Function at 0x140001020
Capabilities:
Acquire debug privileges
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400010ca
mov rbx, qword [rsp + 0x30]
lea r8, [rsp + 0x4c]
xorps xmm0, xmm0
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1400010bf
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x48], 1
mov rcx, rbx
mov dword [rsp + 0x54], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1400010bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov eax, 1
cpuid
test ecx, ecx
lea rdx, str.Hypervisor_detected_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
js 0x1400010ec
lea rdx, str.No_hypervisor_detected_n
call fcn.140001290
xor r9d, r9d
lea rdx, [rsp + 0x58]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
lea r8d, [r9 + 0x10]
lea ecx, [r9 + 0x5b]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov ebx, eax
test eax, eax
js 0x14000115e
lea rdx, str.yeehaa_n
call fcn.140001290
cmp byte [rsp + 0x5a], 0
je 0x140001142
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Hypervisor_present_n
call fcn.140001290
cmp byte [rsp + 0x58], 0
je 0x140001195
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Hypervisor_connected_n
call fcn.140001290
jmp 0x140001195
lea rdx, str.SystemHypervisorInformation_call_failed__error:_0x
call fcn.140001290
mov rcx, rax
lea rdx, section..text
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001460]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
lea rdx, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], eax
lea r8d, [rax + 0xc]
lea ecx, [rax + 1]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x1400011fd
movzx edx, word [rsp + 0x38]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
mov rcx, rax
lea rdx, [0x140001460]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movzx edx, word [rsp + 0x3a]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
mov rcx, rax
lea rdx, [0x140001460]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400014b0
add rsp, 0x70
pop rbx
ret