Function at 0x1400017c0
Capabilities:
Check for sandbox username or hostname
Get disk information
Get session user name

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
lea rbp, [r11 - 0x298]
sub rsp, 0x380
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov qword [r11 + 8], rbx
lea rcx, [fcn.140001390]
xor esi, esi
mov qword [r11 + 0x10], r12
lea rbx, [fcn.1400013b0]
mov qword [r11 + 0x18], r13
mov edx, esi
cmp rcx, rbx
jae 0x14000181d
nop dword [rax + rax]
movzx eax, byte [rcx]
inc rcx
add edx, eax
cmp rcx, rbx
jb 0x140001810
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001ef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdi, [fcn.140001430]
mov edx, esi
cmp rbx, rdi
jae 0x14000185d
nop dword [rax + rax]
movzx eax, byte [rbx]
inc rbx
add edx, eax
cmp rbx, rdi
jb 0x140001850
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001ef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rbx, [fcn.140001450]
mov edx, esi
cmp rdi, rbx
jae 0x14000189d
nop dword [rax + rax]
movzx eax, byte [rdi]
inc rdi
add edx, eax
cmp rdi, rbx
jb 0x140001890
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001ef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdi, [fcn.140001490]
mov edx, esi
cmp rbx, rdi
jae 0x1400018dd
nop dword [rax + rax]
movzx eax, byte [rbx]
inc rbx
add edx, eax
cmp rbx, rdi
jb 0x1400018d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001ef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rbx, [fcn.140001540]
mov edx, esi
cmp rdi, rbx
jae 0x14000191d
nop dword [rax + rax]
movzx eax, byte [rdi]
inc rdi
add edx, eax
cmp rdi, rbx
jb 0x140001910
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001ef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdi, [fcn.1400015f0]
mov edx, esi
cmp rbx, rdi
jae 0x14000195d
nop dword [rax + rax]
movzx eax, byte [rbx]
inc rbx
add edx, eax
cmp rbx, rdi
jb 0x140001950
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001ef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rbx, [fcn.1400016e0]
mov edx, esi
cmp rdi, rbx
jae 0x14000199d
nop dword [rax + rax]
movzx eax, byte [rdi]
inc rdi
add edx, eax
cmp rdi, rbx
jb 0x140001990
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001ef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdi, [fcn.140001730]
mov edx, esi
cmp rbx, rdi
jae 0x1400019dd
nop dword [rax + rax]
movzx eax, byte [rbx]
inc rbx
add edx, eax
cmp rbx, rdi
jb 0x1400019d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001ef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rbx, [fcn.140001770]
mov edx, esi
cmp rdi, rbx
jae 0x140001a1d
nop dword [rax + rax]
movzx eax, byte [rdi]
inc rdi
add edx, eax
cmp rdi, rbx
jb 0x140001a10
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001ef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [fcn.1400017b0]
mov edx, esi
cmp rbx, rcx
jae 0x140001a5d
nop dword [rax + rax]
movzx eax, byte [rbx]
inc rbx
add edx, eax
cmp rbx, rcx
jb 0x140001a50
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x370], r15
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001ef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r12, rax
call fcn.140001390
mov r13d, eax
call fcn.1400013b0
mov dword [rsp + 0x20], eax
call fcn.140001430
mov dword [rsp + 0x24], eax
call fcn.140001450
mov dword [rsp + 0x28], eax
call fcn.140001490
mov dword [rsp + 0x2c], eax
call fcn.140001540
mov dword [rsp + 0x30], eax
call fcn.1400015f0
mov dword [rsp + 0x34], eax
call fcn.1400016e0
mov dword [rsp + 0x38], eax
call fcn.140001730
mov dword [rsp + 0x3c], eax
call fcn.140001770
lea rdx, str.HARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov dword [rsp + 0x40], eax
call fcn.140001070
test eax, eax
jne 0x140001b17
lea rdx, str.HARDWAREDEVICEMAPScsiScsi_Port_1Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
call fcn.140001070
test eax, eax
jne 0x140001b17
lea rdx, str.HARDWAREDEVICEMAPScsiScsi_Port_2Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
call fcn.140001070
mov r15d, esi
test eax, eax
je 0x140001b1d
mov r15d, 1
xor edx, edx
mov qword [rsp + 0x378], r14
mov r8d, 0x104
lea rcx, [rbp + 0x60]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x140001c08
cmp eax, 0x104
ja 0x140001c08
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
lea rbx, [rbp + 0x60]
call sub.VCRUNTIME140.dll_memset
cmp byte [rbp + 0x60], sil
je 0x140001c08
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x140001be4
mov r9, rbx
lea r8, str._ssample.exe
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.140001010
lea rcx, [rsp + 0x50]
call fcn.140001240
test eax, eax
jne 0x140001c8b
mov r9, rbx
lea r8, str._smalware.exe
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.140001010
lea rcx, [rsp + 0x50]
call fcn.140001240
test eax, eax
jne 0x140001c8b
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], sil
jne 0x140001bf0
inc rbx
add rbx, rax
cmp byte [rbx], sil
jne 0x140001b80
mov r14d, esi
mov r8d, 0x1f4
lea rdx, [rbp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rbp + 0x60]
mov rax, 0xffffffffffffffff
mov rbx, rsi
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], bl
jne 0x140001c30
test rax, rax
je 0x140001c6e
nop dword [rax]
movsx ecx, byte [rbp + rbx + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov byte [rbp + rbx + 0x60], al
lea rcx, [rbp + 0x60]
inc rbx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], sil
jne 0x140001c60
cmp rbx, rax
jb 0x140001c40
lea rdx, str.SAMPLE
lea rcx, [rbp + 0x60]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x140001c96
mov edi, 1
jmp 0x140001ccd
mov r14d, 1
jmp 0x140001c0b
lea rdx, str.VIRUS
lea rcx, [rbp + 0x60]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x140001cb3
mov edi, 1
jmp 0x140001ccd
lea rdx, str.SANDBOX
lea rcx, [rbp + 0x60]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
mov edi, esi
setne dil
lea rdx, [rsp + 0x44]
mov dword [rsp + 0x44], 0xc8
lea rcx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rcx, [rsp + 0x50]
mov rax, 0xffffffffffffffff
mov rbx, rsi
inc rax
cmp byte [rcx + rax], bl
jne 0x140001cf4
test rax, rax
je 0x140001d2e
movsx ecx, byte [rsp + rbx + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov byte [rsp + rbx + 0x50], al
lea rcx, [rsp + 0x50]
inc rbx
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], sil
jne 0x140001d20
cmp rbx, rax
jb 0x140001d01
lea rdx, str.SANDBOX
lea rcx, [rsp + 0x50]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
mov rbx, qword [rsp + 0x3a0]
test rax, rax
je 0x140001d54
mov esi, 1
jmp 0x140001d8b
lea rdx, [0x140003418]
lea rcx, [rsp + 0x50]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x140001d72
mov esi, 1
jmp 0x140001d8b
lea rdx, str.MALWARE
lea rcx, [rsp + 0x50]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
setne sil
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, r12d
mov r12, qword [rsp + 0x3a8]
cmp eax, 0xbb8
jl 0x140001dc6
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.TIMEOUT
call fcn.140001f30
mov rcx, rax
lea rdx, [0x140001ef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
test r13d, r13d
mov r13, qword [rsp + 0x3b0]
jne 0x140001e4b
cmp dword [rsp + 0x20], 0
jne 0x140001e4b
cmp dword [rsp + 0x24], 0
jne 0x140001e4b
cmp dword [rsp + 0x28], 0
jne 0x140001e4b
cmp dword [rsp + 0x2c], 0
jne 0x140001e4b
cmp dword [rsp + 0x30], 0
jne 0x140001e4b
cmp dword [rsp + 0x34], 0
jne 0x140001e4b
cmp dword [rsp + 0x38], 0
jne 0x140001e4b
cmp dword [rsp + 0x3c], 0
jne 0x140001e4b
cmp dword [rsp + 0x40], 0
jne 0x140001e4b
test r15d, r15d
jne 0x140001e4b
test r14d, r14d
jne 0x140001e4b
test edi, edi
jne 0x140001e4b
test esi, esi
jne 0x140001e4b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.GOT_HERE____
call fcn.140001f30
mov rcx, rax
lea rdx, [0x140001ef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
jmp 0x140001e50
mov eax, 1
mov r15, qword [rsp + 0x370]
mov r14, qword [rsp + 0x378]
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.140002110
add rsp, 0x380
pop rdi
pop rsi
pop rbp
ret