Function at 0x140003020
Capabilities:
Check for unmoving mouse cursor
Get memory capacity
Get number of processor cores
Query or enumerate registry value
Reference wmi statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x8a0]
sub rsp, 0x9a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x890], rax
lea rdx, [0x140007f44]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
lea rcx, [0x140007f48]
call fcn.140002ef0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x60]
mov ecx, 0x16
mov rsi, rax
lea rdx, [rbp + 0x60]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x68]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Generic_Sandboxe_VM_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.140002ef0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.avghookx.dll
xor esi, esi
mov qword [rbp - 0x70], rax
lea rdi, [rbp - 0x70]
lea rax, str.avghooka.dll
mov qword [rbp - 0x68], rax
lea rax, str.snxhk.dll
mov qword [rbp - 0x60], rax
lea r14d, [rsi + 0xc]
lea rax, str.sbiedll.dll
mov qword [rbp - 0x58], rax
lea r15d, [rsi + 1]
lea rax, str.dbghelp.dll
mov qword [rbp - 0x50], rax
lea rax, str.api_log.dll
mov qword [rbp - 0x48], rax
lea rax, str.dir_watch.dll
mov qword [rbp - 0x40], rax
lea rax, str.pstorec.dll
mov qword [rbp - 0x38], rax
lea rax, str.vmcheck.dll
mov qword [rbp - 0x30], rax
lea rax, str.wpespy.dll
mov qword [rbp - 0x28], rax
lea rax, str.cmdvrt64.dll
mov qword [rbp - 0x20], rax
lea rax, str.cmdvrt32.dll
mov qword [rbp - 0x18], rax
nop dword [rax + rax]
xor edx, edx
mov word [rbp + 0x90], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x92]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_if_process_loaded_modules_contains:__s
mov edx, 0x100
lea rcx, [rbp + 0x90]
call fcn.140001010
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rbp + 0x90]
lea rcx, str.____ls
test rax, rax
jne 0x1400031f5
call fcn.140002ef0
lea rcx, [rbp + 0x90]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x1400031c5
mov ebx, 0x5f
sub rbx, rax
je 0x1400031f1
nop dword [rax + rax]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, r15
jne 0x1400031e0
mov ecx, esi
jmp 0x140003237
call fcn.140002ef0
lea rcx, [rbp + 0x90]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], si
jne 0x140003210
mov ebx, 0x5f
sub rbx, rax
je 0x140003234
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, r15
jne 0x140003223
mov ecx, r15d
lea rdx, [rbp + 0x90]
call fcn.1400046f0
add rdi, 8
sub r14, r15
jne 0x140003160
call fcn.140001230
lea rax, str.CurrentUser
mov qword [rbp - 0x70], rax
lea rax, str.Sandbox
mov qword [rbp - 0x68], rax
lea rax, str.Emily
mov qword [rbp - 0x60], rax
lea rax, str.HAPUBWS
mov qword [rbp - 0x58], rax
lea rax, str.Hong_Lee
mov qword [rbp - 0x50], rax
lea rax, str.IT_ADMIN
mov qword [rbp - 0x48], rax
lea rax, str.Johnson
mov qword [rbp - 0x40], rax
lea rax, str.Miller
mov qword [rbp - 0x38], rax
lea rax, str.milozs
mov qword [rbp - 0x30], rax
lea rax, str.Peter_Wilson
mov qword [rbp - 0x28], rax
lea rax, str.timmy
mov qword [rbp - 0x20], rax
lea rax, str.user
mov qword [rbp - 0x18], rax
lea rax, str.sand_box
mov qword [rbp - 0x10], rax
lea rax, str.malware
mov qword [rbp - 8], rax
lea rax, str.maltest
mov qword [rbp], rax
lea rax, str.test_user
mov qword [rbp + 8], rax
lea rax, str.virus
mov qword [rbp + 0x10], rax
lea rax, str.John_Doe
mov qword [rbp + 0x18], rax
call fcn.140001530
mov r12, rax
test rax, rax
je 0x1400033dc
lea rdi, [rbp - 0x70]
lea r15d, [r14 + 0x12]
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rdi]
lea r8, str.Checking_if_username_matches_:__s
mov edx, 0x100
lea rcx, [rbp + 0x90]
call fcn.140001010
mov rcx, qword [rdi]
mov rdx, r12
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov r14d, esi
lea rdx, [rbp + 0x90]
test eax, eax
lea rcx, str.____ls
sete r14b
call fcn.140002ef0
lea rcx, [rbp + 0x90]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x140003391
mov ebx, 0x5f
sub rbx, rax
je 0x1400033b6
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x1400033a4
lea rdx, [rbp + 0x90]
mov ecx, r14d
call fcn.1400046f0
add rdi, 8
sub r15, 1
jne 0x140003340
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rax, str.SANDBOX
mov qword [rsp + 0x9d0], r13
mov qword [rbp - 0x70], rax
lea rax, str.7SILVIA
mov qword [rbp - 0x68], rax
lea rax, str.HANSPETER_PC
mov qword [rbp - 0x60], rax
lea rax, str.JOHN_PC
mov qword [rbp - 0x58], rax
lea rax, str.MUELLER_PC
mov qword [rbp - 0x50], rax
lea rax, str.WIN7_TRAPS
mov qword [rbp - 0x48], rax
lea rax, str.FORTINET
mov qword [rbp - 0x40], rax
lea rax, str.TEQUILABOOMBOOM
mov qword [rbp - 0x38], rax
call fcn.1400015b0
mov r12, rax
test rax, rax
je 0x140003533
call fcn.140001630
mov r13, rax
test rax, rax
jne 0x140003462
mov rcx, r12
jmp 0x14000352d
lea r14, [rbp - 0x70]
mov r15d, 8
nop dword [rax]
mov rbx, qword [r14]
lea r8, str.Checking_if_hostname_matches_:__s
mov r9, rbx
lea rcx, [rbp + 0x90]
mov edx, 0x100
call fcn.140001010
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400034a3
lea edi, [rax + 1]
jmp 0x1400034bb
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
mov edi, esi
mov eax, 1
cmove edi, eax
lea rdx, [rbp + 0x90]
lea rcx, str.____ls
call fcn.140002ef0
lea rcx, [rbp + 0x90]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], si
jne 0x1400034e0
mov ebx, 0x5f
sub rbx, rax
je 0x140003505
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x1400034f3
lea rdx, [rbp + 0x90]
mov ecx, edi
call fcn.1400046f0
add r14, 8
sub r15, 1
jne 0x140003470
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.1400016e0
lea rdx, str.Checking_Number_of_processors_in_machine
lea rcx, str.____ls
call fcn.140002ef0
mov ebx, 0x36
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x140003550
mov rax, qword gs:[0x60]
lea rdx, str.Checking_Number_of_processors_in_machine
mov edi, esi
mov ebx, dword [rax + 0xb8]
cmp ebx, 2
setb dil
mov ecx, edi
call fcn.1400046f0
cmp ebx, 2
jb 0x140003a21
lea rdx, str.Checking_Interupt_Descriptor_Table_location
lea rcx, str.____ls
call fcn.140002ef0
mov ebx, 0x33
nop dword [rax]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x1400035b0
mov eax, dword [rsp + 0x60]
lea rdx, str.Checking_Interupt_Descriptor_Table_location
and eax, 0xff000000
mov ebx, esi
cmp eax, 0xff000000
sete bl
mov ecx, ebx
call fcn.1400046f0
add edi, ebx
jne 0x140003a21
lea rdx, str.Checking_Global_Descriptor_Table_location
lea rcx, str.____ls
call fcn.140002ef0
lea ebx, [rdi + 0x35]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x140003601
mov eax, dword [rsp + 0x60]
lea rdx, str.Checking_Global_Descriptor_Table_location
and eax, 0xff000000
mov ebx, esi
cmp eax, 0xff000000
sete bl
mov ecx, ebx
call fcn.1400046f0
lea eax, [rbx + rdi]
test eax, eax
jne 0x140003a21
lea rdx, str.Checking_Store_Task_Register
lea rcx, str.____ls
call fcn.140002ef0
mov ebx, 0x42
nop word [rax + rax]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x140003660
lea rdx, str.Checking_Store_Task_Register
xor ecx, ecx
call fcn.1400046f0
lea rdx, str.Checking_Number_of_cores_in_machine_using_WMI
lea rcx, str.____ls
call fcn.140002ef0
mov r14d, 0x31
mov ebx, r14d
nop dword [rax]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x1400036a0
lea r8, str.ROOTCIMV2
mov qword [rsp + 0x40], rsi
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], rsi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x48], rsi
mov edi, esi
call fcn.140004e00
test eax, eax
je 0x140003854
lea rcx, [0x140008fa0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_Processor
mov r12, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, 1
mov r15, rax
mov r13d, ebx
test r12, r12
je 0x140003779
test rax, rax
je 0x140003770
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov r9d, 0x30
mov r8, r15
mov qword [rsp + 0x20], rsi
mov rdx, r12
mov rbx, qword [rcx]
call qword [rbx + 0xa0]
test eax, eax
jns 0x14000376b
lea rcx, str.ExecQuery
mov r13d, esi
call fcn.140004820
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov ebx, 1
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r15, r15
je 0x140003787
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r13d, r13d
je 0x140003854
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x58], esi
test rcx, rcx
je 0x140003832
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x68]
mov edx, 0xffffffff
mov r8d, ebx
call qword [rax + 0x20]
cmp dword [rsp + 0x58], esi
je 0x14000382d
mov rcx, qword [rsp + 0x68]
lea r9, [rbp + 0x20]
mov qword [rsp + 0x28], rsi
lea rdx, str.NumberOfCores
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x140003812
cmp word [rbp + 0x20], 1
je 0x140003812
cmp dword [rbp + 0x28], 2
lea rcx, [rbp + 0x20]
cmovb edi, ebx
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
test edi, edi
jne 0x14000382d
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x1400037b0
jmp 0x140003832
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.Checking_Number_of_cores_in_machine_using_WMI
mov ecx, edi
call fcn.1400046f0
test edi, edi
jne 0x140003a21
lea rdx, str.Checking_hard_disk_size_using_DeviceIoControl
lea rcx, str.____ls
call fcn.140002ef0
nop dword [rax]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub r14, 1
jne 0x140003880
call fcn.140001aa0
lea rdx, str.Checking_hard_disk_size_using_DeviceIoControl
mov ecx, eax
mov ebx, eax
call fcn.1400046f0
test ebx, ebx
jne 0x140003a21
lea rdx, str.Checking_SetupDi_diskdrive
lea rcx, str.____ls
call fcn.140002ef0
lea ebx, [r14 + 0x44]
nop word [rax + rax]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x1400038d0
call fcn.140001dc0
lea rdx, str.Checking_SetupDi_diskdrive
mov ecx, eax
mov ebx, eax
call fcn.1400046f0
test ebx, ebx
jne 0x140003a21
lea rdx, str.Checking_mouse_movement
lea rcx, str.____ls
call fcn.140002ef0
mov ebx, 0x47
nop word [rax + rax]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x140003920
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x68], eax
jne 0x14000397d
mov eax, dword [rsp + 0x74]
cmp dword [rsp + 0x6c], eax
jne 0x14000397d
lea rdx, str.Checking_mouse_movement
jmp 0x140003a17
lea rdx, str.Checking_mouse_movement
xor ecx, ecx
call fcn.1400046f0
lea rdx, str.Checking_lack_of_user_input
lea rcx, str.____ls
call fcn.140002ef0
mov r12d, 0x43
mov ebx, r12d
nop word [rax + rax]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x1400039b0
mov ebx, esi
mov dword [rsp + 0x78], 8
mov edi, esi
nop
mov ecx, 0xb
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x140003a10
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rsp + 0x7c]
cmp eax, ecx
jb 0x140003a10
sub eax, ecx
cmp eax, 0x64
jae 0x140003a06
inc ebx
cmp ebx, 0xa
jge 0x140003a56
inc edi
cmp edi, 0x80
jl 0x1400039d0
lea rdx, str.Checking_lack_of_user_input
mov ecx, 1
call fcn.1400046f0
mov r13, qword [rsp + 0x9d0]
xor eax, eax
mov rcx, qword [rbp + 0x890]
xor rcx, rsp
call fcn.140005050
lea r11, [rsp + 0x9a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
lea rdx, str.Checking_lack_of_user_input
xor ecx, ecx
call fcn.1400046f0
lea rdx, str.Checking_memory_space_using_GlobalMemoryStatusEx
lea rcx, str.____ls
call fcn.140002ef0
mov ebx, 0x2e
nop dword [rax]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x140003a80
xorps xmm0, xmm0
lea rcx, [rbp - 0x70]
movups xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x70], 0x40
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp qword [rbp - 0x68], 0x40000000
lea rdx, str.Checking_memory_space_using_GlobalMemoryStatusEx
mov ebx, esi
setb bl
mov ecx, ebx
call fcn.1400046f0
test ebx, ebx
jne 0x140003a21
lea rdx, str.Checking_if_CPU_hypervisor_field_is_set_using_cpuid_0x1_
lea rcx, str.____ls
call fcn.140002ef0
mov ebx, 0x27
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x140003af1
xor ecx, ecx
mov eax, 1
cpuid
mov edi, ecx
lea rdx, str.Checking_if_CPU_hypervisor_field_is_set_using_cpuid_0x1_
sar edi, 0x1f
and edi, 1
mov ecx, edi
call fcn.1400046f0
test edi, edi
jne 0x140003a21
lea rdx, str.Checking_hypervisor_vendor_using_cpuid_0x40000000_
lea rcx, str.____ls
call fcn.140002ef0
lea ebx, [rdi + 0x2d]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x140003b40
xor ecx, ecx
mov qword [rbp - 0x64], rsi
mov qword [rsp + 0x34], rcx
mov eax, 0x40000000
lea rcx, str.KVMKVMKVM
mov qword [rbp - 0x5c], rsi
mov qword [rbp + 0x20], rcx
mov r15, rsi
lea rcx, str.Microsoft_Hv
mov qword [rbp - 0x54], rsi
mov qword [rbp + 0x28], rcx
lea rcx, str.VMwareVMware
mov qword [rbp + 0x30], rcx
lea rcx, str.XenVMMXenVMM
mov qword [rbp + 0x38], rcx
lea rcx, str.prl_hyperv
mov qword [rbp + 0x40], rcx
lea rcx, str.VBoxVBoxVBox
mov qword [rbp + 0x48], rcx
xor ecx, ecx
cpuid
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x38], ecx
movsd xmm0, qword [rsp + 0x34]
movsd qword [rbp - 0x70], xmm0
mov qword [rbp - 0x4c], rsi
mov qword [rbp - 0x44], rsi
mov qword [rbp - 0x3c], rsi
mov dword [rbp - 0x34], esi
mov dword [rbp - 0x68], edx
nop dword [rax + rax]
mov dword [rsp + 0x28], esi
lea r8, [rbp - 0x70]
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r13d, eax
lea ecx, [rax + 1]
movsxd rbx, ecx
add rbx, rbx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x140003c74
mov rdi, rax
mov dword [rsp + 0x28], r13d
xor eax, eax
mov qword [rsp + 0x20], r14
mov rcx, rbx
lea r8, [rbp - 0x70]
rep stosb byte [rdi], al
lea r9d, [rax - 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, qword [rbp + r15*8 + 0x20]
mov rax, r14
sub rdx, r14
nop dword [rax + rax]
movzx ebx, word [rax]
movzx ecx, word [rax + rdx]
sub ebx, ecx
jne 0x140003c63
add rax, 2
test ecx, ecx
jne 0x140003c50
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test ebx, ebx
je 0x140003f60
inc r15
cmp r15, 6
jl 0x140003be0
lea rdx, str.Checking_hypervisor_vendor_using_cpuid_0x40000000_
xor ecx, ecx
call fcn.1400046f0
lea rdx, str.Checking_SerialNumber_from_BIOS_using_WMI
lea rcx, str.____ls
call fcn.140002ef0
mov esi, 0x35
nop word [rax + rax]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rsi, 1
jne 0x140003cb0
call fcn.140001fd0
lea rdx, str.Checking_SerialNumber_from_BIOS_using_WMI
mov ecx, eax
mov ebx, eax
call fcn.1400046f0
test ebx, ebx
jne 0x140003a21
lea rdx, str.Checking_Model_from_ComputerSystem_using_WMI
lea rcx, str.____ls
call fcn.140002ef0
lea ebx, [rsi + 0x32]
nop word [rax + rax]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x140003d00
call fcn.140002240
lea rdx, str.Checking_Model_from_ComputerSystem_using_WMI
mov ecx, eax
mov ebx, eax
call fcn.1400046f0
test ebx, ebx
jne 0x140003a21
lea rdx, str.Checking_Manufacturer_from_ComputerSystem_using_WMI
lea rcx, str.____ls
call fcn.140002ef0
mov ebx, 0x2b
nop word [rax + rax]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x140003d50
call fcn.140002490
lea rdx, str.Checking_Manufacturer_from_ComputerSystem_using_WMI
mov ecx, eax
mov ebx, eax
call fcn.1400046f0
test ebx, ebx
jne 0x140003a21
lea rdx, str.Checking_Current_Temperature_using_WMI
lea rcx, str.____ls
call fcn.140002ef0
mov edi, 0x38
mov ebx, edi
nop dword [rax]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x140003da0
call fcn.1400026f0
lea rdx, str.Checking_Current_Temperature_using_WMI
mov ecx, eax
mov ebx, eax
call fcn.1400046f0
test ebx, ebx
jne 0x140003a21
lea rdx, str.Checking_ProcessId_using_WMI
lea rcx, str.____ls
call fcn.140002ef0
mov r13d, 0x42
mov ebx, r13d
nop dword [rax + rax]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x140003df0
call fcn.1400028f0
lea rdx, str.Checking_ProcessId_using_WMI
mov ecx, eax
mov ebx, eax
call fcn.1400046f0
test ebx, ebx
jne 0x140003a21
lea rdx, str.Checking_power_capabilities
lea rcx, str.____ls
call fcn.140002ef0
lea rcx, [0x140008d98]
call fcn.140002ef0
sub r12, 1
jne 0x140003e32
lea rcx, [rbp - 0x70]
mov r14d, esi
call qword [sym.imp.POWRPROF.dll_GetPwrCapabilities]
cmp al, 1
jne 0x140003e6c
movzx eax, byte [rbp - 0x6a]
or al, byte [rbp - 0x6b]
or al, byte [rbp - 0x6c]
or al, byte [rbp - 0x6d]
jne 0x140003e6c
cmp byte [rbp - 0x63], sil
sete r14b
lea rdx, str.Checking_power_capabilities
mov ecx, r14d
call fcn.1400046f0
test r14d, r14d
jne 0x140003a21
lea rdx, str.Checking_NtQueryLicenseValue_with_Kernel_VMDetection_Private
lea rcx, str.____ls
call fcn.140002ef0
lea ebx, [r14 + 0x22]
nop dword [rax + rax]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x140003ea0
lea rdx, [0x14000b080]
mov eax, esi
mov rcx, rdx
nop
cmp dword [rcx], 0x1b
je 0x140003f6c
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140003ec0
mov r8, rsi
mov eax, esi
mov rcx, rdx
nop dword [rax]
cmp dword [rcx], 0x11
je 0x140003f8a
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140003ee0
mov rbx, rsi
test r8, r8
je 0x140003fa8
test rbx, rbx
je 0x140003fa8
lea rdx, str.Kernel_VMDetection_Private
lea rcx, [rbp + 0x60]
call r8
lea rax, [rbp + 0x58]
mov dword [rsp + 0x5c], esi
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x5c]
xor edx, edx
lea rcx, [rbp + 0x60]
call rbx
test eax, eax
js 0x140003fa8
cmp dword [rsp + 0x5c], esi
lea rdx, str.Checking_NtQueryLicenseValue_with_Kernel_VMDetection_Private
mov ebx, esi
setne bl
mov ecx, ebx
call fcn.1400046f0
lea eax, [rbx + r14]
test eax, eax
jne 0x140003a21
jmp 0x140003fb6
lea rdx, str.Checking_hypervisor_vendor_using_cpuid_0x40000000_
jmp 0x140003a17
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], sil
je 0x140003ed4
mov r8, qword [rdx + rcx*8 + 0x28]
jmp 0x140003ed7
cdqe
lea rbx, [rax + rax*2]
add rbx, rbx
cmp byte [rdx + rbx*8 + 0x24], sil
je 0x140003ef4
mov rbx, qword [rdx + rbx*8 + 0x28]
jmp 0x140003ef7
lea rdx, str.Checking_NtQueryLicenseValue_with_Kernel_VMDetection_Private
xor ecx, ecx
call fcn.1400046f0
lea rdx, str.Checking_Win32_CacheMemory_with_WMI
lea rcx, str.____ls
call fcn.140002ef0
mov r14d, 0x3b
mov ebx, r14d
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x140003fd2
lea rcx, str.SELECT__FROM_Win32_CacheMemory
call fcn.140002b00
test eax, eax
lea rdx, str.Checking_Win32_CacheMemory_with_WMI
mov ecx, esi
mov ebx, eax
sete cl
call fcn.1400046f0
test ebx, ebx
je 0x140003a21
lea rdx, str.Checking_Win32_PhysicalMemory_with_WMI
lea rcx, str.____ls
call fcn.140002ef0
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rdi, 1
jne 0x140004020
lea rcx, str.SELECT__FROM_Win32_PhysicalMemory
call fcn.140002b00
test eax, eax
lea rdx, str.Checking_Win32_PhysicalMemory_with_WMI
mov ecx, esi
mov ebx, eax
sete cl
call fcn.1400046f0
test ebx, ebx
je 0x140003a21
lea rdx, str.Checking_Win32_MemoryDevice_with_WMI
lea rcx, str.____ls
call fcn.140002ef0
mov edi, 0x3a
mov ebx, edi
nop word [rax + rax]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x140004080
lea rcx, str.SELECT__FROM_Win32_MemoryDevice
call fcn.140002b00
test eax, eax
lea rdx, str.Checking_Win32_MemoryDevice_with_WMI
mov ecx, esi
mov ebx, eax
sete cl
call fcn.1400046f0
test ebx, ebx
je 0x140003a21
lea rdx, str.Checking_Win32_MemoryArray_with_WMI
lea rcx, str.____ls
call fcn.140002ef0
nop
lea rcx, [0x140008d98]
call fcn.140002ef0
sub r14, 1
jne 0x1400040d0
lea rcx, str.SELECT__FROM_Win32_MemoryArray
call fcn.140002b00
test eax, eax
lea rdx, str.Checking_Win32_MemoryArray_with_WMI
mov ecx, esi
mov ebx, eax
sete cl
call fcn.1400046f0
test ebx, ebx
je 0x140003a21
lea rdx, str.Checking_Win32_SMBIOSMemory_with_WMI
lea rcx, str.____ls
call fcn.140002ef0
nop
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rdi, 1
jne 0x140004120
lea rcx, str.SELECT__FROM_Win32_SMBIOSMemory
call fcn.140002b00
test eax, eax
lea rdx, str.Checking_Win32_SMBIOSMemory_with_WMI
mov ecx, esi
mov ebx, eax
sete cl
call fcn.1400046f0
test ebx, ebx
je 0x140003a21
lea rdx, str.Checking_ThermalZoneInfo_performance_counters_with_WMI
lea rcx, str.____ls
call fcn.140002ef0
mov r15d, 0x28
mov ebx, r15d
nop word [rax + rax]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x140004180
lea rcx, str.SELECT__FROM_Win32_PerfFormattedData_Counters_ThermalZoneInformation
call fcn.140002b00
test eax, eax
lea rdx, str.Checking_ThermalZoneInfo_performance_counters_with_WMI
mov ecx, esi
mov ebx, eax
sete cl
call fcn.1400046f0
test ebx, ebx
je 0x140003a21
lea rdx, str.Checking_CIM_Memory_with_WMI
lea rcx, str.____ls
call fcn.140002ef0
nop
lea rcx, [0x140008d98]
call fcn.140002ef0
sub r13, 1
jne 0x1400041d0
lea rcx, str.SELECT__FROM_CIM_Memory
call fcn.140002b00
test eax, eax
lea rdx, str.Checking_CIM_Memory_with_WMI
mov ecx, esi
mov ebx, eax
sete cl
call fcn.1400046f0
test ebx, ebx
je 0x140003a21
lea rdx, str.Checking_ServicesDiskEnum_entries_for_VM_strings
lea rcx, str.____ls
call fcn.140002ef0
lea ebx, [r13 + 0x2c]
lea rcx, [0x140008d98]
call fcn.140002ef0
sub rbx, 1
jne 0x140004222
lea rax, str.qemu
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x20], rax
lea rdx, str.SystemCurrentControlSetServicesDiskEnum
lea rax, str.virtio
mov dword [rsp + 0x58], esi
mov qword [rbp + 0x28], rax
mov r9d, 0x20019
lea rax, str.vmware
mov dword [rsp + 0x5c], 4
mov qword [rbp + 0x30], rax
xor r8d, r8d
lea rax, str.vbox
mov rcx, 0xffffffff80000002
mov qword [rbp + 0x38], rax
lea rax, [0x140007768]
mov qword [rbp + 0x40], rax
lea rax, [0x140007770]
mov qword [rbp + 0x48], rax
lea rax, str.Virtual
mov qword [rbp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004311
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rdx, str.Count
lea rax, [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
test eax, eax
je 0x14000430b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Checking_ServicesDiskEnum_entries_for_VM_strings
xor ecx, ecx
call fcn.1400046f0
jmp 0x140004420
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14d, esi
cmp dword [rsp + 0x58], esi
jbe 0x14000440a
nop
mov r9d, r14d
lea r8, [0x140007784]
mov edx, 0xb
lea rcx, [rbp + 0x78]
call fcn.140001010
mov ebx, esi
lea rdi, [rbp + 0x20]
nop
xor edx, edx
mov qword [rsp + 0x50], rsi
mov r8d, 0x800
lea rcx, [rbp + 0x90]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x50]
mov dword [rsp + 0x60], 0x104
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetServicesDiskEnum
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400043db
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x78]
lea rax, [rbp + 0x90]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400043d0
mov rdx, qword [rdi]
lea rcx, [rbp + 0x90]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x1400043fa
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
add rdi, 8
cmp ebx, 7
jb 0x140004340
inc r14d
cmp r14d, dword [rsp + 0x58]
jb 0x140004320
jmp 0x14000440a
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
lea rdx, str.Checking_ServicesDiskEnum_entries_for_VM_strings
mov ecx, esi
call fcn.1400046f0
test esi, esi
jne 0x140003a21
lea rdx, str.Checking_EnumIDE_and_EnumSCSI_entries_for_VM_strings
lea rcx, str.____ls
call fcn.140002ef0
lea rcx, [0x140008d98]
call fcn.140002ef0
sub r15, 1
jne 0x140004433
call fcn.140002cc0
lea rdx, str.Checking_EnumIDE_and_EnumSCSI_entries_for_VM_strings
mov ecx, eax
mov ebx, eax
call fcn.1400046f0
test ebx, ebx
jne 0x140003a21
call fcn.140002f50
jmp 0x140003a21