Function at 0x140001440
Capabilities:
Access peb ldr_data
Check for debugger via api
Check for outputdebugstring error
Check for peb beingdebugged flag
Check for peb ntglobalflag flag
Check for software breakpoints
Check for time delay via gettickcount
Check for unmoving mouse cursor
Check if file exists
Check if process is running under wine
Check os version
Create thread
Encode data using base64
Enumerate process modules
Execute anti-debugging instructions
Get common file path
Get disk size
Get file attributes
Get memory capacity
Get ntdll base address
Get number of processor cores
Get program files directory
Get system information on windows
Print debug messages
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Reference processor manufacturer constants
Reference wmi statements
Send icmp echo request
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7160]
mov eax, 0x7260
call fcn.140031e90
sub rsp, rax
mov rax, qword [0x14004c010]
xor rax, rsp
mov qword [rbp + 0x7150], rax
xor r8d, r8d
movsxd r14, ecx
mov rsi, rdx
lea r12d, [r8 + 1]
cmp r14d, r12d
jle 0x140001522
mov ebx, r12d
cmp r14, r12
jbe 0x140001599
lea edi, [r8 + 2]
lea r13, str.__check
nop dword [rax + rax]
mov rdx, qword [rsi + rbx*8]
mov rcx, r8
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rcx + r13 - 1]
jne 0x140001514
cmp rcx, 8
jne 0x1400014c0
cmp edi, r14d
jge 0x140001514
mov rdx, qword [rsi + rbx*8 + 8]
mov qword [rbp - 0x78], r8
mov qword [rbp - 0x68], r8
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x60], SafeArrayLock
inc r8
cmp byte [rdx + r8], 0
jne 0x1400014f5
lea rcx, [rbp - 0x78]
call fcn.1400093a0
lea rcx, [rbp - 0x78]
call fcn.140001010
xor r8d, r8d
add edi, 2
add rbx, 2
cmp rbx, r14
jl 0x1400014b0
jmp 0x140001599
mov dword [0x140066984], r12d
mov dword [0x140066980], r12d
mov dword [0x14006697c], r12d
mov dword [0x140066978], r12d
mov dword [0x140066974], r12d
mov dword [0x140066970], r12d
mov dword [0x14006696c], r12d
mov dword [0x140066968], r12d
mov dword [0x140066964], r12d
mov dword [0x140066960], r12d
mov dword [0x14006695c], r12d
mov dword [0x140066958], r12d
mov dword [0x140066954], r12d
mov dword [0x14006694c], r8d
mov dword [0x140066948], r12d
mov dword [0x140066944], r12d
mov dword [0x140066940], r12d
lea rcx, str.Al_Khaser___by_Lord_Noteworthy
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 0x64
mov dword [rsp + 0x28], r12d
mov r8d, edx
mov dword [rsp + 0x20], 0x384
mov r9d, 0x384
mov rcx, rax
call qword [sym.imp.USER32.dll_MoveWindow]
lea rcx, str._al_khaser_version_0.82_
call fcn.140009570
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x6a0]
mov ecx, SafeArrayGetElement
mov rsi, rax
lea rdx, [rbp + 0x6a0]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x6a8]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Initialisation
lea rcx, str._n___________________________s___________________________n
call fcn.140009570
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor ecx, ecx
lea rsi, [0x140064d6c]
mov r13d, ecx
nop word [rax + rax]
test dword [rsi - 4], 0xfffffffd
mov r15d, dword [rsi + 4]
mov r12d, dword [rsi]
jne 0x140001701
xor r14b, r14b
lea rbx, [0x140065328]
mov rdi, rcx
xor al, al
lea rcx, [0x1400653f8]
nop word [rax + rax]
test rdi, rdi
je 0x140001697
cmp dword [rbx - 8], r12d
jne 0x140001697
mov r14b, 1
call qword [rbx]
lea rcx, [0x1400653f8]
inc rdi
add rbx, 0x10
cmp rbx, rcx
jl 0x140001680
test r14b, r14b
jne 0x1400016b1
lea rcx, str.ERROR:_Minimum_version_value_was_invalid._n
jmp 0x1400016fc
test al, al
je 0x140001701
test r15d, r15d
jne 0x1400016be
mov al, 1
jmp 0x140001703
xor dil, dil
lea rbx, [0x140065328]
xor al, al
nop word [rax + rax]
cmp dword [rbx - 8], r15d
jne 0x1400016e7
mov dil, 1
call qword [rbx]
test al, al
lea rcx, [0x1400653f8]
sete al
add rbx, 0x10
cmp rbx, rcx
jl 0x1400016d0
test dil, dil
jne 0x140001703
lea rcx, str.ERROR:_Removed_version_value_was_invalid._n
call fcn.140009500
xor al, al
mov rcx, qword [rsi - 0x14]
mov byte [rsi + 9], al
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x14000171a
mov byte [rsi + 8], al
jmp 0x140001734
mov rdx, qword [rsi - 0xc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rsi + 0xc], rax
setne al
mov byte [rsi + 8], al
inc r13d
add rsi, 0x30
mov ecx, 0
cmp r13d, 0x1f
jb 0x140001650
xor edx, edx
lea rcx, [rbp + 0x3e60]
mov r8d, 0x208
call fcn.1400184d0
lea rcx, [rbp + 0x3e60]
call fcn.140013580
test eax, eax
je 0x140001781
lea rdx, [rbp + 0x3e60]
lea rcx, str._n___You_are_running:__s_n
call fcn.140009570
xor r13d, r13d
lea rbx, [0x140064d74]
mov esi, r13d
mov edi, r13d
cmp byte [rbx + 1], r13b
je 0x1400017b2
cmp byte [rbx], r13b
jne 0x1400017b2
mov r8, qword [rbx - 0x14]
lea rcx, str.___Warning:_API__s__s_was_expected_to_exist_but_was_not_found._n
mov rdx, qword [rbx - 0x1c]
call fcn.140009500
inc esi
inc edi
add rbx, 0x30
cmp edi, 0x1f
jb 0x140001791
test esi, esi
jne 0x1400017cd
lea rcx, str.___All_APIs_present_and_accounted_for._n
call fcn.140009500
call fcn.140013290
test eax, eax
je 0x1400017e2
lea rcx, str.Process_is_running_under_WOW64_n_n
call fcn.140009570
cmp dword [0x140066980], r13d
je 0x1400018f3
lea rcx, [rbp + 0x868]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [rbp + 0x86c]
lea r8, [rbp + 0x600]
xorps xmm0, xmm0
lea rdx, [fcn.140009be0]
mov ecx, 4
movups xmmword [rbp + 0x6b8], xmm0
movups xmmword [rbp + 0x6c8], xmm0
movups xmmword [rbp + 0x6d8], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x1400018f3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x600]
lea r8, [rbp + 0x610]
mov rcx, rax
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetElement
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x1400018f3
mov rdi, r13
cmp dword [rbp + 0x618], r13d
jbe 0x1400018f3
mov rbx, qword [rbp + 0x610]
nop dword [rax]
mov r8d, 0x30
lea rdx, [rbp + 0x6b8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
jb 0x1400018e2
mov eax, dword [rbp + 0x6dc]
test al, 0x10
jne 0x1400018b2
test al, 0x20
jne 0x1400018b2
test al, al
js 0x1400018b2
test al, 0x40
je 0x1400018e2
mov rdx, qword [0x1400669a8]
cmp rdx, qword [0x1400669b0]
mov qword [rbp + 0x690], rbx
je 0x1400018d6
mov qword [rdx], rbx
add qword [0x1400669a8], 8
jmp 0x1400018e2
lea r8, [rbp + 0x690]
call fcn.140009e10
mov eax, dword [rbp + 0x618]
add rdi, rsi
add rbx, rsi
cmp rdi, rax
jb 0x140001880
cmp dword [0x140066984], r13d
mov r14d, 0x43
mov r12d, 0x44
mov qword [rbp + 0x5c8], r14
mov qword [rbp + 0x600], r12
mov r15d, 0x3e8
je 0x140001b93
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x6a0]
mov ecx, SafeArrayGetElement
mov rsi, rax
lea rdx, [rbp + 0x6a0]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x6a8]
lea edx, [r14 - 0x36]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.TLS_Callbacks
lea rcx, str._n___________________________s___________________________n
call fcn.140009570
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.TLS_process_attach_callback
lea rcx, str.____s
call fcn.140009570
mov ebx, r14d
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400019a0
mov rax, qword [0x1400669c0]
mov ebx, r13d
test rax, rax
jne 0x1400019fa
inc ebx
cmp ebx, r15d
je 0x1400019df
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov rax, qword [0x1400669c0]
test rax, rax
je 0x1400019c1
cmp ebx, r15d
jl 0x1400019fa
lea rcx, str.TLSCallbackProcess_timeout_on_event_creation.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, 1
mov esi, 0xdeadbeef
mov ecx, edi
jmp 0x140001a6b
mov rcx, qword [0x1400669c0]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140001a35
cmp eax, 0xffffffff
jne 0x140001a1e
lea rcx, str.TLSCallbackProcess_wait_failed.
jmp 0x1400019e6
lea rcx, str.TLSCallbackProcess_wait_abandoned.
cmp eax, 0x80
je 0x1400019e6
lea rcx, str.TLSCallbackProcess_timeout_on_event_wait.
jmp 0x1400019e6
mov eax, dword [0x1400669c8]
lea rcx, str.TLSCallbackProcess_data_did_not_match.
mov esi, 0xdeadbeef
cmp eax, esi
jne 0x140001a52
lea rcx, str.All_seems_fine_for_TLSCallbackProcess.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x1400669c8]
mov ecx, r13d
cmp eax, esi
mov edi, 1
setne cl
lea rdx, str.TLS_process_attach_callback
call fcn.140012c60
lea rdx, str.TLS_thread_attach_callback
lea rcx, str.____s
call fcn.140009570
mov rbx, r12
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140001a90
mov qword [rsp + 0x28], r13
lea r8, [0x14000e010]
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x140001ad2
lea rcx, str.TLS_callback:_couldnt_start_dummy_thread
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, qword [0x1400669b8]
mov ebx, r13d
test rax, rax
jne 0x140001b10
inc ebx
cmp ebx, r15d
je 0x140001aff
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov rax, qword [0x1400669b8]
test rax, rax
je 0x140001ae1
cmp ebx, r15d
jl 0x140001b10
lea rcx, str.TLSCallbackThread_timeout_on_event_creation.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, edi
jmp 0x140001b87
mov rcx, qword [0x1400669b8]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140001b5b
cmp eax, 0xffffffff
jne 0x140001b3c
lea rcx, str.TLSCallbackThread_wait_failed.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, edi
jmp 0x140001b87
lea rcx, str.TLSCallbackThread_wait_abandoned.
cmp eax, 0x80
je 0x140001b51
lea rcx, str.TLSCallbackThread_timeout_on_event_wait.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, edi
jmp 0x140001b87
mov eax, dword [0x14006699c]
lea rcx, str.TLSCallbackThread_data_did_not_match.
cmp eax, esi
jne 0x140001b73
lea rcx, str.All_seems_fine_for_TLSCallbackThread.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x14006699c]
mov ecx, r13d
cmp eax, esi
setne cl
lea rdx, str.TLS_thread_attach_callback
call fcn.140012c60
cmp dword [0x140066980], 0
mov r13d, 0x40
mov r14d, 0x39
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], 0x42
lea r12d, [r13 - 9]
mov qword [rbp + 0x5f8], 0x41
lea r15d, [r13 - 0x1b]
mov qword [rbp + 0x5f0], 0x31
je 0x140003547
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x7a8]
mov ecx, SafeArrayGetElement
mov rsi, rax
lea rdx, [rbp + 0x7a8]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x7b0]
lea edx, [r13 - 0x33]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Debugger_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140009570
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Checking_IsDebuggerPresent_API
lea rcx, str.____s
call fcn.140009570
mov ebx, r13d
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140001c60
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, eax
lea rdx, str.Checking_IsDebuggerPresent_API
call fcn.140012c60
lea rdx, str.Checking_PEB.BeingDebugged
lea rcx, str.____s
call fcn.140009570
mov edi, 0x44
mov ebx, edi
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140001ca0
mov rax, qword gs:[0x60]
lea rdx, str.Checking_PEB.BeingDebugged
xor esi, esi
mov ecx, esi
cmp byte [rax + 2], 1
sete cl
call fcn.140012c60
lea rdx, str.Checking_CheckRemoteDebuggerPresent_API
lea rcx, str.____s
call fcn.140009570
mov rbx, r12
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140001cf0
mov dword [rbp + 0x650], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x650]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov ecx, dword [rbp + 0x650]
lea rdx, str.Checking_CheckRemoteDebuggerPresent_API
call fcn.140012c60
lea rdx, str.Checking_PEB.NtGlobalFlag
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x45
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140001d50
mov rax, qword gs:[0x60]
add rax, 0xbc
je 0x140001d81
test byte [rax], 0x70
je 0x140001d81
mov esi, 1
mov ecx, esi
jmp 0x140001d88
mov ecx, esi
mov esi, 1
lea rdx, str.Checking_PEB.NtGlobalFlag
call fcn.140012c60
lea rdx, str.Checking_ProcessHeap.Flags
lea rcx, str.____s
call fcn.140009570
mov rbx, rdi
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140001db0
xor r8d, r8d
lea ecx, [rbx + 6]
xor edx, edx
call fcn.140009af0
mov rcx, qword gs:[0x60]
test al, al
mov rax, qword [rcx + 0x30]
je 0x140001de6
add rax, 0x70
jmp 0x140001dea
add rax, 0x14
xor edi, edi
lea rdx, str.Checking_ProcessHeap.Flags
cmp dword [rax], 2
mov ecx, edi
seta cl
call fcn.140012c60
lea rdx, str.Checking_ProcessHeap.ForceFlags
lea rcx, str.____s
call fcn.140009570
lea ebx, [rdi + 0x3f]
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140001e20
xor r8d, r8d
lea ecx, [rbx + 6]
xor edx, edx
call fcn.140009af0
mov rcx, qword gs:[0x60]
test al, al
mov rax, qword [rcx + 0x30]
je 0x140001e56
add rax, 0x74
jmp 0x140001e5a
add rax, 0x18
cmp dword [rax], edi
lea rdx, str.Checking_ProcessHeap.ForceFlags
mov ecx, edi
seta cl
call fcn.140012c60
lea rdx, str.Checking_Low_Fragmentation_Heap
lea rcx, str.____s
call fcn.140009570
mov rbx, r13
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140001e83
mov rbx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea rcx, [rbp + 0xc9c]
mov r8d, 0x110
mov rdi, rax
call fcn.1400184d0
mov r8b, 1
mov dword [rbp + 0xc90], 0x11c
mov edx, 2
mov qword [rbp + 0xc94], 6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 1
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 3
lea rcx, [rbp + 0xc90]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x140001f66
xor edx, edx
lea rcx, [rbp + 0xa5c]
mov r8d, 0x110
call fcn.1400184d0
mov r8b, 1
mov dword [rbp + 0xa50], 0x11c
mov edx, 2
mov dword [rbp + 0xa54], 6
xor ecx, ecx
mov dword [rbp + 0xa58], esi
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 1
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 3
lea rcx, [rbp + 0xa50]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x140001f6d
lea rbx, [rdi + 0x178]
xor edx, edx
lea rcx, [rbp + 0xb7c]
mov r8d, 0x110
call fcn.1400184d0
mov r8b, 1
mov dword [rbp + 0xb70], 0x11c
mov edx, 2
mov dword [rbp + 0xb74], 6
xor ecx, ecx
mov dword [rbp + 0xb78], 2
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 3
lea rcx, [rbp + 0xb70]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x140001fdd
lea rbx, [rdi + 0x170]
test rbx, rbx
je 0x140001ff3
cmp qword [rbx], 0
jne 0x140001ff3
mov edi, 1
xor esi, esi
mov ecx, edi
jmp 0x140001ffa
xor esi, esi
mov ecx, esi
lea edi, [rsi + 1]
lea rdx, str.Checking_Low_Fragmentation_Heap
call fcn.140012c60
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugPort
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x26
nop
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140002020
lea rdx, [0x140064d50]
mov eax, esi
mov rcx, rdx
nop
cmp dword [rcx], 0x10
je 0x1400021ae
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002040
mov rbx, rsi
mov qword [rbp + 0x650], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea r8, [rbp + 0x650]
lea edx, [r9 - 1]
call rbx
test eax, eax
jne 0x14000208f
cmp qword [rbp + 0x650], 0
mov ecx, edi
jne 0x140002091
mov ecx, esi
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugPort
call fcn.140012c60
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugFlags
lea rcx, str.____s
call fcn.140009570
mov rbx, r15
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400020b3
lea rdx, [0x140064d50]
mov eax, esi
mov rcx, rdx
cmp dword [rcx], 0x10
je 0x1400021cc
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x1400020d1
mov rbx, rsi
mov dword [rbp + 0x650], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea r8, [rbp + 0x650]
lea edx, [r9 + 0x1b]
call rbx
test eax, eax
jne 0x14000211d
mov ecx, edi
cmp dword [rbp + 0x650], eax
je 0x14000211f
mov ecx, esi
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugFlags
call fcn.140012c60
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugObject
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x24
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140002143
lea rdx, [0x140064d50]
mov eax, esi
mov rcx, rdx
cmp dword [rcx], 0x10
je 0x1400021ea
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002161
mov rbx, rsi
mov qword [rbp + 0x650], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea r8, [rbp + 0x650]
lea edx, [r9 + 0x16]
call rbx
cmp eax, 0xc0000353
je 0x140002208
mov ecx, edi
jmp 0x140002261
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
je 0x140002054
mov rbx, qword [rdx + rcx*8 + 0x28]
jmp 0x140002057
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
je 0x1400020e5
mov rbx, qword [rdx + rcx*8 + 0x28]
jmp 0x1400020e8
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
je 0x140002175
mov rbx, qword [rdx + rcx*8 + 0x28]
jmp 0x140002178
cmp qword [rbp + 0x650], 0
je 0x140002216
mov ecx, edi
jmp 0x140002261
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
lea r8, [rbp + 0x650]
mov rcx, rax
lea rax, [rbp + 0x650]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x16]
call rbx
cmp eax, 0xc0000353
je 0x140002249
mov ecx, edi
jmp 0x140002261
mov rax, qword [rbp + 0x650]
test rax, rax
jne 0x140002259
mov ecx, edi
jmp 0x140002261
cmp eax, 8
mov ecx, esi
setne cl
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugObject
call fcn.140012c60
lea rdx, str.Checking_WudfIsAnyDebuggerPresent_API
lea rcx, str.____s
call fcn.140009570
mov rbx, r14
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140002283
lea r14, [0x140064d50]
mov eax, esi
mov rcx, r14
cmp dword [rcx], 0x1c
je 0x14000266e
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x1400022a1
mov ecx, esi
lea rdx, str.Checking_WudfIsAnyDebuggerPresent_API
call fcn.140012c60
lea rdx, str.Checking_WudfIsKernelDebuggerPresent_API
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x36
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400022e0
mov eax, esi
mov rcx, r14
cmp dword [rcx], 0x1d
je 0x1400026cd
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x1400022f7
mov ecx, esi
lea rdx, str.Checking_WudfIsKernelDebuggerPresent_API
call fcn.140012c60
lea rdx, str.Checking_WudfIsUserDebuggerPresent_API
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x38
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140002331
mov eax, esi
mov rcx, r14
nop dword [rax + rax]
cmp dword [rcx], 0x1e
je 0x14000272c
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002350
mov ecx, esi
lea rdx, str.Checking_WudfIsUserDebuggerPresent_API
call fcn.140012c60
lea rdx, str.Checking_NtSetInformationThread_with_ThreadHideFromDebugger
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x23
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140002390
call fcn.1400098d0
lea rdx, str.Checking_NtSetInformationThread_with_ThreadHideFromDebugger
mov ecx, eax
call fcn.140012c60
lea rdx, str.Checking_CloseHandle_with_an_invalide_handle
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x32
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400023d0
call fcn.140009690
lea rdx, str.Checking_CloseHandle_with_an_invalide_handle
mov ecx, eax
call fcn.140012c60
lea rdx, str.Checking_NtSystemDebugControl
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x42
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140002410
mov eax, esi
mov rcx, r14
cmp dword [rcx], 0xb
je 0x14000278b
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002427
mov rax, rsi
xor edx, edx
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
lea ecx, [rdx + 0x14]
call rax
cmp eax, 0xc0000354
lea rdx, str.Checking_NtSystemDebugControl
mov ecx, esi
setne cl
call fcn.140012c60
lea rdx, str.Checking_UnhandledExcepFilterTest
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x3d
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140002482
lea rcx, [0x14000e050]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc000008e
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_RaiseException]
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [r14 + rcx*8 + 0x24], 0
je 0x1400022b5
mov eax, esi
mov rcx, r14
cmp dword [rcx], 0x1c
je 0x1400026a9
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002688
mov rax, rsi
call rax
test eax, eax
mov ecx, esi
setne cl
jmp 0x1400022b7
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [r14 + rcx*8 + 0x24], 0
je 0x140002698
mov rax, qword [r14 + rcx*8 + 0x28]
call rax
test eax, eax
mov ecx, esi
setne cl
jmp 0x1400022b7
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [r14 + rcx*8 + 0x24], 0
je 0x14000230b
mov eax, esi
mov rcx, r14
cmp dword [rcx], 0x1d
je 0x140002708
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x1400026e7
mov rax, rsi
call rax
test eax, eax
mov ecx, esi
setne cl
jmp 0x14000230d
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [r14 + rcx*8 + 0x24], 0
je 0x1400026f7
mov rax, qword [r14 + rcx*8 + 0x28]
call rax
test eax, eax
mov ecx, esi
setne cl
jmp 0x14000230d
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [r14 + rcx*8 + 0x24], 0
je 0x140002364
mov eax, esi
mov rcx, r14
cmp dword [rcx], 0x1e
je 0x140002767
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002746
mov rax, rsi
call rax
test eax, eax
mov ecx, esi
setne cl
jmp 0x140002366
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [r14 + rcx*8 + 0x24], 0
je 0x140002756
mov rax, qword [r14 + rcx*8 + 0x28]
call rax
test eax, eax
mov ecx, esi
setne cl
jmp 0x140002366
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [r14 + rcx*8 + 0x24], 0
je 0x14000243b
mov rax, qword [r14 + rcx*8 + 0x28]
jmp 0x14000243e
cmp dword [0x14006697c], 0
mov r14d, 0x28
mov r12d, 0x35
mov qword [rbp + 0x670], 0x2b
mov qword [rbp + 0x688], r12
lea r13d, [r14 + 6]
je 0x1400039e7
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x7d8]
mov ecx, SafeArrayGetElement
mov rsi, rax
lea rdx, [rbp + 0x7d8]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x7e0]
lea edx, [r14 - 0x1b]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.DLL_Injection_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140009570
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__32_bit_
lea rcx, str.____s
call fcn.140009570
mov ebx, r14d
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400035f0
lea ecx, [rbx + 1]
call fcn.14000c670
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__32_bit_
mov ecx, eax
call fcn.140012c60
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__64_bit_
lea rcx, str.____s
call fcn.140009570
mov rbx, r14
nop
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140003630
lea ecx, [rbx + 2]
call fcn.14000c670
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__64_bit_
mov ecx, eax
call fcn.140012c60
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__ALL_
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x2b
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140003670
lea ecx, [rbx + 3]
call fcn.14000c670
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__ALL_
mov ecx, eax
call fcn.140012c60
lea rdx, str.Enumerating_modules_with_ToolHelp32
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x3b
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400036b0
xor dil, dil
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400036f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_snapshot._Last_error:__u_n
call fcn.140009500
jmp 0x140003791
xor edx, edx
lea rcx, [rbp + 0xdb4]
mov r8d, 0x434
call fcn.1400184d0
lea rdx, [rbp + 0xdb0]
mov dword [rbp + 0xdb0], 0x438
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140003774
nop word [rax + rax]
mov edx, 0xffffffff
lea rcx, [rbp + 0xfe0]
call fcn.14000c2e0
movzx ebx, al
test al, al
je 0x14000375b
lea rdx, [rbp + 0xfe0]
lea rcx, str._____Injected_library:__S_n
call fcn.140009500
lea rdx, [rbp + 0xdb0]
mov rcx, rsi
or dil, bl
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140003730
jmp 0x140003788
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_first_module._Last_error:__u_n
call fcn.140009500
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea rdx, str.Enumerating_modules_with_ToolHelp32
mov ecx, eax
test dil, dil
setne cl
call fcn.140012c60
lea rdx, str.Enumerating_the_process_LDR_via_LdrEnumerateLoadedModules
lea rcx, str.____s
call fcn.140009570
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub r15, 1
jne 0x1400037c0
lea rdx, [0x140064d50]
mov eax, r15d
mov rcx, rdx
nop
cmp dword [rcx], 9
je 0x1400037f8
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x1400037e0
mov ecx, r15d
jmp 0x1400038d5
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], r15b
jne 0x140003810
mov ecx, r15d
jmp 0x1400038d5
mov eax, r15d
mov rcx, rdx
cmp dword [rcx], 9
je 0x14000386e
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140003816
mov rbx, r15
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.140016138
mov r8, rax
lea rdx, [0x14000d780]
xor ecx, ecx
mov rdi, rax
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
call rbx
test eax, eax
je 0x140003885
mov edx, eax
lea rcx, str.LdrEnumerateLoadedModules_failed._Status:__x_n
call fcn.140009500
mov rcx, rdi
call fcn.14000d860
mov ecx, r15d
jmp 0x1400038d5
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], r15b
je 0x140003826
mov rbx, qword [rdx + rcx*8 + 0x28]
jmp 0x140003829
mov r14, qword [rdi + 8]
xor sil, sil
mov rbx, qword [rdi]
cmp rbx, r14
je 0x1400038c4
nop dword [rax]
nop dword [rax + rax]
movups xmm2, xmmword [rbx + 0x40]
mov rcx, qword [rbx + 0x50]
pextrw eax, xmm2, 4
movzx edx, ax
call fcn.14000c2e0
or sil, al
add rbx, 0x88
cmp rbx, r14
jne 0x1400038a0
mov rcx, rdi
call fcn.14000d860
test sil, sil
mov ecx, r15d
setne cl
lea rdx, str.Enumerating_the_process_LDR_via_LdrEnumerateLoadedModules
call fcn.140012c60
lea rdx, str.Enumerating_the_process_LDR_directly
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x3a
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140003900
call fcn.14000d0b0
lea rdx, str.Enumerating_the_process_LDR_directly
mov ecx, eax
call fcn.140012c60
lea rdx, str.Walking_process_memory_with_GetModuleInformation
lea rcx, str.____s
call fcn.140009570
mov rbx, r13
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140003940
call fcn.14000c8f0
lea rdx, str.Walking_process_memory_with_GetModuleInformation
mov ecx, eax
call fcn.140012c60
lea rdx, str.Walking_process_memory_for_hidden_modules
lea rcx, str.____s
call fcn.140009570
mov rbx, r12
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140003980
call fcn.14000cb80
lea rdx, str.Walking_process_memory_for_hidden_modules
mov ecx, eax
call fcn.140012c60
lea rdx, str.Walking_process_memory_for_.NET_module_structures
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x2d
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400039c0
call fcn.14000ce60
lea rdx, str.Walking_process_memory_for_.NET_module_structures
mov ecx, eax
call fcn.140012c60
jmp 0x1400039ea
xor r15d, r15d
cmp dword [0x140066978], 0
mov qword [rbp + 0x668], 0x22
je 0x14000560c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x7f0]
mov ecx, SafeArrayGetElement
mov rsi, rax
lea rdx, [rbp + 0x7f0]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x7f8]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Generic_Sandboxe_VM_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140009570
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.avghookx.dll
mov esi, 0xc
mov qword [rbp + 0x260], rax
lea rdi, [rbp + 0x260]
lea rax, str.avghooka.dll
mov qword [rbp + 0x268], rax
lea rax, str.snxhk.dll
mov qword [rbp + 0x270], rax
lea rax, str.sbiedll.dll
mov qword [rbp + 0x278], rax
lea rax, str.dbghelp.dll
mov qword [rbp + 0x280], rax
lea rax, str.api_log.dll
mov qword [rbp + 0x288], rax
lea rax, str.dir_watch.dll
mov qword [rbp + 0x290], rax
lea rax, str.pstorec.dll
mov qword [rbp + 0x298], rax
lea rax, str.vmcheck.dll
mov qword [rbp + 0x2a0], rax
lea rax, str.wpespy.dll
mov qword [rbp + 0x2a8], rax
lea rax, str.cmdvrt64.dll
mov qword [rbp + 0x2b0], rax
lea rax, str.cmdvrt32.dll
mov qword [rbp + 0x2b8], rax
nop dword [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x3c60]
mov r8d, 0x200
call fcn.1400184d0
mov r9, qword [rdi]
lea r8, str.Checking_if_process_loaded_modules_contains:__s
mov edx, 0x100
lea rcx, [rbp + 0x3c60]
call fcn.1400095d0
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rbp + 0x3c60]
lea rcx, str.____s
test rax, rax
jne 0x140003bab
call fcn.140009570
lea rcx, [rbp + 0x3c60]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140003b80
mov ebx, 0x5f
sub rbx, rax
je 0x140003ba6
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140003b94
mov ecx, r15d
jmp 0x140003beb
call fcn.140009570
lea rcx, [rbp + 0x3c60]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140003bc0
mov ebx, 0x5f
sub rbx, rax
je 0x140003be6
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140003bd4
mov ecx, 1
lea rdx, [rbp + 0x3c60]
call fcn.140012c60
add rdi, 8
sub rsi, 1
jne 0x140003b20
call fcn.14000e2f0
lea rax, str.CurrentUser
mov qword [rbp + 0x410], rax
lea rax, str.Sandbox
mov qword [rbp + 0x418], rax
lea rax, str.Emily
mov qword [rbp + 0x420], rax
lea rax, str.HAPUBWS
mov qword [rbp + 0x428], rax
lea rax, str.Hong_Lee
mov qword [rbp + 0x430], rax
lea rax, str.IT_ADMIN
mov qword [rbp + 0x438], rax
lea rax, str.Johnson
mov qword [rbp + 0x440], rax
lea rax, str.Miller
mov qword [rbp + 0x448], rax
lea rax, str.milozs
mov qword [rbp + 0x450], rax
lea rax, str.Peter_Wilson
mov qword [rbp + 0x458], rax
lea rax, str.timmy
mov qword [rbp + 0x460], rax
lea rax, str.user
mov qword [rbp + 0x468], rax
lea rax, str.sand_box
mov qword [rbp + 0x470], rax
lea rax, str.malware
mov qword [rbp + 0x478], rax
lea rax, str.maltest
mov qword [rbp + 0x480], rax
lea rax, str.test_user
mov qword [rbp + 0x488], rax
lea rax, str.virus
mov qword [rbp + 0x490], rax
lea rax, str.John_Doe
mov qword [rbp + 0x498], rax
call fcn.14000e700
mov r15, rax
test rax, rax
je 0x140003dcc
lea rdi, [rbp + 0x410]
lea r14d, [rsi + 0x12]
lea r12d, [rsi + 1]
nop word [rax + rax]
mov r9, qword [rdi]
lea r8, str.Checking_if_username_matches_:__s
mov edx, 0x100
lea rcx, [rbp + 0x48a0]
call fcn.1400095d0
mov rcx, qword [rdi]
mov rdx, r15
call fcn.14001ec68
xor esi, esi
lea rdx, [rbp + 0x48a0]
test eax, eax
lea rcx, str.____s
cmove esi, r12d
call fcn.140009570
lea rcx, [rbp + 0x48a0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140003d80
mov ebx, 0x5f
sub rbx, rax
je 0x140003da5
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, r12
jne 0x140003d94
lea rdx, [rbp + 0x48a0]
mov ecx, esi
call fcn.140012c60
add rdi, 8
sub r14, r12
jne 0x140003d30
mov rcx, r15
call fcn.14001ec04
lea r12d, [r14 + 0x35]
lea rax, str.SANDBOX
mov qword [rbp + 0x180], rax
lea rax, str.7SILVIA
mov qword [rbp + 0x188], rax
lea rax, str.HANSPETER_PC
mov qword [rbp + 0x190], rax
lea rax, str.JOHN_PC
mov qword [rbp + 0x198], rax
lea rax, str.MUELLER_PC
mov qword [rbp + 0x1a0], rax
lea rax, str.WIN7_TRAPS
mov qword [rbp + 0x1a8], rax
lea rax, str.FORTINET
mov qword [rbp + 0x1b0], rax
lea rax, str.TEQUILABOOMBOOM
mov qword [rbp + 0x1b8], rax
call fcn.14000e780
mov r15, rax
test rax, rax
je 0x140003f46
call fcn.14000e800
mov r12, rax
test rax, rax
jne 0x140003e67
mov rcx, r15
call fcn.14001ec04
jmp 0x140003f40
mov r14d, 8
lea rsi, [rbp + 0x180]
lea r13d, [r14 - 7]
nop dword [rax + rax]
mov rbx, qword [rsi]
lea r8, str.Checking_if_hostname_matches_:__s
mov r9, rbx
lea rcx, [rbp + 0x4070]
mov edx, 0x100
call fcn.1400095d0
mov rdx, r15
mov rcx, rbx
call fcn.14001ec68
test eax, eax
jne 0x140003eb2
mov edi, r13d
jmp 0x140003ec5
mov rdx, r12
mov rcx, rbx
call fcn.14001ec68
xor edi, edi
test eax, eax
cmove edi, r13d
lea rdx, [rbp + 0x4070]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x4070]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140003ee6
mov ebx, 0x5f
sub rbx, rax
je 0x140003f11
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, r13
jne 0x140003f00
lea rdx, [rbp + 0x4070]
mov ecx, edi
call fcn.140012c60
add rsi, 8
sub r14, r13
jne 0x140003e80
mov rcx, r15
call fcn.14001ec04
mov rcx, r12
call fcn.14001ec04
lea r13d, [r14 + 0x2e]
mov r12d, 0x35
call fcn.14000e8a0
lea rdx, str.Checking_Number_of_processors_in_machine
lea rcx, str.____s
call fcn.140009570
mov edi, 0x36
mov ebx, edi
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140003f70
mov rax, qword gs:[0x60]
lea rdx, str.Checking_Number_of_processors_in_machine
xor r15d, r15d
mov ecx, r15d
cmp dword [rax + 0xb8], 2
setb cl
call fcn.140012c60
lea rdx, str.Checking_Interupt_Descriptor_Table_location
lea rcx, str.____s
call fcn.140009570
mov esi, 0x33
mov ebx, esi
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140003fc1
mov eax, dword [rbp + 0x648]
lea rdx, str.Checking_Interupt_Descriptor_Table_location
and eax, 0xff000000
mov ecx, r15d
cmp eax, 0xff000000
sete cl
call fcn.140012c60
lea rdx, str.Checking_Local_Descriptor_Table_location
lea rcx, str.____s
call fcn.140009570
mov rbx, rdi
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004010
cmp dword [0x1400464bc], 0xdead0000
lea rdx, str.Checking_Local_Descriptor_Table_location
movzx eax, byte [0x1400464c0]
mov ecx, r15d
setne cl
mov byte [rbp + 0x64c], al
call fcn.140012c60
lea rdx, str.Checking_Global_Descriptor_Table_location
lea rcx, str.____s
call fcn.140009570
mov rbx, r12
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004061
mov eax, dword [rbp + 0x648]
lea rdx, str.Checking_Global_Descriptor_Table_location
and eax, 0xff000000
mov ecx, r15d
cmp eax, 0xff000000
sete cl
call fcn.140012c60
lea rdx, str.Checking_Store_Task_Register
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x42
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400040b0
lea rdx, str.Checking_Store_Task_Register
xor ecx, ecx
call fcn.140012c60
lea rdx, str.Checking_Number_of_cores_in_machine_using_WMI
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x31
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400040f0
lea r8, [0x140042200]
mov qword [rbp + 0x5b8], r15
lea rdx, [rbp + 0x5b0]
mov qword [rbp + 0x5b0], r15
lea rcx, [rbp + 0x5b8]
mov qword [rbp + 0x648], r15
mov edi, r15d
call fcn.140015480
test eax, eax
je 0x1400042f1
lea rcx, [0x1400464a0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_Processor
mov r14, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, 1
mov rsi, rax
mov r15d, ebx
test r14, r14
je 0x1400041de
test rax, rax
je 0x1400041d5
mov rcx, qword [rbp + 0x5b8]
lea rax, [rbp + 0x648]
mov qword [rsp + 0x28], rax
mov r8, rsi
xor eax, eax
mov rdx, r14
mov qword [rsp + 0x20], rax
mov rbx, qword [rcx]
lea r9d, [rax + 0x30]
call qword [rbx + 0xa0]
test eax, eax
jns 0x1400041d0
xor eax, eax
lea rcx, str.ExecQuery
mov r15d, eax
call fcn.140012d90
mov rcx, qword [rbp + 0x5b8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x5b0]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov ebx, 1
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rsi, rsi
je 0x1400041ec
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r15d, r15d
je 0x1400042e9
mov rcx, qword [rbp + 0x648]
xor r15d, r15d
mov qword [rbp + 0x5d0], r15
mov dword [rbp + 0x650], r15d
test rcx, rcx
je 0x1400042c1
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x650]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x5d0]
mov edx, 0xffffffff
mov r8d, ebx
call qword [rax + 0x20]
cmp dword [rbp + 0x650], r15d
je 0x1400042ba
mov rcx, qword [rbp + 0x5d0]
lea r9, [rbp + 0x6e8]
mov qword [rsp + 0x28], r15
lea rdx, str.NumberOfCores
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x140004297
cmp word [rbp + 0x6e8], 1
je 0x140004297
cmp dword [rbp + 0x6f0], 2
lea rcx, [rbp + 0x6e8]
cmovb edi, ebx
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x5d0]
mov rax, qword [rcx]
call qword [rax + 0x10]
test edi, edi
jne 0x1400042ba
mov rcx, qword [rbp + 0x648]
test rcx, rcx
jne 0x140004220
jmp 0x1400042c1
mov rcx, qword [rbp + 0x648]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x5b8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x5b0]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x1400042ec
xor r15d, r15d
mov esi, 0x33
lea rdx, str.Checking_Number_of_cores_in_machine_using_WMI
mov ecx, edi
call fcn.140012c60
lea rdx, str.Checking_hard_disk_size_using_WMI
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x3d
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004320
call fcn.14000ec50
lea rdx, str.Checking_hard_disk_size_using_WMI
mov ecx, eax
call fcn.140012c60
lea rdx, str.Checking_hard_disk_size_using_DeviceIoControl
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x31
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004360
call fcn.14000eea0
lea rdx, str.Checking_hard_disk_size_using_DeviceIoControl
mov ecx, eax
call fcn.140012c60
lea rdx, str.Checking_SetupDi_diskdrive
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x44
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400043a0
call fcn.14000f1d0
lea rdx, str.Checking_SetupDi_diskdrive
mov ecx, eax
call fcn.140012c60
lea rdx, str.Checking_mouse_movement
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x47
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400043e0
lea rcx, [rbp + 0x5b8]
mov qword [rbp + 0x5b8], r15
mov qword [rbp + 0x648], r15
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x648]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rbp + 0x648]
cmp dword [rbp + 0x5b8], eax
jne 0x14000444c
mov eax, dword [rbp + 0x64c]
cmp dword [rbp + 0x5bc], eax
jne 0x14000444c
mov r14d, 1
mov ecx, r14d
jmp 0x140004455
mov ecx, r15d
mov r14d, 1
lea rdx, str.Checking_mouse_movement
call fcn.140012c60
lea rdx, str.Checking_lack_of_user_input
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x43
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004480
mov ebx, r15d
mov dword [rbp + 0x5e8], 8
mov edi, r15d
mov ecx, 0xb
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x5e8]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x1400044ea
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rbp + 0x5ec]
cmp eax, ecx
jb 0x1400044ea
sub eax, ecx
cmp eax, 0x64
jae 0x1400044e0
inc ebx
cmp ebx, 0xa
jge 0x140004bd1
inc edi
cmp edi, 0x80
jl 0x1400044a2
mov ecx, r14d
lea rdx, str.Checking_lack_of_user_input
call fcn.140012c60
lea rdx, str.Checking_memory_space_using_GlobalMemoryStatusEx
lea rcx, str.____s
call fcn.140009570
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub r13, 1
jne 0x140004510
xorps xmm0, xmm0
lea rcx, [rbp + 0x8a0]
movups xmmword [rbp + 0x8a0], xmm0
mov r13d, 0x40
mov dword [rbp + 0x8a0], r13d
movups xmmword [rbp + 0x8b0], xmm0
movups xmmword [rbp + 0x8c0], xmm0
movups xmmword [rbp + 0x8d0], xmm0
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp qword [rbp + 0x8a8], 0x40000000
lea rdx, str.Checking_memory_space_using_GlobalMemoryStatusEx
mov ecx, r15d
setb cl
call fcn.140012c60
lea rdx, str.Checking_disk_size_using_GetDiskFreeSpaceEx
lea rcx, str.____s
call fcn.140009570
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rsi, 1
jne 0x140004590
xor r9d, r9d
lea r8, [rbp + 0x5d8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1400045d0
movabs rax, 0x1400000000
mov ecx, r14d
cmp qword [rbp + 0x5d8], rax
jb 0x1400045d3
mov ecx, r15d
lea rdx, str.Checking_disk_size_using_GetDiskFreeSpaceEx
call fcn.140012c60
lea rdx, str.Checking_if_CPU_hypervisor_field_is_set_using_cpuid_0x1_
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x27
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004600
xor eax, eax
xor ecx, ecx
mov qword [rbp + 0x5dc], rax
mov eax, r14d
cpuid
sar ecx, 0x1f
mov dword [rbp + 0x5e4], edx
and ecx, 1
lea rdx, str.Checking_if_CPU_hypervisor_field_is_set_using_cpuid_0x1_
mov dword [rbp + 0x5d8], eax
mov dword [rbp + 0x5dc], ebx
call fcn.140012c60
lea rdx, str.Checking_hypervisor_vendor_using_cpuid_0x40000000_
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x2d
nop
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004660
xor ecx, ecx
mov qword [rbp + 0x11fc], r15
mov qword [rsp + 0x64], rcx
mov eax, 0x40000000
lea rcx, str.KVMKVMKVM
mov qword [rbp + 0x1204], r15
mov qword [rbp + 0x30], rcx
lea rcx, str.Microsoft_Hv
mov qword [rbp + 0x38], rcx
lea rcx, str.VMwareVMware
mov qword [rbp + 0x40], rcx
lea rcx, str.XenVMMXenVMM
mov qword [rbp + 0x48], rcx
lea rcx, str.prl_hyperv
mov qword [rbp + 0x50], rcx
lea rcx, str.VBoxVBoxVBox
mov qword [rbp + 0x58], rcx
xor ecx, ecx
cpuid
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x68], ecx
movsd xmm0, qword [rsp + 0x64]
movsd qword [rbp + 0x11f0], xmm0
mov qword [rbp + 0x120c], r15
mov qword [rbp + 0x1214], r15
mov qword [rbp + 0x121c], r15
mov qword [rbp + 0x1224], r15
mov dword [rbp + 0x122c], r15d
mov dword [rbp + 0x11f8], edx
xor eax, eax
lea r8, [rbp + 0x11f0]
mov dword [rsp + 0x28], eax
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r9d, [rax - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
lea ecx, [rax + 1]
movsxd rbx, ecx
add rbx, rbx
mov rcx, rbx
call fcn.14001ebfc
mov r14, rax
test rax, rax
je 0x1400047a3
mov rdi, rax
mov dword [rsp + 0x28], esi
xor eax, eax
mov qword [rsp + 0x20], r14
mov rcx, rbx
lea r8, [rbp + 0x11f0]
rep stosb byte [rdi], al
lea r9d, [rax - 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, qword [rbp + r15*8 + 0x30]
mov rax, r14
sub rdx, r14
nop
movzx ebx, word [rax]
movzx ecx, word [rax + rdx]
sub ebx, ecx
jne 0x140004793
add rax, 2
test ecx, ecx
jne 0x140004780
mov rcx, r14
call fcn.14001ec04
test ebx, ebx
je 0x140004bd9
inc r15
cmp r15, 6
jl 0x140004711
xor esi, esi
mov ecx, esi
lea rdx, str.Checking_hypervisor_vendor_using_cpuid_0x40000000_
call fcn.140012c60
lea rdx, str.Check_if_time_has_been_accelerated
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x3c
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400047e0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0xea60
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
lea rdx, str.Check_if_time_has_been_accelerated
sub eax, ebx
cmp eax, 0xe678
setbe cl
call fcn.140012c60
lea rdx, str.VM_Driver_Services
lea rcx, str.____s
call fcn.140009570
mov r12d, 0x4b
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub r12, 1
jne 0x140004840
call fcn.1400100d0
lea rdx, str.VM_Driver_Services
mov ecx, eax
call fcn.140012c60
lea rdx, str.Checking_SerialNumber_from_BIOS_using_WMI
lea rcx, str.____s
call fcn.140009570
mov r12, qword [rbp + 0x688]
nop
lea rcx, [0x1400457e8]
call fcn.140009570
sub r12, 1
jne 0x140004880
call fcn.14000f3e0
lea rdx, str.Checking_SerialNumber_from_BIOS_using_WMI
mov ecx, eax
call fcn.140012c60
lea rdx, str.Checking_Model_from_ComputerSystem_using_WMI
lea rcx, str.____s
call fcn.140009570
lea ebx, [r12 + 0x32]
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400048c0
call fcn.14000f650
lea rdx, str.Checking_Model_from_ComputerSystem_using_WMI
mov ecx, eax
call fcn.140012c60
lea rdx, str.Checking_Manufacturer_from_ComputerSystem_using_WMI
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x2b
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004900
call fcn.14000f8a0
lea rdx, str.Checking_Manufacturer_from_ComputerSystem_using_WMI
mov ecx, eax
call fcn.140012c60
lea rdx, str.Checking_Current_Temperature_using_WMI
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x38
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004940
call fcn.14000fb00
lea rdx, str.Checking_Current_Temperature_using_WMI
mov ecx, eax
call fcn.140012c60
lea rdx, str.Checking_ProcessId_using_WMI
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x42
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004980
call fcn.14000fd00
lea rdx, str.Checking_ProcessId_using_WMI
mov ecx, eax
call fcn.140012c60
lea rdx, str.Checking_power_capabilities
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x43
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400049c0
lea rcx, [rbp + 0x8e0]
mov ebx, esi
call qword [sym.imp.POWRPROF.dll_GetPwrCapabilities]
cmp al, 1
jne 0x140004a09
movzx eax, byte [rbp + 0x8e6]
or al, byte [rbp + 0x8e5]
or al, byte [rbp + 0x8e4]
or al, byte [rbp + 0x8e3]
jne 0x140004a09
cmp byte [rbp + 0x8ed], al
sete bl
lea rdx, str.Checking_power_capabilities
mov ecx, ebx
call fcn.140012c60
lea rdx, str.Checking_CPU_fan_using_WMI
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x44
nop
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004a30
lea r8, [0x140042200]
mov qword [rbp + 0x648], rsi
lea rdx, [rbp + 0x5d0]
mov qword [rbp + 0x5d0], rsi
lea rcx, [rbp + 0x648]
mov qword [rbp + 0x5b8], rsi
mov r12d, esi
mov edi, esi
call fcn.140015480
test eax, eax
je 0x140004bc6
lea rcx, [0x1400464a0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_Fan
mov r14, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea r15d, [rbx + 1]
mov rsi, rax
test r14, r14
je 0x140004b17
test rax, rax
je 0x140004b0e
mov rcx, qword [rbp + 0x648]
lea rax, [rbp + 0x5b8]
mov qword [rsp + 0x28], rax
lea r9d, [r15 + 0x2f]
xor eax, eax
mov r8, rsi
mov rdx, r14
mov qword [rsp + 0x20], rax
mov rbx, qword [rcx]
call qword [rbx + 0xa0]
test eax, eax
jns 0x140004b0e
xor eax, eax
lea rcx, str.ExecQuery
mov r15d, eax
call fcn.140012d90
mov rcx, qword [rbp + 0x648]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x5d0]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rsi, rsi
je 0x140004b25
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
test r15d, r15d
je 0x140004bc6
mov rcx, qword [rbp + 0x5b8]
mov qword [rbp + 0x5e8], rsi
mov dword [rbp + 0x650], esi
test rcx, rcx
je 0x140004b95
nop dword [rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x650]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x5e8]
mov edx, 0xffffffff
lea r8d, [rdx + 2]
call qword [rax + 0x20]
cmp dword [rbp + 0x650], esi
je 0x140004b95
mov rcx, qword [rbp + 0x5e8]
inc edi
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x5b8]
test rcx, rcx
jne 0x140004b50
mov rcx, qword [rbp + 0x648]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x5d0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x5b8]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
test edi, edi
jne 0x140004be5
mov r15d, 1
mov r12d, r15d
jmp 0x140004beb
mov ecx, r15d
jmp 0x1400044ed
mov ecx, 1
xor esi, esi
jmp 0x1400047b4
mov r15d, 1
lea rdx, str.Checking_CPU_fan_using_WMI
mov ecx, r12d
call fcn.140012c60
lea rdx, str.Checking_NtQueryLicenseValue_with_Kernel_VMDetection_Private
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x22
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004c12
lea rdx, [0x140064d50]
mov ecx, esi
mov rax, rdx
cmp dword [rax], 0x1b
je 0x140004cc5
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140004c30
mov rdi, rsi
mov ecx, esi
mov rax, rdx
nop dword [rax]
cmp dword [rax], 0x11
je 0x140004ce4
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140004c50
mov rbx, rsi
test rdi, rdi
je 0x140004d03
test rbx, rbx
je 0x140004d03
lea rdx, str.Kernel_VMDetection_Private
lea rcx, [rbp + 0x6a0]
call rdi
lea rax, [rbp + 0x5c0]
mov dword [rbp + 0x640], esi
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x640]
xor edx, edx
lea rcx, [rbp + 0x6a0]
call rbx
mov ecx, esi
test eax, eax
js 0x140004d05
cmp dword [rbp + 0x640], 0
setne cl
jmp 0x140004d05
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
je 0x140004c44
mov rdi, qword [rdx + rcx*8 + 0x28]
jmp 0x140004c47
movsxd rax, ecx
lea rbx, [rax + rax*2]
add rbx, rbx
cmp byte [rdx + rbx*8 + 0x24], 0
je 0x140004c64
mov rbx, qword [rdx + rbx*8 + 0x28]
jmp 0x140004c67
mov ecx, esi
lea rdx, str.Checking_NtQueryLicenseValue_with_Kernel_VMDetection_Private
call fcn.140012c60
lea rdx, str.Checking_Win32_CacheMemory_with_WMI
lea rcx, str.____s
call fcn.140009570
mov r14d, 0x3b
mov ebx, r14d
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004d30
lea rcx, str.SELECT__FROM_Win32_CacheMemory
call fcn.14000ff10
test eax, eax
lea rdx, str.Checking_Win32_CacheMemory_with_WMI
mov ecx, esi
sete cl
call fcn.140012c60
lea rdx, str.Checking_Win32_PhysicalMemory_with_WMI
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x38
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004d80
lea rcx, str.SELECT__FROM_Win32_PhysicalMemory
call fcn.14000ff10
test eax, eax
lea rdx, str.Checking_Win32_PhysicalMemory_with_WMI
mov ecx, esi
sete cl
call fcn.140012c60
lea rdx, str.Checking_Win32_MemoryDevice_with_WMI
lea rcx, str.____s
call fcn.140009570
mov edi, 0x3a
mov ebx, edi
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004dd0
lea rcx, str.SELECT__FROM_Win32_MemoryDevice
call fcn.14000ff10
test eax, eax
lea rdx, str.Checking_Win32_MemoryDevice_with_WMI
mov ecx, esi
sete cl
call fcn.140012c60
lea rdx, str.Checking_Win32_MemoryArray_with_WMI
lea rcx, str.____s
call fcn.140009570
mov rbx, r14
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004e20
lea rcx, str.SELECT__FROM_Win32_MemoryArray
call fcn.14000ff10
test eax, eax
lea rdx, str.Checking_Win32_MemoryArray_with_WMI
mov ecx, esi
sete cl
call fcn.140012c60
lea rdx, str.Checking_Win32_VoltageProbe_with_WMI
lea rcx, str.____s
call fcn.140009570
mov rbx, rdi
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004e70
lea rcx, str.SELECT__FROM_Win32_VoltageProbe
call fcn.14000ff10
test eax, eax
lea rdx, str.Checking_Win32_VoltageProbe_with_WMI
mov ecx, esi
sete cl
call fcn.140012c60
lea rdx, str.Checking_Win32_PortConnector_with_WMI
lea rcx, str.____s
call fcn.140009570
lea rcx, [0x1400457e8]
call fcn.140009570
sub qword [rsp + 0x70], 1
jne 0x140004eb4
lea rcx, str.SELECT__FROM_Win32_PortConnector
call fcn.14000ff10
test eax, eax
lea rdx, str.Checking_Win32_PortConnector_with_WMI
mov ecx, esi
sete cl
call fcn.140012c60
lea rdx, str.Checking_Win32_SMBIOSMemory_with_WMI
lea rcx, str.____s
call fcn.140009570
mov rbx, rdi
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004f00
lea rcx, str.SELECT__FROM_Win32_SMBIOSMemory
call fcn.14000ff10
test eax, eax
lea rdx, str.Checking_Win32_SMBIOSMemory_with_WMI
mov ecx, esi
sete cl
call fcn.140012c60
lea rdx, str.Checking_ThermalZoneInfo_performance_counters_with_WMI
lea rcx, str.____s
call fcn.140009570
mov edi, 0x28
mov ebx, edi
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004f50
lea rcx, str.SELECT__FROM_Win32_PerfFormattedData_Counters_ThermalZoneInformation
call fcn.14000ff10
test eax, eax
lea rdx, str.Checking_ThermalZoneInfo_performance_counters_with_WMI
mov ecx, esi
sete cl
call fcn.140012c60
lea rdx, str.Checking_CIM_Memory_with_WMI
lea rcx, str.____s
call fcn.140009570
mov esi, 0x42
mov ebx, esi
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004fa0
lea rcx, str.SELECT__FROM_CIM_Memory
call fcn.14000ff10
xor r12d, r12d
lea rdx, str.Checking_CIM_Memory_with_WMI
test eax, eax
mov ecx, r12d
sete cl
call fcn.140012c60
lea rdx, str.Checking_CIM_Sensor_with_WMI
lea rcx, str.____s
call fcn.140009570
mov rbx, rsi
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140004ff0
lea rcx, str.SELECT__FROM_CIM_Sensor
call fcn.14000ff10
test eax, eax
lea rdx, str.Checking_CIM_Sensor_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c60
lea rdx, str.Checking_CIM_NumericSensor_with_WMI
lea rcx, str.____s
call fcn.140009570
mov rbx, r14
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140005040
lea rcx, str.SELECT__FROM_CIM_NumericSensor
call fcn.14000ff10
test eax, eax
lea rdx, str.Checking_CIM_NumericSensor_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c60
lea rdx, str.Checking_CIM_TemperatureSensor_with_WMI
lea rcx, str.____s
call fcn.140009570
mov esi, 0x37
mov ebx, esi
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140005090
lea rcx, str.SELECT__FROM_CIM_TemperatureSensor
call fcn.14000ff10
test eax, eax
lea rdx, str.Checking_CIM_TemperatureSensor_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c60
lea rdx, str.Checking_CIM_VoltageSensor_with_WMI
lea rcx, str.____s
call fcn.140009570
mov rbx, r14
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400050e0
lea rcx, str.SELECT__FROM_CIM_VoltageSensor
call fcn.14000ff10
test eax, eax
lea rdx, str.Checking_CIM_VoltageSensor_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c60
lea rdx, str.Checking_CIM_PhysicalConnector_with_WMI
lea rcx, str.____s
call fcn.140009570
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rsi, 1
jne 0x140005130
lea rcx, str.SELECT__FROM_CIM_PhysicalConnector
call fcn.14000ff10
test eax, eax
lea rdx, str.Checking_CIM_PhysicalConnector_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c60
lea rdx, str.Checking_CIM_Slot_with_WMI
lea rcx, str.____s
call fcn.140009570
lea ebx, [rsi + 0x44]
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140005180
lea rcx, str.SELECT__FROM_CIM_Slot
call fcn.14000ff10
test eax, eax
lea rdx, str.Checking_CIM_Slot_with_WMI
mov ecx, r12d
sete cl
call fcn.140012c60
lea rdx, str.Checking_if_Windows_is_Genuine
lea rcx, str.____s
call fcn.140009570
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub r13, 1
jne 0x1400051d0
xor r8d, r8d
mov dword [rbp + 0x678], 0x55c92734
lea rdx, [rbp + 0x65c]
mov dword [rbp + 0x67c], 0x4d71d682
lea rcx, [rbp + 0x678]
mov dword [rbp + 0x680], 0xecd63e98
mov dword [rbp + 0x684], 0x9f05163f
call qword [sym.imp.SLWGA.dll_SLIsGenuineLocal]
test eax, eax
jne 0x140005231
mov ecx, r15d
cmp dword [rbp + 0x65c], r12d
jne 0x140005234
mov ecx, r12d
lea rdx, str.Checking_if_Windows_is_Genuine
call fcn.140012c60
lea rdx, str.Checking_ServicesDiskEnum_entries_for_VM_strings
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x2c
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140005260
lea rax, [0x140042b88]
mov qword [rbp + 0x5c0], r12
mov qword [rbp + 0xe8], rax
lea r13, str.virtio
lea rax, [0x140042b90]
mov dword [rbp + 0x5b0], r12d
mov qword [rbp + 0xf0], rax
lea r12, str.qemu
lea rax, str.Virtual
mov dword [rbp + 0x65c], 4
mov qword [rbp + 0xf8], rax
lea rbx, str.vmware
xor eax, eax
mov qword [rbp + 0xc8], r12
mov r14d, eax
mov qword [rbp + 0xd0], r13
lea rax, [rbp + 0x5c0]
mov qword [rbp + 0xd8], rbx
lea rsi, str.vbox
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov qword [rbp + 0xe0], rsi
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetServicesDiskEnum
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000536e
mov rcx, qword [rbp + 0x5c0]
lea rax, [rbp + 0x65c]
mov qword [rsp + 0x28], rax
lea rdx, str.Count
lea rax, [rbp + 0x5b0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x5c0]
test eax, eax
je 0x140005368
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400053ed
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esi, eax
cmp dword [rbp + 0x5b0], eax
jbe 0x1400053e6
nop word [rax + rax]
mov r9d, esi
lea r8, [0x140042ba4]
mov edx, 0xb
lea rcx, [rbp + 0x610]
call fcn.1400095d0
xor eax, eax
lea rbx, [rbp + 0xc8]
mov edi, eax
mov r9, qword [rbx]
lea r8, [rbp + 0x610]
lea rdx, str.SystemCurrentControlSetServicesDiskEnum
call fcn.140013350
test eax, eax
jne 0x1400053d7
inc edi
add rbx, 8
cmp edi, 7
jb 0x1400053a6
inc esi
cmp esi, dword [rbp + 0x5b0]
jb 0x140005380
jmp 0x1400053da
mov r14d, r15d
lea rbx, str.vmware
mov edi, 0x28
lea rsi, str.vbox
lea rdx, str.Checking_ServicesDiskEnum_entries_for_VM_strings
mov ecx, r14d
call fcn.140012c60
lea rdx, str.Checking_EnumIDE_and_EnumSCSI_entries_for_VM_strings
lea rcx, str.____s
call fcn.140009570
nop
lea rcx, [0x1400457e8]
call fcn.140009570
sub rdi, 1
jne 0x140005410
lea rax, str.SystemCurrentControlSetEnumIDE
mov qword [rbp + 0x90], r12
mov qword [rbp - 0x58], rax
lea r12, [rbp - 0x58]
lea rax, str.SystemCurrentControlSetEnumSCSI
mov qword [rbp + 0x98], r13
mov qword [rbp - 0x50], rax
mov r13d, edi
lea rax, [0x140042b88]
mov qword [rbp + 0x5c0], rdi
mov qword [rbp + 0xb0], rax
lea rax, [0x140042b90]
mov qword [rbp + 0xb8], rax
lea rax, str.Virtual
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xa0], rbx
mov qword [rbp + 0xa8], rsi
nop dword [rax]
mov rdx, qword [r12]
lea rax, [rbp + 0x5c0]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x5b0], edi
mov rcx, 0xffffffff80000002
mov dword [rbp + 0x640], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400055cf
mov rcx, qword [rbp + 0x5c0]
lea rax, [rbp + 0x640]
mov qword [rsp + 0x58], rdi
xor r9d, r9d
mov qword [rsp + 0x50], rdi
xor r8d, r8d
mov qword [rsp + 0x48], rdi
xor edx, edx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x5b0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1400055c2
mov eax, dword [rbp + 0x640]
lea r15d, [rax*2 + 2]
mov ecx, r15d
call fcn.14001ebfc
mov rsi, rax
test rax, rax
je 0x1400055c2
cmp dword [rbp + 0x5b0], 0
mov r14d, edi
jbe 0x1400055ba
nop dword [rax + rax]
mov rcx, qword [rbp + 0x5c0]
lea r9, [rbp + 0x660]
mov qword [rsp + 0x38], rdi
mov r8, rsi
mov qword [rsp + 0x30], rdi
mov edx, r14d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov dword [rbp + 0x660], r15d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400055ae
lea rbx, [rbp + 0x90]
mov rdx, qword [rbx]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x1400055e4
inc edi
add rbx, 8
cmp edi, 7
jb 0x140005590
xor edi, edi
inc r14d
cmp r14d, dword [rbp + 0x5b0]
jb 0x140005550
mov rcx, rsi
call fcn.14001ec04
mov rcx, qword [rbp + 0x5c0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r13d
add r12, 8
mov ebx, edi
cmp r13d, 2
jb 0x140005490
jmp 0x1400055fe
mov rcx, rsi
mov ebx, 1
call fcn.14001ec04
mov rcx, qword [rbp + 0x5c0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Checking_EnumIDE_and_EnumSCSI_entries_for_VM_strings
mov ecx, ebx
call fcn.140012c60
cmp dword [0x140066974], 0
lea r15, [0x140043330]
lea r14, str.Identifier
lea r13, str.HARDWAREDescriptionSystem
je 0x1400063b7
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x808]
mov ecx, SafeArrayGetElement
mov rsi, rax
lea rdx, [rbp + 0x808]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x810]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.VirtualBox_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140009570
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.VBOX
mov qword [rbp + 0x2c8], r14
mov qword [rbp + 0x2d0], rax
lea rcx, str.SystemBiosVersion
mov qword [rbp + 0x2e8], rax
lea rsi, [rbp + 0x2c8]
lea rax, str.VideoBiosVersion
mov qword [rbp + 0x2c0], r15
mov qword [rbp + 0x2f8], rax
mov r14d, 4
lea rax, str.VIRTUALBOX
mov qword [rbp + 0x2d8], r13
mov qword [rbp + 0x300], rax
lea rax, str.SystemBiosDate
mov qword [rbp + 0x310], rax
lea rax, str.06_23_99
mov qword [rbp + 0x318], rax
lea r12d, [r14 - 3]
mov qword [rbp + 0x2e0], rcx
mov qword [rbp + 0x2f0], r13
mov qword [rbp + 0x308], r13
nop
xor edx, edx
lea rcx, [rbp + 0x3a60]
mov r8d, 0x200
call fcn.1400184d0
mov rbx, qword [rsi + 8]
lea r8, str.Checking_reg_key_HARDWAREDescriptionSystem____s_is_set_to__s
mov r9, qword [rsi]
lea rcx, [rbp + 0x3a60]
mov edx, 0x100
mov qword [rsp + 0x20], rbx
call fcn.1400095d0
mov r8, qword [rsi]
mov r9, rbx
mov rdx, qword [rsi - 8]
call fcn.140013350
lea rdx, [rbp + 0x3a60]
lea rcx, str.____s
test eax, eax
je 0x1400057ba
call fcn.140009570
lea rcx, [rbp + 0x3a60]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005790
mov ebx, 0x5f
sub rbx, rax
je 0x1400057b5
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, r12
jne 0x1400057a4
mov ecx, r12d
jmp 0x1400057f7
call fcn.140009570
lea rcx, [rbp + 0x3a60]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400057d0
mov ebx, 0x5f
sub rbx, rax
je 0x1400057f5
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, r12
jne 0x1400057e4
xor ecx, ecx
lea rdx, [rbp + 0x3a60]
call fcn.140012c60
add rsi, 0x18
sub r14, r12
jne 0x140005720
lea rdx, str.Checking_VirtualBox_Guest_Additions_directory
lea rcx, str.____s
call fcn.140009570
lea rcx, [0x1400457e8]
call fcn.140009570
sub qword [rbp + 0x5f0], 1
jne 0x140005823
xor edx, edx
lea rcx, [rbp + 0x4cb0]
mov r8d, 0x208
call fcn.1400184d0
movaps xmm0, xmmword [str.oracle_virtualbox_guest_additions_]
lea rcx, [rbp + 0x3896]
movaps xmm1, xmmword [0x140043e60]
xor edx, edx
mov eax, dword [0x140043e90]
mov r8d, 0x1c2
movaps xmmword [rbp + 0x3850], xmm0
movaps xmm0, xmmword [0x140043e70]
movaps xmmword [rbp + 0x3860], xmm1
movaps xmm1, xmmword [0x140043e80]
mov dword [rbp + 0x3890], eax
movzx eax, word [0x140043e94]
movaps xmmword [rbp + 0x3870], xmm0
movaps xmmword [rbp + 0x3880], xmm1
mov word [rbp + 0x3894], ax
call fcn.1400184d0
call fcn.140013290
lea rdx, [rbp + 0x4aa0]
test eax, eax
je 0x1400058d8
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x1400058e7
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x3850]
lea rdx, [rbp + 0x4aa0]
lea rcx, [rbp + 0x4cb0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x4cb0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140005926
test al, 0x10
je 0x140005926
mov r15d, 1
xor r14d, r14d
mov ecx, r15d
jmp 0x140005930
xor r14d, r14d
mov ecx, r14d
lea r15d, [r14 + 1]
lea rdx, str.Checking_VirtualBox_Guest_Additions_directory
call fcn.140012c60
call fcn.140010370
lea rax, str.HARDWAREACPIDSDTVBOX__
mov esi, 9
mov qword [rbp + 0x1c0], rax
lea rdi, [rbp + 0x1c0]
lea rax, str.HARDWAREACPIFADTVBOX__
mov qword [rbp + 0x1c8], rax
lea rax, str.HARDWAREACPIRSDTVBOX__
mov qword [rbp + 0x1d0], rax
lea rax, str.SOFTWAREOracleVirtualBox_Guest_Additions
mov qword [rbp + 0x1d8], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxGuest
mov qword [rbp + 0x1e0], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxMouse
mov qword [rbp + 0x1e8], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxService
mov qword [rbp + 0x1f0], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxSF
mov qword [rbp + 0x1f8], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxVideo
mov qword [rbp + 0x200], rax
nop dword [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x1250]
mov r8d, 0x200
call fcn.1400184d0
mov r9, qword [rdi]
lea r8, [0x140042fb0]
mov edx, 0x100
lea rcx, [rbp + 0x1250]
call fcn.1400095d0
mov rdx, qword [rdi]
lea rax, [rbp + 0x5f0]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp + 0x5f0], r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005a8b
mov rcx, qword [rbp + 0x5f0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x1250]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x1250]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005a60
mov ebx, 0x5f
sub rbx, rax
je 0x140005a86
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140005a74
mov ecx, r15d
jmp 0x140005ad8
lea rdx, [rbp + 0x1250]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x1250]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005ab0
mov ebx, 0x5f
sub rbx, rax
je 0x140005ad6
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140005ac4
xor ecx, ecx
lea rdx, [rbp + 0x1250]
call fcn.140012c60
add rdi, 8
sub rsi, 1
jne 0x1400059d0
lea rdx, str.Checking_Mac_Address_start_with_08:00:27
lea rcx, str.____s
call fcn.140009570
lea ebx, [rsi + 0x36]
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140005b10
lea rcx, [0x140043e98]
call fcn.140013440
lea rdx, str.Checking_Mac_Address_start_with_08:00:27
mov ecx, eax
call fcn.140012c60
lea rdx, str.Checking_MAC_address__Hybrid_Analysis_
lea rcx, str.____s
call fcn.140009570
lea r12d, [rbx + 0x38]
lea rcx, [0x1400457e8]
call fcn.140009570
sub r12, 1
jne 0x140005b53
lea rcx, [0x1400421f8]
call fcn.140013440
lea rdx, str.Checking_MAC_address__Hybrid_Analysis_
mov ecx, eax
call fcn.140012c60
lea rax, [0x140043ea0]
mov r13d, 5
mov qword [rbp + 8], rax
lea rsi, [rbp + 8]
lea rax, str..VBoxGuest
mov r14d, r13d
mov qword [rbp + 0x10], rax
lea rax, str..pipeVBoxMiniRdDN
mov qword [rbp + 0x18], rax
lea rax, str..VBoxTrayIPC
mov qword [rbp + 0x20], rax
lea rax, str..pipeVBoxTrayIPC
mov qword [rbp + 0x28], rax
mov rcx, qword [rsi]
xor eax, eax
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov r8d, r15d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
lea rcx, [rbp + 0x1450]
mov r8d, 0x200
mov rdi, rax
call fcn.1400184d0
mov r9, qword [rsi]
lea r8, str.Checking_device__s
mov edx, 0x100
lea rcx, [rbp + 0x1450]
call fcn.1400095d0
cmp rdi, 0xffffffffffffffff
je 0x140005c7b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x1450]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x1450]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005c50
mov ebx, 0x5f
sub rbx, rax
je 0x140005c76
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140005c64
mov ecx, r15d
jmp 0x140005cc8
lea rdx, [rbp + 0x1450]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x1450]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005ca0
mov ebx, 0x5f
sub rbx, rax
je 0x140005cc6
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140005cb4
xor ecx, ecx
lea rdx, [rbp + 0x1450]
call fcn.140012c60
add rsi, 8
sub r14, 1
jne 0x140005bc3
lea rdx, str.Checking_VBoxTrayToolWndClass___VBoxTrayToolWnd
lea rcx, str.____s
call fcn.140009570
lea ebx, [r14 + 0x2f]
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140005d00
xor edx, edx
lea rcx, str.VBoxTrayToolWndClass
call qword [sym.imp.USER32.dll_FindWindowW]
lea rdx, str.VBoxTrayToolWnd
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowW]
test rbx, rbx
jne 0x140005d45
test rax, rax
jne 0x140005d45
xor r14d, r14d
mov ecx, r14d
jmp 0x140005d4b
mov ecx, r15d
xor r14d, r14d
lea rdx, str.Checking_VBoxTrayToolWndClass___VBoxTrayToolWnd
call fcn.140012c60
lea rdx, str.Checking_VirtualBox_Shared_Folders_network_provider
lea rcx, str.____s
call fcn.140009570
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub qword [rbp + 0x670], 1
jne 0x140005d70
xor edx, edx
lea rcx, [rbp + 0x4ec0]
mov r8d, 0x208
call fcn.1400184d0
lea r8, [rbp + 0x660]
mov dword [rbp + 0x660], 0x104
lea rdx, [rbp + 0x4ec0]
mov ecx, 0x250000
call qword [sym.imp.MPR.dll_WNetGetProviderNameW]
test eax, eax
jne 0x140005ddf
lea rdx, str.VirtualBox_Shared_Folders
lea rcx, [rbp + 0x4ec0]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
mov ecx, r14d
sete cl
jmp 0x140005de2
mov ecx, r14d
lea rdx, str.Checking_VirtualBox_Shared_Folders_network_provider
call fcn.140012c60
lea rax, str.vboxservice.exe
mov esi, 2
mov qword [rbp - 0x48], rax
lea rdi, [rbp - 0x48]
lea rax, str.vboxtray.exe
mov qword [rbp - 0x40], rax
nop dword [rax]
xor edx, edx
lea rcx, [rbp + 0x1650]
mov r8d, 0x200
call fcn.1400184d0
mov r9, qword [rdi]
lea r8, str.Checking_VirtualBox_process__s
mov edx, 0x100
lea rcx, [rbp + 0x1650]
call fcn.1400095d0
mov rcx, qword [rdi]
call fcn.140015370
lea rdx, [rbp + 0x1650]
lea rcx, str.____s
test eax, eax
je 0x140005e9b
call fcn.140009570
lea rcx, [rbp + 0x1650]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005e70
mov ebx, 0x5f
sub rbx, rax
je 0x140005e96
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140005e84
mov ecx, r15d
jmp 0x140005ed8
call fcn.140009570
lea rcx, [rbp + 0x1650]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005eb0
mov ebx, 0x5f
sub rbx, rax
je 0x140005ed6
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140005ec4
xor ecx, ecx
lea rdx, [rbp + 0x1650]
call fcn.140012c60
add rdi, 8
sub rsi, 1
jne 0x140005e10
lea rdx, str.Checking_Win32_PnPDevice_DeviceId_from_WMI_for_VBox_PCI_device
lea rcx, str.____s
call fcn.140009570
lea ebx, [rsi + 0x20]
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140005f10
lea r8, [0x140042200]
mov qword [rbp + 0x5c0], r14
lea rdx, [rbp + 0x5d0]
mov qword [rbp + 0x5d0], r14
lea rcx, [rbp + 0x5c0]
mov qword [rbp + 0x648], r14
mov edi, r14d
call fcn.140015480
test eax, eax
je 0x140006105
lea rcx, [0x1400464a0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_PnPEntity
mov r14, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
test r14, r14
je 0x140005ff1
test rax, rax
je 0x140005fe8
mov rcx, qword [rbp + 0x5c0]
lea rax, [rbp + 0x648]
mov qword [rsp + 0x28], rax
mov r8, rsi
xor eax, eax
mov rdx, r14
mov qword [rsp + 0x20], rax
mov rbx, qword [rcx]
lea r9d, [rax + 0x30]
call qword [rbx + 0xa0]
test eax, eax
jns 0x140005fe8
xor eax, eax
lea rcx, str.ExecQuery
mov r15d, eax
call fcn.140012d90
mov rcx, qword [rbp + 0x5c0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x5d0]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rsi, rsi
je 0x140005fff
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor r14d, r14d
test r15d, r15d
lea r15d, [r14 + 1]
je 0x140006105
mov rcx, qword [rbp + 0x648]
mov qword [rbp + 0x5b8], r14
mov dword [rbp + 0x640], r14d
test rcx, rcx
je 0x1400060d8
nop dword [rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x640]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x5b8]
mov edx, 0xffffffff
mov r8d, r15d
call qword [rax + 0x20]
cmp dword [rbp + 0x640], r14d
je 0x1400060d8
mov rcx, qword [rbp + 0x5b8]
lea r9, [rbp + 0x628]
mov qword [rsp + 0x28], r14
lea rdx, str.DeviceId
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x1400060b7
cmp word [rbp + 0x628], 8
jne 0x1400060aa
mov rcx, qword [rbp + 0x630]
lea rdx, str.PCIVEN_80EEDEV_CAFE
call fcn.1400171d4
test rax, rax
cmovne edi, r15d
lea rcx, [rbp + 0x628]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x5b8]
mov rax, qword [rcx]
call qword [rax + 0x10]
test edi, edi
jne 0x1400060d8
mov rcx, qword [rbp + 0x648]
test rcx, rcx
jne 0x140006030
mov rcx, qword [rbp + 0x5c0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x5d0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x648]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.Checking_Win32_PnPDevice_DeviceId_from_WMI_for_VBox_PCI_device
mov ecx, edi
call fcn.140012c60
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBox_controller_hardware
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x1b
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140006130
call fcn.140010cb0
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBox_controller_hardware
mov ecx, eax
call fcn.140012c60
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBOX_names
lea rcx, str.____s
call fcn.140009570
lea r12d, [rbx + 0x29]
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub r12, 1
jne 0x140006170
call fcn.140011410
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBOX_names
mov ecx, eax
call fcn.140012c60
lea rdx, str.Checking_Win32_Bus_from_WMI
lea rcx, str.____s
call fcn.140009570
mov r12d, 0x49
nop
lea rcx, [0x1400457e8]
call fcn.140009570
sub qword [rbp + 0x5c8], 1
jne 0x1400061b0
call fcn.140010f10
lea rdx, str.Checking_Win32_Bus_from_WMI
mov ecx, eax
call fcn.140012c60
lea rdx, str.Checking_Win32_BaseBoard_from_WMI
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x3d
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400061f1
call fcn.140011170
lea rdx, str.Checking_Win32_BaseBoard_from_WMI
mov ecx, eax
call fcn.140012c60
lea rdx, str.Checking_MAC_address_from_WMI
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x41
nop
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140006230
call fcn.140010610
lea rdx, str.Checking_MAC_address_from_WMI
mov ecx, eax
call fcn.140012c60
lea rdx, str.Checking_NTEventLog_from_WMI
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x42
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140006270
call fcn.140010830
lea rdx, str.Checking_NTEventLog_from_WMI
mov ecx, eax
call fcn.140012c60
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, str.____s
call fcn.140009570
mov ebx, 0x45
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400062b0
lea r8, [rbp + 0x640]
mov dword [rbp + 0x640], r14d
xor edx, edx
mov ecx, 0x52534d42
mov edi, r14d
call fcn.140015750
mov rdx, rax
test rax, rax
je 0x14000635e
mov ebx, dword [rbp + 0x640]
mov rcx, r14
lea rax, [rbx - 0xa]
test rax, rax
je 0x14000631a
movabs r8, 0x426c617574726956
cmp qword [rcx + rdx], r8
jne 0x140006312
cmp word [rcx + rdx + 8], 0x786f
je 0x140006353
inc rcx
cmp rcx, rax
jb 0x140006303
lea rcx, [rbx - 4]
mov rax, r14
test rcx, rcx
je 0x140006356
cmp dword [rax + rdx], 0x786f6276
je 0x140006353
inc rax
cmp rax, rcx
jb 0x140006326
mov rax, r14
nop word [rax + rax]
cmp dword [rax + rdx], 0x584f4256
je 0x140006353
inc rax
cmp rax, rcx
jb 0x140006340
jmp 0x140006356
mov edi, r15d
mov rcx, rdx
call fcn.14001ec04
lea rdx, str.Checking_SMBIOS_firmware
mov ecx, edi
call fcn.140012c60
lea rdx, str.Checking_ACPI_tables
lea rcx, str.____s
call fcn.140009570
mov rbx, r12
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140006382
call fcn.140010b50
lea rdx, str.Checking_ACPI_tables
mov ecx, eax
call fcn.140012c60
lea r14, str.Identifier
lea r15, [0x140043330]
jmp 0x1400063bd
mov r13d, 5
cmp dword [0x140066970], 0
je 0x140006fde
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x700]
mov ecx, SafeArrayGetElement
mov rsi, rax
lea rdx, [rbp + 0x700]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x708]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.VMWare_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140009570
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.VMWARE
mov qword [rbp + 0x390], r15
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_1Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp + 0x398], r14
mov qword [rbp + 0x3a8], rax
lea rcx, str.SYSTEMControlSet001ControlSystemInformation
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_2Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp + 0x3a0], rdx
mov qword [rbp + 0x3c0], rax
lea rdi, [rbp + 0x3a0]
lea rax, str.SystemManufacturer
mov qword [rbp + 0x3b0], r14
mov qword [rbp + 0x3e0], rax
mov r12d, 1
lea rax, str.SystemProductName
mov qword [rbp + 0x3b8], rdx
mov qword [rbp + 0x3f8], rax
mov qword [rbp + 0x3c8], r14
mov qword [rbp + 0x3d0], rdx
mov qword [rbp + 0x3d8], rcx
mov qword [rbp + 0x3e8], rdx
mov qword [rbp + 0x3f0], rcx
mov qword [rbp + 0x400], rdx
nop dword [rax]
xor edx, edx
lea rcx, [rbp + 0x1850]
mov r8d, 0x200
call fcn.1400184d0
mov r9, qword [rdi - 0x10]
lea r8, str.Checking_reg_key__s
mov edx, 0x100
lea rcx, [rbp + 0x1850]
call fcn.1400095d0
mov r9, qword [rdi]
mov r8, qword [rdi - 8]
mov rdx, qword [rdi - 0x10]
call fcn.140013350
lea rdx, [rbp + 0x1850]
lea rcx, str.____s
test eax, eax
je 0x140006566
call fcn.140009570
lea rcx, [rbp + 0x1850]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006535
mov ebx, 0x5f
sub rbx, rax
je 0x140006561
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, r12
jne 0x140006550
mov ecx, r12d
jmp 0x1400065a7
call fcn.140009570
lea rcx, [rbp + 0x1850]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006580
mov ebx, 0x5f
sub rbx, rax
je 0x1400065a5
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, r12
jne 0x140006594
xor ecx, ecx
lea rdx, [rbp + 0x1850]
call fcn.140012c60
add rdi, 0x18
sub r13, r12
jne 0x1400064d0
xor edx, edx
lea rcx, [rbp + 0x1a50]
mov r8d, 0x200
call fcn.1400184d0
lea r9, str.SOFTWAREVMware__Inc.VMware_Tools
mov edx, 0x100
lea r8, [0x140042fb0]
lea rcx, [rbp + 0x1a50]
call fcn.1400095d0
lea rax, [rbp + 0x5c8]
xor edi, edi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp + 0x5c8], rdi
lea rdx, str.SOFTWAREVMware__Inc.VMware_Tools
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006695
mov rcx, qword [rbp + 0x5c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x1a50]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x1a50]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], di
jne 0x140006657
mov ebx, 0x5f
sub rbx, rax
je 0x140006681
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, r12
jne 0x140006670
lea rdx, [rbp + 0x1a50]
mov ecx, r12d
mov r13, r12
call fcn.140012c60
jmp 0x1400066f2
lea rdx, [rbp + 0x1a50]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x1a50]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], di
jne 0x1400066b6
mov ebx, 0x5f
sub rbx, rax
je 0x1400066e1
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, r12
jne 0x1400066d0
lea rdx, [rbp + 0x1a50]
xor ecx, ecx
call fcn.140012c60
mov r13, r12
lea rax, str.System32drivers_vmnet.sys
xor edx, edx
mov qword [rbp + 0x320], rax
lea rcx, [rbp + 0x50d0]
lea rax, str.System32drivers_vmmouse.sys
mov r8d, 0x208
mov qword [rbp + 0x328], rax
lea rax, str.System32drivers_vmusb.sys
mov qword [rbp + 0x330], rax
lea rax, str.System32drivers_vm3dmp.sys
mov qword [rbp + 0x338], rax
lea rax, str.System32drivers_vmci.sys
mov qword [rbp + 0x340], rax
lea rax, str.System32drivers_vmhgfs.sys
mov qword [rbp + 0x348], rax
lea rax, str.System32drivers_vmmemctl.sys
mov qword [rbp + 0x350], rax
lea rax, str.System32drivers_vmx86.sys
mov qword [rbp + 0x358], rax
lea rax, str.System32drivers_vmrawdsk.sys
mov qword [rbp + 0x360], rax
lea rax, str.System32drivers_vmusbmouse.sys
mov qword [rbp + 0x368], rax
lea rax, str.System32drivers_vmkdb.sys
mov qword [rbp + 0x370], rax
lea rax, str.System32drivers_vmnetuserif.sys
mov qword [rbp + 0x378], rax
lea rax, str.System32drivers_vmnetadapter.sys
mov qword [rbp + 0x380], rax
call fcn.1400184d0
xor edx, edx
lea rcx, [rbp + 0x4270]
mov r8d, 0x208
call fcn.1400184d0
mov edx, 0x104
mov qword [rbp + 0x5c8], rdi
lea rcx, [rbp + 0x50d0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call fcn.140013290
test eax, eax
je 0x140006800
lea rcx, [rbp + 0x5c8]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
nop
mov r8, qword [rbp + rdi*8 + 0x320]
lea rdx, [rbp + 0x50d0]
lea rcx, [rbp + 0x4270]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edx, edx
lea rcx, [rbp + 0x1c50]
mov r8d, 0x200
call fcn.1400184d0
lea r9, [rbp + 0x4270]
mov edx, 0x100
lea r8, str.Checking_file__s
lea rcx, [rbp + 0x1c50]
call fcn.1400095d0
lea rcx, [rbp + 0x4270]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400068b7
test al, 0x10
jne 0x1400068b7
lea rdx, [rbp + 0x1c50]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x1c50]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006886
mov ebx, 0x5f
sub rbx, rax
je 0x1400068b2
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400068a0
mov ecx, r13d
jmp 0x140006908
lea rdx, [rbp + 0x1c50]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x1c50]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400068e0
mov ebx, 0x5f
sub rbx, rax
je 0x140006906
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400068f4
xor ecx, ecx
lea rdx, [rbp + 0x1c50]
call fcn.140012c60
inc rdi
cmp rdi, 0xd
jl 0x140006800
call fcn.140013290
test eax, eax
je 0x140006937
lea rcx, [rbp + 0x5c8]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
lea rax, [0x140044ac8]
mov esi, 4
mov qword [rbp + 0x140], rax
lea rdi, [rbp + 0x140]
lea rax, [0x140044ad0]
mov qword [rbp + 0x148], rax
lea rax, [0x140044ae8]
mov qword [rbp + 0x150], rax
lea rax, [0x140044af0]
mov qword [rbp + 0x158], rax
lea rax, [0x140044b08]
mov qword [rbp + 0x160], rax
lea rax, str.00:1C:14
mov qword [rbp + 0x168], rax
lea rax, [0x140044b28]
mov qword [rbp + 0x170], rax
lea rax, [0x140044b30]
mov qword [rbp + 0x178], rax
nop dword [rax]
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x1e50]
mov r8d, 0x200
call fcn.1400184d0
mov r9, qword [rdi + 8]
lea r8, str.Checking_MAC_starting_with__s
mov edx, 0x100
lea rcx, [rbp + 0x1e50]
call fcn.1400095d0
mov rcx, qword [rdi]
call fcn.140013440
lea rdx, [rbp + 0x1e50]
lea rcx, str.____s
test eax, eax
je 0x140006a4b
call fcn.140009570
lea rcx, [rbp + 0x1e50]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006a20
mov ebx, 0x5f
sub rbx, rax
je 0x140006a46
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140006a34
mov ecx, r13d
jmp 0x140006a88
call fcn.140009570
lea rcx, [rbp + 0x1e50]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006a60
mov ebx, 0x5f
sub rbx, rax
je 0x140006a86
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140006a74
xor ecx, ecx
lea rdx, [rbp + 0x1e50]
call fcn.140012c60
add rdi, 0x10
sub rsi, 1
jne 0x1400069c0
lea rdx, str.Checking_VMWare_network_adapter_name
lea rcx, str.____s
call fcn.140009570
lea ebx, [rsi + 0x3a]
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140006ac0
mov dword [rbp + 0x5b0], 0x2c0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x2c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x140006b12
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo._n
call fcn.140009570
mov ecx, r13d
xor r12d, r12d
jmp 0x140006be7
lea rdx, [rbp + 0x5b0]
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140006b81
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [rbp + 0x5b0]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x140006b71
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.140009500
mov ecx, r13d
xor r12d, r12d
jmp 0x140006be7
lea rdx, [rbp + 0x5b0]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x140006bcd
mov rdi, rsi
nop dword [rax + rax]
lea rcx, [rdi + 0x110]
call fcn.140012e90
mov rbx, rax
test rax, rax
je 0x140006bc5
lea rdx, str.VMWare
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov rcx, rbx
test rax, rax
jne 0x140006cdb
call fcn.14001ec04
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140006b90
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor r12d, r12d
mov ecx, r12d
lea rdx, str.Checking_VMWare_network_adapter_name
call fcn.140012c60
lea rax, str..HGFS
mov r14d, 2
mov qword [rbp - 0x38], rax
lea rsi, [rbp - 0x38]
lea rax, str.._vmci
mov r15d, 3
mov qword [rbp - 0x30], rax
nop dword [rax]
mov rcx, qword [rsi]
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov r8d, r13d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
lea rcx, [rbp + 0x2050]
mov r8d, 0x200
mov rdi, rax
call fcn.1400184d0
mov r9, qword [rsi]
lea r8, str.Checking_device__s
mov edx, 0x100
lea rcx, [rbp + 0x2050]
call fcn.1400095d0
cmp rdi, 0xffffffffffffffff
je 0x140006cff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x2050]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x2050]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006cb0
mov ebx, 0x5f
sub rbx, rax
je 0x140006cd6
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140006cc4
mov ecx, r13d
jmp 0x140006d48
call fcn.14001ec04
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, r13d
xor r12d, r12d
jmp 0x140006be7
lea rdx, [rbp + 0x2050]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x2050]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006d20
mov ebx, 0x5f
sub rbx, rax
je 0x140006d46
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140006d34
xor ecx, ecx
lea rdx, [rbp + 0x2050]
call fcn.140012c60
add rsi, 8
sub r14, 1
jne 0x140006c20
lea rdx, str.Checking_VMWare_directory
lea rcx, str.____s
call fcn.140009570
mov edi, 0x45
lea r12d, [r14 + 0x49]
mov ebx, edi
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140006d80
xor edx, edx
lea rcx, [rbp + 0x5700]
mov r8d, 0x208
call fcn.1400184d0
movups xmm0, xmmword [str.VMWare_]
xor edx, edx
lea rcx, [rbp + 0x52f0]
mov r8d, 0x1f8
movaps xmmword [rbp + 0x52e0], xmm0
call fcn.1400184d0
call fcn.140013290
lea rdx, [rbp + 0x54f0]
test eax, eax
je 0x140006ded
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140006dfc
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x52e0]
lea rdx, [rbp + 0x54f0]
lea rcx, [rbp + 0x5700]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x5700]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140006e32
test al, 0x10
je 0x140006e32
mov ecx, r13d
jmp 0x140006e36
xor eax, eax
mov ecx, eax
lea rdx, str.Checking_VMWare_directory
call fcn.140012c60
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, str.____s
call fcn.140009570
mov rbx, rdi
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140006e60
xor edi, edi
lea r8, [rbp + 0x640]
xor edx, edx
mov dword [rbp + 0x640], edi
mov ecx, 0x52534d42
mov ebx, edi
call fcn.140015750
test rax, rax
je 0x140006ec9
mov edx, dword [rbp + 0x640]
mov ecx, edi
sub rdx, 6
je 0x140006ec1
cmp dword [rcx + rax], 0x61774d56
jne 0x140006eb4
cmp word [rcx + rax + 4], 0x6572
je 0x140006ebe
inc rcx
cmp rcx, rdx
jb 0x140006ea2
jmp 0x140006ec1
mov ebx, r13d
mov rcx, rax
call fcn.14001ec04
lea rdx, str.Checking_SMBIOS_firmware
mov ecx, ebx
call fcn.140012c60
lea rdx, str.Checking_ACPI_tables
lea rcx, str.____s
call fcn.140009570
mov rbx, r12
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140006ef0
mov ecx, 0x1000
mov esi, edi
call fcn.14001ebfc
mov r14, rax
test rax, rax
je 0x140006fce
mov rdi, rax
mov ecx, 0x1000
xor eax, eax
mov rdx, r14
rep stosb byte [rdi], al
call fcn.1400156c0
mov ecx, eax
cmp eax, 0xffffffff
jne 0x140006f4a
xor eax, eax
lea rdx, str.Checking_ACPI_tables
mov ecx, esi
call fcn.140012c60
jmp 0x140006fe8
shr eax, 2
cmp ecx, 4
jb 0x140006fc3
test eax, eax
je 0x140006fc3
mov rbx, r14
mov edi, eax
xor r12d, r12d
nop
mov edx, dword [rbx]
lea r8, [rbp + 0x640]
mov ecx, 0x41435049
mov dword [rbp + 0x640], r12d
call fcn.140015750
test rax, rax
je 0x140006fb7
mov edx, dword [rbp + 0x640]
mov rcx, r12
sub rdx, 6
je 0x140006faf
nop
cmp dword [rcx + rax], 0x41574d56
jne 0x140006fa2
cmp word [rcx + rax + 4], 0x4552
je 0x140006fac
inc rcx
cmp rcx, rdx
jb 0x140006f90
jmp 0x140006faf
mov esi, r13d
mov rcx, rax
call fcn.14001ec04
add rbx, 4
sub rdi, 1
jne 0x140006f60
jmp 0x140006fc6
mov esi, r13d
mov rcx, r14
call fcn.14001ec04
lea rdx, str.Checking_ACPI_tables
mov ecx, esi
call fcn.140012c60
jmp 0x140006fe8
mov r13d, 1
lea r15d, [r13 + 2]
cmp dword [0x14006696c], 0
je 0x140007296
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x718]
mov ecx, SafeArrayGetElement
mov rsi, rax
lea rdx, [rbp + 0x718]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x720]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Virtual_PC_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140009570
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.VMSrvc.exe
mov esi, 2
mov qword [rbp - 8], rax
lea rdi, [rbp - 8]
lea rax, str.VMUSrvc.exe
mov qword [rbp], rax
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x2250]
mov r8d, 0x200
call fcn.1400184d0
mov r9, qword [rdi]
lea r8, str.Checking_Virtual_PC_processes__s
mov edx, 0x100
lea rcx, [rbp + 0x2250]
call fcn.1400095d0
mov rcx, qword [rdi]
call fcn.140015370
lea rdx, [rbp + 0x2250]
lea rcx, str.____s
test eax, eax
je 0x14000710b
call fcn.140009570
lea rcx, [rbp + 0x2250]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400070e0
mov ebx, 0x5f
sub rbx, rax
je 0x140007106
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400070f4
mov ecx, r13d
jmp 0x140007148
call fcn.140009570
lea rcx, [rbp + 0x2250]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007120
mov ebx, 0x5f
sub rbx, rax
je 0x140007146
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140007134
xor ecx, ecx
lea rdx, [rbp + 0x2250]
call fcn.140012c60
add rdi, 8
sub rsi, 1
jne 0x140007080
xor edx, edx
lea rcx, [rbp + 0x2450]
mov r8d, 0x200
call fcn.1400184d0
lea r9, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
mov edx, 0x100
lea r8, [0x140042fb0]
lea rcx, [rbp + 0x2450]
call fcn.1400095d0
lea rax, [rbp + 0x5c8]
xor r14d, r14d
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp + 0x5c8], r14
lea rdx, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007237
mov rcx, qword [rbp + 0x5c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x2450]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x2450]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140007200
mov ebx, 0x5f
sub rbx, rax
je 0x140007226
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140007214
lea rdx, [rbp + 0x2450]
mov ecx, r13d
call fcn.140012c60
jmp 0x140007299
lea rdx, [rbp + 0x2450]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x2450]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140007260
mov ebx, 0x5f
sub rbx, rax
je 0x140007286
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140007274
lea rdx, [rbp + 0x2450]
xor ecx, ecx
call fcn.140012c60
jmp 0x140007299
xor r14d, r14d
cmp dword [0x140066968], 0
je 0x14000788b
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x730]
mov ecx, SafeArrayGetElement
mov rsi, rax
lea rdx, [rbp + 0x730]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x738]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.QEMU_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140009570
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, [0x140043330]
mov esi, 2
mov qword [rbp + 0x60], rax
lea rcx, str.HARDWAREDescriptionSystem
lea rax, str.Identifier
mov qword [rbp + 0x78], rcx
mov qword [rbp + 0x68], rax
lea rcx, str.SystemBiosVersion
lea rax, str.QEMU
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x70], rax
lea rdi, [rbp + 0x70]
mov qword [rbp + 0x88], rax
nop dword [rax]
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x2650]
mov r8d, 0x200
call fcn.1400184d0
mov r9, qword [rdi - 0x10]
lea r8, [0x140042fb0]
mov edx, 0x100
lea rcx, [rbp + 0x2650]
call fcn.1400095d0
mov r9, qword [rdi]
mov r8, qword [rdi - 8]
mov rdx, qword [rdi - 0x10]
call fcn.140013350
lea rdx, [rbp + 0x2650]
lea rcx, str.____s
test eax, eax
je 0x1400073f7
call fcn.140009570
lea rcx, [rbp + 0x2650]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400073c5
mov ebx, 0x5f
sub rbx, rax
je 0x1400073f2
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400073e0
mov ecx, r13d
jmp 0x140007438
call fcn.140009570
lea rcx, [rbp + 0x2650]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007410
mov ebx, 0x5f
sub rbx, rax
je 0x140007436
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140007424
xor ecx, ecx
lea rdx, [rbp + 0x2650]
call fcn.140012c60
add rdi, 0x18
sub rsi, 1
jne 0x140007360
lea rax, str.qemu_ga.exe
mov qword [rbp - 0x78], rax
lea rdi, [rbp - 0x78]
lea rax, str.vdagent.exe
mov qword [rbp - 0x70], rax
lea rax, str.vdservice.exe
mov qword [rbp - 0x68], rax
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x2850]
mov r8d, 0x200
call fcn.1400184d0
mov r9, qword [rdi]
lea r8, str.Checking_qemu_processes__s
mov edx, 0x100
lea rcx, [rbp + 0x2850]
call fcn.1400095d0
mov rcx, qword [rdi]
call fcn.140015370
lea rdx, [rbp + 0x2850]
lea rcx, str.____s
test eax, eax
je 0x14000750b
call fcn.140009570
lea rcx, [rbp + 0x2850]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400074e0
mov ebx, 0x5f
sub rbx, rax
je 0x140007506
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400074f4
mov ecx, r13d
jmp 0x140007548
call fcn.140009570
lea rcx, [rbp + 0x2850]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007520
mov ebx, 0x5f
sub rbx, rax
je 0x140007546
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140007534
xor ecx, ecx
lea rdx, [rbp + 0x2850]
call fcn.140012c60
add rdi, 8
sub r15, 1
jne 0x140007480
xor edx, edx
lea rcx, [rbp + 0x4480]
mov r8d, 0x208
call fcn.1400184d0
lea rax, str.qemu_ga
mov rdi, r14
mov qword [rbp - 0x28], rax
lea rax, str.SPICE_Guest_Tools
mov qword [rbp - 0x20], rax
nop
xor edx, edx
lea rcx, [rbp + 0x2a50]
mov r8d, 0x200
call fcn.1400184d0
call fcn.140013290
lea rdx, [rbp + 0x5910]
test eax, eax
je 0x1400075c9
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x1400075d8
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov r8, qword [rbp + rdi*8 - 0x28]
lea rdx, [rbp + 0x5910]
lea rcx, [rbp + 0x4480]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea r9, [rbp + 0x4480]
mov edx, 0x100
lea r8, str.Checking_QEMU_directory__s
lea rcx, [rbp + 0x2a50]
call fcn.1400095d0
lea rcx, [rbp + 0x4480]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000767b
test al, 0x10
je 0x14000767b
lea rdx, [rbp + 0x2a50]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x2a50]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007650
mov ebx, 0x5f
sub rbx, rax
je 0x140007676
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140007664
mov ecx, r13d
jmp 0x1400076c8
lea rdx, [rbp + 0x2a50]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x2a50]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400076a0
mov ebx, 0x5f
sub rbx, rax
je 0x1400076c6
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400076b4
xor ecx, ecx
lea rdx, [rbp + 0x2a50]
call fcn.140012c60
inc rdi
cmp rdi, 2
jl 0x140007590
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, str.____s
call fcn.140009570
mov r12d, 0x45
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub r12, 1
jne 0x140007700
lea r8, [rbp + 0x640]
mov dword [rbp + 0x640], r14d
xor edx, edx
mov ecx, 0x52534d42
mov edi, r14d
call fcn.140015750
mov rbx, rax
mov r12d, 0x49
test rax, rax
je 0x140007782
mov ecx, dword [rbp + 0x640]
mov rdx, r14
add rcx, 0xfffffffffffffffc
je 0x14000777a
nop dword [rax]
cmp dword [rdx + rax], 0x756d6571
je 0x140007777
inc rdx
cmp rdx, rcx
jb 0x140007750
mov rax, r14
cmp dword [rax + rbx], 0x554d4551
je 0x140007777
inc rax
cmp rax, rcx
jb 0x140007764
jmp 0x14000777a
mov edi, r13d
mov rcx, rbx
call fcn.14001ec04
lea rdx, str.Checking_SMBIOS_firmware
mov ecx, edi
call fcn.140012c60
lea rdx, str.Checking_ACPI_tables
lea rcx, str.____s
call fcn.140009570
lea rcx, [0x1400457e8]
call fcn.140009570
sub r12, 1
jne 0x1400077a3
mov ecx, 0x1000
mov r14d, r12d
call fcn.14001ebfc
mov r15, rax
test rax, rax
je 0x14000787a
mov rdi, rax
mov ecx, 0x1000
xor eax, eax
mov rdx, r15
rep stosb byte [rdi], al
call fcn.1400156c0
mov ecx, eax
cmp eax, 0xffffffff
je 0x14000787a
shr eax, 2
cmp ecx, 4
jb 0x14000786f
test eax, eax
je 0x14000786f
mov rdi, r15
mov esi, eax
nop
mov edx, dword [rdi]
lea r8, [rbp + 0x640]
mov ecx, 0x41435049
mov dword [rbp + 0x640], r12d
call fcn.140015750
mov rbx, rax
test rax, rax
je 0x140007863
mov ecx, dword [rbp + 0x640]
mov rdx, r12
add rcx, 0xfffffffffffffffc
je 0x14000785b
cmp dword [rdx + rax], 0x48434f42
je 0x140007858
inc rdx
cmp rdx, rcx
jb 0x140007831
mov rax, r12
cmp dword [rax + rbx], 0x43505842
je 0x140007858
inc rax
cmp rax, rcx
jb 0x140007845
jmp 0x14000785b
mov r14d, r13d
mov rcx, rbx
call fcn.14001ec04
add rdi, 4
sub rsi, 1
jne 0x140007800
jmp 0x140007872
mov r14d, r13d
mov rcx, r15
call fcn.14001ec04
lea rdx, str.Checking_ACPI_tables
mov ecx, r14d
call fcn.140012c60
jmp 0x14000788e
xor r12d, r12d
cmp dword [0x140066960], 0
je 0x140007a2e
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x748]
mov ecx, SafeArrayGetElement
mov rsi, rax
lea rdx, [rbp + 0x748]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x750]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Xen_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140009570
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor edx, edx
lea rcx, [rbp + 0x2c50]
mov r8d, 0x200
call fcn.1400184d0
lea r9, str.xenservice.exe
mov edx, 0x100
lea r8, str.Checking_Citrix_Xen_process__s
lea rcx, [rbp + 0x2c50]
call fcn.1400095d0
lea rcx, str.xenservice.exe
call fcn.140015370
lea rdx, [rbp + 0x2c50]
lea rcx, str.____s
test eax, eax
je 0x140007997
call fcn.140009570
lea rcx, [rbp + 0x2c50]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007961
mov ebx, 0x5f
sub rbx, rax
je 0x140007992
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140007980
mov ecx, r13d
jmp 0x1400079d8
call fcn.140009570
lea rcx, [rbp + 0x2c50]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400079b0
mov ebx, 0x5f
sub rbx, rax
je 0x1400079d6
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400079c4
xor ecx, ecx
lea rdx, [rbp + 0x2c50]
call fcn.140012c60
lea rdx, str.Checking_Mac_Address_start_with_08:16:3E
lea rcx, str.____s
call fcn.140009570
mov r15d, 0x36
mov ebx, r15d
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140007a00
lea rcx, [0x140044c70]
call fcn.140013440
lea rdx, str.Checking_Mac_Address_start_with_08:16:3E
mov ecx, eax
call fcn.140012c60
jmp 0x140007a34
mov r15d, 0x36
cmp dword [0x140066964], 0
je 0x140007f40
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x760]
mov ecx, SafeArrayGetElement
mov rsi, rax
lea rdx, [rbp + 0x760]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x768]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Xen_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140009570
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.System32drivers_balloon.sys
xor edx, edx
mov qword [rbp + 0x210], rax
lea rcx, [rbp + 0x5b20]
lea rax, str.System32drivers_netkvm.sys
mov r8d, 0x208
mov qword [rbp + 0x218], rax
lea rax, str.System32driverspvpanic.sys
mov qword [rbp + 0x220], rax
lea rax, str.System32drivers_viofs.sys
mov qword [rbp + 0x228], rax
lea rax, str.System32drivers_viogpudo.sys
mov qword [rbp + 0x230], rax
lea rax, str.System32drivers_vioinput.sys
mov qword [rbp + 0x238], rax
lea rax, str.System32drivers_viorng.sys
mov qword [rbp + 0x240], rax
lea rax, str.System32drivers_vioscsi.sys
mov qword [rbp + 0x248], rax
lea rax, str.System32drivers_vioser.sys
mov qword [rbp + 0x250], rax
lea rax, str.System32drivers_viostor.sys
mov qword [rbp + 0x258], rax
call fcn.1400184d0
xor edx, edx
lea rcx, [rbp + 0x4690]
mov r8d, 0x208
call fcn.1400184d0
mov edx, 0x104
mov qword [rbp + 0x5c8], r12
lea rcx, [rbp + 0x5b20]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call fcn.140013290
test eax, eax
je 0x140007b86
lea rcx, [rbp + 0x5c8]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov rdi, r12
nop dword [rax]
mov r8, qword [rbp + rdi*8 + 0x210]
lea rdx, [rbp + 0x5b20]
lea rcx, [rbp + 0x4690]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edx, edx
lea rcx, [rbp + 0x2e50]
mov r8d, 0x200
call fcn.1400184d0
lea r9, [rbp + 0x4690]
mov edx, 0x100
lea r8, str.Checking_file__s
lea rcx, [rbp + 0x2e50]
call fcn.1400095d0
lea rcx, [rbp + 0x4690]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140007c47
test al, 0x10
jne 0x140007c47
lea rdx, [rbp + 0x2e50]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x2e50]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007c16
mov ebx, 0x5f
sub rbx, rax
je 0x140007c42
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140007c30
mov ecx, r13d
jmp 0x140007c98
lea rdx, [rbp + 0x2e50]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x2e50]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007c70
mov ebx, 0x5f
sub rbx, rax
je 0x140007c96
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140007c84
xor ecx, ecx
lea rdx, [rbp + 0x2e50]
call fcn.140012c60
inc rdi
cmp rdi, 0xa
jl 0x140007b90
call fcn.140013290
test eax, eax
je 0x140007cc7
lea rcx, [rbp + 0x5c8]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
lea rax, str.SYSTEMControlSet001Services_vioscsi
mov qword [rbp + 0x100], rax
lea rdi, [rbp + 0x100]
lea rax, str.SYSTEMControlSet001Services_viostor
mov qword [rbp + 0x108], rax
lea rax, str.SYSTEMControlSet001ServicesVirtIO_FS_Service
mov qword [rbp + 0x110], rax
lea rax, str.SYSTEMControlSet001ServicesVirtioSerial
mov qword [rbp + 0x118], rax
lea rax, str.SYSTEMControlSet001ServicesBALLOON
mov qword [rbp + 0x120], rax
lea rax, str.SYSTEMControlSet001ServicesBalloonService
mov qword [rbp + 0x128], rax
lea rax, str.SYSTEMControlSet001Services_netkvm
mov qword [rbp + 0x130], rax
xor edx, edx
lea rcx, [rbp + 0x3050]
mov r8d, 0x200
call fcn.1400184d0
mov r9, qword [rdi]
lea r8, [0x140042fb0]
mov edx, 0x100
lea rcx, [rbp + 0x3050]
call fcn.1400095d0
mov rdx, qword [rdi]
lea rax, [rbp + 0x5c8]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp + 0x5c8], r12
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007deb
mov rcx, qword [rbp + 0x5c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x3050]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x3050]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007dc0
mov ebx, 0x5f
sub rbx, rax
je 0x140007de6
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140007dd4
mov ecx, r13d
jmp 0x140007e38
lea rdx, [rbp + 0x3050]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x3050]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007e10
mov ebx, 0x5f
sub rbx, rax
je 0x140007e36
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140007e24
xor ecx, ecx
lea rdx, [rbp + 0x3050]
call fcn.140012c60
add rdi, 8
sub qword [rsp + 0x78], 1
jne 0x140007d30
lea rdx, str.Checking_KVM_virio_directory
lea rcx, str.____s
call fcn.140009570
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub qword [rbp - 0x80], 1
jne 0x140007e70
xor edx, edx
lea rcx, [rbp + 0x5f40]
mov r8d, 0x208
call fcn.1400184d0
movups xmm0, xmmword [str.Virtio_Win_]
lea rcx, [rbp + 0x3e78]
xor edx, edx
movsd xmm1, qword [0x140043278]
mov r8d, 0x1f0
movaps xmmword [rbp + 0x3e60], xmm0
movsd qword [rbp + 0x3e70], xmm1
call fcn.1400184d0
call fcn.140013290
lea rdx, [rbp + 0x5d30]
test eax, eax
je 0x140007eee
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140007efd
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x3e60]
lea rdx, [rbp + 0x5d30]
lea rcx, [rbp + 0x5f40]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x5f40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140007f31
mov ecx, r13d
test al, 0x10
jne 0x140007f34
mov ecx, r12d
lea rdx, str.Checking_KVM_virio_directory
call fcn.140012c60
cmp dword [0x14006695c], 0
je 0x140008144
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x778]
mov ecx, SafeArrayGetElement
mov rsi, rax
lea rdx, [rbp + 0x778]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x780]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Wine_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140009570
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Checking_Wine_via_dll_exports
lea rcx, str.____s
call fcn.140009570
lea rcx, [0x1400457e8]
call fcn.140009570
sub qword [rbp + 0x5f8], 1
jne 0x140007fc2
lea rcx, [0x1400407b8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140007ffb
lea rcx, str.GetModuleHandle
call fcn.140012d90
mov ecx, r12d
jmp 0x140008014
lea rdx, str.wine_get_unix_file_name
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov ecx, r12d
setne cl
lea rdx, str.Checking_Wine_via_dll_exports
call fcn.140012c60
xor edx, edx
lea rcx, [rbp + 0x3250]
mov r8d, 0x200
call fcn.1400184d0
lea r9, str.SOFTWAREWine
mov edx, 0x100
lea r8, [0x140042fb0]
lea rcx, [rbp + 0x3250]
call fcn.1400095d0
lea rax, [rbp + 0x5f8]
mov qword [rbp + 0x5f8], r12
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREWine
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400080e7
mov rcx, qword [rbp + 0x5f8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x3250]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x3250]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400080b5
mov ebx, 0x5f
sub rbx, rax
je 0x1400080e2
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400080d0
mov ecx, r13d
jmp 0x140008138
lea rdx, [rbp + 0x3250]
lea rcx, str.____s
call fcn.140009570
lea rcx, [rbp + 0x3250]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008110
mov ebx, 0x5f
sub rbx, rax
je 0x140008136
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140008124
xor ecx, ecx
lea rdx, [rbp + 0x3250]
call fcn.140012c60
cmp dword [0x140066958], 0
je 0x14000830c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x790]
mov ecx, SafeArrayGetElement
mov rsi, rax
lea rdx, [rbp + 0x790]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x798]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Paralles_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140009570
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.prl_cc.exe
mov esi, 2
mov qword [rbp - 0x18], rax
lea rdi, [rbp - 0x18]
lea rax, str.prl_tools.exe
mov qword [rbp - 0x10], rax
nop dword [rax]
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x3450]
mov r8d, 0x200
call fcn.1400184d0
mov r9, qword [rdi]
lea r8, str.Checking_Parallels_processes:__s
mov edx, 0x100
lea rcx, [rbp + 0x3450]
call fcn.1400095d0
mov rcx, qword [rdi]
call fcn.140015370
lea rdx, [rbp + 0x3450]
lea rcx, str.____s
test eax, eax
je 0x14000826b
call fcn.140009570
lea rcx, [rbp + 0x3450]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008240
mov ebx, 0x5f
sub rbx, rax
je 0x140008266
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140008254
mov ecx, r13d
jmp 0x1400082a8
call fcn.140009570
lea rcx, [rbp + 0x3450]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008280
mov ebx, 0x5f
sub rbx, rax
je 0x1400082a6
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140008294
xor ecx, ecx
lea rdx, [rbp + 0x3450]
call fcn.140012c60
add rdi, 8
sub rsi, 1
jne 0x1400081e0
lea rdx, str.Checking_Mac_Address_start_with_00:1C:42
lea rcx, str.____s
call fcn.140009570
mov rbx, r15
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400082e0
lea rcx, [0x140043328]
call fcn.140013440
lea rdx, str.Checking_Mac_Address_start_with_00:1C:42
mov ecx, eax
call fcn.140012c60
cmp dword [0x140066954], 0
je 0x14000855c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x7c0]
mov ecx, SafeArrayGetElement
mov rsi, rax
lea rdx, [rbp + 0x7c0]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x7c8]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Hyper_V_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140009570
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Checking_for_Hyper_V_driver_objects
lea rcx, str.____s
call fcn.140009570
mov edi, 0x3b
mov ebx, edi
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400083a0
lea rcx, str.Driver
call fcn.140015a50
test rax, rax
je 0x140008485
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
cmp rdi, rsi
je 0x140008480
nop word [rax + rax]
mov rbx, qword [rdi]
lea rdx, str.VMBusHID
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140008666
lea rdx, str.vmbus
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140008666
lea rdx, str.vmgid
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140008666
lea rdx, str.IndirectKmd
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140008666
lea rdx, str.HyperVideo
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140008666
lea rdx, str.hyperkbd
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140008666
add rdi, 8
cmp rdi, rsi
jne 0x1400083e0
mov edi, 0x3b
mov ecx, r12d
lea rdx, str.Checking_for_Hyper_V_driver_objects
call fcn.140012c60
lea rdx, str.Checking_for_Hyper_V_global_objects
lea rcx, str.____s
call fcn.140009570
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rdi, 1
jne 0x1400084b0
lea rcx, str.GLOBAL__
call fcn.140015a50
test rax, rax
je 0x14000854d
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
cmp rdi, rsi
je 0x14000854d
nop
mov rbx, qword [rdi]
lea rdx, str.VMBUS
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
jne 0x140008673
lea rdx, str.VDRVROOT
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140008673
lea rdx, str.VmGenerationCounter
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140008673
lea rdx, str.VmGid
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x140008673
add rdi, 8
cmp rdi, rsi
jne 0x1400084e0
mov ecx, r12d
lea rdx, str.Checking_for_Hyper_V_global_objects
call fcn.140012c60
cmp dword [0x140066950], 0
je 0x14000857e
call fcn.1400116e0
call fcn.1400128b0
call fcn.140011af0
call fcn.140012470
call fcn.140011f40
cmp dword [0x14006694c], 0
je 0x140008ce4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x850]
mov ecx, SafeArrayGetElement
mov rsi, rax
lea rdx, [rbp + 0x850]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x858]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Timing_attacks
lea rcx, str._n___________________________s___________________________n
call fcn.140009570
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, 0xa
lea rcx, str._n___Delay_value_is_set_to__u_minutes_..._n
call fcn.140009500
lea rdx, str.Performing_a_sleep_using_NtDelayExecution_...
lea rcx, str.____s
call fcn.140009570
mov r12d, 0x32
mov ebx, r12d
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140008620
movabs rsi, 0xfffffffe9a5f4400
lea rdx, [0x140064d50]
xor edi, edi
mov qword [rbp + 0x5d8], rsi
mov eax, edi
mov rcx, rdx
cmp dword [rcx], 0xd
je 0x14000867b
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140008651
mov ecx, r13d
jmp 0x1400086b9
mov ecx, r13d
mov edi, 0x3b
jmp 0x140008488
mov ecx, r13d
jmp 0x140008550
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], dil
jne 0x140008690
mov ecx, r13d
jmp 0x1400086b9
mov eax, edi
mov rcx, rdx
cmp dword [rcx], 0xd
je 0x140008779
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140008695
mov rax, rdi
lea rdx, [rbp + 0x5d8]
xor ecx, ecx
call rax
mov ecx, edi
lea rdx, str.Performing_a_sleep_using_NtDelayExecution_...
call fcn.140012c60
lea rdx, str.Performing_a_sleep___in_a_loop_...
lea rcx, str.____s
call fcn.140009570
mov r14d, 0x3d
nop
lea rcx, [0x1400457e8]
call fcn.140009570
sub r14, 1
jne 0x1400086e0
mov ebx, 0x3e8
nop word [rax + rax]
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rbx, 1
jne 0x140008700
lea rdx, str.Performing_a_sleep___in_a_loop_...
xor ecx, ecx
call fcn.140012c60
lea rdx, str.Delaying_execution_using_SetTimer_...
lea rcx, str.____s
call fcn.140009570
lea r14d, [rbx + 0x3a]
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub r14, 1
jne 0x140008740
lea r9, [0x140015cf0]
xor edx, edx
xor ecx, ecx
mov r8d, 0x927c0
call qword [sym.imp.USER32.dll_SetTimer]
mov rbx, rax
test rax, rax
jne 0x140008797
mov ecx, r13d
jmp 0x14000880b
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], dil
je 0x1400086a9
mov rax, qword [rdx + rcx*8 + 0x28]
jmp 0x1400086ac
xor r9d, r9d
lea rcx, [rbp + 0x868]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp dword [0x140066998], edi
mov ecx, edi
sete cl
test ecx, eax
je 0x1400087fe
nop dword [rax + rax]
lea rcx, [rbp + 0x868]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x868]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rbp + 0x868]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp dword [0x140066998], edi
mov ecx, edi
sete cl
test ecx, eax
jne 0x1400087c0
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
mov ecx, edi
lea rdx, str.Delaying_execution_using_SetTimer_...
call fcn.140012c60
lea rdx, str.Delaying_execution_using_timeSetEvent_...
lea rcx, str.____s
call fcn.140009570
mov rbx, r15
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140008830
lea edx, [rbx + 8]
lea rcx, [rbp + 0x690]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
mov rax, qword [rbp + 0x690]
lea r8, [0x140015cf0]
mov ebx, dword [rbp + 0x694]
test eax, eax
mov ecx, edi
mov dword [rsp + 0x20], edi
cmovne ecx, eax
cmp ecx, ebx
cmovb ebx, ecx
xor r9d, r9d
mov edx, ebx
mov ecx, 0x927c0
call qword [sym.imp.WINMM.dll_timeSetEvent]
test eax, eax
jne 0x140008890
mov ecx, r13d
jmp 0x1400088a2
mov ecx, eax
call qword [sym.imp.WINMM.dll_timeKillEvent]
mov ecx, ebx
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ecx, edi
lea rdx, str.Delaying_execution_using_timeSetEvent_...
call fcn.140012c60
lea rdx, str.Delaying_execution_using_WaitForSingleObject_...
lea rcx, str.____s
call fcn.140009570
mov edi, 0x2f
mov ebx, edi
nop dword [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x1400088d0
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
jne 0x140008909
lea rcx, [0x140046548]
call fcn.140012d90
mov ecx, r13d
jmp 0x14000891b
mov edx, 0x927c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov ecx, eax
lea rdx, str.Delaying_execution_using_WaitForSingleObject_...
call fcn.140012c60
lea rdx, str.Delaying_execution_using_IcmpSendEcho_...
lea rcx, str.____s
call fcn.140009570
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub r15, 1
jne 0x140008940
movsd xmm0, qword [str.Data_Buffer]
mov eax, dword [0x140046568]
movsd qword [rbp + 0x1230], xmm0
xorps xmm0, xmm0
mov dword [rbp + 0x1238], eax
xor eax, eax
movups xmmword [rbp + 0x123c], xmm0
mov dword [rbp + 0x124c], eax
call qword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400089b4
lea rcx, str._tUnable_to_open_handle._n
call fcn.140009500
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.IcmpCreatefile_returned_error:__u_n
call fcn.140009500
mov ecx, r13d
jmp 0x140008a31
mov ecx, 0x50
call fcn.14001ebfc
mov rdi, rax
mov rcx, rbx
test rax, rax
jne 0x1400089e3
call qword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
lea rcx, str._tUnable_to_allocate_memory_n
call fcn.140009500
mov ecx, r13d
xor r15d, r15d
jmp 0x140008a2c
mov dword [rsp + 0x38], 0x927c0
lea r8, [rbp + 0x1230]
mov dword [rsp + 0x30], 0x50
xor r15d, r15d
mov qword [rsp + 0x28], rdi
mov r9d, 0x20
mov edx, 0xffffffff
mov qword [rsp + 0x20], r15
call qword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
mov rcx, rbx
call qword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
mov rcx, rdi
call fcn.14001ec04
mov ecx, r15d
mov edi, 0x2f
lea rdx, str.Delaying_execution_using_IcmpSendEcho_...
call fcn.140012c60
lea rdx, str.Delaying_execution_using_CreateWaitableTimer_...
lea rcx, str.____s
call fcn.140009570
lea rcx, [0x1400457e8]
call fcn.140009570
sub rdi, 1
jne 0x140008a50
xor r8d, r8d
mov qword [rbp + 0x5d8], rsi
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov rdi, rax
test rax, rax
jne 0x140008a84
mov ebx, r13d
jmp 0x140008ad6
mov dword [rsp + 0x28], r15d
lea rdx, [rbp + 0x5d8]
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
test eax, eax
jne 0x140008aad
mov ebx, r13d
jmp 0x140008ac4
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov ebx, r15d
cmovne ebx, r13d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Delaying_execution_using_CreateWaitableTimer_...
mov ecx, ebx
call fcn.140012c60
lea rdx, str.Delaying_execution_using_CreateTimerQueueTimer_...
lea rcx, str.____s
call fcn.140009570
mov r14d, 0x2d
nop dword [rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub r14, 1
jne 0x140008b00
xor r9d, r9d
mov qword [rbp + 0x5d8], r15
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140066990], rax
test rax, rax
jne 0x140008b3a
mov ebx, r15d
jmp 0x140008bb8
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
mov rdi, rax
test rax, rax
jne 0x140008b4d
mov ebx, r13d
jmp 0x140008bb8
mov dword [rsp + 0x30], r15d
lea r8, [0x140015d00]
mov dword [rsp + 0x28], r15d
lea rcx, [rbp + 0x5d8]
mov r9d, 0xdeadbeef
mov dword [rsp + 0x20], 0x927c0
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
test eax, eax
jne 0x140008b85
mov ebx, r13d
jmp 0x140008ba0
mov rcx, qword [0x140066990]
mov edx, 0x5b8d80
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov ebx, r15d
cmovne ebx, r15d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
mov rcx, qword [0x140066990]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Delaying_execution_using_CreateTimerQueueTimer_...
mov ecx, ebx
call fcn.140012c60
lea rdx, str.Checking_RDTSC_Locky_trick
lea rcx, str.____s
call fcn.140009570
mov r14d, 0xa
nop
lea rcx, [0x1400457e8]
call fcn.140009570
sub qword [rbp + 0x600], 1
jne 0x140008be0
mov esi, r15d
nop dword [rax]
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
rdtsc
shl rdx, 0x20
xor ecx, ecx
or rax, rdx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
rdtsc
shl rdx, 0x20
or rax, rdx
xor edx, edx
sub eax, ebx
sub ebx, edi
div ebx
cmp eax, r14d
jae 0x140008c48
inc esi
cmp esi, r14d
jb 0x140008c00
mov ecx, r13d
jmp 0x140008c4b
mov ecx, r15d
lea rdx, str.Checking_RDTSC_Locky_trick
call fcn.140012c60
lea rdx, str.Checking_RDTSC_which_force_a_VM_Exit__cpuid_
lea rcx, str.____s
call fcn.140009570
nop word [rax + rax]
lea rcx, [0x1400457e8]
call fcn.140009570
sub r12, 1
jne 0x140008c70
mov r8, r12
nop word [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdi, rax
xor eax, eax
xor ecx, ecx
cpuid
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rdi
add r8, rax
sub r14, 1
jne 0x140008c90
mov ecx, r12d
movabs rax, 0xcccccccccccccccd
mul r8
shr rdx, 3
lea rax, [rdx - 1]
cmp rax, 0x3e6
lea rdx, str.Checking_RDTSC_which_force_a_VM_Exit__cpuid_
seta cl
call fcn.140012c60
cmp dword [0x140066944], 0
je 0x140009016
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x838]
mov ecx, SafeArrayGetElement
mov rsi, rax
lea rdx, [rbp + 0x838]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x840]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Analysis_tools
lea rcx, str._n___________________________s___________________________n
call fcn.140009570
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.ollydbg.exe
mov qword [rbp + 0x4a0], rax
lea rax, str.ProcessHacker.exe
mov qword [rbp + 0x4a8], rax
lea rax, str.tcpview.exe
mov qword [rbp + 0x4b0], rax
lea rax, str.autoruns.exe
mov qword [rbp + 0x4b8], rax
lea rax, str.autorunsc.exe
mov qword [rbp + 0x4c0], rax
lea rax, str.filemon.exe
mov qword [rbp + 0x4c8], rax
lea rax, str.procmon.exe
mov qword [rbp + 0x4d0], rax
lea rax, str.regmon.exe
mov qword [rbp + 0x4d8], rax
lea rax, str.procexp.exe
mov qword [rbp + 0x4e0], rax
lea rax, str.idaq.exe
mov qword [rbp + 0x4e8], rax
lea rax, str.idaq64.exe
mov qword [rbp + 0x4f0], rax
lea rax, str.ImmunityDebugger.exe
mov qword [rbp + 0x4f8], rax
lea rax, str.Wireshark.exe
mov qword [rbp + 0x500], rax
lea rax, str.dumpcap.exe
mov qword [rbp + 0x508], rax
lea rax, str.HookExplorer.exe
mov qword [rbp + 0x510], rax
lea rax, str.ImportREC.exe
mov qword [rbp + 0x518], rax
lea rax, str.PETools.exe
mov qword [rbp + 0x520], rax
lea rax, str.LordPE.exe
mov qword [rbp + 0x528], rax
lea rax, str.SysInspector.exe
mov qword [rbp + 0x530], rax
lea rax, str.proc_analyzer.exe
mov qword [rbp + 0x538], rax
lea rax, str.sysAnalyzer.exe
mov qword [rbp + 0x540], rax
lea rax, str.sniff_hit.exe
mov qword [rbp + 0x548], rax
lea rax, str.windbg.exe
mov qword [rbp + 0x550], rax
lea rax, str.joeboxcontrol.exe
mov qword [rbp + 0x558], rax
lea rax, str.joeboxserver.exe
mov qword [rbp + 0x560], rax
mov qword [rbp + 0x568], rax
lea rax, str.ResourceHacker.exe
mov qword [rbp + 0x570], rax
lea rax, str.x32dbg.exe
mov qword [rbp + 0x578], rax
lea rax, str.x64dbg.exe
mov qword [rbp + 0x580], rax
lea rax, str.Fiddler.exe
mov qword [rbp + 0x588], rax
lea rax, str.httpdebugger.exe
mov qword [rbp + 0x590], rax
lea rax, str.cheatengine_i386.exe
mov qword [rbp + 0x598], rax
lea rdi, [rbp + 0x4a0]
lea rax, str.cheatengine_x86_64.exe
mov qword [rbp + 0x5a0], rax
lea rax, str.cheatengine_x86_64_SSE4_AVX2.exe
mov qword [rbp + 0x5a8], rax
nop
xor edx, edx
lea rcx, [rbp + 0x3650]
mov r8d, 0x200
call fcn.1400184d0
mov r9, qword [rdi]
lea r8, str.Checking_process_of_malware_analysis_tool:__s
mov edx, 0x100
lea rcx, [rbp + 0x3650]
call fcn.1400095d0
mov rcx, qword [rdi]
call fcn.140015370
lea rdx, [rbp + 0x3650]
lea rcx, str.____s
test eax, eax
je 0x140008fbb
call fcn.140009570
lea rcx, [rbp + 0x3650]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008f90
mov ebx, 0x5f
sub rbx, rax
je 0x140008fb6
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140008fa4
mov ecx, r13d
jmp 0x140008ff8
call fcn.140009570
lea rcx, [rbp + 0x3650]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008fd0
mov ebx, 0x5f
sub rbx, rax
je 0x140008ff6
lea rcx, [0x1400457e8]
call fcn.140009570
sub rbx, 1
jne 0x140008fe4
xor ecx, ecx
lea rdx, [rbp + 0x3650]
call fcn.140012c60
add rdi, 8
sub qword [rbp + 0x668], 1
jne 0x140008f30
cmp dword [0x140066940], 0
je 0x14000907e
lea rcx, str.Begin_AntiDisassmConstantCondition_n
call fcn.140009570
call fcn.140015d30
lea rcx, str.Begin_AntiDisassmAsmJmpSameTarget_n
call fcn.140009570
call fcn.140015d38
lea rcx, str.Begin_AntiDisassmImpossibleDiasassm_n
call fcn.140009570
call fcn.140015d3f
lea rcx, str.Begin_AntiDisassmFunctionPointer_n
call fcn.140009570
mov ecx, 2
call fcn.140015d53
lea rcx, str.Begin_AntiDisassmReturnPointerAbuse_n
call fcn.140009570
mov ecx, 0x29a
call fcn.140015d7e
cmp dword [0x140066948], 0
je 0x140009157
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x820]
mov ecx, SafeArrayGetElement
mov rsi, rax
lea rdx, [rbp + 0x820]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x828]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Anti_Dumping
lea rcx, str._n___________________________s___________________________n
call fcn.140009570
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.___Erasing_PE_header_from_memory_n
call fcn.140009570
xor ecx, ecx
mov dword [rbp + 0x698], r12d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9, [rbp + 0x698]
mov edx, 0x1000
mov rcx, rax
mov r8d, 4
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
mov rbx, qword gs:[0x60]
lea rcx, str.___Increasing_SizeOfImage_in_PE_Header_to:_0x100000_n
call fcn.140009570
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x30]
add eax, 0x100000
mov dword [rcx + 0x40], eax
lea rcx, str._n_nAnalysis_done__I_hope_you_didnt_get_red_flags_:_
call fcn.140009570
call fcn.14001ea8c
xor eax, eax
mov rcx, qword [rbp + 0x7150]
xor rcx, rsp
call fcn.140016110
lea r11, [rsp + 0x7260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret