joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180071da0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r12
push r14
sub rsp, 0x20
movzx r14d, r9b
mov ebx, r8d
mov r12, rdx
mov rsi, rcx
test rcx, rcx
jne 0x180071dcf
mov rcx, qword [0x1803c0c00]
call sym.VBoxRT.dll_RTTlsGet
mov rsi, rax
lea rcx, [rsi + 0x1000]
cmp rcx, 0x2000
jb 0x180071fc5
movabs rax, 0xffff800000000000
test rax, rsi
jne 0x180071fc5
cmp dword [rsi], 0x19750113
je 0x180071e12
mov eax, 0xfffffffd
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r12
pop rsi
ret
mov eax, 1
test ebx, ebx
jne 0x180071e26
mov ebx, eax
bsf ecx, ebx
je 0x180071e42
inc ecx
jmp 0x180071e44
cmp ebx, 0x1000
jbe 0x180071e1d
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r12
pop rsi
ret
xor ecx, ecx
dec ecx
shl eax, cl
cmp ebx, eax
jne 0x180071e2e
mov qword [rsp + 0x40], rbp
mov ebp, 0xfffffff8
lea rdx, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3_test.cpp
lea ecx, [rbp + 0x48]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r13
call sym.VBoxRT.dll_RTMemAllocTag
mov rdi, rax
test rax, rax
je 0x180071fc1
mov ecx, dword [rsi + 0x18]
lea r13, [r12 + 0xfff]
lea rdx, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3_test.cpp
mov qword [rax + 0x38], rcx
mov qword [rax + 0x28], rcx
add rcx, rcx
and r13, 0xfffffffffffff000
add rcx, r13
mov qword [rax + 0x18], rcx
call sym.VBoxRT.dll_RTMemPageAllocTag
mov r11, rax
mov qword [rdi + 0x10], rax
test rax, rax
je 0x180071fb9
mov rdx, qword [rdi + 0x28]
mov qword [rdi + 0x20], rax
lea r8, [rdx + rax]
mov qword [rdi + 8], r8
lea rcx, [r8 + r13]
mov qword [rdi + 0x30], rcx
test r14b, r14b
jne 0x180071efd
and r12d, 0xfff
je 0x180071efd
lea eax, [rbx - 1]
mov ecx, eax
add rax, r12
not rcx
and rax, rcx
sub r8, rax
add r8, 0x1000
mov qword [rdi + 8], r8
mov r8d, 0xdeadbeef
mov rcx, r11
call fcn.180071d00
mov rdx, qword [rdi + 0x38]
mov rcx, qword [rdi + 0x30]
mov r8d, 0xdeadbeef
call fcn.180071d00
mov rdx, qword [rdi + 0x28]
mov rcx, qword [rdi + 0x20]
xor r8d, r8d
call sym.VBoxRT.dll_RTMemProtect
mov ebp, eax
test eax, eax
js 0x180071fac
mov rdx, qword [rdi + 0x38]
mov rcx, qword [rdi + 0x30]
xor r8d, r8d
call sym.VBoxRT.dll_RTMemProtect
mov ebp, eax
test eax, eax
js 0x180071f99
mov rcx, qword [rdi + 8]
mov rax, qword [rsp + 0x60]
mov qword [rax], rcx
lea rcx, [rsi + 0x60]
call sym.VBoxRT.dll_RTCritSectEnter
mov rax, qword [rsi + 0x90]
lea rcx, [rsi + 0x60]
mov qword [rdi], rax
mov qword [rsi + 0x90], rdi
call sym.VBoxRT.dll_RTCritSectLeave
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r13, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r12
pop rsi
ret
mov rdx, qword [rdi + 0x28]
mov rcx, qword [rdi + 0x20]
mov r8d, 3
call sym.VBoxRT.dll_RTMemProtect
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
call sym.VBoxRT.dll_RTMemPageFree
mov rcx, rdi
call sym.VBoxRT.dll_RTMemFree
mov eax, ebp
jmp 0x180071f7b
mov eax, 0xfffffffc
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r12
pop rsi
ret
Function at 0x180072090
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
sub rsp, 0x28
mov rbp, rdx
mov rdi, rcx
test rcx, rcx
jne 0x1800720b1
mov rcx, qword [0x1803c0c00]
call sym.VBoxRT.dll_RTTlsGet
mov rdi, rax
lea rcx, [rdi + 0x1000]
cmp rcx, 0x2000
jb 0x1800721bc
movabs rax, 0xffff800000000000
test rax, rdi
jne 0x1800721bc
cmp dword [rdi], 0x19750113
je 0x1800720ec
mov eax, 0xfffffffd
add rsp, 0x28
pop rdi
pop rbp
ret
test rbp, rbp
jne 0x1800720fa
xor eax, eax
add rsp, 0x28
pop rdi
pop rbp
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
lea rcx, [rdi + 0x60]
xor esi, esi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x20], r13
lea r13d, [rsi - 6]
call sym.VBoxRT.dll_RTCritSectEnter
mov rbx, qword [rdi + 0x90]
test rbx, rbx
je 0x180072195
nop dword [rax]
cmp qword [rbx + 8], rbp
je 0x180072143
mov rsi, rbx
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180072130
jmp 0x180072195
mov rax, qword [rbx]
test rsi, rsi
je 0x180072150
mov qword [rsi], rax
jmp 0x180072157
mov qword [rdi + 0x90], rax
mov rdx, qword [rbx + 0x28]
mov rcx, qword [rbx + 0x20]
mov r8d, 3
call sym.VBoxRT.dll_RTMemProtect
mov rdx, qword [rbx + 0x38]
mov rcx, qword [rbx + 0x30]
mov r8d, 3
call sym.VBoxRT.dll_RTMemProtect
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
call sym.VBoxRT.dll_RTMemPageFree
mov rcx, rbx
call sym.VBoxRT.dll_RTMemFree
xor r13d, r13d
lea rcx, [rdi + 0x60]
call sym.VBoxRT.dll_RTCritSectLeave
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov eax, r13d
mov r13, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rbp
ret
mov eax, 0xfffffffc
add rsp, 0x28
pop rdi
pop rbp
ret

Function at 0x1800729a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r12
push r13
sub rsp, 0x30
mov r12, r9
mov r13, r8
mov ebp, edx
mov rbx, rcx
test rcx, rcx
jne 0x1800729cd
mov rcx, qword [0x1803c0c00]
call sym.VBoxRT.dll_RTTlsGet
mov rbx, rax
lea rcx, [rbx + 0x1000]
cmp rcx, 0x2000
jb 0x180072a6e
movabs rax, 0xffff800000000000
test rax, rbx
jne 0x180072a6e
cmp dword [rbx], 0x19750113
jne 0x180072a6e
lea rcx, [rbx + 0x20]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
call sym.VBoxRT.dll_RTCritSectEnter
xor edi, edi
cmp ebp, dword [rbx + 0x1c]
jg 0x180072a4a
cmp byte [rbx + 0x58], dil
jne 0x180072a29
lea rdx, [0x180236fcc]
mov rcx, rbx
call fcn.180072960
mov edi, eax
lea rcx, [0x180072840]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
call sym.VBoxRT.dll_RTStrFormatV
add edi, eax
lea rcx, [rbx + 0x20]
call sym.VBoxRT.dll_RTCritSectLeave
mov rsi, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rbp
ret
or eax, 0xffffffff
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rbp
ret
Function at 0x180072aa0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r12
push r13
sub rsp, 0x30
mov r12, r9
mov r13, r8
mov ebp, edx
mov rbx, rcx
test rcx, rcx
jne 0x180072acd
mov rcx, qword [0x1803c0c00]
call sym.VBoxRT.dll_RTTlsGet
mov rbx, rax
lea rcx, [rbx + 0x1000]
cmp rcx, 0x2000
jb 0x180072b54
movabs rax, 0xffff800000000000
test rax, rbx
jne 0x180072b54
cmp dword [rbx], 0x19750113
jne 0x180072b54
lea rcx, [rbx + 0x20]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
call sym.VBoxRT.dll_RTCritSectEnter
xor esi, esi
cmp ebp, dword [rbx + 0x1c]
jg 0x180072b30
lea rcx, [0x180072840]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
call sym.VBoxRT.dll_RTStrFormatV
mov rsi, rax
lea rcx, [rbx + 0x20]
call sym.VBoxRT.dll_RTCritSectLeave
mov rdi, qword [rsp + 0x58]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rbp
ret
or eax, 0xffffffff
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rbp
ret

Function at 0x180072cf0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rsi
push r12
sub rsp, 0x20
mov r12, rdx
mov rsi, rcx
mov rbx, rcx
test rcx, rcx
jne 0x180072d16
mov rcx, qword [0x1803c0c00]
call sym.VBoxRT.dll_RTTlsGet
mov rbx, rax
lea rax, [rbx + 0x1000]
cmp rax, 0x2000
jb 0x180072e29
movabs rax, 0xffff800000000000
test rax, rbx
jne 0x180072e29
cmp dword [rbx], 0x19750113
jne 0x180072e29
mov qword [rsp + 0x40], rbp
lea rcx, [rbx + 0x60]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r13
call sym.VBoxRT.dll_RTCritSectEnter
xor ebp, ebp
cmp qword [rbx + 0x98], rbp
je 0x180072d8d
mov rcx, rbx
call fcn.180072bb0
mov rcx, qword [rbx + 0x98]
call sym.VBoxRT.dll_RTStrFree
mov qword [rbx + 0x98], rbp
mov byte [rbx + 0xa8], 1
inc dword [rbx + 0xb0]
mov eax, dword [rbx + 4]
lea rdx, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3_test.cpp
mov rcx, r12
mov dword [rbx + 0xac], eax
call sym.VBoxRT.dll_RTStrDupTag
or rcx, 0xffffffffffffffff
mov rdi, r12
mov qword [rbx + 0x98], rax
xor eax, eax
repne scasb al, byte [rdi]
mov rdi, qword [rsp + 0x48]
mov byte [rbx + 0xa8], al
not rcx
dec rcx
cmp dword [rbx + 0x1c], 5
mov qword [rbx + 0xa0], rcx
jl 0x180072df2
lea r8, str.debug:_Starting_sub_test__s_n
lea edx, [rax + 5]
mov r9, r12
mov rcx, rsi
call sym.VBoxRT.dll_RTTestPrintfNl
mov ebp, eax
lea r8, str.name_RMas
lea rdx, str.SubTest
mov r9, r12
mov rcx, rbx
call fcn.180072500
lea rcx, [rbx + 0x60]
call sym.VBoxRT.dll_RTCritSectLeave
mov r13, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r12
pop rsi
pop rbx
ret
or eax, 0xffffffff
add rsp, 0x20
pop r12
pop rsi
pop rbx
ret
Function at 0x180072e90
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x180072ead
mov rcx, qword [0x1803c0c00]
call sym.VBoxRT.dll_RTTlsGet
mov rbx, rax
lea rcx, [rbx + 0x1000]
cmp rcx, 0x2000
jb 0x180072f35
movabs rax, 0xffff800000000000
test rax, rbx
jne 0x180072f35
cmp dword [rbx], 0x19750113
jne 0x180072f35
lea rcx, [rbx + 0x60]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
call sym.VBoxRT.dll_RTCritSectEnter
xor esi, esi
cmp qword [rbx + 0x98], rsi
je 0x180072f1a
mov rcx, rbx
call fcn.180072bb0
mov rcx, qword [rbx + 0x98]
mov esi, eax
call sym.VBoxRT.dll_RTStrFree
mov qword [rbx + 0x98], 0
mov byte [rbx + 0xa8], 1
lea rcx, [rbx + 0x60]
call sym.VBoxRT.dll_RTCritSectLeave
mov rdi, qword [rsp + 0x38]
mov eax, esi
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret

Function at 0x180072f40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x20
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
test rcx, rcx
jne 0x180072f6c
mov rcx, qword [0x1803c0c00]
call sym.VBoxRT.dll_RTTlsGet
mov rdi, rax
lea rcx, [rdi + 0x1000]
cmp rcx, 0x2000
jb 0x180072fe7
movabs rax, 0xffff800000000000
test rax, rdi
jne 0x180072fe7
cmp dword [rdi], 0x19750113
jne 0x180072fe7
mov qword [rsp + 0x38], rsi
xor esi, esi
cmp dword [rdi + 0x1c], 4
jl 0x180072fd0
lea rcx, [rdi + 0x20]
mov qword [rsp + 0x30], rbx
call sym.VBoxRT.dll_RTCritSectEnter
lea r9, [rsp + 0x30]
lea rdx, [0x180272438]
mov r8, rbp
mov rcx, rdi
call fcn.180072960
lea rcx, [rdi + 0x20]
mov esi, eax
call sym.VBoxRT.dll_RTCritSectLeave
mov eax, esi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
or eax, 0xffffffff
add rsp, 0x20
pop rdi
ret
Function at 0x180073180
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x30
mov ebx, r9d
mov rbp, r8
mov r12, rdx
mov rsi, rcx
test rcx, rcx
jne 0x1800731b5
mov rcx, qword [0x1803c0c00]
call sym.VBoxRT.dll_RTTlsGet
mov rsi, rax
lea rcx, [rsi + 0x1000]
cmp rcx, 0x2000
jb 0x180073283
movabs rax, 0xffff800000000000
test rax, rsi
jne 0x180073283
cmp dword [rsi], 0x19750113
je 0x1800731ee
mov eax, 0xfffffffd
jmp 0x180073288
mov ecx, ebx
mov qword [rsp + 0x40], rdi
call fcn.180073030
lea rcx, [rsi + 0x60]
mov rdi, rax
call sym.VBoxRT.dll_RTCritSectEnter
lea r8, str.name_RMas_unit_RMas
lea rdx, str.Value
mov r9, r12
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call fcn.180072500
lea rdx, str._llu
mov r8, rbp
mov rcx, rsi
call fcn.180072580
lea rdx, str.Value
mov rcx, rsi
call fcn.1800725f0
lea rcx, [rsi + 0x60]
call sym.VBoxRT.dll_RTCritSectLeave
lea rcx, [rsi + 0x20]
call sym.VBoxRT.dll_RTCritSectEnter
lea rdx, str.____48s:__16llu__s_n
mov r9, rbp
mov r8, r12
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call fcn.180072960
lea rcx, [rsi + 0x20]
call sym.VBoxRT.dll_RTCritSectLeave
mov rdi, qword [rsp + 0x40]
xor eax, eax
jmp 0x180073288
mov eax, 0xfffffffc
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x180073320
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, rcx
test rcx, rcx
jne 0x180073338
mov rcx, qword [0x1803c0c00]
call sym.VBoxRT.dll_RTTlsGet
lea rcx, [rax + 0x1000]
cmp rcx, 0x2000
jb 0x180073374
movabs rcx, 0xffff800000000000
test rcx, rax
jne 0x180073374
cmp dword [rax], 0x19750113
je 0x180073369
mov eax, 0xfffffffd
add rsp, 0x28
ret
lock inc dword [rax + 4]
xor eax, eax
add rsp, 0x28
ret
mov eax, 0xfffffffc
add rsp, 0x28
ret

Function at 0x180073380
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x18007339b
mov rcx, qword [0x1803c0c00]
call sym.VBoxRT.dll_RTTlsGet
mov rdx, rax
lea rcx, [rdx + 0x1000]
cmp rcx, 0x2000
jb 0x1800733d0
movabs rax, 0xffff800000000000
test rax, rdx
jne 0x1800733d0
cmp dword [rdx], 0x19750113
jne 0x1800733d0
xor eax, eax
xchg dword [rsp + 0x30], eax
mov eax, dword [rdx + 4]
add rsp, 0x28
ret
or eax, 0xffffffff
add rsp, 0x28
ret
Function at 0x1800733e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x20
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
test rcx, rcx
jne 0x18007340c
mov rcx, qword [0x1803c0c00]
call sym.VBoxRT.dll_RTTlsGet
mov rdi, rax
lea rcx, [rdi + 0x1000]
cmp rcx, 0x2000
jb 0x1800734ba
movabs rax, 0xffff800000000000
test rax, rdi
jne 0x1800734ba
cmp dword [rdi], 0x19750113
jne 0x1800734ba
mov qword [rsp + 0x38], rsi
lock inc dword [rdi + 4]
xor esi, esi
cmp dword [rdi + 0x1c], 2
jl 0x1800734a3
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x30], rbx
call qword [sym.imp.MSVCR100.dll_strchr]
cmp rbp, rax
je 0x18007346a
cmp byte [rax - 1], 0xa
jne 0x18007346a
mov sil, 1
lea rcx, [rdi + 0x20]
call sym.VBoxRT.dll_RTCritSectEnter
lea rax, [0x180272568]
lea rdx, [0x180272438]
test sil, sil
lea r9, [rsp + 0x30]
mov r8, rbp
cmovne rdx, rax
mov rcx, rdi
call fcn.180072960
lea rcx, [rdi + 0x20]
mov esi, eax
call sym.VBoxRT.dll_RTCritSectLeave
mov eax, esi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
or eax, 0xffffffff
add rsp, 0x20
pop rdi
ret

Function at 0x180073500
Capabilities:
Get thread local storage value

Disassembly:
mov r9, r8
mov r8, rdx
mov edx, 2
jmp sym.VBoxRT.dll_RTTestPrintfV

Function at 0x180073540
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x180073556
xor eax, eax
add rsp, 0x20
pop rdi
ret
lea rax, [rcx + 0x1000]
cmp rax, 0x2000
jb 0x180073688
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x180073688
cmp dword [rcx], 0x19750113
jne 0x180073688
cmp byte [rcx + 0x58], 0
mov qword [rsp + 0x38], rsi
jne 0x18007359f
lea rdx, [0x180236fcc]
call fcn.180072960
mov rcx, rdi
call fcn.1800726e0
mov rcx, qword [0x1803c0c00]
call sym.VBoxRT.dll_RTTlsGet
cmp rax, rdi
jne 0x1800735c6
mov rcx, qword [0x1803c0c00]
xor edx, edx
call sym.VBoxRT.dll_RTTlsSet
mov eax, 0xe68afeec
lea rcx, [rdi + 0x60]
xchg dword [rdi], eax
call sym.VBoxRT.dll_RTCritSectDelete
lea rcx, [rdi + 0x20]
call sym.VBoxRT.dll_RTCritSectDelete
mov rsi, qword [rdi + 0x90]
mov qword [rdi + 0x90], 0
test rsi, rsi
je 0x18007364b
mov qword [rsp + 0x30], rbx
nop dword [rax + rax]
mov rbx, rsi
mov rsi, qword [rsi]
mov r8d, 3
mov rdx, qword [rbx + 0x28]
mov rcx, qword [rbx + 0x20]
call sym.VBoxRT.dll_RTMemProtect
mov rdx, qword [rbx + 0x38]
mov rcx, qword [rbx + 0x30]
mov r8d, 3
call sym.VBoxRT.dll_RTMemProtect
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
call sym.VBoxRT.dll_RTMemPageFree
mov rcx, rbx
call sym.VBoxRT.dll_RTMemFree
test rsi, rsi
jne 0x180073600
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rdi + 0x98]
call sym.VBoxRT.dll_RTStrFree
mov rcx, qword [rdi + 8]
mov qword [rdi + 0x98], 0
call sym.VBoxRT.dll_RTStrFree
mov rcx, rdi
mov qword [rdi + 8], 0
call sym.VBoxRT.dll_RTMemFree
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov eax, 0xfffffffc
add rsp, 0x20
pop rdi
ret
Function at 0x180073700
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rdi, rcx
test rcx, rcx
jne 0x180073724
mov rcx, qword [0x1803c0c00]
call sym.VBoxRT.dll_RTTlsGet
mov rdi, rax
lea rdx, [rdi + 0x1000]
mov qword [rsp + 0x30], rbx
cmp rdx, 0x2000
jb 0x1800737dc
movabs rax, 0xffff800000000000
test rax, rdi
jne 0x1800737dc
cmp dword [rdi], 0x19750113
jne 0x1800737dc
lea rcx, [rdi + 0x60]
call sym.VBoxRT.dll_RTCritSectEnter
mov rcx, rdi
call fcn.180072bb0
lea rcx, [rdi + 0x60]
call sym.VBoxRT.dll_RTCritSectLeave
mov eax, dword [rdi + 4]
mov r9d, dword [rdi + 4]
mov rcx, rsi
test eax, eax
jne 0x1800737af
lea r8, str.SUCCESS_n
lea edx, [rax + 1]
call sym.VBoxRT.dll_RTTestPrintfNl
mov rcx, rdi
xor ebx, ebx
call sym.VBoxRT.dll_RTTestDestroy
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ebx, 1
lea r8, str.FAILURE____u_errors_n
mov edx, ebx
call sym.VBoxRT.dll_RTTestPrintfNl
mov rcx, rdi
call sym.VBoxRT.dll_RTTestDestroy
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x180073800
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov r12, r8
mov rbp, rdx
mov rsi, rcx
mov rdi, rcx
test rcx, rcx
jne 0x180073835
mov rcx, qword [0x1803c0c00]
call sym.VBoxRT.dll_RTTlsGet
mov rdi, rax
lea r9, [rdi + 0x1000]
mov qword [rsp + 0x30], rbx
cmp r9, 0x2000
jb 0x1800738f3
movabs rax, 0xffff800000000000
test rax, rdi
jne 0x1800738f3
cmp dword [rdi], 0x19750113
jne 0x1800738f3
lea rcx, [rdi + 0x60]
call sym.VBoxRT.dll_RTCritSectEnter
mov rcx, rdi
call fcn.180072bb0
lea rcx, [rdi + 0x60]
call sym.VBoxRT.dll_RTCritSectLeave
mov eax, dword [rdi + 4]
test eax, eax
jne 0x1800738cd
test rbp, rbp
je 0x1800738a4
lea edx, [rax + 2]
mov r9, r12
mov r8, rbp
mov rcx, rsi
call sym.VBoxRT.dll_RTTestPrintfNlV
mov r9d, dword [rdi + 4]
lea r8, str.SKIPPED_n
mov edx, 1
mov rcx, rsi
call sym.VBoxRT.dll_RTTestPrintfNl
mov rcx, rdi
mov ebx, 4
call sym.VBoxRT.dll_RTTestDestroy
mov eax, ebx
jmp 0x1800738f8
mov r9d, dword [rdi + 4]
mov ebx, 1
lea r8, str.FAILURE____u_errors_n
mov edx, ebx
mov rcx, rsi
call sym.VBoxRT.dll_RTTestPrintfNl
mov rcx, rdi
call sym.VBoxRT.dll_RTTestDestroy
mov eax, ebx
jmp 0x1800738f8
mov eax, 4
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x180073ee0
Capabilities:
Get thread local storage value

Disassembly:
mov r9, r8
mov r8, rdx
mov edx, ecx
xor ecx, ecx
jmp sym.VBoxRT.dll_RTTestPrintfV

Function at 0x180073f20
Capabilities:
Get thread local storage value

Disassembly:
mov rdx, rcx
xor ecx, ecx
jmp sym.VBoxRT.dll_RTTestSub

Function at 0x180073f80
Capabilities:
Get thread local storage value

Disassembly:
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
jmp sym.VBoxRT.dll_RTTestPassedV

Function at 0x180074040
Capabilities:
Get thread local storage value

Disassembly:
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
jmp sym.VBoxRT.dll_RTTestFailedV

Function at 0x180075bb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov r9, qword [sym.VBoxRT.dll_g_pSUPGlobalInfoPage]
mov rdi, rcx
test r9, r9
je 0x180075c91
cmp dword [r9], 0x19590106
jne 0x180075c91
mov eax, 1
xor ecx, ecx
cpuid
mov dword [rsp + 0x20], eax
mov r8d, ebx
mov dword [rsp + 0x24], ebx
shr r8, 0x18
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x2c], edx
movzx eax, r8b
movzx r11d, word [r9 + rax*2 + 0x100]
add r11, 0xa
shl r11, 7
add r11, r9
mov r10d, dword [r11]
mov eax, r10d
xchg dword [rsp + 0x88], eax
mov r13d, dword [r11 + 4]
mov rsi, qword [r11 + 8]
mov r14, qword [r11 + 0x10]
mov r12d, dword [r9 + 0x14]
rdtsc
shl rdx, 0x20
xor ecx, ecx
or rax, rdx
mov rdx, qword [rdi]
xchg dword [rsp + 0x90], ecx
mov rbp, qword [rdx]
mov r9, rax
xor ecx, ecx
mov eax, 1
cpuid
mov dword [rsp + 0x30], eax
mov eax, ebx
mov dword [rsp + 0x34], ebx
shr rax, 0x18
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x3c], edx
cmp r8b, al
jne 0x180075c81
mov eax, dword [r11]
cmp eax, r10d
jne 0x180075c81
test r10b, 1
je 0x180075ca6
mov r9, qword [sym.VBoxRT.dll_g_pSUPGlobalInfoPage]
test r9, r9
jne 0x180075bd2
mov rcx, rdi
call qword [rdi + reloc.WS2_32.dll_recv]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
sub r9, r14
mov rbx, r13
cmp r9, r13
jbe 0x180075cb7
inc dword [rdi + 0x24]
mov r9, rbx
xor edx, edx
mov eax, r9d
imul rax, r12
div rbx
mov ecx, eax
add rsi, rcx
mov r8, rsi
sub r8, rbp
je 0x180075cdf
movabs rax, 0x4e376f736000
cmp r8, rax
jb 0x180075d0c
test r8, r8
jg 0x180075cf7
lea ecx, [r12 + r12]
add rcx, r8
js 0x180075cf7
lock inc dword [rdi + 0x20]
lea rsi, [rbp + 1]
jmp 0x180075d0c
test rbp, rbp
je 0x180075d0c
lock inc dword [rdi + 0x28]
mov r9, rbp
mov rdx, rsi
mov rcx, rdi
call qword [rdi + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi]
mov rax, rbp
lock cmpxchg qword [rcx], rsi
je 0x180075d45
inc dword [rdi + 0x2c]
mov edx, 0x19
mov rcx, qword [rdi]
xor eax, eax
xchg dword [rsp + 0x98], eax
mov rax, qword [rcx]
cmp rax, rsi
jae 0x180075d45
mov rcx, qword [rdi]
lock cmpxchg qword [rcx], rsi
je 0x180075d45
dec edx
test edx, edx
jg 0x180075d21
mov rax, rsi
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret