Function at 0x1801d4d10
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get common file path
Get file attributes
Reference processor manufacturer constants

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rdi, rdx
movzx r13d, cl
mov edx, 0x104
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, eax
lea ebx, [rsi - 2]
cmp ebx, 0x101
ja 0x1801d51e0
mov eax, 0x5c
lea rcx, [rbp - 0x80]
mov word [rbp + rsi*2 - 0x80], ax
lea r8, str.WinHvPlatform.dll
inc esi
mov edx, 0x144
mov eax, esi
sub rdx, rax
lea rcx, [rcx + rsi*2]
call qword [sym.imp.VBoxRT.dll_RTUtf16CopyAscii]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1801d4dae
lea r9, [rbp - 0x80]
mov edx, 0xffffe56f
lea r8, str.The_native_API_dll_was_not_found___ls_
mov rcx, rdi
call qword [sym.imp.VBoxRT.dll_RTErrInfoSetF]
add rsp, 0x320
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor eax, eax
xor ecx, ecx
cpuid
dec eax
cmp eax, 0xffffe
ja 0x1801d51bd
xor ecx, ecx
mov eax, 1
cpuid
test ecx, ecx
js 0x1801d4df1
lea r8, str.Not_in_a_hypervisor_partition__HVP0_
mov edx, 0xffffe56f
mov rcx, rdi
call qword [sym.imp.VBoxRT.dll_RTErrInfoSet]
add rsp, 0x320
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor ebx, ebx
lea rax, [rbp + 0x260]
mov qword [rsp + 0x38], rax
xor r9d, r9d
lea rax, [rbp + 0x268]
mov dword [rsp + 0x54], ebx
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rsp + 0x54]
mov dword [rbp + 0x268], ebx
mov ecx, 0x40000000
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x260], ebx
call sub.VBoxRT.dll_ASMCpuIdExSlow
mov r9d, dword [rsp + 0x54]
lea eax, [r9 - 0x40000000]
cmp eax, 0xfffffff
ja 0x1801d517e
mov edx, dword [rsp + 0x50]
mov eax, dword [rbp + 0x268]
mov ecx, dword [rbp + 0x260]
cmp edx, 0x7263694d
jne 0x1801d5138
cmp eax, 0x666f736f
jne 0x1801d5138
cmp ecx, 0x76482074
jne 0x1801d5138
cmp r9d, 0x40000005
jae 0x1801d4ebb
lea r8, str.Too_narrow_hypervisor_CPUID_range___x_
mov edx, 0xffffe56f
mov rcx, rdi
call qword [sym.imp.VBoxRT.dll_RTErrInfoSetF]
add rsp, 0x320
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rsp + 0x350], r12
lea rsi, [rsp + 0x58]
mov qword [rsp + 0x318], r14
lea r12, str.WinHvPlatform.dll
xorps xmm0, xmm0
mov qword [rsp + 0x310], r15
mov r15d, ebx
mov r14d, 2
movdqu xmmword [rsp + 0x58], xmm0
mov rcx, qword [rbx + r12]
mov r8, rsi
mov dl, 1
call qword [sym.imp.VBoxRT.dll_RTLdrLoadSystem]
mov edx, eax
test eax, eax
jns 0x1801d4f56
mov r9, qword [rbx + r12]
test rdi, rdi
je 0x1801d4f1d
mov eax, dword [rdi]
and eax, 0xffff0004
cmp eax, 0xbabe0004
je 0x1801d4f33
lea r8, str.Failed_to_load_API_DLL:__s:__Rrc
mov dword [rsp + 0x20], edx
mov rcx, rdi
call qword [sym.imp.VBoxRT.dll_RTErrInfoSetF]
jmp 0x1801d4f47
lea r8, str.___s:__Rrc
mov dword [rsp + 0x20], edx
mov rcx, rdi
call qword [sym.imp.VBoxRT.dll_RTErrInfoAddF]
mov qword [rsp + rbx + 0x58], 0
mov r15d, 0xffffe56e
add rsi, 8
add rbx, 8
sub r14, 1
jne 0x1801d4ef1
lea r12d, [r14 + 2]
test r15d, r15d
js 0x1801d50f7
mov rcx, qword [rsp + 0x60]
mov rdx, rdi
call fcn.1801d5210
mov r15d, eax
test eax, eax
js 0x1801d50f7
lea r14d, [r12 + 0x10]
lea r12, str.WinHvPlatform.dll
lea rbx, [0x18052abf1]
nop dword [rax]
movzx ecx, byte [rbx - 1]
mov r8, qword [rbx + 7]
mov rdx, qword [rbx + 0xf]
mov rcx, qword [rsp + rcx*8 + 0x58]
call qword [sym.imp.VBoxRT.dll_RTLdrGetSymbol]
mov esi, eax
test eax, eax
js 0x1801d5010
cmp byte [rbx], 0
je 0x1801d50e5
mov ecx, 0x1550010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1801d50e5
movzx edx, byte [rbx - 1]
lea r9, str.NEM:__info:_Found_optional_import__s__s._n
mov rcx, qword [rbx + 0xf]
mov r8d, 0x155
mov qword [rsp + 0x28], rcx
mov rcx, qword [r12 + rdx*8]
mov edx, 0x10
mov qword [rsp + 0x20], rcx
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
jmp 0x1801d50e5
mov rax, qword [rbx + 7]
mov ecx, 0x1550010
mov qword [rax], 0
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1801d5088
cmp byte [rbx], 0
movzx ecx, byte [rbx - 1]
mov rdx, qword [rbx + 0xf]
mov r8, qword [r12 + rcx*8]
je 0x1801d5045
lea rcx, str.info
jmp 0x1801d505a
test r13b, r13b
lea rcx, str.error
lea r9, str.fatal
cmovne rcx, r9
mov dword [rsp + 0x38], esi
lea r9, str.NEM:___s:_Failed_to_import__s__s:__Rrc
mov qword [rsp + 0x30], rdx
mov edx, 0x10
mov qword [rsp + 0x28], r8
mov r8d, 0x155
mov qword [rsp + 0x20], rcx
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
cmp byte [rbx], 0
jne 0x1801d50e5
movzx eax, byte [rbx - 1]
mov rcx, qword [rbx + 0xf]
lea r9, [r12 + rax*8]
test rdi, rdi
je 0x1801d50c8
mov eax, dword [rdi]
and eax, 0xffff0004
cmp eax, 0xbabe0004
jne 0x1801d50c8
mov r9, qword [r9]
lea r8, str.___s__s
mov qword [rsp + 0x20], rcx
mov edx, esi
mov rcx, rdi
call qword [sym.imp.VBoxRT.dll_RTErrInfoAddF]
jmp 0x1801d50e5
mov r9, qword [r9]
lea r8, str.Failed_to_import:__s__s
mov qword [rsp + 0x20], rcx
mov edx, esi
mov rcx, rdi
call qword [sym.imp.VBoxRT.dll_RTErrInfoSetF]
mov r15d, eax
add rbx, 0x18
sub r14, 1
jne 0x1801d4fa0
lea r12d, [r14 + 2]
mov r14, qword [rsp + 0x318]
lea rbx, [rsp + 0x58]
mov rcx, qword [rbx]
call qword [sym.imp.VBoxRT.dll_RTLdrClose]
lea rbx, [rbx + 8]
sub r12, 1
jne 0x1801d5104
mov r12, qword [rsp + 0x350]
mov eax, r15d
mov r15, qword [rsp + 0x310]
add rsp, 0x320
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov dword [rsp + 0x40], 0x76482074
lea r8, str.Not_Hyper_V_CPUID_signature:__x__x__x__expected__x__x__x_
mov dword [rsp + 0x38], 0x666f736f
mov r9d, edx
mov dword [rsp + 0x30], 0x7263694d
mov edx, 0xffffe56f
mov dword [rsp + 0x28], ecx
mov rcx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.VBoxRT.dll_RTErrInfoSetF]
add rsp, 0x320
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, dword [rbp + 0x260]
lea r8, str.Invalid_hypervisor_CPUID_range___x__x__x__x_
mov dword [rsp + 0x30], eax
mov edx, 0xffffe56f
mov eax, dword [rbp + 0x268]
mov rcx, rdi
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
call qword [sym.imp.VBoxRT.dll_RTErrInfoSetF]
add rsp, 0x320
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea r8, str.No_CPUID_leaf_1
mov edx, 0xffffe56f
mov rcx, rdi
call qword [sym.imp.VBoxRT.dll_RTErrInfoSet]
add rsp, 0x320
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, esi
lea r8, str.GetSystemDirectoryW_failed___x____u_
mov edx, 0xffffe56e
mov dword [rsp + 0x20], eax
mov rcx, rdi
call qword [sym.imp.VBoxRT.dll_RTErrInfoSetF]
add rsp, 0x320
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret