Function at 0x18000c76c
Capabilities:
Check for unmoving mouse cursor
Check if file exists
Check if process is running under wine
Get common file path
Get file attributes
Get memory capacity
Get program files directory
Query environment variable
Reference wmi statements

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3d38]
mov eax, 0x3e38
call fcn.180132290
sub rsp, rax
mov qword [rbp + 0x220], 0xfffffffffffffffe
mov rdi, rcx
xor r12d, r12d
mov dword [rsp + 0x50], r12d
lea eax, [r12 + 0xf]
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x10], r12
mov byte [rcx], r12b
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x30], r12
mov byte [rcx + 0x20], r12b
mov qword [rcx + 0x58], rax
mov qword [rcx + 0x50], r12
mov byte [rcx + 0x40], r12b
mov qword [rcx + 0xc0], r12
mov qword [rcx + 0xc8], r12
mov qword [rcx + 0xd0], r12
mov qword [rcx + 0xd8], r12
mov qword [rcx + 0xe0], r12
mov qword [rcx + 0xe8], r12
lea r13d, [r12 + 1]
mov dword [rsp + 0x50], r13d
lea rcx, [0x1801ae2c8]
call fcn.1800331e0
test eax, eax
setne al
mov byte [rdi + 0x60], al
lea rcx, str.procexp64.exe
call fcn.1800332f0
test eax, eax
setne al
mov byte [rdi + 0x61], al
lea rcx, [0x1801ab950]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x18000c843
mov al, r12b
jmp 0x18000c859
lea rdx, str.wine_get_unix_file_name
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
setne al
mov byte [rdi + 0x62], al
mov r15d, 0x200
mov r8d, r15d
xor edx, edx
lea rcx, [rbp + 0x2d30]
call fcn.1801530a0
lea r9, str.SOFTWAREWine
lea r8, [0x1801ac260]
mov edx, 0x100
lea rcx, [rbp + 0x2d30]
call fcn.1800301c0
lea rdx, str.SOFTWAREWine
mov rcx, 0xffffffff80000001
call fcn.180033190
test eax, eax
setne al
mov byte [rdi + 0x63], al
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp + 0x140], rax
lea rax, str.Identifier
mov qword [rbp + 0x148], rax
lea rax, [0x1801abdf0]
mov qword [rbp + 0x150], rax
lea rcx, str.HARDWAREDescriptionSystem
mov qword [rbp + 0x158], rcx
lea rdx, str.SystemBiosVersion
mov qword [rbp + 0x160], rdx
mov qword [rbp + 0x168], rax
mov qword [rbp + 0x170], rcx
lea rax, str.VideoBiosVersion
mov qword [rbp + 0x178], rax
lea rax, str.VIRTUALBOX
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x188], rcx
lea rax, str.SystemBiosDate
mov qword [rbp + 0x190], rax
lea rax, str.06_23_99
mov qword [rbp + 0x198], rax
mov r14d, r12d
lea rsi, [rbp + 0x148]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x1f30]
call fcn.1801530a0
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x20], rbx
mov r9, qword [rsi]
lea r8, str.Checking_reg_key_HARDWAREDescriptionSystem____s_is_set_to__s
mov edx, 0x100
lea rcx, [rbp + 0x1f30]
call fcn.1800301c0
mov r9, rbx
mov r8, qword [rsi]
mov rdx, qword [rsi - 8]
call fcn.1800330a0
test eax, eax
jne 0x18000c9a4
add r14d, r13d
add rsi, 0x18
cmp r14d, 4
jl 0x18000c94a
mov al, r12b
jmp 0x18000c9a7
mov al, r13b
mov byte [rdi + 0x64], al
lea rax, str.HARDWAREACPIDSDTVBOX__
mov qword [rbp + 0xf0], rax
lea rax, str.HARDWAREACPIFADTVBOX__
mov qword [rbp + 0xf8], rax
lea rax, str.HARDWAREACPIRSDTVBOX__
mov qword [rbp + 0x100], rax
lea rax, str.SOFTWAREOracleVirtualBox_Guest_Additions
mov qword [rbp + 0x108], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxGuest
mov qword [rbp + 0x110], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxMouse
mov qword [rbp + 0x118], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxService
mov qword [rbp + 0x120], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxSF
mov qword [rbp + 0x128], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxVideo
mov qword [rbp + 0x130], rax
mov ebx, r12d
lea rsi, [rbp + 0xf0]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x2530]
call fcn.1801530a0
mov r9, qword [rsi]
lea r8, [0x1801ac260]
mov edx, 0x100
lea rcx, [rbp + 0x2530]
call fcn.1800301c0
mov rdx, qword [rsi]
mov rcx, 0xffffffff80000002
call fcn.180033190
test eax, eax
jne 0x18000ca82
add ebx, r13d
add rsi, 8
cmp ebx, 9
jl 0x18000ca32
mov al, r12b
jmp 0x18000ca85
mov al, r13b
mov byte [rdi + 0x65], al
call fcn.180030220
test eax, eax
setne al
mov byte [rdi + 0x66], al
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x8a0]
call fcn.1801530a0
movaps xmm0, xmmword [str.oracle_virtualbox_guest_additions_]
movaps xmmword [rbp + 0x270], xmm0
movaps xmm1, xmmword [0x1801ac640]
movaps xmmword [rbp + 0x280], xmm1
movaps xmm0, xmmword [0x1801ac650]
movaps xmmword [rbp + 0x290], xmm0
movaps xmm1, xmmword [0x1801ac660]
movaps xmmword [rbp + 0x2a0], xmm1
mov eax, dword [0x1801ac670]
mov dword [rbp + 0x2b0], eax
movzx eax, word [0x1801ac674]
mov word [rbp + 0x2b4], ax
xor edx, edx
mov r8d, 0x1c2
lea rcx, [rbp + 0x2b6]
call fcn.1801530a0
call fcn.180033010
lea rdx, [rbp + 0xcc0]
test eax, eax
je 0x18000cb34
mov r8d, 0x104
lea rcx, [0x1801ac6a8]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x18000cb43
xor r9d, r9d
lea r8d, [r9 + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x270]
lea rdx, [rbp + 0xcc0]
lea rcx, [rbp + 0x8a0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x8a0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000cb77
test al, 0x10
mov al, r13b
jne 0x18000cb7a
mov al, r12b
mov byte [rdi + 0x67], al
lea rcx, [0x1801ac6a0]
call fcn.1800331e0
test eax, eax
setne al
mov byte [rdi + 0x68], al
lea rax, str..VBoxMiniRdrDN
mov qword [rbp - 8], rax
lea rax, str..VBoxGuest
mov qword [rbp], rax
lea rax, str..pipeVBoxMiniRdDN
mov qword [rbp + 8], rax
lea rax, str..VBoxTrayIPC
mov qword [rbp + 0x10], rax
lea rax, str..pipeVBoxTrayIPC
mov qword [rbp + 0x18], rax
mov ebx, r12d
lea rsi, [rbp - 8]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, 0x80000000
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x2730]
call fcn.1801530a0
mov r9, qword [rsi]
lea r8, str.Checking_device__s
mov edx, 0x100
lea rcx, [rbp + 0x2730]
call fcn.1800301c0
cmp r14, 0xffffffffffffffff
jne 0x18000cc3e
add ebx, r13d
add rsi, 8
cmp ebx, 5
jl 0x18000cbcf
mov al, r12b
jmp 0x18000cc4a
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, r13b
mov byte [rdi + 0x69], al
xor edx, edx
lea rcx, str.VBoxTrayToolWndClass
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
lea rdx, str.VBoxTrayToolWnd
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rbx, rbx
jne 0x18000cc7b
test rax, rax
mov al, r12b
je 0x18000cc7e
mov al, r13b
mov byte [rdi + 0x6a], al
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xed0]
call fcn.1801530a0
mov dword [rsp + 0x54], 0x104
lea r8, [rsp + 0x54]
lea rdx, [rbp + 0xed0]
mov ecx, 0x250000
call qword [sym.imp.MPR.dll_WNetGetProviderNameW]
test eax, eax
jne 0x18000ccd3
lea rdx, str.VirtualBox_Shared_Folders
lea rcx, [rbp + 0xed0]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
sete al
jmp 0x18000ccd6
mov al, r12b
mov byte [rdi + 0x6b], al
lea rax, str.vboxservice.exe
mov qword [rbp - 0x70], rax
lea rax, str.vboxtray.exe
mov qword [rbp - 0x68], rax
mov ebx, r12d
lea rsi, [rbp - 0x70]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x2930]
call fcn.1801530a0
mov r9, qword [rsi]
lea r8, str.Checking_VirtualBox_process__s
mov edx, 0x100
lea rcx, [rbp + 0x2930]
call fcn.1800301c0
mov rcx, qword [rsi]
call fcn.1800332f0
test eax, eax
jne 0x18000cd3f
add ebx, r13d
add rsi, 8
cmp ebx, 2
jl 0x18000ccf6
mov al, r12b
jmp 0x18000cd42
mov al, r13b
mov byte [rdi + 0x6c], al
call fcn.180030490
test eax, eax
setne al
mov byte [rdi + 0x6d], al
call fcn.180030670
test eax, eax
setne al
mov byte [rdi + 0x6e], al
mov dword [rbp + 0x3d90], r12d
lea r8, [rbp + 0x3d90]
xor edx, edx
mov ecx, 0x52534d42
call fcn.180033660
mov rbx, rax
mov r14b, r12b
test rax, rax
je 0x18000cde2
mov esi, dword [rbp + 0x3d90]
mov r9d, esi
mov r8, rax
mov edx, 0xa
lea rcx, [0x1801aca30]
call fcn.1800335f0
test eax, eax
jne 0x18000cdd7
mov r9d, esi
mov r8, rbx
lea edx, [rax + 4]
lea rcx, [0x1801aca28]
call fcn.1800335f0
test eax, eax
jne 0x18000cdd7
mov r9d, esi
mov r8, rbx
lea edx, [rax + 4]
lea rcx, str.VBOX
call fcn.1800335f0
test eax, eax
je 0x18000cdda
mov r14b, r13b
mov rcx, rbx
call fcn.180154dd0
mov byte [rdi + 0x6f], r14b
call fcn.180030980
test eax, eax
setne al
mov byte [rdi + 0x70], al
call fcn.180030f70
test eax, eax
setne al
mov byte [rdi + 0x71], al
call fcn.180031180
test eax, eax
setne al
mov byte [rdi + 0x72], al
call fcn.180030b70
test eax, eax
setne al
mov byte [rdi + 0x73], al
call fcn.180030d50
test eax, eax
setne al
mov byte [rdi + 0x74], al
call fcn.180031410
test eax, eax
setne al
mov byte [rdi + 0x75], al
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp + 0x1a0], rax
lea rcx, str.Identifier
mov qword [rbp + 0x1a8], rcx
lea rdx, [0x1801acd70]
mov qword [rbp + 0x1b0], rdx
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_1Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp + 0x1b8], rax
mov qword [rbp + 0x1c0], rcx
mov qword [rbp + 0x1c8], rdx
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_2Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x1d8], rcx
mov qword [rbp + 0x1e0], rdx
lea rcx, str.SYSTEMControlSet001ControlSystemInformation
mov qword [rbp + 0x1e8], rcx
lea rax, str.SystemManufacturer
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 0x1f8], rdx
mov qword [rbp + 0x200], rcx
lea rax, str.SystemProductName
mov qword [rbp + 0x208], rax
mov qword [rbp + 0x210], rdx
mov esi, r12d
lea rbx, [rbp + 0x1a0]
mov r14d, 0x100
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x2b30]
call fcn.1801530a0
mov r9, qword [rbx]
lea r8, str.Checking_reg_key__s
mov rdx, r14
lea rcx, [rbp + 0x2b30]
call fcn.1800301c0
mov r9, qword [rbx + 0x10]
mov r8, qword [rbx + 8]
mov rdx, qword [rbx]
call fcn.1800330a0
test eax, eax
jne 0x18000cf34
add esi, r13d
add rbx, 0x18
cmp esi, 5
jl 0x18000cee5
mov al, r12b
jmp 0x18000cf37
mov al, r13b
mov byte [rdi + 0x76], al
lea rax, str.SOFTWAREVMware__Inc.VMware_Tools
mov qword [rbp - 0x80], rax
mov ebx, r12d
lea rsi, [rbp - 0x80]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x2f30]
call fcn.1801530a0
mov r9, qword [rsi]
lea r8, [0x1801ac260]
mov rdx, r14
lea rcx, [rbp + 0x2f30]
call fcn.1800301c0
mov rdx, qword [rsi]
mov rcx, 0xffffffff80000002
call fcn.180033190
test eax, eax
jne 0x18000cf9a
add ebx, r13d
add rsi, 8
cmp ebx, r13d
jl 0x18000cf4c
mov al, r12b
jmp 0x18000cf9d
mov al, r13b
mov byte [rdi + 0x77], al
call fcn.1800316a0
test eax, eax
setne al
mov byte [rdi + 0x78], al
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1500]
call fcn.1801530a0
movups xmm0, xmmword [str.VMWare_]
movdqu xmmword [rbp + 0x10e0], xmm0
xor edx, edx
mov r8d, 0x1f8
lea rcx, [rbp + 0x10f0]
call fcn.1801530a0
call fcn.180033010
lea rdx, [rbp + 0x12f0]
test eax, eax
je 0x18000d009
mov r8d, 0x104
lea rcx, [0x1801ac6a8]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x18000d018
xor r9d, r9d
lea r8d, [r9 + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x10e0]
lea rdx, [rbp + 0x12f0]
lea rcx, [rbp + 0x1500]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x1500]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000d04c
test al, 0x10
mov al, r13b
jne 0x18000d04f
mov al, r12b
mov byte [rdi + 0x79], al
lea rax, [0x1801ad280]
mov qword [rbp + 0xb0], rax
lea rax, str.00:05:69
mov qword [rbp + 0xb8], rax
lea rax, [0x1801ad2a0]
mov qword [rbp + 0xc0], rax
lea rax, [0x1801ad288]
mov qword [rbp + 0xc8], rax
lea rax, [0x1801ad2c0]
mov qword [rbp + 0xd0], rax
lea rax, [0x1801ad2a8]
mov qword [rbp + 0xd8], rax
lea rax, [0x1801ad2e0]
mov qword [rbp + 0xe0], rax
lea rax, str.00:50:56
mov qword [rbp + 0xe8], rax
mov esi, r12d
lea rbx, [rbp + 0xb0]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x3130]
call fcn.1801530a0
mov r9, qword [rbx + 8]
lea r8, str.Checking_MAC_starting_with__s
mov rdx, r14
lea rcx, [rbp + 0x3130]
call fcn.1800301c0
mov rcx, qword [rbx]
call fcn.1800331e0
test eax, eax
jne 0x18000d114
add esi, r13d
add rbx, 0x10
cmp esi, 4
jl 0x18000d0cc
mov al, r12b
jmp 0x18000d117
mov al, r13b
mov byte [rdi + 0x7a], al
mov esi, r12d
mov ebx, 0x2c0
mov dword [rbp + 0x3d88], ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, ebx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x18000d158
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo._n
call fcn.180032ee0
or esi, 0xffffffff
jmp 0x18000d224
lea rdx, [rbp + 0x3d88]
mov rcx, rbx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x18000d1c4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [rbp + 0x3d88]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, ebx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x18000d1b4
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.180032b00
mov esi, r13d
jmp 0x18000d224
lea rdx, [rbp + 0x3d88]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x18000d210
mov r14, rbx
lea rcx, [r14 + 0x110]
call fcn.1800337e0
mov r15, rax
test rax, rax
je 0x18000d202
lea rdx, [0x1801ad2e8]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
cmovne esi, r13d
mov rcx, r15
call fcn.180154dd0
test esi, esi
jne 0x18000d20a
mov r14, qword [r14]
test r14, r14
jne 0x18000d1cb
mov r15d, 0x200
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
setne al
mov byte [rdi + 0x7b], al
lea rax, str..HGFS
mov qword [rbp - 0x60], rax
lea rax, str.._vmci
mov qword [rbp - 0x58], rax
mov ebx, r12d
lea rsi, [rbp - 0x60]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, 0x80000000
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x3330]
call fcn.1801530a0
mov r9, qword [rsi]
lea r8, str.Checking_device__s
mov edx, 0x100
lea rcx, [rbp + 0x3330]
call fcn.1800301c0
cmp r14, 0xffffffffffffffff
jne 0x18000d2b8
add ebx, r13d
add rsi, 8
cmp ebx, 2
jl 0x18000d249
mov al, r12b
jmp 0x18000d2c4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, r13b
mov byte [rdi + 0x7c], al
lea rax, str.vmtoolsd.exe
mov qword [rbp + 0x20], rax
lea rax, str.vmwaretray.exe
mov qword [rbp + 0x28], rax
lea rax, str.vmwareuser.exe
mov qword [rbp + 0x30], rax
lea rax, str.VGAuthService.exe
mov qword [rbp + 0x38], rax
lea rax, str.vmacthlp.exe
mov qword [rbp + 0x40], rax
mov ebx, r12d
lea rsi, [rbp + 0x20]
mov r14d, 0x100
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x3530]
call fcn.1801530a0
mov r9, qword [rsi]
lea r8, str.Checking_VWware_process__s
mov rdx, r14
lea rcx, [rbp + 0x3530]
call fcn.1800301c0
mov rcx, qword [rsi]
call fcn.1800332f0
test eax, eax
jne 0x18000d352
add ebx, r13d
add rsi, 8
cmp ebx, 5
jl 0x18000d30b
mov al, r12b
jmp 0x18000d355
mov al, r13b
mov byte [rdi + 0x7d], al
mov dword [rbp + 0x3d98], r12d
lea r8, [rbp + 0x3d98]
xor edx, edx
mov ecx, 0x52534d42
call fcn.180033660
mov rsi, rax
mov al, r12b
test rsi, rsi
je 0x18000d3a7
mov r9d, dword [rbp + 0x3d98]
mov r8, rsi
mov edx, 6
lea rcx, str.VMware
call fcn.1800335f0
mov ebx, eax
mov rcx, rsi
call fcn.180154dd0
test ebx, ebx
setne al
mov byte [rdi + 0x7e], al
call fcn.1800318e0
test eax, eax
setne al
mov byte [rdi + 0x7f], al
lea rax, str.VMSrvc.exe
mov qword [rbp - 0x50], rax
lea rax, str.VMUSrvc.exe
mov qword [rbp - 0x48], rax
mov ebx, r12d
lea rsi, [rbp - 0x50]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x3730]
call fcn.1801530a0
mov r9, qword [rsi]
lea r8, str.Checking_Virtual_PC_processes__s
mov rdx, r14
lea rcx, [rbp + 0x3730]
call fcn.1800301c0
mov rcx, qword [rsi]
call fcn.1800332f0
test eax, eax
jne 0x18000d41b
add ebx, r13d
add rsi, 8
cmp ebx, 2
jl 0x18000d3d4
mov al, r12b
jmp 0x18000d41e
mov al, r13b
mov byte [rdi + 0x80], al
lea rax, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
mov qword [rbp - 0x78], rax
mov ebx, r12d
lea rsi, [rbp - 0x78]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x3930]
call fcn.1801530a0
mov r9, qword [rsi]
lea r8, [0x1801ac260]
mov rdx, r14
lea rcx, [rbp + 0x3930]
call fcn.1800301c0
mov rdx, qword [rsi]
mov rcx, 0xffffffff80000002
call fcn.180033190
test eax, eax
jne 0x18000d484
add ebx, r13d
add rsi, 8
cmp ebx, r13d
jl 0x18000d436
mov al, r12b
jmp 0x18000d487
mov al, r13b
mov byte [rdi + 0x81], al
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp + 0x48], rax
lea rax, str.Identifier
mov qword [rbp + 0x50], rax
lea rax, [0x1801ad560]
mov qword [rbp + 0x58], rax
lea rcx, str.HARDWAREDescriptionSystem
mov qword [rbp + 0x60], rcx
lea rcx, str.SystemBiosVersion
mov qword [rbp + 0x68], rcx
mov qword [rbp + 0x70], rax
mov esi, r12d
lea rbx, [rbp + 0x48]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x1b30]
call fcn.1801530a0
mov r9, qword [rbx]
lea r8, [0x1801ac260]
mov rdx, r14
lea rcx, [rbp + 0x1b30]
call fcn.1800301c0
mov r9, qword [rbx + 0x10]
mov r8, qword [rbx + 8]
mov rdx, qword [rbx]
call fcn.1800330a0
test eax, eax
jne 0x18000d51e
add esi, r13d
add rbx, 0x18
cmp esi, 2
jl 0x18000d4cf
mov al, r12b
jmp 0x18000d521
mov al, r13b
mov byte [rdi + 0x84], al
lea rax, str.qemu_ga.exe
mov qword [rbp - 0x20], rax
lea rax, str.vdagent.exe
mov qword [rbp - 0x18], rax
lea rax, str.vdservice.exe
mov qword [rbp - 0x10], rax
mov ebx, r12d
lea rsi, [rbp - 0x20]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x1d30]
call fcn.1801530a0
mov r9, qword [rsi]
lea r8, str.Checking_qemu_processes__s
mov rdx, r14
lea rcx, [rbp + 0x1d30]
call fcn.1800301c0
mov rcx, qword [rsi]
call fcn.1800332f0
test eax, eax
jne 0x18000d596
add ebx, r13d
add rsi, 8
cmp ebx, 3
jl 0x18000d54f
mov al, r12b
jmp 0x18000d599
mov al, r13b
mov byte [rdi + 0x85], al
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x480]
call fcn.1801530a0
lea rax, str.qemu_ga
mov qword [rbp - 0x40], rax
lea rax, str.SPICE_Guest_Tools
mov qword [rbp - 0x38], rax
mov ebx, r12d
lea rsi, [rbp - 0x40]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x3b30]
call fcn.1801530a0
call fcn.180033010
lea rdx, [rbp + 0x1710]
test eax, eax
je 0x18000d606
mov r8d, 0x104
lea rcx, [0x1801ac6a8]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x18000d615
xor r9d, r9d
lea r8d, [r9 + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov r8, qword [rsi]
lea rdx, [rbp + 0x1710]
lea rcx, [rbp + 0x480]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea r9, [rbp + 0x480]
lea r8, str.Checking_QEMU_directory__s
mov rdx, r14
lea rcx, [rbp + 0x3b30]
call fcn.1800301c0
lea rcx, [rbp + 0x480]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000d65f
test al, 0x10
jne 0x18000d670
add ebx, r13d
add rsi, 8
cmp ebx, 2
jge 0x18000d675
jmp 0x18000d5d0
mov al, r13b
jmp 0x18000d678
mov al, r12b
mov byte [rdi + 0x86], al
call fcn.180031aa0
test eax, eax
setne al
mov byte [rdi + 0x87], al
mov dword [rsp + 0x40], r12d
lea r8, [rsp + 0x40]
xor edx, edx
mov ecx, 0x52534d42
call fcn.180033660
mov rbx, rax
mov sil, r12b
test rax, rax
je 0x18000d6f9
mov r14d, dword [rsp + 0x40]
mov r9d, r14d
mov r8, rax
mov edx, 4
lea rcx, [0x1801ad654]
call fcn.1800335f0
test eax, eax
jne 0x18000d6e8
mov r9d, r14d
mov r8, rbx
lea edx, [rax + 4]
lea rcx, str.QEMU
call fcn.1800335f0
test eax, eax
je 0x18000d6eb
mov sil, r13b
mov rcx, rbx
call fcn.180154dd0
mov r14d, 0x100
mov byte [rdi + 0x88], sil
lea rax, str.SYSTEMControlSet001Services_vioscsi
mov qword [rbp + 0x78], rax
lea rax, str.SYSTEMControlSet001Services_viostor
mov qword [rbp + 0x80], rax
lea rax, str.SYSTEMControlSet001ServicesVirtIO_FS_Service
mov qword [rbp + 0x88], rax
lea rax, str.SYSTEMControlSet001ServicesVirtioSerial
mov qword [rbp + 0x90], rax
lea rax, str.SYSTEMControlSet001ServicesBALLOON
mov qword [rbp + 0x98], rax
lea rax, str.SYSTEMControlSet001ServicesBalloonService
mov qword [rbp + 0xa0], rax
lea rax, str.SYSTEMControlSet001Services_netkvm
mov qword [rbp + 0xa8], rax
mov ebx, r12d
lea rsi, [rbp + 0x78]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x2130]
call fcn.1801530a0
mov r9, qword [rsi]
lea r8, [0x1801ac260]
mov rdx, r14
lea rcx, [rbp + 0x2130]
call fcn.1800301c0
mov rdx, qword [rsi]
mov rcx, 0xffffffff80000002
call fcn.180033190
test eax, eax
jne 0x18000d7b4
add ebx, r13d
add rsi, 8
cmp ebx, 7
jl 0x18000d766
mov al, r12b
jmp 0x18000d7b7
mov al, r13b
mov byte [rdi + 0x89], al
call fcn.180031c50
test eax, eax
setne al
mov byte [rdi + 0x8a], al
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xab0]
call fcn.1801530a0
movups xmm0, xmmword [str.Virtio_Win_]
movaps xmmword [rbp + 0x690], xmm0
movsd xmm1, qword [0x1801adb80]
movsd qword [rbp + 0x6a0], xmm1
xor edx, edx
mov r8d, 0x1f0
lea rcx, [rbp + 0x6a8]
call fcn.1801530a0
call fcn.180033010
lea rdx, [rbp + 0x1920]
test eax, eax
je 0x18000d838
mov r8d, 0x104
lea rcx, [0x1801ac6a8]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x18000d847
xor r9d, r9d
lea r8d, [r9 + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x690]
lea rdx, [rbp + 0x1920]
lea rcx, [rbp + 0xab0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0xab0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000d87b
test al, 0x10
mov al, r13b
jne 0x18000d87e
mov al, r12b
mov byte [rdi + 0x8b], al
lea rax, str.prl_cc.exe
mov qword [rbp - 0x30], rax
lea rax, str.prl_tools.exe
mov qword [rbp - 0x28], rax
mov ebx, r12d
lea rsi, [rbp - 0x30]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x2330]
call fcn.1801530a0
mov r9, qword [rsi]
lea r8, str.Checking_Parallels_processes:__s
mov rdx, r14
lea rcx, [rbp + 0x2330]
call fcn.1800301c0
mov rcx, qword [rsi]
call fcn.1800332f0
test eax, eax
jne 0x18000d8e8
add ebx, r13d
add rsi, 8
cmp ebx, 2
jl 0x18000d8a1
mov al, r12b
jmp 0x18000d8eb
mov al, r13b
mov byte [rdi + 0x8c], al
lea rcx, [0x1801ae168]
call fcn.1800331e0
test eax, eax
setne al
mov byte [rdi + 0x8d], al
call fcn.180032b60
test eax, eax
setne al
mov byte [rdi + 0x82], al
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rsp + 0x58]
cmp dword [rsp + 0x60], eax
jne 0x18000d95c
mov eax, dword [rsp + 0x5c]
cmp dword [rsp + 0x64], eax
mov al, r13b
je 0x18000d95f
mov al, r12b
mov byte [rdi + 0xa8], al
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x48], r12
mov ebx, r12d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call fcn.1800333d0
test eax, eax
je 0x18000da1a
lea r9, str.SELECT__FROM_Win32_Fan
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call fcn.180033520
test eax, eax
je 0x18000da1a
mov qword [rsp + 0x78], r12
mov dword [rsp + 0x44], r12d
jmp 0x18000d9e9
mov rax, qword [rcx]
lea rdx, [rsp + 0x44]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x78]
mov r8d, r13d
or edx, 0xffffffff
call qword [rax + 0x20]
cmp dword [rsp + 0x44], r12d
je 0x18000d9f3
add ebx, r13d
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x18000d9b9
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
test ebx, ebx
sete al
mov byte [rdi + 0x83], al
call fcn.180032500
test eax, eax
setne al
mov byte [rdi + 0x8e], al
call fcn.180032300
mov qword [rdi + 0x90], rax
call fcn.180032120
test eax, eax
setne al
mov byte [rdi + 0x98], al
xor edx, edx
lea r8d, [rdx + 0x3c]
lea rcx, [rbp + 0x234]
call fcn.1801530a0
mov dword [rbp + 0x230], 0x40
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0x238]
shr rax, 0x1e
mov qword [rdi + 0xa0], rax
call fcn.180032950
mov byte [rdi + 0xa9], al
mov rax, qword gs:[0x60]
mov ecx, dword [rax + 0xb8]
mov qword [rdi + 0xb0], rcx
call fcn.180032120
test eax, eax
setne al
mov byte [rdi + 0x98], al
call fcn.180031f50
test eax, eax
setne al
mov byte [rdi + 0xaa], al
call fcn.180032700
test eax, eax
setne al
mov byte [rdi + 0xb8], al
mov rax, rdi
add rsp, 0x3e38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret