Anti-VM: smsw

[recvfrom]

I didn't see an existing implementation in al-khaser for the technique detailed here - https://search.unprotect.it/technique/smsw/

Reference: https://krabsonsecurity.com/2019/12/05/buer-loader-new-russian-loader-on-the-market-with-interesting-persistence/

[gsuberland]

Looks useful. One important implementation detail is that UMIP breaks this check, turning SMSW into a privileged instruction, so we'd need to add a catch for that.