Function at 0x1400198f0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x298]
sub rsp, 0x370
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
mov rax, qword [0x1400490c0]
xor rax, rsp
mov qword [rbp + 0x228], rax
xor r13d, r13d
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x140040a70]
movdqu xmmword [rsp + 0x78], xmm1
mov eax, dword [str.e_0m]
mov dword [rsp + 0x68], eax
mov byte [rsp + 0x6c], r13b
movups xmmword [rbp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
mov ecx, 0x20
call fcn.140034530
mov rbx, rax
mov qword [rbp + 0x28], rax
movdqa xmm0, xmmword [0x140040b40]
movdqu xmmword [rbp + 0x38], xmm0
movups xmm0, xmmword [str.e_38_2_94_214_114m]
movups xmmword [rax], xmm0
movzx ecx, word [0x14003f190]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], r13b
mov qword [rbp + 0x38], 0x15
lea rax, [0x14003fc37]
lea rsi, [0x14003fc34]
cmp rax, rbx
jbe 0x1400199da
lea rax, [rbx + 0x12]
cmp rsi, rax
ja 0x1400199da
cmp rbx, rsi
ja 0x1400199d2
mov edi, r13d
jmp 0x1400199df
mov rdi, rbx
sub rdi, rsi
jmp 0x1400199df
mov edi, 3
lea rcx, [rbx + 3]
mov r8d, 0x13
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 3
sub r8, rdi
lea rdx, [rsi + 3]
add rdx, rdi
lea rcx, [rdi + rbx]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x28]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 8
jb 0x140019a95
lea rax, [rcx + 8]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x48]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x48]
movabs rdx, 0x4445544345544544
mov qword [rax + rcx], rdx
mov byte [rax + rcx + 8], 0
lea rax, [rsp + 0x48]
jmp 0x140019aba
mov qword [rsp + 0x20], 8
lea r9, str.DETECTED
movzx r8d, byte [rsp + 0x30]
mov edx, 8
lea rcx, [rsp + 0x48]
call fcn.140007ba0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rsp + 0x68]
lea r8, [rbp - 0x58]
movzx edx, byte [rsp + 0x30]
lea rcx, [rbp - 0x78]
call fcn.14000cca0
nop
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x140019b3b
lea rax, [rcx + 3]
mov qword [rbp - 0x68], rax
lea rbx, [rbp - 0x78]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x78]
add rbx, rcx
mov r8d, 3
lea rdx, [0x14003fc24]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
lea rax, [rbp - 0x78]
jmp 0x140019b5f
mov qword [rsp + 0x20], 3
lea r9, [0x14003fc24]
movzx r8d, byte [rsp + 0x30]
mov edx, 3
lea rcx, [rbp - 0x78]
call fcn.140007ba0
xorps xmm0, xmm0
movups xmmword [rbp + 0x108], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x118], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x108], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x118], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140019bd6
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019bd1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019bd1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003456c
movdqa xmm7, xmmword [0x140040a60]
movdqu xmmword [rbp - 0x68], xmm7
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140019c26
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019c20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019c20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003456c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140019c66
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019c61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019c61
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003456c
movdqu xmmword [rsp + 0x58], xmm7
mov byte [rsp + 0x48], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x140019caf
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019caa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019caa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003456c
movdqu xmmword [rbp + 0x38], xmm7
mov byte [rbp + 0x28], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140019cf7
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019cf2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019cf2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003456c
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x140040a70]
movdqu xmmword [rsp + 0x78], xmm1
mov eax, dword [str.e_0m]
mov dword [rsp + 0x68], eax
mov byte [rsp + 0x6c], 0
movups xmmword [rbp - 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 8], xmm1
mov ecx, 0x20
call fcn.140034530
mov rbx, rax
mov qword [rbp - 0x18], rax
movdqa xmm0, xmmword [0x140040b30]
movdqu xmmword [rbp - 8], xmm0
movups xmm0, xmmword [str.e_38_2_239_75_75m]
movups xmmword [rax], xmm0
movzx ecx, byte [0x14003f160]
mov byte [rax + 0x10], cl
mov byte [rax + 0x11], 0
mov qword [rbp - 8], 0x12
lea rax, [0x14003fc51]
lea rsi, [0x14003fc50]
cmp rax, rbx
jbe 0x140019d94
lea rax, [rbx + 0x11]
cmp rsi, rax
ja 0x140019d94
cmp rbx, rsi
ja 0x140019d8c
mov rdi, r13
jmp 0x140019d99
mov rdi, rbx
sub rdi, rsi
jmp 0x140019d99
mov edi, 1
lea rcx, [rbx + 1]
mov r8d, 0x12
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 1
sub r8, rdi
lea rdx, [rsi + 1]
add rdx, rdi
lea rcx, [rdi + rbx]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x98], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x98], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0xc
lea rdx, str.NOT_DETECTED
lea rcx, [rbp + 0x88]
call fcn.140016700
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
lea r9, [rsp + 0x68]
lea r8, [rbp - 0x58]
movzx edx, byte [rsp + 0x30]
lea rcx, [rbp + 0x128]
call fcn.14000cca0
nop
mov r8d, 1
lea rdx, [0x14003fc38]
lea rcx, [rbp + 0x128]
call fcn.140016700
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8, qword [rbp + 0x140]
cmp r8, 0xf
jbe 0x140019ec7
mov rdx, qword [rbp + 0x128]
lea rcx, [rbp + 0x128]
call fcn.140012110
movdqu xmmword [rbp + 0x138], xmm7
mov byte [rbp + 0x128], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140019f15
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019f0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019f0f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003456c
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x140019f59
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019f54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019f54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003456c
movdqu xmmword [rbp + 0x98], xmm7
mov byte [rbp + 0x88], 0
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x140019fa6
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019fa1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019fa1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003456c
movdqu xmmword [rbp - 8], xmm7
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140019fee
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019fe9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019fe9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003456c
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x140040a70]
movdqu xmmword [rsp + 0x78], xmm1
mov eax, dword [str.e_0m]
mov dword [rsp + 0x68], eax
mov byte [rsp + 0x6c], 0
movups xmmword [rbp + 0xa8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb8], xmm1
mov r8d, 0x11
lea rdi, str.e_38_2_239_75_75m
mov rdx, rdi
lea rcx, [rbp + 0xa8]
call fcn.140005a50
nop
lea r8, [rbp + 0xa8]
mov rdx, rsi
lea rcx, [rbp + 0x1e8]
call fcn.140005070
nop
mov r8d, 0xb
lea rdx, str._SPOOFABLE
mov rcx, rax
call fcn.140016700
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
lea r9, [rsp + 0x68]
lea r8, [rbp - 0x58]
movzx edx, byte [rsp + 0x30]
lea rcx, [rbp + 0x148]
call fcn.14000cca0
nop
mov r8d, 1
lea rdx, [0x14003fc38]
lea rcx, [rbp + 0x148]
call fcn.140016700
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x58], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8, qword [rbp + 0x160]
cmp r8, 0xf
jbe 0x14001a10d
mov rdx, qword [rbp + 0x148]
lea rcx, [rbp + 0x148]
call fcn.140012110
movdqu xmmword [rbp + 0x158], xmm7
mov byte [rbp + 0x148], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x14001a15b
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a155
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a155
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003456c
nop
lea rcx, [rbp + 0x1e8]
call fcn.14000dc10
nop
mov r8, qword [rbp + 0xc0]
cmp r8, 0xf
jbe 0x14001a188
mov rdx, qword [rbp + 0xa8]
lea rcx, [rbp + 0xa8]
call fcn.140012110
movdqu xmmword [rbp + 0xb8], xmm7
mov byte [rbp + 0xa8], 0
mov r8, qword [rbp - 0x80]
cmp r8, 0xf
jbe 0x14001a1b0
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.140012110
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], 0xe
mov qword [rbp - 0x20], 0xf
movsd xmm0, qword [str._____NOTE_____]
movsd qword [rbp - 0x38], xmm0
mov eax, dword [0x14003fc70]
mov dword [rbp - 0x30], eax
movzx eax, word [0x14003fc74]
mov word [rbp - 0x2c], ax
mov byte [rbp - 0x2a], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x140040a70]
movdqu xmmword [rsp + 0x78], xmm1
mov eax, dword [str.e_0m]
mov dword [rsp + 0x68], eax
mov byte [rsp + 0x6c], 0
movups xmmword [rbp + 0xc8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd8], xmm1
mov r8d, 0x13
lea rdx, str.e_38_2_108_108_108m
lea rcx, [rbp + 0xc8]
call fcn.140005a50
nop
lea r8, [rbp + 0xc8]
mov rdx, rsi
lea rcx, [rbp + 0x208]
call fcn.140005070
nop
mov r8d, 0xc
lea rdx, str.__NO_PERMS
mov rcx, rax
call fcn.140016700
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
lea r9, [rsp + 0x68]
lea r8, [rbp - 0x58]
movzx edx, byte [rsp + 0x30]
lea rcx, [rbp + 0x1a8]
call fcn.14000cca0
nop
mov r8d, 1
lea rdx, [0x14003fc38]
lea rcx, [rbp + 0x1a8]
call fcn.140016700
movups xmm9, xmmword [rax]
movups xmmword [rbp + 0x1c8], xmm9
movups xmm8, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1d8], xmm8
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0x1a8]
call fcn.14000dc10
nop
mov r8, qword [rbp - 0x40]
cmp r8, 0xf
jbe 0x14001a308
mov rdx, qword [rbp - 0x58]
lea rcx, [rbp - 0x58]
call fcn.140012110
nop
lea rcx, [rbp + 0x208]
call fcn.14000dc10
nop
mov r8, qword [rbp + 0xe0]
cmp r8, 0xf
jbe 0x14001a335
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0xc8]
call fcn.140012110
movdqu xmmword [rbp + 0xd8], xmm7
mov byte [rbp + 0xc8], 0
mov r8, qword [rbp - 0x80]
cmp r8, 0xf
jbe 0x14001a35d
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.140012110
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x140040a70]
movdqu xmmword [rsp + 0x78], xmm1
mov eax, dword [str.e_0m]
mov dword [rsp + 0x68], eax
mov byte [rsp + 0x6c], 0
movups xmmword [rbp + 0xe8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf8], xmm1
mov r8d, 0x12
lea r14, str.e_38_2_94_214_114m
mov rdx, r14
lea rcx, [rbp + 0xe8]
call fcn.140005a50
nop
mov r8d, 5
lea rdx, str.TIP:
lea rcx, [rbp + 0xe8]
call fcn.140016700
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rsp + 0x68]
lea r8, [rbp - 0x58]
movzx edx, byte [rsp + 0x30]
lea rcx, [rbp + 0x188]
call fcn.14000cca0
nop
mov r8, qword [rbp - 0x40]
cmp r8, 0xf
jbe 0x14001a41b
mov rdx, qword [rbp - 0x58]
lea rcx, [rbp - 0x58]
call fcn.140012110
nop
mov r8, qword [rbp + 0x100]
cmp r8, 0xf
jbe 0x14001a43b
mov rdx, qword [rbp + 0xe8]
lea rcx, [rbp + 0xe8]
call fcn.140012110
movdqu xmmword [rbp + 0xf8], xmm7
mov byte [rbp + 0xe8], 0
mov r8, qword [rbp - 0x80]
cmp r8, 0xf
jbe 0x14001a463
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.140012110
lea rax, [rbp + 0x48]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x108]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x58], rax
mov ebx, dword [0x1400498b0]
mov r12d, ebx
shr r12d, 0xb
and r12b, 1
mov r15d, ebx
shr r15d, 0xa
and r15b, 1
add r15b, 0x66
shr ebx, 0xc
and bl, 1
add bl, 0x67
lea r8, str.VMID
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.CPU_brand
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.CPUID_hypervisor_bit
mov dl, 2
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.hypervisor_brand
mov dl, 3
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.RDTSC
mov dl, 4
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.sidt_null_byte
mov dl, 0xf
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.processor_count
mov dl, 5
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.MAC_address
mov dl, 6
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.temperature
mov dl, 7
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.systemd_virtualisation
mov dl, 8
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.chassis_vendor
mov dl, 9
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.chassis_type
mov dl, 0xa
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.Dockerenv
mov dl, 0xb
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.dmidecode_output
mov dl, 0xc
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.dmesg_output
mov dl, 0xd
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.hwmon_presence
mov dl, 0xe
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.cursor
mov dl, 0x10
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.VMware_registry
mov dl, 0x11
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.VBox_registry
mov dl, 0x12
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.users
mov dl, 0x13
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.DLLs
mov dl, 0x14
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.registry
mov dl, 0x15
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.Sunbelt_CWSandbox_directory
mov dl, 0x16
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.Wine
mov dl, 0x1d
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.VM_files
mov dl, 0x17
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.hw.model
mov dl, 0x18
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.disk_size
mov dl, 0x19
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.VBox_default_specs
mov dl, 0x1a
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.VBox_network_provider_match
mov dl, 0x1b
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.computer_name
mov dl, 0x1c
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.hostname
mov dl, 0x1e
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.low_memory_space
mov dl, 0x1f
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.VM_processes
mov dl, 0x28
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.default_Linux_user_host
mov dl, 0x29
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.VBox_window_class
mov dl, 0x20
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.gamarue_ransomware_technique
mov dl, 0x2a
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.0x4_leaf_of_VMID
mov dl, 0x2b
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.Parallels_techniques
mov dl, 0x2c
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.RDTSC_VMEXIT
mov dl, 0x2d
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.loaded_DLLs
mov dl, 0x21
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.QEMU_CPU_brand
mov dl, 0x2e
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.BOCHS_CPU_techniques
mov dl, 0x2f
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.VirtualPC_motherboard
mov dl, 0x30
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.BIOS_serial_number
mov dl, 0x33
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.Hyper_V_registry
mov dl, 0x32
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.Hyper_V_WMI_output
mov dl, 0x31
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.VirtualBox_shared_folders
mov dl, 0x34
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.MSSMBIOS
mov dl, 0x35
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.MacOS_hw.memsize
mov dl, 0x36
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.MacOS_registry_IO_kit
mov dl, 0x37
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.IO_registry_grep
mov dl, 0x38
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.MacOS_SIP
mov dl, 0x39
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.KVM_registries
mov dl, 0x22
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.KVM_drivers
mov dl, 0x23
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.KVM_directories
mov dl, 0x24
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.HKLM_registries
mov dl, 0x3a
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.Audio_device
mov dl, 0x25
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.qemu_ga_process
mov dl, 0x3b
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.MSR_validity
mov dl, 0x3c
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.QEMU_processes
mov dl, 0x3d
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.QEMU_directories
mov dl, 0x26
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.VPC_processes
mov dl, 0x3e
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.VPC_invalid_instructions
mov dl, 0x3f
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.SIDT
mov dl, 0x40
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.SGDT
mov dl, 0x41
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.SLDT
mov dl, 0x42
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.Offensive_Security_SIDT
mov dl, 0x43
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.Offensive_Security_SGDT
mov dl, 0x44
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.Offensive_Security_SLDT
mov dl, 0x45
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.VirtualPC_SIDT
mov dl, 0x48
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.Hyper_V_motherboard
mov dl, 0x46
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.Extra_VM_files
mov dl, 0x47
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str._proc_iomem_file
mov dl, 0x49
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str._proc_ioports_file
mov dl, 0x4a
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str._proc_scsi_scsi_file
mov dl, 0x4b
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.VMware_dmesg
mov dl, 0x4c
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.STR_instruction
mov dl, 0x4d
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.VMware_IO_port_backdoor
mov dl, 0x4e
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.VMware_port_memory
mov dl, 0x4f
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.SMSW_instruction
mov dl, 0x50
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.mutex_strings
mov dl, 0x51
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.uptime
mov dl, 0x52
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.unusual_thread_count
mov dl, 0x53
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.Intel_thread_count_mismatch
mov dl, 0x54
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.Intel_Xeon_thread_count_mismatch
mov dl, 0x55
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.VM_memory_regions
mov dl, 0x56
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.CPUID_bitset
mov dl, 0x57
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.Cuckoo_directory
mov dl, 0x58
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.Cuckoo_pipe
mov dl, 0x59
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.Hyper_V_Azure_hostname
mov dl, 0x5a
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.general_VM_hostnames
mov dl, 0x5b
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.screen_resolution
mov dl, 0x5c
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.bogus_device_string
mov dl, 0x5d
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.mouse_device
mov dl, 0x27
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.BlueStacks_folders
mov dl, 0x5e
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.CPUID_signatures
mov dl, 0x5f
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.Hyper_V_CPUID_reserved_bitmask
mov dl, 0x60
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.KVM_CPUID_reserved_bitmask
mov dl, 0x61
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea r8, str.Intel_KGT_signature
mov dl, 0x62
lea rcx, [rsp + 0x48]
call fcn.14000e6b0
lea rcx, [0x14003fbfc]
call fcn.140033f00
movzx r8d, bl
mov dl, 0x69
lea rcx, [rbp + 8]
call fcn.14000a370
nop
lea rdx, str.VM_brand:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004de0
mov rsi, rax
lea rcx, [rbp + 8]
cmp qword [rbp + 0x20], 0xf
cmova rcx, qword [rbp + 8]
mov r8, qword [rbp + 0x18]
cmp r8, 7
jne 0x14001ac61
lea rdx, str.Unknown
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001ac61
mov al, 1
jmp 0x14001ac63
xor al, al
mov rdx, r14
test al, al
cmovne rdx, rdi
mov rcx, rsi
call fcn.140004de0
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 0xf
cmova rdx, qword [rbp + 8]
mov r8, qword [rbp + 0x18]
mov rcx, rax
call fcn.1400070b0
lea rdx, str.e_0m
mov rcx, rax
call fcn.140004de0
mov rcx, rax
lea rdx, [0x14003fbfc]
call fcn.140004de0
xor r8d, r8d
lea rdx, str._or
lea rcx, [rbp + 8]
call fcn.1400192b0
cmp rax, 0xffffffffffffffff
jne 0x14001ada6
movzx r8d, bl
mov dl, 0x69
lea rcx, [rbp + 0x1a8]
call fcn.14000a370
nop
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp - 0x18]
call fcn.14002de20
nop
lea rdx, str.VM_type:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004de0
lea rcx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rcx, qword [rbp - 0x18]
mov r8, qword [rbp - 8]
cmp r8, 7
jne 0x14001ad48
lea rdx, str.Unknown
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001ad48
mov rdx, rdi
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004de0
mov rcx, rax
lea rdx, str.Unknown
call fcn.140004de0
jmp 0x14001ad71
mov rdx, r14
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004de0
lea rdx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 8]
mov rcx, rax
call fcn.1400070b0
lea rdx, str.e_0m
mov rcx, rax
call fcn.140004de0
lea rdx, [0x14003fbfc]
mov rcx, rax
call fcn.140004de0
nop
lea rcx, [rbp - 0x18]
call fcn.14000dc10
nop
lea rcx, [rbp + 0x1a8]
call fcn.14000dc10
xorps xmm0, xmm0
movups xmmword [0x1400498a0], xmm0
lea rsi, vtable.VM::core::TestUint8Handler.0
mov qword [rbp - 0x78], rsi
movzx edx, r15b
lea rcx, [rbp - 0x78]
call fcn.14001c060
mov qword [rsp + 0x48], rsi
movzx edx, bl
lea rcx, [rsp + 0x48]
call fcn.14001c060
lea rcx, [0x1400498a0]
call fcn.140019440
movups xmm6, xmmword [0x1400498a0]
movups xmmword [rbp - 0x78], xmm6
mov dl, 1
lea rcx, [rbp - 0x78]
call fcn.14002d4c0
nop
psrldq xmm6, 8
movq rcx, xmm6
movabs rdx, 0x2000000000
and rcx, rdx
mov ecx, 0x12c
mov edx, 0x96
cmove cx, dx
cmp ax, cx
jb 0x14001ae2c
mov r14b, 0x64
jmp 0x14001ae3d
movzx r14d, al
mov ecx, 0x63
cmp ax, 0x64
cmovae r14d, ecx
lea rcx, [rbp - 0x78]
call fcn.14001f180
mov esi, r13d
movzx ecx, r14b
test al, al
cmove esi, ecx
test sil, sil
jne 0x14001ae5c
mov r14, rdi
jmp 0x14001ae90
cmp sil, 0x19
jae 0x14001ae6b
lea r14, str.e_38_2_247_127_40m
jmp 0x14001ae90
cmp sil, 0x32
jae 0x14001ae7a
lea r14, str.e_38_2_255_180_5m
jmp 0x14001ae90
lea r14, str.e_38_2_174_197_59m
cmp sil, 0x4b
lea rax, str.e_38_2_94_214_114m
cmovae r14, rax
lea rdx, str.VM_likeliness:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004de0
mov rcx, rax
mov rdx, r14
call fcn.140004de0
movzx edx, sil
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int____ptr64]
mov rcx, rax
lea rdx, [0x140040454]
call fcn.140004de0
lea rdx, str.e_0m
mov rcx, rax
call fcn.140004de0
mov rcx, rax
lea rdx, [0x14003fbfc]
call fcn.140004de0
xorps xmm0, xmm0
movups xmmword [0x1400498a0], xmm0
lea r14, vtable.VM::core::TestUint8Handler.0
mov qword [rsp + 0x48], r14
movzx edx, r15b
lea rcx, [rsp + 0x48]
call fcn.14001c060
mov qword [rbp - 0x78], r14
movzx edx, bl
lea rcx, [rbp - 0x78]
call fcn.14001c060
lea rcx, [0x1400498a0]
call fcn.140019440
movups xmm6, xmmword [0x1400498a0]
movups xmmword [rbp - 0x78], xmm6
mov dl, 1
lea rcx, [rbp - 0x78]
call fcn.14002d4c0
nop
psrldq xmm6, 8
movq rcx, xmm6
movabs rdx, 0x2000000000
and rcx, rdx
je 0x14001af62
mov ecx, 0x12c
cmp ax, cx
jmp 0x14001af66
cmp ax, 0x64
setae r14b
lea rcx, [rbp - 0x78]
call fcn.14001f180
mov ebx, r13d
movzx ecx, r14b
test al, al
cmove ebx, ecx
lea rdx, str.VM_confirmation:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004de0
mov rdx, rdi
test bl, bl
lea r14, str.e_38_2_94_214_114m
cmovne rdx, r14
mov rcx, rax
call fcn.140004de0
lea rdx, [0x140017010]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
movzx edx, bl
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___bool____ptr64]
lea rdx, [0x14002c1a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
lea rdx, str.e_0m
mov rcx, rax
call fcn.140004de0
mov rcx, rax
lea rdx, [0x14003fbfc]
call fcn.140004de0
movzx ecx, byte [0x1400498b4]
test ecx, ecx
je 0x14001b033
sub ecx, 1
je 0x14001b02a
sub ecx, 1
je 0x14001b021
sub ecx, 1
je 0x14001b021
cmp ecx, 1
je 0x14001b018
mov rbx, r14
jmp 0x14001b036
lea rbx, str.e_38_2_174_197_59m
jmp 0x14001b036
lea rbx, str.e_38_2_255_180_5m
jmp 0x14001b036
lea rbx, str.e_38_2_247_127_40m
jmp 0x14001b036
mov rbx, rdi
lea rdx, str.VM_detections:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004de0
mov rcx, rax
mov rdx, rbx
call fcn.140004de0
movzx edx, byte [0x1400498b4]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int____ptr64]
mov rcx, rax
lea rdx, [0x140040480]
call fcn.140004de0
mov edx, 0x64
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int____ptr64]
lea rdx, str.e_0m
mov rcx, rax
call fcn.140004de0
mov rcx, rax
lea rdx, [0x14004047c]
call fcn.140004de0
movups xmm0, xmmword [0x140049900]
movups xmmword [rbp - 0x78], xmm0
mov rax, qword [0x140049918]
cmp rax, 0x64
je 0x14001b0ce
cmp rax, 0x63
jne 0x14001b0e7
mov rax, qword [0x140049890]
shr rax, 0x10
not al
test al, 1
je 0x14001b0e7
psrldq xmm0, 8
movq rax, xmm0
movabs rcx, 0x1000000000
and rax, rcx
je 0x14001b0f2
xor edx, edx
lea rcx, [rbp - 0x78]
call fcn.14002d4c0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.140016690
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x38], rax
mov r8, rax
mov rdx, qword [0x1400498b8]
mov rdx, qword [rdx + 8]
lea rcx, [rsp + 0x38]
call fcn.140005b60
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 8], rax
mov rax, qword [0x1400498c0]
mov qword [rsp + 0x40], rax
mov r8, qword [rsp + 0x38]
mov rdx, qword [r8 + 8]
cmp byte [rdx + 0x19], 0
jne 0x14001b1c3
mov rcx, qword [rdx]
cmp byte [rcx + 0x19], 0
jne 0x14001b18f
nop dword [rax]
mov rdx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x14001b180
mov qword [r8], rdx
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rdx + 8]
mov rax, qword [rcx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x14001b1bd
nop word [rax + rax]
mov rcx, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
je 0x14001b1b0
mov qword [rdx + 0x10], rcx
jmp 0x14001b1cf
mov qword [r8], r8
mov rax, qword [rsp + 0x38]
mov qword [rax + 0x10], rax
test sil, sil
je 0x14001b22a
cmp sil, 0xc
jbe 0x14001b22a
cmp sil, 0x19
ja 0x14001b1e9
lea rdi, str.e_38_2_247_127_40m
jmp 0x14001b22a
cmp sil, 0x32
jae 0x14001b1f8
lea rdi, str.e_38_2_247_127_40m
jmp 0x14001b22a
cmp sil, 0x3e
ja 0x14001b207
lea rdi, str.e_38_2_255_180_5m
jmp 0x14001b22a
cmp sil, 0x4b
ja 0x14001b216
lea rdi, str.e_38_2_174_197_59m
jmp 0x14001b22a
mov rdi, r14
cmp sil, 0x64
jb 0x14001b22a
lea rax, [0x14003ebdd]
cmovne rdi, rax
lea r8, [rbp + 8]
movzx edx, sil
lea rcx, [rbp + 0x168]
call fcn.14002a9b0
nop
lea rdx, str.e_1m
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004de0
mov rcx, rax
lea rdx, str._CONCLUSION:
call fcn.140004de0
lea rdx, str.e_0m
mov rcx, rax
call fcn.140004de0
mov rcx, rax
mov rdx, rdi
call fcn.140004de0
lea rdx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0xf
cmova rdx, qword [rbp + 0x168]
mov r8, qword [rbp + 0x178]
mov rcx, rax
call fcn.1400070b0
lea rdx, [0x1400404a0]
mov rcx, rax
call fcn.140004de0
lea rdx, str.e_0m
mov rcx, rax
call fcn.140004de0
lea rdx, str.e_1m
mov rcx, rax
call fcn.140004de0
mov rcx, rax
lea rdx, str.
call fcn.140004de0
lea rdx, str.e_0m
mov rcx, rax
call fcn.140004de0
mov rcx, rax
lea rdx, [0x14004047c]
call fcn.140004de0
cmp r15b, 0x66
jne 0x14001b425
xor r14b, r14b
xor r15b, r15b
xor sil, sil
mov rbx, qword [rsp + 0x38]
mov rbx, qword [rbx]
mov rax, rbx
mov qword [rbp - 0x78], rbx
cmp byte [rbx + 0x19], sil
jne 0x14001b425
nop word [rax + rax]
lea rdx, str.Microsoft_Hyper_V
mov rdi, qword [rax + 0x20]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14001b34c
mov r14b, 1
jmp 0x14001b367
lea rdx, str.Virtual_PC
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14001b364
mov r15b, 1
jmp 0x14001b367
mov sil, 1
lea rcx, [rbp - 0x78]
call fcn.14000e460
mov rax, qword [rbp - 0x78]
cmp byte [rax + 0x19], 0
je 0x14001b330
test r14b, r14b
jne 0x14001b391
test r15b, r15b
je 0x14001b425
test sil, sil
je 0x14001b425
test sil, sil
jne 0x14001b425
xor dil, dil
mov qword [rbp - 0x78], rbx
cmp byte [rbx + 0x19], dil
jne 0x14001b425
nop dword [rax + rax]
lea rdx, str.Microsoft_Hyper_V
mov rbx, qword [rbx + 0x20]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14001b3da
lea rdx, str.Virtual_PC
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14001b3dd
mov dil, 1
lea rcx, [rbp - 0x78]
call fcn.14000e460
mov rbx, qword [rbp - 0x78]
cmp byte [rbx + 0x19], 0
je 0x14001b3b0
test dil, dil
je 0x14001b425
test r12b, r12b
jne 0x14001b491
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
cmova rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400070b0
lea rdx, str._If_you_know_you_are_running_on_host__Hyper_V_virtualises_all_applications_by_default_within_the_host_system._This_result_is_in_fact_correct_and_NOT_a_false_positive._If_you_do_not_want_Hyper_Vs_default_virtualisation_to_affect_the_result__disable_Hyper_V_in_your_system._See_here_for_more_information_https:__github.com_kernelwernel_VMAware_issues_75_n_n
jmp 0x14001b488
test r12b, r12b
jne 0x14001b491
mov eax, dword [0x1400498b0]
shr eax, 0xc
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test al, 1
jne 0x14001b46a
lea rdx, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0xf
cmova rdx, qword [rbp + 0x188]
mov r8, qword [rbp + 0x198]
call fcn.1400070b0
lea rdx, str.To_enable_spoofable_techniques__run_with_the____spoofable__argument_n_n
jmp 0x14001b488
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
cmova rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
call fcn.1400070b0
lea rdx, str._If_you_found_a_false_positive__please_make_sure_to_create_an_issue_at_https:__github.com_kernelwernel_VMAware_issues_n_n
mov rcx, rax
call fcn.140004de0
nop
lea rcx, [rbp + 0x168]
call fcn.14000dc10
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.140006250
nop
lea rcx, [rbp + 8]
call fcn.14000dc10
nop
lea rcx, [rbp + 0x188]
call fcn.14000dc10
nop
psrldq xmm8, 8
movq r8, xmm8
cmp r8, 0xf
jbe 0x14001b4e8
movq rdx, xmm9
lea rcx, [rbp + 0x1c8]
call fcn.140012110
nop
mov r8, qword [rbp - 0x20]
cmp r8, 0xf
jbe 0x14001b4ff
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x38]
call fcn.140012110
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
mov r8, qword [rbp + 0x60]
cmp r8, 0xf
jbe 0x14001b526
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x48]
call fcn.140012110
movdqu xmmword [rbp + 0x58], xmm7
mov byte [rbp + 0x48], 0
mov r8, qword [rbp + 0x80]
cmp r8, 0xf
jbe 0x14001b549
mov rdx, qword [rbp + 0x68]
lea rcx, [rbp + 0x68]
call fcn.140012110
movdqu xmmword [rbp + 0x78], xmm7
mov byte [rbp + 0x68], 0
mov r8, qword [rbp + 0x120]
cmp r8, 0xf
jbe 0x14001b572
mov rdx, qword [rbp + 0x108]
lea rcx, [rbp + 0x108]
call fcn.140012110
mov rcx, qword [rbp + 0x228]
xor rcx, rsp
call fcn.140034930
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret