Function at 0x18000efd8
Capabilities:
Check for unmoving mouse cursor
Check if file exists
Check if process is running under wine
Get common file path
Get file attributes
Get memory capacity
Get program files directory
Query environment variable
Reference wmi statements

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30d8]
mov eax, 0x31d8
call fcn.180087260
sub rsp, rax
mov qword [rbp + 0x210], 0xfffffffffffffffe
mov rdi, rcx
xor r12d, r12d
mov dword [rsp + 0x50], r12d
lea eax, [r12 + 0xf]
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x10], r12
mov byte [rcx], r12b
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x30], r12
mov byte [rcx + 0x20], r12b
mov qword [rcx + 0x58], rax
mov qword [rcx + 0x50], r12
mov byte [rcx + 0x40], r12b
mov qword [rcx + 0xc0], r12
mov qword [rcx + 0xc8], r12
mov qword [rcx + 0xd0], r12
mov qword [rcx + 0xd8], r12
mov qword [rcx + 0xe0], r12
mov qword [rcx + 0xe8], r12
lea r13d, [r12 + 1]
mov dword [rsp + 0x50], r13d
lea rcx, [0x1800fd6f8]
call fcn.180061260
test eax, eax
setne al
mov byte [rdi + 0x60], al
lea rcx, str.procexp64.exe
call fcn.180061370
test eax, eax
setne al
mov byte [rdi + 0x61], al
lea rcx, [0x1800fadc0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x18000f0af
mov al, r12b
jmp 0x18000f0c5
lea rdx, str.wine_get_unix_file_name
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
setne al
mov byte [rdi + 0x62], al
mov r15d, 0x200
mov r8d, r15d
xor edx, edx
lea rcx, [rbp + 0x10d0]
call fcn.1800a8ae0
lea r9, str.SOFTWAREWine
lea r8, [0x1800fb628]
mov edx, 0x100
lea rcx, [rbp + 0x10d0]
call fcn.18005dd20
lea rdx, str.SOFTWAREWine
mov rcx, 0xffffffff80000001
call fcn.180061210
test eax, eax
setne al
mov byte [rdi + 0x63], al
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp + 0x130], rax
lea rax, str.Identifier
mov qword [rbp + 0x138], rax
lea rax, [0x1800fb2a8]
mov qword [rbp + 0x140], rax
lea rcx, str.HARDWAREDescriptionSystem
mov qword [rbp + 0x148], rcx
lea rdx, str.SystemBiosVersion
mov qword [rbp + 0x150], rdx
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x160], rcx
lea rax, str.VideoBiosVersion
mov qword [rbp + 0x168], rax
lea rax, str.VIRTUALBOX
mov qword [rbp + 0x170], rax
mov qword [rbp + 0x178], rcx
lea rax, str.SystemBiosDate
mov qword [rbp + 0x180], rax
lea rax, str.06_23_99
mov qword [rbp + 0x188], rax
mov r14d, r12d
lea rsi, [rbp + 0x138]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x12d0]
call fcn.1800a8ae0
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x20], rbx
mov r9, qword [rsi]
lea r8, str.Checking_reg_key_HARDWAREDescriptionSystem____s_is_set_to__s
mov edx, 0x100
lea rcx, [rbp + 0x12d0]
call fcn.18005dd20
mov r9, rbx
mov r8, qword [rsi]
mov rdx, qword [rsi - 8]
call fcn.180061120
test eax, eax
jne 0x18000f210
add r14d, r13d
add rsi, 0x18
cmp r14d, 4
jl 0x18000f1b6
mov al, r12b
jmp 0x18000f213
mov al, r13b
mov byte [rdi + 0x64], al
lea rax, str.HARDWAREACPIDSDTVBOX__
mov qword [rbp + 0xe0], rax
lea rax, str.HARDWAREACPIFADTVBOX__
mov qword [rbp + 0xe8], rax
lea rax, str.HARDWAREACPIRSDTVBOX__
mov qword [rbp + 0xf0], rax
lea rax, str.SOFTWAREOracleVirtualBox_Guest_Additions
mov qword [rbp + 0xf8], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxGuest
mov qword [rbp + 0x100], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxMouse
mov qword [rbp + 0x108], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxService
mov qword [rbp + 0x110], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxSF
mov qword [rbp + 0x118], rax
lea rax, str.SYSTEMControlSet001ServicesVBoxVideo
mov qword [rbp + 0x120], rax
mov ebx, r12d
lea rsi, [rbp + 0xe0]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x14d0]
call fcn.1800a8ae0
mov r9, qword [rsi]
lea r8, [0x1800fb628]
mov edx, 0x100
lea rcx, [rbp + 0x14d0]
call fcn.18005dd20
mov rdx, qword [rsi]
mov rcx, 0xffffffff80000002
call fcn.180061210
test eax, eax
jne 0x18000f2ee
add ebx, r13d
add rsi, 8
cmp ebx, 9
jl 0x18000f29e
mov al, r12b
jmp 0x18000f2f1
mov al, r13b
mov byte [rdi + 0x65], al
call fcn.18005dd80
test eax, eax
setne al
mov byte [rdi + 0x66], al
call fcn.18005e060
test eax, eax
setne al
mov byte [rdi + 0x67], al
lea rcx, [0x1800fbb40]
call fcn.180061260
test eax, eax
setne al
mov byte [rdi + 0x68], al
lea rax, str..VBoxMiniRdrDN
mov qword [rbp - 0x18], rax
lea rax, str..VBoxGuest
mov qword [rbp - 0x10], rax
lea rax, [0x1800fbb48]
mov qword [rbp - 8], rax
lea rax, str..VBoxTrayIPC
mov qword [rbp], rax
lea rax, str..pipeVBoxTrayIPC
mov qword [rbp + 8], rax
mov ebx, r12d
lea rsi, [rbp - 0x18]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, 0x80000000
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x16d0]
call fcn.1800a8ae0
mov r9, qword [rsi]
lea r8, str.Checking_device__s
mov edx, 0x100
lea rcx, [rbp + 0x16d0]
call fcn.18005dd20
cmp r14, 0xffffffffffffffff
jne 0x18000f3cf
add ebx, r13d
add rsi, 8
cmp ebx, 5
jl 0x18000f360
mov al, r12b
jmp 0x18000f3db
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, r13b
mov byte [rdi + 0x69], al
xor edx, edx
lea rcx, str.VBoxTrayToolWndClass
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
lea rdx, str.VBoxTrayToolWnd
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rbx, rbx
jne 0x18000f40c
test rax, rax
mov al, r12b
je 0x18000f40f
mov al, r13b
mov byte [rdi + 0x6a], al
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x680]
call fcn.1800a8ae0
mov dword [rsp + 0x54], 0x104
lea r8, [rsp + 0x54]
lea rdx, [rbp + 0x680]
mov ecx, 0x250000
call qword [sym.imp.MPR.dll_WNetGetProviderNameW]
test eax, eax
jne 0x18000f464
lea rdx, str.VirtualBox_Shared_Folders
lea rcx, [rbp + 0x680]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
sete al
jmp 0x18000f467
mov al, r12b
mov byte [rdi + 0x6b], al
lea rax, str.vboxservice.exe
mov qword [rbp - 0x70], rax
lea rax, str.vboxtray.exe
mov qword [rbp - 0x68], rax
mov ebx, r12d
lea rsi, [rbp - 0x70]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x18d0]
call fcn.1800a8ae0
mov r9, qword [rsi]
lea r8, str.Checking_VirtualBox_process__s
mov edx, 0x100
lea rcx, [rbp + 0x18d0]
call fcn.18005dd20
mov rcx, qword [rsi]
call fcn.180061370
test eax, eax
jne 0x18000f4d0
add ebx, r13d
add rsi, 8
cmp ebx, 2
jl 0x18000f487
mov al, r12b
jmp 0x18000f4d3
mov al, r13b
mov byte [rdi + 0x6c], al
call fcn.18005e230
test eax, eax
setne al
mov byte [rdi + 0x6d], al
call fcn.18005e410
test eax, eax
setne al
mov byte [rdi + 0x6e], al
mov dword [rbp + 0x3130], r12d
lea r8, [rbp + 0x3130]
xor edx, edx
mov ecx, 0x52534d42
call fcn.1800616e0
mov rbx, rax
mov r14b, r12b
test rax, rax
je 0x18000f573
mov esi, dword [rbp + 0x3130]
mov r9d, esi
mov r8, rax
mov edx, 0xa
lea rcx, [0x1800fbe68]
call fcn.180061670
test eax, eax
jne 0x18000f568
mov r9d, esi
mov r8, rbx
lea edx, [rax + 4]
lea rcx, [0x1800fbe90]
call fcn.180061670
test eax, eax
jne 0x18000f568
mov r9d, esi
mov r8, rbx
lea edx, [rax + 4]
lea rcx, str.VBOX
call fcn.180061670
test eax, eax
je 0x18000f56b
mov r14b, r13b
mov rcx, rbx
call fcn.1800ab6a4
mov byte [rdi + 0x6f], r14b
call fcn.18005e720
test eax, eax
setne al
mov byte [rdi + 0x70], al
call fcn.18005ed10
test eax, eax
setne al
mov byte [rdi + 0x71], al
call fcn.18005ef20
test eax, eax
setne al
mov byte [rdi + 0x72], al
call fcn.18005e910
test eax, eax
setne al
mov byte [rdi + 0x73], al
call fcn.18005eaf0
test eax, eax
setne al
mov byte [rdi + 0x74], al
call fcn.18005f1b0
test eax, eax
setne al
mov byte [rdi + 0x75], al
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp + 0x190], rax
lea rcx, str.Identifier
mov qword [rbp + 0x198], rcx
lea rdx, [0x1800fc120]
mov qword [rbp + 0x1a0], rdx
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_1Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp + 0x1a8], rax
mov qword [rbp + 0x1b0], rcx
mov qword [rbp + 0x1b8], rdx
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_2Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x1c8], rcx
mov qword [rbp + 0x1d0], rdx
lea rcx, str.SYSTEMControlSet001ControlSystemInformation
mov qword [rbp + 0x1d8], rcx
lea rax, str.SystemManufacturer
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x1e8], rdx
mov qword [rbp + 0x1f0], rcx
lea rax, str.SystemProductName
mov qword [rbp + 0x1f8], rax
mov qword [rbp + 0x200], rdx
mov esi, r12d
lea rbx, [rbp + 0x190]
mov r14d, 0x100
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x1ad0]
call fcn.1800a8ae0
mov r9, qword [rbx]
lea r8, str.Checking_reg_key__s
mov rdx, r14
lea rcx, [rbp + 0x1ad0]
call fcn.18005dd20
mov r9, qword [rbx + 0x10]
mov r8, qword [rbx + 8]
mov rdx, qword [rbx]
call fcn.180061120
test eax, eax
jne 0x18000f6c5
add esi, r13d
add rbx, 0x18
cmp esi, 5
jl 0x18000f676
mov al, r12b
jmp 0x18000f6c8
mov al, r13b
mov byte [rdi + 0x76], al
lea rax, str.SOFTWAREVMware__Inc.VMware_Tools
mov qword [rbp - 0x80], rax
mov ebx, r12d
lea rsi, [rbp - 0x80]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x1cd0]
call fcn.1800a8ae0
mov r9, qword [rsi]
lea r8, [0x1800fb628]
mov rdx, r14
lea rcx, [rbp + 0x1cd0]
call fcn.18005dd20
mov rdx, qword [rsi]
mov rcx, 0xffffffff80000002
call fcn.180061210
test eax, eax
jne 0x18000f72b
add ebx, r13d
add rsi, 8
cmp ebx, r13d
jl 0x18000f6dd
mov al, r12b
jmp 0x18000f72e
mov al, r13b
mov byte [rdi + 0x77], al
call fcn.18005f440
test eax, eax
setne al
mov byte [rdi + 0x78], al
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xcb0]
call fcn.1800a8ae0
movups xmm0, xmmword [0x1800fc6d0]
movdqu xmmword [rbp + 0x890], xmm0
xor edx, edx
mov r8d, 0x1f8
lea rcx, [rbp + 0x8a0]
call fcn.1800a8ae0
call fcn.180061090
lea rdx, [rbp + 0xaa0]
test eax, eax
je 0x18000f79a
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x18000f7a9
xor r9d, r9d
lea r8d, [r9 + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x890]
lea rdx, [rbp + 0xaa0]
lea rcx, [rbp + 0xcb0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0xcb0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000f7dd
test al, 0x10
mov al, r13b
jne 0x18000f7e0
mov al, r12b
mov byte [rdi + 0x79], al
lea rax, [0x1800fc6c8]
mov qword [rbp + 0xa0], rax
lea rax, [0x1800fc6e8]
mov qword [rbp + 0xa8], rax
lea rax, [0x1800fc6e0]
mov qword [rbp + 0xb0], rax
lea rax, str.00:0c:29
mov qword [rbp + 0xb8], rax
lea rax, [0x1800fc700]
mov qword [rbp + 0xc0], rax
lea rax, [0x1800fc728]
mov qword [rbp + 0xc8], rax
lea rax, [0x1800fc720]
mov qword [rbp + 0xd0], rax
lea rax, str.00:50:56
mov qword [rbp + 0xd8], rax
mov esi, r12d
lea rbx, [rbp + 0xa0]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x1ed0]
call fcn.1800a8ae0
mov r9, qword [rbx + 8]
lea r8, str.Checking_MAC_starting_with__s
mov rdx, r14
lea rcx, [rbp + 0x1ed0]
call fcn.18005dd20
mov rcx, qword [rbx]
call fcn.180061260
test eax, eax
jne 0x18000f8a5
add esi, r13d
add rbx, 0x10
cmp esi, 4
jl 0x18000f85d
mov al, r12b
jmp 0x18000f8a8
mov al, r13b
mov byte [rdi + 0x7a], al
mov esi, r12d
mov ebx, 0x2c0
mov dword [rbp + 0x3128], ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, ebx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x18000f8e9
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo._n
call fcn.180060f60
or esi, 0xffffffff
jmp 0x18000f9b5
lea rdx, [rbp + 0x3128]
mov rcx, rbx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x18000f955
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [rbp + 0x3128]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, ebx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x18000f945
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.180060b80
mov esi, r13d
jmp 0x18000f9b5
lea rdx, [rbp + 0x3128]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x18000f9a1
mov r14, rbx
lea rcx, [r14 + 0x110]
call fcn.180061860
mov r15, rax
test rax, rax
je 0x18000f993
lea rdx, str.VMWare
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
cmovne esi, r13d
mov rcx, r15
call fcn.1800ab6a4
test esi, esi
jne 0x18000f99b
mov r14, qword [r14]
test r14, r14
jne 0x18000f95c
mov r15d, 0x200
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
setne al
mov byte [rdi + 0x7b], al
lea rax, str..HGFS
mov qword [rbp - 0x60], rax
lea rax, str.._vmci
mov qword [rbp - 0x58], rax
mov ebx, r12d
lea rsi, [rbp - 0x60]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, 0x80000000
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x20d0]
call fcn.1800a8ae0
mov r9, qword [rsi]
lea r8, str.Checking_device__s
mov edx, 0x100
lea rcx, [rbp + 0x20d0]
call fcn.18005dd20
cmp r14, 0xffffffffffffffff
jne 0x18000fa49
add ebx, r13d
add rsi, 8
cmp ebx, 2
jl 0x18000f9da
mov al, r12b
jmp 0x18000fa55
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, r13b
mov byte [rdi + 0x7c], al
lea rax, str.vmtoolsd.exe
mov qword [rbp + 0x10], rax
lea rax, str.vmwaretray.exe
mov qword [rbp + 0x18], rax
lea rax, str.vmwareuser.exe
mov qword [rbp + 0x20], rax
lea rax, str.VGAuthService.exe
mov qword [rbp + 0x28], rax
lea rax, str.vmacthlp.exe
mov qword [rbp + 0x30], rax
mov ebx, r12d
lea rsi, [rbp + 0x10]
mov r14d, 0x100
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x22d0]
call fcn.1800a8ae0
mov r9, qword [rsi]
lea r8, str.Checking_VWware_process__s
mov rdx, r14
lea rcx, [rbp + 0x22d0]
call fcn.18005dd20
mov rcx, qword [rsi]
call fcn.180061370
test eax, eax
jne 0x18000fae3
add ebx, r13d
add rsi, 8
cmp ebx, 5
jl 0x18000fa9c
mov al, r12b
jmp 0x18000fae6
mov al, r13b
mov byte [rdi + 0x7d], al
mov dword [rbp + 0x3138], r12d
lea r8, [rbp + 0x3138]
xor edx, edx
mov ecx, 0x52534d42
call fcn.1800616e0
mov rsi, rax
mov al, r12b
test rsi, rsi
je 0x18000fb38
mov r9d, dword [rbp + 0x3138]
mov r8, rsi
mov edx, 6
lea rcx, str.VMware
call fcn.180061670
mov ebx, eax
mov rcx, rsi
call fcn.1800ab6a4
test ebx, ebx
setne al
mov byte [rdi + 0x7e], al
call fcn.18005f700
test eax, eax
setne al
mov byte [rdi + 0x7f], al
lea rax, str.VMSrvc.exe
mov qword [rbp - 0x50], rax
lea rax, str.VMUSrvc.exe
mov qword [rbp - 0x48], rax
mov ebx, r12d
lea rsi, [rbp - 0x50]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x2ed0]
call fcn.1800a8ae0
mov r9, qword [rsi]
lea r8, str.Checking_Virtual_PC_processes__s
mov rdx, r14
lea rcx, [rbp + 0x2ed0]
call fcn.18005dd20
mov rcx, qword [rsi]
call fcn.180061370
test eax, eax
jne 0x18000fbac
add ebx, r13d
add rsi, 8
cmp ebx, 2
jl 0x18000fb65
mov al, r12b
jmp 0x18000fbaf
mov al, r13b
mov byte [rdi + 0x80], al
lea rax, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
mov qword [rbp - 0x78], rax
mov ebx, r12d
lea rsi, [rbp - 0x78]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x24d0]
call fcn.1800a8ae0
mov r9, qword [rsi]
lea r8, [0x1800fb628]
mov rdx, r14
lea rcx, [rbp + 0x24d0]
call fcn.18005dd20
mov rdx, qword [rsi]
mov rcx, 0xffffffff80000002
call fcn.180061210
test eax, eax
jne 0x18000fc15
add ebx, r13d
add rsi, 8
cmp ebx, r13d
jl 0x18000fbc7
mov al, r12b
jmp 0x18000fc18
mov al, r13b
mov byte [rdi + 0x81], al
lea rax, str.HARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
mov qword [rbp + 0x38], rax
lea rax, str.Identifier
mov qword [rbp + 0x40], rax
lea rax, [0x1800fc9a8]
mov qword [rbp + 0x48], rax
lea rcx, str.HARDWAREDescriptionSystem
mov qword [rbp + 0x50], rcx
lea rcx, str.SystemBiosVersion
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0x60], rax
mov esi, r12d
lea rbx, [rbp + 0x38]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x26d0]
call fcn.1800a8ae0
mov r9, qword [rbx]
lea r8, [0x1800fb628]
mov rdx, r14
lea rcx, [rbp + 0x26d0]
call fcn.18005dd20
mov r9, qword [rbx + 0x10]
mov r8, qword [rbx + 8]
mov rdx, qword [rbx]
call fcn.180061120
test eax, eax
jne 0x18000fcaf
add esi, r13d
add rbx, 0x18
cmp esi, 2
jl 0x18000fc60
mov al, r12b
jmp 0x18000fcb2
mov al, r13b
mov byte [rdi + 0x84], al
lea rax, str.qemu_ga.exe
mov qword [rbp - 0x30], rax
lea rax, str.vdagent.exe
mov qword [rbp - 0x28], rax
lea rax, str.vdservice.exe
mov qword [rbp - 0x20], rax
mov ebx, r12d
lea rsi, [rbp - 0x30]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x28d0]
call fcn.1800a8ae0
mov r9, qword [rsi]
lea r8, str.Checking_qemu_processes__s
mov rdx, r14
lea rcx, [rbp + 0x28d0]
call fcn.18005dd20
mov rcx, qword [rsi]
call fcn.180061370
test eax, eax
jne 0x18000fd27
add ebx, r13d
add rsi, 8
cmp ebx, 3
jl 0x18000fce0
mov al, r12b
jmp 0x18000fd2a
mov al, r13b
mov byte [rdi + 0x85], al
call fcn.18005f8c0
test eax, eax
setne al
mov byte [rdi + 0x86], al
call fcn.18005faa0
test eax, eax
setne al
mov byte [rdi + 0x87], al
mov dword [rsp + 0x40], r12d
lea r8, [rsp + 0x40]
xor edx, edx
mov ecx, 0x52534d42
call fcn.1800616e0
mov rbx, rax
mov sil, r12b
test rax, rax
je 0x18000fdbb
mov r14d, dword [rsp + 0x40]
mov r9d, r14d
mov r8, rax
mov edx, 4
lea rcx, [0x1800fca78]
call fcn.180061670
test eax, eax
jne 0x18000fdaa
mov r9d, r14d
mov r8, rbx
lea edx, [rax + 4]
lea rcx, str.QEMU
call fcn.180061670
test eax, eax
je 0x18000fdad
mov sil, r13b
mov rcx, rbx
call fcn.1800ab6a4
mov r14d, 0x100
mov byte [rdi + 0x88], sil
lea rax, str.SYSTEMControlSet001Services_vioscsi
mov qword [rbp + 0x68], rax
lea rax, str.SYSTEMControlSet001Services_viostor
mov qword [rbp + 0x70], rax
lea rax, str.SYSTEMControlSet001ServicesVirtIO_FS_Service
mov qword [rbp + 0x78], rax
lea rax, str.SYSTEMControlSet001ServicesVirtioSerial
mov qword [rbp + 0x80], rax
lea rax, str.SYSTEMControlSet001ServicesBALLOON
mov qword [rbp + 0x88], rax
lea rax, str.SYSTEMControlSet001ServicesBalloonService
mov qword [rbp + 0x90], rax
lea rax, str.SYSTEMControlSet001Services_netkvm
mov qword [rbp + 0x98], rax
mov ebx, r12d
lea rsi, [rbp + 0x68]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x2ad0]
call fcn.1800a8ae0
mov r9, qword [rsi]
lea r8, [0x1800fb628]
mov rdx, r14
lea rcx, [rbp + 0x2ad0]
call fcn.18005dd20
mov rdx, qword [rsi]
mov rcx, 0xffffffff80000002
call fcn.180061210
test eax, eax
jne 0x18000fe70
add ebx, r13d
add rsi, 8
cmp ebx, 7
jl 0x18000fe22
mov al, r12b
jmp 0x18000fe73
mov al, r13b
mov byte [rdi + 0x89], al
call fcn.18005fc50
test eax, eax
setne al
mov byte [rdi + 0x8a], al
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x470]
call fcn.1800a8ae0
movups xmm0, xmmword [str.Virtio_Win_]
movaps xmmword [rbp + 0x260], xmm0
movsd xmm1, qword [0x1800fcfa0]
movsd qword [rbp + 0x270], xmm1
xor edx, edx
mov r8d, 0x1f0
lea rcx, [rbp + 0x278]
call fcn.1800a8ae0
call fcn.180061090
lea rdx, [rbp + 0xec0]
test eax, eax
je 0x18000fef4
mov r8d, 0x104
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x18000ff03
xor r9d, r9d
lea r8d, [r9 + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x260]
lea rdx, [rbp + 0xec0]
lea rcx, [rbp + 0x470]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rbp + 0x470]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000ff37
test al, 0x10
mov al, r13b
jne 0x18000ff3a
mov al, r12b
mov byte [rdi + 0x8b], al
lea rax, str.prl_cc.exe
mov qword [rbp - 0x40], rax
lea rax, str.prl_tools.exe
mov qword [rbp - 0x38], rax
mov ebx, r12d
lea rsi, [rbp - 0x40]
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x2cd0]
call fcn.1800a8ae0
mov r9, qword [rsi]
lea r8, str.Checking_Parallels_processes:__s
mov rdx, r14
lea rcx, [rbp + 0x2cd0]
call fcn.18005dd20
mov rcx, qword [rsi]
call fcn.180061370
test eax, eax
jne 0x18000ffa4
add ebx, r13d
add rsi, 8
cmp ebx, 2
jl 0x18000ff5d
mov al, r12b
jmp 0x18000ffa7
mov al, r13b
mov byte [rdi + 0x8c], al
lea rcx, [0x1800fd598]
call fcn.180061260
test eax, eax
setne al
mov byte [rdi + 0x8d], al
call fcn.180060be0
test eax, eax
setne al
mov byte [rdi + 0x82], al
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rsp + 0x58]
cmp dword [rsp + 0x60], eax
jne 0x180010018
mov eax, dword [rsp + 0x5c]
cmp dword [rsp + 0x64], eax
mov al, r13b
je 0x18001001b
mov al, r12b
mov byte [rdi + 0xa8], al
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x48], r12
mov ebx, r12d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call fcn.180061450
test eax, eax
je 0x1800100d6
lea r9, str.SELECT__FROM_Win32_Fan
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call fcn.1800615a0
test eax, eax
je 0x1800100d6
mov qword [rsp + 0x78], r12
mov dword [rsp + 0x44], r12d
jmp 0x1800100a5
mov rax, qword [rcx]
lea rdx, [rsp + 0x44]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x78]
mov r8d, r13d
or edx, 0xffffffff
call qword [rax + 0x20]
cmp dword [rsp + 0x44], r12d
je 0x1800100af
add ebx, r13d
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x180010075
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
test ebx, ebx
sete al
mov byte [rdi + 0x83], al
call fcn.180060580
test eax, eax
setne al
mov byte [rdi + 0x8e], al
call fcn.180060380
mov qword [rdi + 0x90], rax
call fcn.1800601a0
test eax, eax
setne al
mov byte [rdi + 0x98], al
xor edx, edx
lea r8d, [rdx + 0x3c]
lea rcx, [rbp + 0x224]
call fcn.1800a8ae0
mov dword [rbp + 0x220], 0x40
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0x228]
shr rax, 0x1e
mov qword [rdi + 0xa0], rax
call fcn.1800609d0
mov byte [rdi + 0xa9], al
mov rax, qword gs:[0x60]
mov ecx, dword [rax + 0xb8]
mov qword [rdi + 0xb0], rcx
call fcn.1800601a0
test eax, eax
setne al
mov byte [rdi + 0x98], al
call fcn.18005ffd0
test eax, eax
setne al
mov byte [rdi + 0xaa], al
call fcn.180060780
test eax, eax
setne al
mov byte [rdi + 0xb8], al
mov rax, rdi
add rsp, 0x31d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret