Unnamed

function running_inside_vpc: boolean; assembler;
asm
  push ebp

  mov  ecx, offset @@exception_handler
  mov  ebp, esp

  push ebx
  push ecx
  push dword ptr fs:[0]
  mov  dword ptr fs:[0], esp

  mov  ebx, 0 // flag
  mov  eax, 1 // VPC function number

  // call VPC
  db 00Fh, 03Fh, 007h, 00Bh

  mov eax, dword ptr ss:[esp]
  mov dword ptr fs:[0], eax
  add esp, 8

  test ebx, ebx
  setz al
  lea esp, dword ptr ss:[ebp-4]
  mov ebx, dword ptr ss:[esp]
  mov ebp, dword ptr ss:[esp+4]
  add esp, 8
  jmp @@ret
  @@exception_handler:
  mov ecx, [esp+0Ch]
  mov dword ptr [ecx+0A4h], -1 // EBX = -1 -> not running, ebx = 0 -> running
  add dword ptr [ecx+0B8h], 4 // -> skip past the detection code
  xor eax, eax // exception is handled
  ret
  @@ret:
end;

function running_inside_vmware: Boolean;
var
  rc: Boolean;
begin
  rc := False;
  try
    asm
      push   edx
      push   ecx
      push   ebx
      mov    eax, 'VMXh'
      mov    ebx, 0
      mov    ecx, 10
      mov    edx, 'VX'
      in     eax, dx
      cmp    ebx, 'VMXh'
      setz   [rc]
      pop    ebx
      pop    ecx
      pop    edx
    end;
  except
     on EPrivilege do rc := False;
  end;
  Result := rc;
end;

Function IsInSandBox: Boolean;
Var
  TCount1       :Integer;
  TCount2       :Integer;
  TCount3       :Integer;
Begin
  Result := False;
  TCount1 := GetTickCount();
  Sleep(5000);
  TCount2 := GetTickCount();
  Sleep(5000);
  TCount3 := GetTickCount();
  If ((TCount2 - TCount1) < 5000) And
     ((TCount3 - TCount1) < 10000) Then
     Result := True;
End;

////////////////////////////////////////////////////////////////////////////////

begin

////////////////////////////////////////////////////////////////////////////////

if running_inside_vpc=true then exit;
if running_inside_vmware=true then exit;
if IsInSandBox=true then exit;