Function at 0x140004a52
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rbx
sub rsp, 0x238
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1d0], rcx
mov qword [rbp + 0x1d8], rdx
lea rax, str.system32driversVBoxMouse.sys
mov qword [rbp - 0x30], rax
lea rax, str.system32driversVBoxGuest.sys
mov qword [rbp - 0x28], rax
lea rax, str.system32driversVBoxSF.sys
mov qword [rbp - 0x20], rax
lea rax, str.system32driversVBoxVideo.sys
mov qword [rbp - 0x18], rax
lea rax, str.system32_vboxdisp.dll
mov qword [rbp - 0x10], rax
lea rax, str.system32_vboxhook.dll
mov qword [rbp - 8], rax
lea rax, str.system32_vboxmrxnp.dll
mov qword [rbp], rax
lea rax, str.system32_vboxogl.dll
mov qword [rbp + 8], rax
lea rax, str.system32_vboxoglarrayspu.dll
mov qword [rbp + 0x10], rax
lea rax, str.system32_vboxoglcrutil.dll
mov qword [rbp + 0x18], rax
lea rax, str.system32_vboxoglerrorspu.dll
mov qword [rbp + 0x20], rax
lea rax, str.system32_vboxoglfeedbackspu.dll
mov qword [rbp + 0x28], rax
lea rax, str.system32_vboxoglpackspu.dll
mov qword [rbp + 0x30], rax
lea rax, str.system32_vboxoglpassthroughspu.dll
mov qword [rbp + 0x38], rax
lea rax, str.system32_vboxservice.exe
mov qword [rbp + 0x40], rax
lea rax, str.system32_vboxtray.exe
mov qword [rbp + 0x48], rax
lea rax, str.system32VBoxControl.exe
mov qword [rbp + 0x50], rax
lea rax, str.system32drivers_vmmouse.sys
mov qword [rbp + 0x58], rax
lea rax, str.system32drivers_vmhgfs.sys
mov qword [rbp + 0x60], rax
lea rax, str.system32drivers_vm3dmp.sys
mov qword [rbp + 0x68], rax
lea rax, str.system32drivers_vmci.sys
mov qword [rbp + 0x70], rax
lea rax, str.system32drivers_vmhgfs.sys
mov qword [rbp + 0x78], rax
lea rax, str.system32drivers_vmmemctl.sys
mov qword [rbp + 0x80], rax
lea rax, str.system32drivers_vmmouse.sys
mov qword [rbp + 0x88], rax
lea rax, str.system32drivers_vmrawdsk.sys
mov qword [rbp + 0x90], rax
lea rax, str.system32drivers_vmusbmouse.sys
mov qword [rbp + 0x98], rax
lea rax, [rbp - 0x30]
add rax, 0xd0
lea rdx, [rbp + 0xaf]
mov qword [rbp + 0x198], rdx
nop
nop
lea r8, [rbp + 0xaf]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
mov r9, r8
mov r8, rax
call method.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______.vector_char_const_const__void__char_const_const__cha
nop
lea rax, [rbp - 0x50]
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0x1a8]
mov rcx, rax
call dbg.std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >::begin()
mov qword [rbp - 0x58], rax
mov rax, qword [rbp + 0x1a8]
mov rcx, rax
call dbg.std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >::end()
mov qword [rbp - 0x60], rax
jmp 0x140004d0d
lea rax, [rbp - 0x58]
mov rcx, rax
call sym.__gnu_cxx::__normal_iterator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_________::operator___const
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::c_str() const
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call rax
cmp eax, 0xffffffff
setne al
test al, al
je 0x140004d01
lea rax, [rbp + 0xe0]
mov rdx, qword [rbp + 0x1a0]
mov r8, rdx
lea rdx, str.detected_via_file_system:
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rdx, [rbp + 0xe0]
lea rax, [rbp + 0xb0]
mov rcx, rax
call method.std::optional_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____::optional_std::__cxx11::basic_string_char__std::char_traits_char___std.allocator_char_____true__std::__cxx11::basic_string_char__std::char_traits_char__
lea rax, [rbp + 0x12f]
mov qword [rbp + 0x190], rax
nop
nop
lea rdx, [rbp + 0x12f]
lea rax, [rbp + 0x100]
mov r8, rdx
lea rdx, str.file_system_checks
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string<std::allocator<char> >(char const*, std::allocator<char> const&)
lea rcx, [rbp + 0xb0]
lea rdx, [rbp + 0x100]
mov rax, qword [rbp + 0x1d0]
mov r9d, 1
mov r8, rcx
mov rcx, rax
call method.protection::checks::base::CheckResult.CheckResult_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::optional_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char______const__bool_
lea rax, [rbp + 0x100]
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string()
nop
lea rax, [rbp + 0xb0]
mov rcx, rax
call dbg.std::optional<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >::~optional()
lea rax, [rbp + 0xe0]
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string()
jmp 0x140004dae
lea rax, [rbp - 0x58]
mov rcx, rax
call sym.__gnu_cxx::__normal_iterator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_________::operator__
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x58]
mov rcx, rax
call sym._ZN9__gnu_cxxeqIPNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt6vectorIS6_SaIS6_EEEEbRKNS_17__normal_iteratorIT_T0_EES
xor eax, 1
test al, al
jne 0x140004c06
lea rax, [rbp + 0x130]
mov edx, ebx
mov rcx, rax
call dbg.std::optional<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >::optional(std::nullopt_t)
lea rax, [rbp + 0x187]
mov qword [rbp + 0x188], rax
nop
nop
lea rdx, [rbp + 0x187]
lea rax, [rbp + 0x160]
mov r8, rdx
lea rdx, str.file_system_checks
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string<std::allocator<char> >(char const*, std::allocator<char> const&)
lea rcx, [rbp + 0x130]
lea rdx, [rbp + 0x160]
mov rax, qword [rbp + 0x1d0]
mov r9d, 0
mov r8, rcx
mov rcx, rax
call method.protection::checks::base::CheckResult.CheckResult_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::optional_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char______const__bool_
lea rax, [rbp + 0x160]
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string()
nop
lea rax, [rbp + 0x130]
mov rcx, rax
call dbg.std::optional<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >::~optional()
lea rax, [rbp - 0x50]
mov rcx, rax
call dbg.std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >::~vector()
jmp 0x140004e40
mov rax, qword [rbp + 0x1d0]
add rsp, 0x238
pop rbx
pop rbp
ret