], rax
lea rax, str.WIN7_TRAPS
mov qword [rbp + 0x2b8], rax
lea rax, str.FORTINET
mov qword [rbp + 0x2c0], rax
lea rax, str.TEQUILABOOMBOOM
mov qword [rbp + 0x2c8], rax
call fcn.14000dfb0
mov r12, rax
test rax, rax
je 0x140003da4
call fcn.14000e030
mov r15, rax
test rax, rax
jne 0x140003ccd
mov rcx, r12
jmp 0x140003d9e
lea rsi, [rbp + 0x290]
mov r14d, 8
nop word [rax + rax]
mov rbx, qword [rsi]
lea r8, str.Checking_if_hostname_matches_:__s
mov r9, rbx
lea rcx, [rbp + 0x80]
mov edx, 0x100
call fcn.140008c50
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140003d13
mov edi, r13d
jmp 0x140003d29
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor ecx, ecx
test eax, eax
mov edi, ecx
cmove edi, r13d
lea rdx, [rbp + 0x80]
lea rcx, str.____s
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140003d50
mov ebx, 0x5f
sub rbx, rax
je 0x140003d76
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140003d64
lea rdx, [rbp + 0x80]
mov ecx, edi
call fcn.140012c50
add rsi, 8
sub r14, 1
jne 0x140003ce0
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.14000e0e0
lea rdx, str.Checking_Number_of_processors_in_machine
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x36
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140003dc1
mov rax, qword gs:[0x60]
lea rdx, str.Checking_Number_of_processors_in_machine
xor r12d, r12d
mov ecx, r12d
cmp dword [rax + 0xb8], 2
setb cl
call fcn.140012c50
lea rdx, str.Checking_Interupt_Descriptor_Table_location
lea rcx, str.____s
call fcn.140008b90
lea ebx, [r12 + 0x33]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140003e10
mov eax, dword [rbp + 0x14]
lea rdx, str.Checking_Interupt_Descriptor_Table_location
and eax, 0xff000000
mov ecx, r12d
cmp eax, 0xff000000
sete cl
call fcn.140012c50
lea rdx, str.Checking_Local_Descriptor_Table_location
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x36
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140003e60
cmp dword [0x140021cdc], 0xdead0000
lea rdx, str.Checking_Local_Descriptor_Table_location
movzx eax, byte [0x140021ce0]
mov ecx, r12d
setne cl
mov byte [rbp - 0x6c], al
call fcn.140012c50
lea rdx, str.Checking_Global_Descriptor_Table_location
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x35
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140003eb0
mov eax, dword [rbp + 0x14]
lea rdx, str.Checking_Global_Descriptor_Table_location
and eax, 0xff000000
mov ecx, r12d
cmp eax, 0xff000000
sete cl
call fcn.140012c50
lea rdx, str.Checking_Store_Task_Register
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x42
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140003f00
lea rdx, str.Checking_Store_Task_Register
xor ecx, ecx
call fcn.140012c50
lea rdx, str.Checking_Number_of_cores_in_machine_using_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x31
nop dword [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140003f40
lea r8, [0x14001da10]
mov qword [rbp - 0x68], r12
lea rdx, [rbp + 0x68]
mov qword [rbp + 0x68], r12
lea rcx, [rbp - 0x68]
mov qword [rbp - 0x70], r12
mov r15d, r12d
call fcn.140015480
test eax, eax
je 0x1400040ce
lea rcx, [0x140021cc0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_Processor
mov rsi, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r14d, r13d
mov rdi, rax
test rsi, rsi
je 0x140004007
test rax, rax
je 0x140003ffe
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov r9d, 0x30
mov r8, rdi
mov qword [rsp + 0x20], r12
mov rdx, rsi
mov rbx, qword [rcx]
call qword [rbx + 0xa0]
test eax, eax
jns 0x140003ffe
lea rcx, str.ExecQuery
mov r14d, r12d
call fcn.140012d80
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rdi, rdi
je 0x140004015
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r14d, r14d
je 0x1400040ce
mov rcx, qword [rbp - 0x70]
mov qword [rbp - 0x60], r12
mov dword [rbp - 0x28], r12d
test rcx, rcx
je 0x1400040ae
nop
mov rax, qword [rcx]
lea rdx, [rbp - 0x28]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x60]
mov edx, 0xffffffff
mov r8d, r13d
call qword [rax + 0x20]
cmp dword [rbp - 0x28], r12d
je 0x1400040aa
mov rcx, qword [rbp - 0x60]
lea r9, [rbp - 0x20]
mov qword [rsp + 0x28], r12
lea rdx, str.NumberOfCores
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x140004090
cmp word [rbp - 0x20], 1
je 0x140004090
cmp dword [rbp - 0x18], 2
lea rcx, [rbp - 0x20]
cmovb r15d, r13d
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
test r15d, r15d
jne 0x1400040aa
mov rcx, qword [rbp - 0x70]
test rcx, rcx
jne 0x140004030
jmp 0x1400040ae
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.Checking_Number_of_cores_in_machine_using_WMI
mov ecx, r15d
call fcn.140012c50
lea rdx, str.Checking_hard_disk_size_using_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x3d
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004100
call fcn.14000e500
lea rdx, str.Checking_hard_disk_size_using_WMI
mov ecx, eax
call fcn.140012c50
lea rdx, str.Checking_hard_disk_size_using_DeviceIoControl
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x31
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004140
call fcn.14000e750
lea rdx, str.Checking_hard_disk_size_using_DeviceIoControl
mov ecx, eax
call fcn.140012c50
lea rdx, str.Checking_SetupDi_diskdrive
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x44
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004180
call fcn.14000ea80
lea rdx, str.Checking_SetupDi_diskdrive
mov ecx, eax
call fcn.140012c50
lea rdx, str.Checking_mouse_movement
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x47
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400041c0
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x60], r12
mov qword [rbp + 0x68], r12
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x68]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rbp + 0x68]
cmp dword [rbp - 0x60], eax
jne 0x14000420c
mov eax, dword [rbp + 0x6c]
mov ecx, r13d
cmp dword [rbp - 0x5c], eax
je 0x14000420f
mov ecx, r12d
lea rdx, str.Checking_mouse_movement
call fcn.140012c50
lea rdx, str.Checking_lack_of_user_input
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x43
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004233
mov ebx, r12d
mov dword [rbp + 0x28], 8
mov edi, r12d
mov ecx, 0xb
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x28]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x140004294
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rbp + 0x2c]
cmp eax, ecx
jb 0x140004294
sub eax, ecx
cmp eax, 0x64
jae 0x14000428a
inc ebx
cmp ebx, 0xa
jge 0x140004a18
inc edi
cmp edi, 0x80
jl 0x140004252
mov ecx, r13d
lea rdx, str.Checking_lack_of_user_input
call fcn.140012c50
lea rdx, str.Checking_memory_space_using_GlobalMemoryStatusEx
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x2e
nop dword [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400042c0
xorps xmm0, xmm0
lea rcx, [rbp + 0x290]
movups xmmword [rbp + 0x290], xmm0
mov dword [rbp + 0x290], 0x40
movups xmmword [rbp + 0x2a0], xmm0
movups xmmword [rbp + 0x2b0], xmm0
movups xmmword [rbp + 0x2c0], xmm0
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp qword [rbp + 0x298], 0x40000000
lea rdx, str.Checking_memory_space_using_GlobalMemoryStatusEx
mov ecx, r12d
setb cl
call fcn.140012c50
lea rdx, str.Checking_disk_size_using_GetDiskFreeSpaceEx
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x33
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004340
xor r9d, r9d
lea r8, [rbp + 0x50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x14000437a
movabs rax, 0x1400000000
mov ecx, r13d
cmp qword [rbp + 0x50], rax
jb 0x14000437d
mov ecx, r12d
lea rdx, str.Checking_disk_size_using_GetDiskFreeSpaceEx
call fcn.140012c50
lea rdx, str.Checking_if_CPU_hypervisor_field_is_set_using_cpuid_0x1_
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x27
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400043a1
movdqa xmm0, xmmword [0x140021e00]
xor ecx, ecx
movdqu xmmword [rbp + 0x68], xmm0
mov eax, r13d
cpuid
sar ecx, 0x1f
mov dword [rbp + 0x74], edx
and ecx, 1
lea rdx, str.Checking_if_CPU_hypervisor_field_is_set_using_cpuid_0x1_
mov dword [rbp + 0x68], eax
mov dword [rbp + 0x6c], ebx
call fcn.140012c50
lea rdx, str.Checking_hypervisor_vendor_using_cpuid_0x40000000_
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x2d
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004400
movdqa xmm0, xmmword [0x140021e00]
lea rax, str.KVMKVMKVM
mov qword [rbp - 0x20], rax
xor ecx, ecx
movdqu xmmword [rbp + 0x68], xmm0
lea rax, str.Microsoft_Hv
mov qword [rbp + 0x29c], r12
mov qword [rbp - 0x18], rax
mov r15, r12
lea rax, str.VMwareVMware
mov qword [rbp + 0x2a4], r12
mov qword [rbp - 0x10], rax
lea rax, str.XenVMMXenVMM
mov qword [rbp - 8], rax
lea rax, str.prl_hyperv
mov qword [rbp], rax
lea rax, str.VBoxVBoxVBox
mov qword [rbp + 8], rax
mov eax, 0x40000000
cpuid
mov dword [rbp + 0x6c], ebx
mov dword [rbp + 0x70], ecx
movsd xmm0, qword [rbp + 0x6c]
movsd qword [rbp + 0x290], xmm0
mov dword [rbp + 0x68], eax
mov qword [rbp + 0x2ac], r12
mov qword [rbp + 0x2b4], r12
mov qword [rbp + 0x2bc], r12
mov qword [rbp + 0x2c4], r12
mov dword [rbp + 0x2cc], r12d
mov dword [rbp + 0x298], edx
nop word [rax + rax]
mov dword [rsp + 0x28], r12d
lea r8, [rbp + 0x290]
mov r9d, 0xffffffff
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
lea ecx, [rax + 1]
movsxd rbx, ecx
add rbx, rbx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x140004554
mov rdi, rax
mov dword [rsp + 0x28], esi
xor eax, eax
mov qword [rsp + 0x20], r14
mov rcx, rbx
lea r8, [rbp + 0x290]
rep stosb byte [rdi], al
lea r9d, [rax - 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, qword [rbp + r15*8 - 0x20]
mov rcx, r14
sub rdx, r14
movzx ebx, word [rcx]
movzx eax, word [rcx + rdx]
sub ebx, eax
jne 0x140004543
add rcx, 2
test eax, eax
jne 0x140004530
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test ebx, ebx
je 0x140004a20
inc r15
cmp r15, 6
jl 0x1400044c0
mov ecx, r12d
lea rdx, str.Checking_hypervisor_vendor_using_cpuid_0x40000000_
call fcn.140012c50
lea rdx, str.Check_if_time_has_been_accelerated
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x3c
nop dword [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004590
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0xea60
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, r12d
lea rdx, str.Check_if_time_has_been_accelerated
sub eax, ebx
cmp eax, 0xe678
setbe cl
call fcn.140012c50
lea rdx, str.VM_Driver_Services
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x4b
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400045f0
call fcn.14000fe10
lea rdx, str.VM_Driver_Services
mov ecx, eax
call fcn.140012c50
lea rdx, str.Checking_SerialNumber_from_BIOS_using_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x35
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004630
call fcn.14000ec90
lea rdx, str.Checking_SerialNumber_from_BIOS_using_WMI
mov ecx, eax
call fcn.140012c50
lea rdx, str.Checking_Model_from_ComputerSystem_using_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x32
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004670
call fcn.14000ef00
lea rdx, str.Checking_Model_from_ComputerSystem_using_WMI
mov ecx, eax
call fcn.140012c50
lea rdx, str.Checking_Manufacturer_from_ComputerSystem_using_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x2b
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400046b0
call fcn.14000f150
lea rdx, str.Checking_Manufacturer_from_ComputerSystem_using_WMI
mov ecx, eax
call fcn.140012c50
lea rdx, str.Checking_Current_Temperature_using_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x38
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400046f0
call fcn.14000f3b0
lea rdx, str.Checking_Current_Temperature_using_WMI
mov ecx, eax
call fcn.140012c50
lea rdx, str.Checking_ProcessId_using_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x42
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004730
call fcn.14000f5b0
lea rdx, str.Checking_ProcessId_using_WMI
mov ecx, eax
call fcn.140012c50
lea rdx, str.Checking_power_capabilities
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x43
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004770
lea rcx, [rbp + 0x290]
mov ebx, r12d
call qword [sym.imp.POWRPROF.dll_GetPwrCapabilities]
cmp al, 1
jne 0x1400047ba
movzx eax, byte [rbp + 0x296]
or al, byte [rbp + 0x295]
or al, byte [rbp + 0x294]
or al, byte [rbp + 0x293]
jne 0x1400047ba
cmp byte [rbp + 0x29d], bl
sete bl
lea rdx, str.Checking_power_capabilities
mov ecx, ebx
call fcn.140012c50
lea rdx, str.Checking_CPU_fan_using_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x44
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400047e0
lea r8, [0x14001da10]
mov qword [rbp - 0x68], r12
lea rdx, [rbp + 0x68]
mov qword [rbp + 0x68], r12
lea rcx, [rbp - 0x68]
mov qword [rbp - 0x70], r12
mov r15d, ebx
call fcn.140015480
test eax, eax
je 0x140004930
lea rcx, [0x140021cc0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_Fan
mov rsi, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r14d, r13d
mov rdi, rax
test rsi, rsi
je 0x1400048a9
test rax, rax
je 0x1400048a0
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov r8, rdi
xor eax, eax
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rbx, qword [rcx]
lea r9d, [rax + 0x30]
call qword [rbx + 0xa0]
xor ebx, ebx
test eax, eax
jns 0x1400048a0
lea rcx, str.ExecQuery
mov r14d, ebx
call fcn.140012d80
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rdi, rdi
je 0x1400048b7
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r14d, r14d
je 0x140004930
mov rcx, qword [rbp - 0x70]
mov qword [rbp - 0x60], rbx
mov dword [rbp - 0x28], ebx
test rcx, rcx
je 0x140004907
nop dword [rax]
mov rax, qword [rcx]
lea rdx, [rbp - 0x28]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x60]
mov edx, 0xffffffff
mov r8d, r13d
call qword [rax + 0x20]
cmp dword [rbp - 0x28], r12d
je 0x140004907
mov rcx, qword [rbp - 0x60]
inc r15d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
jne 0x1400048d0
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
test r15d, r15d
jne 0x140004933
mov r12d, r13d
lea rdx, str.Checking_CPU_fan_using_WMI
mov ecx, r12d
call fcn.140012c50
lea rdx, str.Checking_NtQueryLicenseValue_with_Kernel_VMDetection_Private
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x22
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004960
xor r12d, r12d
lea r15, [0x14003f180]
mov ecx, r12d
mov edx, r12d
mov rax, r15
cmp dword [rax], 0x1b
je 0x140004a28
inc ecx
inc rdx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140004985
mov rdi, r12
mov ecx, r12d
mov rdx, r12
mov rax, r15
nop dword [rax + rax]
cmp dword [rax], 0x11
je 0x140004a44
inc ecx
inc rdx
add rax, 0x30
cmp ecx, 0x1f
jb 0x1400049b0
mov rbx, r12
test rdi, rdi
je 0x140004a60
test rbx, rbx
je 0x140004a60
lea rdx, str.Kernel_VMDetection_Private
lea rcx, [rbp - 0x40]
call rdi
lea rax, [rbp + 0x60]
mov dword [rbp + 0x10], r12d
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x10]
xor edx, edx
lea rcx, [rbp - 0x40]
call rbx
mov ecx, r12d
test eax, eax
js 0x140004a63
cmp dword [rbp + 0x10], r12d
setne cl
jmp 0x140004a63
mov ecx, r12d
jmp 0x140004297
mov ecx, r13d
jmp 0x140004564
lea rax, [rdx + rdx*2]
add rax, rax
cmp byte [r15 + rax*8 + 0x24], r12b
je 0x14000499c
mov rdi, qword [r15 + rax*8 + 0x28]
jmp 0x14000499f
lea rax, [rdx + rdx*2]
add rax, rax
cmp byte [r15 + rax*8 + 0x24], r12b
je 0x1400049c7
mov rbx, qword [r15 + rax*8 + 0x28]
jmp 0x1400049ca
mov ecx, r12d
lea rdx, str.Checking_NtQueryLicenseValue_with_Kernel_VMDetection_Private
call fcn.140012c50
lea rdx, str.Checking_Win32_CacheMemory_with_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x3b
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004a90
lea rcx, str.SELECT__FROM_Win32_CacheMemory
call fcn.14000f7c0
test eax, eax
lea rdx, str.Checking_Win32_CacheMemory_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c50
lea rdx, str.Checking_Win32_PhysicalMemory_with_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x38
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004ae0
lea rcx, str.SELECT__FROM_Win32_PhysicalMemory
call fcn.14000f7c0
test eax, eax
lea rdx, str.Checking_Win32_PhysicalMemory_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c50
lea rdx, str.Checking_Win32_MemoryDevice_with_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x3a
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004b30
lea rcx, str.SELECT__FROM_Win32_MemoryDevice
call fcn.14000f7c0
test eax, eax
lea rdx, str.Checking_Win32_MemoryDevice_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c50
lea rdx, str.Checking_Win32_MemoryArray_with_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x3b
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004b80
lea rcx, str.SELECT__FROM_Win32_MemoryArray
call fcn.14000f7c0
test eax, eax
lea rdx, str.Checking_Win32_MemoryArray_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c50
lea rdx, str.Checking_Win32_VoltageProbe_with_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x3a
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004bd0
lea rcx, str.SELECT__FROM_Win32_VoltageProbe
call fcn.14000f7c0
test eax, eax
lea rdx, str.Checking_Win32_VoltageProbe_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c50
lea rdx, str.Checking_Win32_PortConnector_with_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x39
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004c20
lea rcx, str.SELECT__FROM_Win32_PortConnector
call fcn.14000f7c0
test eax, eax
lea rdx, str.Checking_Win32_PortConnector_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c50
lea rdx, str.Checking_Win32_SMBIOSMemory_with_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x3a
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004c70
lea rcx, str.SELECT__FROM_Win32_SMBIOSMemory
call fcn.14000f7c0
test eax, eax
lea rdx, str.Checking_Win32_SMBIOSMemory_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c50
lea rdx, str.Checking_ThermalZoneInfo_performance_counters_with_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x28
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004cc0
lea rcx, str.SELECT__FROM_Win32_PerfFormattedData_Counters_ThermalZoneInformation
call fcn.14000f7c0
test eax, eax
lea rdx, str.Checking_ThermalZoneInfo_performance_counters_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c50
lea rdx, str.Checking_CIM_Memory_with_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x42
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004d10
lea rcx, str.SELECT__FROM_CIM_Memory
call fcn.14000f7c0
test eax, eax
lea rdx, str.Checking_CIM_Memory_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c50
lea rdx, str.Checking_CIM_Sensor_with_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x42
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004d60
lea rcx, str.SELECT__FROM_CIM_Sensor
call fcn.14000f7c0
test eax, eax
lea rdx, str.Checking_CIM_Sensor_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c50
lea rdx, str.Checking_CIM_NumericSensor_with_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x3b
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004db0
lea rcx, str.SELECT__FROM_CIM_NumericSensor
call fcn.14000f7c0
test eax, eax
lea rdx, str.Checking_CIM_NumericSensor_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c50
lea rdx, str.Checking_CIM_TemperatureSensor_with_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x37
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004e00
lea rcx, str.SELECT__FROM_CIM_TemperatureSensor
call fcn.14000f7c0
test eax, eax
lea rdx, str.Checking_CIM_TemperatureSensor_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c50
lea rdx, str.Checking_CIM_VoltageSensor_with_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x3b
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004e50
lea rcx, str.SELECT__FROM_CIM_VoltageSensor
call fcn.14000f7c0
test eax, eax
lea rdx, str.Checking_CIM_VoltageSensor_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c50
lea rdx, str.Checking_CIM_PhysicalConnector_with_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x37
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004ea0
lea rcx, str.SELECT__FROM_CIM_PhysicalConnector
call fcn.14000f7c0
test eax, eax
lea rdx, str.Checking_CIM_PhysicalConnector_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c50
lea rdx, str.Checking_CIM_Slot_with_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x44
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004ef0
lea rcx, str.SELECT__FROM_CIM_Slot
call fcn.14000f7c0
test eax, eax
lea rdx, str.Checking_CIM_Slot_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c50
lea rdx, str.Checking_if_Windows_is_Genuine
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x40
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004f40
xor r8d, r8d
mov dword [rbp + 0x18], 0x55c92734
lea rdx, [rbp + 0x30]
mov dword [rbp + 0x1c], 0x4d71d682
lea rcx, [rbp + 0x18]
mov dword [rbp + 0x20], 0xecd63e98
mov dword [rbp + 0x24], 0x9f05163f
call qword [sym.imp.SLWGA.dll_SLIsGenuineLocal]
test eax, eax
jne 0x140004f8c
mov ecx, r13d
cmp dword [rbp + 0x30], r12d
jne 0x140004f8f
mov ecx, r12d
lea rdx, str.Checking_if_Windows_is_Genuine
call fcn.140012c50
lea rdx, str.Checking_ServicesDiskEnum_entries_for_VM_strings
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x2c
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140004fb3
lea rax, str.qemu
mov qword [rbp - 0x68], r12
mov qword [rbp + 0x290], rax
lea rdx, str.SystemCurrentControlSetServicesDiskEnum
lea rax, str.virtio
mov dword [rbp - 0x28], r12d
mov qword [rbp + 0x298], rax
mov r9d, 0x20019
lea rax, str.vmware
mov dword [rbp - 0x70], 4
mov qword [rbp + 0x2a0], rax
xor r8d, r8d
lea rax, str.vbox
mov rcx, 0xffffffff80000002
mov qword [rbp + 0x2a8], rax
mov r14d, r12d
lea rax, [0x14001e398]
mov qword [rbp + 0x2b0], rax
lea rax, [0x14001e3a0]
mov qword [rbp + 0x2b8], rax
lea rax, str.Virtual
mov qword [rbp + 0x2c0], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400050a2
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rdx, str.Count
lea rax, [rbp - 0x28]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x68]
test eax, eax
je 0x14000509c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140005100
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, r12d
cmp dword [rbp - 0x28], r12d
jbe 0x140005100
nop dword [rax + rax]
mov r9d, esi
lea r8, [0x14001e3b4]
mov edx, 0xb
lea rcx, [rbp + 0x68]
call fcn.140008c50
mov edi, r12d
lea rbx, [rbp + 0x290]
mov r9, qword [rbx]
lea r8, [rbp + 0x68]
lea rdx, str.SystemCurrentControlSetServicesDiskEnum
call fcn.140013350
test eax, eax
jne 0x1400050fd
inc edi
add rbx, 8
cmp edi, 7
jb 0x1400050d2
inc esi
cmp esi, dword [rbp - 0x28]
jae 0x140005100
jmp 0x1400050b0
mov r14d, r13d
lea rdx, str.Checking_ServicesDiskEnum_entries_for_VM_strings
mov ecx, r14d
call fcn.140012c50
lea rdx, str.Checking_EnumIDE_and_EnumSCSI_entries_for_VM_strings
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x28
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140005130
call fcn.14000f980
lea rdx, str.Checking_EnumIDE_and_EnumSCSI_entries_for_VM_strings
mov ecx, eax
call fcn.140012c50
cmp dword [0x140040024], 0
je 0x140005ee5
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.VirtualBox_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008b90
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, [0x14001eb40]
mov r14d, 4
mov qword [rbp + 0x290], rax
lea rcx, str.SystemBiosVersion
lea rax, str.Identifier
mov qword [rbp + 0x2b0], rcx
mov qword [rbp + 0x298], rax
lea rcx, str.VideoBiosVersion
lea rax, str.HARDWAREDescriptionSystem
mov qword [rbp + 0x2c8], rcx
mov qword [rbp + 0x2a8], rax
lea rdx, str.VBOX
mov qword [rbp + 0x2c0], rax
lea rcx, str.VIRTUALBOX
mov qword [rbp + 0x2d8], rax
lea rsi, [rbp + 0x298]
lea rax, str.SystemBiosDate
mov qword [rbp + 0x2a0], rdx
mov qword [rbp + 0x2e0], rax
lea rax, str.06_23_99
mov qword [rbp + 0x2e8], rax
mov qword [rbp + 0x2b8], rdx
mov qword [rbp + 0x2d0], rcx
nop dword [rax + rax]
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x82]
call sub.VCRUNTIME140.dll_memset
mov rbx, qword [rsi + 8]
lea r8, str.Checking_reg_key_HARDWAREDescriptionSystem____s_is_set_to__s
mov r9, qword [rsi]
lea rcx, [rbp + 0x80]
mov edx, 0x100
mov qword [rsp + 0x20], rbx
call fcn.140008c50
mov r8, qword [rsi]
mov r9, rbx
mov rdx, qword [rsi - 8]
call fcn.140013350
lea rdx, [rbp + 0x80]
lea rcx, str.____s
test eax, eax
je 0x140005307
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400052d4
mov ebx, 0x5f
sub rbx, rax
je 0x140005302
nop dword [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400052f0
mov ecx, r13d
jmp 0x140005348
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005320
mov ebx, 0x5f
sub rbx, rax
je 0x140005346
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140005334
xor ecx, ecx
lea rdx, [rbp + 0x80]
call fcn.140012c50
add rsi, 0x18
sub r14, 1
jne 0x140005260
lea rdx, str.Checking_VirtualBox_Guest_Additions_directory
lea rcx, str.____s
call fcn.140008b90
lea ebx, [r14 + 0x31]
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140005380
xor edx, edx
mov word [rbp + 0x290], r12w
mov r8d, 0x206
lea rcx, [rbp + 0x292]
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [str.oracle_virtualbox_guest_additions_]
lea rcx, [rbp + 0xc6]
movaps xmm1, xmmword [0x14001f670]
xor edx, edx
mov eax, dword [0x14001f6a0]
mov r8d, 0x1c2
movaps xmmword [rbp + 0x80], xmm0
movaps xmm0, xmmword [0x14001f680]
movaps xmmword [rbp + 0x90], xmm1
movaps xmm1, xmmword [0x14001f690]
mov dword [rbp + 0xc0], eax
movzx eax, word [0x14001f6a4]
movaps xmmword [rbp + 0xa0], xmm0
movaps xmmword [rbp + 0xb0], xmm1
mov word [rbp + 0xc4], ax
call sub.VCRUNTIME140.dll_memset
call fcn.140013290
lea rdx, [rbp + 0x4a0]
test eax, eax
je 0x140005439
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140005448
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0x290]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000547c
mov ecx, r13d
test al, 0x10
jne 0x14000547f
mov ecx, r12d
lea rdx, str.Checking_VirtualBox_Guest_Additions_directory
call fcn.140012c50
call fcn.1400100b0
lea rax, str.HARDWAREACPIDSDTVBOX__
mov esi, 9
mov qword [rbp + 0x290], rax
lea rdi, [rbp + 0x290]
lea rax, str.HARDWAREACPIFADTVBOX__
mov qword [rbp + 0x298], rax
lea rax, str.HARDWAREACPIRSDTVBOX__
mov qword [rbp + 0x2a0], rax
lea rax, str.SOFTWAREOracleVirtualBox_Guest_Additions
mov qword [rbp + 0x2a8], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxGuest
mov qword [rbp + 0x2b0], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxMouse
mov qword [rbp + 0x2b8], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxService
mov qword [rbp + 0x2c0], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxSF
mov qword [rbp + 0x2c8], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxVideo
mov qword [rbp + 0x2d0], rax
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x82]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, [0x14001e7c0]
mov edx, 0x100
lea rcx, [rbp + 0x80]
call fcn.140008c50
xor edx, edx
mov qword [rbp + 0x68], r12
mov r8d, 0x800
lea rcx, [rbp + 0x4a0]
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rdi]
lea rax, [rbp + 0x68]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400055eb
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x80]
lea rcx, str.____s
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400055c0
mov ebx, 0x5f
sub rbx, rax
je 0x1400055e6
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400055d4
mov ecx, r13d
jmp 0x140005638
lea rdx, [rbp + 0x80]
lea rcx, str.____s
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005610
mov ebx, 0x5f
sub rbx, rax
je 0x140005636
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140005624
xor ecx, ecx
lea rdx, [rbp + 0x80]
call fcn.140012c50
add rdi, 8
sub rsi, 1
jne 0x140005520
lea rdx, str.Checking_Mac_Address_start_with_08:00:27
lea rcx, str.____s
call fcn.140008b90
lea ebx, [rsi + 0x36]
nop dword [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140005670
lea rcx, [0x14001f6a8]
call fcn.140013440
lea rdx, str.Checking_Mac_Address_start_with_08:00:27
mov ecx, eax
call fcn.140012c50
lea rdx, str.Checking_MAC_address__Hybrid_Analysis_
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x38
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400056b4
lea rcx, [0x14001da08]
call fcn.140013440
lea rdx, str.Checking_MAC_address__Hybrid_Analysis_
mov ecx, eax
call fcn.140012c50
lea rax, [0x14001f6b0]
mov qword [rbp - 0x20], rax
lea rsi, [rbp - 0x20]
lea rax, str..VBoxGuest
mov qword [rbp - 0x18], rax
lea r14d, [rbx + 5]
lea rax, str..pipeVBoxMiniRdDN
mov qword [rbp - 0x10], rax
lea rax, str..VBoxTrayIPC
mov qword [rbp - 8], rax
lea rax, str..pipeVBoxTrayIPC
mov qword [rbp], rax
nop
mov rcx, qword [rsi]
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov r8d, r13d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x82]
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rsi]
lea r8, str.Checking_device__s
mov edx, 0x100
lea rcx, [rbp + 0x80]
call fcn.140008c50
cmp rdi, 0xffffffffffffffff
je 0x1400057e7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x80]
lea rcx, str.____s
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400057b3
mov ebx, 0x5f
sub rbx, rax
je 0x1400057e2
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400057d0
mov ecx, r13d
jmp 0x140005838
lea rdx, [rbp + 0x80]
lea rcx, str.____s
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005810
mov ebx, 0x5f
sub rbx, rax
je 0x140005836
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140005824
xor ecx, ecx
lea rdx, [rbp + 0x80]
call fcn.140012c50
add rsi, 8
sub r14, 1
jne 0x140005720
lea rdx, str.Checking_VBoxTrayToolWndClass___VBoxTrayToolWnd
lea rcx, str.____s
call fcn.140008b90
lea ebx, [r14 + 0x2f]
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140005870
xor edx, edx
lea rcx, str.VBoxTrayToolWndClass
call qword [sym.imp.USER32.dll_FindWindowW]
lea rdx, str.VBoxTrayToolWnd
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowW]
test rbx, rbx
jne 0x1400058b0
mov ecx, r12d
test rax, rax
je 0x1400058b3
mov ecx, r13d
lea rdx, str.Checking_VBoxTrayToolWndClass___VBoxTrayToolWnd
call fcn.140012c50
lea rdx, str.Checking_VirtualBox_Shared_Folders_network_provider
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x2b
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400058e0
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x206
lea rcx, [rbp + 0x82]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp - 0x70]
mov dword [rbp - 0x70], 0x104
lea rdx, [rbp + 0x80]
mov ecx, 0x250000
call qword [sym.imp.MPR.dll_WNetGetProviderNameW]
test eax, eax
jne 0x14000594d
lea rdx, str.VirtualBox_Shared_Folders
lea rcx, [rbp + 0x80]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
mov ecx, r12d
sete cl
jmp 0x140005950
mov ecx, r12d
lea rdx, str.Checking_VirtualBox_Shared_Folders_network_provider
call fcn.140012c50
lea rax, str.vboxservice.exe
mov esi, 2
mov qword [rsp + 0x40], rax
lea rdi, [rsp + 0x40]
lea rax, str.vboxtray.exe
mov qword [rsp + 0x48], rax
nop
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x82]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_VirtualBox_process__s
mov edx, 0x100
lea rcx, [rbp + 0x80]
call fcn.140008c50
mov rcx, qword [rdi]
call fcn.140015370
lea rdx, [rbp + 0x80]
lea rcx, str.____s
test eax, eax
je 0x140005a17
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400059e4
mov ebx, 0x5f
sub rbx, rax
je 0x140005a12
nop dword [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140005a00
mov ecx, r13d
jmp 0x140005a58
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005a30
mov ebx, 0x5f
sub rbx, rax
je 0x140005a56
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140005a44
xor ecx, ecx
lea rdx, [rbp + 0x80]
call fcn.140012c50
add rdi, 8
sub rsi, 1
jne 0x140005980
lea rdx, str.Checking_Win32_PnPDevice_DeviceId_from_WMI_for_VBox_PCI_device
lea rcx, str.____s
call fcn.140008b90
lea ebx, [rsi + 0x20]
nop dword [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140005a90
lea r8, [0x14001da10]
mov qword [rbp - 0x68], r12
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x60], r12
lea rcx, [rbp - 0x68]
mov qword [rbp - 0x70], r12
mov r15d, r12d
call fcn.140015480
test eax, eax
je 0x140005c40
lea rcx, [0x140021cc0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_PnPEntity
mov rsi, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r14d, r13d
mov rdi, rax
test rsi, rsi
je 0x140005b57
test rax, rax
je 0x140005b4e
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov r9d, 0x30
mov r8, rdi
mov qword [rsp + 0x20], r12
mov rdx, rsi
mov rbx, qword [rcx]
call qword [rbx + 0xa0]
test eax, eax
jns 0x140005b4e
lea rcx, str.ExecQuery
mov r14d, r12d
call fcn.140012d80
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rdi, rdi
je 0x140005b65
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r14d, r14d
je 0x140005c40
mov rcx, qword [rbp - 0x70]
mov qword [rbp + 0x68], r12
mov dword [rbp - 0x28], r12d
test rcx, rcx
je 0x140005c1c
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp - 0x28]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x68]
mov edx, 0xffffffff
mov r8d, r13d
call qword [rax + 0x20]
cmp dword [rbp - 0x28], 0
je 0x140005c1c
mov rcx, qword [rbp + 0x68]
lea r9, [rbp - 0x20]
mov qword [rsp + 0x28], r12
lea rdx, str.DeviceId
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x140005c00
cmp word [rbp - 0x20], 8
jne 0x140005bf6
mov rcx, qword [rbp - 0x18]
lea rdx, str.PCIVEN_80EEDEV_CAFE
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
cmovne r15d, r13d
lea rcx, [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
test r15d, r15d
jne 0x140005c1c
mov rcx, qword [rbp - 0x70]
test rcx, rcx
jne 0x140005b90
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.Checking_Win32_PnPDevice_DeviceId_from_WMI_for_VBox_PCI_device
mov ecx, r15d
call fcn.140012c50
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBox_controller_hardware
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x1b
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140005c70
call fcn.140010a20
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBox_controller_hardware
mov ecx, eax
call fcn.140012c50
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBOX_names
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x29
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140005cb0
call fcn.140011180
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBOX_names
mov ecx, eax
call fcn.140012c50
lea rdx, str.Checking_Win32_Bus_from_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x43
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140005cf0
call fcn.140010c80
lea rdx, str.Checking_Win32_Bus_from_WMI
mov ecx, eax
call fcn.140012c50
lea rdx, str.Checking_Win32_BaseBoard_from_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x3d
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140005d30
call fcn.140010ee0
lea rdx, str.Checking_Win32_BaseBoard_from_WMI
mov ecx, eax
call fcn.140012c50
lea rdx, str.Checking_MAC_address_from_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x41
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140005d70
call fcn.140010360
lea rdx, str.Checking_MAC_address_from_WMI
mov ecx, eax
call fcn.140012c50
lea rdx, str.Checking_NTEventLog_from_WMI
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x42
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140005db0
call fcn.140010580
lea rdx, str.Checking_NTEventLog_from_WMI
mov ecx, eax
call fcn.140012c50
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x45
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140005df0
lea r8, [rbp - 0x28]
mov dword [rbp - 0x28], r12d
xor edx, edx
mov ecx, 0x52534d42
mov esi, r12d
call fcn.140015750
mov rdi, rax
test rax, rax
je 0x140005e96
mov ebx, dword [rbp - 0x28]
mov rcx, r12
lea rdx, [rbx - 0xa]
test rdx, rdx
je 0x140005e57
movabs rax, 0x426c617574726956
nop word [rax + rax]
cmp qword [rcx + rdi], rax
jne 0x140005e4f
cmp word [rcx + rdi + 8], 0x786f
je 0x140005e8a
inc rcx
cmp rcx, rdx
jb 0x140005e40
lea rcx, [rbx - 4]
mov rax, r12
test rcx, rcx
je 0x140005e8d
cmp dword [rax + rdi], 0x786f6276
je 0x140005e8a
inc rax
cmp rax, rcx
jb 0x140005e63
mov rax, r12
cmp dword [rax + rdi], 0x584f4256
je 0x140005e8a
inc rax
cmp rax, rcx
jb 0x140005e77
jmp 0x140005e8d
mov esi, r13d
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_SMBIOS_firmware
mov ecx, esi
call fcn.140012c50
lea rdx, str.Checking_ACPI_tables
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x49
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140005ec0
call fcn.1400108b0
lea rdx, str.Checking_ACPI_tables
mov ecx, eax
call fcn.140012c50
cmp dword [0x140040020], 0
je 0x1400068c5
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.VMWare_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008b90
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea r15, str.Identifier
mov esi, 5
lea rcx, str.HARDWAREDEVICEMAPScsiScsi_Port_1Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp + 0x298], r15
mov qword [rbp + 0x2a8], rcx
lea rax, [0x14001eb40]
lea rcx, str.HARDWAREDEVICEMAPScsiScsi_Port_2Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp + 0x290], rax
lea rax, str.VMWARE
mov qword [rbp + 0x2c0], rcx
lea rcx, str.SYSTEMControlSet001ControlSystemInformation
mov qword [rbp + 0x2a0], rax
mov qword [rbp + 0x2d8], rcx
lea rdx, str.SystemManufacturer
mov qword [rbp + 0x2f0], rcx
lea rdi, [rbp + 0x2a0]
lea rcx, str.SystemProductName
mov qword [rbp + 0x2b0], r15
mov qword [rbp + 0x2f8], rcx
mov qword [rbp + 0x2b8], rax
mov qword [rbp + 0x2c8], r15
mov qword [rbp + 0x2d0], rax
mov qword [rbp + 0x2e0], rdx
mov qword [rbp + 0x2e8], rax
mov qword [rbp + 0x300], rax
nop dword [rax + rax]
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x82]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi - 0x10]
lea r8, str.Checking_reg_key__s
mov edx, 0x100
lea rcx, [rbp + 0x80]
call fcn.140008c50
mov r9, qword [rdi]
mov r8, qword [rdi - 8]
mov rdx, qword [rdi - 0x10]
call fcn.140013350
lea rdx, [rbp + 0x80]
lea rcx, str.____s
test eax, eax
je 0x14000609b
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006070
mov ebx, 0x5f
sub rbx, rax
je 0x140006096
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140006084
mov ecx, r13d
jmp 0x1400060d8
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400060b0
mov ebx, 0x5f
sub rbx, rax
je 0x1400060d6
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400060c4
xor ecx, ecx
lea rdx, [rbp + 0x80]
call fcn.140012c50
add rdi, 0x18
sub rsi, 1
jne 0x140006000
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x82]
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREVMware__Inc.VMware_Tools
mov edx, 0x100
lea r8, [0x14001e7c0]
lea rcx, [rbp + 0x80]
call fcn.140008c50
xor edx, edx
mov qword [rbp + 0x68], r12
mov r8d, 0x800
lea rcx, [rbp + 0x4a0]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x68]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREVMware__Inc.VMware_Tools
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400061cb
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x80]
lea rcx, str.____s
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400061a0
mov ebx, 0x5f
sub rbx, rax
je 0x1400061c6
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400061b4
mov ecx, r13d
jmp 0x140006218
lea rdx, [rbp + 0x80]
lea rcx, str.____s
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400061f0
mov ebx, 0x5f
sub rbx, rax
je 0x140006216
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140006204
xor ecx, ecx
lea rdx, [rbp + 0x80]
call fcn.140012c50
call fcn.140011450
lea rax, [0x1400202d8]
mov esi, 4
mov qword [rbp + 0x290], rax
lea rdi, [rbp + 0x290]
lea rax, [0x1400202e0]
mov qword [rbp + 0x298], rax
lea rax, [0x1400202f8]
mov qword [rbp + 0x2a0], rax
lea rax, [0x140020300]
mov qword [rbp + 0x2a8], rax
lea rax, [0x140020318]
mov qword [rbp + 0x2b0], rax
lea rax, str.00:1C:14
mov qword [rbp + 0x2b8], rax
lea rax, [0x140020338]
mov qword [rbp + 0x2c0], rax
lea rax, [0x140020340]
mov qword [rbp + 0x2c8], rax
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x82]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi + 8]
lea r8, str.Checking_MAC_starting_with__s
mov edx, 0x100
lea rcx, [rbp + 0x80]
call fcn.140008c50
mov rcx, qword [rdi]
call fcn.140013440
lea rdx, [rbp + 0x80]
lea rcx, str.____s
test eax, eax
je 0x140006347
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006315
mov ebx, 0x5f
sub rbx, rax
je 0x140006342
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140006330
mov ecx, r13d
jmp 0x140006388
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006360
mov ebx, 0x5f
sub rbx, rax
je 0x140006386
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140006374
xor ecx, ecx
lea rdx, [rbp + 0x80]
call fcn.140012c50
add rdi, 0x10
sub rsi, 1
jne 0x1400062b0
lea rdx, str.Checking_VMWare_network_adapter_name
lea rcx, str.____s
call fcn.140008b90
lea ebx, [rsi + 0x3a]
nop dword [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400063c0
mov dword [rbp - 0x28], 0x2c0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x2c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x14000640c
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo._n
call fcn.140008b90
mov ecx, r13d
jmp 0x1400064d5
lea rdx, [rbp - 0x28]
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x14000646f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x140006462
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.140008b20
mov ecx, r13d
jmp 0x1400064d5
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1400064be
mov rdi, rsi
nop word [rax + rax]
lea rcx, [rdi + 0x110]
call fcn.140012e80
mov rbx, rax
test rax, rax
je 0x1400064b6
lea rdx, str.VMWare
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov rcx, rbx
test rax, rax
jne 0x1400065db
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140006480
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, r12d
lea rdx, str.Checking_VMWare_network_adapter_name
call fcn.140012c50
lea rax, str..HGFS
mov r14d, 2
mov qword [rsp + 0x50], rax
lea rsi, [rsp + 0x50]
lea rax, str.._vmci
mov qword [rsp + 0x58], rax
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsi]
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov r8d, r13d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x82]
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rsi]
lea r8, str.Checking_device__s
mov edx, 0x100
lea rcx, [rbp + 0x80]
call fcn.140008c50
cmp rdi, 0xffffffffffffffff
je 0x1400065fd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x80]
lea rcx, str.____s
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400065b0
mov ebx, 0x5f
sub rbx, rax
je 0x1400065d6
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400065c4
mov ecx, r13d
jmp 0x140006648
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, r13d
jmp 0x1400064d5
lea rdx, [rbp + 0x80]
lea rcx, str.____s
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006620
mov ebx, 0x5f
sub rbx, rax
je 0x140006646
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140006634
xor ecx, ecx
lea rdx, [rbp + 0x80]
call fcn.140012c50
add rsi, 8
sub r14, 1
jne 0x140006510
lea rdx, str.Checking_VMWare_directory
lea rcx, str.____s
call fcn.140008b90
lea ebx, [r14 + 0x45]
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140006680
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x206
lea rcx, [rbp + 0x82]
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.VMWare_]
xor edx, edx
lea rcx, [rbp + 0x4b0]
mov r8d, 0x1f8
movaps xmmword [rbp + 0x4a0], xmm0
call sub.VCRUNTIME140.dll_memset
call fcn.140013290
lea rdx, [rbp + 0x290]
test eax, eax
je 0x1400066f5
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140006704
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x4a0]
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140006738
mov ecx, r13d
test al, 0x10
jne 0x14000673b
mov ecx, r12d
lea rdx, str.Checking_VMWare_directory
call fcn.140012c50
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x45
nop
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140006760
lea r8, [rbp - 0x28]
mov dword [rbp - 0x28], r12d
xor edx, edx
mov ecx, 0x52534d42
mov ebx, r12d
call fcn.140015750
test rax, rax
je 0x1400067c8
mov edx, dword [rbp - 0x28]
mov rcx, r12
sub rdx, 6
je 0x1400067bf
nop word [rax + rax]
cmp dword [rcx + rax], 0x61774d56
jne 0x1400067b2
cmp word [rcx + rax + 4], 0x6572
je 0x1400067bc
inc rcx
cmp rcx, rdx
jae 0x1400067bf
jmp 0x1400067a0
mov ebx, r13d
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_SMBIOS_firmware
mov ecx, ebx
call fcn.140012c50
lea rdx, str.Checking_ACPI_tables
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x49
nop
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400067f0
mov ecx, 0x1000
mov esi, r12d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x1400068b5
mov rdi, rax
mov ecx, 0x1000
xor eax, eax
mov rdx, r14
rep stosb byte [rdi], al
call fcn.1400156c0
mov ecx, eax
cmp eax, 0xffffffff
je 0x1400068b5
shr eax, 2
cmp ecx, 4
jb 0x1400068a9
test eax, eax
je 0x1400068a9
mov rbx, r14
mov edi, eax
nop dword [rax]
mov edx, dword [rbx]
lea r8, [rbp - 0x28]
mov ecx, 0x41435049
mov dword [rbp - 0x28], r12d
call fcn.140015750
test rax, rax
je 0x14000689d
mov edx, dword [rbp - 0x28]
mov rcx, r12
sub rdx, 6
je 0x140006894
cmp dword [rcx + rax], 0x41574d56
jne 0x140006887
cmp word [rcx + rax + 4], 0x4552
je 0x140006891
inc rcx
cmp rcx, rdx
jae 0x140006894
jmp 0x140006875
mov esi, r13d
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add rbx, 4
sub rdi, 1
jne 0x140006850
jmp 0x1400068ac
mov esi, r13d
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_ACPI_tables
mov ecx, esi
call fcn.140012c50
jmp 0x1400068cc
lea r15, str.Identifier
cmp dword [0x14004001c], 0
je 0x140006b84
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Virtual_PC_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008b90
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.VMSrvc.exe
mov esi, 2
mov qword [rsp + 0x60], rax
lea rdi, [rsp + 0x60]
lea rax, str.VMUSrvc.exe
mov qword [rsp + 0x68], rax
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x82]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_Virtual_PC_processes__s
mov edx, 0x100
lea rcx, [rbp + 0x80]
call fcn.140008c50
mov rcx, qword [rdi]
call fcn.140015370
lea rdx, [rbp + 0x80]
lea rcx, str.____s
test eax, eax
je 0x1400069f7
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400069c4
mov ebx, 0x5f
sub rbx, rax
je 0x1400069f2
nop dword [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400069e0
mov ecx, r13d
jmp 0x140006a38
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006a10
mov ebx, 0x5f
sub rbx, rax
je 0x140006a36
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140006a24
xor ecx, ecx
lea rdx, [rbp + 0x80]
call fcn.140012c50
add rdi, 8
sub rsi, 1
jne 0x140006960
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x82]
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
mov edx, 0x100
lea r8, [0x14001e7c0]
lea rcx, [rbp + 0x80]
call fcn.140008c50
xor edx, edx
mov qword [rbp + 0x68], r12
mov r8d, 0x800
lea rcx, [rbp + 0x4a0]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x68]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006b2b
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x80]
lea rcx, str.____s
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006b00
mov ebx, 0x5f
sub rbx, rax
je 0x140006b26
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140006b14
mov ecx, r13d
jmp 0x140006b78
lea rdx, [rbp + 0x80]
lea rcx, str.____s
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006b50
mov ebx, 0x5f
sub rbx, rax
je 0x140006b76
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140006b64
xor ecx, ecx
lea rdx, [rbp + 0x80]
call fcn.140012c50
cmp dword [0x140040018], 0
je 0x14000717a
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.QEMU_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008b90
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, [0x14001eb40]
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x20], rax
lea rcx, str.QEMU
lea rax, str.HARDWAREDescriptionSystem
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rax
lea rdi, [rbp - 0x10]
lea rax, str.SystemBiosVersion
mov qword [rbp + 8], rcx
mov qword [rbp], rax
mov esi, 2
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x82]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi - 0x10]
lea r8, [0x14001e7c0]
mov edx, 0x100
lea rcx, [rbp + 0x80]
call fcn.140008c50
mov r9, qword [rdi]
mov r8, qword [rdi - 8]
mov rdx, qword [rdi - 0x10]
call fcn.140013350
lea rdx, [rbp + 0x80]
lea rcx, str.____s
test eax, eax
je 0x140006ccb
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006ca0
mov ebx, 0x5f
sub rbx, rax
je 0x140006cc6
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140006cb4
mov ecx, r13d
jmp 0x140006d08
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006ce0
mov ebx, 0x5f
sub rbx, rax
je 0x140006d06
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140006cf4
xor ecx, ecx
lea rdx, [rbp + 0x80]
call fcn.140012c50
add rdi, 0x18
sub rsi, 1
jne 0x140006c30
lea rax, str.qemu_ga.exe
mov esi, 3
mov qword [rbp - 0x20], rax
lea rdi, [rbp - 0x20]
lea rax, str.vdagent.exe
mov qword [rbp - 0x18], rax
lea rax, str.vdservice.exe
mov qword [rbp - 0x10], rax
nop dword [rax]
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x82]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_qemu_processes__s
mov edx, 0x100
lea rcx, [rbp + 0x80]
call fcn.140008c50
mov rcx, qword [rdi]
call fcn.140015370
lea rdx, [rbp + 0x80]
lea rcx, str.____s
test eax, eax
je 0x140006de7
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006db4
mov ebx, 0x5f
sub rbx, rax
je 0x140006de2
nop dword [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140006dd0
mov ecx, r13d
jmp 0x140006e28
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006e00
mov ebx, 0x5f
sub rbx, rax
je 0x140006e26
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140006e14
xor ecx, ecx
lea rdx, [rbp + 0x80]
call fcn.140012c50
add rdi, 8
sub rsi, 1
jne 0x140006d50
xor edx, edx
mov word [rbp + 0x290], r12w
mov r8d, 0x206
lea rcx, [rbp + 0x292]
call sub.VCRUNTIME140.dll_memset
lea rax, str.qemu_ga
mov rdi, r12
mov qword [rsp + 0x70], rax
lea rax, str.SPICE_Guest_Tools
mov qword [rsp + 0x78], rax
nop dword [rax]
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x82]
call sub.VCRUNTIME140.dll_memset
call fcn.140013290
lea rdx, [rbp + 0x4a0]
test eax, eax
je 0x140006ec1
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140006ed0
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov r8, qword [rsp + rdi*8 + 0x70]
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0x290]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea r9, [rbp + 0x290]
mov edx, 0x100
lea r8, str.Checking_QEMU_directory__s
lea rcx, [rbp + 0x80]
call fcn.140008c50
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140006f6b
test al, 0x10
je 0x140006f6b
lea rdx, [rbp + 0x80]
lea rcx, str.____s
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006f40
mov ebx, 0x5f
sub rbx, rax
je 0x140006f66
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140006f54
mov ecx, r13d
jmp 0x140006fb8
lea rdx, [rbp + 0x80]
lea rcx, str.____s
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006f90
mov ebx, 0x5f
sub rbx, rax
je 0x140006fb6
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140006fa4
xor ecx, ecx
lea rdx, [rbp + 0x80]
call fcn.140012c50
inc rdi
cmp rdi, 2
jl 0x140006e80
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x45
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140006ff0
lea r8, [rbp - 0x28]
mov dword [rbp - 0x28], r12d
xor edx, edx
mov ecx, 0x52534d42
mov edi, r12d
call fcn.140015750
mov rbx, rax
test rax, rax
je 0x140007063
mov ecx, dword [rbp - 0x28]
mov rdx, r12
add rcx, 0xfffffffffffffffc
je 0x14000705a
nop dword [rax]
cmp dword [rdx + rax], 0x756d6571
je 0x140007057
inc rdx
cmp rdx, rcx
jb 0x140007030
mov rax, r12
cmp dword [rax + rbx], 0x554d4551
je 0x140007057
inc rax
cmp rax, rcx
jb 0x140007044
jmp 0x14000705a
mov edi, r13d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_SMBIOS_firmware
mov ecx, edi
call fcn.140012c50
lea rdx, str.Checking_ACPI_tables
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x49
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140007090
mov ecx, 0x1000
mov r14d, r12d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
test rax, rax
je 0x14000716b
mov rdi, rax
mov ecx, 0x1000
xor eax, eax
mov rdx, r15
rep stosb byte [rdi], al
call fcn.1400156c0
mov ecx, eax
cmp eax, 0xffffffff
je 0x14000716b
shr eax, 2
cmp ecx, 4
jb 0x14000715f
test eax, eax
je 0x14000715f
mov rdi, r15
mov esi, eax
mov edx, dword [rdi]
lea r8, [rbp - 0x28]
mov ecx, 0x41435049
mov dword [rbp - 0x28], r12d
call fcn.140015750
mov rbx, rax
test rax, rax
je 0x140007153
mov ecx, dword [rbp - 0x28]
mov rdx, r12
add rcx, 0xfffffffffffffffc
je 0x14000714a
nop dword [rax + rax]
cmp dword [rdx + rax], 0x48434f42
je 0x140007147
inc rdx
cmp rdx, rcx
jb 0x140007120
mov rax, r12
cmp dword [rax + rbx], 0x43505842
je 0x140007147
inc rax
cmp rax, rcx
jb 0x140007134
jmp 0x14000714a
mov r14d, r13d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add rdi, 4
sub rsi, 1
jne 0x1400070f0
jmp 0x140007162
mov r14d, r13d
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str.Checking_ACPI_tables
mov ecx, r14d
call fcn.140012c50
cmp dword [0x140040010], 0
je 0x14000730c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Xen_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008b90
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x82]
call sub.VCRUNTIME140.dll_memset
lea r9, str.xenservice.exe
mov edx, 0x100
lea r8, str.Checking_Citrix_Xen_process__s
lea rcx, [rbp + 0x80]
call fcn.140008c50
lea rcx, str.xenservice.exe
call fcn.140015370
lea rdx, [rbp + 0x80]
lea rcx, str.____s
test eax, eax
je 0x14000727b
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007250
mov ebx, 0x5f
sub rbx, rax
je 0x140007276
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140007264
mov ecx, r13d
jmp 0x1400072b8
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007290
mov ebx, 0x5f
sub rbx, rax
je 0x1400072b6
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400072a4
xor ecx, ecx
lea rdx, [rbp + 0x80]
call fcn.140012c50
lea rdx, str.Checking_Mac_Address_start_with_08:16:3E
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x36
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400072e0
lea rcx, [0x140020480]
call fcn.140013440
lea rdx, str.Checking_Mac_Address_start_with_08:16:3E
mov ecx, eax
call fcn.140012c50
cmp dword [0x140040014], 0
je 0x140007617
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Xen_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008b90
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call fcn.14000fbb0
lea rax, str.SYSTEMControlSet001Services_vioscsi
mov esi, 7
mov qword [rbp + 0x290], rax
lea rdi, [rbp + 0x290]
lea rax, str.SYSTEMControlSet001Services_viostor
mov qword [rbp + 0x298], rax
lea rax, str.SYSTEMControlSet001ServicesVirtIO_FS_Service
mov qword [rbp + 0x2a0], rax
lea rax, str.SYSTEMControlSet001ServicesVirtioSerial
mov qword [rbp + 0x2a8], rax
lea rax, str.SYSTEMControlSet001ServicesBALLOON
mov qword [rbp + 0x2b0], rax
lea rax, str.SYSTEMControlSet001ServicesBalloonService
mov qword [rbp + 0x2b8], rax
lea rax, str.SYSTEMControlSet001Services_netkvm
mov qword [rbp + 0x2c0], rax
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x82]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, [0x14001e7c0]
mov edx, 0x100
lea rcx, [rbp + 0x80]
call fcn.140008c50
xor edx, edx
mov qword [rbp + 0x68], r12
mov r8d, 0x800
lea rcx, [rbp + 0x4a0]
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rdi]
lea rax, [rbp + 0x68]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400074bb
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x80]
lea rcx, str.____s
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007490
mov ebx, 0x5f
sub rbx, rax
je 0x1400074b6
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400074a4
mov ecx, r13d
jmp 0x140007508
lea rdx, [rbp + 0x80]
lea rcx, str.____s
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400074e0
mov ebx, 0x5f
sub rbx, rax
je 0x140007506
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400074f4
xor ecx, ecx
lea rdx, [rbp + 0x80]
call fcn.140012c50
add rdi, 8
sub rsi, 1
jne 0x1400073f0
lea rdx, str.Checking_KVM_virio_directory
lea rcx, str.____s
call fcn.140008b90
lea ebx, [rsi + 0x42]
nop dword [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140007540
xor edx, edx
mov word [rbp + 0x290], r12w
mov r8d, 0x206
lea rcx, [rbp + 0x292]
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.Virtio_Win_]
xor edx, edx
lea rcx, [rbp + 0x98]
mov r8d, 0x1f0
movaps xmmword [rbp + 0x80], xmm0
movsd xmm0, qword [0x14001ea88]
movsd qword [rbp + 0x90], xmm0
call sub.VCRUNTIME140.dll_memset
call fcn.140013290
lea rdx, [rbp + 0x4a0]
test eax, eax
je 0x1400075c5
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x1400075d4
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0x290]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140007608
mov ecx, r13d
test al, 0x10
jne 0x14000760b
mov ecx, r12d
lea rdx, str.Checking_KVM_virio_directory
call fcn.140012c50
cmp dword [0x14004000c], 0
je 0x140007834
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Wine_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008b90
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Checking_Wine_via_dll_exports
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x41
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400076a0
lea rcx, [0x14001bfb8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x1400076d5
lea rcx, str.GetModuleHandle
call fcn.140012d80
mov ecx, r12d
jmp 0x1400076ee
lea rdx, str.wine_get_unix_file_name
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov ecx, r12d
setne cl
lea rdx, str.Checking_Wine_via_dll_exports
call fcn.140012c50
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x82]
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREWine
mov edx, 0x100
lea r8, [0x14001e7c0]
lea rcx, [rbp + 0x80]
call fcn.140008c50
xor edx, edx
mov qword [rbp + 0x68], r12
mov r8d, 0x800
lea rcx, [rbp + 0x4a0]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x68]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREWine
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400077d7
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x80]
lea rcx, str.____s
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400077a2
mov ebx, 0x5f
sub rbx, rax
je 0x1400077d2
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400077c0
mov ecx, r13d
jmp 0x140007828
lea rdx, [rbp + 0x80]
lea rcx, str.____s
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007800
mov ebx, 0x5f
sub rbx, rax
je 0x140007826
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140007814
xor ecx, ecx
lea rdx, [rbp + 0x80]
call fcn.140012c50
cmp dword [0x140040008], 0
je 0x1400079fc
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Paralles_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008b90
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.prl_cc.exe
mov esi, 2
mov qword [rbp - 0x80], rax
lea rdi, [rbp - 0x80]
lea rax, str.prl_tools.exe
mov qword [rbp - 0x78], rax
nop dword [rax]
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x82]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_Parallels_processes:__s
mov edx, 0x100
lea rcx, [rbp + 0x80]
call fcn.140008c50
mov rcx, qword [rdi]
call fcn.140015370
lea rdx, [rbp + 0x80]
lea rcx, str.____s
test eax, eax
je 0x140007957
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007924
mov ebx, 0x5f
sub rbx, rax
je 0x140007952
nop dword [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140007940
mov ecx, r13d
jmp 0x140007998
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007970
mov ebx, 0x5f
sub rbx, rax
je 0x140007996
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140007984
xor ecx, ecx
lea rdx, [rbp + 0x80]
call fcn.140012c50
add rdi, 8
sub rsi, 1
jne 0x1400078c0
lea rdx, str.Checking_Mac_Address_start_with_00:1C:42
lea rcx, str.____s
call fcn.140008b90
lea ebx, [rsi + 0x36]
nop dword [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400079d0
lea rcx, [0x14001eb38]
call fcn.140013440
lea rdx, str.Checking_Mac_Address_start_with_00:1C:42
mov ecx, eax
call fcn.140012c50
cmp dword [0x140040004], 0
je 0x140007c3c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Hyper_V_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140008b90
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Checking_for_Hyper_V_driver_objects
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x3b
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140007a80
lea rcx, str.Driver
call fcn.140015a50
test rax, rax
je 0x140007b60
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
cmp rdi, rsi
je 0x140007b60
nop word [rax + rax]
mov rbx, qword [rdi]
lea rdx, str.VMBusHID
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140007d38
lea rdx, str.vmbus
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140007d38
lea rdx, str.vmgid
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140007d38
lea rdx, str.IndirectKmd
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140007d38
lea rdx, str.HyperVideo
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140007d38
lea rdx, str.hyperkbd
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140007d38
add rdi, 8
cmp rdi, rsi
jne 0x140007ac0
mov ecx, r12d
lea rdx, str.Checking_for_Hyper_V_driver_objects
call fcn.140012c50
lea rdx, str.Checking_for_Hyper_V_global_objects
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x3b
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140007b90
lea rcx, str.GLOBAL__
call fcn.140015a50
test rax, rax
je 0x140007c2d
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
cmp rdi, rsi
je 0x140007c2d
nop
mov rbx, qword [rdi]
lea rdx, str.VMBUS
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
jne 0x140007d40
lea rdx, str.VDRVROOT
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140007d40
lea rdx, str.VmGenerationCounter
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140007d40
lea rdx, str.VmGid
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140007d40
add rdi, 8
cmp rdi, rsi
jne 0x140007bc0
mov ecx, r12d
lea rdx, str.Checking_for_Hyper_V_global_objects
call fcn.140012c50
cmp dword [0x140040000], 0
je 0x140007c5e
call fcn.1400116d0
call fcn.1400128a0
call fcn.140011ae0
call fcn.140012460
call fcn.140011f40
cmp dword [0x14003fffc], 0
je 0x1400083b3
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Timing_attacks
lea rcx, str._n___________________________s___________________________n
call fcn.140008b90
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, 0xa
lea rcx, str._n___Delay_value_is_set_to__u_minutes_..._n
call fcn.140008b20
lea rdx, str.Performing_a_sleep_using_NtDelayExecution_...
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x32
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140007cf0
movabs rsi, 0xfffffffe9a5f4400
lea r15, [0x14003f180]
mov qword [rbp + 0x68], rsi
mov rax, r15
mov ecx, r12d
mov rdx, r12
cmp dword [rax], 0xd
je 0x140007d48
inc ecx
inc rdx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140007d20
mov ecx, r13d
jmp 0x140007d8a
mov ecx, r13d
jmp 0x140007b63
mov ecx, r13d
jmp 0x140007c30
lea rax, [rdx + rdx*2]
add rax, rax
cmp byte [r15 + rax*8 + 0x24], 0
jne 0x140007d5c
mov ecx, r13d
jmp 0x140007d8a
mov ecx, r12d
mov rdx, r12
mov rax, r15
cmp dword [rax], 0xd
je 0x140007e49
inc ecx
inc rdx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140007d65
mov rax, r12
lea rdx, [rbp + 0x68]
xor ecx, ecx
call rax
mov ecx, r12d
lea rdx, str.Performing_a_sleep_using_NtDelayExecution_...
call fcn.140012c50
lea rdx, str.Performing_a_sleep___in_a_loop_...
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x3d
nop
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140007db0
mov ebx, 0x3e8
nop word [rax + rax]
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rbx, 1
jne 0x140007dd0
lea rdx, str.Performing_a_sleep___in_a_loop_...
xor ecx, ecx
call fcn.140012c50
lea rdx, str.Delaying_execution_using_SetTimer_...
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x3a
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140007e10
lea r9, [0x140015d00]
xor edx, edx
xor ecx, ecx
mov r8d, 0x927c0
call qword [sym.imp.USER32.dll_SetTimer]
mov rbx, rax
test rax, rax
jne 0x140007e66
mov ecx, r13d
jmp 0x140007ed5
lea rax, [rdx + rdx*2]
add rax, rax
cmp byte [r15 + rax*8 + 0x24], 0
je 0x140007d7c
mov rax, qword [r15 + rax*8 + 0x28]
jmp 0x140007d7f
xor r9d, r9d
lea rcx, [rbp - 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp dword [0x140040048], 0
mov ecx, r12d
sete cl
test ecx, eax
je 0x140007ec7
nop dword [rax]
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rbp - 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp dword [0x140040048], 0
mov ecx, r12d
sete cl
test ecx, eax
jne 0x140007e90
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
mov ecx, r12d
lea rdx, str.Delaying_execution_using_SetTimer_...
call fcn.140012c50
lea rdx, str.Delaying_execution_using_timeSetEvent_...
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x36
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140007f00
lea edx, [rbx + 8]
lea rcx, [rbp - 0x50]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
mov rax, qword [rbp - 0x50]
lea r8, [0x140015d00]
mov ebx, dword [rbp - 0x4c]
test eax, eax
mov ecx, r12d
mov dword [rsp + 0x20], r12d
cmovne ecx, eax
cmp ecx, ebx
cmovb ebx, ecx
xor r9d, r9d
mov edx, ebx
mov ecx, 0x927c0
call qword [sym.imp.WINMM.dll_timeSetEvent]
mov ecx, eax
test eax, eax
jne 0x140007f5a
mov ecx, r13d
jmp 0x140007f75
mov eax, dword [0x140040048]
test eax, eax
je 0x140007f60
call qword [sym.imp.WINMM.dll_timeKillEvent]
mov ecx, ebx
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ecx, r12d
lea rdx, str.Delaying_execution_using_timeSetEvent_...
call fcn.140012c50
lea rdx, str.Delaying_execution_using_WaitForSingleObject_...
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x2f
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140007fa0
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
jne 0x140007fd9
lea rcx, [0x140021d68]
call fcn.140012d80
mov ecx, r13d
jmp 0x140007fea
mov edx, 0x927c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, r12d
lea rdx, str.Delaying_execution_using_WaitForSingleObject_...
call fcn.140012c50
lea rdx, str.Delaying_execution_using_IcmpSendEcho_...
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x36
nop
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140008010
movsd xmm0, qword [str.Data_Buffer]
mov eax, dword [0x140021d88]
movsd qword [rbp - 0x20], xmm0
xorps xmm0, xmm0
mov dword [rbp - 0x18], eax
xor eax, eax
movups xmmword [rbp - 0x14], xmm0
mov dword [rbp - 4], eax
call qword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140008078
lea rcx, str._tUnable_to_open_handle._n
call fcn.140008b20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.IcmpCreatefile_returned_error:__u_n
call fcn.140008b20
mov ecx, r13d
jmp 0x1400080e9
mov ecx, 0x50
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov rcx, rdi
test rax, rax
jne 0x1400080a5
call qword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
lea rcx, str._tUnable_to_allocate_memory_n
call fcn.140008b20
mov ecx, r13d
jmp 0x1400080e9
mov dword [rsp + 0x38], 0x927c0
lea r8, [rbp - 0x20]
mov dword [rsp + 0x30], 0x50
mov r9d, 0x20
mov qword [rsp + 0x28], rbx
mov edx, 0xffffffff
mov qword [rsp + 0x20], r12
call qword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
mov rcx, rdi
call qword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, r12d
lea rdx, str.Delaying_execution_using_IcmpSendEcho_...
call fcn.140012c50
lea rdx, str.Delaying_execution_using_CreateWaitableTimer_...
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x2f
nop dword [rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140008110
xor r8d, r8d
mov qword [rbp + 0x68], rsi
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov rdi, rax
test rax, rax
jne 0x140008141
mov ebx, r13d
jmp 0x140008190
mov dword [rsp + 0x28], r12d
lea rdx, [rbp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
test eax, eax
jne 0x140008167
mov ebx, r13d
jmp 0x14000817e
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov ebx, r12d
cmovne ebx, r13d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Delaying_execution_using_CreateWaitableTimer_...
mov ecx, ebx
call fcn.140012c50
lea rdx, str.Delaying_execution_using_CreateTimerQueueTimer_...
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x2d
nop word [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400081c0
xor r9d, r9d
mov qword [rbp + 0x68], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140040040], rax
test rax, rax
jne 0x1400081f7
mov ebx, r12d
jmp 0x140008272
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
mov rdi, rax
test rax, rax
jne 0x14000820a
mov ebx, r13d
jmp 0x140008272
mov dword [rsp + 0x30], r12d
lea r8, [0x140015d10]
mov dword [rsp + 0x28], r12d
lea rcx, [rbp + 0x68]
mov r9d, 0xdeadbeef
mov dword [rsp + 0x20], 0x927c0
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
test eax, eax
jne 0x14000823f
mov ebx, r13d
jmp 0x14000825a
mov rcx, qword [0x140040040]
mov edx, 0x5b8d80
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov ebx, r12d
cmovne ebx, r12d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
mov rcx, qword [0x140040040]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Delaying_execution_using_CreateTimerQueueTimer_...
mov ecx, ebx
call fcn.140012c50
lea rdx, str.Checking_RDTSC_Locky_trick
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x44
nop dword [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400082a0
mov esi, r12d
nop word [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
rdtsc
shl rdx, 0x20
xor ecx, ecx
or rax, rdx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
rdtsc
shl rdx, 0x20
mov ecx, ebx
or rax, rdx
sub ecx, edi
sub eax, ebx
xor edx, edx
div ecx
cmp eax, 0xa
jae 0x14000830a
inc esi
cmp esi, 0xa
jb 0x1400082c0
mov ecx, r13d
jmp 0x14000830d
mov ecx, r12d
lea rdx, str.Checking_RDTSC_Locky_trick
call fcn.140012c50
lea rdx, str.Checking_RDTSC_which_force_a_VM_Exit__cpuid_
lea rcx, str.____s
call fcn.140008b90
mov ebx, 0x32
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140008331
xorps xmm0, xmm0
lea r8d, [rbx + 0xa]
movups xmmword [rbp + 0x68], xmm0
mov r9, r12
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdi, rax
xor eax, eax
xor ecx, ecx
cpuid
mov dword [rbp + 0x68], eax
mov dword [rbp + 0x6c], ebx
mov dword [rbp + 0x70], ecx
mov dword [rbp + 0x74], edx
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rdi
add r9, rax
sub r8, 1
jne 0x140008351
mov ecx, r12d
movabs rax, 0xcccccccccccccccd
mul r9
shr rdx, 3
lea rax, [rdx - 1]
cmp rax, 0x3e6
lea rdx, str.Checking_RDTSC_which_force_a_VM_Exit__cpuid_
seta cl
call fcn.140012c50
jmp 0x1400083ba
lea r15, [0x14003f180]
cmp dword [0x14003fff4], 0
je 0x1400086d2
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Analysis_tools
lea rcx, str._n___________________________s___________________________n
call fcn.140008b90
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.ollydbg.exe
mov qword [rbp + 0x290], rax
lea rax, str.ProcessHacker.exe
mov qword [rbp + 0x298], rax
lea rax, str.tcpview.exe
mov qword [rbp + 0x2a0], rax
lea rax, str.autoruns.exe
mov qword [rbp + 0x2a8], rax
lea rax, str.autorunsc.exe
mov qword [rbp + 0x2b0], rax
lea rax, str.filemon.exe
mov qword [rbp + 0x2b8], rax
lea rax, str.procmon.exe
mov qword [rbp + 0x2c0], rax
lea rax, str.regmon.exe
mov qword [rbp + 0x2c8], rax
lea rax, str.procexp.exe
mov qword [rbp + 0x2d0], rax
lea rax, str.idaq.exe
mov qword [rbp + 0x2d8], rax
lea rax, str.idaq64.exe
mov qword [rbp + 0x2e0], rax
lea rax, str.ImmunityDebugger.exe
mov qword [rbp + 0x2e8], rax
lea rax, str.Wireshark.exe
mov qword [rbp + 0x2f0], rax
lea rax, str.dumpcap.exe
mov qword [rbp + 0x2f8], rax
lea rax, str.HookExplorer.exe
mov qword [rbp + 0x300], rax
lea rax, str.ImportREC.exe
mov qword [rbp + 0x308], rax
lea rax, str.PETools.exe
mov qword [rbp + 0x310], rax
lea rax, str.LordPE.exe
mov qword [rbp + 0x318], rax
lea rax, str.SysInspector.exe
mov qword [rbp + 0x320], rax
lea rax, str.proc_analyzer.exe
mov qword [rbp + 0x328], rax
lea rax, str.sysAnalyzer.exe
mov qword [rbp + 0x330], rax
lea rax, str.sniff_hit.exe
mov qword [rbp + 0x338], rax
lea rax, str.windbg.exe
mov qword [rbp + 0x340], rax
lea rax, str.joeboxcontrol.exe
mov qword [rbp + 0x348], rax
lea rax, str.joeboxserver.exe
mov qword [rbp + 0x350], rax
mov qword [rbp + 0x358], rax
lea rax, str.ResourceHacker.exe
mov qword [rbp + 0x360], rax
lea rax, str.x32dbg.exe
mov qword [rbp + 0x368], rax
lea rax, str.x64dbg.exe
mov qword [rbp + 0x370], rax
lea rax, str.Fiddler.exe
mov qword [rbp + 0x378], rax
lea rax, str.httpdebugger.exe
mov qword [rbp + 0x380], rax
lea rdi, [rbp + 0x290]
mov esi, 0x1f
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x80], r12w
mov r8d, 0x1fe
lea rcx, [rbp + 0x82]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_process_of_malware_analysis_tool:__s
mov edx, 0x100
lea rcx, [rbp + 0x80]
call fcn.140008c50
mov rcx, qword [rdi]
call fcn.140015370
lea rdx, [rbp + 0x80]
lea rcx, str.____s
test eax, eax
je 0x140008677
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008644
mov ebx, 0x5f
sub rbx, rax
je 0x140008672
nop dword [rax + rax]
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x140008660
mov ecx, r13d
jmp 0x1400086b8
call fcn.140008b90
lea rcx, [rbp + 0x80]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008690
mov ebx, 0x5f
sub rbx, rax
je 0x1400086b6
lea rcx, [0x140020ff8]
call fcn.140008b90
sub rbx, 1
jne 0x1400086a4
xor ecx, ecx
lea rdx, [rbp + 0x80]
call fcn.140012c50
add rdi, 8
sub rsi, 1
jne 0x1400085e0
cmp dword [0x14003fff0], 0
je 0x14000873a
lea rcx, str.Begin_AntiDisassmConstantCondition_n
call fcn.140008b90
call fcn.140015d40
lea rcx, str.Begin_AntiDisassmAsmJmpSameTarget_n
call fcn.140008b90
call fcn.140015d48
lea rcx, str.Begin_AntiDisassmImpossibleDiasassm_n
call fcn.140008b90
call fcn.140015d4f
lea rcx, str.Begin_AntiDisassmFunctionPointer_n
call fcn.140008b90
mov ecx, 2
call fcn.140015d63
lea rcx, str.Begin_AntiDisassmReturnPointerAbuse_n
call fcn.140008b90
mov ecx, 0x29a
call fcn.140015d8e
cmp dword [0x14003fff8], 0
je 0x140008804
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x68]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x68]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x70]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Anti_Dumping
lea rcx, str._n___________________________s___________________________n
call fcn.140008b90
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.___Erasing_PE_header_from_memory_n
call fcn.140008b90
xor ecx, ecx
mov dword [rbp + 0x34], r12d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9, [rbp + 0x34]
mov edx, 0x1000
mov rcx, rax
mov r8d, 4
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
mov rbx, qword gs:[0x60]
lea rcx, str.___Increasing_SizeOfImage_in_PE_Header_to:_0x100000_n
call fcn.140008b90
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x30]
add eax, 0x100000
mov dword [rcx + 0x40], eax
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000185b