Function at 0x140001440
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check if file exists
Check if process is running under wine
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get common file path
Get file attributes
Get ntdll base address
Get program files directory
Get system information on windows
Query environment variable
Send icmp echo request
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x710]
sub rsp, 0x810
mov rax, qword [0x140045040]
xor rax, rsp
mov qword [rbp + 0x700], rax
movsxd rsi, ecx
xor r12d, r12d
mov r15, rdx
cmp esi, 1
jle 0x140001532
cmp rsi, 1
jbe 0x1400015dc
mov edi, 1
lea r13, str.__check
lea ebx, [rdi + 1]
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [r15 + rdi*8]
mov rcx, r12
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rcx + r13 - 1]
jne 0x140001521
cmp rcx, 8
jne 0x1400014c0
cmp ebx, esi
jge 0x140001521
mov rdx, qword [r15 + rdi*8 + 8]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r12
mov r8, 0xffffffffffffffff
mov qword [rbp + 0xc8], r12
nop dword [rax]
inc r8
cmp byte [rdx + r8], r12b
jne 0x140001500
lea rcx, [rbp + 0xb0]
call fcn.1400039b0
lea rcx, [rbp + 0xb0]
call fcn.140001020
add ebx, 2
add rdi, 2
cmp rdi, rsi
jl 0x1400014b0
jmp 0x1400015dc
mov dword [0x14005e1b4], 1
mov dword [0x14005e1b0], 1
mov dword [0x14005e1ac], 1
mov dword [0x14005e1a8], 1
mov dword [0x14005e1a4], 1
mov dword [0x14005e1a0], 1
mov dword [0x14005e19c], 1
mov dword [0x14005e198], 1
mov dword [0x14005e194], 1
mov dword [0x14005e190], 1
mov dword [0x14005e18c], 1
mov dword [0x14005e188], 1
mov dword [0x14005e184], 1
mov dword [0x14005e17c], 1
mov dword [0x14005e178], 1
mov dword [0x14005e174], 1
mov dword [0x14005e170], 1
lea rcx, str.Al_Khaser___by_Lord_Noteworthy
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 0x64
mov dword [rsp + 0x28], 1
mov r8d, edx
mov dword [rsp + 0x20], 0x384
mov r9d, 0x384
mov rcx, rax
call qword [sym.imp.USER32.dll_MoveWindow]
lea rcx, str._al_khaser_version_0.82_
call fcn.140003790
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rsp + 0x48]
mov ecx, SafeArrayGetElement
mov rbx, rax
lea rdx, [rsp + 0x48]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edi, word [rsp + 0x50]
mov edx, 0xd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Initialisation
lea rcx, str._n___________________________s___________________________n
call fcn.140003790
movzx edx, di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r13d, r12d
lea rsi, [0x14005d1ec]
nop dword [rax + rax]
mov r15d, dword [rsi + 4]
xor al, al
test dword [rsi - 4], 0xfffffffd
mov r12d, dword [rsi]
jne 0x140001741
xor r14b, r14b
lea rdi, [0x14005d7a8]
xor ebx, ebx
lea rcx, [0x14005d878]
nop dword [rax]
test rbx, rbx
je 0x1400016d7
cmp dword [rdi - 8], r12d
jne 0x1400016d7
mov r14b, 1
call qword [rdi]
lea rcx, [0x14005d878]
inc rbx
add rdi, 0x10
cmp rdi, rcx
jl 0x1400016c0
test r14b, r14b
jne 0x1400016f1
lea rcx, str.ERROR:_Minimum_version_value_was_invalid._n
jmp 0x14000173a
test al, al
je 0x14000173f
test r15d, r15d
jne 0x1400016fe
mov al, 1
jmp 0x140001741
xor bl, bl
lea rdi, [0x14005d7a8]
xor al, al
nop dword [rax]
cmp dword [rdi - 8], r15d
jne 0x140001726
mov bl, 1
call qword [rdi]
test al, al
lea rcx, [0x14005d878]
sete al
add rdi, 0x10
cmp rdi, rcx
jl 0x140001710
test bl, bl
jne 0x140001741
lea rcx, str.ERROR:_Removed_version_value_was_invalid._n
call fcn.140003720
xor al, al
mov rcx, qword [rsi - 0x14]
mov byte [rsi + 9], al
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x140001758
mov byte [rsi + 8], al
jmp 0x140001772
mov rdx, qword [rsi - 0xc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rsi + 0xc], rax
setne al
mov byte [rsi + 8], al
inc r13d
add rsi, 0x30
cmp r13d, 0x1f
jb 0x140001690
xor r13d, r13d
lea rcx, [rbp + 0x2e2]
xor edx, edx
mov word [rbp + 0x2e0], r13w
mov r8d, 0x206
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x2e0]
call fcn.1400155e0
test eax, eax
je 0x1400017c5
lea rdx, [rbp + 0x2e0]
lea rcx, str._n___You_are_running:__s_n
call fcn.140003790
mov esi, r13d
lea rdi, [0x14005d1f4]
mov ebx, r13d
cmp byte [rdi + 1], r13b
je 0x1400017f3
cmp byte [rdi], r13b
jne 0x1400017f3
mov r8, qword [rdi - 0x14]
lea rcx, str.___Warning:_API__s__s_was_expected_to_exist_but_was_not_found._n
mov rdx, qword [rdi - 0x1c]
call fcn.140003720
inc esi
inc ebx
add rdi, 0x30
cmp ebx, 0x1f
jb 0x1400017d2
test esi, esi
jne 0x14000180e
lea rcx, str.___All_APIs_present_and_accounted_for._n
call fcn.140003720
call fcn.1400152f0
test eax, eax
je 0x140001823
lea rcx, str.Process_is_running_under_WOW64_n_n
call fcn.140003790
cmp dword [0x14005e1b0], r13d
je 0x14000192f
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [rsp + 0x64]
lea r8, [rsp + 0x40]
xorps xmm0, xmm0
lea rdx, [0x140003c60]
mov ecx, 4
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x14000192f
mov rdi, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetElement
lea r8, [rbp + 0xb0]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x14000192f
mov rbx, r13
cmp dword [rbp + 0xb8], ebx
jbe 0x14000192f
mov rdi, qword [rbp + 0xb0]
nop dword [rax + rax]
mov r8d, 0x30
lea rdx, [rbp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
jb 0x14000191e
mov eax, dword [rbp + 0xa4]
test al, 0x10
jne 0x1400018f2
test al, 0x20
jne 0x1400018f2
test al, al
js 0x1400018f2
test al, 0x40
je 0x14000191e
mov rdx, qword [0x14005e1d8]
cmp rdx, qword [0x14005e1e0]
mov qword [rsp + 0x48], rdi
je 0x140001914
mov qword [rdx], rdi
add qword [0x14005e1d8], 8
jmp 0x14000191e
lea r8, [rsp + 0x48]
call fcn.140003e50
mov eax, dword [rbp + 0xb8]
add rbx, rsi
add rdi, rsi
cmp rbx, rax
jb 0x1400018c0
lea rdx, str.Checking_Win32_PortConnector_with_WMI
lea rcx, [0x1400044b0]
call fcn.140008540
lea rdx, str.Checking_Win32_SMBIOSMemory_with_WMI
lea rcx, [0x1400044d0]
call fcn.140008540
lea rdx, str.Checking_ThermalZoneInfo_performance_counters_with_WMI
lea rcx, [0x1400044f0]
call fcn.140008540
lea rdx, str.Checking_CIM_Memory_with_WMI
lea rcx, [0x140004510]
call fcn.140008540
lea rdx, str.Checking_CIM_Sensor_with_WMI
lea rcx, [0x140004570]
call fcn.140008540
lea rdx, str.Checking_CIM_NumericSensor_with_WMI
lea rcx, [0x140004530]
call fcn.140008540
lea rdx, str.Checking_CIM_TemperatureSensor_with_WMI
lea rcx, [0x1400045b0]
call fcn.140008540
lea rdx, str.Checking_CIM_VoltageSensor_with_WMI
lea rcx, [0x1400045d0]
call fcn.140008540
lea rdx, str.Checking_CIM_PhysicalConnector_with_WMI
lea rcx, [0x140004550]
call fcn.140008540
lea rdx, str.Checking_CIM_Slot_with_WMI
lea rcx, [0x140004590]
call fcn.140008540
lea rdx, str.Checking_if_Windows_is_Genuine
lea rcx, [0x1400045f0]
call fcn.140008540
lea rdx, str.Checking_ServicesDiskEnum_entries_for_VM_strings
lea rcx, [0x140004670]
call fcn.140008540
lea rdx, str.Checking_EnumIDE_and_EnumSCSI_entries_for_VM_strings
lea rcx, [0x140004810]
call fcn.140008540
lea rdx, str.Checking_SMBIOS_tables
lea rcx, [0x140004a40]
call fcn.140008540
cmp dword [0x14005e1a4], r13d
lea rsi, [0x14003a260]
mov r15d, 5
lea rdi, str.Identifier
lea rbx, str.HARDWAREDescriptionSystem
lea r14, str.SystemBiosVersion
lea r12d, [r15 - 2]
je 0x1400020a6
lea rcx, str.VirtualBox_Detection
call fcn.140008250
lea rax, str.VBOX
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], rax
lea rsi, [rsp + 0x68]
mov qword [rbp - 0x78], rax
lea rax, str.VideoBiosVersion
mov qword [rbp - 0x68], rax
lea rax, str.VIRTUALBOX
mov qword [rbp - 0x60], rax
lea rax, str.SystemBiosDate
mov qword [rbp - 0x50], rax
lea rax, str.06_23_99
mov qword [rbp - 0x80], r14
lea r14d, [r15 - 1]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x58], rbx
nop dword [rax + rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov rdi, qword [rsi + 8]
lea r8, str.Checking_reg_key_HARDWAREDescriptionSystem____s_is_set_to__s
mov r9, qword [rsi]
lea rcx, [rbp + 0xe0]
mov edx, 0x100
mov qword [rsp + 0x20], rdi
call fcn.140003b10
mov r8, qword [rsi]
mov r9, rdi
mov rdx, qword [rsi - 8]
call fcn.1400153b0
test eax, eax
lea rdx, [rbp + 0xe0]
mov ecx, r13d
setne cl
call fcn.140008420
lea rsi, [rsi + 0x18]
sub r14, 1
jne 0x140001ae0
lea rdx, str.Checking_VirtualBox_Guest_Additions_directory
lea rcx, [0x140004f60]
call fcn.140008540
lea rax, str.System32driversVBoxMouse.sys
mov word [rbp + 0x4f0], r13w
mov qword [rsp + 0x60], rax
lea rcx, [rbp + 0x4f2]
lea rax, str.System32driversVBoxGuest.sys
xor edx, edx
mov qword [rsp + 0x68], rax
mov r8d, 0x206
lea rax, str.System32driversVBoxSF.sys
mov qword [rsp + 0x70], rax
lea rax, str.System32driversVBoxVideo.sys
mov qword [rsp + 0x78], rax
lea rax, str.System32_vboxdisp.dll
mov qword [rbp - 0x80], rax
lea rax, str.System32_vboxhook.dll
mov qword [rbp - 0x78], rax
lea rax, str.System32_vboxmrxnp.dll
mov qword [rbp - 0x70], rax
lea rax, str.System32_vboxogl.dll
mov qword [rbp - 0x68], rax
lea rax, str.System32_vboxoglarrayspu.dll
mov qword [rbp - 0x60], rax
lea rax, str.System32_vboxoglcrutil.dll
mov qword [rbp - 0x58], rax
lea rax, str.System32_vboxoglerrorspu.dll
mov qword [rbp - 0x50], rax
lea rax, str.System32_vboxoglfeedbackspu.dll
mov qword [rbp - 0x48], rax
lea rax, str.System32_vboxoglpackspu.dll
mov qword [rbp - 0x40], rax
lea rax, str.System32_vboxoglpassthroughspu.dll
mov qword [rbp - 0x38], rax
lea rax, str.System32_vboxservice.exe
mov qword [rbp - 0x30], rax
lea rax, str.System32_vboxtray.exe
mov qword [rbp - 0x28], rax
lea rax, str.System32VBoxControl.exe
mov qword [rbp - 0x20], rax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov word [rbp + 0x2e0], r13w
mov r8d, 0x206
lea rcx, [rbp + 0x2e2]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x104
mov qword [rsp + 0x40], r13
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call fcn.1400152f0
test eax, eax
je 0x140001c82
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov rdi, r13
nop word [rax + rax]
mov r8, qword [rsp + rdi*8 + 0x60]
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x2e0]
mov edx, 0x100
lea r8, str.Checking_file__s
lea rcx, [rbp + 0xe0]
call fcn.140003b10
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140001cff
mov ecx, 1
test al, 0x10
je 0x140001d02
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140008420
inc rdi
cmp rdi, 0x11
jl 0x140001c90
call fcn.1400152f0
test eax, eax
je 0x140001d2f
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
lea rax, str.HARDWAREACPIDSDTVBOX__
mov esi, 9
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x60]
lea rax, str.HARDWAREACPIFADTVBOX__
mov qword [rsp + 0x68], rax
lea rax, str.HARDWAREACPIRSDTVBOX__
mov qword [rsp + 0x70], rax
lea rax, str.SOFTWAREOracleVirtualBox_Guest_Additions
mov qword [rsp + 0x78], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxGuest
mov qword [rbp - 0x80], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxMouse
mov qword [rbp - 0x78], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxService
mov qword [rbp - 0x70], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxSF
mov qword [rbp - 0x68], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxVideo
mov qword [rbp - 0x60], rax
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, [0x140039ee0]
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.140003b10
mov rdx, qword [rbx]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x40], r13
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001e15
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 1
jmp 0x140001e18
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140008420
add rbx, 8
sub rsi, 1
jne 0x140001da0
lea rdx, str.Checking_Mac_Address_start_with_08:00:27
lea rcx, [0x140005080]
call fcn.140008540
lea rdx, str.Checking_MAC_address__Hybrid_Analysis_
lea rcx, [0x1400042d0]
call fcn.140008540
lea rax, [0x14003ac70]
mov r14, r15
mov qword [rbp + 0xb0], rax
lea rbx, [rbp + 0xb0]
lea rax, str..VBoxGuest
mov qword [rbp + 0xb8], rax
lea rax, str..pipeVBoxMiniRdDN
mov qword [rbp + 0xc0], rax
lea rax, str..VBoxTrayIPC
mov qword [rbp + 0xc8], rax
lea rax, str..pipeVBoxTrayIPC
mov qword [rbp + 0xd0], rax
nop dword [rax + rax]
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], r12d
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
mov rsi, rax
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, str.Checking_device__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.140003b10
cmp rsi, 0xffffffffffffffff
je 0x140001f27
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 1
jmp 0x140001f2a
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140008420
add rbx, 8
sub r14, 1
jne 0x140001eb0
lea rdx, str.Checking_VBoxTrayToolWndClass___VBoxTrayToolWnd
lea rcx, [0x140005090]
call fcn.140008540
lea rdx, str.Checking_VirtualBox_Shared_Folders_network_provider
lea rcx, [0x1400050e0]
call fcn.140008540
lea rax, str.vboxservice.exe
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x48]
lea rax, str.vboxtray.exe
mov qword [rsp + 0x50], rax
lea esi, [r14 + 2]
nop dword [rax + rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, str.Checking_VirtualBox_process__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.140003b10
mov rcx, qword [rbx]
call fcn.1400173d0
test eax, eax
lea rdx, [rbp + 0xe0]
mov ecx, r13d
setne cl
call fcn.140008420
lea rbx, [rbx + 8]
sub rsi, 1
jne 0x140001f90
lea rdx, str.Checking_Win32_PnPDevice_DeviceId_from_WMI_for_VBox_PCI_device
lea rcx, [0x140005910]
call fcn.140008540
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBox_controller_hardware
lea rcx, [0x140005b40]
call fcn.140008540
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBOX_names
lea rcx, [0x1400062a0]
call fcn.140008540
lea rdx, str.Checking_Win32_Bus_from_WMI
lea rcx, [0x140005da0]
call fcn.140008540
lea rdx, str.Checking_Win32_BaseBoard_from_WMI
lea rcx, [0x140006000]
call fcn.140008540
lea rdx, str.Checking_MAC_address_from_WMI
lea rcx, [0x140005180]
call fcn.140008540
lea rdx, str.Checking_NTEventLog_from_WMI
lea rcx, [0x1400053b0]
call fcn.140008540
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, [0x1400056f0]
call fcn.140008540
lea rdx, str.Checking_ACPI_tables
lea rcx, [0x1400057a0]
call fcn.140008540
lea rdi, str.Identifier
lea rsi, [0x14003a260]
cmp dword [0x14005e1a0], r13d
je 0x1400025ac
lea rcx, str.VMWare_Detection
call fcn.140008250
lea rdx, str.VMWARE
mov qword [rsp + 0x60], rsi
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_1Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rax
lea rcx, str.SYSTEMControlSet001ControlSystemInformation
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_2Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rsp + 0x70], rdx
mov qword [rbp - 0x70], rax
lea rbx, [rsp + 0x70]
lea rax, str.SystemManufacturer
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x50], rax
lea rax, str.SystemProductName
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x78], rdx
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], rdx
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x30], rdx
nop
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx - 0x10]
lea r8, str.Checking_reg_key__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.140003b10
mov r9, qword [rbx]
mov r8, qword [rbx - 8]
mov rdx, qword [rbx - 0x10]
call fcn.1400153b0
test eax, eax
lea rdx, [rbp + 0xe0]
mov ecx, r13d
setne cl
call fcn.140008420
lea rbx, [rbx + 0x18]
sub r15, 1
jne 0x140002130
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREVMware__Inc.VMware_Tools
mov edx, 0x100
lea r8, [0x140039ee0]
lea rcx, [rbp + 0xe0]
call fcn.140003b10
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREVMware__Inc.VMware_Tools
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002217
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15d, 1
mov ecx, r15d
jmp 0x140002220
mov ecx, r13d
mov r15d, 1
lea rdx, [rbp + 0xe0]
call fcn.140008420
lea rax, str.System32drivers_vmnet.sys
mov word [rbp + 0x4f0], r13w
mov qword [rsp + 0x60], rax
lea rcx, [rbp + 0x4f2]
lea rax, str.System32drivers_vmmouse.sys
xor edx, edx
mov qword [rsp + 0x68], rax
mov r8d, 0x206
lea rax, str.System32drivers_vmusb.sys
mov qword [rsp + 0x70], rax
lea rax, str.System32drivers_vm3dmp.sys
mov qword [rsp + 0x78], rax
lea rax, str.System32drivers_vmci.sys
mov qword [rbp - 0x80], rax
lea rax, str.System32drivers_vmhgfs.sys
mov qword [rbp - 0x78], rax
lea rax, str.System32drivers_vmmemctl.sys
mov qword [rbp - 0x70], rax
lea rax, str.System32drivers_vmx86.sys
mov qword [rbp - 0x68], rax
lea rax, str.System32drivers_vmrawdsk.sys
mov qword [rbp - 0x60], rax
lea rax, str.System32drivers_vmusbmouse.sys
mov qword [rbp - 0x58], rax
lea rax, str.System32drivers_vmkdb.sys
mov qword [rbp - 0x50], rax
lea rax, str.System32drivers_vmnetuserif.sys
mov qword [rbp - 0x48], rax
lea rax, str.System32drivers_vmnetadapter.sys
mov qword [rbp - 0x40], rax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov word [rbp + 0x2e0], r13w
mov r8d, 0x206
lea rcx, [rbp + 0x2e2]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x104
mov qword [rsp + 0x40], r13
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call fcn.1400152f0
test eax, eax
je 0x140002322
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov rdi, r13
nop word [rax + rax]
mov r8, qword [rsp + rdi*8 + 0x60]
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x2e0]
mov edx, 0x100
lea r8, str.Checking_file__s
lea rcx, [rbp + 0xe0]
call fcn.140003b10
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000239d
mov ecx, r15d
test al, 0x10
je 0x1400023a0
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140008420
inc rdi
cmp rdi, 0xd
jl 0x140002330
call fcn.1400152f0
test eax, eax
je 0x1400023cd
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
lea rax, [0x14003b898]
mov ebx, 4
mov qword [rsp + 0x60], rax
lea rdi, [rsp + 0x60]
lea rax, [0x14003b8a0]
mov qword [rsp + 0x68], rax
lea rax, [0x14003b8b8]
mov qword [rsp + 0x70], rax
lea rax, [0x14003b8c0]
mov qword [rsp + 0x78], rax
lea rax, [0x14003b8d8]
mov qword [rbp - 0x80], rax
lea rax, str.00:1C:14
mov qword [rbp - 0x78], rax
lea rax, [0x14003b8f8]
mov qword [rbp - 0x70], rax
lea rax, [0x14003b900]
mov qword [rbp - 0x68], rax
nop dword [rax]
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi + 8]
lea r8, str.Checking_MAC_starting_with__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.140003b10
mov rcx, qword [rdi]
call fcn.1400154a0
test eax, eax
lea rdx, [rbp + 0xe0]
mov ecx, r13d
setne cl
call fcn.140008420
lea rdi, [rdi + 0x10]
sub rbx, 1
jne 0x140002440
lea rdx, str.Checking_VMWare_network_adapter_name
lea rcx, [0x140006660]
call fcn.140008540
lea rax, str..HGFS
mov r14d, 2
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x48]
lea rax, str.._vmci
mov qword [rsp + 0x50], rax
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov r8d, r15d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
mov rsi, rax
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, str.Checking_device__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.140003b10
cmp rsi, 0xffffffffffffffff
je 0x140002554
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, r15d
jmp 0x140002557
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140008420
add rbx, 8
sub r14, 1
jne 0x1400024e0
lea rdx, str.Checking_VMWare_directory
lea rcx, [0x140006580]
call fcn.140008540
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, [0x1400067c0]
call fcn.140008540
lea rdx, str.Checking_ACPI_tables
lea rcx, [0x140006840]
call fcn.140008540
jmp 0x1400025b2
mov r15d, 1
cmp dword [0x14005e19c], r13d
je 0x1400026d7
lea rcx, str.Virtual_PC_Detection
call fcn.140008250
lea rax, str.VMSrvc.exe
mov esi, 2
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x48]
lea rax, str.VMUSrvc.exe
mov qword [rsp + 0x50], rax
nop dword [rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, str.Checking_Virtual_PC_processes__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.140003b10
mov rcx, qword [rbx]
call fcn.1400173d0
test eax, eax
lea rdx, [rbp + 0xe0]
mov ecx, r13d
setne cl
call fcn.140008420
lea rbx, [rbx + 8]
sub rsi, 1
jne 0x1400025f0
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
mov edx, 0x100
lea r8, [0x140039ee0]
lea rcx, [rbp + 0xe0]
call fcn.140003b10
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400026c8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, r15d
jmp 0x1400026cb
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140008420
cmp dword [0x14005e198], r13d
je 0x140002973
lea rcx, str.QEMU_Detection
call fcn.140008250
lea rax, [0x14003a260]
mov esi, 2
mov qword [rbp + 0xb0], rax
lea rcx, str.HARDWAREDescriptionSystem
lea rax, str.Identifier
mov qword [rbp + 0xc8], rcx
mov qword [rbp + 0xb8], rax
lea rcx, str.SystemBiosVersion
lea rax, str.QEMU
mov qword [rbp + 0xd0], rcx
mov qword [rbp + 0xc0], rax
lea rbx, [rbp + 0xc0]
mov qword [rbp + 0xd8], rax
nop dword [rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx - 0x10]
lea r8, [0x140039ee0]
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.140003b10
mov r9, qword [rbx]
mov r8, qword [rbx - 8]
mov rdx, qword [rbx - 0x10]
call fcn.1400153b0
test eax, eax
lea rdx, [rbp + 0xe0]
mov ecx, r13d
setne cl
call fcn.140008420
lea rbx, [rbx + 0x18]
sub rsi, 1
jne 0x140002750
lea rax, str.qemu_ga.exe
mov qword [rbp + 0xb0], rax
lea rbx, [rbp + 0xb0]
lea rax, str.vdagent.exe
mov qword [rbp + 0xb8], rax
lea rax, str.vdservice.exe
mov qword [rbp + 0xc0], rax
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, str.Checking_qemu_processes__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.140003b10
mov rcx, qword [rbx]
call fcn.1400173d0
test eax, eax
lea rdx, [rbp + 0xe0]
mov ecx, r13d
setne cl
call fcn.140008420
lea rbx, [rbx + 8]
sub r12, 1
jne 0x1400027f0
xor edx, edx
mov word [rbp + 0x2e0], r13w
mov r8d, 0x206
lea rcx, [rbp + 0x2e2]
call sub.VCRUNTIME140.dll_memset
lea rax, str.qemu_ga
mov rdi, r13
mov qword [rsp + 0x48], rax
lea rax, str.SPICE_Guest_Tools
mov qword [rsp + 0x50], rax
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
call fcn.1400152f0
lea rdx, [rbp + 0x4f0]
test eax, eax
je 0x1400028d1
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x1400028e0
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov r8, qword [rsp + rdi*8 + 0x48]
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea r9, [rbp + 0x2e0]
mov edx, 0x100
lea r8, str.Checking_QEMU_directory__s
lea rcx, [rbp + 0xe0]
call fcn.140003b10
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002931
mov ecx, r15d
test al, 0x10
jne 0x140002934
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140008420
inc rdi
cmp rdi, 2
jl 0x140002890
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, [0x140004dc0]
call fcn.140008540
lea rdx, str.Checking_ACPI_tables
lea rcx, [0x140004e40]
call fcn.140008540
cmp dword [0x14005e190], r13d
je 0x1400029f6
lea rcx, str.Xen_Detection
call fcn.140008250
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.xenservice.exe
mov edx, 0x100
lea r8, str.Checking_Citrix_Xen_process__s
lea rcx, [rbp + 0xe0]
call fcn.140003b10
lea rcx, str.xenservice.exe
call fcn.1400173d0
test eax, eax
lea rdx, [rbp + 0xe0]
mov ecx, r13d
setne cl
call fcn.140008420
lea rdx, str.Checking_Mac_Address_start_with_08:16:3E
lea rcx, [0x1400069b0]
call fcn.140008540
cmp dword [0x14005e194], r13d
je 0x140002c93
lea rcx, str.Xen_Detection
call fcn.140008250
lea rax, str.System32drivers_balloon.sys
mov word [rbp + 0x4f0], r13w
mov qword [rsp + 0x60], rax
lea rcx, [rbp + 0x4f2]
lea rax, str.System32drivers_netkvm.sys
xor edx, edx
mov qword [rsp + 0x68], rax
mov r8d, 0x206
lea rax, str.System32driverspvpanic.sys
mov qword [rsp + 0x70], rax
lea rax, str.System32drivers_viofs.sys
mov qword [rsp + 0x78], rax
lea rax, str.System32drivers_viogpudo.sys
mov qword [rbp - 0x80], rax
lea rax, str.System32drivers_vioinput.sys
mov qword [rbp - 0x78], rax
lea rax, str.System32drivers_viorng.sys
mov qword [rbp - 0x70], rax
lea rax, str.System32drivers_vioscsi.sys
mov qword [rbp - 0x68], rax
lea rax, str.System32drivers_vioser.sys
mov qword [rbp - 0x60], rax
lea rax, str.System32drivers_viostor.sys
mov qword [rbp - 0x58], rax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov word [rbp + 0x2e0], r13w
mov r8d, 0x206
lea rcx, [rbp + 0x2e2]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x104
mov qword [rsp + 0x40], r13
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call fcn.1400152f0
test eax, eax
je 0x140002ae4
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov rdi, r13
nop word [rax + rax]
mov r8, qword [rsp + rdi*8 + 0x60]
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x2e0]
mov edx, 0x100
lea r8, str.Checking_file__s
lea rcx, [rbp + 0xe0]
call fcn.140003b10
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002b5d
mov ecx, r15d
test al, 0x10
je 0x140002b60
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140008420
inc rdi
cmp rdi, 0xa
jl 0x140002af0
call fcn.1400152f0
test eax, eax
je 0x140002b8d
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
lea rax, str.SYSTEMControlSet001Services_vioscsi
mov esi, 7
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x60]
lea rax, str.SYSTEMControlSet001Services_viostor
mov qword [rsp + 0x68], rax
lea rax, str.SYSTEMControlSet001ServicesVirtIO_FS_Service
mov qword [rsp + 0x70], rax
lea rax, str.SYSTEMControlSet001ServicesVirtioSerial
mov qword [rsp + 0x78], rax
lea rax, str.SYSTEMControlSet001ServicesBALLOON
mov qword [rbp - 0x80], rax
lea rax, str.SYSTEMControlSet001ServicesBalloonService
mov qword [rbp - 0x78], rax
lea rax, str.SYSTEMControlSet001Services_netkvm
mov qword [rbp - 0x70], rax
nop dword [rax + rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, [0x140039ee0]
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.140003b10
mov rdx, qword [rbx]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x40], r13
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002c63
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, r15d
jmp 0x140002c66
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140008420
add rbx, 8
sub rsi, 1
jne 0x140002bf0
lea rdx, str.Checking_KVM_virio_directory
lea rcx, [0x140004cc0]
call fcn.140008540
cmp dword [0x14005e18c], r13d
je 0x140002d49
lea rcx, str.Wine_Detection
call fcn.140008250
lea rdx, str.Checking_Wine_via_dll_exports
lea rcx, [0x140006960]
call fcn.140008540
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREWine
mov edx, 0x100
lea r8, [0x140039ee0]
lea rcx, [rbp + 0xe0]
call fcn.140003b10
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREWine
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002d3a
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, r15d
jmp 0x140002d3d
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140008420
cmp dword [0x14005e188], r13d
je 0x140002e00
lea rcx, str.Paralles_Detection
call fcn.140008250
lea rax, str.prl_cc.exe
mov esi, 2
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x48]
lea rax, str.prl_tools.exe
mov qword [rsp + 0x50], rax
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, str.Checking_Parallels_processes:__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.140003b10
mov rcx, qword [rbx]
call fcn.1400173d0
test eax, eax
lea rdx, [rbp + 0xe0]
mov ecx, r13d
setne cl
call fcn.140008420
lea rbx, [rbx + 8]
sub rsi, 1
jne 0x140002d90
lea rdx, str.Checking_Mac_Address_start_with_00:1C:42
lea rcx, [0x140004db0]
call fcn.140008540
cmp dword [0x14005e184], r13d
je 0x140002e3b
lea rcx, str.Hyper_V_Detection
call fcn.140008250
lea rdx, str.Checking_for_Hyper_V_driver_objects
lea rcx, [0x140004b00]
call fcn.140008540
lea rdx, str.Checking_for_Hyper_V_global_objects
lea rcx, [0x140004c00]
call fcn.140008540
cmp dword [0x14005e180], r13d
je 0x140002e5d
call fcn.1400069c0
call fcn.140007b90
call fcn.140006dd0
call fcn.140007750
call fcn.140007230
cmp dword [0x14005e17c], r13d
je 0x1400033de
lea rcx, str.Timing_attacks
call fcn.140008250
xor edx, edx
lea rcx, str._n___Delay_value_is_set_to__u_minutes_..._n
call fcn.140003720
lea rdx, str.Performing_a_sleep_using_NtDelayExecution_...
lea rcx, str.____s
call fcn.140003790
lea rdx, [0x14005d1d0]
mov qword [rsp + 0x48], 0xffffffffff676980
mov rcx, rdx
mov eax, r13d
nop dword [rax]
cmp dword [rcx], 0xd
je 0x140002ec5
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002eb0
mov ecx, r15d
jmp 0x140002f03
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], r13b
jne 0x140002eda
mov ecx, r15d
jmp 0x140002f03
mov eax, r13d
mov rcx, rdx
cmp dword [rcx], 0xd
je 0x140002f7e
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002ee0
mov rax, r13
lea rdx, [rsp + 0x48]
xor ecx, ecx
call rax
mov ecx, r13d
lea rdx, str.Performing_a_sleep_using_NtDelayExecution_...
call fcn.1400082f0
lea rdx, str.Performing_a_sleep___in_a_loop_...
lea rcx, str.____s
call fcn.140003790
mov edi, 0x3e8
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rdi, 1
jne 0x140002f27
lea rdx, str.Performing_a_sleep___in_a_loop_...
xor ecx, ecx
call fcn.1400082f0
lea rdx, str.Delaying_execution_using_SetTimer_...
lea rcx, str.____s
call fcn.140003790
lea r9, [0x140017cd0]
xor edx, edx
xor ecx, ecx
mov r8d, 0x3e8
call qword [sym.imp.USER32.dll_SetTimer]
mov rdi, rax
test rax, rax
jne 0x140002f9c
mov ecx, r15d
jmp 0x14000300e
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], r13b
je 0x140002ef4
mov rax, qword [rdx + rcx*8 + 0x28]
jmp 0x140002ef7
xor r9d, r9d
lea rcx, [rbp + 0x80]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
mov ecx, r13d
cmp dword [0x14005e1c8], ecx
sete cl
test ecx, eax
je 0x140003000
lea rcx, [rbp + 0x80]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x80]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rbp + 0x80]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
mov ecx, r13d
cmp dword [0x14005e1c8], ecx
sete cl
test ecx, eax
jne 0x140002fc1
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
mov ecx, r13d
lea rdx, str.Delaying_execution_using_SetTimer_...
call fcn.1400082f0
lea rdx, str.Delaying_execution_using_timeSetEvent_...
lea rcx, str.____s
call fcn.140003790
mov edx, 8
lea rcx, [rsp + 0x40]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
mov rax, qword [rsp + 0x40]
lea r8, [0x140017cd0]
mov edi, dword [rsp + 0x44]
test eax, eax
mov ecx, r13d
mov dword [rsp + 0x20], r13d
cmovne ecx, eax
cmp ecx, edi
cmovb edi, ecx
xor r9d, r9d
mov edx, edi
mov ecx, 0x3e8
call qword [sym.imp.WINMM.dll_timeSetEvent]
test eax, eax
jne 0x140003078
mov ecx, r15d
jmp 0x14000308b
mov ecx, eax
call qword [sym.imp.WINMM.dll_timeKillEvent]
mov ecx, edi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ecx, r13d
lea rdx, str.Delaying_execution_using_timeSetEvent_...
call fcn.1400082f0
lea rdx, str.Delaying_execution_using_WaitForSingleObject_...
lea rcx, str.____s
call fcn.140003790
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
jne 0x1400030d1
lea rcx, [0x140040498]
call fcn.140008660
mov ecx, r15d
jmp 0x1400030e2
mov edx, 0x3e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, r13d
lea rdx, str.Delaying_execution_using_WaitForSingleObject_...
call fcn.1400082f0
lea rdx, str.Delaying_execution_using_WaitForMultipleObjects_...
lea rcx, str.____s
call fcn.140003790
mov edi, r13d
lea rbx, [rsp + 0x48]
nop dword [rax]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx], rax
test rax, rax
je 0x140003150
inc edi
add rbx, 8
cmp edi, 2
jb 0x140003110
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov r9d, 0x3e8
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ecx, r13d
jmp 0x14000315f
lea rcx, [0x140040498]
call fcn.140008660
mov ecx, r15d
lea rdx, str.Delaying_execution_using_WaitForMultipleObjects_...
call fcn.1400082f0
lea rdx, str.Delaying_execution_using_IcmpSendEcho_...
lea rcx, str.____s
call fcn.140003790
movsd xmm0, qword [str.Data_Buffer]
mov eax, dword [0x1400404b8]
movsd qword [rbp + 0xb0], xmm0
xorps xmm0, xmm0
mov dword [rbp + 0xb8], eax
xor eax, eax
movups xmmword [rbp + 0xbc], xmm0
mov dword [rbp + 0xcc], eax
call qword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400031e0
lea rcx, str._tUnable_to_open_handle._n
call fcn.140003720
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.IcmpCreatefile_returned_error:__u_n
call fcn.140003720
mov ecx, r15d
jmp 0x140003254
mov ecx, 0x50
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov rcx, rdi
test rax, rax
jne 0x14000320d
call qword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
lea rcx, str._tUnable_to_allocate_memory_n
call fcn.140003720
mov ecx, r15d
jmp 0x140003254
mov dword [rsp + 0x38], 0x3e8
lea r8, [rbp + 0xb0]
mov dword [rsp + 0x30], 0x50
mov r9d, 0x20
mov qword [rsp + 0x28], rbx
mov edx, 0xffffffff
mov qword [rsp + 0x20], r13
call qword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
mov rcx, rdi
call qword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, r13d
lea rdx, str.Delaying_execution_using_IcmpSendEcho_...
call fcn.1400082f0
lea rdx, str.Delaying_execution_using_CreateWaitableTimer_...
lea rcx, str.____s
call fcn.140003790
xor r8d, r8d
mov qword [rsp + 0x48], 0xffffffffff676980
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov rbx, rax
test rax, rax
jne 0x140003297
mov edi, r15d
jmp 0x1400032e7
mov dword [rsp + 0x28], r13d
lea rdx, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
test eax, eax
jne 0x1400032be
mov edi, r15d
jmp 0x1400032d5
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov edi, r13d
cmovne edi, r15d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Delaying_execution_using_CreateWaitableTimer_...
mov ecx, edi
call fcn.1400082f0
lea rdx, str.Delaying_execution_using_CreateTimerQueueTimer_...
lea rcx, str.____s
call fcn.140003790
xor r9d, r9d
mov qword [rsp + 0x48], r13
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14005e1c0], rax
test rax, rax
jne 0x14000332e
mov edi, r13d
jmp 0x1400033aa
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
mov rbx, rax
test rax, rax
jne 0x140003341
mov edi, r15d
jmp 0x1400033aa
mov dword [rsp + 0x30], r13d
lea r8, [0x140017db0]
mov dword [rsp + 0x28], r13d
lea rcx, [rsp + 0x48]
mov r9d, 0xdeadbeef
mov dword [rsp + 0x20], 0x3e8
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
test eax, eax
jne 0x140003377
mov edi, r15d
jmp 0x140003392
mov rcx, qword [0x14005e1c0]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov edi, r13d
cmovne edi, r13d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
mov rcx, qword [0x14005e1c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Delaying_execution_using_CreateTimerQueueTimer_...
mov ecx, edi
call fcn.1400082f0
lea rdx, str.Checking_RDTSC_Locky_trick
lea rcx, [0x140017ce0]
call fcn.140008540
lea rdx, str.Checking_RDTSC_which_force_a_VM_Exit__cpuid_
lea rcx, [0x140017d60]
call fcn.140008540
cmp dword [0x14005e174], r13d
je 0x1400035f0
lea rcx, str.Analysis_tools
call fcn.140008250
lea rax, str.ollydbg.exe
mov esi, 0x24
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x60]
lea rax, str.ProcessHacker.exe
mov qword [rsp + 0x68], rax
lea rax, str.tcpview.exe
mov qword [rsp + 0x70], rax
lea rax, str.autoruns.exe
mov qword [rsp + 0x78], rax
lea rax, str.autorunsc.exe
mov qword [rbp - 0x80], rax
lea rax, str.filemon.exe
mov qword [rbp - 0x78], rax
lea rax, str.procmon.exe
mov qword [rbp - 0x70], rax
lea rax, str.regmon.exe
mov qword [rbp - 0x68], rax
lea rax, str.procexp.exe
mov qword [rbp - 0x60], rax
lea rax, str.idaq.exe
mov qword [rbp - 0x58], rax
lea rax, str.idaq64.exe
mov qword [rbp - 0x50], rax
lea rax, str.ImmunityDebugger.exe
mov qword [rbp - 0x48], rax
lea rax, str.Wireshark.exe
mov qword [rbp - 0x40], rax
lea rax, str.dumpcap.exe
mov qword [rbp - 0x38], rax
lea rax, str.HookExplorer.exe
mov qword [rbp - 0x30], rax
lea rax, str.ImportREC.exe
mov qword [rbp - 0x28], rax
lea rax, str.PETools.exe
mov qword [rbp - 0x20], rax
lea rax, str.LordPE.exe
mov qword [rbp - 0x18], rax
lea rax, str.SysInspector.exe
mov qword [rbp - 0x10], rax
lea rax, str.proc_analyzer.exe
mov qword [rbp - 8], rax
lea rax, str.sysAnalyzer.exe
mov qword [rbp], rax
lea rax, str.sniff_hit.exe
mov qword [rbp + 8], rax
lea rax, str.windbg.exe
mov qword [rbp + 0x10], rax
lea rax, str.joeboxcontrol.exe
mov qword [rbp + 0x18], rax
lea rax, str.joeboxserver.exe
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rax
lea rax, str.ResourceHacker.exe
mov qword [rbp + 0x30], rax
lea rax, str.x32dbg.exe
mov qword [rbp + 0x38], rax
lea rax, str.x64dbg.exe
mov qword [rbp + 0x40], rax
lea rax, str.Fiddler.exe
mov qword [rbp + 0x48], rax
lea rax, str.httpdebugger.exe
mov qword [rbp + 0x50], rax
lea rax, str.cheatengine_i386.exe
mov qword [rbp + 0x58], rax
lea rax, str.cheatengine_x86_64.exe
mov qword [rbp + 0x60], rax
lea rax, str.cheatengine_x86_64_SSE4_AVX2.exe
mov qword [rbp + 0x68], rax
lea rax, str.frida_helper_32.exe
mov qword [rbp + 0x70], rax
lea rax, str.frida_helper_64.exe
mov qword [rbp + 0x78], rax
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, str.Checking_process_of_malware_analysis_tool:__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.140003b10
mov rcx, qword [rbx]
call fcn.1400173d0
lea rdx, [rbp + 0xe0]
test eax, eax
je 0x1400035df
mov ecx, r15d
jmp 0x1400035e1
xor ecx, ecx
call fcn.140008420
add rbx, 8
sub rsi, 1
jne 0x140003590
cmp dword [0x14005e170], r13d
je 0x140003658
lea rcx, str.Begin_AntiDisassmConstantCondition_n
call fcn.140003790
call fcn.140017de0
lea rcx, str.Begin_AntiDisassmAsmJmpSameTarget_n
call fcn.140003790
call fcn.140017de8
lea rcx, str.Begin_AntiDisassmImpossibleDiasassm_n
call fcn.140003790
call fcn.140017def
lea rcx, str.Begin_AntiDisassmFunctionPointer_n
call fcn.140003790
mov ecx, 2
call fcn.140017e03
lea rcx, str.Begin_AntiDisassmReturnPointerAbuse_n
call fcn.140003790
mov ecx, 0x29a
call fcn.140017e2e
cmp dword [0x14005e178], r13d
je 0x1400036d3
lea rcx, str.Anti_Dumping
call fcn.140008250
lea rcx, str.___Erasing_PE_header_from_memory_n
call fcn.140003790
xor ecx, ecx
mov dword [rsp + 0x40], r13d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9, [rsp + 0x40]
mov edx, 0x1000
mov rcx, rax
mov r8d, 4
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
mov rdi, qword gs:[0x60]
lea rcx, str.___Increasing_SizeOfImage_in_PE_Header_to:_0x100000_n
call fcn.140003790
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x30]
add eax, 0x100000
mov dword [rcx + 0x40], eax
lea rcx, str._n_nAnalysis_done__I_hope_you_didnt_get_red_flags_:_
call fcn.140003790
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
mov rcx, qword [rbp + 0x700]
xor rcx, rsp
call fcn.140018050
lea r11, [rsp + 0x810]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret