Function at 0x401180
Capabilities:
Check if file exists
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x234]
push eax
push 0x20019
push 0
push str.HARDWAREACPIDSDTVBOX__
push 0x80000002
xor bl, bl
call esi
test eax, eax
jne 0x4011db
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402939
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x234]
push eax
push 0x20019
push 0
push str.SOFTWAREVMware__Inc.VMware_Tools
push 0x80000002
call esi
test eax, eax
je 0x4011bb
push edi
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x401244
push 4
push str.VBoxService
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x40123f
push eax
call esi
push edi
mov bl, 1
call esi
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402939
mov esp, ebp
pop ebp
ret
push edi
call esi
xor bl, bl
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x401286
push 4
push str.vmtoolsd
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x401283
push eax
call esi
push edi
mov bl, 1
call esi
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402939
mov esp, ebp
pop ebp
ret
push edi
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push str.C:Program_FilesOracleVirtualBox_Guest_AdditionsVBoxGuest.sys
call esi
test eax, eax
jne 0x401389
push str.C:Program_FilesVMwareVMware_Tools_vmtoolsd.exe
call esi
test eax, eax
jne 0x401389
push str.C:Windows_system32_vmicrdv.dll
call esi
test eax, eax
jne 0x401389
push str.C:Program_FilesSandboxieStart.exe
call esi
test eax, eax
jne 0x401389
push str.C:Windows_system32qemu_ga.exe
call esi
test eax, eax
jne 0x401389
push str.C:Program_FilesParallelsParallels_Toolsprl_tools.exe
call esi
test eax, eax
jne 0x401389
push str.C:Program_FilesCitrixXenToolsxentools.exe
call esi
test eax, eax
jne 0x401389
push str.C:Windows_system32qemu_system_x86_64.exe
call esi
test eax, eax
jne 0x401389
push str.C:Windows_system32_vmusrvc.exe
call esi
test eax, eax
jne 0x401389
push eax
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x40138b
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x401368
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
lea eax, [ebp - 0x20c]
push str.Wsandbox.exe
push eax
call edi
add esp, 8
test eax, eax
je 0x401382
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x401341
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402939
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402939
mov esp, ebp
pop ebp
ret