Function at 0x140001440
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check if file exists
Check if process is running under wine
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get common file path
Get file attributes
Get ntdll base address
Get program files directory
Get system information on windows
Query environment variable
Send icmp echo request
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x710]
sub rsp, 0x810
mov rax, qword [0x140054040]
xor rax, rsp
mov qword [rbp + 0x700], rax
movsxd rsi, ecx
mov r13d, 1
xor r12d, r12d
mov r15, rdx
cmp esi, r13d
jle 0x14000153a
cmp rsi, r13
jbe 0x1400015b1
mov edi, r13d
lea ebx, [r13 + 1]
lea r8, str.__check
nop word [rax + rax]
mov rdx, qword [r15 + rdi*8]
mov rax, r12
nop word [rax + rax]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r8 + rax - 1]
jne 0x140001528
cmp rax, 8
jne 0x1400014c0
cmp ebx, esi
jge 0x140001528
mov rdx, qword [r15 + rdi*8 + 8]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r12
mov r8, 0xffffffffffffffff
mov qword [rbp + 0xc8], r12
nop dword [rax]
inc r8
cmp byte [rdx + r8], r12b
jne 0x140001500
lea rcx, [rbp + 0xb0]
call fcn.140004320
lea rcx, [rbp + 0xb0]
call fcn.140001020
lea r8, str.__check
add ebx, 2
add rdi, 2
cmp rdi, rsi
jl 0x1400014b0
jmp 0x1400015b1
mov dword [0x14006d2c4], r13d
mov dword [0x14006d2c0], r13d
mov dword [0x14006d2bc], r13d
mov dword [0x14006d2b8], r13d
mov dword [0x14006d2b4], r13d
mov dword [0x14006d2b0], r13d
mov dword [0x14006d2ac], r13d
mov dword [0x14006d2a8], r13d
mov dword [0x14006d2a4], r13d
mov dword [0x14006d2a0], r13d
mov dword [0x14006d29c], r13d
mov dword [0x14006d298], r13d
mov dword [0x14006d294], r13d
mov dword [0x14006d28c], r13d
mov dword [0x14006d288], r13d
mov dword [0x14006d284], r13d
mov dword [0x14006d280], r13d
lea rcx, str.Al_Khaser___by_Lord_Noteworthy
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 0x64
mov dword [rsp + 0x28], r13d
mov r8d, edx
mov dword [rsp + 0x20], 0x384
mov r9d, 0x384
mov rcx, rax
call qword [sym.imp.USER32.dll_MoveWindow]
lea rcx, str._al_khaser_version_0.82_
call fcn.140004100
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdi, [rsp + 0x48]
mov ecx, SafeArrayPutElement
mov rbx, rax
lea rdx, [rsp + 0x48]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edi, word [rsp + 0x50]
mov edx, 0xd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Initialisation
lea rcx, str._n___________________________s___________________________n
call fcn.140004100
movzx edx, di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r13d, r12d
lea rsi, [0x14006c1ec]
nop word [rax + rax]
mov r15d, dword [rsi + 4]
xor al, al
test dword [rsi - 4], 0xfffffffd
mov r12d, dword [rsi]
jne 0x140001711
xor r14b, r14b
lea rdi, [0x14006c7a8]
xor ebx, ebx
lea rcx, [0x14006c878]
nop dword [rax]
test rbx, rbx
je 0x1400016a7
cmp dword [rdi - 8], r12d
jne 0x1400016a7
mov r14b, 1
call qword [rdi]
lea rcx, [0x14006c878]
inc rbx
add rdi, 0x10
cmp rdi, rcx
jl 0x140001690
test r14b, r14b
jne 0x1400016c1
lea rcx, str.ERROR:_Minimum_version_value_was_invalid._n
jmp 0x14000170a
test al, al
je 0x14000170f
test r15d, r15d
jne 0x1400016ce
mov al, 1
jmp 0x140001711
xor bl, bl
lea rdi, [0x14006c7a8]
xor al, al
nop dword [rax]
cmp dword [rdi - 8], r15d
jne 0x1400016f6
mov bl, 1
call qword [rdi]
test al, al
lea rcx, [0x14006c878]
sete al
add rdi, 0x10
cmp rdi, rcx
jl 0x1400016e0
test bl, bl
jne 0x140001711
lea rcx, str.ERROR:_Removed_version_value_was_invalid._n
call fcn.140004090
xor al, al
mov rcx, qword [rsi - 0x14]
mov byte [rsi + 9], al
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x140001728
mov byte [rsi + 8], al
jmp 0x140001742
mov rdx, qword [rsi - 0xc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rsi + 0xc], rax
setne al
mov byte [rsi + 8], al
inc r13d
add rsi, 0x30
cmp r13d, 0x1f
jb 0x140001660
xor r13d, r13d
lea rcx, [rbp + 0x2e2]
xor edx, edx
mov word [rbp + 0x2e0], r13w
mov r8d, 0x206
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x2e0]
call fcn.14001e710
test eax, eax
je 0x140001795
lea rdx, [rbp + 0x2e0]
lea rcx, str._n___You_are_running:__s_n
call fcn.140004100
mov esi, r13d
lea rdi, [0x14006c1f4]
mov ebx, r13d
cmp byte [rdi + 1], r13b
je 0x1400017c3
cmp byte [rdi], r13b
jne 0x1400017c3
mov r8, qword [rdi - 0x14]
lea rcx, str.___Warning:_API__s__s_was_expected_to_exist_but_was_not_found._n
mov rdx, qword [rdi - 0x1c]
call fcn.140004090
inc esi
inc ebx
add rdi, 0x30
cmp ebx, 0x1f
jb 0x1400017a2
test esi, esi
jne 0x1400017de
lea rcx, str.___All_APIs_present_and_accounted_for._n
call fcn.140004090
call fcn.14001e420
test eax, eax
je 0x1400017f3
lea rcx, str.Process_is_running_under_WOW64_n_n
call fcn.140004100
cmp dword [0x14006d2c0], r13d
je 0x1400018ff
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [rsp + 0x64]
lea r8, [rsp + 0x40]
xorps xmm0, xmm0
lea rdx, [0x140005690]
mov ecx, 4
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x1400018ff
mov rdi, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetElement
lea r8, [rbp + 0xb0]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x1400018ff
mov rbx, r13
cmp dword [rbp + 0xb8], ebx
jbe 0x1400018ff
mov rdi, qword [rbp + 0xb0]
nop dword [rax + rax]
mov r8d, 0x30
lea rdx, [rbp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
jb 0x1400018ee
mov eax, dword [rbp + 0xa4]
test al, 0x10
jne 0x1400018c2
test al, 0x20
jne 0x1400018c2
test al, al
js 0x1400018c2
test al, 0x40
je 0x1400018ee
mov rdx, qword [0x14006d2e8]
cmp rdx, qword [0x14006d2f0]
mov qword [rsp + 0x48], rdi
je 0x1400018e4
mov qword [rdx], rdi
add qword [0x14006d2e8], 8
jmp 0x1400018ee
lea r8, [rsp + 0x48]
call fcn.140005880
mov eax, dword [rbp + 0xb8]
add rbx, rsi
add rdi, rsi
cmp rbx, rax
jb 0x140001890
cmp dword [0x14006d2c4], r13d
je 0x14000193a
lea rcx, str.TLS_Callbacks
call fcn.140011380
lea rdx, str.TLS_process_attach_callback
lea rcx, [0x14000a2a0]
call fcn.140011670
lea rdx, str.TLS_thread_attach_callback
lea rcx, [0x14000a160]
call fcn.140011670
cmp dword [0x14006d2c0], r13d
je 0x140001c38
lea rcx, str.Debugger_Detection
call fcn.140011380
lea rdx, str.Checking_IsDebuggerPresent_API
lea rcx, [0x140004790]
call fcn.140011670
lea rdx, str.Checking_PEB.BeingDebugged
lea rcx, [0x140004520]
call fcn.140011670
lea rdx, str.Checking_CheckRemoteDebuggerPresent_API
lea rcx, [0x140004540]
call fcn.140011670
lea rdx, str.Checking_PEB.NtGlobalFlag
lea rcx, [0x140004b70]
call fcn.140011670
lea rdx, str.Checking_ProcessHeap.Flags
lea rcx, [0x140007970]
call fcn.140011670
lea rdx, str.Checking_ProcessHeap.ForceFlags
lea rcx, [0x1400079c0]
call fcn.140011670
lea rdx, str.Checking_Low_Fragmentation_Heap
lea rcx, [0x1400047a0]
call fcn.140011670
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugPort
lea rcx, [0x140004d20]
call fcn.140011670
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugFlags
lea rcx, [0x140004b90]
call fcn.140011670
lea rdx, str.Checking_NtQueryInformationProcess_with_ProcessDebugObject
lea rcx, [0x140004c30]
call fcn.140011670
lea rdx, str.Checking_WudfIsAnyDebuggerPresent_API
lea rcx, [0x14000abb0]
call fcn.140011670
lea rdx, str.Checking_WudfIsKernelDebuggerPresent_API
lea rcx, [0x14000ac40]
call fcn.140011670
lea rdx, str.Checking_WudfIsUserDebuggerPresent_API
lea rcx, [0x14000acd0]
call fcn.140011670
lea rdx, str.Checking_NtSetInformationThread_with_ThreadHideFromDebugger
lea rcx, [0x140005180]
call fcn.140011670
lea rdx, str.Checking_CloseHandle_with_an_invalide_handle
lea rcx, [0x1400045f0]
call fcn.140011670
lea rdx, str.Checking_NtSystemDebugControl
lea rcx, [0x140005490]
call fcn.140011670
lea rdx, str.Checking_UnhandledExcepFilterTest
lea rcx, [0x14000a430]
call fcn.140011670
lea rdx, str.Checking_OutputDebugString
lea rcx, [0x1400055a0]
call fcn.140011670
lea rdx, str.Checking_Hardware_Breakpoints
lea rcx, [0x140004620]
call fcn.140011670
lea rdx, str.Checking_Software_Breakpoints
lea rcx, [0x14000a060]
call fcn.140011670
lea rdx, str.Checking_Interupt_0x2d
lea rcx, [0x1400046e0]
call fcn.140011670
lea rdx, str.Checking_Interupt_1
lea rcx, [0x140004750]
call fcn.140011670
lea rdx, str.Checking_trap_flag
lea rcx, [0x14000a3d0]
call fcn.140011670
lea rdx, str.Checking_Memory_Breakpoints_PAGE_GUARD
lea rcx, [0x140004930]
call fcn.140011670
lea rdx, str.Checking_If_Parent_Process_is_explorer.exe
lea rcx, [0x140005f10]
call fcn.140011670
lea rdx, str.Checking_SeDebugPrivilege
lea rcx, [0x140009f90]
call fcn.140011670
lea rdx, str.Checking_NtQueryObject_with_ObjectTypeInformation
lea rcx, [0x140004f20]
call fcn.140011670
lea rdx, str.Checking_NtQueryObject_with_ObjectAllTypesInformation
lea rcx, [0x140004dc0]
call fcn.140011670
lea rdx, str.Checking_NtYieldExecution
lea rcx, [0x140005500]
call fcn.140011670
lea rdx, str.Checking_CloseHandle_protected_handle_trick
lea rcx, [0x140009fd0]
call fcn.140011670
lea rdx, str.Checking_NtQuerySystemInformation_with_SystemKernelDebuggerInformation
lea rcx, [0x1400050c0]
call fcn.140011670
lea rdx, str.Checking_SharedUserData__KdDebuggerEnabled
lea rcx, [0x14000a020]
call fcn.140011670
lea rdx, str.Checking_if_process_is_in_a_job
lea rcx, [0x140007a10]
call fcn.140011670
lea rdx, str.Checking_VirtualAlloc_write_watch__buffer_only_
lea rcx, [0x14000a470]
call fcn.140011670
lea rdx, str.Checking_VirtualAlloc_write_watch__API_calls_
lea rcx, [0x14000a5d0]
call fcn.140011670
lea rdx, str.Checking_VirtualAlloc_write_watch__IsDebuggerPresent_
lea rcx, [0x14000a860]
call fcn.140011670
lea rdx, str.Checking_VirtualAlloc_write_watch__code_write_
lea rcx, [0x14000a9d0]
call fcn.140011670
lea rdx, str.Checking_for_page_exception_breakpoints
lea rcx, [0x140005690]
call fcn.140011670
lea rdx, str.Checking_for_API_hooks_outside_module_bounds
lea rcx, [0x140004af0]
call fcn.140011670
cmp dword [0x14006d2bc], r13d
je 0x140001cfc
lea rcx, str.DLL_Injection_Detection
call fcn.140011380
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__32_bit_
lea rcx, [0x140008700]
call fcn.140011670
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__64_bit_
lea rcx, [0x140008710]
call fcn.140011670
lea rdx, str.Enumerating_modules_with_EnumProcessModulesEx__ALL_
lea rcx, [0x140008720]
call fcn.140011670
lea rdx, str.Enumerating_modules_with_ToolHelp32
lea rcx, [0x1400098f0]
call fcn.140011670
lea rdx, str.Enumerating_the_process_LDR_via_LdrEnumerateLoadedModules
lea rcx, [0x140009700]
call fcn.140011670
lea rdx, str.Enumerating_the_process_LDR_directly
lea rcx, [0x140008ee0]
call fcn.140011670
lea rdx, str.Walking_process_memory_with_GetModuleInformation
lea rcx, [0x140008730]
call fcn.140011670
lea rdx, str.Walking_process_memory_for_hidden_modules
lea rcx, [0x1400089c0]
call fcn.140011670
lea rdx, str.Walking_process_memory_for_.NET_module_structures
lea rcx, [0x140008ca0]
call fcn.140011670
cmp dword [0x14006d2b8], r13d
je 0x140002398
lea rcx, str.Generic_Sandboxe_VM_Detection
call fcn.140011380
lea rax, str.avghookx.dll
mov esi, 0xc
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x60]
lea rax, str.avghooka.dll
mov qword [rsp + 0x68], rax
lea rax, str.snxhk.dll
mov qword [rsp + 0x70], rax
lea rax, str.sbiedll.dll
mov qword [rsp + 0x78], rax
lea rax, str.dbghelp.dll
mov qword [rbp - 0x80], rax
lea rax, str.api_log.dll
mov qword [rbp - 0x78], rax
lea rax, str.dir_watch.dll
mov qword [rbp - 0x70], rax
lea rax, str.pstorec.dll
mov qword [rbp - 0x68], rax
lea rax, str.vmcheck.dll
mov qword [rbp - 0x60], rax
lea rax, str.wpespy.dll
mov qword [rbp - 0x58], rax
lea rax, str.cmdvrt64.dll
mov qword [rbp - 0x50], rax
lea rax, str.cmdvrt32.dll
mov qword [rbp - 0x48], rax
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, str.Checking_if_process_loaded_modules_contains:__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, r13d
lea rdx, [rbp + 0xe0]
test rax, rax
setne cl
call fcn.140011550
lea rbx, [rbx + 8]
sub rsi, 1
jne 0x140001db0
call fcn.14000ad60
lea rax, str.CurrentUser
mov qword [rsp + 0x60], rax
lea rax, str.Sandbox
mov qword [rsp + 0x68], rax
lea rax, str.Emily
mov qword [rsp + 0x70], rax
lea rax, str.HAPUBWS
mov qword [rsp + 0x78], rax
lea rax, str.Hong_Lee
mov qword [rbp - 0x80], rax
lea rax, str.IT_ADMIN
mov qword [rbp - 0x78], rax
lea rax, str.Johnson
mov qword [rbp - 0x70], rax
lea rax, str.Miller
mov qword [rbp - 0x68], rax
lea rax, str.milozs
mov qword [rbp - 0x60], rax
lea rax, str.Peter_Wilson
mov qword [rbp - 0x58], rax
lea rax, str.timmy
mov qword [rbp - 0x50], rax
lea rax, str.user
mov qword [rbp - 0x48], rax
lea rax, str.sand_box
mov qword [rbp - 0x40], rax
lea rax, str.malware
mov qword [rbp - 0x38], rax
lea rax, str.maltest
mov qword [rbp - 0x30], rax
lea rax, str.test_user
mov qword [rbp - 0x28], rax
lea rax, str.virus
mov qword [rbp - 0x20], rax
lea rax, str.John_Doe
mov qword [rbp - 0x18], rax
call fcn.14000b020
mov r14, rax
test rax, rax
je 0x140001f4e
lea rbx, [rsp + 0x60]
mov esi, SafeArrayLock
nop word [rax + rax]
mov r9, qword [rbx]
lea r8, str.Checking_if_username_matches_:__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
mov rcx, qword [rbx]
mov rdx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov ecx, r13d
lea rdx, [rbp + 0xe0]
test eax, eax
sete cl
call fcn.140011550
lea rbx, [rbx + 8]
sub rsi, 1
jne 0x140001f00
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rax, str.SANDBOX
mov qword [rsp + 0x60], rax
lea rax, str.7SILVIA
mov qword [rsp + 0x68], rax
lea rax, str.HANSPETER_PC
mov qword [rsp + 0x70], rax
lea rax, str.JOHN_PC
mov qword [rsp + 0x78], rax
lea rax, str.MUELLER_PC
mov qword [rbp - 0x80], rax
lea rax, str.WIN7_TRAPS
mov qword [rbp - 0x78], rax
lea rax, str.FORTINET
mov qword [rbp - 0x70], rax
lea rax, str.TEQUILABOOMBOOM
mov qword [rbp - 0x68], rax
call fcn.14000b0a0
mov r14, rax
test rax, rax
je 0x14000204f
call fcn.14000b120
mov r15, rax
test rax, rax
jne 0x140001fcd
mov rcx, r14
jmp 0x140002049
mov esi, 8
lea rbx, [rsp + 0x60]
lea r12d, [rsi - 7]
nop dword [rax + rax]
mov rdi, qword [rbx]
lea r8, str.Checking_if_hostname_matches_:__s
mov r9, rdi
lea rcx, [rbp + 0xe0]
mov edx, 0x100
call fcn.1400044c0
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140002013
mov ecx, r12d
jmp 0x140002028
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
mov ecx, r13d
cmove ecx, r12d
lea rdx, [rbp + 0xe0]
call fcn.140011550
add rbx, 8
sub rsi, r12
jne 0x140001fe0
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.14000b1d0
lea rdx, str.Checking_Number_of_processors_in_machine
lea rcx, [0x14000b480]
call fcn.140011670
lea rdx, str.Checking_Interupt_Descriptor_Table_location
lea rcx, [0x14000b4a0]
call fcn.140011670
lea rdx, str.Checking_Local_Descriptor_Table_location
lea rcx, [fcn.14000b4c0]
call fcn.140011670
lea rdx, str.Checking_Global_Descriptor_Table_location
lea rcx, [0x14000b4a0]
call fcn.140011670
lea rdx, str.Checking_Store_Task_Register
lea rcx, [fcn.14000b4d0]
call fcn.140011670
lea rdx, str.Checking_Number_of_cores_in_machine_using_WMI
lea rcx, [0x14000b4e0]
call fcn.140011670
lea rdx, str.Checking_hard_disk_size_using_WMI
lea rcx, [0x14000b700]
call fcn.140011670
lea rdx, str.Checking_hard_disk_size_using_DeviceIoControl
lea rcx, [0x14000b950]
call fcn.140011670
lea rdx, str.Checking_SetupDi_diskdrive
lea rcx, [0x14000bc70]
call fcn.140011670
lea rdx, str.Checking_mouse_movement
lea rcx, [0x14000be80]
call fcn.140011670
lea rdx, str.Checking_lack_of_user_input
lea rcx, [0x14000bf10]
call fcn.140011670
lea rdx, str.Checking_memory_space_using_GlobalMemoryStatusEx
lea rcx, [0x14000bfa0]
call fcn.140011670
lea rdx, str.Checking_disk_size_using_GetDiskFreeSpaceEx
lea rcx, [0x14000c000]
call fcn.140011670
lea rdx, str.Checking_if_CPU_hypervisor_field_is_set_using_cpuid_0x1_
lea rcx, [0x14000c0b0]
call fcn.140011670
lea rdx, str.Checking_hypervisor_vendor_using_cpuid_0x40000000_
lea rcx, [0x14000c0d0]
call fcn.140011670
lea rdx, str.Check_if_time_has_been_accelerated
lea rcx, [0x14000c070]
call fcn.140011670
lea rdx, str.VM_Driver_Services
lea rcx, [0x14000ddd0]
call fcn.140011670
lea rdx, str.Checking_SerialNumber_from_BIOS_using_WMI
lea rcx, [0x14000c270]
call fcn.140011670
lea rdx, str.Checking_Model_from_ComputerSystem_using_WMI
lea rcx, [0x14000c4e0]
call fcn.140011670
lea rdx, str.Checking_Manufacturer_from_ComputerSystem_using_WMI
lea rcx, [0x14000c730]
call fcn.140011670
lea rdx, str.Checking_Current_Temperature_using_WMI
lea rcx, [0x14000c990]
call fcn.140011670
lea rdx, str.Checking_ProcessId_using_WMI
lea rcx, [0x14000cb90]
call fcn.140011670
lea rdx, str.Checking_power_capabilities
lea rcx, [0x14000cda0]
call fcn.140011670
lea rdx, str.Checking_CPU_fan_using_WMI
lea rcx, [0x14000ce00]
call fcn.140011670
lea rdx, str.Checking_NtQueryLicenseValue_with_Kernel_VMDetection_Private
lea rcx, [0x14000cfc0]
call fcn.140011670
lea rdx, str.Checking_Win32_CacheMemory_with_WMI
lea rcx, [0x14000d280]
call fcn.140011670
lea rdx, str.Checking_Win32_PhysicalMemory_with_WMI
lea rcx, [0x14000d2a0]
call fcn.140011670
lea rdx, str.Checking_Win32_MemoryDevice_with_WMI
lea rcx, [0x14000d2c0]
call fcn.140011670
lea rdx, str.Checking_Win32_MemoryArray_with_WMI
lea rcx, [0x14000d2e0]
call fcn.140011670
lea rdx, str.Checking_Win32_VoltageProbe_with_WMI
lea rcx, [0x14000d300]
call fcn.140011670
lea rdx, str.Checking_Win32_PortConnector_with_WMI
lea rcx, [0x14000d320]
call fcn.140011670
lea rdx, str.Checking_Win32_SMBIOSMemory_with_WMI
lea rcx, [0x14000d340]
call fcn.140011670
lea rdx, str.Checking_ThermalZoneInfo_performance_counters_with_WMI
lea rcx, [0x14000d360]
call fcn.140011670
lea rdx, str.Checking_CIM_Memory_with_WMI
lea rcx, [0x14000d380]
call fcn.140011670
lea rdx, str.Checking_CIM_Sensor_with_WMI
lea rcx, [0x14000d3e0]
call fcn.140011670
lea rdx, str.Checking_CIM_NumericSensor_with_WMI
lea rcx, [0x14000d3a0]
call fcn.140011670
lea rdx, str.Checking_CIM_TemperatureSensor_with_WMI
lea rcx, [0x14000d420]
call fcn.140011670
lea rdx, str.Checking_CIM_VoltageSensor_with_WMI
lea rcx, [0x14000d440]
call fcn.140011670
lea rdx, str.Checking_CIM_PhysicalConnector_with_WMI
lea rcx, [0x14000d3c0]
call fcn.140011670
lea rdx, str.Checking_CIM_Slot_with_WMI
lea rcx, [0x14000d400]
call fcn.140011670
lea rdx, str.Checking_if_Windows_is_Genuine
lea rcx, [0x14000d460]
call fcn.140011670
lea rdx, str.Checking_ServicesDiskEnum_entries_for_VM_strings
lea rcx, [0x14000d4e0]
call fcn.140011670
lea rdx, str.Checking_EnumIDE_and_EnumSCSI_entries_for_VM_strings
lea rcx, [0x14000d680]
call fcn.140011670
lea rdx, str.Checking_SMBIOS_tables
lea rcx, [0x14000d8b0]
call fcn.140011670
cmp dword [0x14006d2b4], r13d
lea rsi, [0x140046e50]
mov r12d, 5
lea rdi, str.Identifier
lea rbx, str.HARDWAREDescriptionSystem
lea r14, str.SystemBiosVersion
lea r15d, [r12 - 2]
je 0x140002a16
lea rcx, str.VirtualBox_Detection
call fcn.140011380
lea rax, str.VBOX
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], rax
lea rsi, [rsp + 0x68]
mov qword [rbp - 0x78], rax
lea rax, str.VideoBiosVersion
mov qword [rbp - 0x68], rax
lea rax, str.VIRTUALBOX
mov qword [rbp - 0x60], rax
lea rax, str.SystemBiosDate
mov qword [rbp - 0x50], rax
lea rax, str.06_23_99
mov qword [rbp - 0x80], r14
lea r14d, [r12 - 1]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x58], rbx
nop dword [rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov rdi, qword [rsi + 8]
lea r8, str.Checking_reg_key_HARDWAREDescriptionSystem____s_is_set_to__s
mov r9, qword [rsi]
lea rcx, [rbp + 0xe0]
mov edx, 0x100
mov qword [rsp + 0x20], rdi
call fcn.1400044c0
mov r8, qword [rsi]
mov r9, rdi
mov rdx, qword [rsi - 8]
call fcn.14001e4e0
test eax, eax
lea rdx, [rbp + 0xe0]
mov ecx, r13d
setne cl
call fcn.140011550
lea rsi, [rsi + 0x18]
sub r14, 1
jne 0x140002440
lea rdx, str.Checking_VirtualBox_Guest_Additions_directory
lea rcx, [0x14000e090]
call fcn.140011670
lea rax, str.System32driversVBoxMouse.sys
mov word [rbp + 0x4f0], r13w
mov qword [rsp + 0x60], rax
lea rcx, [rbp + 0x4f2]
lea rax, str.System32driversVBoxGuest.sys
xor edx, edx
mov qword [rsp + 0x68], rax
mov r8d, 0x206
lea rax, str.System32driversVBoxSF.sys
mov qword [rsp + 0x70], rax
lea rax, str.System32driversVBoxVideo.sys
mov qword [rsp + 0x78], rax
lea rax, str.System32_vboxdisp.dll
mov qword [rbp - 0x80], rax
lea rax, str.System32_vboxhook.dll
mov qword [rbp - 0x78], rax
lea rax, str.System32_vboxmrxnp.dll
mov qword [rbp - 0x70], rax
lea rax, str.System32_vboxogl.dll
mov qword [rbp - 0x68], rax
lea rax, str.System32_vboxoglarrayspu.dll
mov qword [rbp - 0x60], rax
lea rax, str.System32_vboxoglcrutil.dll
mov qword [rbp - 0x58], rax
lea rax, str.System32_vboxoglerrorspu.dll
mov qword [rbp - 0x50], rax
lea rax, str.System32_vboxoglfeedbackspu.dll
mov qword [rbp - 0x48], rax
lea rax, str.System32_vboxoglpackspu.dll
mov qword [rbp - 0x40], rax
lea rax, str.System32_vboxoglpassthroughspu.dll
mov qword [rbp - 0x38], rax
lea rax, str.System32_vboxservice.exe
mov qword [rbp - 0x30], rax
lea rax, str.System32_vboxtray.exe
mov qword [rbp - 0x28], rax
lea rax, str.System32VBoxControl.exe
mov qword [rbp - 0x20], rax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov word [rbp + 0x2e0], r13w
mov r8d, 0x206
lea rcx, [rbp + 0x2e2]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x104
mov qword [rsp + 0x40], r13
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call fcn.14001e420
test eax, eax
je 0x1400025e2
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov rdi, r13
mov r15d, 1
nop dword [rax + rax]
mov r8, qword [rsp + rdi*8 + 0x60]
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x2e0]
mov edx, 0x100
lea r8, str.Checking_file__s
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000265d
mov ecx, r15d
test al, 0x10
je 0x140002660
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140011550
inc rdi
cmp rdi, 0x11
jl 0x1400025f0
call fcn.14001e420
mov r15d, 3
test eax, eax
je 0x140002693
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
lea rax, str.HARDWAREACPIDSDTVBOX__
mov esi, 9
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x60]
lea rax, str.HARDWAREACPIFADTVBOX__
mov qword [rsp + 0x68], rax
lea rax, str.HARDWAREACPIRSDTVBOX__
mov qword [rsp + 0x70], rax
lea r12d, [rsi - 8]
lea rax, str.SOFTWAREOracleVirtualBox_Guest_Additions
mov qword [rsp + 0x78], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxGuest
mov qword [rbp - 0x80], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxMouse
mov qword [rbp - 0x78], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxService
mov qword [rbp - 0x70], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxSF
mov qword [rbp - 0x68], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxVideo
mov qword [rbp - 0x60], rax
nop dword [rax + rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, [0x140046ad0]
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
mov rdx, qword [rbx]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x40], r13
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002783
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, r12d
jmp 0x140002786
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140011550
add rbx, 8
sub rsi, r12
jne 0x140002710
lea rdx, str.Checking_Mac_Address_start_with_08:00:27
lea rcx, [0x14000e1b0]
call fcn.140011670
lea rdx, str.Checking_MAC_address__Hybrid_Analysis_
lea rcx, [0x14000b470]
call fcn.140011670
lea rax, [0x1400479c0]
mov qword [rbp + 0xb0], rax
lea rbx, [rbp + 0xb0]
lea rax, str..VBoxGuest
mov qword [rbp + 0xb8], rax
lea r14d, [rsi + 5]
lea rax, str..pipeVBoxMiniRdDN
mov qword [rbp + 0xc0], rax
lea rax, str..VBoxTrayIPC
mov qword [rbp + 0xc8], rax
lea rax, str..pipeVBoxTrayIPC
mov qword [rbp + 0xd0], rax
nop word [rax + rax]
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov r8d, r12d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
mov rsi, rax
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, str.Checking_device__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
cmp rsi, 0xffffffffffffffff
je 0x140002894
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, r12d
jmp 0x140002897
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140011550
add rbx, 8
sub r14, r12
jne 0x140002820
lea rdx, str.Checking_VBoxTrayToolWndClass___VBoxTrayToolWnd
lea rcx, [0x14000e1c0]
call fcn.140011670
lea rdx, str.Checking_VirtualBox_Shared_Folders_network_provider
lea rcx, [0x14000e210]
call fcn.140011670
lea rax, str.vboxservice.exe
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x48]
lea rax, str.vboxtray.exe
mov qword [rsp + 0x50], rax
lea esi, [r14 + 2]
lea r12d, [r14 + 5]
nop dword [rax + rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, str.Checking_VirtualBox_process__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
mov rcx, qword [rbx]
call fcn.140020500
test eax, eax
lea rdx, [rbp + 0xe0]
mov ecx, r13d
setne cl
call fcn.140011550
lea rbx, [rbx + 8]
sub rsi, 1
jne 0x140002900
lea rdx, str.Checking_Win32_PnPDevice_DeviceId_from_WMI_for_VBox_PCI_device
lea rcx, [0x14000ea40]
call fcn.140011670
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBox_controller_hardware
lea rcx, [0x14000ec70]
call fcn.140011670
lea rdx, str.Checking_Win32_PnPDevice_Name_from_WMI_for_VBOX_names
lea rcx, [0x14000f3d0]
call fcn.140011670
lea rdx, str.Checking_Win32_Bus_from_WMI
lea rcx, [0x14000eed0]
call fcn.140011670
lea rdx, str.Checking_Win32_BaseBoard_from_WMI
lea rcx, [0x14000f130]
call fcn.140011670
lea rdx, str.Checking_MAC_address_from_WMI
lea rcx, [0x14000e2b0]
call fcn.140011670
lea rdx, str.Checking_NTEventLog_from_WMI
lea rcx, [0x14000e4e0]
call fcn.140011670
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, [0x14000e820]
call fcn.140011670
lea rdx, str.Checking_ACPI_tables
lea rcx, [0x14000e8d0]
call fcn.140011670
lea rdi, str.Identifier
lea rsi, [0x140046e50]
cmp dword [0x14006d2b0], r13d
je 0x140002f1c
lea rcx, str.VMWare_Detection
call fcn.140011380
lea rdx, str.VMWARE
mov qword [rsp + 0x60], rsi
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_1Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rax
lea rcx, str.SYSTEMControlSet001ControlSystemInformation
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_2Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rsp + 0x70], rdx
mov qword [rbp - 0x70], rax
lea rbx, [rsp + 0x70]
lea rax, str.SystemManufacturer
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x50], rax
lea rax, str.SystemProductName
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x78], rdx
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], rdx
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x30], rdx
nop
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx - 0x10]
lea r8, str.Checking_reg_key__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
mov r9, qword [rbx]
mov r8, qword [rbx - 8]
mov rdx, qword [rbx - 0x10]
call fcn.14001e4e0
test eax, eax
lea rdx, [rbp + 0xe0]
mov ecx, r13d
setne cl
call fcn.140011550
lea rbx, [rbx + 0x18]
sub r12, 1
jne 0x140002aa0
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREVMware__Inc.VMware_Tools
mov edx, 0x100
lea r8, [0x140046ad0]
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREVMware__Inc.VMware_Tools
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002b87
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12d, 1
mov ecx, r12d
jmp 0x140002b90
mov ecx, r13d
mov r12d, 1
lea rdx, [rbp + 0xe0]
call fcn.140011550
lea rax, str.System32drivers_vmnet.sys
mov word [rbp + 0x4f0], r13w
mov qword [rsp + 0x60], rax
lea rcx, [rbp + 0x4f2]
lea rax, str.System32drivers_vmmouse.sys
xor edx, edx
mov qword [rsp + 0x68], rax
mov r8d, 0x206
lea rax, str.System32drivers_vmusb.sys
mov qword [rsp + 0x70], rax
lea rax, str.System32drivers_vm3dmp.sys
mov qword [rsp + 0x78], rax
lea rax, str.System32drivers_vmci.sys
mov qword [rbp - 0x80], rax
lea rax, str.System32drivers_vmhgfs.sys
mov qword [rbp - 0x78], rax
lea rax, str.System32drivers_vmmemctl.sys
mov qword [rbp - 0x70], rax
lea rax, str.System32drivers_vmx86.sys
mov qword [rbp - 0x68], rax
lea rax, str.System32drivers_vmrawdsk.sys
mov qword [rbp - 0x60], rax
lea rax, str.System32drivers_vmusbmouse.sys
mov qword [rbp - 0x58], rax
lea rax, str.System32drivers_vmkdb.sys
mov qword [rbp - 0x50], rax
lea rax, str.System32drivers_vmnetuserif.sys
mov qword [rbp - 0x48], rax
lea rax, str.System32drivers_vmnetadapter.sys
mov qword [rbp - 0x40], rax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov word [rbp + 0x2e0], r13w
mov r8d, 0x206
lea rcx, [rbp + 0x2e2]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x104
mov qword [rsp + 0x40], r13
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call fcn.14001e420
test eax, eax
je 0x140002c92
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov rdi, r13
nop word [rax + rax]
mov r8, qword [rsp + rdi*8 + 0x60]
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x2e0]
mov edx, 0x100
lea r8, str.Checking_file__s
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002d0d
mov ecx, r12d
test al, 0x10
je 0x140002d10
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140011550
inc rdi
cmp rdi, 0xd
jl 0x140002ca0
call fcn.14001e420
test eax, eax
je 0x140002d3d
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
lea rax, [0x1400485e8]
mov ebx, 4
mov qword [rsp + 0x60], rax
lea rdi, [rsp + 0x60]
lea rax, [0x1400485f0]
mov qword [rsp + 0x68], rax
lea rax, [0x140048608]
mov qword [rsp + 0x70], rax
lea rax, [0x140048610]
mov qword [rsp + 0x78], rax
lea rax, [0x140048628]
mov qword [rbp - 0x80], rax
lea rax, str.00:1C:14
mov qword [rbp - 0x78], rax
lea rax, [0x140048648]
mov qword [rbp - 0x70], rax
lea rax, [0x140048650]
mov qword [rbp - 0x68], rax
nop dword [rax]
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi + 8]
lea r8, str.Checking_MAC_starting_with__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
mov rcx, qword [rdi]
call fcn.14001e5d0
test eax, eax
lea rdx, [rbp + 0xe0]
mov ecx, r13d
setne cl
call fcn.140011550
lea rdi, [rdi + 0x10]
sub rbx, 1
jne 0x140002db0
lea rdx, str.Checking_VMWare_network_adapter_name
lea rcx, [0x14000f790]
call fcn.140011670
lea rax, str..HGFS
mov r14d, 2
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x48]
lea rax, str.._vmci
mov qword [rsp + 0x50], rax
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov r8d, r12d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
mov rsi, rax
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, str.Checking_device__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
cmp rsi, 0xffffffffffffffff
je 0x140002ec4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, r12d
jmp 0x140002ec7
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140011550
add rbx, 8
sub r14, 1
jne 0x140002e50
lea rdx, str.Checking_VMWare_directory
lea rcx, [0x14000f6b0]
call fcn.140011670
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, [0x14000f8f0]
call fcn.140011670
lea rdx, str.Checking_ACPI_tables
lea rcx, [0x14000f970]
call fcn.140011670
jmp 0x140002f22
mov r12d, 1
cmp dword [0x14006d2ac], r13d
je 0x140003047
lea rcx, str.Virtual_PC_Detection
call fcn.140011380
lea rax, str.VMSrvc.exe
mov esi, 2
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x48]
lea rax, str.VMUSrvc.exe
mov qword [rsp + 0x50], rax
nop dword [rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, str.Checking_Virtual_PC_processes__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
mov rcx, qword [rbx]
call fcn.140020500
test eax, eax
lea rdx, [rbp + 0xe0]
mov ecx, r13d
setne cl
call fcn.140011550
lea rbx, [rbx + 8]
sub rsi, 1
jne 0x140002f60
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
mov edx, 0x100
lea r8, [0x140046ad0]
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003038
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, r12d
jmp 0x14000303b
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140011550
cmp dword [0x14006d2a8], r13d
je 0x1400032e3
lea rcx, str.QEMU_Detection
call fcn.140011380
lea rax, [0x140046e50]
mov esi, 2
mov qword [rbp + 0xb0], rax
lea rcx, str.HARDWAREDescriptionSystem
lea rax, str.Identifier
mov qword [rbp + 0xc8], rcx
mov qword [rbp + 0xb8], rax
lea rcx, str.SystemBiosVersion
lea rax, str.QEMU
mov qword [rbp + 0xd0], rcx
mov qword [rbp + 0xc0], rax
lea rbx, [rbp + 0xc0]
mov qword [rbp + 0xd8], rax
nop dword [rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx - 0x10]
lea r8, [0x140046ad0]
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
mov r9, qword [rbx]
mov r8, qword [rbx - 8]
mov rdx, qword [rbx - 0x10]
call fcn.14001e4e0
test eax, eax
lea rdx, [rbp + 0xe0]
mov ecx, r13d
setne cl
call fcn.140011550
lea rbx, [rbx + 0x18]
sub rsi, 1
jne 0x1400030c0
lea rax, str.qemu_ga.exe
mov qword [rbp + 0xb0], rax
lea rbx, [rbp + 0xb0]
lea rax, str.vdagent.exe
mov qword [rbp + 0xb8], rax
lea rax, str.vdservice.exe
mov qword [rbp + 0xc0], rax
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, str.Checking_qemu_processes__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
mov rcx, qword [rbx]
call fcn.140020500
test eax, eax
lea rdx, [rbp + 0xe0]
mov ecx, r13d
setne cl
call fcn.140011550
lea rbx, [rbx + 8]
sub r15, 1
jne 0x140003160
xor edx, edx
mov word [rbp + 0x2e0], r13w
mov r8d, 0x206
lea rcx, [rbp + 0x2e2]
call sub.VCRUNTIME140.dll_memset
lea rax, str.qemu_ga
mov rdi, r13
mov qword [rsp + 0x48], rax
lea rax, str.SPICE_Guest_Tools
mov qword [rsp + 0x50], rax
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
call fcn.14001e420
lea rdx, [rbp + 0x4f0]
test eax, eax
je 0x140003241
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140003250
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov r8, qword [rsp + rdi*8 + 0x48]
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea r9, [rbp + 0x2e0]
mov edx, 0x100
lea r8, str.Checking_QEMU_directory__s
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400032a1
mov ecx, r12d
test al, 0x10
jne 0x1400032a4
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140011550
inc rdi
cmp rdi, 2
jl 0x140003200
lea rdx, str.Checking_SMBIOS_firmware
lea rcx, [0x14000dc30]
call fcn.140011670
lea rdx, str.Checking_ACPI_tables
lea rcx, [0x14000dcb0]
call fcn.140011670
cmp dword [0x14006d2a0], r13d
je 0x140003366
lea rcx, str.Xen_Detection
call fcn.140011380
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.xenservice.exe
mov edx, 0x100
lea r8, str.Checking_Citrix_Xen_process__s
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
lea rcx, str.xenservice.exe
call fcn.140020500
test eax, eax
lea rdx, [rbp + 0xe0]
mov ecx, r13d
setne cl
call fcn.140011550
lea rdx, str.Checking_Mac_Address_start_with_08:16:3E
lea rcx, [0x14000fae0]
call fcn.140011670
cmp dword [0x14006d2a4], r13d
je 0x140003603
lea rcx, str.Xen_Detection
call fcn.140011380
lea rax, str.System32drivers_balloon.sys
mov word [rbp + 0x4f0], r13w
mov qword [rsp + 0x60], rax
lea rcx, [rbp + 0x4f2]
lea rax, str.System32drivers_netkvm.sys
xor edx, edx
mov qword [rsp + 0x68], rax
mov r8d, 0x206
lea rax, str.System32driverspvpanic.sys
mov qword [rsp + 0x70], rax
lea rax, str.System32drivers_viofs.sys
mov qword [rsp + 0x78], rax
lea rax, str.System32drivers_viogpudo.sys
mov qword [rbp - 0x80], rax
lea rax, str.System32drivers_vioinput.sys
mov qword [rbp - 0x78], rax
lea rax, str.System32drivers_viorng.sys
mov qword [rbp - 0x70], rax
lea rax, str.System32drivers_vioscsi.sys
mov qword [rbp - 0x68], rax
lea rax, str.System32drivers_vioser.sys
mov qword [rbp - 0x60], rax
lea rax, str.System32drivers_viostor.sys
mov qword [rbp - 0x58], rax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov word [rbp + 0x2e0], r13w
mov r8d, 0x206
lea rcx, [rbp + 0x2e2]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x104
mov qword [rsp + 0x40], r13
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call fcn.14001e420
test eax, eax
je 0x140003454
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov rdi, r13
nop word [rax + rax]
mov r8, qword [rsp + rdi*8 + 0x60]
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x2e0]
mov edx, 0x100
lea r8, str.Checking_file__s
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400034cd
mov ecx, r12d
test al, 0x10
je 0x1400034d0
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140011550
inc rdi
cmp rdi, 0xa
jl 0x140003460
call fcn.14001e420
test eax, eax
je 0x1400034fd
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
lea rax, str.SYSTEMControlSet001Services_vioscsi
mov esi, 7
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x60]
lea rax, str.SYSTEMControlSet001Services_viostor
mov qword [rsp + 0x68], rax
lea rax, str.SYSTEMControlSet001ServicesVirtIO_FS_Service
mov qword [rsp + 0x70], rax
lea rax, str.SYSTEMControlSet001ServicesVirtioSerial
mov qword [rsp + 0x78], rax
lea rax, str.SYSTEMControlSet001ServicesBALLOON
mov qword [rbp - 0x80], rax
lea rax, str.SYSTEMControlSet001ServicesBalloonService
mov qword [rbp - 0x78], rax
lea rax, str.SYSTEMControlSet001Services_netkvm
mov qword [rbp - 0x70], rax
nop dword [rax + rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, [0x140046ad0]
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
mov rdx, qword [rbx]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x40], r13
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400035d3
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, r12d
jmp 0x1400035d6
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140011550
add rbx, 8
sub rsi, 1
jne 0x140003560
lea rdx, str.Checking_KVM_virio_directory
lea rcx, [0x14000db30]
call fcn.140011670
cmp dword [0x14006d29c], r13d
je 0x1400036b9
lea rcx, str.Wine_Detection
call fcn.140011380
lea rdx, str.Checking_Wine_via_dll_exports
lea rcx, [0x14000fa90]
call fcn.140011670
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
lea r9, str.SOFTWAREWine
mov edx, 0x100
lea r8, [0x140046ad0]
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r13
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREWine
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400036aa
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, r12d
jmp 0x1400036ad
mov ecx, r13d
lea rdx, [rbp + 0xe0]
call fcn.140011550
cmp dword [0x14006d298], r13d
je 0x140003770
lea rcx, str.Paralles_Detection
call fcn.140011380
lea rax, str.prl_cc.exe
mov esi, 2
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x48]
lea rax, str.prl_tools.exe
mov qword [rsp + 0x50], rax
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, str.Checking_Parallels_processes:__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
mov rcx, qword [rbx]
call fcn.140020500
test eax, eax
lea rdx, [rbp + 0xe0]
mov ecx, r13d
setne cl
call fcn.140011550
lea rbx, [rbx + 8]
sub rsi, 1
jne 0x140003700
lea rdx, str.Checking_Mac_Address_start_with_00:1C:42
lea rcx, [0x14000dc20]
call fcn.140011670
cmp dword [0x14006d294], r13d
je 0x1400037ab
lea rcx, str.Hyper_V_Detection
call fcn.140011380
lea rdx, str.Checking_for_Hyper_V_driver_objects
lea rcx, [0x14000d970]
call fcn.140011670
lea rdx, str.Checking_for_Hyper_V_global_objects
lea rcx, [0x14000da70]
call fcn.140011670
cmp dword [0x14006d290], r13d
je 0x1400037cd
call fcn.14000faf0
call fcn.140010cc0
call fcn.14000ff00
call fcn.140010880
call fcn.140010360
cmp dword [0x14006d28c], r13d
je 0x140003d4e
lea rcx, str.Timing_attacks
call fcn.140011380
xor edx, edx
lea rcx, str._n___Delay_value_is_set_to__u_minutes_..._n
call fcn.140004090
lea rdx, str.Performing_a_sleep_using_NtDelayExecution_...
lea rcx, str.____s
call fcn.140004100
lea rdx, [0x14006c1d0]
mov qword [rsp + 0x48], 0xffffffffff676980
mov rcx, rdx
mov eax, r13d
nop dword [rax]
cmp dword [rcx], 0xd
je 0x140003835
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140003820
mov ecx, r12d
jmp 0x140003873
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], r13b
jne 0x14000384a
mov ecx, r12d
jmp 0x140003873
mov eax, r13d
mov rcx, rdx
cmp dword [rcx], 0xd
je 0x1400038ee
inc eax
add rcx, 0x30
cmp eax, 0x1f
jb 0x140003850
mov rax, r13
lea rdx, [rsp + 0x48]
xor ecx, ecx
call rax
mov ecx, r13d
lea rdx, str.Performing_a_sleep_using_NtDelayExecution_...
call fcn.140011420
lea rdx, str.Performing_a_sleep___in_a_loop_...
lea rcx, str.____s
call fcn.140004100
mov edi, 0x3e8
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rdi, 1
jne 0x140003897
lea rdx, str.Performing_a_sleep___in_a_loop_...
xor ecx, ecx
call fcn.140011420
lea rdx, str.Delaying_execution_using_SetTimer_...
lea rcx, str.____s
call fcn.140004100
lea r9, [0x140020e90]
xor edx, edx
xor ecx, ecx
mov r8d, 0x3e8
call qword [sym.imp.USER32.dll_SetTimer]
mov rdi, rax
test rax, rax
jne 0x14000390c
mov ecx, r12d
jmp 0x14000397e
cdqe
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], r13b
je 0x140003864
mov rax, qword [rdx + rcx*8 + 0x28]
jmp 0x140003867
xor r9d, r9d
lea rcx, [rbp + 0x80]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
mov ecx, r13d
cmp dword [0x14006d2d8], ecx
sete cl
test ecx, eax
je 0x140003970
lea rcx, [rbp + 0x80]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x80]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rbp + 0x80]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
mov ecx, r13d
cmp dword [0x14006d2d8], ecx
sete cl
test ecx, eax
jne 0x140003931
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
mov ecx, r13d
lea rdx, str.Delaying_execution_using_SetTimer_...
call fcn.140011420
lea rdx, str.Delaying_execution_using_timeSetEvent_...
lea rcx, str.____s
call fcn.140004100
mov edx, 8
lea rcx, [rsp + 0x40]
call qword [sym.imp.WINMM.dll_timeGetDevCaps]
mov rax, qword [rsp + 0x40]
lea r8, [0x140020e90]
mov edi, dword [rsp + 0x44]
test eax, eax
mov ecx, r13d
mov dword [rsp + 0x20], r13d
cmovne ecx, eax
cmp ecx, edi
cmovb edi, ecx
xor r9d, r9d
mov edx, edi
mov ecx, 0x3e8
call qword [sym.imp.WINMM.dll_timeSetEvent]
test eax, eax
jne 0x1400039e8
mov ecx, r12d
jmp 0x1400039fb
mov ecx, eax
call qword [sym.imp.WINMM.dll_timeKillEvent]
mov ecx, edi
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov ecx, r13d
lea rdx, str.Delaying_execution_using_timeSetEvent_...
call fcn.140011420
lea rdx, str.Delaying_execution_using_WaitForSingleObject_...
lea rcx, str.____s
call fcn.140004100
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
jne 0x140003a41
lea rcx, [0x14004d228]
call fcn.140011790
mov ecx, r12d
jmp 0x140003a52
mov edx, 0x3e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, r13d
lea rdx, str.Delaying_execution_using_WaitForSingleObject_...
call fcn.140011420
lea rdx, str.Delaying_execution_using_WaitForMultipleObjects_...
lea rcx, str.____s
call fcn.140004100
mov edi, r13d
lea rbx, [rsp + 0x48]
nop dword [rax]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx], rax
test rax, rax
je 0x140003ac0
inc edi
add rbx, 8
cmp edi, 2
jb 0x140003a80
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov r9d, 0x3e8
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ecx, r13d
jmp 0x140003acf
lea rcx, [0x14004d228]
call fcn.140011790
mov ecx, r12d
lea rdx, str.Delaying_execution_using_WaitForMultipleObjects_...
call fcn.140011420
lea rdx, str.Delaying_execution_using_IcmpSendEcho_...
lea rcx, str.____s
call fcn.140004100
movsd xmm0, qword [str.Data_Buffer]
mov eax, dword [0x14004d248]
movsd qword [rbp + 0xb0], xmm0
xorps xmm0, xmm0
mov dword [rbp + 0xb8], eax
xor eax, eax
movups xmmword [rbp + 0xbc], xmm0
mov dword [rbp + 0xcc], eax
call qword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140003b50
lea rcx, str._tUnable_to_open_handle._n
call fcn.140004090
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.IcmpCreatefile_returned_error:__u_n
call fcn.140004090
mov ecx, r12d
jmp 0x140003bc4
mov ecx, 0x50
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov rcx, rdi
test rax, rax
jne 0x140003b7d
call qword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
lea rcx, str._tUnable_to_allocate_memory_n
call fcn.140004090
mov ecx, r12d
jmp 0x140003bc4
mov dword [rsp + 0x38], 0x3e8
lea r8, [rbp + 0xb0]
mov dword [rsp + 0x30], 0x50
mov r9d, 0x20
mov qword [rsp + 0x28], rbx
mov edx, 0xffffffff
mov qword [rsp + 0x20], r13
call qword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
mov rcx, rdi
call qword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, r13d
lea rdx, str.Delaying_execution_using_IcmpSendEcho_...
call fcn.140011420
lea rdx, str.Delaying_execution_using_CreateWaitableTimer_...
lea rcx, str.____s
call fcn.140004100
xor r8d, r8d
mov qword [rsp + 0x48], 0xffffffffff676980
mov edx, r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov rbx, rax
test rax, rax
jne 0x140003c07
mov edi, r12d
jmp 0x140003c57
mov dword [rsp + 0x28], r13d
lea rdx, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
test eax, eax
jne 0x140003c2e
mov edi, r12d
jmp 0x140003c45
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov edi, r13d
cmovne edi, r12d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Delaying_execution_using_CreateWaitableTimer_...
mov ecx, edi
call fcn.140011420
lea rdx, str.Delaying_execution_using_CreateTimerQueueTimer_...
lea rcx, str.____s
call fcn.140004100
xor r9d, r9d
mov qword [rsp + 0x48], r13
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14006d2d0], rax
test rax, rax
jne 0x140003c9e
mov edi, r13d
jmp 0x140003d1a
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
mov rbx, rax
test rax, rax
jne 0x140003cb1
mov edi, r12d
jmp 0x140003d1a
mov dword [rsp + 0x30], r13d
lea r8, [0x140020f70]
mov dword [rsp + 0x28], r13d
lea rcx, [rsp + 0x48]
mov r9d, 0xdeadbeef
mov dword [rsp + 0x20], 0x3e8
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
test eax, eax
jne 0x140003ce7
mov edi, r12d
jmp 0x140003d02
mov rcx, qword [0x14006d2d0]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov edi, r13d
cmovne edi, r13d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
mov rcx, qword [0x14006d2d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Delaying_execution_using_CreateTimerQueueTimer_...
mov ecx, edi
call fcn.140011420
lea rdx, str.Checking_RDTSC_Locky_trick
lea rcx, [0x140020ea0]
call fcn.140011670
lea rdx, str.Checking_RDTSC_which_force_a_VM_Exit__cpuid_
lea rcx, [0x140020f20]
call fcn.140011670
cmp dword [0x14006d284], r13d
je 0x140003f60
lea rcx, str.Analysis_tools
call fcn.140011380
lea rax, str.ollydbg.exe
mov esi, 0x24
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x60]
lea rax, str.ProcessHacker.exe
mov qword [rsp + 0x68], rax
lea rax, str.tcpview.exe
mov qword [rsp + 0x70], rax
lea rax, str.autoruns.exe
mov qword [rsp + 0x78], rax
lea rax, str.autorunsc.exe
mov qword [rbp - 0x80], rax
lea rax, str.filemon.exe
mov qword [rbp - 0x78], rax
lea rax, str.procmon.exe
mov qword [rbp - 0x70], rax
lea rax, str.regmon.exe
mov qword [rbp - 0x68], rax
lea rax, str.procexp.exe
mov qword [rbp - 0x60], rax
lea rax, str.idaq.exe
mov qword [rbp - 0x58], rax
lea rax, str.idaq64.exe
mov qword [rbp - 0x50], rax
lea rax, str.ImmunityDebugger.exe
mov qword [rbp - 0x48], rax
lea rax, str.Wireshark.exe
mov qword [rbp - 0x40], rax
lea rax, str.dumpcap.exe
mov qword [rbp - 0x38], rax
lea rax, str.HookExplorer.exe
mov qword [rbp - 0x30], rax
lea rax, str.ImportREC.exe
mov qword [rbp - 0x28], rax
lea rax, str.PETools.exe
mov qword [rbp - 0x20], rax
lea rax, str.LordPE.exe
mov qword [rbp - 0x18], rax
lea rax, str.SysInspector.exe
mov qword [rbp - 0x10], rax
lea rax, str.proc_analyzer.exe
mov qword [rbp - 8], rax
lea rax, str.sysAnalyzer.exe
mov qword [rbp], rax
lea rax, str.sniff_hit.exe
mov qword [rbp + 8], rax
lea rax, str.windbg.exe
mov qword [rbp + 0x10], rax
lea rax, str.joeboxcontrol.exe
mov qword [rbp + 0x18], rax
lea rax, str.joeboxserver.exe
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rax
lea rax, str.ResourceHacker.exe
mov qword [rbp + 0x30], rax
lea rax, str.x32dbg.exe
mov qword [rbp + 0x38], rax
lea rax, str.x64dbg.exe
mov qword [rbp + 0x40], rax
lea rax, str.Fiddler.exe
mov qword [rbp + 0x48], rax
lea rax, str.httpdebugger.exe
mov qword [rbp + 0x50], rax
lea rax, str.cheatengine_i386.exe
mov qword [rbp + 0x58], rax
lea rax, str.cheatengine_x86_64.exe
mov qword [rbp + 0x60], rax
lea rax, str.cheatengine_x86_64_SSE4_AVX2.exe
mov qword [rbp + 0x68], rax
lea rax, str.frida_helper_32.exe
mov qword [rbp + 0x70], rax
lea rax, str.frida_helper_64.exe
mov qword [rbp + 0x78], rax
nop word [rax + rax]
xor edx, edx
mov word [rbp + 0xe0], r13w
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
lea r8, str.Checking_process_of_malware_analysis_tool:__s
mov edx, 0x100
lea rcx, [rbp + 0xe0]
call fcn.1400044c0
mov rcx, qword [rbx]
call fcn.140020500
lea rdx, [rbp + 0xe0]
test eax, eax
je 0x140003f4f
mov ecx, r12d
jmp 0x140003f51
xor ecx, ecx
call fcn.140011550
add rbx, 8
sub rsi, 1
jne 0x140003f00
cmp dword [0x14006d280], r13d
je 0x140003fc8
lea rcx, str.Begin_AntiDisassmConstantCondition_n
call fcn.140004100
call fcn.140020fa0
lea rcx, str.Begin_AntiDisassmAsmJmpSameTarget_n
call fcn.140004100
call fcn.140020fa8
lea rcx, str.Begin_AntiDisassmImpossibleDiasassm_n
call fcn.140004100
call fcn.140020faf
lea rcx, str.Begin_AntiDisassmFunctionPointer_n
call fcn.140004100
mov ecx, 2
call fcn.140020fc3
lea rcx, str.Begin_AntiDisassmReturnPointerAbuse_n
call fcn.140004100
mov ecx, 0x29a
call fcn.140020fee
cmp dword [0x14006d288], r13d
je 0x140004043
lea rcx, str.Anti_Dumping
call fcn.140011380
lea rcx, str.___Erasing_PE_header_from_memory_n
call fcn.140004100
xor ecx, ecx
mov dword [rsp + 0x40], r13d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9, [rsp + 0x40]
mov edx, 0x1000
mov rcx, rax
mov r8d, 4
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
mov rdi, qword gs:[0x60]
lea rcx, str.___Increasing_SizeOfImage_in_PE_Header_to:_0x100000_n
call fcn.140004100
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x30]
add eax, 0x100000
mov dword [rcx + 0x40], eax
lea rcx, str._n_nAnalysis_done__I_hope_you_didnt_get_red_flags_:_
call fcn.140004100
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
mov rcx, qword [rbp + 0x700]
xor rcx, rsp
call fcn.140021210
lea r11, [rsp + 0x810]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret