Function at 0x401000
Capabilities:
Allocate thread local storage
Query environment variable

Disassembly:
push 0x544
push 0
push 0x4d1358
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x4d135c], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x4d1358], eax
mov eax, 0x468478
mov dword [0x4d1374], eax
call fcn.00408ad2
call fcn.0041a360
call fcn.004199f4
call fcn.00419500
call fcn.00417ae0
call fcn.00415a1c
call fcn.004152c0
call fcn.00414aec
call fcn.0041414b
call fcn.00413a6d
call fcn.0041374b
call fcn.004134c6
call fcn.00411bfd
call fcn.004115cd
call fcn.00410360
call fcn.0040f60d
call fcn.0040e214
call fcn.0040ba13
call fcn.0040aedc
call fcn.0040a425
call fcn.00409a80
call fcn.0040917b
call fcn.00408bf3
mov edx, str.c:ProgramsOracleVirtualBoxVBoxManage.exe
lea ecx, [0x4d13a4]
call fcn.00408008
push 0x100
push 1
call fcn.0040793a
push dword [0x4d2590]
mov eax, 0x46529c
push eax
mov eax, 0x4652d6
push eax
mov eax, str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesdiskEnum
push eax
call fcn.00402fd6
lea eax, [0x4d1360]
push eax
call fcn.0041a3e0
mov eax, str.Ven_VBOX
push eax
push dword [0x4d1360]
call fcn.00417e50
mov ebx, eax
and ebx, ebx
jg 0x401134
mov eax, str.DiskVBOX
push eax
push dword [0x4d1360]
call fcn.00417e50
mov ebx, eax
and ebx, ebx
jg 0x401134
jmp 0x40113b
mov eax, 1
jmp 0x40113d
xor eax, eax
and eax, eax
je 0x401365
push dword [0x4d2590]
push dword [0x4d2590]
call fcn.0040f799
lea eax, [0x4d139c]
push eax
call fcn.0041a3e0
push dword [0x4d2590]
push dword [0x4d2590]
push 0x3e8
call fcn.00417e70
lea eax, [0x4d1390]
push eax
call fcn.0041a3e0
push dword [0x4d2590]
push dword [0x4d2590]
push 0x3e8
call fcn.00417e70
lea eax, [0x4d13ac]
push eax
call fcn.0041a3e0
push 0x3e8
mov eax, dword [0x4d1390]
push eax
mov eax, str.PROCESSOR_ARCHITECTURE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0x4d13ac]
push eax
mov eax, str.PROCESSOR_ARCHITEW6432
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push dword [0x4d1390]
mov edx, str.AMD64
pop ecx
call fcn.00408560
jne 0x4011fa
push dword [0x4d13ac]
mov edx, str.AMD64
pop ecx
call fcn.00408560
jne 0x4011fa
jmp 0x401201
mov eax, 1
jmp 0x401203
xor eax, eax
and eax, eax
je 0x401286
mov edx, 0x46687a
lea ecx, [0x4d138c]
call fcn.00408008
push dword [0x4d2590]
mov edx, dword [0x4d139c]
push dword [0x4d2590]
push edx
call fcn.0041a460
mov edx, 0x465210
push edx
call fcn.0041a460
add dword [0x4d2590], 2
push 0x6f
mov edx, dword [0x4ce5b4]
add dword [esp + 4], edx
call fcn.00410580
pop dword [0x4d2590]
mov ebp, 0x4ce5b2
mov ebx, ebp
mov ebp, 0x497a0a
sub ebx, ebp
push ebx
mov ebp, 0x497a0a
push ebp
push 0x6f
call fcn.004107d0
push 0x6f
call fcn.00410290
jmp 0x401303
mov edx, 0x467094
lea ecx, [0x4d138c]
call fcn.00408008
push dword [0x4d2590]
mov edx, dword [0x4d139c]
push dword [0x4d2590]
push edx
call fcn.0041a460
mov edx, 0x465210
push edx
call fcn.0041a460
add dword [0x4d2590], 2
push 0x6f
mov edx, dword [0x4ce5b4]
add dword [esp + 4], edx
call fcn.00410580
pop dword [0x4d2590]
mov ebp, 0x497a0a
mov ebx, ebp
mov ebp, 0x4687e2
sub ebx, ebp
push ebx
mov ebp, 0x4687e2
push ebp
push 0x6f
call fcn.004107d0
push 0x6f
call fcn.00410290
push 1
push dword [0x4d139c]
mov eax, str._z_c:
push eax
mov eax, 0x467e48
push eax
call fcn.004091e8
push 0x3e8
call fcn.0040deeb
push dword [0x4d2590]
mov edx, dword [0x4d139c]
push dword [0x4d2590]
push edx
call fcn.0041a460
mov edx, 0x465210
push edx
call fcn.0041a460
mov edx, dword [0x4ce5b4]
add dword [esp], edx
call fcn.0040f82a
pop dword [0x4d2590]
jmp 0x4015a2
push dword [0x4d13a4]
call fcn.0040f838
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xffffffff
jne 0x40137e
cmp edi, 0xffffffff
je 0x401382
xor eax, eax
jmp 0x401387
mov eax, 1
or eax, eax
je 0x4013bf
push dword [0x4d2590]
mov eax, 0x46529c
push eax
mov eax, str.InstallDir
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREOracleVirtualBox
push eax
call fcn.00402fd6
mov edx, str.VBoxManage.exe
push edx
call fcn.0041a460
lea eax, [0x4d13a4]
push eax
call fcn.0041a3e0
push dword [0x4d13a4]
call fcn.0040f838
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xffffffff
jne 0x4013d8
cmp edi, 0xffffffff
je 0x4013dc
xor eax, eax
jmp 0x4013e1
mov eax, 1
or eax, eax
je 0x4013fb
mov eax, 0x467e82
push eax
mov eax, 0x465028
push eax
call fcn.00408c5d
jmp 0x4015a2
mov edx, 0x465028
lea ecx, [0x4d1378]
call fcn.00408008
mov edx, 0x465028
lea ecx, [0x4d1384]
call fcn.00408008
mov edx, 0x465028
lea ecx, [0x4d13a0]
call fcn.00408008
mov dword [0x4d1380], 0
push dword [0x4d2590]
push dword [0x4d2590]
push 0x3e8
call fcn.00417e70
lea eax, [0x4d13a8]
push eax
call fcn.0041a3e0
push 0x3e8
mov eax, dword [0x4d13a8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push dword [0x4d2590]
mov edx, dword [0x4d13a8]
push dword [0x4d2590]
push edx
call fcn.0041a460
mov edx, str.Sysnativecmd.exe
push edx
call fcn.0041a460
mov edx, dword [0x4ce5b4]
add dword [esp], edx
call fcn.0040f838
pop dword [0x4d2590]
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4014b8
jl 0x4014b4
cmp ebx, 0
ja 0x4014b8
xor eax, eax
jmp 0x4014bd
mov eax, 1
or eax, eax
je 0x4014ec
mov edx, dword [0x4d13a8]
push dword [0x4d2590]
push edx
call fcn.0041a460
mov edx, str.Sysnative
push edx
call fcn.0041a460
lea eax, [0x4d13a8]
push eax
call fcn.0041a3e0
jmp 0x401515
mov edx, dword [0x4d13a8]
push dword [0x4d2590]
push edx
call fcn.0041a460
mov edx, str.System32
push edx
call fcn.0041a460
lea eax, [0x4d13a8]
push eax
call fcn.0041a3e0
mov dword [0x4d1364], 0
push 0x5b
push 0x1aa
push 0
push 0
call fcn.0040160d
call fcn.0040e27f
mov dword [0x4d1388], eax
call fcn.004116e7
mov dword [0x4d136c], eax
cmp dword [0x4d1388], 0
je 0x40158a
call fcn.004116f6
push eax
mov ebx, dword [0x4d1394]
cmp ebx, dword [esp]
jne 0x401573
push dword [0x4d1388]
call fcn.004019a7
jmp 0x401587
mov dword [0x4d1388], 0
push 5
call fcn.0040deeb
pop eax
jmp 0x401594
push 5
call fcn.0040deeb
mov ebx, dword [0x4d1388]
cmp ebx, 0x333c
jne 0x401538
push 0
call 0x4015c1
call fcn.0041a3b0
push dword [0x4d1358]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00409a6e
call fcn.0040a3f5
call fcn.0040aed0
call fcn.0040b9bd
call fcn.0040e1f1
call fcn.0040f5fc
call fcn.0040f98f
call fcn.00410350
call fcn.004115af
call fcn.00413a61
call fcn.00414adf
call fcn.00417b00
call fcn.00419a82
call fcn.00419b89
call fcn.004194f0
ret