Function at 0x14000bdd0
Capabilities:
Check for unmoving mouse cursor
Check if process is running under wine
Get memory capacity

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0x88
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov rsi, rcx
xor ebx, ebx
mov dword [rbp - 0x29], ebx
mov qword [rcx + 0x18], SafeArrayLock
mov qword [rcx + 0x10], rbx
cmp qword [rcx + 0x18], 0x10
jb 0x14000be0d
mov rax, qword [rcx]
jmp 0x14000be10
mov rax, rsi
mov byte [rax], bl
lea rax, [rcx + 0x20]
mov qword [rax + 0x18], SafeArrayLock
mov qword [rax + 0x10], rbx
cmp qword [rax + 0x18], 0x10
jb 0x14000be2c
mov rax, qword [rax]
mov byte [rax], bl
lea rax, [rcx + 0x40]
mov qword [rax + 0x18], SafeArrayLock
mov qword [rax + 0x10], rbx
cmp qword [rax + 0x18], 0x10
jb 0x14000be48
mov rax, qword [rax]
mov byte [rax], bl
mov qword [rcx + 0xc0], rbx
mov qword [rcx + 0xc8], rbx
mov qword [rcx + 0xd0], rbx
mov qword [rcx + 0xd8], rbx
mov qword [rcx + 0xe0], rbx
mov qword [rcx + 0xe8], rbx
mov dword [rbp - 0x29], 1
lea rcx, [0x1400c5fe0]
call fcn.1400324d0
test eax, eax
setne al
mov byte [rsi + 0x60], al
lea rcx, str.procexp64.exe
call fcn.140032730
test eax, eax
setne al
mov byte [rsi + 0x61], al
lea rcx, [0x1400c3660]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000becb
lea rdx, str.wine_get_unix_file_name
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
setne al
mov byte [rsi + 0x62], al
call fcn.140030a00
test eax, eax
setne al
mov byte [rsi + 0x63], al
call fcn.14002db90
test eax, eax
setne al
mov byte [rsi + 0x64], al
call fcn.14002dce0
test eax, eax
setne al
mov byte [rsi + 0x65], al
call fcn.14002de30
test eax, eax
setne al
mov byte [rsi + 0x66], al
call fcn.14002e110
test eax, eax
setne al
mov byte [rsi + 0x67], al
lea rcx, [0x1400c43f0]
call fcn.1400324d0
test eax, eax
setne al
mov byte [rsi + 0x68], al
call fcn.14002e2e0
test eax, eax
setne al
mov byte [rsi + 0x69], al
xor edx, edx
lea rcx, str.VBoxTrayToolWndClass
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
lea rdx, str.VBoxTrayToolWnd
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rdi, rdi
jne 0x14000bf5b
test rax, rax
je 0x14000bf5d
mov al, 1
mov byte [rsi + 0x6a], al
call fcn.14002e400
test eax, eax
setne al
mov byte [rsi + 0x6b], al
call fcn.14002e4a0
test eax, eax
setne al
mov byte [rsi + 0x6c], al
call fcn.14002e550
test eax, eax
setne al
mov byte [rsi + 0x6d], al
call fcn.14002e730
test eax, eax
setne al
mov byte [rsi + 0x6e], al
call fcn.14002ea40
test eax, eax
setne al
mov byte [rsi + 0x6f], al
call fcn.14002eb10
test eax, eax
setne al
mov byte [rsi + 0x70], al
call fcn.14002f100
test eax, eax
setne al
mov byte [rsi + 0x71], al
call fcn.14002f310
test eax, eax
setne al
mov byte [rsi + 0x72], al
call fcn.14002ed00
test eax, eax
setne al
mov byte [rsi + 0x73], al
call fcn.14002eee0
test eax, eax
setne al
mov byte [rsi + 0x74], al
call fcn.14002f5a0
test eax, eax
setne al
mov byte [rsi + 0x75], al
call fcn.14002f830
test eax, eax
setne al
mov byte [rsi + 0x76], al
call fcn.14002f970
test eax, eax
setne al
mov byte [rsi + 0x77], al
call fcn.14002fa50
test eax, eax
setne al
mov byte [rsi + 0x78], al
call fcn.14002fd10
test eax, eax
setne al
mov byte [rsi + 0x79], al
call fcn.14002fea0
test eax, eax
setne al
mov byte [rsi + 0x7a], al
call fcn.1400325e0
test eax, eax
setne al
mov byte [rsi + 0x7b], al
call fcn.14002ffa0
test eax, eax
setne al
mov byte [rsi + 0x7c], al
call fcn.1400300a0
test eax, eax
setne al
mov byte [rsi + 0x7d], al
mov edi, ebx
mov dword [rbp + 0x6f], ebx
lea r8, [rbp + 0x6f]
xor edx, edx
mov ecx, 0x52534d42
call fcn.140032960
test rax, rax
je 0x14000c0bd
mov r8d, dword [rbp + 0x6f]
mov rdx, rbx
lea rcx, [r8 - 6]
test rcx, rcx
je 0x14000c0b3
lea rcx, [r8 - 6]
movzx r8d, word [0x1400c5130]
mov r9d, dword [str.VMware]
cmp dword [rdx + rax], r9d
jne 0x14000c0a2
cmp word [rdx + rax + 4], r8w
je 0x14000c0ac
inc rdx
cmp rdx, rcx
jae 0x14000c0b3
jmp 0x14000c094
mov edi, 1
jmp 0x14000c0b5
mov edi, ebx
mov rcx, rax
call fcn.140079704
mov byte [rsi + 0x7e], dil
call fcn.140030170
test eax, eax
setne al
mov byte [rsi + 0x7f], al
call fcn.140030330
test eax, eax
setne al
mov byte [rsi + 0x80], al
call fcn.1400303e0
test eax, eax
setne al
mov byte [rsi + 0x81], al
call fcn.1400304c0
test eax, eax
setne al
mov byte [rsi + 0x84], al
call fcn.1400305b0
test eax, eax
setne al
mov byte [rsi + 0x85], al
call fcn.140030670
test eax, eax
setne al
mov byte [rsi + 0x86], al
call fcn.140030850
test eax, eax
setne al
mov byte [rsi + 0x87], al
mov dword [rbp + 0x77], ebx
lea r8, [rbp + 0x77]
xor edx, edx
mov ecx, 0x52534d42
call fcn.140032960
mov r8, rax
xor edi, edi
test rax, rax
je 0x14000c1a1
mov r9d, dword [rbp + 0x77]
mov rdx, rbx
lea rcx, [r9 - 4]
test rcx, rcx
je 0x14000c173
lea rax, [r9 - 4]
mov ecx, dword [0x1400c5374]
cmp dword [rdx + r8], ecx
je 0x14000c196
inc rdx
cmp rdx, rax
jb 0x14000c165
lea rax, [r9 - 4]
test rax, rax
je 0x14000c199
lea rax, [r9 - 4]
mov ecx, dword [str.QEMU]
cmp dword [rbx + r8], ecx
je 0x14000c196
inc rbx
cmp rbx, rax
jb 0x14000c186
jmp 0x14000c199
mov dil, 1
mov rcx, r8
call fcn.140079704
mov byte [rsi + 0x88], dil
call fcn.140030ac0
test eax, eax
setne al
mov byte [rsi + 0x89], al
call fcn.140030be0
test eax, eax
setne al
mov byte [rsi + 0x8a], al
call fcn.140030e80
test eax, eax
setne al
mov byte [rsi + 0x8b], al
call fcn.140031e20
test eax, eax
setne al
mov byte [rsi + 0x8c], al
lea rcx, [0x1400c5e30]
call fcn.1400324d0
test eax, eax
setne al
mov byte [rsi + 0x8d], al
call fcn.140031f30
test eax, eax
setne al
mov byte [rsi + 0x82], al
xor eax, eax
mov qword [rbp - 0x21], rax
mov qword [rbp + 0x7f], rax
lea rcx, [rbp - 0x21]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x7f]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rbp + 0x7f]
cmp dword [rbp - 0x21], eax
jne 0x14000c24f
mov eax, dword [rbp + 0x83]
cmp dword [rbp - 0x1d], eax
jne 0x14000c24f
mov al, 1
jmp 0x14000c251
xor eax, eax
mov byte [rsi + 0xa8], al
call fcn.1400318b0
test eax, eax
setne al
mov byte [rsi + 0x83], al
call fcn.1400316b0
test eax, eax
setne al
mov byte [rsi + 0x8e], al
call fcn.1400314b0
mov qword [rsi + 0x90], rax
call fcn.1400312d0
test eax, eax
setne al
mov byte [rsi + 0x98], al
xor eax, eax
mov qword [rbp - 5], rax
mov qword [rbp + 3], rax
mov qword [rbp + 0xb], rax
mov qword [rbp + 0x13], rax
mov qword [rbp + 0x1b], rax
mov qword [rbp + 0x23], rax
mov qword [rbp + 0x2b], rax
mov dword [rbp + 0x33], eax
mov dword [rbp - 9], 0x40
lea rcx, [rbp - 9]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp - 1]
shr rax, 0x1e
mov qword [rsi + 0xa0], rax
call fcn.140031c80
mov byte [rsi + 0xa9], al
mov rax, qword gs:[0x60]
mov ecx, dword [rax + 0xb8]
mov qword [rsi + 0xb0], rcx
call fcn.1400312d0
test eax, eax
setne al
mov byte [rsi + 0x98], al
call fcn.140031100
test eax, eax
setne al
mov byte [rsi + 0xaa], al
call fcn.140031a30
test eax, eax
setne al
mov byte [rsi + 0xb8], al
mov rax, rsi
add rsp, 0x88
pop rdi
pop rsi
pop rbx
pop rbp
ret