Function at 0x1400013e0
Capabilities:
Check for debugger via api
Check for outputdebugstring error
Check for peb beingdebugged flag
Check for peb ntglobalflag flag
Check for software breakpoints
Check for time delay via gettickcount
Check for unmoving mouse cursor
Check if file exists
Check if process is running under wine
Check os version
Create thread
Encode data using base64
Enumerate process modules
Execute anti-debugging instructions
Get common file path
Get disk size
Get file attributes
Get memory capacity
Get number of processor cores
Get program files directory
Get system information on windows
Print debug messages
Query environment variable
Query or enumerate registry value
Reference processor manufacturer constants
Reference wmi statements
Send icmp echo request
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x15790]
mov eax, 0x15890
call fcn.1400188d0
sub rsp, rax
mov rax, qword [0x140027040]
xor rax, rsp
mov qword [rbp + 0x15780], rax
movsxd rsi, ecx
xor r8d, r8d
mov r12d, 1
mov r15, rdx
cmp esi, r12d
jle 0x1400014d7
mov ebx, r12d
cmp rsi, r12
jbe 0x140001540
mov edi, 2
lea r13, str.__check
nop
mov rdx, qword [r15 + rbx*8]
mov rcx, r8
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rcx + r13 - 1]
jne 0x1400014c5
cmp rcx, 8
jne 0x140001460
cmp edi, esi
jge 0x1400014c5
mov rdx, qword [r15 + rbx*8 + 8]
xorps xmm0, xmm0
mov qword [rbp + 0xc8], r8
mov qword [rbp + 0xd0], r8
mov r8, 0xffffffffffffffff
movups xmmword [rbp + 0xb8], xmm0
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400014a0
lea rcx, [rbp + 0xb8]
call fcn.14000b2c0
lea rcx, [rbp + 0xb8]
call fcn.140001010
xor r8d, r8d
add edi, 2
add rbx, 2
cmp rbx, rsi
jl 0x140001450
jmp 0x140001540
mov dword [0x140040098], r12d
mov dword [0x140040094], r12d
mov dword [0x140040090], r12d
mov dword [0x14004008c], r12d
mov dword [0x140040088], r12d
mov dword [0x140040084], r12d
mov dword [0x140040080], r12d
mov dword [0x14004007c], r12d
mov dword [0x140040078], r12d
mov dword [0x140040074], r12d
mov dword [0x140040070], r12d
mov dword [0x14004006c], r12d
mov dword [0x140040068], r12d
mov dword [0x140040064], r12d
mov dword [0x140040060], r12d
lea rcx, str.Al_Khaser___by_Lord_Noteworthy
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 0x64
mov dword [rsp + 0x28], r12d
mov r8d, edx
mov dword [rsp + 0x20], 0x384
mov r9d, 0x384
mov rcx, rax
call qword [sym.imp.USER32.dll_MoveWindow]
lea rcx, str._al_khaser_version_0.82_
call fcn.14000b0a0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x2b0]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x2b0]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x2b8]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Initialisation
lea rcx, str._n___________________________s___________________________n
call fcn.14000b0a0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor ebx, ebx
lea rsi, [0x14003f20c]
mov r13d, ebx
nop dword [rax]
nop word [rax + rax]
test dword [rsi - 4], 0xfffffffd
mov r15d, dword [rsi + 4]
mov r12d, dword [rsi]
je 0x140001617
xor al, al
jmp 0x1400016b5
xor r14b, r14b
lea rcx, [0x14003f898]
mov rdi, rbx
xor al, al
lea rbx, [0x14003f7c8]
nop dword [rax]
test rdi, rdi
je 0x140001647
cmp dword [rbx - 8], r12d
jne 0x140001647
mov r14b, 1
call qword [rbx]
lea rcx, [0x14003f898]
inc rdi
add rbx, 0x10
cmp rbx, rcx
jl 0x140001630
test r14b, r14b
jne 0x140001661
lea rcx, str.ERROR:_Minimum_version_value_was_invalid._n
jmp 0x1400016ac
test al, al
je 0x1400016b1
test r15d, r15d
jne 0x14000166e
mov al, 1
jmp 0x1400016b3
xor dil, dil
lea rbx, [0x14003f7c8]
xor al, al
nop word [rax + rax]
cmp dword [rbx - 8], r15d
jne 0x140001697
mov dil, 1
call qword [rbx]
test al, al
lea rcx, [0x14003f898]
sete al
add rbx, 0x10
cmp rbx, rcx
jl 0x140001680
test dil, dil
jne 0x1400016b3
lea rcx, str.ERROR:_Removed_version_value_was_invalid._n
call fcn.14000b030
xor al, al
xor ebx, ebx
mov byte [rsi + 9], al
mov rcx, qword [rsi - 0x14]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x1400016cc
mov byte [rsi + 8], al
jmp 0x1400016e6
mov rdx, qword [rsi - 0xc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0xc], rax
test rax, rax
setne al
mov byte [rsi + 8], al
inc r13d
add rsi, 0x30
cmp r13d, 0x1f
jb 0x140001600
xor edx, edx
mov word [rbp + 0x12cd0], bx
mov r8d, 0x206
lea rcx, [rbp + 0x12cd2]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x12cd0]
call fcn.140014f60
test eax, eax
je 0x140001735
lea rdx, [rbp + 0x12cd0]
lea rcx, str._n___You_are_running:__s_n
call fcn.14000b0a0
mov esi, ebx
mov edi, ebx
lea rbx, [0x14003f214]
cmp byte [rbx + 1], 0
je 0x140001761
cmp byte [rbx], 0
jne 0x140001761
mov r8, qword [rbx - 0x14]
lea rcx, str.___Warning:_API__s__s_was_expected_to_exist_but_was_not_found._n
mov rdx, qword [rbx - 0x1c]
call fcn.14000b030
inc esi
inc edi
add rbx, 0x30
cmp edi, 0x1f
jb 0x140001740
test esi, esi
jne 0x14000177c
lea rcx, str.___All_APIs_present_and_accounted_for._n
call fcn.14000b030
call fcn.140014c60
test eax, eax
je 0x140001791
lea rcx, str.Process_is_running_under_WOW64_n_n
call fcn.14000b0a0
cmp dword [0x140040094], 0
je 0x14000189f
lea rcx, [rbp + 0x530]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [rbp + 0x534]
lea r8, [rbp + 0x198]
xorps xmm0, xmm0
lea rdx, [fcn.14000ba80]
mov ecx, 4
movups xmmword [rbp + 0x480], xmm0
movups xmmword [rbp + 0x490], xmm0
movups xmmword [rbp + 0x4a0], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x14000189f
mov rbx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetElement
lea r8, [rbp + 0x1a0]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x14000189f
xor eax, eax
mov edi, eax
cmp dword [rbp + 0x1a8], eax
jbe 0x14000189f
mov rbx, qword [rbp + 0x1a0]
nop dword [rax + rax]
mov r8d, 0x30
lea rdx, [rbp + 0x480]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
jb 0x14000188e
mov eax, dword [rbp + 0x4a4]
test al, 0x10
jne 0x140001862
test al, 0x20
jne 0x140001862
test al, al
js 0x140001862
test al, 0x40
je 0x14000188e
mov rdx, qword [0x1400400b8]
cmp rdx, qword [0x1400400c0]
mov qword [rsp + 0x48], rbx
je 0x140001884
mov qword [rdx], rbx
add qword [0x1400400b8], 8
jmp 0x14000188e
lea r8, [rsp + 0x48]
call fcn.14000bc70
mov eax, dword [rbp + 0x1a8]
add rdi, rsi
add rbx, rsi
cmp rdi, rax
jb 0x140001830
cmp dword [0x140040098], 0
mov r15d, 0x44
mov qword [rsp + 0x48], r15
mov r14d, 0x3e8
mov r12d, 0xdeadbeef
je 0x140001be6
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x2c8]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x2c8]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x2d0]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.TLS_Callbacks
lea rcx, str._n___________________________s___________________________n
call fcn.14000b0a0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.TLS_process_attach_callback
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x43
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140001940
mov rax, qword [0x1400400d0]
xor esi, esi
mov ebx, esi
test rax, rax
jne 0x140001999
inc ebx
cmp ebx, r14d
je 0x140001980
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov rax, qword [0x1400400d0]
test rax, rax
je 0x140001962
cmp ebx, r14d
jl 0x140001999
lea rcx, str.TLSCallbackProcess_timeout_on_event_creation.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, 1
mov ebx, edi
jmp 0x140001a20
mov rcx, qword [0x1400400d0]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400019ee
cmp eax, 0xffffffff
jne 0x1400019ca
lea rcx, str.TLSCallbackProcess_wait_failed.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, 1
mov ebx, edi
jmp 0x140001a20
lea rcx, str.TLSCallbackProcess_wait_abandoned.
cmp eax, 0x80
je 0x140001987
lea rcx, str.TLSCallbackProcess_timeout_on_event_wait.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, 1
mov ebx, edi
jmp 0x140001a20
mov eax, dword [0x1400400d8]
lea rcx, str.TLSCallbackProcess_data_did_not_match.
cmp eax, r12d
jne 0x140001a07
lea rcx, str.All_seems_fine_for_TLSCallbackProcess.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x1400400d8]
mov ebx, esi
cmp eax, r12d
mov edi, 1
setne bl
xor edx, edx
mov word [rbp + 0x128d0], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x128d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.TLS_process_attach_callback
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x128d0]
call fcn.14000b460
lea rdx, str.TLS_process_attach_callback
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140001a7d
lea rcx, [rbp + 0x128d0]
call fcn.140014310
lea rdx, str.TLS_thread_attach_callback
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, r15
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140001a93
mov qword [rsp + 0x28], rsi
lea r8, [0x140010050]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x140001ad4
lea rcx, str.TLS_callback:_couldnt_start_dummy_thread
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, qword [0x1400400c8]
mov ebx, esi
test rax, rax
jne 0x140001b11
inc ebx
cmp ebx, r14d
je 0x140001b00
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov rax, qword [0x1400400c8]
test rax, rax
je 0x140001ae2
cmp ebx, r14d
jl 0x140001b11
lea rcx, str.TLSCallbackThread_timeout_on_event_creation.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, edi
jmp 0x140001b89
mov rcx, qword [0x1400400c8]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140001b5c
cmp eax, 0xffffffff
jne 0x140001b3d
lea rcx, str.TLSCallbackThread_wait_failed.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, edi
jmp 0x140001b89
lea rcx, str.TLSCallbackThread_wait_abandoned.
cmp eax, 0x80
je 0x140001b52
lea rcx, str.TLSCallbackThread_timeout_on_event_wait.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, edi
jmp 0x140001b89
mov eax, dword [0x1400400ac]
lea rcx, str.TLSCallbackThread_data_did_not_match.
cmp eax, r12d
jne 0x140001b75
lea rcx, str.All_seems_fine_for_TLSCallbackThread.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x1400400ac]
mov ebx, esi
cmp eax, r12d
setne bl
xor edx, edx
mov word [rbp + 0x12ad0], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x12ad2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.TLS_thread_attach_callback
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x12ad0]
call fcn.14000b460
lea rdx, str.TLS_thread_attach_callback
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140001be6
lea rcx, [rbp + 0x12ad0]
call fcn.140014310
cmp dword [0x140040094], 0
mov r13d, 0x40
mov r12d, 0x37
mov qword [rbp + 0xb0], 7
mov r15d, 0x25
mov qword [rbp + 0x98], 0x24
mov r14d, 0x38
mov qword [rbp + 0xa8], 0x42
mov qword [rbp + 0x90], 0x3d
mov qword [rbp + 0xa0], 0x41
mov qword [rbp + 0x78], 0x2d
je 0x140004208
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x2e0]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x2e0]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x2e8]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Debugger_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.14000b0a0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Checking_IsDebuggerPresent_API
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, r13d
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140001cc2
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor esi, esi
lea rcx, [rbp + 0x13932]
xor edx, edx
mov word [rbp + 0x13930], si
mov r8d, 0x1fe
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_IsDebuggerPresent_API
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x13930]
call fcn.14000b460
lea rdx, str.Checking_IsDebuggerPresent_API
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140001d3b
lea rcx, [rbp + 0x13930]
call fcn.140014310
lea rdx, str.Checking_PEB.BeingDebugged
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x44
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140001d53
mov rax, qword gs:[0x60]
lea rcx, [rbp + 0x38d2]
mov ebx, esi
mov r8d, 0x1fe
movzx edi, byte [rax + 2]
cmp dil, 1
mov word [rbp + 0x38d0], si
sete bl
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_PEB.BeingDebugged
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x38d0]
call fcn.14000b460
lea rdx, str.Checking_PEB.BeingDebugged
mov ecx, ebx
call fcn.140014610
cmp dil, 1
jne 0x140001dd9
lea rcx, [rbp + 0x38d0]
call fcn.140014310
lea rdx, str.Checking_CheckRemoteDebuggerPresent_API
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, r12
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140001df0
mov dword [rbp + 0x1f4], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x1f4]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov ebx, dword [rbp + 0x1f4]
lea rcx, [rbp + 0x3ad2]
xor edx, edx
mov word [rbp + 0x3ad0], si
mov r8d, 0x1fe
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_CheckRemoteDebuggerPresent_API
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x3ad0]
call fcn.14000b460
lea rdx, str.Checking_CheckRemoteDebuggerPresent_API
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140001e81
lea rcx, [rbp + 0x3ad0]
call fcn.140014310
lea rdx, str.Checking_PEB.NtGlobalFlag
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x45
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140001ea0
mov rax, qword gs:[0x60]
add rax, 0xbc
je 0x140001ed1
test byte [rax], 0x70
je 0x140001ed1
mov esi, 1
mov ebx, esi
jmp 0x140001ed8
mov ebx, esi
mov esi, 1
xor eax, eax
lea rcx, [rbp + 0x3cd2]
xor edx, edx
mov word [rbp + 0x3cd0], ax
mov r8d, 0x1fe
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_PEB.NtGlobalFlag
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x3cd0]
call fcn.14000b460
lea rdx, str.Checking_PEB.NtGlobalFlag
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140001f37
lea rcx, [rbp + 0x3cd0]
call fcn.140014310
lea rdx, str.Checking_ProcessHeap.Flags
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x44
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140001f50
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.14000b990
mov rdi, qword gs:[0x60]
mov rdi, qword [rdi + 0x30]
test al, al
je 0x140001f88
add rdi, 0x70
jmp 0x140001f8c
add rdi, 0x14
mov edi, dword [rdi]
lea rcx, [rbp + 0x3ed2]
xor eax, eax
mov r8d, 0x1fe
mov ebx, eax
mov word [rbp + 0x3ed0], ax
cmp edi, 2
seta bl
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_ProcessHeap.Flags
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x3ed0]
call fcn.14000b460
lea rdx, str.Checking_ProcessHeap.Flags
mov ecx, ebx
call fcn.140014610
cmp edi, 2
jbe 0x140001ff5
lea rcx, [rbp + 0x3ed0]
call fcn.140014310
lea rdx, str.Checking_ProcessHeap.ForceFlags
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x3f
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140002010
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.14000b990
mov rdi, qword gs:[0x60]
mov rdi, qword [rdi + 0x30]
test al, al
je 0x140002048
add rdi, 0x74
jmp 0x14000204c
add rdi, 0x18
mov edi, dword [rdi]
lea rcx, [rbp + 0x40d2]
xor eax, eax
mov r8d, 0x1fe
mov ebx, eax
mov word [rbp + 0x40d0], ax
test edi, edi
setne bl
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_ProcessHeap.ForceFlags
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x40d0]
call fcn.14000b460
lea rdx, str.Checking_ProcessHeap.ForceFlags
mov ecx, ebx
call fcn.140014610
test edi, edi
je 0x1400020b3
lea rcx, [rbp + 0x40d0]
call fcn.140014310
lea rdx, str.Checking_Low_Fragmentation_Heap
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, r13
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400020d0
xor eax, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea rcx, [rbp + 0x68c]
mov r8d, 0x110
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov r8b, 1
mov dword [rbp + 0x680], 0x11c
mov edx, 2
mov qword [rbp + 0x684], 6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 1
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 3
lea rcx, [rbp + 0x680]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x1400021b4
xor edx, edx
lea rcx, [rbp + 0x7ac]
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memset
mov r8b, 1
mov dword [rbp + 0x7a0], 0x11c
mov edx, 2
mov dword [rbp + 0x7a4], 6
xor ecx, ecx
mov dword [rbp + 0x7a8], esi
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 1
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 3
lea rcx, [rbp + 0x7a0]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x1400021bb
lea rbx, [rdi + 0x178]
xor edx, edx
lea rcx, [rbp + 0x8cc]
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memset
mov r8b, 1
mov dword [rbp + 0x8c0], 0x11c
mov edx, 2
mov dword [rbp + 0x8c4], 6
xor ecx, ecx
mov dword [rbp + 0x8c8], 2
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 3
lea rcx, [rbp + 0x8c0]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x14000222b
lea rbx, [rdi + 0x170]
test rbx, rbx
je 0x14000223c
cmp qword [rbx], 0
jne 0x14000223c
mov ebx, esi
xor edi, edi
jmp 0x140002240
xor edi, edi
mov ebx, edi
xor edx, edx
mov word [rbp + 0x42d0], di
mov r8d, 0x1fe
lea rcx, [rbp + 0x42d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Low_Fragmentation_Heap
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x42d0]
call fcn.14000b460
lea rdx, str.Checking_Low_Fragmentation_Heap
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x14000229d
lea rcx, [rbp + 0x42d0]
call fcn.140014310
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugPort
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x26
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400022c0
lea rdx, [0x14003f1f0]
mov eax, edi
mov rcx, rdx
nop
cmp dword [rcx], 0x10
je 0x140002500
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x1400022e0
mov rbx, rdi
mov qword [rbp + 0x248], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
mov qword [rsp + 0x20], rdi
mov rcx, rax
lea r8, [rbp + 0x248]
mov edx, 7
call rbx
test eax, eax
jne 0x140002330
cmp qword [rbp + 0x248], 0
mov ebx, esi
jne 0x140002332
mov ebx, edi
xor edx, edx
mov word [rbp + 0x44d0], di
mov r8d, 0x1fe
lea rcx, [rbp + 0x44d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_NtQueryInformationProcess_with_ProcessDebugPort
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x44d0]
call fcn.14000b460
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugPort
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x14000238f
lea rcx, [rbp + 0x44d0]
call fcn.140014310
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugFlags
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, r15
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400023b0
lea rdx, [0x14003f1f0]
mov eax, edi
mov rcx, rdx
nop
cmp dword [rcx], 0x10
je 0x14000251e
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x1400023d0
mov rbx, rdi
mov dword [rbp + 0x1f8], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
mov qword [rsp + 0x20], rdi
mov rcx, rax
lea r8, [rbp + 0x1f8]
mov edx, 0x1f
call rbx
test eax, eax
jne 0x14000241d
mov ebx, esi
cmp dword [rbp + 0x1f8], eax
je 0x14000241f
mov ebx, edi
xor edx, edx
mov word [rbp + 0x46d0], di
mov r8d, 0x1fe
lea rcx, [rbp + 0x46d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_NtQueryInformationProcess_with_ProcessDebugFlags
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x46d0]
call fcn.14000b460
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugFlags
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x14000247c
lea rcx, [rbp + 0x46d0]
call fcn.140014310
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugObject
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x24
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140002494
lea rdx, [0x14003f1f0]
mov eax, edi
mov rcx, rdx
cmp dword [rcx], 0x10
je 0x14000253c
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x1400024b2
mov rbx, rdi
mov qword [rbp + 0x110], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
mov qword [rsp + 0x20], rdi
mov rcx, rax
lea r8, [rbp + 0x110]
mov edx, 0x1e
call rbx
cmp eax, 0xc0000353
je 0x14000255a
mov ebx, esi
jmp 0x1400025b4
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
je 0x1400022f4
mov rbx, qword [rdx + rcx*8 + 0x28]
jmp 0x1400022f7
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
je 0x1400023e4
mov rbx, qword [rdx + rcx*8 + 0x28]
jmp 0x1400023e7
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
je 0x1400024c6
mov rbx, qword [rdx + rcx*8 + 0x28]
jmp 0x1400024c9
cmp qword [rbp + 0x110], 0
je 0x140002568
mov ebx, esi
jmp 0x1400025b4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
lea r8, [rbp + 0x110]
mov rcx, rax
mov edx, 0x1e
lea rax, [rbp + 0x110]
mov qword [rsp + 0x20], rax
call rbx
cmp eax, 0xc0000353
je 0x14000259c
mov ebx, esi
jmp 0x1400025b4
mov rax, qword [rbp + 0x110]
test rax, rax
jne 0x1400025ac
mov ebx, esi
jmp 0x1400025b4
cmp eax, 8
mov ebx, edi
setne bl
xor edx, edx
mov word [rbp + 0x48d0], di
mov r8d, 0x1fe
lea rcx, [rbp + 0x48d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_NtQueryInformationProcess_with_ProcessDebugObject
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x48d0]
call fcn.14000b460
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugObject
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140002611
lea rcx, [rbp + 0x48d0]
call fcn.140014310
lea rdx, str.Checking_WudfIsAnyDebuggerPresent_API
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x39
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140002630
lea rdx, [0x14003f1f0]
mov eax, edi
mov rcx, rdx
nop
cmp dword [rcx], 0x1c
je 0x140003160
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002650
mov ebx, edi
xor edx, edx
mov word [rbp + 0x4ad0], di
mov r8d, 0x1fe
lea rcx, [rbp + 0x4ad2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_WudfIsAnyDebuggerPresent_API
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x4ad0]
call fcn.14000b460
lea rdx, str.Checking_WudfIsAnyDebuggerPresent_API
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x1400026c3
lea rcx, [rbp + 0x4ad0]
call fcn.140014310
lea rdx, str.Checking_WudfIsKernelDebuggerPresent_API
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x36
nop dword [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400026e0
lea rdx, [0x14003f1f0]
mov eax, edi
mov rcx, rdx
nop
cmp dword [rcx], 0x1d
je 0x1400031c4
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002700
mov ebx, edi
xor edx, edx
mov word [rbp + 0x4cd0], di
mov r8d, 0x1fe
lea rcx, [rbp + 0x4cd2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_WudfIsKernelDebuggerPresent_API
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x4cd0]
call fcn.14000b460
lea rdx, str.Checking_WudfIsKernelDebuggerPresent_API
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140002773
lea rcx, [rbp + 0x4cd0]
call fcn.140014310
lea rdx, str.Checking_WudfIsUserDebuggerPresent_API
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, r14
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140002790
lea rdx, [0x14003f1f0]
mov eax, edi
mov rcx, rdx
nop
cmp dword [rcx], 0x1e
je 0x140003224
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x1400027b0
mov ebx, edi
xor edx, edx
mov word [rbp + 0x4ed0], di
mov r8d, 0x1fe
lea rcx, [rbp + 0x4ed2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_WudfIsUserDebuggerPresent_API
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x4ed0]
call fcn.14000b460
lea rdx, str.Checking_WudfIsUserDebuggerPresent_API
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140002823
lea rcx, [rbp + 0x4ed0]
call fcn.140014310
lea rdx, str.Checking_NtSetInformationThread_with_ThreadHideFromDebugger
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x23
nop dword [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140002840
call fcn.14000b760
xor edx, edx
mov word [rbp + 0x50d0], di
mov r8d, 0x1fe
lea rcx, [rbp + 0x50d2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_NtSetInformationThread_with_ThreadHideFromDebugger
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x50d0]
call fcn.14000b460
lea rdx, str.Checking_NtSetInformationThread_with_ThreadHideFromDebugger
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x1400028b6
lea rcx, [rbp + 0x50d0]
call fcn.140014310
lea rdx, str.Checking_CloseHandle_with_an_invalide_handle
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x32
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400028d0
call fcn.14000b520
xor edx, edx
mov word [rbp + 0x52d0], di
mov r8d, 0x1fe
lea rcx, [rbp + 0x52d2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_CloseHandle_with_an_invalide_handle
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x52d0]
call fcn.14000b460
lea rdx, str.Checking_CloseHandle_with_an_invalide_handle
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140002946
lea rcx, [rbp + 0x52d0]
call fcn.140014310
lea rdx, str.Checking_NtSystemDebugControl
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x42
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140002960
lea rdx, [0x14003f1f0]
mov eax, edi
mov rcx, rdx
nop
cmp dword [rcx], 0xb
je 0x140003284
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140002980
mov rax, rdi
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
call rax
mov edi, eax
lea rcx, [rbp + 0x54d2]
xor eax, eax
mov r8d, 0x1fe
mov ebx, eax
mov word [rbp + 0x54d0], ax
cmp edi, 0xc0000354
setne bl
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_NtSystemDebugControl
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x54d0]
call fcn.14000b460
lea rdx, str.Checking_NtSystemDebugControl
mov ecx, ebx
call fcn.140014610
cmp edi, 0xc0000354
je 0x140002a1e
lea rcx, [rbp + 0x54d0]
call fcn.140014310
lea rdx, str.Checking_UnhandledExcepFilterTest
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x3d
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140002a40
lea rcx, [0x140010090]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc000008e
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_RaiseException]
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
je 0x140002664
mov eax, edi
mov rcx, rdx
nop dword [rax]
cmp dword [rcx], 0x1c
je 0x1400031a1
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140003180
mov rax, rdi
call rax
test eax, eax
mov ebx, edi
setne bl
jmp 0x140002666
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
je 0x140003190
mov rax, qword [rdx + rcx*8 + 0x28]
call rax
test eax, eax
mov ebx, edi
setne bl
jmp 0x140002666
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
je 0x140002714
mov eax, edi
mov rcx, rdx
nop dword [rax]
cmp dword [rcx], 0x1d
je 0x140003201
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x1400031e0
mov rax, rdi
call rax
test eax, eax
mov ebx, edi
setne bl
jmp 0x140002716
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
je 0x1400031f0
mov rax, qword [rdx + rcx*8 + 0x28]
call rax
test eax, eax
mov ebx, edi
setne bl
jmp 0x140002716
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
je 0x1400027c4
mov eax, edi
mov rcx, rdx
nop dword [rax]
cmp dword [rcx], 0x1e
je 0x140003261
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140003240
mov rax, rdi
call rax
test eax, eax
mov ebx, edi
setne bl
jmp 0x1400027c6
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
je 0x140003250
mov rax, qword [rdx + rcx*8 + 0x28]
call rax
test eax, eax
mov ebx, edi
setne bl
jmp 0x1400027c6
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
je 0x140002994
mov rax, qword [rdx + rcx*8 + 0x28]
jmp 0x140002997
cmp dword [0x140040090], 0
mov r14d, 0x28
mov qword [rbp + 0x70], 0x2b
mov r12d, 0x2e
mov qword [rbp + 0x88], 0x3a
mov r13d, 0x35
je 0x1400049c6
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x2f8]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x2f8]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x300]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.DLL_Injection_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.14000b0a0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__32_bit_
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, r14d
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400042b2
mov ecx, 1
call fcn.14000e6d0
xor edi, edi
lea rcx, [rbp + 0x84d2]
xor edx, edx
mov word [rbp + 0x84d0], di
mov r8d, 0x1fe
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Enumerating_modules_with_EnumProcessModulesEx__32_bit_
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x84d0]
call fcn.14000b460
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__32_bit_
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x14000432f
lea rcx, [rbp + 0x84d0]
call fcn.140014310
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__64_bit_
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, r14
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140004350
mov ecx, 2
call fcn.14000e6d0
xor edx, edx
mov word [rbp + 0x86d0], di
mov r8d, 0x1fe
lea rcx, [rbp + 0x86d2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Enumerating_modules_with_EnumProcessModulesEx__64_bit_
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x86d0]
call fcn.14000b460
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__64_bit_
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x1400043cb
lea rcx, [rbp + 0x86d0]
call fcn.140014310
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__ALL_
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x2b
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400043e3
mov ecx, 3
call fcn.14000e6d0
xor edx, edx
mov word [rbp + 0x88d0], di
mov r8d, 0x1fe
lea rcx, [rbp + 0x88d2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Enumerating_modules_with_EnumProcessModulesEx__ALL_
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x88d0]
call fcn.14000b460
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__ALL_
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x14000445e
lea rcx, [rbp + 0x88d0]
call fcn.140014310
lea rdx, str.Enumerating_modules_with_ToolHelp32
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x3b
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140004480
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400044c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_snapshot._Last_error:__u_n
call fcn.14000b030
jmp 0x140004561
xor edx, edx
lea rcx, [rbp + 0x9e4]
mov r8d, 0x434
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x9e0]
mov dword [rbp + 0x9e0], 0x438
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140004544
nop dword [rax]
mov edx, 0xffffffff
lea rcx, [rbp + 0xc10]
call fcn.14000e330
movzx ebx, al
test al, al
je 0x14000452b
lea rdx, [rbp + 0xc10]
lea rcx, str._____Injected_library:__S_n
call fcn.14000b030
lea rdx, [rbp + 0x9e0]
mov rcx, rsi
or dil, bl
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140004500
jmp 0x140004558
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_first_module._Last_error:__u_n
call fcn.14000b030
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
lea rcx, [rbp + 0x8ad2]
test dil, dil
mov word [rbp + 0x8ad0], si
mov ebx, esi
mov r8d, 0x1fe
setne bl
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r9, str.Enumerating_modules_with_ToolHelp32
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x8ad0]
call fcn.14000b460
lea rdx, str.Enumerating_modules_with_ToolHelp32
mov ecx, ebx
call fcn.140014610
test dil, dil
je 0x1400045c8
lea rcx, [rbp + 0x8ad0]
call fcn.140014310
lea rdx, str.Enumerating_the_process_LDR_via_LdrEnumerateLoadedModules
lea rcx, str.____s
call fcn.14000b0a0
nop dword [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub r15, 1
jne 0x1400045e0
lea rdx, [0x14003f1f0]
mov eax, esi
mov rcx, rdx
nop
cmp dword [rcx], 9
je 0x140004617
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140004600
mov ebx, esi
jmp 0x140004725
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], sil
jne 0x14000462e
mov ebx, esi
jmp 0x140004725
mov ecx, esi
mov rax, rdx
cmp dword [rax], 9
je 0x14000468d
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140004633
mov rbx, rsi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400177d8
mov r8, rax
lea rdx, [0x14000f860]
xor ecx, ecx
mov rdi, rax
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
call rbx
test eax, eax
je 0x1400046a5
mov edx, eax
lea rcx, str.LdrEnumerateLoadedModules_failed._Status:__x_n
call fcn.14000b030
mov rcx, rdi
call fcn.14000f940
mov ebx, esi
jmp 0x140004725
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], sil
je 0x140004643
mov rbx, qword [rdx + rcx*8 + 0x28]
jmp 0x140004646
mov r14, qword [rdi + 8]
mov rbx, qword [rdi]
cmp rbx, r14
je 0x140004711
movups xmm0, xmmword [rbx]
mov rcx, qword [rbx + 0x50]
movups xmm1, xmmword [rbx + 0x10]
movups xmm2, xmmword [rbx + 0x40]
movaps xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rbx + 0x20]
movaps xmmword [rsp + 0x60], xmm1
movups xmm1, xmmword [rbx + 0x30]
movaps xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [rbx + 0x60]
movaps xmmword [rbp - 0x80], xmm1
movups xmm1, xmmword [rbx + 0x70]
movaps xmmword [rbp - 0x50], xmm0
movsd xmm0, qword [rbx + 0x80]
pextrw edx, xmm2, 4
movsd qword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm1
call fcn.14000e330
or sil, al
add rbx, 0x88
cmp rbx, r14
jne 0x1400046b1
mov rcx, rdi
call fcn.14000f940
xor eax, eax
test sil, sil
mov ebx, eax
setne bl
xor esi, esi
xor edx, edx
mov word [rbp + 0x8cd0], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x8cd2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Enumerating_the_process_LDR_via_LdrEnumerateLoadedModules
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x8cd0]
call fcn.14000b460
lea rdx, str.Enumerating_the_process_LDR_via_LdrEnumerateLoadedModules
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140004782
lea rcx, [rbp + 0x8cd0]
call fcn.140014310
lea rdx, str.Enumerating_the_process_LDR_directly
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x3a
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400047a0
call fcn.14000f110
xor edx, edx
mov word [rbp + 0x8ed0], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x8ed2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Enumerating_the_process_LDR_directly
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x8ed0]
call fcn.14000b460
lea rdx, str.Enumerating_the_process_LDR_directly
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140004816
lea rcx, [rbp + 0x8ed0]
call fcn.140014310
lea rdx, str.Walking_process_memory_with_GetModuleInformation
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, r12
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140004830
call fcn.14000e950
xor edx, edx
mov word [rbp + 0x90d0], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x90d2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Walking_process_memory_with_GetModuleInformation
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x90d0]
call fcn.14000b460
lea rdx, str.Walking_process_memory_with_GetModuleInformation
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x1400048a6
lea rcx, [rbp + 0x90d0]
call fcn.140014310
lea rdx, str.Walking_process_memory_for_hidden_modules
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, r13
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400048c0
call fcn.14000ebe0
xor edx, edx
mov word [rbp + 0x92d0], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x92d2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Walking_process_memory_for_hidden_modules
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x92d0]
call fcn.14000b460
lea rdx, str.Walking_process_memory_for_hidden_modules
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140004936
lea rcx, [rbp + 0x92d0]
call fcn.140014310
lea rdx, str.Walking_process_memory_for_.NET_module_structures
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x2d
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140004950
call fcn.14000eec0
xor edx, edx
mov word [rbp + 0x94d0], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x94d2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Walking_process_memory_for_.NET_module_structures
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x94d0]
call fcn.14000b460
lea rdx, str.Walking_process_memory_for_.NET_module_structures
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x1400049c6
lea rcx, [rbp + 0x94d0]
call fcn.140014310
cmp dword [0x14004008c], 0
mov qword [rbp + 0x80], 0x2c
je 0x1400072a9
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x310]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x310]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x318]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Generic_Sandboxe_VM_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.14000b0a0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.avghookx.dll
mov esi, 0xc
mov qword [rsp + 0x50], rax
lea rdi, [rsp + 0x50]
lea rax, str.avghooka.dll
mov r12d, 1
mov qword [rsp + 0x58], rax
xor r14d, r14d
lea rax, str.snxhk.dll
mov qword [rsp + 0x60], rax
lea rax, str.sbiedll.dll
mov qword [rsp + 0x68], rax
lea rax, str.dbghelp.dll
mov qword [rsp + 0x70], rax
lea rax, str.api_log.dll
mov qword [rsp + 0x78], rax
lea rax, str.dir_watch.dll
mov qword [rbp - 0x80], rax
lea rax, str.pstorec.dll
mov qword [rbp - 0x78], rax
lea rax, str.vmcheck.dll
mov qword [rbp - 0x70], rax
lea rax, str.wpespy.dll
mov qword [rbp - 0x68], rax
lea rax, str.cmdvrt64.dll
mov qword [rbp - 0x60], rax
lea rax, str.cmdvrt32.dll
mov qword [rbp - 0x58], rax
nop dword [rax]
xor edx, edx
mov word [rbp + 0xeb0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0xeb2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_if_process_loaded_modules_contains:__s
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xeb0]
call fcn.14000b460
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rbp + 0xeb0]
lea rcx, str.____s
test rax, rax
jne 0x140004b76
call fcn.14000b0a0
lea rcx, [rbp + 0xeb0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140004b46
mov ebx, 0x5f
sub rbx, rax
je 0x140004b71
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, r12
jne 0x140004b60
mov ecx, r14d
jmp 0x140004bb8
call fcn.14000b0a0
lea rcx, [rbp + 0xeb0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140004b90
mov ebx, 0x5f
sub rbx, rax
je 0x140004bb5
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, r12
jne 0x140004ba4
mov ecx, r12d
lea rdx, [rbp + 0xeb0]
call fcn.140014610
add rdi, 8
sub rsi, r12
jne 0x140004ae0
call fcn.140010330
lea rax, str.CurrentUser
mov qword [rsp + 0x50], rax
lea rax, str.Sandbox
mov qword [rsp + 0x58], rax
lea rax, str.Emily
mov qword [rsp + 0x60], rax
lea rax, str.HAPUBWS
mov qword [rsp + 0x68], rax
lea rax, str.Hong_Lee
mov qword [rsp + 0x70], rax
lea rax, str.IT_ADMIN
mov qword [rsp + 0x78], rax
lea rax, str.Johnson
mov qword [rbp - 0x80], rax
lea rax, str.Miller
mov qword [rbp - 0x78], rax
lea rax, str.milozs
mov qword [rbp - 0x70], rax
lea rax, str.Peter_Wilson
mov qword [rbp - 0x68], rax
lea rax, str.timmy
mov qword [rbp - 0x60], rax
lea rax, str.user
mov qword [rbp - 0x58], rax
lea rax, str.sand_box
mov qword [rbp - 0x50], rax
lea rax, str.malware
mov qword [rbp - 0x48], rax
lea rax, str.maltest
mov qword [rbp - 0x40], rax
lea rax, str.test_user
mov qword [rbp - 0x38], rax
lea rax, str.virus
mov qword [rbp - 0x30], rax
lea rax, str.John_Doe
mov qword [rbp - 0x28], rax
call fcn.140010720
mov r15, rax
mov r12d, 0x2e
test rax, rax
je 0x140004d7d
lea rdi, [rsp + 0x50]
mov r14d, SafeArrayLock
xor r13d, r13d
nop word [rax + rax]
mov r9, qword [rdi]
lea r8, str.Checking_if_username_matches_:__s
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x96d0]
call fcn.14000b460
mov rcx, qword [rdi]
mov rdx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov esi, r13d
lea rdx, [rbp + 0x96d0]
test eax, eax
lea rcx, str.____s
sete sil
call fcn.14000b0a0
lea rcx, [rbp + 0x96d0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140004d21
mov ebx, 0x5f
sub rbx, rax
je 0x140004d52
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140004d40
lea rdx, [rbp + 0x96d0]
mov ecx, esi
call fcn.140014610
add rdi, 8
sub r14, 1
jne 0x140004cd0
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r13d, 0x35
lea rax, str.SANDBOX
mov qword [rsp + 0x50], rax
lea rax, str.7SILVIA
mov qword [rsp + 0x58], rax
lea rax, str.HANSPETER_PC
mov qword [rsp + 0x60], rax
lea rax, str.JOHN_PC
mov qword [rsp + 0x68], rax
lea rax, str.MUELLER_PC
mov qword [rsp + 0x70], rax
lea rax, str.WIN7_TRAPS
mov qword [rsp + 0x78], rax
lea rax, str.FORTINET
mov qword [rbp - 0x80], rax
lea rax, str.TEQUILABOOMBOOM
mov qword [rbp - 0x78], rax
call fcn.1400107a0
mov r15, rax
test rax, rax
je 0x140004eee
call fcn.140010820
mov r12, rax
test rax, rax
jne 0x140004e07
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140004ee8
lea rsi, [rsp + 0x50]
mov r14d, 8
mov r13d, 1
nop dword [rax + rax]
mov rbx, qword [rsi]
lea r8, str.Checking_if_hostname_matches_:__s
mov r9, rbx
lea rcx, [rbp + 0x98d0]
mov edx, pe_nt_image_headers64
call fcn.14000b460
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140004e53
mov edi, r13d
jmp 0x140004e69
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor ecx, ecx
test eax, eax
mov edi, ecx
cmove edi, r13d
lea rdx, [rbp + 0x98d0]
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [rbp + 0x98d0]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140004e90
mov ebx, 0x5f
sub rbx, rax
je 0x140004eb5
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, r13
jne 0x140004ea4
lea rdx, [rbp + 0x98d0]
mov ecx, edi
call fcn.140014610
add rsi, 8
sub r14, r13
jne 0x140004e20
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r13d, 0x35
mov r12d, 0x2e
call fcn.1400108d0
lea rdx, str.Checking_Number_of_processors_in_machine
lea rcx, str.____s
call fcn.14000b0a0
mov r14d, 0x36
mov ebx, r14d
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140004f10
mov rax, qword gs:[0x60]
lea rcx, [rbp + 0x9ad2]
xor r15d, r15d
mov r8d, 0x1fe
mov ebx, r15d
mov edi, dword [rax + 0xb8]
cmp edi, 2
mov word [rbp + 0x9ad0], r15w
setb bl
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Number_of_processors_in_machine
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x9ad0]
call fcn.14000b460
lea rdx, str.Checking_Number_of_processors_in_machine
mov ecx, ebx
call fcn.140014610
cmp edi, 2
jae 0x140004f9b
lea rcx, [rbp + 0x9ad0]
call fcn.140014310
lea rdx, str.Checking_Interupt_Descriptor_Table_location
lea rcx, str.____s
call fcn.14000b0a0
mov esi, 0x33
mov ebx, esi
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140004fc0
mov edi, dword [rbp + 0x1fc]
lea rcx, [rbp + 0x9cd2]
shr edi, 0x18
mov ebx, r15d
cmp edi, 0xff
mov word [rbp + 0x9cd0], r15w
mov r8d, 0x1fe
sete bl
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Interupt_Descriptor_Table_location
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x9cd0]
call fcn.14000b460
lea rdx, str.Checking_Interupt_Descriptor_Table_location
mov ecx, ebx
call fcn.140014610
cmp edi, 0xff
jne 0x140005048
lea rcx, [rbp + 0x9cd0]
call fcn.140014310
lea rdx, str.Checking_Local_Descriptor_Table_location
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, r14
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140005060
xor r14d, r14d
lea rcx, [rbp + 0x9ed2]
xor edx, edx
mov word [rbp + 0x9ed0], r14w
mov r8d, 0x1fe
call sub.VCRUNTIME140.dll_memset
mov r15d, 1
lea r9, str.Checking_Local_Descriptor_Table_location
lea r8, str.____s_____d
mov dword [rsp + 0x20], r15d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x9ed0]
call fcn.14000b460
lea rdx, str.Checking_Local_Descriptor_Table_location
mov ecx, r15d
call fcn.140014610
lea rcx, [rbp + 0x9ed0]
call fcn.140014310
lea rdx, str.Checking_Global_Descriptor_Table_location
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, r13
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, r15
jne 0x1400050f0
mov edi, dword [rbp + 0x1fc]
lea rcx, [rbp + 0xa0d2]
shr edi, 0x18
mov ebx, r14d
cmp edi, 0xff
mov word [rbp + 0xa0d0], r14w
mov r8d, 0x1fe
sete bl
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Global_Descriptor_Table_location
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xa0d0]
call fcn.14000b460
lea rdx, str.Checking_Global_Descriptor_Table_location
mov ecx, ebx
call fcn.140014610
cmp edi, 0xff
jne 0x140005177
lea rcx, [rbp + 0xa0d0]
call fcn.140014310
lea rdx, str.Checking_Store_Task_Register
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x42
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, r15
jne 0x140005190
xor edx, edx
mov word [rbp + 0x14580], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x14582]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Store_Task_Register
mov dword [rsp + 0x20], r14d
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x14580]
call fcn.14000b460
lea rdx, str.Checking_Store_Task_Register
xor ecx, ecx
call fcn.140014610
lea rdx, str.Checking_Number_of_cores_in_machine_using_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x31
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, r15
jne 0x140005210
lea r8, [0x14001e8b0]
mov qword [rbp + 0x138], r14
lea rdx, [rbp + 0x148]
mov qword [rbp + 0x148], r14
lea rcx, [rbp + 0x138]
mov qword [rbp + 0x118], r14
mov edi, r14d
call fcn.140016e60
test eax, eax
je 0x140005410
lea rcx, [0x1400224d8]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_Processor
mov r14, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
test r14, r14
je 0x1400052f4
test rax, rax
je 0x1400052eb
mov rcx, qword [rbp + 0x138]
lea rax, [rbp + 0x118]
mov qword [rsp + 0x28], rax
xor r13d, r13d
mov r9d, 0x30
mov qword [rsp + 0x20], r13
mov r8, rsi
mov rdx, qword [rcx]
mov rbx, qword [rdx + 0xa0]
mov rdx, r14
call rbx
test eax, eax
jns 0x1400052eb
lea rcx, str.ExecQuery
mov r15d, r13d
call fcn.140014740
mov rcx, qword [rbp + 0x138]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x148]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rsi, rsi
je 0x140005302
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor r14d, r14d
test r15d, r15d
mov r15d, 1
je 0x14000540b
mov rcx, qword [rbp + 0x118]
mov qword [rbp + 0x150], r14
mov dword [rbp + 0x200], r14d
test rcx, rcx
je 0x1400053e5
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x200]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x150]
mov edx, 0xffffffff
mov r8d, r15d
call qword [rax + 0x20]
cmp dword [rbp + 0x200], r14d
je 0x1400053de
mov rcx, qword [rbp + 0x150]
lea r9, [rbp + 0x298]
mov qword [rsp + 0x28], r14
lea rdx, str.NumberOfCores
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call rax
test eax, eax
js 0x1400053bb
cmp word [rbp + 0x298], r15w
je 0x1400053bb
cmp dword [rbp + 0x2a0], 2
lea rcx, [rbp + 0x298]
cmovb edi, r15d
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x150]
mov rax, qword [rcx]
call qword [rax + 0x10]
test edi, edi
jne 0x1400053de
mov rcx, qword [rbp + 0x118]
test rcx, rcx
jne 0x140005340
jmp 0x1400053e5
mov rcx, qword [rbp + 0x118]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x138]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x148]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov esi, 0x33
xor edx, edx
mov word [rbp + 0xa2d0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0xa2d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Number_of_cores_in_machine_using_WMI
mov dword [rsp + 0x20], edi
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xa2d0]
call fcn.14000b460
lea rdx, str.Checking_Number_of_cores_in_machine_using_WMI
mov ecx, edi
call fcn.140014610
cmp edi, 1
jne 0x14000546e
lea rcx, [rbp + 0xa2d0]
call fcn.140014310
lea rdx, str.Checking_hard_disk_size_using_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x3d
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140005490
call fcn.140010c90
xor edx, edx
mov word [rbp + 0xa4d0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0xa4d2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_hard_disk_size_using_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xa4d0]
call fcn.14000b460
lea rdx, str.Checking_hard_disk_size_using_WMI
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140005507
lea rcx, [rbp + 0xa4d0]
call fcn.140014310
lea rdx, str.Checking_hard_disk_size_using_DeviceIoControl
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x31
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140005520
call fcn.140010f40
xor edx, edx
mov word [rbp + 0xa6d0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0xa6d2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_hard_disk_size_using_DeviceIoControl
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xa6d0]
call fcn.14000b460
lea rdx, str.Checking_hard_disk_size_using_DeviceIoControl
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140005597
lea rcx, [rbp + 0xa6d0]
call fcn.140014310
lea rdx, str.Checking_SetupDi_diskdrive
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x44
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400055b0
call fcn.140011270
xor edx, edx
mov word [rbp + 0xa8d0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0xa8d2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_SetupDi_diskdrive
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xa8d0]
call fcn.14000b460
lea rdx, str.Checking_SetupDi_diskdrive
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140005627
lea rcx, [rbp + 0xa8d0]
call fcn.140014310
lea rdx, str.Checking_mouse_movement
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x47
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140005640
lea rcx, [rbp + 0x220]
mov qword [rbp + 0x220], r14
mov qword [rbp + 0x228], r14
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x228]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rbp + 0x228]
cmp dword [rbp + 0x220], eax
jne 0x1400056a4
mov eax, dword [rbp + 0x22c]
mov ebx, r15d
cmp dword [rbp + 0x224], eax
je 0x1400056a7
mov ebx, r14d
xor edx, edx
mov word [rbp + 0xaad0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0xaad2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_mouse_movement
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xaad0]
call fcn.14000b460
lea rdx, str.Checking_mouse_movement
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140005705
lea rcx, [rbp + 0xaad0]
call fcn.140014310
lea rdx, str.Checking_lack_of_user_input
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x43
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140005720
mov ebx, r14d
mov dword [rbp + 0x268], 8
mov edi, r14d
mov ecx, 0xb
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x268]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x14000578a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rbp + 0x26c]
cmp eax, ecx
jb 0x14000578a
sub eax, ecx
cmp eax, 0x64
jae 0x140005780
inc ebx
cmp ebx, 0xa
jge 0x140006407
inc edi
cmp edi, 0x80
jl 0x140005742
mov ebx, r15d
xor edx, edx
mov word [rbp + 0xacd0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0xacd2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_lack_of_user_input
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xacd0]
call fcn.14000b460
lea rdx, str.Checking_lack_of_user_input
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x1400057eb
lea rcx, [rbp + 0xacd0]
call fcn.140014310
lea rdx, str.Checking_memory_space_using_GlobalMemoryStatusEx
lea rcx, str.____s
call fcn.14000b0a0
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub r12, 1
jne 0x140005800
xorps xmm0, xmm0
lea rcx, [rbp + 0x440]
movups xmmword [rbp + 0x440], xmm0
mov dword [rbp + 0x440], 0x40
movups xmmword [rbp + 0x450], xmm0
movups xmmword [rbp + 0x460], xmm0
movups xmmword [rbp + 0x470], xmm0
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp qword [rbp + 0x448], 0x40000000
lea rcx, [rbp + 0xaed2]
mov ebx, r14d
mov word [rbp + 0xaed0], r14w
setb bl
mov r8d, 0x1fe
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_memory_space_using_GlobalMemoryStatusEx
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xaed0]
call fcn.14000b460
lea rdx, str.Checking_memory_space_using_GlobalMemoryStatusEx
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x1400058b7
lea rcx, [rbp + 0xaed0]
call fcn.140014310
lea rdx, str.Checking_disk_size_using_GetDiskFreeSpaceEx
lea rcx, str.____s
call fcn.14000b0a0
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rsi, 1
jne 0x1400058d0
xor r9d, r9d
lea r8, [rbp + 0x288]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x140005910
movabs rax, 0x1400000000
mov ebx, r15d
cmp qword [rbp + 0x288], rax
jb 0x140005913
mov ebx, r14d
xor edx, edx
mov word [rbp + 0xb0d0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0xb0d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_disk_size_using_GetDiskFreeSpaceEx
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xb0d0]
call fcn.14000b460
lea rdx, str.Checking_disk_size_using_GetDiskFreeSpaceEx
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140005971
lea rcx, [rbp + 0xb0d0]
call fcn.140014310
lea rdx, str.Checking_if_CPU_hypervisor_field_is_set_using_cpuid_0x1_
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x27
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140005990
xor eax, eax
mov word [rbp + 0xb2d0], r14w
mov qword [rsp + 0x54], rax
xor ecx, ecx
mov eax, r15d
mov r8d, 0x1fe
cpuid
mov edi, ecx
mov dword [rsp + 0x54], ebx
mov dword [rsp + 0x5c], edx
lea rcx, [rbp + 0xb2d2]
sar edi, 0x1f
xor edx, edx
mov ebx, edi
mov dword [rsp + 0x50], eax
and ebx, 1
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_if_CPU_hypervisor_field_is_set_using_cpuid_0x1_
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xb2d0]
call fcn.14000b460
lea rdx, str.Checking_if_CPU_hypervisor_field_is_set_using_cpuid_0x1_
mov ecx, ebx
call fcn.140014610
test dil, 1
je 0x140005a25
lea rcx, [rbp + 0xb2d0]
call fcn.140014310
lea rdx, str.Checking_hypervisor_vendor_using_cpuid_0x40000000_
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x2d
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140005a40
xor ecx, ecx
mov qword [rbp + 0xe3c], r14
mov qword [rsp + 0x54], rcx
lea r12, [rbp + 0xd8]
mov dword [rsp + 0x5c], ecx
mov eax, 0x40000000
lea rcx, str.KVMKVMKVM
mov qword [rbp + 0xe44], r14
mov qword [rbp + 0xd8], rcx
mov r15d, r14d
lea rcx, str.Microsoft_Hv
mov qword [rbp + 0xe4c], r14
mov qword [rbp + 0xe0], rcx
lea rcx, str.VMwareVMware
mov qword [rbp + 0xe8], rcx
lea rcx, str.XenVMMXenVMM
mov qword [rbp + 0xf0], rcx
lea rcx, str.prl_hyperv
mov qword [rbp + 0xf8], rcx
lea rcx, str.VBoxVBoxVBox
mov qword [rbp + 0x100], rcx
xor ecx, ecx
cpuid
mov dword [rsp + 0x54], ebx
mov dword [rsp + 0x58], ecx
movsd xmm0, qword [rsp + 0x54]
movsd qword [rbp + 0xe30], xmm0
mov dword [rsp + 0x50], eax
mov qword [rbp + 0xe54], r14
mov qword [rbp + 0xe5c], r14
mov qword [rbp + 0xe64], r14
mov dword [rbp + 0xe6c], r14d
mov dword [rbp + 0xe38], edx
nop word [rax + rax]
mov dword [rsp + 0x28], r14d
lea r8, [rbp + 0xe30]
mov r9d, 0xffffffff
mov qword [rsp + 0x20], r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
lea ecx, [rax + 1]
movsxd rbx, ecx
add rbx, rbx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x140005bb5
mov rdi, rax
mov dword [rsp + 0x28], esi
xor eax, eax
mov qword [rsp + 0x20], r14
mov rcx, rbx
lea r8, [rbp + 0xe30]
rep stosb byte [rdi], al
xor ecx, ecx
mov r9d, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, qword [r12]
mov rax, r14
sub rdx, r14
movzx ebx, word [rax]
movzx ecx, word [rax + rdx]
sub ebx, ecx
jne 0x140005ba4
add rax, 2
test ecx, ecx
jne 0x140005b91
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test ebx, ebx
je 0x14000640f
inc r15d
add r12, 8
xor r14d, r14d
cmp r15d, 6
jl 0x140005b20
mov ebx, r14d
xor edx, edx
mov word [rbp + 0xb4d0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0xb4d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_hypervisor_vendor_using_cpuid_0x40000000_
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xb4d0]
call fcn.14000b460
lea rdx, str.Checking_hypervisor_vendor_using_cpuid_0x40000000_
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140005c2a
lea rcx, [rbp + 0xb4d0]
call fcn.140014310
lea rdx, str.Check_if_time_has_been_accelerated
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x3c
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140005c42
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0xea60
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, 0x1fe
mov word [rbp + 0xb6d0], r14w
mov edi, eax
lea rcx, [rbp + 0xb6d2]
sub edi, ebx
mov ebx, r14d
cmp edi, 0xe678
setbe bl
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r9, str.Check_if_time_has_been_accelerated
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xb6d0]
call fcn.14000b460
lea rdx, str.Check_if_time_has_been_accelerated
mov ecx, ebx
call fcn.140014610
cmp edi, 0xe678
ja 0x140005cde
lea rcx, [rbp + 0xb6d0]
call fcn.140014310
lea rdx, str.VM_Driver_Services
lea rcx, str.____s
call fcn.14000b0a0
mov r13d, 0x4b
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub r13, 1
jne 0x140005d00
call fcn.140012660
xor edx, edx
mov word [rbp + 0xb8d0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0xb8d2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.VM_Driver_Services
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xb8d0]
call fcn.14000b460
lea rdx, str.VM_Driver_Services
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140005d77
lea rcx, [rbp + 0xb8d0]
call fcn.140014310
lea rdx, str.Checking_SerialNumber_from_BIOS_using_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov r13d, 0x35
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub r13, 1
jne 0x140005d90
call fcn.140011480
xor edx, edx
mov word [rbp + 0xbad0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0xbad2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_SerialNumber_from_BIOS_using_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xbad0]
call fcn.14000b460
lea rdx, str.Checking_SerialNumber_from_BIOS_using_WMI
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140005e07
lea rcx, [rbp + 0xbad0]
call fcn.140014310
lea rdx, str.Checking_Model_from_ComputerSystem_using_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x32
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140005e20
call fcn.140011700
xor edx, edx
mov word [rbp + 0xbcd0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0xbcd2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Model_from_ComputerSystem_using_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xbcd0]
call fcn.14000b460
lea rdx, str.Checking_Model_from_ComputerSystem_using_WMI
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140005e97
lea rcx, [rbp + 0xbcd0]
call fcn.140014310
lea rdx, str.Checking_Manufacturer_from_ComputerSystem_using_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x2b
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140005eb0
call fcn.140011960
xor edx, edx
mov word [rbp + 0xbed0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0xbed2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Manufacturer_from_ComputerSystem_using_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xbed0]
call fcn.14000b460
lea rdx, str.Checking_Manufacturer_from_ComputerSystem_using_WMI
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140005f27
lea rcx, [rbp + 0xbed0]
call fcn.140014310
lea rdx, str.Checking_Current_Temperature_using_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x38
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140005f40
call fcn.140011bd0
xor edx, edx
mov word [rbp + 0xc0d0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0xc0d2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Current_Temperature_using_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xc0d0]
call fcn.14000b460
lea rdx, str.Checking_Current_Temperature_using_WMI
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140005fb7
lea rcx, [rbp + 0xc0d0]
call fcn.140014310
lea rdx, str.Checking_ProcessId_using_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x42
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140005fd0
call fcn.140011df0
xor edx, edx
mov word [rbp + 0xc2d0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0xc2d2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_ProcessId_using_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xc2d0]
call fcn.14000b460
lea rdx, str.Checking_ProcessId_using_WMI
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140006047
lea rcx, [rbp + 0xc2d0]
call fcn.140014310
lea rdx, str.Checking_power_capabilities
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x43
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140006060
lea rcx, [rbp + 0x4e0]
mov ebx, r14d
call qword [sym.imp.POWRPROF.dll_GetPwrCapabilities]
cmp al, 1
jne 0x1400060aa
movzx eax, byte [rbp + 0x4e6]
or al, byte [rbp + 0x4e5]
or al, byte [rbp + 0x4e4]
or al, byte [rbp + 0x4e3]
jne 0x1400060aa
cmp byte [rbp + 0x4ed], al
sete bl
xor edx, edx
mov word [rbp + 0xc4d0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0xc4d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_power_capabilities
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xc4d0]
call fcn.14000b460
lea rdx, str.Checking_power_capabilities
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140006108
lea rcx, [rbp + 0xc4d0]
call fcn.140014310
lea rdx, str.Checking_CPU_fan_using_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x44
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140006120
lea r8, [0x14001e8b0]
mov qword [rbp + 0x120], r14
lea rdx, [rbp + 0x140]
mov qword [rbp + 0x140], r14
lea rcx, [rbp + 0x120]
mov qword [rbp + 0x128], r14
mov r12d, r14d
mov edi, r14d
call fcn.140016e60
test eax, eax
je 0x1400062c9
lea rcx, [0x1400224d8]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, str.SELECT__FROM_Win32_Fan
mov r14, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r15d, 1
mov rsi, rax
test r14, r14
je 0x14000620f
test rax, rax
je 0x140006206
mov rcx, qword [rbp + 0x120]
lea rax, [rbp + 0x128]
mov qword [rsp + 0x28], rax
mov r9d, 0x30
xor eax, eax
mov r8, rsi
mov qword [rsp + 0x20], rax
mov rdx, qword [rcx]
mov rbx, qword [rdx + 0xa0]
mov rdx, r14
call rbx
test eax, eax
jns 0x140006206
xor eax, eax
lea rcx, str.ExecQuery
mov r15d, eax
call fcn.140014740
mov rcx, qword [rbp + 0x120]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x140]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rsi, rsi
je 0x14000621d
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor r14d, r14d
test r15d, r15d
je 0x1400062c9
mov rcx, qword [rbp + 0x128]
mov qword [rbp + 0x160], r14
mov dword [rbp + 0x218], r14d
test rcx, rcx
je 0x140006298
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x218]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x160]
mov edx, 0xffffffff
mov r8d, 1
call qword [rax + 0x20]
cmp dword [rbp + 0x218], r14d
je 0x140006298
mov rcx, qword [rbp + 0x160]
inc edi
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x128]
test rcx, rcx
jne 0x140006250
mov rcx, qword [rbp + 0x120]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x140]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
test edi, edi
jne 0x1400062cf
mov r12d, 1
xor edx, edx
mov word [rbp + 0xc6d0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0xc6d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_CPU_fan_using_WMI
mov dword [rsp + 0x20], r12d
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xc6d0]
call fcn.14000b460
lea rdx, str.Checking_CPU_fan_using_WMI
mov ecx, r12d
call fcn.140014610
cmp r12d, 1
jne 0x140006330
lea rcx, [rbp + 0xc6d0]
call fcn.140014310
lea rdx, str.Checking_NtQueryLicenseValue_with_Kernel_VMDetection_Private
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x22
nop dword [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140006350
lea rdx, [0x14003f1f0]
mov ecx, r14d
mov rax, rdx
nop
cmp dword [rax], 0x1b
je 0x14000641c
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140006370
mov rdi, r14
mov ecx, r14d
mov rax, rdx
nop dword [rax]
cmp dword [rax], 0x11
je 0x14000643b
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140006390
mov rbx, r14
test rdi, rdi
je 0x14000645a
test rbx, rbx
je 0x14000645a
lea rdx, str.Kernel_VMDetection_Private
lea rcx, [rbp + 0x430]
call rdi
lea rax, [rbp + 0x274]
mov dword [rbp + 0x204], r14d
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x204]
xor edx, edx
lea rcx, [rbp + 0x430]
call rbx
mov ebx, r14d
test eax, eax
js 0x14000645d
cmp dword [rbp + 0x204], 0
setne bl
jmp 0x14000645d
mov ebx, r14d
jmp 0x14000578d
mov ebx, 1
xor r14d, r14d
jmp 0x140005bcc
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
je 0x140006384
mov rdi, qword [rdx + rcx*8 + 0x28]
jmp 0x140006387
movsxd rax, ecx
lea rbx, [rax + rax*2]
add rbx, rbx
cmp byte [rdx + rbx*8 + 0x24], 0
je 0x1400063a4
mov rbx, qword [rdx + rbx*8 + 0x28]
jmp 0x1400063a7
mov ebx, r14d
xor edx, edx
mov word [rbp + 0xc8d0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0xc8d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_NtQueryLicenseValue_with_Kernel_VMDetection_Private
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xc8d0]
call fcn.14000b460
lea rdx, str.Checking_NtQueryLicenseValue_with_Kernel_VMDetection_Private
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x1400064bb
lea rcx, [rbp + 0xc8d0]
call fcn.140014310
lea rdx, str.Checking_Win32_CacheMemory_with_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov r15d, 0x3b
mov ebx, r15d
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400064e0
lea rcx, str.SELECT__FROM_Win32_CacheMemory
call fcn.140012000
test eax, eax
mov word [rbp + 0xcad0], r14w
mov ebx, r14d
lea rcx, [rbp + 0xcad2]
sete bl
mov r8d, 0x1fe
xor edx, edx
mov edi, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Win32_CacheMemory_with_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xcad0]
call fcn.14000b460
lea rdx, str.Checking_Win32_CacheMemory_with_WMI
mov ecx, ebx
call fcn.140014610
test edi, edi
jne 0x140006565
lea rcx, [rbp + 0xcad0]
call fcn.140014310
lea rdx, str.Checking_Win32_PhysicalMemory_with_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov r12d, 0x38
mov ebx, r12d
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140006581
lea rcx, str.SELECT__FROM_Win32_PhysicalMemory
call fcn.140012000
test eax, eax
mov word [rbp + 0xccd0], r14w
mov ebx, r14d
lea rcx, [rbp + 0xccd2]
sete bl
mov r8d, 0x1fe
xor edx, edx
mov edi, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Win32_PhysicalMemory_with_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xccd0]
call fcn.14000b460
lea rdx, str.Checking_Win32_PhysicalMemory_with_WMI
mov ecx, ebx
call fcn.140014610
test edi, edi
jne 0x140006606
lea rcx, [rbp + 0xccd0]
call fcn.140014310
lea rdx, str.Checking_Win32_MemoryDevice_with_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov esi, 0x3a
mov ebx, esi
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140006620
lea rcx, str.SELECT__FROM_Win32_MemoryDevice
call fcn.140012000
test eax, eax
mov word [rbp + 0xced0], r14w
mov ebx, r14d
lea rcx, [rbp + 0xced2]
sete bl
mov r8d, 0x1fe
xor edx, edx
mov edi, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Win32_MemoryDevice_with_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xced0]
call fcn.14000b460
lea rdx, str.Checking_Win32_MemoryDevice_with_WMI
mov ecx, ebx
call fcn.140014610
test edi, edi
jne 0x1400066a5
lea rcx, [rbp + 0xced0]
call fcn.140014310
lea rdx, str.Checking_Win32_MemoryArray_with_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, r15
nop dword [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400066c0
lea rcx, str.SELECT__FROM_Win32_MemoryArray
call fcn.140012000
test eax, eax
mov word [rbp + 0xd0d0], r14w
mov ebx, r14d
lea rcx, [rbp + 0xd0d2]
sete bl
mov r8d, 0x1fe
xor edx, edx
mov edi, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Win32_MemoryArray_with_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xd0d0]
call fcn.14000b460
lea rdx, str.Checking_Win32_MemoryArray_with_WMI
mov ecx, ebx
call fcn.140014610
test edi, edi
jne 0x140006745
lea rcx, [rbp + 0xd0d0]
call fcn.140014310
lea rdx, str.Checking_Win32_VoltageProbe_with_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, rsi
nop dword [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140006760
lea rcx, str.SELECT__FROM_Win32_VoltageProbe
call fcn.140012000
test eax, eax
mov word [rbp + 0xd2d0], r14w
mov ebx, r14d
lea rcx, [rbp + 0xd2d2]
sete bl
mov r8d, 0x1fe
xor edx, edx
mov edi, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Win32_VoltageProbe_with_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xd2d0]
call fcn.14000b460
lea rdx, str.Checking_Win32_VoltageProbe_with_WMI
mov ecx, ebx
call fcn.140014610
test edi, edi
jne 0x1400067e5
lea rcx, [rbp + 0xd2d0]
call fcn.140014310
lea rdx, str.Checking_Win32_PortConnector_with_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov r13d, 0x39
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub r13, 1
jne 0x140006800
lea rcx, str.SELECT__FROM_Win32_PortConnector
call fcn.140012000
test eax, eax
mov word [rbp + 0xd4d0], r14w
mov ebx, r14d
lea rcx, [rbp + 0xd4d2]
sete bl
mov r8d, 0x1fe
xor edx, edx
mov edi, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Win32_PortConnector_with_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xd4d0]
call fcn.14000b460
lea rdx, str.Checking_Win32_PortConnector_with_WMI
mov ecx, ebx
call fcn.140014610
test edi, edi
jne 0x140006885
lea rcx, [rbp + 0xd4d0]
call fcn.140014310
lea rdx, str.Checking_Win32_SMBIOSMemory_with_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, rsi
nop dword [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400068a0
lea rcx, str.SELECT__FROM_Win32_SMBIOSMemory
call fcn.140012000
test eax, eax
mov word [rbp + 0xd6d0], r14w
mov ebx, r14d
lea rcx, [rbp + 0xd6d2]
sete bl
mov r8d, 0x1fe
xor edx, edx
mov edi, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Win32_SMBIOSMemory_with_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xd6d0]
call fcn.14000b460
lea rdx, str.Checking_Win32_SMBIOSMemory_with_WMI
mov ecx, ebx
call fcn.140014610
test edi, edi
jne 0x140006925
lea rcx, [rbp + 0xd6d0]
call fcn.140014310
lea rdx, str.Checking_ThermalZoneInfo_performance_counters_with_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov esi, 0x28
mov ebx, esi
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140006940
lea rcx, str.SELECT__FROM_Win32_PerfFormattedData_Counters_ThermalZoneInformation
call fcn.140012000
test eax, eax
mov word [rbp + 0xd8d0], r14w
mov ebx, r14d
lea rcx, [rbp + 0xd8d2]
sete bl
mov r8d, 0x1fe
xor edx, edx
mov edi, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_ThermalZoneInfo_performance_counters_with_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xd8d0]
call fcn.14000b460
lea rdx, str.Checking_ThermalZoneInfo_performance_counters_with_WMI
mov ecx, ebx
call fcn.140014610
test edi, edi
jne 0x1400069c5
lea rcx, [rbp + 0xd8d0]
call fcn.140014310
lea rdx, str.Checking_CIM_Memory_with_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov r14d, 0x42
mov ebx, r14d
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400069e1
lea rcx, str.SELECT__FROM_CIM_Memory
call fcn.140012000
mov edi, eax
lea rcx, [rbp + 0xdad2]
xor eax, eax
mov r8d, 0x1fe
mov ebx, eax
mov word [rbp + 0xdad0], ax
test edi, edi
sete bl
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_CIM_Memory_with_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xdad0]
call fcn.14000b460
lea rdx, str.Checking_CIM_Memory_with_WMI
mov ecx, ebx
call fcn.140014610
test edi, edi
jne 0x140006a66
lea rcx, [rbp + 0xdad0]
call fcn.140014310
lea rdx, str.Checking_CIM_Sensor_with_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, r14
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140006a80
lea rcx, str.SELECT__FROM_CIM_Sensor
call fcn.140012000
xor r14d, r14d
lea rcx, [rbp + 0xdcd2]
test eax, eax
mov word [rbp + 0xdcd0], r14w
mov ebx, r14d
mov r8d, 0x1fe
sete bl
mov edi, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_CIM_Sensor_with_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xdcd0]
call fcn.14000b460
lea rdx, str.Checking_CIM_Sensor_with_WMI
mov ecx, ebx
call fcn.140014610
test edi, edi
jne 0x140006b08
lea rcx, [rbp + 0xdcd0]
call fcn.140014310
lea rdx, str.Checking_CIM_NumericSensor_with_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, r15
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140006b20
lea rcx, str.SELECT__FROM_CIM_NumericSensor
call fcn.140012000
test eax, eax
mov word [rbp + 0xded0], r14w
mov ebx, r14d
lea rcx, [rbp + 0xded2]
sete bl
mov r8d, 0x1fe
xor edx, edx
mov edi, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_CIM_NumericSensor_with_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xded0]
call fcn.14000b460
lea rdx, str.Checking_CIM_NumericSensor_with_WMI
mov ecx, ebx
call fcn.140014610
test edi, edi
jne 0x140006ba5
lea rcx, [rbp + 0xded0]
call fcn.140014310
lea rdx, str.Checking_CIM_TemperatureSensor_with_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov r14d, 0x37
mov ebx, r14d
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140006bc1
lea rcx, str.SELECT__FROM_CIM_TemperatureSensor
call fcn.140012000
mov edi, eax
lea rcx, [rbp + 0xe0d2]
xor eax, eax
mov r8d, 0x1fe
mov ebx, eax
mov word [rbp + 0xe0d0], ax
test edi, edi
sete bl
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_CIM_TemperatureSensor_with_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xe0d0]
call fcn.14000b460
lea rdx, str.Checking_CIM_TemperatureSensor_with_WMI
mov ecx, ebx
call fcn.140014610
test edi, edi
jne 0x140006c46
lea rcx, [rbp + 0xe0d0]
call fcn.140014310
lea rdx, str.Checking_CIM_VoltageSensor_with_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, r15
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140006c60
lea rcx, str.SELECT__FROM_CIM_VoltageSensor
call fcn.140012000
xor r15d, r15d
lea rcx, [rbp + 0xe2d2]
test eax, eax
mov word [rbp + 0xe2d0], r15w
mov ebx, r15d
mov r8d, 0x1fe
sete bl
mov edi, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_CIM_VoltageSensor_with_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xe2d0]
call fcn.14000b460
lea rdx, str.Checking_CIM_VoltageSensor_with_WMI
mov ecx, ebx
call fcn.140014610
test edi, edi
jne 0x140006ce8
lea rcx, [rbp + 0xe2d0]
call fcn.140014310
lea rdx, str.Checking_CIM_PhysicalConnector_with_WMI
lea rcx, str.____s
call fcn.14000b0a0
nop dword [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub r14, 1
jne 0x140006d00
lea rcx, str.SELECT__FROM_CIM_PhysicalConnector
call fcn.140012000
test eax, eax
mov word [rbp + 0xe4d0], r15w
mov ebx, r15d
lea rcx, [rbp + 0xe4d2]
sete bl
mov r8d, 0x1fe
xor edx, edx
mov edi, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_CIM_PhysicalConnector_with_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xe4d0]
call fcn.14000b460
lea rdx, str.Checking_CIM_PhysicalConnector_with_WMI
mov ecx, ebx
call fcn.140014610
test edi, edi
jne 0x140006d85
lea rcx, [rbp + 0xe4d0]
call fcn.140014310
lea rdx, str.Checking_CIM_Slot_with_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x44
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140006da0
lea rcx, str.SELECT__FROM_CIM_Slot
call fcn.140012000
test eax, eax
mov word [rbp + 0xe6d0], r15w
mov ebx, r15d
lea rcx, [rbp + 0xe6d2]
sete bl
mov r8d, 0x1fe
xor edx, edx
mov edi, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_CIM_Slot_with_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xe6d0]
call fcn.14000b460
lea rdx, str.Checking_CIM_Slot_with_WMI
mov ecx, ebx
call fcn.140014610
test edi, edi
jne 0x140006e25
lea rcx, [rbp + 0xe6d0]
call fcn.140014310
lea rdx, str.Checking_if_Windows_is_Genuine
lea rcx, str.____s
call fcn.14000b0a0
mov r13d, 0x40
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub r13, 1
jne 0x140006e40
xor r8d, r8d
mov dword [rbp + 0x208], 0x55c92734
lea rdx, [rbp + 0x238]
mov dword [rbp + 0x20c], 0x4d71d682
lea rcx, [rbp + 0x208]
mov dword [rbp + 0x210], 0xecd63e98
mov dword [rbp + 0x214], 0x9f05163f
call qword [sym.imp.SLWGA.dll_SLIsGenuineLocal]
mov r13d, 0x47
test eax, eax
jne 0x140006eb1
cmp dword [rbp + 0x238], r15d
je 0x140006eb1
mov r15d, 1
xor edi, edi
mov ebx, r15d
jmp 0x140006ebb
xor edi, edi
mov r15d, 1
mov ebx, edi
xor edx, edx
mov word [rbp + 0xe8d0], di
mov r8d, 0x1fe
lea rcx, [rbp + 0xe8d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_if_Windows_is_Genuine
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xe8d0]
call fcn.14000b460
lea rdx, str.Checking_if_Windows_is_Genuine
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140006f18
lea rcx, [rbp + 0xe8d0]
call fcn.140014310
lea rdx, str.Checking_ServicesDiskEnum_entries_for_VM_strings
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x2c
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140006f30
lea rax, str.qemu
mov qword [rbp + 0x130], rdi
mov qword [rsp + 0x50], rax
lea rdx, str.SystemCurrentControlSetServicesDiskEnum
lea rax, str.virtio
mov dword [rbp + 0x1ec], edi
mov qword [rsp + 0x58], rax
mov r9d, 0x20019
lea rax, str.vmware
mov dword [rbp + 0x234], 4
mov qword [rsp + 0x60], rax
xor r8d, r8d
lea rax, str.vbox
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x68], rax
mov r14d, edi
lea rax, [0x14001f248]
mov qword [rsp + 0x70], rax
lea rax, [0x14001f250]
mov qword [rsp + 0x78], rax
lea rax, str.Virtual
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007027
mov rcx, qword [rbp + 0x130]
lea rax, [rbp + 0x234]
mov qword [rsp + 0x28], rax
lea rdx, str.Count
lea rax, [rbp + 0x1ec]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x130]
test eax, eax
je 0x140007021
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000709d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp + 0x1ec], 0
mov esi, edi
jbe 0x140007098
nop dword [rax]
nop word [rax + rax]
mov r9d, esi
lea r8, [0x14001f264]
mov edx, 0xb
lea rcx, [rbp + 0xe90]
call fcn.14000b460
lea rbx, [rsp + 0x50]
mov r9, qword [rbx]
lea r8, [rbp + 0xe90]
lea rdx, str.SystemCurrentControlSetServicesDiskEnum
call fcn.140014d20
test eax, eax
jne 0x140007093
inc edi
add rbx, 8
cmp edi, 7
jb 0x140007060
inc esi
xor edi, edi
cmp esi, dword [rbp + 0x1ec]
jae 0x140007098
jmp 0x140007040
mov r14d, r15d
xor edi, edi
mov esi, 0x28
xor edx, edx
mov word [rbp + 0xead0], di
mov r8d, 0x1fe
lea rcx, [rbp + 0xead2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_ServicesDiskEnum_entries_for_VM_strings
mov dword [rsp + 0x20], r14d
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xead0]
call fcn.14000b460
lea rdx, str.Checking_ServicesDiskEnum_entries_for_VM_strings
mov ecx, r14d
call fcn.140014610
cmp r14d, 1
jne 0x1400070fd
lea rcx, [rbp + 0xead0]
call fcn.140014310
lea rdx, str.Checking_EnumIDE_and_EnumSCSI_entries_for_VM_strings
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rsi, 1
jne 0x140007110
call fcn.1400121d0
xor edx, edx
mov word [rbp + 0xecd0], si
mov r8d, 0x1fe
lea rcx, [rbp + 0xecd2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_EnumIDE_and_EnumSCSI_entries_for_VM_strings
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xecd0]
call fcn.14000b460
lea rdx, str.Checking_EnumIDE_and_EnumSCSI_entries_for_VM_strings
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140007186
lea rcx, [rbp + 0xecd0]
call fcn.140014310
lea rdx, str.Checking_SMBIOS_tables
lea rcx, str.____s
call fcn.14000b0a0
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub r13, 1
jne 0x1400071a0
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], esi
xor edx, edx
mov ecx, 0x52534d42
mov ebx, esi
call fcn.140017140
mov r11, rax
test rax, rax
je 0x14000724a
mov r9d, dword [rax + 4]
lea r8, [rax + 8]
add r9, 8
mov r10d, esi
add r9, rax
cmp r8, r9
jae 0x14000723e
nop dword [rax + rax]
inc r10d
cmp byte [r8], 0x7f
je 0x140007236
movzx edi, byte [r8 + 1]
mov edx, esi
add rdi, r8
mov ebx, edx
lea ecx, [rdx + 1]
cmp byte [rbx + rdi], sil
jne 0x140007214
mov ebx, esi
cmp r10d, 0x28
ja 0x140007241
mov ebx, r15d
mov rcx, r11
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor edx, edx
mov word [rbp + 0xeed0], si
mov r8d, 0x1fe
lea rcx, [rbp + 0xeed2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_SMBIOS_tables
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xeed0]
call fcn.14000b460
lea rdx, str.Checking_SMBIOS_tables
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x1400072af
lea rcx, [rbp + 0xeed0]
call fcn.140014310
jmp 0x1400072af
mov r12d, 0x38
cmp dword [0x140040088], 0
lea r13, [0x14001f9f0]
lea r14, str.Identifier
je 0x1400084aa
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x328]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x328]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x330]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.VirtualBox_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.14000b0a0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.VBOX
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x60], rax
lea rcx, str.HARDWAREDescriptionSystem
mov qword [rsp + 0x78], rax
lea rdx, str.SystemBiosVersion
lea rax, str.VideoBiosVersion
mov qword [rsp + 0x58], r14
mov qword [rbp - 0x78], rax
lea rsi, [rsp + 0x58]
lea rax, str.VIRTUALBOX
mov qword [rsp + 0x68], rcx
mov qword [rbp - 0x70], rax
mov r13d, 4
lea rax, str.SystemBiosDate
mov qword [rsp + 0x70], rdx
mov qword [rbp - 0x60], rax
mov r14d, r13d
lea rax, str.06_23_99
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x68], rcx
xor eax, eax
lea rcx, [rbp + 0x10b2]
xor edx, edx
mov word [rbp + 0x10b0], ax
mov r8d, 0x1fe
call sub.VCRUNTIME140.dll_memset
mov rbx, qword [rsi + 8]
lea r8, str.Checking_reg_key_HARDWAREDescriptionSystem____s_is_set_to__s
mov r9, qword [rsi]
lea rcx, [rbp + 0x10b0]
mov edx, pe_nt_image_headers64
mov qword [rsp + 0x20], rbx
call fcn.14000b460
mov r8, qword [rsi]
mov r9, rbx
mov rdx, qword [rsi - 8]
call fcn.140014d20
lea rdx, [rbp + 0x10b0]
lea rcx, str.____s
test eax, eax
je 0x140007449
call fcn.14000b0a0
lea rcx, [rbp + 0x10b0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007416
mov ebx, 0x5f
sub rbx, rax
je 0x140007442
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140007430
mov ecx, 1
jmp 0x140007488
call fcn.14000b0a0
lea rcx, [rbp + 0x10b0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007460
mov ebx, 0x5f
sub rbx, rax
je 0x140007486
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140007474
xor ecx, ecx
lea rdx, [rbp + 0x10b0]
call fcn.140014610
add rsi, 0x18
sub r14, 1
jne 0x1400073a1
lea rdx, str.Checking_VirtualBox_Guest_Additions_directory
lea rcx, str.____s
call fcn.14000b0a0
mov r15d, 0x31
nop dword [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub r15, 1
jne 0x1400074c0
xor edi, edi
lea rcx, [rbp + 0x12ee2]
xor edx, edx
mov word [rbp + 0x12ee0], di
mov r8d, 0x206
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [str.oracle_virtualbox_guest_additions_]
lea rcx, [rbp + 0x34f6]
movaps xmm1, xmmword [0x140020520]
xor edx, edx
mov eax, dword [0x140020550]
mov r8d, 0x1c2
movaps xmmword [rbp + 0x34b0], xmm0
movaps xmm0, xmmword [0x140020530]
movaps xmmword [rbp + 0x34c0], xmm1
movaps xmm1, xmmword [0x140020540]
mov dword [rbp + 0x34f0], eax
movzx eax, word [0x140020554]
movaps xmmword [rbp + 0x34d0], xmm0
movaps xmmword [rbp + 0x34e0], xmm1
mov word [rbp + 0x34f4], ax
call sub.VCRUNTIME140.dll_memset
call fcn.140014c60
lea rdx, [rbp + 0x13b30]
test eax, eax
je 0x14000757a
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x14000758b
xor r9d, r9d
mov r8d, 0x26
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x34b0]
lea rdx, [rbp + 0x13b30]
lea rcx, [rbp + 0x12ee0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x12ee0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400075c7
test al, 0x10
je 0x1400075c7
mov r14d, 1
mov ebx, r14d
jmp 0x1400075cf
mov ebx, edi
mov r14d, 1
xor edx, edx
mov word [rbp + 0xf0d0], di
mov r8d, 0x1fe
lea rcx, [rbp + 0xf0d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_VirtualBox_Guest_Additions_directory
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xf0d0]
call fcn.14000b460
lea rdx, str.Checking_VirtualBox_Guest_Additions_directory
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x14000762c
lea rcx, [rbp + 0xf0d0]
call fcn.140014310
call fcn.140012920
lea rax, str.HARDWAREACPIDSDTVBOX__
mov esi, 9
mov qword [rsp + 0x50], rax
lea rdi, [rsp + 0x50]
lea rax, str.HARDWAREACPIFADTVBOX__
xor r15d, r15d
mov qword [rsp + 0x58], rax
lea rax, str.HARDWAREACPIRSDTVBOX__
mov qword [rsp + 0x60], rax
lea rax, str.SOFTWAREOracleVirtualBox_Guest_Additions
mov qword [rsp + 0x68], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxGuest
mov qword [rsp + 0x70], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxMouse
mov qword [rsp + 0x78], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxService
mov qword [rbp - 0x80], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxSF
mov qword [rbp - 0x78], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxVideo
mov qword [rbp - 0x70], rax
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x12b0], r15w
mov r8d, 0x1fe
lea rcx, [rbp + 0x12b2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, [0x14001f670]
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x12b0]
call fcn.14000b460
mov rdx, qword [rdi]
lea rax, [rbp + 0x168]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp + 0x168], r15
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007777
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x12b0]
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [rbp + 0x12b0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140007745
mov ebx, 0x5f
sub rbx, rax
je 0x140007772
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140007760
mov ecx, r14d
jmp 0x1400077c8
lea rdx, [rbp + 0x12b0]
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [rbp + 0x12b0]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r15w
jne 0x1400077a0
mov ebx, 0x5f
sub rbx, rax
je 0x1400077c6
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400077b4
xor ecx, ecx
lea rdx, [rbp + 0x12b0]
call fcn.140014610
add rdi, 8
sub rsi, 1
jne 0x1400076b0
lea rdx, str.Checking_Mac_Address_start_with_08:00:27
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x36
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140007800
lea rcx, [0x140020558]
call fcn.140014e10
xor edi, edi
lea rcx, [rbp + 0xf2d2]
xor edx, edx
mov word [rbp + 0xf2d0], di
mov r8d, 0x1fe
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Mac_Address_start_with_08:00:27
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xf2d0]
call fcn.14000b460
lea rdx, str.Checking_Mac_Address_start_with_08:00:27
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x14000787f
lea rcx, [rbp + 0xf2d0]
call fcn.140014310
lea rdx, str.Checking_MAC_address__Hybrid_Analysis_
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub r12, 1
jne 0x140007892
lea rcx, [0x14001e8a8]
call fcn.140014e10
xor edx, edx
mov word [rbp + 0xf4d0], di
mov r8d, 0x1fe
lea rcx, [rbp + 0xf4d2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_MAC_address__Hybrid_Analysis_
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xf4d0]
call fcn.14000b460
lea rdx, str.Checking_MAC_address__Hybrid_Analysis_
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x14000790f
lea rcx, [rbp + 0xf4d0]
call fcn.140014310
lea rax, [0x140020560]
mov r12d, 5
mov qword [rsp + 0x50], rax
lea rsi, [rsp + 0x50]
lea rax, str..VBoxGuest
mov r14d, r12d
mov qword [rsp + 0x58], rax
mov r15d, 1
lea rax, str..pipeVBoxMiniRdDN
mov qword [rsp + 0x60], rax
lea rax, str..VBoxTrayIPC
mov qword [rsp + 0x68], rax
lea rax, str..pipeVBoxTrayIPC
mov qword [rsp + 0x70], rax
jmp 0x140007972
xor edi, edi
mov rcx, qword [rsi]
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov r8d, r15d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
lea rcx, [rbp + 0x14b2]
mov rdi, rax
mov r8d, 0x1fe
xor eax, eax
mov word [rbp + 0x14b0], ax
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rsi]
lea r8, str.Checking_device__s
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x14b0]
call fcn.14000b460
cmp rdi, 0xffffffffffffffff
je 0x140007a36
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x14b0]
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [rbp + 0x14b0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007a06
mov ebx, 0x5f
sub rbx, rax
je 0x140007a31
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, r15
jne 0x140007a20
mov ecx, r15d
jmp 0x140007a87
lea rdx, [rbp + 0x14b0]
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [rbp + 0x14b0]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140007a60
mov ebx, 0x5f
sub rbx, rax
je 0x140007a85
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, r15
jne 0x140007a74
xor ecx, ecx
lea rdx, [rbp + 0x14b0]
call fcn.140014610
add rsi, 8
sub r14, r15
jne 0x140007970
lea rdx, str.Checking_VBoxTrayToolWndClass___VBoxTrayToolWnd
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x2f
nop dword [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140007ac0
xor edx, edx
lea rcx, str.VBoxTrayToolWndClass
call qword [sym.imp.USER32.dll_FindWindowW]
lea rdx, str.VBoxTrayToolWnd
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowW]
test rbx, rbx
jne 0x140007b09
test rax, rax
jne 0x140007b09
xor edi, edi
mov r14d, 1
mov ebx, edi
jmp 0x140007b14
mov r14d, 1
xor edi, edi
mov ebx, r14d
xor edx, edx
mov word [rbp + 0xf6d0], di
mov r8d, 0x1fe
lea rcx, [rbp + 0xf6d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_VBoxTrayToolWndClass___VBoxTrayToolWnd
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xf6d0]
call fcn.14000b460
lea rdx, str.Checking_VBoxTrayToolWndClass___VBoxTrayToolWnd
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140007b71
lea rcx, [rbp + 0xf6d0]
call fcn.140014310
lea rdx, str.Checking_VirtualBox_Shared_Folders_network_provider
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub qword [rbp + 0x70], 1
jne 0x140007b84
xor edx, edx
mov word [rbp + 0x130f0], di
mov r8d, 0x206
lea rcx, [rbp + 0x130f2]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x230]
mov dword [rbp + 0x230], 0x104
lea rdx, [rbp + 0x130f0]
mov ecx, 0x250000
call qword [sym.imp.MPR.dll_WNetGetProviderNameW]
test eax, eax
jne 0x140007bf6
lea rdx, str.VirtualBox_Shared_Folders
lea rcx, [rbp + 0x130f0]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
mov ebx, edi
sete bl
jmp 0x140007bf8
mov ebx, edi
xor edx, edx
mov word [rbp + 0xf8d0], di
mov r8d, 0x1fe
lea rcx, [rbp + 0xf8d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_VirtualBox_Shared_Folders_network_provider
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xf8d0]
call fcn.14000b460
lea rdx, str.Checking_VirtualBox_Shared_Folders_network_provider
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140007c55
lea rcx, [rbp + 0xf8d0]
call fcn.140014310
lea rax, str.vboxservice.exe
mov esi, 2
mov qword [rsp + 0x50], rax
lea rdi, [rsp + 0x50]
lea rax, str.vboxtray.exe
xor r15d, r15d
mov qword [rsp + 0x58], rax
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x16b0], r15w
mov r8d, 0x1fe
lea rcx, [rbp + 0x16b2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_VirtualBox_process__s
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x16b0]
call fcn.14000b460
mov rcx, qword [rdi]
call fcn.140016d50
lea rdx, [rbp + 0x16b0]
lea rcx, str.____s
test eax, eax
je 0x140007d17
call fcn.14000b0a0
lea rcx, [rbp + 0x16b0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140007ce4
mov ebx, 0x5f
sub rbx, rax
je 0x140007d12
nop dword [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140007d00
mov ecx, r14d
jmp 0x140007d58
call fcn.14000b0a0
lea rcx, [rbp + 0x16b0]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140007d30
mov ebx, 0x5f
sub rbx, rax
je 0x140007d56
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140007d44
xor ecx, ecx
lea rdx, [rbp + 0x16b0]
call fcn.140014610
add rdi, 8
sub rsi, 1
jne 0x140007c80
lea rdx, str.Checking_Win32_PnPDevice_DeviceId_from_WMI_for_VBox_PCI_device
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x20
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140007d90
call fcn.1400132b0
xor esi, esi
lea rcx, [rbp + 0xfad2]
xor edx, edx
mov word [rbp + 0xfad0], si
mov r8d, 0x1fe
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Win32_PnPDevice_DeviceId_from_WMI_for_VBox_PCI_device
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xfad0]
call fcn.14000b460
lea rdx, str.Checking_Win32_PnPDevice_DeviceId_from_WMI_for_VBox_PCI_device
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140007e08
lea rcx, [rbp + 0xfad0]
call fcn.140014310
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBox_controller_hardware
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x1b
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140007e20
call fcn.1400134e0
xor edx, edx
mov word [rbp + 0xfcd0], si
mov r8d, 0x1fe
lea rcx, [rbp + 0xfcd2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBox_controller_hardware
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xfcd0]
call fcn.14000b460
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBox_controller_hardware
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140007e96
lea rcx, [rbp + 0xfcd0]
call fcn.140014310
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBOX_names
lea rcx, str.____s
call fcn.14000b0a0
mov r15d, 0x29
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub r15, 1
jne 0x140007eb0
call fcn.140013c60
xor edx, edx
mov word [rbp + 0xfed0], si
mov r8d, 0x1fe
lea rcx, [rbp + 0xfed2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBOX_names
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xfed0]
call fcn.14000b460
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBOX_names
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140007f26
lea rcx, [rbp + 0xfed0]
call fcn.140014310
lea rdx, str.Checking_Win32_Bus_from_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov r15d, 0x43
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub r15, 1
jne 0x140007f40
call fcn.140013740
xor edx, edx
mov word [rbp + 0x100d0], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x100d2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Win32_Bus_from_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x100d0]
call fcn.14000b460
lea rdx, str.Checking_Win32_Bus_from_WMI
mov ecx, ebx
call fcn.140014610
mov r15d, 0x49
cmp ebx, 1
jne 0x140007fbc
lea rcx, [rbp + 0x100d0]
call fcn.140014310
lea rdx, str.Checking_Win32_BaseBoard_from_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x3d
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140007fd4
call fcn.1400139b0
xor edx, edx
mov word [rbp + 0x102d0], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x102d2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Win32_BaseBoard_from_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x102d0]
call fcn.14000b460
lea rdx, str.Checking_Win32_BaseBoard_from_WMI
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x14000804a
lea rcx, [rbp + 0x102d0]
call fcn.140014310
lea rdx, str.Checking_MAC_address_from_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x41
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140008062
call fcn.140012bd0
xor edx, edx
mov word [rbp + 0x104d0], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x104d2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_MAC_address_from_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x104d0]
call fcn.14000b460
lea rdx, str.Checking_MAC_address_from_WMI
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x1400080d8
lea rcx, [rbp + 0x104d0]
call fcn.140014310
lea rdx, str.Checking_NTEventLog_from_WMI
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x42
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400080f0
call fcn.140012e00
xor edx, edx
mov word [rbp + 0x106d0], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x106d2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_NTEventLog_from_WMI
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x106d0]
call fcn.14000b460
lea rdx, str.Checking_NTEventLog_from_WMI
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140008166
lea rcx, [rbp + 0x106d0]
call fcn.140014310
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x45
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140008180
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], esi
xor edx, edx
mov ecx, 0x52534d42
mov edi, esi
call fcn.140017140
mov rdx, rax
test rax, rax
je 0x14000822f
mov ebx, dword [rsp + 0x40]
mov rcx, rsi
mov eax, ebx
sub rax, 0xa
je 0x1400081e7
movabs r8, 0x426c617574726956
nop word [rax + rax]
cmp qword [rcx + rdx], r8
jne 0x1400081df
cmp word [rcx + rdx + 8], 0x786f
je 0x140008223
inc rcx
cmp rcx, rax
jb 0x1400081d0
mov rcx, rbx
mov rax, rsi
sub rcx, r13
je 0x140008226
cmp dword [rax + rdx], 0x786f6276
je 0x140008223
inc rax
cmp rax, rcx
jb 0x1400081f2
mov rax, rsi
lea rcx, [rbx - 4]
nop word [rax + rax]
cmp dword [rax + rdx], 0x584f4256
je 0x140008223
inc rax
cmp rax, rcx
jb 0x140008210
jmp 0x140008226
mov edi, r14d
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor edx, edx
mov word [rbp + 0x108d0], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x108d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_SMBIOS_firmware
mov dword [rsp + 0x20], edi
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x108d0]
call fcn.14000b460
lea rdx, str.Checking_SMBIOS_firmware
mov ecx, edi
call fcn.140014610
cmp edi, 1
jne 0x14000828c
lea rcx, [rbp + 0x108d0]
call fcn.140014310
lea rdx, str.Checking_ACPI_tables
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, r15
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400082a2
call fcn.140013140
xor edx, edx
mov word [rbp + 0x10ad0], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x10ad2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_ACPI_tables
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x10ad0]
call fcn.14000b460
lea rdx, str.Checking_ACPI_tables
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140008318
lea rcx, [rbp + 0x10ad0]
call fcn.140014310
lea r14, str.Identifier
cmp dword [0x140040084], 0
je 0x140008e13
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x340]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x340]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x348]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.VMWare_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.14000b0a0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.VMWARE
mov qword [rsp + 0x58], r14
lea rax, [0x14001f9f0]
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x50], rax
lea rcx, str.SYSTEMControlSet001ControlSystemInformation
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_1Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp - 0x78], r14
mov qword [rsp + 0x68], rax
lea rdi, [rsp + 0x60]
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_2Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rsp + 0x60], rdx
mov qword [rbp - 0x80], rax
mov r15d, 1
lea rax, str.SystemManufacturer
mov qword [rsp + 0x78], rdx
mov qword [rbp - 0x60], rax
xor r14d, r14d
lea rax, str.SystemProductName
mov qword [rbp - 0x70], rdx
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x40], rdx
nop
xor edx, edx
mov word [rbp + 0x18b0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x18b2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi - 0x10]
lea r8, str.Checking_reg_key__s
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x18b0]
call fcn.14000b460
mov r9, qword [rdi]
mov r8, qword [rdi - 8]
mov rdx, qword [rdi - 0x10]
call fcn.140014d20
lea rdx, [rbp + 0x18b0]
lea rcx, str.____s
test eax, eax
je 0x1400084bb
call fcn.14000b0a0
lea rcx, [rbp + 0x18b0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140008480
mov ebx, 0x5f
sub rbx, rax
je 0x1400084a5
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, r15
jne 0x140008494
mov ecx, r15d
jmp 0x1400084f7
mov r12d, 5
mov r13d, 4
jmp 0x14000831f
call fcn.14000b0a0
lea rcx, [rbp + 0x18b0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400084d0
mov ebx, 0x5f
sub rbx, rax
je 0x1400084f5
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, r15
jne 0x1400084e4
xor ecx, ecx
lea rdx, [rbp + 0x18b0]
call fcn.140014610
add rdi, 0x18
sub r12, r15
jne 0x140008410
xor edx, edx
mov word [rbp + 0x1ab0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x1ab2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREVMware__Inc.VMware_Tools
mov edx, pe_nt_image_headers64
lea r8, [0x14001f670]
lea rcx, [rbp + 0x1ab0]
call fcn.14000b460
lea rax, [rbp + 0x188]
mov qword [rbp + 0x188], r14
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREVMware__Inc.VMware_Tools
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400085e9
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x1ab0]
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [rbp + 0x1ab0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400085b0
mov ebx, 0x5f
sub rbx, rax
je 0x1400085d5
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, r15
jne 0x1400085c4
lea rdx, [rbp + 0x1ab0]
mov ecx, r15d
mov r12, r15
call fcn.140014610
jmp 0x140008646
lea rdx, [rbp + 0x1ab0]
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [rbp + 0x1ab0]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140008610
mov ebx, 0x5f
sub rbx, rax
je 0x140008635
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, r15
jne 0x140008624
lea rdx, [rbp + 0x1ab0]
xor ecx, ecx
call fcn.140014610
mov r12, r15
call fcn.140013f40
lea rax, [0x140021188]
mov qword [rsp + 0x50], rax
lea rdi, [rsp + 0x50]
lea rax, [0x140021190]
mov qword [rsp + 0x58], rax
lea rax, [0x1400211a8]
mov qword [rsp + 0x60], rax
lea rax, [0x1400211b0]
mov qword [rsp + 0x68], rax
lea rax, [0x1400211c8]
mov qword [rsp + 0x70], rax
lea rax, str.00:1C:14
mov qword [rsp + 0x78], rax
lea rax, [0x1400211e8]
mov qword [rbp - 0x80], rax
lea rax, [0x1400211f0]
mov qword [rbp - 0x78], rax
nop
xor edx, edx
mov word [rbp + 0x32b0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x32b2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi + 8]
lea r8, str.Checking_MAC_starting_with__s
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x32b0]
call fcn.14000b460
mov rcx, qword [rdi]
call fcn.140014e10
lea rdx, [rbp + 0x32b0]
lea rcx, str.____s
test eax, eax
je 0x140008747
call fcn.14000b0a0
lea rcx, [rbp + 0x32b0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140008715
mov ebx, 0x5f
sub rbx, rax
je 0x140008742
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140008730
mov ecx, r12d
jmp 0x140008788
call fcn.14000b0a0
lea rcx, [rbp + 0x32b0]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140008760
mov ebx, 0x5f
sub rbx, rax
je 0x140008786
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140008774
xor ecx, ecx
lea rdx, [rbp + 0x32b0]
call fcn.140014610
add rdi, 0x10
sub r13, 1
jne 0x1400086b0
lea rdx, str.Checking_VMWare_network_adapter_name
lea rcx, str.____s
call fcn.14000b0a0
mov ebx, 0x3a
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400087c0
mov dword [rbp + 0x1f0], 0x2c0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x2c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x14000880f
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo._n
call fcn.14000b0a0
mov ebx, r12d
jmp 0x1400088d7
lea rdx, [rbp + 0x1f0]
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x14000887b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x14000886b
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.14000b030
mov ebx, r12d
jmp 0x1400088d7
lea rdx, [rbp + 0x1f0]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1400088c0
mov rdi, rsi
lea rcx, [rdi + 0x110]
call fcn.140014850
mov rbx, rax
test rax, rax
je 0x1400088b8
lea rdx, str.VMWare
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov rcx, rbx
test rax, rax
jne 0x140008a27
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140008882
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, r14d
xor edx, edx
mov word [rbp + 0x10cd0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x10cd2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_VMWare_network_adapter_name
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x10cd0]
call fcn.14000b460
lea rdx, str.Checking_VMWare_network_adapter_name
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140008935
lea rcx, [rbp + 0x10cd0]
call fcn.140014310
lea rax, str..HGFS
mov r14d, 2
mov qword [rsp + 0x50], rax
lea rsi, [rsp + 0x50]
lea rax, str.._vmci
mov r13d, 3
mov qword [rsp + 0x58], rax
xor r15d, r15d
mov rcx, qword [rsi]
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov r8d, r12d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
mov word [rbp + 0x1cb0], r15w
mov r8d, 0x1fe
lea rcx, [rbp + 0x1cb2]
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rsi]
lea r8, str.Checking_device__s
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x1cb0]
call fcn.14000b460
cmp rdi, 0xffffffffffffffff
je 0x140008a49
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x1cb0]
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [rbp + 0x1cb0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x1400089f5
mov ebx, 0x5f
sub rbx, rax
je 0x140008a22
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140008a10
mov ecx, r12d
jmp 0x140008a98
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, r12d
jmp 0x1400088d7
lea rdx, [rbp + 0x1cb0]
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [rbp + 0x1cb0]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140008a70
mov ebx, 0x5f
sub rbx, rax
je 0x140008a96
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140008a84
xor ecx, ecx
lea rdx, [rbp + 0x1cb0]
call fcn.140014610
add rsi, 8
sub r14, 1
jne 0x140008961
lea rdx, str.Checking_VMWare_directory
lea rcx, str.____s
call fcn.14000b0a0
mov edi, 0x45
mov r15d, 0x49
mov ebx, edi
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140008ad2
xor esi, esi
lea rcx, [rbp + 0x13302]
xor edx, edx
mov word [rbp + 0x13300], si
mov r8d, 0x206
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.VMWare_]
xor edx, edx
lea rcx, [rbp + 0x13d50]
mov r8d, 0x1f8
movaps xmmword [rbp + 0x13d40], xmm0
call sub.VCRUNTIME140.dll_memset
call fcn.140014c60
lea rdx, [rbp + 0x13f50]
test eax, eax
je 0x140008b48
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140008b59
xor r9d, r9d
mov r8d, 0x26
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x13d40]
lea rdx, [rbp + 0x13f50]
lea rcx, [rbp + 0x13300]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x13300]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140008b8d
mov ebx, r12d
test al, 0x10
jne 0x140008b8f
mov ebx, esi
xor edx, edx
mov word [rbp + 0x10ed0], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x10ed2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_VMWare_directory
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x10ed0]
call fcn.14000b460
lea rdx, str.Checking_VMWare_directory
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140008bec
lea rcx, [rbp + 0x10ed0]
call fcn.140014310
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, rdi
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140008c02
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], esi
xor edx, edx
mov ecx, 0x52534d42
mov ebx, esi
call fcn.140017140
test rax, rax
je 0x140008c68
mov edx, dword [rsp + 0x40]
mov rcx, rsi
sub rdx, 6
je 0x140008c5f
nop dword [rax]
cmp dword [rcx + rax], 0x61774d56
jne 0x140008c52
cmp word [rcx + rax + 4], 0x6572
je 0x140008c5c
inc rcx
cmp rcx, rdx
jb 0x140008c40
jmp 0x140008c5f
mov ebx, r12d
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor edx, edx
mov word [rbp + 0x110d0], si
mov r8d, 0x1fe
lea rcx, [rbp + 0x110d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_SMBIOS_firmware
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x110d0]
call fcn.14000b460
lea rdx, str.Checking_SMBIOS_firmware
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140008cc5
lea rcx, [rbp + 0x110d0]
call fcn.140014310
lea rdx, str.Checking_ACPI_tables
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, r15
nop dword [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140008ce0
mov ecx, 0x1000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x140008db0
mov rdi, rax
mov ecx, 0x1000
xor eax, eax
mov rdx, r14
rep stosb byte [rdi], al
call fcn.1400170b0
mov ecx, eax
cmp eax, 0xffffffff
je 0x140008db0
shr eax, 2
cmp ecx, 4
jb 0x140008da4
test eax, eax
je 0x140008da4
mov rbx, r14
mov edi, eax
xor r15d, r15d
nop dword [rax]
mov edx, dword [rbx]
lea r8, [rsp + 0x40]
mov ecx, 0x41435049
mov dword [rsp + 0x40], r15d
call fcn.140017140
test rax, rax
je 0x140008d98
mov edx, dword [rsp + 0x40]
mov rcx, r15
sub rdx, 6
je 0x140008d8f
nop dword [rax + rax]
cmp dword [rcx + rax], 0x41574d56
jne 0x140008d82
cmp word [rcx + rax + 4], 0x4552
je 0x140008d8c
inc rcx
cmp rcx, rdx
jb 0x140008d70
jmp 0x140008d8f
mov esi, r12d
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add rbx, 4
sub rdi, 1
jne 0x140008d40
jmp 0x140008da7
mov esi, r12d
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r14d, r14d
lea rcx, [rbp + 0x112d2]
xor edx, edx
mov word [rbp + 0x112d0], r14w
mov r8d, 0x1fe
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_ACPI_tables
mov dword [rsp + 0x20], esi
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x112d0]
call fcn.14000b460
lea rdx, str.Checking_ACPI_tables
mov ecx, esi
call fcn.140014610
cmp esi, 1
jne 0x140008e22
lea rcx, [rbp + 0x112d0]
call fcn.140014310
jmp 0x140008e22
mov r12d, 1
mov r13d, 3
xor r14d, r14d
cmp dword [0x140040080], 0
je 0x1400090d4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x358]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x358]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x360]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Virtual_PC_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.14000b0a0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.VMSrvc.exe
mov esi, 2
mov qword [rsp + 0x50], rax
lea rdi, [rsp + 0x50]
lea rax, str.VMUSrvc.exe
mov qword [rsp + 0x58], rax
nop dword [rax]
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x1eb0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x1eb2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_Virtual_PC_processes__s
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x1eb0]
call fcn.14000b460
mov rcx, qword [rdi]
call fcn.140016d50
lea rdx, [rbp + 0x1eb0]
lea rcx, str.____s
test eax, eax
je 0x140008f57
call fcn.14000b0a0
lea rcx, [rbp + 0x1eb0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008f24
mov ebx, 0x5f
sub rbx, rax
je 0x140008f52
nop dword [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140008f40
mov ecx, r12d
jmp 0x140008f98
call fcn.14000b0a0
lea rcx, [rbp + 0x1eb0]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008f70
mov ebx, 0x5f
sub rbx, rax
je 0x140008f96
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140008f84
xor ecx, ecx
lea rdx, [rbp + 0x1eb0]
call fcn.140014610
add rdi, 8
sub rsi, 1
jne 0x140008ec0
xor edx, edx
mov word [rbp + 0x20b0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x20b2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
mov edx, pe_nt_image_headers64
lea r8, [0x14001f670]
lea rcx, [rbp + 0x20b0]
call fcn.14000b460
lea rax, [rbp + 0x170]
mov qword [rbp + 0x170], r14
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000907b
mov rcx, qword [rbp + 0x170]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x20b0]
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [rbp + 0x20b0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009050
mov ebx, 0x5f
sub rbx, rax
je 0x140009076
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140009064
mov ecx, r12d
jmp 0x1400090c8
lea rdx, [rbp + 0x20b0]
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [rbp + 0x20b0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400090a0
mov ebx, 0x5f
sub rbx, rax
je 0x1400090c6
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400090b4
xor ecx, ecx
lea rdx, [rbp + 0x20b0]
call fcn.140014610
cmp dword [0x14004007c], 0
je 0x1400097aa
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x370]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x370]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x378]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.QEMU_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.14000b0a0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, [0x14001f9f0]
mov esi, 2
mov qword [rsp + 0x50], rax
lea rcx, str.HARDWAREDescriptionSystem
lea rax, str.Identifier
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
lea rcx, str.SystemBiosVersion
lea rax, str.QEMU
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x60], rax
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x78], rax
nop
xor edx, edx
mov word [rbp + 0x22b0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x22b2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi - 0x10]
lea r8, [0x14001f670]
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x22b0]
call fcn.14000b460
mov r9, qword [rdi]
mov r8, qword [rdi - 8]
mov rdx, qword [rdi - 0x10]
call fcn.140014d20
lea rdx, [rbp + 0x22b0]
lea rcx, str.____s
test eax, eax
je 0x14000922b
call fcn.14000b0a0
lea rcx, [rbp + 0x22b0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009200
mov ebx, 0x5f
sub rbx, rax
je 0x140009226
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140009214
mov ecx, r12d
jmp 0x140009268
call fcn.14000b0a0
lea rcx, [rbp + 0x22b0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009240
mov ebx, 0x5f
sub rbx, rax
je 0x140009266
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140009254
xor ecx, ecx
lea rdx, [rbp + 0x22b0]
call fcn.140014610
add rdi, 0x18
sub rsi, 1
jne 0x140009190
lea rax, str.qemu_ga.exe
mov qword [rsp + 0x50], rax
lea rdi, [rsp + 0x50]
lea rax, str.vdagent.exe
mov qword [rsp + 0x58], rax
lea rax, str.vdservice.exe
mov qword [rsp + 0x60], rax
nop dword [rax + rax]
xor edx, edx
mov word [rbp + 0x24b0], r14w
mov r8d, 0x1fe
lea rcx, [rbp + 0x24b2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_qemu_processes__s
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x24b0]
call fcn.14000b460
mov rcx, qword [rdi]
call fcn.140016d50
lea rdx, [rbp + 0x24b0]
lea rcx, str.____s
test eax, eax
je 0x140009347
call fcn.14000b0a0
lea rcx, [rbp + 0x24b0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009314
mov ebx, 0x5f
sub rbx, rax
je 0x140009342
nop dword [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140009330
mov ecx, r12d
jmp 0x140009388
call fcn.14000b0a0
lea rcx, [rbp + 0x24b0]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009360
mov ebx, 0x5f
sub rbx, rax
je 0x140009386
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140009374
xor ecx, ecx
lea rdx, [rbp + 0x24b0]
call fcn.140014610
add rdi, 8
sub r13, 1
jne 0x1400092b0
xor edx, edx
mov word [rbp + 0x36c0], r13w
mov r8d, 0x206
lea rcx, [rbp + 0x36c2]
call sub.VCRUNTIME140.dll_memset
lea rax, str.qemu_ga
mov rdi, r13
mov qword [rsp + 0x50], rax
lea rax, str.SPICE_Guest_Tools
mov qword [rsp + 0x58], rax
nop dword [rax]
xor edx, edx
mov word [rbp + 0x26b0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0x26b2]
call sub.VCRUNTIME140.dll_memset
call fcn.140014c60
lea rdx, [rbp + 0x14160]
test eax, eax
je 0x140009421
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140009432
xor r9d, r9d
mov r8d, 0x26
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov r8, qword [rsp + rdi*8 + 0x50]
lea rdx, [rbp + 0x14160]
lea rcx, [rbp + 0x36c0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea r9, [rbp + 0x36c0]
mov edx, pe_nt_image_headers64
lea r8, str.Checking_QEMU_directory__s
lea rcx, [rbp + 0x26b0]
call fcn.14000b460
lea rcx, [rbp + 0x36c0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400094d7
test al, 0x10
je 0x1400094d7
lea rdx, [rbp + 0x26b0]
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [rbp + 0x26b0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x1400094a1
mov ebx, 0x5f
sub rbx, rax
je 0x1400094d2
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400094c0
mov ecx, r12d
jmp 0x140009528
lea rdx, [rbp + 0x26b0]
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [rbp + 0x26b0]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140009500
mov ebx, 0x5f
sub rbx, rax
je 0x140009526
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140009514
xor ecx, ecx
lea rdx, [rbp + 0x26b0]
call fcn.140014610
inc rdi
cmp rdi, 2
jl 0x1400093e0
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, str.____s
call fcn.14000b0a0
mov r15d, 0x45
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub r15, 1
jne 0x140009560
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], r13d
xor edx, edx
mov ecx, 0x52534d42
mov edi, r13d
call fcn.140017140
mov rdx, rax
mov r15d, 0x49
test rax, rax
je 0x1400095ef
mov ebx, dword [rsp + 0x40]
mov rcx, r13
mov eax, ebx
sub rax, 4
je 0x1400095e6
nop dword [rax + rax]
cmp dword [rcx + rdx], 0x756d6571
je 0x1400095e3
inc rcx
cmp rcx, rax
jb 0x1400095b0
mov rax, r13
lea rcx, [rbx - 4]
nop dword [rax + rax]
cmp dword [rax + rdx], 0x554d4551
je 0x1400095e3
inc rax
cmp rax, rcx
jb 0x1400095d0
jmp 0x1400095e6
mov edi, r12d
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor edx, edx
mov word [rbp + 0x114d0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0x114d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_SMBIOS_firmware
mov dword [rsp + 0x20], edi
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x114d0]
call fcn.14000b460
lea rdx, str.Checking_SMBIOS_firmware
mov ecx, edi
call fcn.140014610
cmp edi, 1
jne 0x14000964d
lea rcx, [rbp + 0x114d0]
call fcn.140014310
lea rdx, str.Checking_ACPI_tables
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub r15, 1
jne 0x140009660
mov ecx, 0x1000
mov r14d, r13d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
test rax, rax
je 0x140009747
mov rdi, rax
mov ecx, 0x1000
xor eax, eax
mov rdx, r15
rep stosb byte [rdi], al
call fcn.1400170b0
mov ecx, eax
cmp eax, 0xffffffff
je 0x140009747
shr eax, 2
cmp ecx, 4
jb 0x14000973b
test eax, eax
je 0x14000973b
mov rdi, r15
mov esi, eax
mov edx, dword [rdi]
lea r8, [rsp + 0x40]
mov ecx, 0x41435049
mov dword [rsp + 0x40], r13d
call fcn.140017140
mov rdx, rax
test rax, rax
je 0x14000972f
mov ebx, dword [rsp + 0x40]
mov rcx, r13
mov eax, ebx
sub rax, 4
je 0x140009726
cmp dword [rcx + rdx], 0x48434f42
je 0x140009723
inc rcx
cmp rcx, rax
jb 0x1400096f1
mov rax, r13
lea rcx, [rbx - 4]
nop dword [rax]
cmp dword [rax + rdx], 0x43505842
je 0x140009723
inc rax
cmp rax, rcx
jb 0x140009710
jmp 0x140009726
mov r14d, r12d
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add rdi, 4
sub rsi, 1
jne 0x1400096c4
jmp 0x14000973e
mov r14d, r12d
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor edx, edx
mov word [rbp + 0x116d0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0x116d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_ACPI_tables
mov dword [rsp + 0x20], r14d
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x116d0]
call fcn.14000b460
lea rdx, str.Checking_ACPI_tables
mov ecx, r14d
call fcn.140014610
cmp r14d, 1
jne 0x1400097ad
lea rcx, [rbp + 0x116d0]
call fcn.140014310
jmp 0x1400097ad
xor r13d, r13d
cmp dword [0x140040074], 0
je 0x1400099a0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x388]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x388]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x390]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Xen_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.14000b0a0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor edx, edx
mov word [rbp + 0x28b0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0x28b2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.xenservice.exe
mov edx, pe_nt_image_headers64
lea r8, str.Checking_Citrix_Xen_process__s
lea rcx, [rbp + 0x28b0]
call fcn.14000b460
lea rcx, str.xenservice.exe
call fcn.140016d50
lea rdx, [rbp + 0x28b0]
lea rcx, str.____s
test eax, eax
je 0x1400098bb
call fcn.14000b0a0
lea rcx, [rbp + 0x28b0]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009890
mov ebx, 0x5f
sub rbx, rax
je 0x1400098b6
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400098a4
mov ecx, r12d
jmp 0x1400098f8
call fcn.14000b0a0
lea rcx, [rbp + 0x28b0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400098d0
mov ebx, 0x5f
sub rbx, rax
je 0x1400098f6
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x1400098e4
xor ecx, ecx
lea rdx, [rbp + 0x28b0]
call fcn.140014610
lea rdx, str.Checking_Mac_Address_start_with_08:16:3E
lea rcx, str.____s
call fcn.14000b0a0
mov r14d, 0x36
mov ebx, r14d
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140009920
lea rcx, [0x140021330]
call fcn.140014e10
xor edx, edx
mov word [rbp + 0x118d0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0x118d2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Mac_Address_start_with_08:16:3E
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x118d0]
call fcn.14000b460
lea rdx, str.Checking_Mac_Address_start_with_08:16:3E
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x1400099a6
lea rcx, [rbp + 0x118d0]
call fcn.140014310
jmp 0x1400099a6
mov r14d, 0x36
cmp dword [0x140040078], 0
je 0x140009cff
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x3a0]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x3a0]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x3a8]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Xen_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.14000b0a0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call fcn.140012400
lea rax, str.SYSTEMControlSet001Services_vioscsi
mov qword [rsp + 0x50], rax
lea rdi, [rsp + 0x50]
lea rax, str.SYSTEMControlSet001Services_viostor
mov qword [rsp + 0x58], rax
lea rax, str.SYSTEMControlSet001ServicesVirtIO_FS_Service
mov qword [rsp + 0x60], rax
lea rax, str.SYSTEMControlSet001ServicesVirtioSerial
mov qword [rsp + 0x68], rax
lea rax, str.SYSTEMControlSet001ServicesBALLOON
mov qword [rsp + 0x70], rax
lea rax, str.SYSTEMControlSet001ServicesBalloonService
mov qword [rsp + 0x78], rax
lea rax, str.SYSTEMControlSet001Services_netkvm
mov qword [rbp - 0x80], rax
nop dword [rax]
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x2ab0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0x2ab2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, [0x14001f670]
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x2ab0]
call fcn.14000b460
mov rdx, qword [rdi]
lea rax, [rbp + 0x178]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp + 0x178], r13
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140009b47
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x2ab0]
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [rbp + 0x2ab0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009b15
mov ebx, 0x5f
sub rbx, rax
je 0x140009b42
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140009b30
mov ecx, r12d
jmp 0x140009b98
lea rdx, [rbp + 0x2ab0]
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [rbp + 0x2ab0]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009b70
mov ebx, 0x5f
sub rbx, rax
je 0x140009b96
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140009b84
xor ecx, ecx
lea rdx, [rbp + 0x2ab0]
call fcn.140014610
add rdi, 8
sub qword [rbp + 0xb0], 1
jne 0x140009a80
lea rdx, str.Checking_KVM_virio_directory
lea rcx, str.____s
call fcn.14000b0a0
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub qword [rbp + 0xa8], 1
jne 0x140009bd0
xor edx, edx
mov word [rbp + 0x13720], r13w
mov r8d, 0x206
lea rcx, [rbp + 0x13722]
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.Virtio_Win_]
xor edx, edx
lea rcx, [rbp + 0x13528]
mov r8d, 0x1f0
movaps xmmword [rbp + 0x13510], xmm0
movsd xmm0, qword [0x14001f938]
movsd qword [rbp + 0x13520], xmm0
call sub.VCRUNTIME140.dll_memset
call fcn.140014c60
lea rdx, [rbp + 0x14370]
test eax, eax
je 0x140009c59
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140009c6a
xor r9d, r9d
mov r8d, 0x26
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x13510]
lea rdx, [rbp + 0x14370]
lea rcx, [rbp + 0x13720]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x13720]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140009c9e
mov ebx, r12d
test al, 0x10
jne 0x140009ca1
mov ebx, r13d
xor edx, edx
mov word [rbp + 0x11ad0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0x11ad2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_KVM_virio_directory
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x11ad0]
call fcn.14000b460
lea rdx, str.Checking_KVM_virio_directory
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140009cff
lea rcx, [rbp + 0x11ad0]
call fcn.140014310
cmp dword [0x140040070], 0
je 0x140009f64
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x3b8]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x3b8]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x3c0]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Wine_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.14000b0a0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Checking_Wine_via_dll_exports
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub qword [rbp + 0xa0], 1
jne 0x140009d81
lea rcx, [0x14001cf10]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140009dba
lea rcx, str.GetModuleHandle
call fcn.140014740
mov ebx, r13d
jmp 0x140009dd3
lea rdx, str.wine_get_unix_file_name
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov ebx, r13d
setne bl
xor edx, edx
mov word [rbp + 0x11cd0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0x11cd2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Wine_via_dll_exports
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x11cd0]
call fcn.14000b460
lea rdx, str.Checking_Wine_via_dll_exports
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x140009e40
lea rcx, [rbp + 0x11cd0]
call fcn.140014310
nop dword [rax]
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x2cb0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0x2cb2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREWine
mov edx, pe_nt_image_headers64
lea r8, [0x14001f670]
lea rcx, [rbp + 0x2cb0]
call fcn.14000b460
lea rax, [rbp + 0x180]
mov qword [rbp + 0x180], r13
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREWine
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140009f0b
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x2cb0]
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [rbp + 0x2cb0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009ee0
mov ebx, 0x5f
sub rbx, rax
je 0x140009f06
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140009ef4
mov ecx, r12d
jmp 0x140009f58
lea rdx, [rbp + 0x2cb0]
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [rbp + 0x2cb0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009f30
mov ebx, 0x5f
sub rbx, rax
je 0x140009f56
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x140009f44
xor ecx, ecx
lea rdx, [rbp + 0x2cb0]
call fcn.140014610
cmp dword [0x14004006c], 0
je 0x14000a18e
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x3d0]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x3d0]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x3d8]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Paralles_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.14000b0a0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.prl_cc.exe
mov esi, 2
mov qword [rsp + 0x50], rax
lea rdi, [rsp + 0x50]
lea rax, str.prl_tools.exe
mov qword [rsp + 0x58], rax
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0x2eb0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0x2eb2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_Parallels_processes:__s
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x2eb0]
call fcn.14000b460
mov rcx, qword [rdi]
call fcn.140016d50
lea rdx, [rbp + 0x2eb0]
lea rcx, str.____s
test eax, eax
je 0x14000a097
call fcn.14000b0a0
lea rcx, [rbp + 0x2eb0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000a064
mov ebx, 0x5f
sub rbx, rax
je 0x14000a092
nop dword [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x14000a080
mov ecx, r12d
jmp 0x14000a0d8
call fcn.14000b0a0
lea rcx, [rbp + 0x2eb0]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000a0b0
mov ebx, 0x5f
sub rbx, rax
je 0x14000a0d6
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x14000a0c4
xor ecx, ecx
lea rdx, [rbp + 0x2eb0]
call fcn.140014610
add rdi, 8
sub rsi, 1
jne 0x14000a000
lea rdx, str.Checking_Mac_Address_start_with_00:1C:42
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, r14
nop dword [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x14000a110
lea rcx, [0x14001f9e8]
call fcn.140014e10
xor edx, edx
mov word [rbp + 0x11ed0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0x11ed2]
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_Mac_Address_start_with_00:1C:42
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x11ed0]
call fcn.14000b460
lea rdx, str.Checking_Mac_Address_start_with_00:1C:42
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x14000a18e
lea rcx, [rbp + 0x11ed0]
call fcn.140014310
cmp dword [0x140040068], 0
je 0x14000a47e
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x3e8]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x3e8]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x3f0]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Hyper_V_Detection
lea rcx, str._n___________________________s___________________________n
call fcn.14000b0a0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Checking_for_Hyper_V_driver_objects
lea rcx, str.____s
call fcn.14000b0a0
mov edi, 0x3b
mov ebx, edi
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x14000a220
lea rcx, str.Driver
call fcn.140017440
test rax, rax
je 0x14000a305
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
cmp rdi, rsi
je 0x14000a300
nop word [rax + rax]
mov rbx, qword [rdi]
lea rdx, str.VMBusHID
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x14000a717
lea rdx, str.vmbus
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x14000a717
lea rdx, str.vmgid
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x14000a717
lea rdx, str.IndirectKmd
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x14000a717
lea rdx, str.HyperVideo
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x14000a717
lea rdx, str.hyperkbd
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x14000a717
add rdi, 8
cmp rdi, rsi
jne 0x14000a260
mov edi, 0x3b
mov ebx, r13d
xor edx, edx
mov word [rbp + 0x120d0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0x120d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_for_Hyper_V_driver_objects
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x120d0]
call fcn.14000b460
lea rdx, str.Checking_for_Hyper_V_driver_objects
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x14000a366
lea rcx, [rbp + 0x120d0]
call fcn.140014310
lea rdx, str.Checking_for_Hyper_V_global_objects
lea rcx, str.____s
call fcn.14000b0a0
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rdi, 1
jne 0x14000a380
lea rcx, str.GLOBAL__
call fcn.140017440
test rax, rax
je 0x14000a41d
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
cmp rdi, rsi
je 0x14000a41d
nop
mov rbx, qword [rdi]
lea rdx, str.VMBUS
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
jne 0x14000a724
lea rdx, str.VDRVROOT
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x14000a724
lea rdx, str.VmGenerationCounter
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x14000a724
lea rdx, str.VmGid
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpCW]
test eax, eax
je 0x14000a724
add rdi, 8
cmp rdi, rsi
jne 0x14000a3b0
mov ebx, r13d
xor edx, edx
mov word [rbp + 0x122d0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0x122d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_for_Hyper_V_global_objects
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x122d0]
call fcn.14000b460
lea rdx, str.Checking_for_Hyper_V_global_objects
mov ecx, ebx
call fcn.140014610
cmp ebx, 1
jne 0x14000a47e
lea rcx, [rbp + 0x122d0]
call fcn.140014310
cmp dword [0x140040060], 0
je 0x14000a786
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x400]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x400]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x408]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Analysis_tools
lea rcx, str._n___________________________s___________________________n
call fcn.14000b0a0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, str.ollydbg.exe
mov qword [rsp + 0x50], rax
lea rax, str.ProcessHacker.exe
mov qword [rsp + 0x58], rax
lea rax, str.tcpview.exe
mov qword [rsp + 0x60], rax
lea rax, str.autoruns.exe
mov qword [rsp + 0x68], rax
lea rax, str.autorunsc.exe
mov qword [rsp + 0x70], rax
lea rax, str.filemon.exe
mov qword [rsp + 0x78], rax
lea rax, str.procmon.exe
mov qword [rbp - 0x80], rax
lea rax, str.regmon.exe
mov qword [rbp - 0x78], rax
lea rax, str.procexp.exe
mov qword [rbp - 0x70], rax
lea rax, str.idaq.exe
mov qword [rbp - 0x68], rax
lea rax, str.idaq64.exe
mov qword [rbp - 0x60], rax
lea rax, str.ImmunityDebugger.exe
mov qword [rbp - 0x58], rax
lea rax, str.Wireshark.exe
mov qword [rbp - 0x50], rax
lea rax, str.dumpcap.exe
mov qword [rbp - 0x48], rax
lea rax, str.HookExplorer.exe
mov qword [rbp - 0x40], rax
lea rax, str.ImportREC.exe
mov qword [rbp - 0x38], rax
lea rax, str.PETools.exe
mov qword [rbp - 0x30], rax
lea rax, str.LordPE.exe
mov qword [rbp - 0x28], rax
lea rax, str.SysInspector.exe
mov qword [rbp - 0x20], rax
lea rax, str.proc_analyzer.exe
mov qword [rbp - 0x18], rax
lea rax, str.sysAnalyzer.exe
mov qword [rbp - 0x10], rax
lea rax, str.sniff_hit.exe
mov qword [rbp - 8], rax
lea rax, str.windbg.exe
mov qword [rbp], rax
lea rax, str.joeboxcontrol.exe
mov qword [rbp + 8], rax
lea rax, str.joeboxserver.exe
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
lea rax, str.ResourceHacker.exe
mov qword [rbp + 0x20], rax
lea rax, str.x32dbg.exe
mov qword [rbp + 0x28], rax
lea rax, str.x64dbg.exe
mov qword [rbp + 0x30], rax
lea rax, str.Fiddler.exe
mov qword [rbp + 0x38], rax
lea rax, str.httpdebugger.exe
mov qword [rbp + 0x40], rax
lea rax, str.cheatengine_i386.exe
mov qword [rbp + 0x48], rax
lea rdi, [rsp + 0x50]
lea rax, str.cheatengine_x86_64.exe
mov qword [rbp + 0x50], rax
lea rax, str.cheatengine_x86_64_SSE4_AVX2.exe
mov qword [rbp + 0x58], rax
lea rax, str.frida_helper_32.exe
mov qword [rbp + 0x60], rax
lea rax, str.frida_helper_64.exe
mov qword [rbp + 0x68], rax
nop dword [rax]
xor edx, edx
mov word [rbp + 0x30b0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0x30b2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
lea r8, str.Checking_process_of_malware_analysis_tool:__s
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x30b0]
call fcn.14000b460
mov rcx, qword [rdi]
call fcn.140016d50
lea rdx, [rbp + 0x30b0]
lea rcx, str.____s
test eax, eax
je 0x14000a72c
call fcn.14000b0a0
lea rcx, [rbp + 0x30b0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000a6e4
mov ebx, 0x5f
sub rbx, rax
je 0x14000a712
nop dword [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x14000a700
mov ecx, r12d
jmp 0x14000a768
mov ebx, r12d
mov edi, 0x3b
jmp 0x14000a308
mov ebx, r12d
jmp 0x14000a420
call fcn.14000b0a0
lea rcx, [rbp + 0x30b0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000a740
mov ebx, 0x5f
sub rbx, rax
je 0x14000a766
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x14000a754
xor ecx, ecx
lea rdx, [rbp + 0x30b0]
call fcn.140014610
add rdi, 8
sub qword [rbp + 0x98], 1
jne 0x14000a680
cmp dword [0x140040064], 0
je 0x14000afeb
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rbp + 0x418]
mov ecx, SafeArrayPutElement
mov rsi, rax
lea rdx, [rbp + 0x418]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [rbp + 0x420]
mov edx, 0xd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Timing_attacks
lea rcx, str._n___________________________s___________________________n
call fcn.14000b0a0
movzx edx, bx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, r12d
lea rcx, str._n___Delay_value_is_set_to__u_minutes_..._n
call fcn.14000b030
lea rdx, str.Performing_a_sleep_using_NtDelayExecution_...
lea rcx, str.____s
call fcn.14000b0a0
mov r15d, 0x32
mov ebx, r15d
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x14000a820
lea rdx, [0x14003f1f0]
mov qword [rbp + 0x280], 0xffffffffdc3cba00
mov rcx, rdx
mov eax, r13d
nop word [rax + rax]
cmp dword [rcx], 0xd
je 0x14000a865
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x14000a850
mov ecx, r12d
jmp 0x14000a8a5
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
jne 0x14000a87a
mov ecx, r12d
jmp 0x14000a8a5
mov eax, r13d
mov rcx, rdx
cmp dword [rcx], 0xd
je 0x14000a94f
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x14000a880
mov rax, r13
lea rdx, [rbp + 0x280]
xor ecx, ecx
call rax
mov ecx, r13d
lea rdx, str.Performing_a_sleep_using_NtDelayExecution_...
call fcn.140014610
lea rdx, str.Performing_a_sleep___in_a_loop_...
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub qword [rbp + 0x90], 1
jne 0x14000a8c4
mov ebx, 0x3e8
nop
mov ecx, 0x3c
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rbx, 1
jne 0x14000a8e0
lea rdx, str.Performing_a_sleep___in_a_loop_...
xor ecx, ecx
call fcn.140014610
lea rdx, str.Delaying_execution_using_SetTimer_...
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub qword [rbp + 0x88], 1
jne 0x14000a912
lea r9, [0x1400176f0]
xor edx, edx
xor ecx, ecx
mov r8d, 0xea60
call qword [sym.imp.USER32.dll_SetTimer]
mov rbx, rax
test rax, rax
jne 0x14000a96d
mov ecx, r12d
jmp 0x14000a9e1
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], 0
je 0x14000a894
mov rax, qword [rdx + rcx*8 + 0x28]
jmp 0x14000a897
xor r9d, r9d
lea rcx, [rbp + 0x4b0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp dword [0x1400400a8], 0
mov ecx, r13d
sete cl
test ecx, eax
je 0x14000a9d3
lea rcx, [rbp + 0x4b0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x4b0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rbp + 0x4b0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp dword [0x1400400a8], 0
mov ecx, r13d
sete cl
test ecx, eax
jne 0x14000a993
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
mov ecx, r13d
lea rdx, str.Delaying_execution_using_SetTimer_...
call fcn.140014610
lea rdx, str.Delaying_execution_using_timeSetEvent_...
lea rcx, str.____s
call fcn.14000b0a0
mov rbx, r14
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x14000aa03
mov edx, 8
lea rcx, [rbp + 0x240]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
mov rax, qword [rbp + 0x240]
lea r8, [0x1400176f0]
mov ebx, dword [rbp + 0x244]
test eax, eax
mov ecx, r13d
mov dword [rsp + 0x20], r13d
cmovne ecx, eax
cmp ecx, ebx
cmovb ebx, ecx
xor r9d, r9d
mov edx, ebx
mov ecx, 0xea60
call qword [sym.imp.WINMM.dll_timeSetEvent]
test eax, eax
jne 0x14000aa66
mov ecx, r12d
jmp 0x14000aa79
mov ecx, eax
call qword [sym.imp.WINMM.dll_timeKillEvent]
mov ecx, ebx
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ecx, r13d
lea rdx, str.Delaying_execution_using_timeSetEvent_...
call fcn.140014610
lea rdx, str.Delaying_execution_using_WaitForSingleObject_...
lea rcx, str.____s
call fcn.14000b0a0
mov esi, 0x2f
mov ebx, esi
nop
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rbx, 1
jne 0x14000aaa0
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
jne 0x14000aad9
lea rcx, [0x140022578]
call fcn.140014740
mov ecx, r12d
jmp 0x14000aaea
mov edx, 0xea60
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, r13d
lea rdx, str.Delaying_execution_using_WaitForSingleObject_...
call fcn.140014610
lea rdx, str.Delaying_execution_using_WaitForMultipleObjects_...
lea rcx, str.____s
call fcn.14000b0a0
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub qword [rbp + 0x80], 1
jne 0x14000ab10
mov ebx, r13d
lea rdi, [rbp + 0xe20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi], rax
test rax, rax
je 0x14000ab73
inc ebx
add rdi, 8
cmp ebx, 2
jb 0x14000ab30
mov r9d, 0xea60
lea rdx, [rbp + 0xe20]
xor r8d, r8d
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ecx, r13d
jmp 0x14000ab82
lea rcx, [0x140022578]
call fcn.140014740
mov ecx, r12d
lea rdx, str.Delaying_execution_using_WaitForMultipleObjects_...
call fcn.140014610
lea rdx, str.Delaying_execution_using_IcmpSendEcho_...
lea rcx, str.____s
call fcn.14000b0a0
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub r14, 1
jne 0x14000aba1
movsd xmm0, qword [str.Data_Buffer]
mov eax, dword [0x140022598]
movsd qword [rbp + 0xe70], xmm0
xorps xmm0, xmm0
mov dword [rbp + 0xe78], eax
xor eax, eax
movups xmmword [rbp + 0xe7c], xmm0
mov dword [rbp + 0xe8c], eax
call qword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000ac15
lea rcx, str._tUnable_to_open_handle._n
call fcn.14000b030
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.IcmpCreatefile_returned_error:__u_n
call fcn.14000b030
mov ecx, r12d
jmp 0x14000ac89
mov ecx, 0x50
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
mov rcx, rbx
test rax, rax
jne 0x14000ac42
call qword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
lea rcx, str._tUnable_to_allocate_memory_n
call fcn.14000b030
mov ecx, r12d
jmp 0x14000ac89
mov dword [rsp + 0x38], 0xea60
lea r8, [rbp + 0xe70]
mov dword [rsp + 0x30], 0x50
mov r9d, 0x20
mov qword [rsp + 0x28], rdi
mov edx, 0xffffffff
mov qword [rsp + 0x20], r13
call qword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
mov rcx, rbx
call qword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, r13d
lea rdx, str.Delaying_execution_using_IcmpSendEcho_...
call fcn.140014610
lea rdx, str.Delaying_execution_using_CreateWaitableTimer_...
lea rcx, str.____s
call fcn.14000b0a0
nop dword [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub rsi, 1
jne 0x14000acb0
xor r8d, r8d
mov qword [rbp + 0x278], 0xffffffffdc3cba00
mov edx, r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov rdi, rax
test rax, rax
jne 0x14000ace8
mov ebx, r12d
jmp 0x14000ad3a
mov dword [rsp + 0x28], r13d
lea rdx, [rbp + 0x278]
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
test eax, eax
jne 0x14000ad11
mov ebx, r12d
jmp 0x14000ad28
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov ebx, r13d
cmovne ebx, r12d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Delaying_execution_using_CreateWaitableTimer_...
mov ecx, ebx
call fcn.140014610
lea rdx, str.Delaying_execution_using_CreateTimerQueueTimer_...
lea rcx, str.____s
call fcn.14000b0a0
nop dword [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub qword [rbp + 0x78], 1
jne 0x14000ad60
xor r9d, r9d
mov qword [rbp + 0x190], r13
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1400400a0], rax
test rax, rax
jne 0x14000ad9b
mov ebx, r13d
jmp 0x14000ae19
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
mov rdi, rax
test rax, rax
jne 0x14000adae
mov ebx, r12d
jmp 0x14000ae19
mov dword [rsp + 0x30], r13d
lea r8, [0x140017700]
mov dword [rsp + 0x28], r13d
lea rcx, [rbp + 0x190]
mov r9d, 0xdeadbeef
mov dword [rsp + 0x20], 0xea60
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
test eax, eax
jne 0x14000ade6
mov ebx, r12d
jmp 0x14000ae01
mov rcx, qword [0x1400400a0]
mov edx, 0x927c0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov ebx, r13d
cmovne ebx, r13d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
mov rcx, qword [0x1400400a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Delaying_execution_using_CreateTimerQueueTimer_...
mov ecx, ebx
call fcn.140014610
lea rdx, str.Checking_RDTSC_Locky_trick
lea rcx, str.____s
call fcn.14000b0a0
nop word [rax + rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub qword [rsp + 0x48], 1
jne 0x14000ae40
mov esi, r13d
nop word [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
rdtsc
shl rdx, 0x20
xor ecx, ecx
or rax, rdx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
rdtsc
shl rdx, 0x20
or rax, rdx
xor edx, edx
sub eax, ebx
sub ebx, edi
div ebx
cmp eax, 0xa
jae 0x14000aea5
inc esi
cmp esi, 0xa
jb 0x14000ae60
jmp 0x14000aea8
mov r12d, r13d
xor edx, edx
mov word [rbp + 0x124d0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0x124d2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_RDTSC_Locky_trick
mov dword [rsp + 0x20], r12d
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x124d0]
call fcn.14000b460
lea rdx, str.Checking_RDTSC_Locky_trick
mov ecx, r12d
call fcn.140014610
cmp r12d, 1
jne 0x14000af09
lea rcx, [rbp + 0x124d0]
call fcn.140014310
lea rdx, str.Checking_RDTSC_which_force_a_VM_Exit__cpuid_
lea rcx, str.____s
call fcn.14000b0a0
nop dword [rax]
lea rcx, [0x1400218b8]
call fcn.14000b0a0
sub r15, 1
jne 0x14000af20
mov r9, r13
mov r8d, 0xa
nop dword [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdi, rax
xor eax, eax
xor ecx, ecx
cpuid
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rdi
add r9, rax
sub r8, 1
jne 0x14000af40
movabs rax, 0xcccccccccccccccd
mov word [rbp + 0x126d0], r13w
mul r9
mov ebx, r13d
lea rcx, [rbp + 0x126d2]
shr rdx, 3
mov r8d, 0x1fe
lea rdi, [rdx - 1]
cmp rdi, 0x3e6
seta bl
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r9, str.Checking_RDTSC_which_force_a_VM_Exit__cpuid_
mov dword [rsp + 0x20], ebx
lea r8, str.____s_____d
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x126d0]
call fcn.14000b460
lea rdx, str.Checking_RDTSC_which_force_a_VM_Exit__cpuid_
mov ecx, ebx
call fcn.140014610
cmp rdi, 0x3e6
jbe 0x14000afeb
lea rcx, [rbp + 0x126d0]
call fcn.140014310
lea rcx, str._n_nAnalysis_done__I_hope_you_didnt_get_red_flags_:_
call fcn.14000b0a0
xor eax, eax
mov rcx, qword [rbp + 0x15780]
xor rcx, rsp
call fcn.1400177b0
lea r11, [rsp + 0x15890]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret