joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180084700
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
sub rsp, 0x38
lea rax, [rcx + 0x1000]
mov rbp, r9
mov r12, r8
mov r13, rdx
mov rbx, rcx
cmp rax, 0x2000
jb 0x1800848fc
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x1800848fc
cmp dword [rcx], 0x19570528
jne 0x1800848fc
cmp byte [rcx + 0x10], 0
jne 0x18008475f
mov eax, 0xffffffda
add rsp, 0x38
pop r13
pop r12
pop rbp
pop rbx
ret
add rcx, 0x60
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
call sym.VBoxRT.dll_RTCritSectEnter
mov edi, eax
test eax, eax
js 0x1800848e5
cmp dword [rbx + 0x18], 0
jne 0x1800848d7
mov rcx, qword [rbx + 0x38]
mov qword [rsp + 0x78], r14
mov dword [rbx + 0x18], 1
mov qword [rsp + 0x30], r15
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edi, edi
mov eax, edi
mov r15d, 0xffffffff
mov dword [rsp + 0x60], eax
test r12, r12
je 0x1800848c3
mov rcx, qword [rbx + 8]
mov r8d, r15d
lea r14, [rbx + 0x20]
cmp r12, r15
lea r9, [rsp + 0x60]
mov rdx, r13
cmovbe r8d, r12d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800848bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x180084894
lea rcx, [rbx + 0x60]
mov byte [rbx + 0x11], 1
call sym.VBoxRT.dll_RTCritSectLeave
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CancelIo]
test eax, eax
jne 0x18008481e
mov rcx, qword [rbx + 0x38]
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x60]
mov r9d, 1
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x180084851
mov eax, dword [rsp + 0x60]
lea rcx, [rbx + 0x60]
mov qword [rbp], rax
call sym.VBoxRT.dll_RTCritSectEnter
mov byte [rbx + 0x11], 0
jmp 0x1800848a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e3
jne 0x180084876
mov qword [rbp], rdi
lea rcx, [rbx + 0x60]
mov edi, reloc.WS2_32.dll_gethostbyname
call sym.VBoxRT.dll_RTCritSectEnter
mov byte [rbx + 0x11], 0
jmp 0x1800848a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
lea rcx, [rbx + 0x60]
mov edi, eax
call sym.VBoxRT.dll_RTCritSectEnter
mov byte [rbx + 0x11], 0
jmp 0x1800848a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov edi, eax
cmp edi, 0xfffffed3
jne 0x1800848c7
add dword [rbx + 0x18], r15d
mov r14, qword [rsp + 0x78]
mov r15, qword [rsp + 0x30]
mov byte [rbx + 0x13], 1
jmp 0x1800848dc
mov eax, dword [rsp + 0x60]
mov qword [rbp], rax
add dword [rbx + 0x18], r15d
mov r14, qword [rsp + 0x78]
mov r15, qword [rsp + 0x30]
jmp 0x1800848dc
mov edi, 0xffffffea
lea rcx, [rbx + 0x60]
call sym.VBoxRT.dll_RTCritSectLeave
mov rsi, qword [rsp + 0x68]
mov eax, edi
mov rdi, qword [rsp + 0x70]
add rsp, 0x38
pop r13
pop r12
pop rbp
pop rbx
ret
mov eax, 0xfffffffc
add rsp, 0x38
pop r13
pop r12
pop rbp
pop rbx
ret
Function at 0x180084910
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
push rsi
push rdi
push r12
push r15
sub rsp, 0x48
lea rax, [rcx + 0x1000]
mov r15, r9
mov rsi, r8
mov r12, rdx
mov rdi, rcx
cmp rax, 0x2000
jb 0x180084ae2
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x180084ae2
cmp dword [rcx], 0x19570528
jne 0x180084ae2
cmp byte [rcx + 0x10], 0
jne 0x180084973
mov eax, 0xffffffda
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rsi
ret
add rcx, 0x60
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x38], r13
call sym.VBoxRT.dll_RTCritSectEnter
mov ebx, eax
test eax, eax
js 0x180084acb
cmp dword [rdi + 0x18], 0
jne 0x180084abd
xor eax, eax
mov qword [rsp + 0x40], rbp
mov dword [rdi + 0x18], 1
mov ecx, 0xffffffff
mov ebp, eax
test rsi, rsi
je 0x180084a90
mov qword [rsp + 0x30], r14
xor r15d, r15d
lea r14, [rdi + 0x20]
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rdi + 0x60]
mov dword [rsp + 0x70], r15d
mov byte [rdi + 0x11], 1
call sym.VBoxRT.dll_RTCritSectLeave
mov rcx, qword [rdi + 8]
mov ebx, 0xffffffff
lea r9, [rsp + 0x70]
mov rdx, r12
mov r8d, ebx
cmp rsi, rbx
mov qword [rsp + 0x20], r14
cmovbe r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180084a0f
mov ebx, r15d
jmp 0x180084a58
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x180084a49
mov rcx, qword [rdi + 0x38]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rdi + 8]
lea r8, [rsp + 0x70]
mov r9d, 1
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x180084a49
mov ebx, r15d
jmp 0x180084a58
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov ebx, eax
lea rcx, [rdi + 0x60]
call sym.VBoxRT.dll_RTCritSectEnter
mov byte [rdi + 0x11], r15b
test ebx, ebx
js 0x180084a7c
mov eax, dword [rsp + 0x70]
add rbp, rax
add r12, rax
sub rsi, rax
jne 0x1800849c4
mov r15, qword [rsp + 0x88]
mov r14, qword [rsp + 0x30]
xor eax, eax
mov ecx, 0xffffffff
cmp ebx, 0xfffffed3
jne 0x180084a9c
mov byte [rdi + 0x13], 1
test r15, r15
je 0x180084ab3
mov qword [r15], rbp
test ebx, ebx
jns 0x180084ab3
test rbp, rbp
je 0x180084ab3
cmp ebx, 0xfffffffa
cmovne ebx, eax
add dword [rdi + 0x18], ecx
mov rbp, qword [rsp + 0x40]
jmp 0x180084ac2
mov ebx, 0xffffffea
lea rcx, [rdi + 0x60]
call sym.VBoxRT.dll_RTCritSectLeave
mov r13, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rsi
ret
mov eax, 0xfffffffc
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rsi
ret
Function at 0x180084da0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rdi
push r13
push r14
push r15
sub rsp, 0x40
lea rax, [rcx + 0x1000]
mov r15, r9
mov r13, r8
mov r14, rdx
mov rdi, rcx
cmp rax, 0x2000
jb 0x180084fca
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x180084fca
cmp dword [rcx], 0x19570528
jne 0x180084fca
cmp byte [rcx + 0x10], 0
je 0x180084e07
mov eax, 0xffffffda
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rbx
ret
add rcx, 0x60
mov qword [rsp + 0x38], rsi
call sym.VBoxRT.dll_RTCritSectEnter
mov ebx, eax
test eax, eax
js 0x180084fb6
cmp dword [rdi + 0x18], 0
jne 0x180084fa8
cmp byte [rdi + 0x11], 0
mov qword [rsp + 0x78], rbp
mov dword [rdi + 0x18], 1
je 0x180084e70
mov rcx, rdi
call fcn.1800840c0
mov ebx, eax
cmp eax, 0x34
jne 0x180084e70
mov ebp, 0xffffffff
nop
lea rcx, [rdi + 0x60]
call sym.VBoxRT.dll_RTCritSectLeave
mov rcx, qword [rdi + 0x38]
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [rdi + 0x60]
call sym.VBoxRT.dll_RTCritSectEnter
jmp 0x180084e50
mov qword [rsp + 0x30], r12
mov ebp, 0xffffffff
test ebx, ebx
js 0x180084f8d
xor r12d, r12d
mov byte [rdi + 0x14], 0
test r13, r13
je 0x180084f66
lea r15, [rdi + 0x20]
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rdi + 0x60]
mov byte [rdi + 0x11], 1
call sym.VBoxRT.dll_RTCritSectLeave
mov rcx, qword [rdi + 8]
mov r8d, ebp
cmp r13, rbp
lea r9, [rsp + 0x70]
mov rdx, r14
cmovbe r8d, r13d
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180084ede
xor ebx, ebx
jmp 0x180084f3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x180084f17
mov rcx, qword [rdi + 0x38]
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rdi + 8]
lea r8, [rsp + 0x70]
mov r9d, 1
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x180084f2b
xor ebx, ebx
jmp 0x180084f3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x180084f2b
mov ebx, 0xfffffed3
jmp 0x180084f3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov ebx, eax
lea rcx, [rdi + 0x60]
call sym.VBoxRT.dll_RTCritSectEnter
mov byte [rdi + 0x11], 0
test ebx, ebx
js 0x180084f5e
mov eax, dword [rsp + 0x70]
add r14, rax
add r12, rax
sub r13, rax
jne 0x180084e96
mov r15, qword [rsp + 0x88]
test r15, r15
je 0x180084f8d
mov qword [r15], r12
test ebx, ebx
jns 0x180084f8d
test r12, r12
je 0x180084f8d
cmp ebx, 0xfffffffa
je 0x180084f8d
mov r12, qword [rsp + 0x30]
xor ebx, ebx
add dword [rdi + 0x18], ebp
mov rbp, qword [rsp + 0x78]
jmp 0x180084fad
cmp ebx, 0xfffffed3
jne 0x180084f99
mov byte [rdi + 0x13], 1
add dword [rdi + 0x18], ebp
mov r12, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x78]
jmp 0x180084fad
mov ebx, 0xffffffea
lea rcx, [rdi + 0x60]
call sym.VBoxRT.dll_RTCritSectLeave
mov eax, ebx
mov rsi, qword [rsp + 0x38]
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rbx
ret
mov eax, 0xfffffffc
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rbx
ret
Function at 0x180085540
Capabilities:
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x70
xor ebx, ebx
mov ebp, edx
mov rdi, rcx
cmp byte [rcx + 0x13], bl
jne 0x1800855c0
cmp byte [rcx + 0x10], bl
je 0x1800855ca
cmp byte [rcx + 0x11], bl
jne 0x18008565e
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
mov qword [r11 - 0x50], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [r11 - 0x58], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1800855b1
test bpl, 1
je 0x18008565e
cmp dword [rsp + 0x80], ebx
jbe 0x18008565e
mov ebx, 1
jmp 0x18008565e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x1800855c0
mov byte [rdi + 0x13], 1
mov ebx, 4
jmp 0x18008565e
mov esi, 4
cmp byte [rcx + 0x11], bl
je 0x1800855df
call fcn.1800840c0
cmp byte [rdi + 0x13], bl
cmovne ebx, esi
cmp byte [rdi + 0x11], 0
jne 0x18008565e
test ebx, ebx
jne 0x18008565e
xor eax, eax
lea r8d, [rbx + 0x28]
lea rcx, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call sub.MSVCR100.dll_memset
mov rcx, qword [rdi + 8]
lea r9d, [rbx + 0x28]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x18
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x180085652
cmp dword [rsp + 0x60], esi
jne 0x180085637
mov ebx, esi
mov byte [rdi + 0x13], 1
jmp 0x18008565e
test bpl, 2
je 0x18008565e
cmp dword [rsp + 0x5c], 0
ja 0x18008564b
cmp dword [rsp + 0x58], 0
jne 0x18008565e
mov ebx, 2
jmp 0x18008565e
test bpl, 2
mov eax, 2
cmovne ebx, eax
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180085680
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x30
lea rax, [rcx + 0x1000]
mov esi, r8d
mov r12, rdx
mov rbx, rcx
cmp rax, 0x2000
jb 0x1800856bc
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x1800856bc
cmp dword [rcx], 0x19570528
je 0x1800856cd
or eax, 0xffffffff
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
add rcx, 0x60
mov qword [rsp + 0x58], rbp
call sym.VBoxRT.dll_RTCritSectEnter
test eax, eax
jns 0x1800856e7
or eax, 0xffffffff
jmp 0x18008577b
cmp dword [rbx + 0x18], 0
je 0x1800856f8
cmp qword [rbx + 0x58], r12
je 0x1800856f8
or edi, 0xffffffff
jmp 0x180085770
mov edx, esi
mov rcx, rbx
call fcn.180085540
mov edi, eax
test eax, eax
jne 0x180085770
cmp byte [rsp + 0x70], al
jne 0x180085770
cmp byte [rbx + 0x11], al
jne 0x180085769
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
cmp byte [rbx + 0x11], dil
jne 0x180085769
cmp byte [rbx + 0x10], dil
je 0x180085769
test sil, 1
je 0x180085769
mov rcx, qword [rbx + 8]
lea rax, [rbx + 0x20]
lea rdx, [rbx + 0x90]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18008578e
mov edx, esi
mov rcx, rbx
call fcn.180085540
mov edi, eax
test eax, eax
jne 0x180085770
inc dword [rbx + 0x18]
mov qword [rbx + 0x58], r12
lea rcx, [rbx + 0x60]
call sym.VBoxRT.dll_RTCritSectLeave
mov eax, edi
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1800857a3
mov word [rbx + 0x11], 0x101
jmp 0x180085769
mov edi, 4
jmp 0x180085770
Function at 0x180086870
Capabilities:
Compare security identifiers

Disassembly:
push rbp
push rsi
push r12
sub rsp, 0x40
mov r12, r8
mov rbp, rdx
mov r8d, ecx
mov ecx, 0x2000000
mov edx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x180086a3a
lea r8, [rsp + 0x30]
mov edx, 0x201eb
mov rcx, rax
mov qword [rsp + 0x68], rdi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180086a12
xor ecx, ecx
mov qword [rsp + 0x60], rbx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x30]
xor edi, edi
lea rax, [rsp + 0x78]
lea edx, [rdi + 1]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x78], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x1800869fb
cmp eax, 0x7a
jne 0x1800869dc
mov ecx, dword [rsp + 0x78]
test ecx, ecx
je 0x1800869e0
lea rdx, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3winprocess_win.cpp
call sym.VBoxRT.dll_RTMemTmpAllocZTag
mov rbx, rax
test rax, rax
je 0x1800869c5
mov r9d, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x78]
lea edx, [rdi + 1]
mov r8, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x180086995
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1800869be
mov rcx, qword [rbx]
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1800869be
mov rcx, qword [rsp + 0x30]
lea r9d, [rdi + 1]
xor r8d, r8d
mov edx, 0x2000000
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x1800869a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180086810
mov edi, eax
mov rcx, rbx
call sym.VBoxRT.dll_RTMemTmpFree
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
jmp 0x180086a21
mov edi, 0xffffffb2
jmp 0x1800869a4
mov rcx, qword [rsp + 0x30]
mov edi, 0xfffffff8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
jmp 0x180086a21
test eax, eax
je 0x1800869fb
mov ecx, eax
call fcn.180086810
mov rcx, qword [rsp + 0x30]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
jmp 0x180086a21
mov rcx, qword [rsp + 0x30]
mov edi, 0xffffff1a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
jmp 0x180086a21
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180086810
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add rsp, 0x40
pop r12
pop rsi
pop rbp
jmp fcn.180086810
Function at 0x180086df0
Capabilities:
Check os version
Impersonate user

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
lea rcx, [0x18027467c]
cmp al, 5
mov r9d, 2
mov r8, rdi
cmovb rdx, rcx
mov rcx, rsi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
jne 0x180086eb5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov ebx, eax
call fcn.180086810
mov edi, eax
cmp eax, 0xffffffdd
jne 0x180086ea3
call sym.VBoxRT.dll_RTLogRelDefaultInstance
test rax, rax
je 0x180086ea3
test byte [rax + 0xc008], 1
jne 0x180086ea3
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], ebx
lea rcx, str.dwErr_u___x___rc_Rrc_n
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rcx
lea rcx, str.int___cdecl_rtProcWinUserLogon_unsigned_short__unsigned_short__unsigned_short__void__
mov qword [rsp + 0x20], rcx
lea r9, str._Rfn:__M
lea edx, [rdi + 0x25]
lea r8d, [rdi + 0x2b]
mov rcx, rax
call sym.VBoxRT.dll_RTLogLoggerEx
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x50
pop rdi
ret
Function at 0x180087fa0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
cmp ecx, 0xffffffff
jne 0x180087fb5
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, dword [reloc.WS2_32.dll_accept]
mov qword [rsp + 0x40], rdi
cmp eax, 0x10
je 0x180087fec
cmp eax, 6
je 0x180087fec
cmp eax, 7
je 0x180087fec
lea rdx, [0x1800865c0]
lea rcx, [0x1803c1210]
xor r9d, r9d
xor r8d, r8d
call sym.VBoxRT.dll_RTOnceSlow
mov edi, eax
jmp 0x180087ff2
mov edi, dword [0x1803c1220]
test edi, edi
js 0x18008808a
mov ecx, ebx
call fcn.180086620
test rax, rax
je 0x180088032
mov edx, 0x7f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x18008808a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov edi, eax
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret
xor edx, edx
mov r8d, ebx
mov qword [rsp + 0x38], rsi
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x180088085
mov edx, 0x7f
mov rcx, rax
mov qword [rsp + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x180088080
mov ecx, ebp
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov edi, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, edi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret

Function at 0x1800880e0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x240
mov rbp, r9
mov rbx, r8
mov r12, rdx
mov edi, ecx
test rdx, rdx
je 0x18008812c
test rbx, rbx
jne 0x180088131
mov eax, 0xfffffffe
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
test rbx, rbx
jne 0x18008810d
call sym.VBoxRT.dll_RTProcSelf
cmp edi, eax
je 0x180088141
mov eax, 0xffffffdb
jmp 0x180088112
lea rdx, [rsp + 0x258]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x258], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x180088172
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
jmp 0x180088112
lea r8, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3winprocess_win.cpp
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call sym.VBoxRT.dll_RTUtf16ToUtf8Tag
mov edi, eax
test eax, eax
js 0x1800881e7
mov rdi, qword [rsp + 0x20]
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
not rcx
test rbp, rbp
je 0x1800881b0
mov qword [rbp], rcx
cmp rcx, rbx
jbe 0x1800881cb
mov rcx, qword [rsp + 0x20]
mov edi, 0xffffffd7
call sym.VBoxRT.dll_RTStrFree
mov eax, edi
jmp 0x180088112
mov rdx, qword [rsp + 0x20]
mov r8, rcx
mov rcx, r12
call sub.MSVCR100.dll_memcpy
mov rcx, qword [rsp + 0x20]
xor edi, edi
call sym.VBoxRT.dll_RTStrFree
mov eax, edi
jmp 0x180088112
Function at 0x180089410
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
lea eax, [r8 - 1]
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
cmp eax, 2
ja 0x1800895d4
lea rax, [rcx + 0x1000]
cmp rax, 0x2000
jb 0x1800895bf
movabs rcx, 0xffff800000000000
test rcx, rdi
jne 0x1800895bf
lea rax, [rdx + 0x1000]
cmp rax, 0x2000
jb 0x1800895bf
test rcx, rdx
jne 0x1800895bf
cmp byte [0x1803d97d0], 0
jne 0x1800894b2
mov rcx, qword [0x1803d9770]
lea rdx, str.CreateSymbolicLinkW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1803d97c8]
mov byte [0x1803d97d0], 1
test rax, rax
cmovne rcx, rax
mov qword [0x1803d97c8], rcx
jmp 0x1800894b9
mov rcx, qword [0x1803d97c8]
test rcx, rcx
jne 0x1800894d1
lea eax, [rcx - 0x25]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea r8, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3win_symlink_win.cpp
lea rdx, [rsp + 0x28]
mov rcx, rdi
call sym.VBoxRT.dll_RTStrToUtf16Tag
mov edi, eax
test eax, eax
js 0x1800895ad
lea r8, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3win_symlink_win.cpp
lea rdx, [rsp + 0x20]
mov rcx, rsi
call sym.VBoxRT.dll_RTStrToUtf16Tag
mov edi, eax
test eax, eax
js 0x1800895a3
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov rcx, rsi
call fcn.18003db40
cmp ebx, 3
jne 0x18008956a
cmp rdi, rax
jbe 0x180089547
movzx ecx, byte [rdi + rsi - 1]
cmp cl, 0x5c
je 0x180089540
cmp cl, 0x2f
jne 0x180089547
mov ebx, 1
jmp 0x18008956a
test rax, rax
je 0x18008956a
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18008956a
test al, 0x10
mov eax, ebx
mov ebx, 1
cmovne eax, ebx
mov ebx, eax
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor edi, edi
mov r8d, edi
cmp ebx, 1
sete r8b
call qword [0x1803d97c8]
test al, al
jne 0x180089599
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov edi, eax
mov rcx, qword [rsp + 0x20]
call sym.VBoxRT.dll_RTUtf16Free
mov rcx, qword [rsp + 0x28]
call sym.VBoxRT.dll_RTUtf16Free
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, 0xfffffffa
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 0xfffffffe
add rsp, 0x30
pop rdi
ret