joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180081780
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
lea rax, [rcx + 0x1000]
mov rbp, r9
mov rdi, r8
mov rsi, rdx
cmp rax, 0x2000
jb 0x1800818bb
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x1800818bb
cmp byte [rcx], 0
je 0x1800818bb
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
call fcn.1800815c0
mov ebx, eax
test eax, eax
js 0x1800818a6
test rsi, rsi
jne 0x1800817ea
test rdi, rdi
je 0x180081831
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x38]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x180081822
test rsi, rsi
je 0x180081813
mov rax, qword [rsp + 0x60]
mov qword [rsi], rax
test rdi, rdi
je 0x180081831
mov rax, qword [rsp + 0x38]
mov qword [rdi], rax
jmp 0x180081831
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov ebx, eax
test ebx, ebx
js 0x18008189a
mov rdi, qword [rsp + 0x80]
test rbp, rbp
jne 0x180081847
test rdi, rdi
je 0x18008189a
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x18008188b
mov ecx, dword [rsp + 0x60]
test rbp, rbp
je 0x180081882
mov eax, dword [rsp + 0x30]
imul eax, ecx
mov dword [rbp], eax
test rdi, rdi
je 0x18008189a
mov dword [rdi], ecx
jmp 0x18008189a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call sym.VBoxRT.dll_RTUtf16Free
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov eax, 0xfffffffe
add rsp, 0x50
pop rdi
ret

Function at 0x1800818d0
Capabilities:
Get disk information

Disassembly:
push rdi
sub rsp, 0x50
lea rax, [rcx + 0x1000]
mov rdi, rdx
cmp rax, 0x2000
jb 0x18008199b
movabs rdx, 0xffff800000000000
test rdx, rcx
jne 0x18008199b
cmp byte [rcx], 0
je 0x18008199b
lea rax, [rdi + 0x1000]
cmp rax, 0x2000
jb 0x18008199b
test rdx, rdi
jne 0x18008199b
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
call fcn.1800815c0
mov ebx, eax
test eax, eax
js 0x180081990
mov rcx, qword [rsp + 0x40]
xor eax, eax
lea r9, [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x180081975
mov eax, dword [rsp + 0x60]
mov dword [rdi], eax
jmp 0x180081984
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call sym.VBoxRT.dll_RTUtf16Free
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov eax, 0xfffffffe
add rsp, 0x50
pop rdi
ret
Function at 0x1800819b0
Capabilities:
Get disk information

Disassembly:
push rdi
sub rsp, 0x50
lea rax, [rcx + 0x1000]
mov rdi, rdx
cmp rax, 0x2000
jb 0x180081abc
movabs rdx, 0xffff800000000000
test rdx, rcx
jne 0x180081abc
cmp byte [rcx], 0
je 0x180081abc
lea rax, [rdi + 0x1000]
cmp rax, 0x2000
jb 0x180081abc
test rdx, rdi
jne 0x180081abc
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
call fcn.1800815c0
mov ebx, eax
test eax, eax
js 0x180081ab1
mov rcx, qword [rsp + 0x40]
xor eax, eax
lea r9, [rsp + 0x78]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x180081a96
mov ecx, dword [rsp + 0x70]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
mov eax, dword [rsp + 0x60]
mov dword [rdi], eax
mov eax, ecx
mov word [rdi + 4], 0
shr eax, 4
and al, 1
mov byte [rdi + 9], al
mov eax, ecx
shr eax, 0xf
and al, 1
mov byte [rdi + 8], al
mov eax, ecx
shr ecx, 2
shr eax, 0x13
and al, 1
and cl, 1
mov byte [rdi + 7], cl
mov byte [rdi + 6], al
jmp 0x180081aa5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call sym.VBoxRT.dll_RTUtf16Free
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov eax, 0xfffffffe
add rsp, 0x50
pop rdi
ret

Function at 0x180082220
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1260
call fcn.18008c1c0
sub rsp, rax
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x40]
mov edx, 0x104
mov rsi, r9
mov ebp, r8d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, 0x104
jb 0x18008226a
mov eax, 0xffffff88
jmp 0x18008230e
lea rax, [rsp + 0x250]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3winldrNative_win.cpp
mov r9d, 0x1004
mov qword [rsp + 0x28], rax
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x20], 0
call sym.VBoxRT.dll_RTUtf16ToUtf8ExTag
test eax, eax
js 0x18008230e
lea rcx, [rsp + 0x250]
mov r8, rdi
mov edx, 0x1004
call sym.VBoxRT.dll_RTPathAppend
test rbx, rbx
je 0x1800822dc
test eax, eax
js 0x18008230e
lea rcx, [rsp + 0x250]
mov r8, rbx
mov edx, 0x1004
call sym.VBoxRT.dll_RTStrCat
test eax, eax
js 0x18008230e
lea rcx, [rsp + 0x250]
call sym.VBoxRT.dll_RTFileExists
test al, al
je 0x180082309
lea rcx, [rsp + 0x250]
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
call sym.VBoxRT.dll_RTLdrLoadEx
jmp 0x18008230e
mov eax, 0xfffffd9e
lea r11, [rsp + 0x1260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180082980
Capabilities:
Connect pipe

Disassembly:
push rbx
push rdi
sub rsp, 0x28
lea rax, [rcx + 0x1000]
mov rbx, rcx
cmp rax, 0x2000
jb 0x180082b38
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x180082b38
cmp dword [rcx], 0x19600201
je 0x1800829c4
mov eax, 0xfffffffd
add rsp, 0x28
pop rdi
pop rbx
ret
add rcx, 8
mov qword [rsp + 0x50], rsi
call sym.VBoxRT.dll_RTCritSectEnter
movzx eax, byte [rbx + 0x3c]
test al, al
je 0x1800829fa
mov byte [rbx + 0x3c], 0
mov edi, 0xffffffba
lea rcx, [rbx + 8]
call sym.VBoxRT.dll_RTCritSectLeave
mov rsi, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x28
pop rdi
pop rbx
ret
inc dword [rbx + 0x38]
mov rcx, qword [rbx + 0x48]
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rbx + 8]
call sym.VBoxRT.dll_RTCritSectLeave
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbx + 0x40]
lea rdx, [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ebp, eax
test eax, eax
je 0x180082a3a
xor edi, edi
jmp 0x180082a7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x3e5
jne 0x180082a7e
mov rcx, qword [rbx + 0x48]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x40]
lea r8, [rsp + 0x40]
lea rdx, [rbx + 0x50]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ebp, eax
test eax, eax
je 0x180082a76
xor edi, edi
jmp 0x180082a7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rcx, [rbx + 8]
call sym.VBoxRT.dll_RTCritSectEnter
movzx r11d, byte [rbx + 0x3c]
mov r12, qword [rsp + 0x20]
test r11b, r11b
jne 0x180082ae2
cmp dword [rbx], 0x19600201
jne 0x180082ae2
test ebp, ebp
jne 0x180082ac0
cmp edi, 0x217
je 0x180082ac0
mov ecx, edi
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov edi, eax
jmp 0x180082b11
lea r9, str.unsigned_long___cdecl_rtLocalIpcServerWinCreatePipeInstance_void__const_char__bool_
lea r8, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3winlocalipc_win.cpp
mov edx, 0xc6
xor ecx, ecx
call sym.VBoxRT.dll_RTAssertMsg1Weak
call sym.VBoxRT.dll_RTAssertShouldPanic
int3
test ebp, ebp
jne 0x180082b02
cmp edi, 0x217
je 0x180082b02
cmp edi, 0x3e5
jne 0x180082b0c
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CancelIo]
jmp 0x180082b0c
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov edi, 0xffffffba
dec dword [rbx + 0x38]
mov rbp, qword [rsp + 0x48]
mov eax, dword [rbx + 0x38]
jne 0x1800829e3
mov rcx, rbx
call fcn.180082510
mov rsi, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x28
pop rdi
pop rbx
ret
mov eax, 0xfffffffc
add rsp, 0x28
pop rdi
pop rbx
ret

Function at 0x180082c00
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r11, qword [rsp + 0x38]
xor eax, eax
mov qword [rbx], r11
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x180082c40
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r11, qword [rsp + 0x38]
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], r11
lea r8, [rsp + 0x20]
lea r9d, [rax + 4]
mov rcx, qword [r8]
test rcx, rcx
je 0x180082c90
mov edx, 0x40
dec edx
test cl, 1
je 0x180082c89
inc eax
shr rcx, 1
test edx, edx
jne 0x180082c80
add r8, 8
dec r9
jne 0x180082c73
add rsp, 0x58
ret

Function at 0x180082ce0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
mov ebx, ecx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r11, qword [rsp + 0x38]
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
or eax, 0xffffffff
cmp ebx, 0x40
mov qword [rsp + 0x20], r11
cmovb eax, ebx
test eax, eax
jns 0x180082d23
xor al, al
add rsp, 0x50
pop rbx
ret
lea rcx, [rsp + 0x20]
bt dword [rcx], eax
setb al
movzx eax, al
add rsp, 0x50
pop rbx
ret

Function at 0x180082d40
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r11d, dword [rsp + 0x40]
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
test r11d, r11d
je 0x180082d8b
nop
dec r11d
or eax, 0xffffffff
cmp r11d, 0x40
cmovb eax, r11d
test eax, eax
js 0x180082d86
lock bts dword [rbx], eax
test r11d, r11d
jne 0x180082d70
mov rax, rbx
add rsp, 0x50
pop rbx
ret

Function at 0x180082da0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x70
mov ebx, ecx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r11d, dword [rsp + 0x60]
xor eax, eax
or edx, 0xffffffff
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
test r11d, r11d
je 0x180082dff
nop word [rax + rax]
dec r11d
mov eax, edx
cmp r11d, 0x40
cmovb eax, r11d
test eax, eax
js 0x180082dfa
lea rcx, [rsp + 0x20]
lock bts dword [rcx], eax
test r11d, r11d
jne 0x180082de0
cmp ebx, 0x40
cmovb edx, ebx
test edx, edx
jns 0x180082e11
xor al, al
add rsp, 0x70
pop rbx
ret
lea rax, [rsp + 0x20]
bt dword [rax], edx
setb al
movzx eax, al
add rsp, 0x70
pop rbx
ret
Function at 0x180082e30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
mov eax, 0x2050
call fcn.18008c1c0
sub rsp, rax
mov rbx, r8
lea rdi, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3winpath_win.cpp
lea rdx, [rsp + 0x2078]
mov r8, rdi
call sym.VBoxRT.dll_RTStrToUtf16Tag
test eax, eax
js 0x180082ef0
mov rcx, qword [rsp + 0x2078]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
mov edx, 0x1004
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jle 0x180082ed2
cmp eax, 0x1004
jae 0x180082ecb
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180082ed2
lea r8, [rsp + 0x2068]
lea rcx, [rsp + 0x40]
mov r9, rbx
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
call sym.VBoxRT.dll_RTUtf16ToUtf8ExTag
jmp 0x180082edf
mov ebx, 0xffffff88
jmp 0x180082ee1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov ebx, eax
mov rcx, qword [rsp + 0x2078]
call sym.VBoxRT.dll_RTUtf16Free
mov eax, ebx
mov rbx, qword [rsp + 0x2060]
add rsp, 0x2050
pop rdi
ret

Function at 0x180083030
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x2040
call fcn.18008c1c0
sub rsp, rax
mov rdi, rdx
mov ebx, 0x1004
lea rcx, [0x180274870]
lea rdx, [rsp + 0x30]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x18008307d
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18008307d
test al, 0x10
jne 0x1800830fc
lea rdx, [rsp + 0x30]
lea rcx, str.USERPROFILE
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1800830aa
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800830aa
test al, 0x10
jne 0x1800830fc
lea rdx, [rsp + 0x30]
lea rcx, str.HOMEDRIVE
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x18008313b
lea rcx, [rsp + 0x30]
call sym.VBoxRT.dll_RTUtf16Len
lea rcx, str.HOMEPATH
sub ebx, eax
lea rdx, [rsp + rax*2 + 0x30]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x18008313b
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18008313b
test al, 0x10
je 0x18008313b
lea rax, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3winpath_win.cpp
lea r8, [rsp + 0x2050]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov r9, rdi
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x20], 0
call sym.VBoxRT.dll_RTUtf16ToUtf8ExTag
mov rbx, qword [rsp + 0x2058]
add rsp, 0x2040
pop rdi
ret
mov eax, 0xffffff99
mov rbx, qword [rsp + 0x2058]
add rsp, 0x2040
pop rdi
ret
Function at 0x180083890
Capabilities:
Check if file exists
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov esi, r8d
mov rbx, rdx
lea r8, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3winpath_win.cpp
lea rdx, [rsp + 0x20]
mov edi, r9d
call sym.VBoxRT.dll_RTStrToUtf16Tag
test eax, eax
js 0x180083977
lea r8, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3winpath_win.cpp
lea rdx, [rsp + 0x28]
mov rcx, rbx
call sym.VBoxRT.dll_RTStrToUtf16Tag
mov ebx, eax
test eax, eax
js 0x18008396b
mov qword [rsp + 0x40], rbp
xor ebp, ebp
test edi, edi
je 0x18008392e
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x18008390b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov ebx, eax
jmp 0x18008392e
and edi, 0xf000
cmp edi, 0x4000
jne 0x180083925
test al, 0x10
mov ebx, 0xffffff82
cmovne ebx, ebp
jmp 0x18008392e
and al, 0x10
neg al
sbb ebx, ebx
and ebx, 0xffffff81
test ebx, ebx
js 0x18008395c
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x18008394d
mov ebx, ebp
jmp 0x18008395c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov ebx, eax
mov rcx, qword [rsp + 0x28]
call sym.VBoxRT.dll_RTUtf16Free
mov rbp, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call sym.VBoxRT.dll_RTUtf16Free
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180083990
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
lea rax, [rcx + 0x1000]
cmp rax, 0x2000
jb 0x1800839e7
movabs r9, 0xffff800000000000
test r9, rcx
jne 0x1800839e7
lea rax, [rdx + 0x1000]
cmp rax, 0x2000
jb 0x1800839e7
test r9, rdx
jne 0x1800839e7
cmp byte [rcx], 0
jne 0x1800839cd
mov eax, 0xfffffffe
ret
cmp byte [rdx], 0
je 0x1800839c7
test r8d, 0xfffffffe
jne 0x1800839c7
and r8d, 1
xor r9d, r9d
jmp fcn.180083890
mov eax, 0xfffffffa
ret

Function at 0x180083a00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
lea rax, [rcx + 0x1000]
cmp rax, 0x2000
jb 0x180083a69
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x180083a69
cmp byte [rcx], 0
je 0x180083a69
lea r8, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3winpath_win.cpp
lea rdx, [rsp + 0x30]
call sym.VBoxRT.dll_RTStrToUtf16Tag
test eax, eax
js 0x180083a69
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call sym.VBoxRT.dll_RTUtf16Free
cmp ebx, 0xffffffff
mov rbx, qword [rsp + 0x20]
je 0x180083a69
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x180083a70
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rbx
mov eax, 0x4050
call fcn.18008c1c0
sub rsp, rax
mov rbx, rdx
lea rdx, [rsp + 0x30]
mov ecx, 0x1004
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x180083af3
lea r8, [rsp + 0x2040]
lea rcx, [rsp + 0x30]
xor r9d, r9d
mov edx, 0x1004
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x180083af3
lea rax, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3winpath_win.cpp
lea r8, [rsp + 0x4060]
lea rcx, [rsp + 0x2040]
mov qword [rsp + 0x28], rax
mov r9, rbx
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x20], 0
call sym.VBoxRT.dll_RTUtf16ToUtf8ExTag
add rsp, 0x4050
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
add rsp, 0x4050
pop rbx
ret

Function at 0x180083b10
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
lea rax, [rcx + 0x1000]
cmp rax, 0x2000
jb 0x180083bce
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x180083bce
cmp byte [rcx], 0
jne 0x180083b49
mov eax, 0xfffffffe
add rsp, 0x28
ret
lea r8, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3winpath_win.cpp
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call sym.VBoxRT.dll_RTStrToUtf16Tag
mov ebx, eax
test eax, eax
js 0x180083bc2
mov rcx, qword [rsp + 0x30]
call sym.VBoxRT.dll_RTUtf16Len
mov rcx, qword [rsp + 0x30]
cmp rax, 2
jb 0x180083b9f
movzx edx, word [rcx + rax*2 - 2]
cmp dx, 0x2f
je 0x180083b8b
cmp dx, 0x5c
jne 0x180083b9f
cmp word [rcx + rax*2 - 4], 0x3a
je 0x180083b9f
xor edx, edx
mov word [rcx + rax*2 - 2], dx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x180083bb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call sym.VBoxRT.dll_RTUtf16Free
mov eax, ebx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
mov eax, 0xfffffffa
add rsp, 0x28
ret

Function at 0x180083c10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
lea rax, [rcx + 0x1000]
cmp rax, 0x2000
jb 0x180083c79
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x180083c79
cmp byte [rcx], 0
je 0x180083c79
lea r8, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3winpath_win.cpp
lea rdx, [rsp + 0x30]
call sym.VBoxRT.dll_RTStrToUtf16Tag
test eax, eax
js 0x180083c79
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call sym.VBoxRT.dll_RTUtf16Free
cmp ebx, 0xffffffff
mov rbx, qword [rsp + 0x20]
je 0x180083c79
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x1800840c0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x38]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1800841fb
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x48], rdi
lea rdi, [rbx + 0x20]
lea r9d, [rax + 1]
lea r8, [rsp + 0x40]
mov rdx, rdi
mov dword [rsp + 0x40], eax
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x1800841df
mov eax, dword [rsp + 0x40]
cmp rax, qword [rbx + 0x48]
jae 0x180084169
nop word [rax + rax]
mov rcx, qword [rbx + 0x40]
mov r8, qword [rbx + 0x48]
lea rdx, [rcx + rax]
sub r8, rax
call qword [sym.imp.MSVCR100.dll_memmove]
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov r8d, dword [rbx + 0x48]
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18008417a
mov eax, dword [rsp + 0x40]
cmp rax, qword [rbx + 0x48]
jb 0x180084120
mov byte [rbx + 0x11], 0
xor eax, eax
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x180084197
mov eax, reloc.WS2_32.dll_gethostbyname
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
mov byte [rbx + 0x11], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x1800841bc
mov rdi, qword [rsp + 0x48]
mov eax, 0xfffffed3
mov byte [rbx + 0x13], 1
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
cmp eax, 0xfffffed3
jne 0x18008416f
mov byte [rbx + 0x13], 1
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
mov byte [rbx + 0x11], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
cmp eax, 0x102
jne 0x18008420d
mov eax, reloc.WS2_32.dll_gethostbyname
add rsp, 0x30
pop rbx
ret
mov byte [rbx + 0x11], 0
cmp eax, 0x80
jne 0x180084223
mov eax, 0xfffffffc
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add rsp, 0x30
pop rbx
jmp sym.VBoxRT.dll_RTErrConvertFromWin32