Function at 0x426360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ec6c
mov eax, dword fs:[0]
push eax
sub esp, 0xa94
mov eax, dword [0x43e080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov ecx, edi
mov esi, dword [ebp + 8]
push 0
push str._or
mov dword [ebp - 0xa94], esi
call fcn.00416c50
xorps xmm0, xmm0
cmp eax, 0xffffffff
je 0x4263f3
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 7
mov dword [esi + 0x14], 0xf
mov ecx, dword [str.Unknown]
mov dword [esi], ecx
mov cx, word [0x435578]
mov word [esi + 4], cx
mov cl, byte [0x43557a]
mov byte [esi + 6], cl
mov byte [esi + 7], 0
jmp 0x427786
mov eax, dword [str.Xen_HVM]
movups xmmword [ebp - 0xa90], xmm0
mov dword [ebp - 0xa90], eax
movzx eax, word [0x4335ec]
mov word [ebp - 0xa8c], ax
movzx eax, byte [0x4335ee]
mov dword [ebp - 0xa80], 7
mov dword [ebp - 0xa7c], 0xf
mov byte [ebp - 0xa8a], al
mov byte [ebp - 0xa89], 0
lea eax, [ebp - 0xa94]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xa78]
mov dword [ebp - 0xa68], 0
push eax
push ecx
movups xmmword [ebp - 0xa78], xmm0
mov dword [ebp - 0xa64], 0
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0xa94]
mov edx, eax
mov dword [ebp - 0xa64], ecx
mov dword [ebp - 0xa78], edx
mov dword [ebp - 0xa68], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x436884]
mov word [edx + 0x10], cx
movzx eax, byte [0x436886]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
movzx eax, word [0x43330c]
xorps xmm0, xmm0
movups xmmword [ebp - 0xa60], xmm0
mov dword [ebp - 4], 1
movq xmm0, qword [str.VMware_ESX]
mov dword [ebp - 0xa50], 0xa
mov dword [ebp - 0xa4c], 0xf
movq qword [ebp - 0xa60], xmm0
mov word [ebp - 0xa58], ax
mov byte [ebp - 0xa56], 0
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa48]
mov dword [ebp - 0xa38], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0xa34], 0
push ecx
movups xmmword [ebp - 0xa48], xmm0
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0xa94]
mov edx, eax
mov dword [ebp - 0xa34], ecx
mov dword [ebp - 0xa48], edx
mov dword [ebp - 0xa38], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x436884]
mov word [edx + 0x10], cx
movzx eax, byte [0x436886]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
mov eax, dword [str.ACRN]
xorps xmm0, xmm0
movups xmmword [ebp - 0xa30], xmm0
mov dword [ebp - 0xa20], 4
mov dword [ebp - 0xa1c], 0xf
mov dword [ebp - 0xa30], eax
mov byte [ebp - 0xa2c], 0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa18]
movups xmmword [ebp - 0xa18], xmm0
mov dword [ebp - 0xa08], 0
lea eax, [ebp - 0xa94]
mov dword [ebp - 0xa04], 0
push eax
push ecx
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0xa94]
mov edx, eax
mov dword [ebp - 0xa04], ecx
mov dword [ebp - 0xa18], edx
mov dword [ebp - 0xa08], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x436884]
mov word [edx + 0x10], cx
movzx eax, byte [0x436886]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
mov eax, dword [0x433630]
xorps xmm0, xmm0
movups xmmword [ebp - 0xa00], xmm0
mov dword [ebp - 0x9f8], eax
movq xmm0, qword [str.QNX_hypervisor]
movzx eax, word [0x433634]
mov dword [ebp - 0x9f0], 0xe
mov dword [ebp - 0x9ec], 0xf
movq qword [ebp - 0xa00], xmm0
mov word [ebp - 0x9f4], ax
mov byte [ebp - 0x9f2], 0
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x9e8]
mov dword [ebp - 0x9d8], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x9d4], 0
push ecx
movups xmmword [ebp - 0x9e8], xmm0
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0xa94]
mov edx, eax
mov dword [ebp - 0x9d4], ecx
mov dword [ebp - 0x9e8], edx
mov dword [ebp - 0x9d8], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x436884]
mov word [edx + 0x10], cx
movzx eax, byte [0x436886]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x9d0]
mov dword [ebp - 0x9c0], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x9bc], 0
push ecx
movups xmmword [ebp - 0x9d0], xmm0
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.Microsoft_Hyper_V]
mov ecx, dword [ebp - 0xa94]
mov dword [ebp - 0x9bc], ecx
mov dword [ebp - 0x9d0], eax
mov dword [ebp - 0x9c0], 0x11
movups xmmword [eax], xmm0
mov cl, byte [0x433514]
mov byte [eax + 0x10], cl
mov byte [eax + 0x11], 0
xorps xmm0, xmm0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x9b8]
mov dword [ebp - 0x9a8], 0
movups xmmword [ebp - 0x9b8], xmm0
lea eax, [ebp - 0xa94]
mov dword [ebp - 0x9a4], 0
push eax
push ecx
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0xa94]
mov edx, eax
mov dword [ebp - 0x9a4], ecx
mov dword [ebp - 0x9b8], edx
mov dword [ebp - 0x9a8], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x436884]
mov word [edx + 0x10], cx
movzx eax, byte [0x436886]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x9a0]
mov dword [ebp - 0x990], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x98c], 0
push ecx
movups xmmword [ebp - 0x9a0], xmm0
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.Microsoft_Azure_Hyper_V]
mov ecx, dword [ebp - 0xa94]
mov edx, eax
mov dword [ebp - 0x98c], ecx
mov dword [ebp - 0x9a0], edx
mov dword [ebp - 0x990], 0x17
movups xmmword [edx], xmm0
mov ecx, dword [0x433868]
mov dword [edx + 0x10], ecx
movzx eax, word [0x43386c]
mov word [edx + 0x14], ax
movzx eax, byte [0x43386e]
mov byte [edx + 0x16], al
mov byte [edx + 0x17], 0
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x988]
mov dword [ebp - 0x978], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x974], 0
push ecx
movups xmmword [ebp - 0x988], xmm0
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0xa94]
mov edx, eax
mov dword [ebp - 0x974], ecx
add esp, 0x40
mov dword [ebp - 0x988], edx
mov dword [ebp - 0x978], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x436884]
mov word [edx + 0x10], cx
movzx eax, byte [0x436886]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x970]
mov dword [ebp - 0x960], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x95c], 0
push ecx
movups xmmword [ebp - 0x970], xmm0
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.Xbox_NanoVisor__Hyper_V_]
mov ecx, dword [ebp - 0xa94]
mov dword [ebp - 0x970], eax
mov dword [ebp - 0x960], 0x18
mov dword [ebp - 0x95c], ecx
movups xmmword [eax], xmm0
movq xmm0, qword [0x433898]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x958]
mov dword [ebp - 0x948], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x944], 0
push ecx
movups xmmword [ebp - 0x958], xmm0
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0xa94]
mov edx, eax
mov dword [ebp - 0x944], ecx
mov dword [ebp - 0x958], edx
mov dword [ebp - 0x948], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x436884]
mov word [edx + 0x10], cx
movzx eax, byte [0x436886]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
xorps xmm0, xmm0
mov dword [ebp - 0x930], 4
movups xmmword [ebp - 0x940], xmm0
mov dword [ebp - 0x92c], 0xf
mov dword [ebp - 0x940], 0x204d564b
mov byte [ebp - 0x93c], 0
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x928]
mov dword [ebp - 0x918], 0
push eax
push ecx
movups xmmword [ebp - 0x928], xmm0
mov dword [ebp - 0x914], 0
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0xa94]
mov edx, eax
mov dword [ebp - 0x914], ecx
mov dword [ebp - 0x928], edx
mov dword [ebp - 0x918], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x436884]
mov word [edx + 0x10], cx
movzx eax, byte [0x436886]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
mov eax, dword [str.bhyve]
xorps xmm0, xmm0
movups xmmword [ebp - 0x910], xmm0
mov dword [ebp - 0x910], eax
movzx eax, byte [0x4333d4]
mov dword [ebp - 0x900], 5
mov dword [ebp - 0x8fc], 0xf
mov byte [ebp - 0x90c], al
mov byte [ebp - 0x90b], 0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x8f8]
movups xmmword [ebp - 0x8f8], xmm0
mov dword [ebp - 0x8e8], 0
lea eax, [ebp - 0xa94]
mov dword [ebp - 0x8e4], 0
mov dword [ebp - 0xa94], 0x1f
push eax
push ecx
call fcn.00405810
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0xa94]
mov edx, eax
mov dword [ebp - 0x8e4], ecx
mov dword [ebp - 0x8f8], edx
mov dword [ebp - 0x8e8], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x436884]
mov word [edx + 0x10], cx
movzx eax, byte [0x436886]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x8e0]
mov dword [ebp - 0x8d0], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x8cc], 0
push ecx
movups xmmword [ebp - 0x8e0], xmm0
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.KVM_Hyper_V_Enlightenment]
mov ecx, dword [ebp - 0xa94]
mov edx, eax
mov dword [ebp - 0x8e0], edx
mov dword [ebp - 0x8d0], 0x19
mov dword [ebp - 0x8cc], ecx
movups xmmword [edx], xmm0
movq xmm0, qword [0x433490]
movq qword [edx + 0x10], xmm0
movzx eax, byte [0x433498]
mov byte [edx + 0x18], al
mov byte [edx + 0x19], 0
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x8c8]
mov dword [ebp - 0x8b8], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x8b4], 0
push ecx
movups xmmword [ebp - 0x8c8], xmm0
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0xa94]
mov edx, eax
mov dword [ebp - 0x8b4], ecx
mov dword [ebp - 0x8c8], edx
mov dword [ebp - 0x8b8], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x436884]
mov word [edx + 0x10], cx
movzx eax, byte [0x436886]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x8b0]
mov dword [ebp - 0x8a0], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x89c], 0
push ecx
movups xmmword [ebp - 0x8b0], xmm0
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
mov ecx, dword [ebp - 0xa94]
mov edx, eax
movups xmm0, xmmword [str.QEMUKVM_Hyper_V_Enlightenment]
mov dword [ebp - 0x8b0], edx
mov dword [ebp - 0x8a0], 0x1e
mov dword [ebp - 0x89c], ecx
movups xmmword [edx], xmm0
movq xmm0, qword [0x4334d0]
movq qword [edx + 0x10], xmm0
mov eax, dword [0x4334d8]
mov dword [edx + 0x18], eax
movzx eax, word [0x4334dc]
mov word [edx + 0x1c], ax
mov byte [edx + 0x1e], 0
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x898]
mov dword [ebp - 0x888], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x884], 0
push ecx
movups xmmword [ebp - 0x898], xmm0
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0xa94]
mov edx, eax
mov dword [ebp - 0x884], ecx
add esp, 0x40
mov dword [ebp - 0x898], edx
mov dword [ebp - 0x888], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x436884]
mov word [edx + 0x10], cx
movzx eax, byte [0x436886]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
mov eax, dword [str.QEMUKVM]
xorps xmm0, xmm0
mov ecx, dword [0x433454]
movups xmmword [ebp - 0x880], xmm0
mov dword [ebp - 0x870], 8
mov dword [ebp - 0x86c], 0xf
mov dword [ebp - 0x880], eax
mov dword [ebp - 0x87c], ecx
mov byte [ebp - 0x878], 0
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x868]
mov dword [ebp - 0x858], 0
push eax
push ecx
movups xmmword [ebp - 0x868], xmm0
mov dword [ebp - 0x854], 0
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0xa94]
mov edx, eax
mov dword [ebp - 0x854], ecx
add esp, 8
mov dword [ebp - 0x868], edx
mov dword [ebp - 0x858], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x436884]
mov word [edx + 0x10], cx
movzx eax, byte [0x436886]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
push str.Hypervisor__type_1_
push str.Intel_HAXM
lea ecx, [ebp - 0x850]
mov byte [ebp - 4], 0x17
call fcn.00404d80
push str.Hypervisor__type_1_
push str.Intel_KGT__Trusty_
lea ecx, [ebp - 0x820]
mov byte [ebp - 4], 0x18
call fcn.00404d80
mov byte [ebp - 4], 0x19
push str.Hypervisor__type_1_
push str.SimpleVisor
lea ecx, [ebp - 0x7f0]
call fcn.00404d80
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x7c0]
mov dword [ebp - 0x7b0], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x7ac], 0
push ecx
movups xmmword [ebp - 0x7c0], xmm0
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.Google_Compute_Engine__KVM_]
mov ecx, dword [ebp - 0xa94]
mov edx, eax
mov dword [ebp - 0x7c0], edx
mov dword [ebp - 0x7b0], 0x1b
mov dword [ebp - 0x7ac], ecx
movups xmmword [edx], xmm0
movq xmm0, qword [0x4339a4]
movq qword [edx + 0x10], xmm0
movzx eax, word [0x4339ac]
mov word [edx + 0x18], ax
movzx eax, byte [0x4339ae]
mov byte [edx + 0x1a], al
mov byte [edx + 0x1b], 0
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x7a8]
mov dword [ebp - 0x798], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x794], 0
push ecx
movups xmmword [ebp - 0x7a8], xmm0
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0xa94]
mov edx, eax
mov dword [ebp - 0x794], ecx
add esp, 0x10
mov dword [ebp - 0x7a8], edx
mov dword [ebp - 0x798], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x436884]
mov word [edx + 0x10], cx
movzx eax, byte [0x436886]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
push str.Hypervisor__type_1_
push str.OpenStack__KVM_
lea ecx, [ebp - 0x790]
mov byte [ebp - 4], 0x1c
call fcn.00404d80
push str.Hypervisor__type_1_
push str.KubeVirt__KVM_
lea ecx, [ebp - 0x760]
mov byte [ebp - 4], 0x1d
call fcn.00404d80
push str.Hypervisor__type_1_
push str.IBM_PowerVM
lea ecx, [ebp - 0x730]
mov byte [ebp - 4], 0x1e
call fcn.00404d80
xorps xmm0, xmm0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x700]
mov dword [ebp - 0x6f0], 0
movups xmmword [ebp - 0x700], xmm0
mov dword [ebp - 0x6ec], 0
mov dword [ebp - 0xa94], 0x2f
lea eax, [ebp - 0xa94]
push eax
push ecx
call fcn.00405810
movups xmm0, xmmword [str.AWS_Nitro_System_EC2__KVM_based_]
mov ecx, dword [ebp - 0xa94]
mov dword [ebp - 0x700], eax
mov dword [ebp - 0x6f0], 0x20
mov dword [ebp - 0x6ec], ecx
movups xmmword [eax], xmm0
movups xmm0, xmmword [0x433a28]
movups xmmword [eax + 0x10], xmm0
mov byte [eax + 0x20], 0
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x6e8]
mov dword [ebp - 0x6d8], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x6d4], 0
push ecx
movups xmmword [ebp - 0x6e8], xmm0
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.Hypervisor__type_1_]
mov ecx, dword [ebp - 0xa94]
mov edx, eax
mov dword [ebp - 0x6d4], ecx
add esp, 0x10
mov dword [ebp - 0x6e8], edx
mov dword [ebp - 0x6d8], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x436884]
mov word [edx + 0x10], cx
movzx eax, byte [0x436886]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
push str.Hypervisor__type_2_
push str.VirtualBox
lea ecx, [ebp - 0x6d0]
mov byte [ebp - 4], 0x21
call fcn.00404d80
mov eax, dword [0x4332a4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x6a0], xmm0
mov dword [ebp - 0x6a0], eax
movzx eax, word [0x4332a8]
mov dword [ebp - 0x690], 6
mov dword [ebp - 0x68c], 0xf
mov word [ebp - 0x69c], ax
mov byte [ebp - 0x69a], 0
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x688]
mov dword [ebp - 0x678], 0
push eax
push ecx
movups xmmword [ebp - 0x688], xmm0
mov dword [ebp - 0x674], 0
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.Hypervisor__type_2_]
mov ecx, dword [ebp - 0xa94]
mov edx, eax
mov dword [ebp - 0x674], ecx
add esp, 8
mov dword [ebp - 0x688], edx
mov dword [ebp - 0x678], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x436898]
mov word [edx + 0x10], cx
movzx eax, byte [0x43689a]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
mov byte [ebp - 4], 0x24
push str.Hypervisor__type_2_
push str.VMware_Express
lea ecx, [ebp - 0x670]
call fcn.00404d80
push str.Hypervisor__type_2_
push str.VMware_GSX
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 0x25
call fcn.00404d80
push str.Hypervisor__type_2_
push str.VMware_Workstation
lea ecx, [ebp - 0x610]
mov byte [ebp - 4], 0x26
call fcn.00404d80
push str.Hypervisor__type_2_
push str.VMware_Fusion
lea ecx, [ebp - 0x5e0]
mov byte [ebp - 4], 0x27
call fcn.00404d80
movzx eax, byte [0x4335c0]
xorps xmm0, xmm0
movups xmmword [ebp - 0x5b0], xmm0
mov dword [ebp - 0x5a0], 9
movq xmm0, qword [str.Parallels]
mov dword [ebp - 0x59c], 0xf
movq qword [ebp - 0x5b0], xmm0
mov byte [ebp - 0x5a8], al
mov byte [ebp - 0x5a7], 0
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x598]
mov dword [ebp - 0x588], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x584], 0
push ecx
movups xmmword [ebp - 0x598], xmm0
mov dword [ebp - 0xa94], 0x1f
call fcn.00405810
movups xmm0, xmmword [str.Hypervisor__type_2_]
mov ecx, dword [ebp - 0xa94]
mov edx, eax
mov dword [ebp - 0x584], ecx
add esp, 8
mov dword [ebp - 0x598], edx
mov dword [ebp - 0x588], 0x13
movups xmmword [edx], xmm0
movzx ecx, word [0x436898]
mov word [edx + 0x10], cx
movzx eax, byte [0x43689a]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
push str.Hypervisor__type_2_
push str.Virtual_PC
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], 0x2a
call fcn.00404d80
push str.Hypervisor__type_2_
push str.Virtual_Apple
lea ecx, [ebp - 0x550]
mov byte [ebp - 4], 0x2b
call fcn.00404d80
push str.Hypervisor__type_2_
push str.NetBSD_NVMM
lea ecx, [ebp - 0x520]
mov byte [ebp - 4], 0x2c
call fcn.00404d80
push str.Hypervisor__type_2_
push str.OpenBSD_VMM
lea ecx, [ebp - 0x4f0]
mov byte [ebp - 4], 0x2d
call fcn.00404d80
push str.Hypervisor__type_2_
push str.User_mode_Linux
lea ecx, [ebp - 0x4c0]
mov byte [ebp - 4], 0x2e
call fcn.00404d80
push str.Sandbox
push str.Cuckoo
lea ecx, [ebp - 0x490]
mov byte [ebp - 4], 0x2f
call fcn.00404d80
push str.Sandbox
push str.Sandboxie
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 0x30
call fcn.00404d80
mov eax, dword [0x433640]
xorps xmm0, xmm0
movups xmmword [ebp - 0x430], xmm0
mov dword [ebp - 0x428], eax
movzx eax, word [0x433644]
movq xmm0, qword [str.Hybrid_Analysis]
mov word [ebp - 0x424], ax
movzx eax, byte [0x433646]
mov dword [ebp - 0x420], 0xf
mov dword [ebp - 0x41c], 0xf
movq qword [ebp - 0x430], xmm0
mov byte [ebp - 0x422], al
mov byte [ebp - 0x421], 0
mov eax, dword [str.Sandbox]
xorps xmm0, xmm0
movups xmmword [ebp - 0x418], xmm0
mov dword [ebp - 0x418], eax
movzx eax, word [0x433c54]
mov word [ebp - 0x414], ax
movzx eax, byte [0x433c56]
mov dword [ebp - 0x408], 7
mov dword [ebp - 0x404], 0xf
mov byte [ebp - 0x412], al
mov byte [ebp - 0x411], 0
push str.Sandbox
push str.CWSandbox
lea ecx, [ebp - 0x400]
mov byte [ebp - 4], 0x33
call fcn.00404d80
push str.Sandbox
push str.JoeBox
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 0x34
call fcn.00404d80
push str.Sandbox
push str.Anubis
lea ecx, [ebp - 0x3a0]
mov byte [ebp - 4], 0x35
call fcn.00404d80
push str.Sandbox
push str.Comodo
lea ecx, [ebp - 0x370]
mov byte [ebp - 4], 0x36
call fcn.00404d80
push 0xc
xorps xmm0, xmm0
mov byte [ebp - 4], 0x37
push str.ThreatExpert
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x330], 0
movups xmmword [ebp - 0x340], xmm0
mov dword [ebp - 0x32c], 0
call fcn.00405f60
xorps xmm0, xmm0
mov byte [ebp - 4], 0x38
movups xmmword [ebp - 0x328], xmm0
push 7
push str.Sandbox
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x318], 0
mov dword [ebp - 0x314], 0
call fcn.00405f60
push 5
xorps xmm0, xmm0
mov byte [ebp - 4], 0x39
push str.Bochs
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x300], 0
movups xmmword [ebp - 0x310], xmm0
mov dword [ebp - 0x2fc], 0
call fcn.00405f60
push 8
xorps xmm0, xmm0
mov byte [ebp - 4], 0x3a
push str.Emulator
lea ecx, [ebp - 0x2f8]
mov dword [ebp - 0x2e8], 0
movups xmmword [ebp - 0x2f8], xmm0
mov dword [ebp - 0x2e4], 0
call fcn.00405f60
push 0xa
xorps xmm0, xmm0
mov byte [ebp - 4], 0x3b
push str.BlueStacks
lea ecx, [ebp - 0x2e0]
mov dword [ebp - 0x2d0], 0
movups xmmword [ebp - 0x2e0], xmm0
mov dword [ebp - 0x2cc], 0
call fcn.00405f60
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 0x3c
call fcn.0040c890
push 8
push str.Emulator
lea ecx, [ebp - 0x2c8]
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b4], 0
call fcn.00405f60
push str.Emulator
push str.Microsoft_x86_to_ARM
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0x3d
call fcn.00404d80
push str.Emulator
push str.QEMU
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 0x3e
call fcn.00404d80
push str.Partitioning_Hypervisor
push str.Jailhouse
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 0x3f
call fcn.00404d80
push str.Partitioning_Hypervisor
push str.Unisys_s_Par
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0x40
call fcn.00404d80
push str.Container
push str.Docker
lea ecx, [ebp - 0x1f0]
mov byte [ebp - 4], 0x41
call fcn.00404d80
push str.Container
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x1c0]
push str.Podman
call fcn.00404d80
push str.Container
push str.OpenVZ
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x43
call fcn.00404d80
push str.Hypervisor__either_type_1_or_2_
push str.Microsoft_Virtual_PC_Hyper_V
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x44
call fcn.00404d80
push str.Hypervisor__unknown_type_
push str.Lockheed_Martin_LMHS
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x45
call fcn.00404d80
push str.Compatibility_layer
push str.Wine
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0x46
call fcn.00404d80
push str.Unknown
push str.Apple_VZ
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x47
call fcn.00404d80
push str.No_VM
push str.Hyper_V_artifact__not_an_actual_VM_
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x48
call fcn.00404d80
push str.Paravirtualised
push str.User_mode_Linux
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x49
call fcn.00404d80
push str.Hybrid_Hyper_V__type_1_and_2_
push 0x433a74
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x4a
call fcn.00404d80
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x4b
lea ecx, [ebp - 0xa90]
push eax
push ecx
lea ecx, [ebp - 0xa9c]
call fcn.0040c4b0
push fcn.0040d470
push 0x38
push 0x30
lea eax, [ebp - 0xa90]
mov byte [ebp - 4], 0x4d
push eax
call fcn.0042b46c
push edi
lea eax, [ebp - 0xa94]
push eax
lea ecx, [ebp - 0xa9c]
call fcn.00416c00
mov eax, dword [ebp - 0xa94]
mov ecx, esi
cmp eax, dword [ebp - 0xa9c]
je 0x427771
add eax, 0x28
push eax
call fcn.0040c040
jmp 0x42777b
push str.Unknown
call fcn.0040c0f0
lea ecx, [ebp - 0xa9c]
call fcn.0040d1c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042b81e
mov esp, ebp
pop ebp
ret