Why would the sole use of this API represent some anti-VM behavior? It could be checking for any service.