Function at 0x14001136b
Capabilities:
Check if file exists
Check if process is running under wine
Get file attributes
Get installed programs

Disassembly:
jmp 0x14001dd20
push rbp
push rsi
push rdi
mov eax, 0x1b50
call fcn.14001127b
sub rsp, rax
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x548
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14003f040]
xor rax, rbp
mov qword [rbp + 0x1b10], rax
lea rcx, [0x140047114]
call fcn.140011d7f
nop
mov edx, 0x20
lea rcx, [rbp + 8]
call fcn.140011767
mov qword [rbp + 0x7c8], 0xffffffff80000002
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallMicrosoft_Teams
lea rdx, [rbp + 0x7c8]
lea rcx, [rbp + 0x12c0]
call fcn.1400119d8
nop
mov qword [rbp + 0x7e8], 0xffffffff80000002
lea r8, str.SOFTWAREWOW6432NodeMicrosoftOfficeTeams
lea rdx, [rbp + 0x7e8]
lea rcx, [rbp + 0x12f0]
call fcn.140011578
nop
mov qword [rbp + 0x808], 0xffffffff80000002
lea r8, str.SOFTWAREMicrosoftWindows_Advanced_Threat_ProtectionTelLib
lea rdx, [rbp + 0x808]
lea rcx, [rbp + 0x1320]
call fcn.140011c08
nop
mov qword [rbp + 0x828], 0xffffffff80000002
lea r8, str.SOFTWAREZscaler_Inc.Zscaler
lea rdx, [rbp + 0x828]
lea rcx, [rbp + 0x1350]
call fcn.140011839
nop
mov qword [rbp + 0x848], 0xffffffff80000002
lea r8, str.SOFTWAREZoomUMXPerInstall
lea rdx, [rbp + 0x848]
lea rcx, [rbp + 0x1380]
call fcn.1400119bf
nop
mov qword [rbp + 0x868], 0xffffffff80000002
lea r8, str.SOFTWAREZoomUMXMSI
lea rdx, [rbp + 0x868]
lea rcx, [rbp + 0x13b0]
call fcn.140011a0f
nop
mov qword [rbp + 0x888], 0xffffffff80000002
lea r8, str.SOFTWAREClientsZoomPBX
lea rdx, [rbp + 0x888]
lea rcx, [rbp + 0x13e0]
call fcn.140011794
nop
mov qword [rbp + 0x8a8], 0xffffffff80000002
lea r8, str.SOFTWAREWOW6432NodePoliciesMicrosoftAzureADAccount
lea rdx, [rbp + 0x8a8]
lea rcx, [rbp + 0x1410]
call fcn.14001178f
nop
mov qword [rbp + 0x8c8], 0xffffffff80000002
lea r8, str.SOFTWAREWOW6432NodePoliciesMicrosoftcloudoffice16.0Commonofficesvcmanager
lea rdx, [rbp + 0x8c8]
lea rcx, [rbp + 0x1440]
call fcn.1400116cc
nop
mov qword [rbp + 0x8e8], 0xffffffff80000002
lea r8, str.SOFTWAREWOW6432NodePoliciesMicrosoftcloudoffice16.0Commonofficeupdate
lea rdx, [rbp + 0x8e8]
lea rcx, [rbp + 0x1470]
call fcn.1400110aa
nop
mov qword [rbp + 0x908], 0xffffffff80000002
lea r8, str.SOFTWAREWOW6432NodePoliciesMicrosoftOneDrive
lea rdx, [rbp + 0x908]
lea rcx, [rbp + 0x14a0]
call fcn.1400115e1
nop
mov qword [rbp + 0x928], 0xffffffff80000002
lea r8, str.SOFTWAREWOW6432NodePoliciesMicrosoftOneDriveEnableODIgnoreListFromGPO
lea rdx, [rbp + 0x928]
lea rcx, [rbp + 0x14d0]
call fcn.1400118e8
nop
mov qword [rbp + 0x948], 0xffffffff80000002
lea r8, str.SOFTWAREWOW6432NodePoliciesMicrosoftWindows_DefenderMpEngine
lea rdx, [rbp + 0x948]
lea rcx, [rbp + 0x1500]
call fcn.14001178a
nop
mov qword [rbp + 0x968], 0xffffffff80000002
lea r8, str.SOFTWAREWOW6432NodePoliciesMicrosoftWindows_DefenderPolicy_Manager
lea rdx, [rbp + 0x968]
lea rcx, [rbp + 0x1530]
call fcn.140011a87
nop
mov qword [rbp + 0x988], 0xffffffff80000002
lea r8, str.SOFTWAREWOW6432NodePoliciesMicrosoftWindows_Defender_Security_Center
lea rdx, [rbp + 0x988]
lea rcx, [rbp + 0x1560]
call fcn.140011406
nop
mov qword [rbp + 0x9a8], 0xffffffff80000002
lea r8, str.SOFTWAREWOW6432NodePoliciesMicrosoftWindows_Defender_Security_CenterApp_and_Browser_protection
lea rdx, [rbp + 0x9a8]
lea rcx, [rbp + 0x1590]
call fcn.14001150f
nop
mov qword [rbp + 0x9c8], 0xffffffff80000002
lea r8, str.SOFTWAREWOW6432NodePoliciesMicrosoftWindows_Defender_Security_CenterDevice_performance_and_health
lea rdx, [rbp + 0x9c8]
lea rcx, [rbp + 0x15c0]
call fcn.140011505
nop
mov qword [rbp + 0x9e8], 0xffffffff80000002
lea r8, str.SOFTWAREWOW6432NodePoliciesMicrosoftWindows_Defender_Security_CenterDevice_security
lea rdx, [rbp + 0x9e8]
lea rcx, [rbp + 0x15f0]
call fcn.140011e88
nop
mov qword [rbp + 0xa08], 0xffffffff80000002
lea r8, str.SOFTWAREWOW6432NodePoliciesMicrosoftWindows_Defender_Security_CenterEnterprise_Customization
lea rdx, [rbp + 0xa08]
lea rcx, [rbp + 0x1620]
call fcn.140011d70
nop
mov qword [rbp + 0xa28], 0xffffffff80000002
lea r8, str.SOFTWAREWOW6432NodePoliciesMicrosoftWindows_Defender_Security_CenterFamily_options
lea rdx, [rbp + 0xa28]
lea rcx, [rbp + 0x1650]
call fcn.140011695
nop
mov qword [rbp + 0xa48], 0xffffffff80000002
lea r8, str.SOFTWAREWOW6432NodePoliciesMicrosoftWindows_Defender_Security_CenterFirewall_and_network_protection
lea rdx, [rbp + 0xa48]
lea rcx, [rbp + 0x1680]
call fcn.140011e15
nop
mov qword [rbp + 0xa68], 0xffffffff80000002
lea r8, str.SOFTWAREMicrosoftIntuneManagementExtension
lea rdx, [rbp + 0xa68]
lea rcx, [rbp + 0x16b0]
call fcn.140011924
nop
mov qword [rbp + 0xa88], 0xffffffff80000002
lea r8, str.SOFTWAREMicrosoftIntuneWindowsAgent
lea rdx, [rbp + 0xa88]
lea rcx, [rbp + 0x16e0]
call fcn.1400110dc
nop
mov qword [rbp + 0xaa8], 0xffffffff80000002
lea r8, str.SOFTWAREFastTrack_SoftwareAdmin_By_Request
lea rdx, [rbp + 0xaa8]
lea rcx, [rbp + 0x1710]
call fcn.140011924
nop
mov qword [rbp + 0xac8], 0xffffffff80000002
lea r8, str.SOFTWARECode42_AAT
lea rdx, [rbp + 0xac8]
lea rcx, [rbp + 0x1740]
call fcn.140011451
nop
mov qword [rbp + 0xae8], 0xffffffff80000002
lea r8, str.SOFTWAREDell_Inc.DellDataVault
lea rdx, [rbp + 0xae8]
lea rcx, [rbp + 0x1770]
call fcn.1400116fe
nop
mov qword [rbp + 0xb08], 0xffffffff80000002
lea r8, str.HARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0
lea rdx, [rbp + 0xb08]
lea rcx, [rbp + 0x17a0]
call fcn.140011a91
nop
mov qword [rbp + 0xb28], 0xffffffff80000002
lea r8, str.HARDWAREDescriptionSystem
lea rdx, [rbp + 0xb28]
lea rcx, [rbp + 0x17d0]
call fcn.140011cc1
nop
mov qword [rbp + 0xb48], 0xffffffff80000002
lea r8, str.SYSTEMControlSet001ControlSystemInformation
lea rdx, [rbp + 0xb48]
lea rcx, [rbp + 0x1800]
call fcn.140011a9b
nop
mov qword [rbp + 0xb68], 0xffffffff80000002
lea r8, str.HARDWAREACPIDSDTVBOX__
lea rdx, [rbp + 0xb68]
lea rcx, [rbp + 0x1830]
call fcn.140011794
nop
mov qword [rbp + 0xb88], 0xffffffff80000002
lea r8, str.HARDWAREACPIFADTVBOX__
lea rdx, [rbp + 0xb88]
lea rcx, [rbp + 0x1860]
call fcn.140011794
nop
mov qword [rbp + 0xba8], 0xffffffff80000002
lea r8, str.HARDWAREACPIRSDTVBOX__
lea rdx, [rbp + 0xba8]
lea rcx, [rbp + 0x1890]
call fcn.140011794
nop
mov qword [rbp + 0xbc8], 0xffffffff80000002
lea r8, str.SOFTWAREOracleVirtualBox_Guest_Additions
lea rdx, [rbp + 0xbc8]
lea rcx, [rbp + 0x18c0]
call fcn.1400119a6
nop
mov qword [rbp + 0xbe8], 0xffffffff80000002
lea r8, str.SYSTEMControlSet001ServicesVBoxGuest
lea rdx, [rbp + 0xbe8]
lea rcx, [rbp + 0x18f0]
call fcn.140011190
nop
mov qword [rbp + 0xc08], 0xffffffff80000002
lea r8, str.SYSTEMControlSet001ServicesVBoxMouse
lea rdx, [rbp + 0xc08]
lea rcx, [rbp + 0x1920]
call fcn.140011190
nop
mov qword [rbp + 0xc28], 0xffffffff80000002
lea r8, str.SYSTEMControlSet001ServicesVBoxService
lea rdx, [rbp + 0xc28]
lea rcx, [rbp + 0x1950]
call fcn.1400112b2
nop
mov qword [rbp + 0xc48], 0xffffffff80000002
lea r8, str.SYSTEMControlSet001ServicesVBoxSF
lea rdx, [rbp + 0xc48]
lea rcx, [rbp + 0x1980]
call fcn.140011a4b
nop
mov qword [rbp + 0xc68], 0xffffffff80000002
lea r8, str.SYSTEMControlSet001ServicesVBoxVideo
lea rdx, [rbp + 0xc68]
lea rcx, [rbp + 0x19b0]
call fcn.140011190
nop
mov qword [rbp + 0xc88], 0xffffffff80000002
lea r8, str.SOFTWAREVMware__Inc.VMware_Tools
lea rdx, [rbp + 0xc88]
lea rcx, [rbp + 0x19e0]
call fcn.140011960
nop
mov qword [rbp + 0xca8], 0xffffffff80000002
lea r8, str.SOFTWAREWine
lea rdx, [rbp + 0xca8]
lea rcx, [rbp + 0x1a10]
call fcn.140011555
nop
mov qword [rbp + 0xcc8], 0xffffffff80000002
lea r8, str.SOFTWAREMicrosoftVirtual_MachineGuestParameters
lea rdx, [rbp + 0xcc8]
lea rcx, [rbp + 0x1a40]
call fcn.140011820
nop
mov qword [rbp + 0xce8], 0xffffffff80000002
lea r8, str.SYSTEMCurrentControlSetServicesDiskEnum
lea rdx, [rbp + 0xce8]
lea rcx, [rbp + 0x1a70]
call fcn.140011578
nop
mov qword [rbp + 0xd08], 0xffffffff80000002
lea r8, str.SYSTEMCurrentControlSetEnumIDE
lea rdx, [rbp + 0xd08]
lea rcx, [rbp + 0x1aa0]
call fcn.1400116fe
nop
mov qword [rbp + 0xd28], 0xffffffff80000002
lea r8, str.SYSTEMCurrentControlSetEnumSCSI
lea rdx, [rbp + 0xd28]
lea rcx, [rbp + 0x1ad0]
call fcn.140011960
nop
lea rcx, [rbp + 0x7a4]
call fcn.140011460
mov qword [rbp + 0x1b08], rax
lea rcx, [rbp + 0x1b00]
mov r8, rcx
lea rdx, [rbp + 0x12c0]
lea rcx, [rbp + 0xd48]
call fcn.140011acd
lea rcx, [rbp + 0xe30]
mov rdi, rcx
mov rsi, rax
mov ecx, select
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp + 0x1b08]
mov r8, rax
lea rdx, [rbp + 0xe30]
lea rcx, [rbp + 8]
call fcn.1400112ad
nop
lea r9, [fcn.140011cf3]
mov r8d, 0x2c
mov edx, 0x30
lea rcx, [rbp + 0x12c0]
call fcn.140011366
nop
lea rax, [rbp + 8]
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x48]
call fcn.140011dcf
mov qword [rbp + 0x68], rax
mov rcx, qword [rbp + 0x48]
call fcn.140011df7
mov qword [rbp + 0x88], rax
jmp 0x14001e4ac
mov rax, qword [rbp + 0x68]
add rax, 0x30
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x88]
cmp qword [rbp + 0x68], rax
je 0x14001e532
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
add rax, 8
mov rcx, rax
call fcn.14001148d
lea rcx, [rbp + 0xc8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001e52d
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov byte [rbp + 0xd74], 1
lea rcx, [rbp + 8]
call fcn.14001106e
movzx eax, byte [rbp + 0xd74]
jmp 0x14001e898
jmp 0x14001e4a0
mov edx, 0x20
lea rcx, [rbp + 0xe8]
call fcn.140011ccb
lea rdx, str.system32driversVBoxMouse.sys
lea rcx, [rbp + 0xe90]
call fcn.140011479
nop
lea rdx, str.system32driversVBoxGuest.sys
lea rcx, [rbp + 0xeb8]
call fcn.140011479
nop
lea rdx, str.system32driversVBoxSF.sys
lea rcx, [rbp + 0xee0]
call fcn.140011479
nop
lea rdx, str.system32driversVBoxVideo.sys
lea rcx, [rbp + 0xf08]
call fcn.140011479
nop
lea rdx, str.system32_vboxdisp.dll
lea rcx, [rbp + 0xf30]
call fcn.140011479
nop
lea rdx, str.system32_vboxhook.dll
lea rcx, [rbp + 0xf58]
call fcn.140011479
nop
lea rdx, str.system32_vboxmrxnp.dll
lea rcx, [rbp + 0xf80]
call fcn.140011479
nop
lea rdx, str.system32_vboxogl.dll
lea rcx, [rbp + 0xfa8]
call fcn.140011479
nop
lea rdx, str.system32_vboxoglarrayspu.dll
lea rcx, [rbp + 0xfd0]
call fcn.140011479
nop
lea rdx, str.system32_vboxoglcrutil.dll
lea rcx, [rbp + 0xff8]
call fcn.140011479
nop
lea rdx, str.system32_vboxoglerrorspu.dll
lea rcx, [rbp + 0x1020]
call fcn.140011479
nop
lea rdx, str.system32_vboxoglfeedbackspu.dll
lea rcx, [rbp + 0x1048]
call fcn.140011479
nop
lea rdx, str.system32_vboxoglpackspu.dll
lea rcx, [rbp + 0x1070]
call fcn.140011479
nop
lea rdx, str.system32_vboxoglpassthroughspu.dll
lea rcx, [rbp + 0x1098]
call fcn.140011479
nop
lea rdx, str.system32_vboxservice.exe
lea rcx, [rbp + 0x10c0]
call fcn.140011479
nop
lea rdx, str.system32_vboxtray.exe
lea rcx, [rbp + 0x10e8]
call fcn.140011479
nop
lea rdx, str.system32VBoxControl.exe
lea rcx, [rbp + 0x1110]
call fcn.140011479
nop
lea rdx, str.system32drivers_vmmouse.sys
lea rcx, [rbp + 0x1138]
call fcn.140011479
nop
lea rdx, str.system32drivers_vmhgfs.sys
lea rcx, [rbp + 0x1160]
call fcn.140011479
nop
lea rdx, str.system32drivers_vm3dmp.sys
lea rcx, [rbp + 0x1188]
call fcn.140011479
nop
lea rdx, str.system32drivers_vmci.sys
lea rcx, [rbp + 0x11b0]
call fcn.140011479
nop
lea rdx, str.system32drivers_vmhgfs.sys
lea rcx, [rbp + 0x11d8]
call fcn.140011479
nop
lea rdx, str.system32drivers_vmmemctl.sys
lea rcx, [rbp + 0x1200]
call fcn.140011479
nop
lea rdx, str.system32drivers_vmmouse.sys
lea rcx, [rbp + 0x1228]
call fcn.140011479
nop
lea rdx, str.system32drivers_vmrawdsk.sys
lea rcx, [rbp + 0x1250]
call fcn.140011479
nop
lea rdx, str.system32drivers_vmusbmouse.sys
lea rcx, [rbp + 0x1278]
call fcn.140011479
nop
lea rcx, [rbp + 0xd94]
call fcn.1400118f7
mov qword [rbp + 0x1b08], rax
lea rcx, [rbp + 0x12a0]
mov r8, rcx
lea rdx, [rbp + 0xe90]
lea rcx, [rbp + 0xdb8]
call fcn.140011631
lea rcx, [rbp + 0xe60]
mov rdi, rcx
mov rsi, rax
mov ecx, select
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp + 0x1b08]
mov r8, rax
lea rdx, [rbp + 0xe60]
lea rcx, [rbp + 0xe8]
call fcn.1400118d4
nop
lea r9, [fcn.140011bae]
mov r8d, 0x1a
mov edx, 0x28
lea rcx, [rbp + 0xe90]
call fcn.140011366
nop
lea rax, [rbp + 0xe8]
mov qword [rbp + 0x128], rax
mov rcx, qword [rbp + 0x128]
call fcn.1400119f6
mov qword [rbp + 0x148], rax
mov rcx, qword [rbp + 0x128]
call fcn.1400119e2
mov qword [rbp + 0x168], rax
jmp 0x14001e814
mov rax, qword [rbp + 0x148]
add rax, 0x28
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x168]
cmp qword [rbp + 0x148], rax
je 0x14001e874
mov rax, qword [rbp + 0x148]
mov qword [rbp + 0x188], rax
mov rcx, qword [rbp + 0x188]
call fcn.14001148d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001e872
mov byte [rbp + 0xde4], 1
lea rcx, [rbp + 0xe8]
call fcn.14001198d
nop
lea rcx, [rbp + 8]
call fcn.14001106e
movzx eax, byte [rbp + 0xde4]
jmp 0x14001e898
jmp 0x14001e802
mov byte [rbp + 0xe04], 0
lea rcx, [rbp + 0xe8]
call fcn.14001198d
nop
lea rcx, [rbp + 8]
call fcn.14001106e
movzx eax, byte [rbp + 0xe04]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.140011b40
mov rax, rdi
mov rcx, qword [rbp + 0x1b10]
xor rcx, rbp
call fcn.14001169a
lea rsp, [rbp + 0x1b20]
pop rdi
pop rsi
pop rbp
ret