joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140040100
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r8, [rax - 1]
cmp r8, 0xfffffffffffffffd
ja 0x140040142
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140040150
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r8, [rax - 1]
cmp r8, 0xfffffffffffffffd
ja 0x140040192
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400402b0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, r8
lea rdi, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntime_r3winenv_win.cpp
mov qword [rsp + 0x28], rdi
lea r8, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], 0
call fcn.1400343e0
test eax, eax
js 0x140040341
mov r8, rdi
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.1400344d0
mov ebx, eax
test eax, eax
js 0x140040335
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x14004031c
xor ebx, ebx
jmp 0x14004032b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001ee80
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call fcn.140017710
mov rcx, qword [rsp + 0x30]
call fcn.140017710
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140040350
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov edx, 0x3d
mov rbx, rcx
call sym.NetMonitor.exe_nocrt_strchr
test rax, rax
jne 0x1400403a8
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntime_r3winenv_win.cpp
mov rcx, rbx
lea rdx, [rsp + 0x38]
call fcn.1400344d0
test eax, eax
js 0x1400403a8
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rsp + 0x38]
test eax, eax
setne bl
call fcn.140017710
movzx eax, bl
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1400403b0
Capabilities:
Query environment variable

Disassembly:
jmp 0x1400403c0
push rbx
sub rsp, 0x470
mov rax, qword [0x1400a0f20]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov edx, 0x3d
mov rbx, rcx
call sym.NetMonitor.exe_nocrt_strchr
test rax, rax
jne 0x1400405cd
mov qword [rsp + 0x460], r12
cmp rbx, 0x1000
jb 0x1400405be
movabs rax, 0xffff800000000000
test rax, rbx
jne 0x1400405be
lea r12, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntime_r3winenv_win.cpp
mov rcx, rbx
mov r8, r12
lea rdx, [rsp + 0x38]
call fcn.1400344d0
xor ebx, ebx
test eax, eax
js 0x1400405c0
mov qword [rsp + 0x488], rbp
xor ecx, ecx
mov qword [rsp + 0x490], rsi
mov ebp, ebx
mov qword [rsp + 0x468], rdi
mov edi, 0x200
mov qword [rsp + 0x458], r14
lea r14, [rsp + 0x40]
mov qword [rsp + 0x450], r15
mov r15d, ebx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, edi
jb 0x140040514
nop dword [rax]
mov rcx, r15
call fcn.14001ed80
cmp edi, 0x8000
jae 0x140040548
lea r8d, [rsi + rbp]
mov edx, ebp
shl rdx, 9
mov ecx, ebp
shl ecx, 9
mov eax, r8d
cmp rax, rdx
lea rdx, [0x140054850]
cmovb r8d, ecx
mov ecx, r8d
add rcx, rcx
mov edi, r8d
call fcn.14001ed20
mov r14, rax
mov r15, rax
test rax, rax
je 0x140040548
xor ecx, ecx
inc ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
mov r8d, edi
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, edi
jae 0x1400404a0
test esi, esi
jne 0x14004051c
test eax, eax
jne 0x140040548
mov edx, esi
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], r12
xor r9d, r9d
mov rcx, r14
mov qword [rsp + 0x20], rbx
call fcn.140035c80
mov rdx, qword [rsp + 0x30]
test eax, eax
cmovs rdx, rbx
mov qword [rsp + 0x30], rdx
mov rcx, r15
call fcn.14001ed80
mov rcx, qword [rsp + 0x38]
call fcn.140017710
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp + 0x450]
mov r14, qword [rsp + 0x458]
mov rdi, qword [rsp + 0x468]
mov rsi, qword [rsp + 0x490]
mov rbp, qword [rsp + 0x488]
test rbx, rbx
je 0x1400405c0
mov eax, 1
lock xadd dword [0x1400aaaac], eax
inc eax
lea rdx, [0x1400aaab0]
and eax, 0x3f
mov rcx, rbx
xchg qword [rdx + rax*8], rcx
call fcn.140017710
mov r12, qword [rsp + 0x460]
mov rax, rbx
jmp 0x1400405cf
xor ebx, ebx
mov r12, qword [rsp + 0x460]
mov rax, rbx
jmp 0x1400405cf
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140001250
add rsp, 0x470
pop rbx
ret
Function at 0x1400403c0
Capabilities:
Query environment variable

Disassembly:
jmp 0x1400403c0
push rbx
sub rsp, 0x470
mov rax, qword [0x1400a0f20]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov edx, 0x3d
mov rbx, rcx
call sym.NetMonitor.exe_nocrt_strchr
test rax, rax
jne 0x1400405cd
mov qword [rsp + 0x460], r12
cmp rbx, 0x1000
jb 0x1400405be
movabs rax, 0xffff800000000000
test rax, rbx
jne 0x1400405be
lea r12, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntime_r3winenv_win.cpp
mov rcx, rbx
mov r8, r12
lea rdx, [rsp + 0x38]
call fcn.1400344d0
xor ebx, ebx
test eax, eax
js 0x1400405c0
mov qword [rsp + 0x488], rbp
xor ecx, ecx
mov qword [rsp + 0x490], rsi
mov ebp, ebx
mov qword [rsp + 0x468], rdi
mov edi, 0x200
mov qword [rsp + 0x458], r14
lea r14, [rsp + 0x40]
mov qword [rsp + 0x450], r15
mov r15d, ebx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, edi
jb 0x140040514
nop dword [rax]
mov rcx, r15
call fcn.14001ed80
cmp edi, 0x8000
jae 0x140040548
lea r8d, [rsi + rbp]
mov edx, ebp
shl rdx, 9
mov ecx, ebp
shl ecx, 9
mov eax, r8d
cmp rax, rdx
lea rdx, [0x140054850]
cmovb r8d, ecx
mov ecx, r8d
add rcx, rcx
mov edi, r8d
call fcn.14001ed20
mov r14, rax
mov r15, rax
test rax, rax
je 0x140040548
xor ecx, ecx
inc ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
mov r8d, edi
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, edi
jae 0x1400404a0
test esi, esi
jne 0x14004051c
test eax, eax
jne 0x140040548
mov edx, esi
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], r12
xor r9d, r9d
mov rcx, r14
mov qword [rsp + 0x20], rbx
call fcn.140035c80
mov rdx, qword [rsp + 0x30]
test eax, eax
cmovs rdx, rbx
mov qword [rsp + 0x30], rdx
mov rcx, r15
call fcn.14001ed80
mov rcx, qword [rsp + 0x38]
call fcn.140017710
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp + 0x450]
mov r14, qword [rsp + 0x458]
mov rdi, qword [rsp + 0x468]
mov rsi, qword [rsp + 0x490]
mov rbp, qword [rsp + 0x488]
test rbx, rbx
je 0x1400405c0
mov eax, 1
lock xadd dword [0x1400aaaac], eax
inc eax
lea rdx, [0x1400aaab0]
and eax, 0x3f
mov rcx, rbx
xchg qword [rdx + rax*8], rcx
call fcn.140017710
mov r12, qword [rsp + 0x460]
mov rax, rbx
jmp 0x1400405cf
xor ebx, ebx
mov r12, qword [rsp + 0x460]
mov rax, rbx
jmp 0x1400405cf
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140001250
add rsp, 0x470
pop rbx
ret
Function at 0x1400405f0
Capabilities:
Query environment variable

Disassembly:
push rbx
push r12
push r15
sub rsp, 0x480
mov rax, qword [0x1400a0f20]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov qword [rsp + 0x38], rdx
mov r15, r9
mov r12, r8
mov rbx, rcx
cmp rcx, 0x1000
jb 0x140040846
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x140040846
cmp rdx, 0x1000
jb 0x14004064b
test rax, rdx
je 0x14004065d
test rdx, rdx
jne 0x140040846
test r12, r12
jne 0x14004083f
cmp r15, 0x1000
jb 0x14004066b
test rax, r15
je 0x140040686
test r15, r15
jne 0x140040846
test rdx, rdx
je 0x14004083f
test r12, r12
je 0x14004083f
mov edx, 0x3d
call sym.NetMonitor.exe_nocrt_strchr
test rax, rax
jne 0x140040838
mov qword [rsp + 0x468], rdi
xor edi, edi
mov qword [rsp + 0x460], r13
test r15, r15
je 0x1400406b3
mov qword [r15], rdi
lea r13, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntime_r3winenv_win.cpp
mov rcx, rbx
mov r8, r13
lea rdx, [rsp + 0x30]
call fcn.1400344d0
test eax, eax
js 0x14004080b
mov qword [rsp + 0x478], rbp
xor ecx, ecx
mov qword [rsp + 0x470], rsi
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x458], r14
mov ebx, 0x200
mov r14d, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, ebx
jb 0x140040793
nop
mov rcx, rdi
call fcn.14001ed80
cmp ebx, 0x8000
jae 0x1400407ab
lea r8d, [rsi + r14]
mov edx, r14d
shl rdx, 9
mov ecx, r14d
shl ecx, 9
mov eax, r8d
cmp rax, rdx
lea rdx, [0x140054850]
cmovb r8d, ecx
mov ecx, r8d
add rcx, rcx
mov ebx, r8d
call fcn.14001ed20
mov rbp, rax
mov rdi, rax
test rax, rax
je 0x1400407a4
xor ecx, ecx
inc r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x30]
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, ebx
jae 0x140040720
test esi, esi
jne 0x1400407b2
test eax, eax
je 0x1400407b2
mov ecx, eax
call fcn.14001ee80
jmp 0x1400407dd
mov ebx, 0xffffffec
jmp 0x1400407df
mov ebx, 0xffffff1d
jmp 0x1400407df
mov edx, esi
mov rcx, rbp
test r12, r12
je 0x1400407d5
mov qword [rsp + 0x28], r13
lea r8, [rsp + 0x38]
mov r9, r12
mov qword [rsp + 0x20], r15
call fcn.140035c80
jmp 0x1400407dd
mov r8, r15
call fcn.140035990
mov ebx, eax
mov rcx, rdi
call fcn.14001ed80
mov rcx, qword [rsp + 0x30]
call fcn.140017710
mov r14, qword [rsp + 0x458]
mov eax, ebx
mov rsi, qword [rsp + 0x470]
mov rbp, qword [rsp + 0x478]
mov rdi, qword [rsp + 0x468]
mov r13, qword [rsp + 0x460]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140001250
add rsp, 0x480
pop r15
pop r12
pop rbx
ret
mov eax, 0xfffffd10
jmp 0x14004081b
mov eax, 0xfffffffe
jmp 0x14004081b
mov eax, 0xfffffffa
jmp 0x14004081b
Function at 0x140040850
Capabilities:
Set environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov edx, 0x3d
mov rbx, rcx
call sym.NetMonitor.exe_nocrt_strchr
test rax, rax
jne 0x1400408f5
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntime_r3winenv_win.cpp
mov rcx, rbx
lea rdx, [rsp + 0x38]
call fcn.1400344d0
mov ebx, eax
test eax, eax
js 0x1400408ed
mov ecx, 0xcb
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x1400408b6
mov rcx, qword [rsp + 0x38]
xor ebx, ebx
call fcn.140017710
mov eax, ebx
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x1400408da
mov rcx, qword [rsp + 0x38]
mov ebx, 0x2ee
call fcn.140017710
mov eax, ebx
add rsp, 0x20
pop rbx
ret
mov ecx, eax
call fcn.14001ee80
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call fcn.140017710
mov eax, ebx
add rsp, 0x20
pop rbx
ret
mov eax, 0xfffffd10
add rsp, 0x20
pop rbx
ret

Function at 0x140040b40
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x1400a98a8]
mov rdi, rdx
mov ebx, ecx
test rax, rax
je 0x140040b71
mov ecx, 0x17
call qword [case.0x14004be35.0]
test eax, eax
je 0x140040b71
mov ecx, ebx
int 0x29
mov rax, qword [0x1400a9860]
test rax, rax
je 0x140040b88
call qword [case.0x14004be35.0]
test eax, eax
je 0x140040b88
int3
mov rax, qword [0x1400a9898]
test rax, rax
je 0x140040c33
cmp qword [0x1400a98a0], 0
je 0x140040c33
xor ecx, ecx
call qword [case.0x14004be35.0]
mov rax, qword [rdi + 0xf8]
lea rcx, [rsp + 0x20]
xorps xmm0, xmm0
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0xc0000409
mov qword [rsp + 0x20], rax
mov rax, qword [0x1400a98a0]
mov dword [rsp + 0x34], 1
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x50], rbx
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x28], rdi
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0xb8], xmm0
call qword [case.0x14004be35.0]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140040c33
Function at 0x1400417f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
lea rax, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntime_r3winpathint_win.cpp
mov rbx, rdx
mov qword [rsp + 0x28], rax
mov rdi, rcx
mov qword [rcx], rbp
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], rbp
mov r8, rcx
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 1]
xor r9d, r9d
mov rcx, rbx
call fcn.1400343e0
mov esi, eax
test eax, eax
js 0x140041993
mov rcx, qword [rsp + 0x60]
cmp rcx, 0xf3
ja 0x1400418fe
movsx edx, byte [rbx]
lea eax, [rdx - 0x61]
cmp eax, 0x1a
jb 0x140041863
lea eax, [rdx - 0x41]
cmp eax, 0x1a
jae 0x140041898
cmp byte [rbx + 1], 0x3a
jne 0x140041898
movzx eax, byte [rbx + 2]
cmp al, 0x5c
je 0x140041975
cmp al, 0x2f
je 0x140041975
mov rcx, rdi
call fcn.140041760
test al, al
je 0x1400418fe
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
cmp dl, 0x5c
je 0x1400418bc
cmp dl, 0x2f
je 0x1400418bc
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, eax
add rcx, qword [rsp + 0x60]
cmp rcx, 0xf2
jmp 0x1400418fc
movzx eax, byte [rbx + 1]
cmp al, 0x5c
je 0x1400418c8
cmp al, 0x2f
jne 0x1400418f5
movzx eax, byte [rbx + 2]
cmp al, 0x5c
je 0x1400418f5
cmp al, 0x2f
je 0x1400418f5
test al, al
je 0x1400418f5
cmp al, 0x3f
jne 0x1400418ec
movzx eax, byte [rbx + 3]
cmp al, 0x5c
je 0x1400418ec
cmp al, 0x2f
jne 0x140041975
cmp rcx, 0xf0
jmp 0x1400418fc
cmp rcx, 0xf1
jbe 0x140041975
mov rcx, qword [rdi]
call fcn.140017710
mov r8, rbx
mov qword [rdi], rbp
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x30], ebp
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x78], rbp
call fcn.140042580
mov esi, eax
test eax, eax
js 0x140041993
cmp qword [rsp + 0x78], rbp
jne 0x140041984
mov rax, qword [rsp + 0x38]
cmp word [rax], 0x5c
jne 0x140041984
cmp word [rax + 2], 0x3f
jne 0x140041984
cmp word [rax + 4], 0x3f
jne 0x140041984
cmp word [rax + 6], 0x5c
jne 0x140041984
mov ecx, 0x5c
mov word [rax + 2], cx
movzx eax, word [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
shr rax, 1
cmp word [rcx + rax*2], bp
jne 0x140041984
mov qword [rdi], rcx
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x30]
call fcn.140042420
mov rbx, qword [rsp + 0x68]
mov eax, esi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140044770
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
sub rsp, 0x28
mov rdx, rcx
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.1400417f0
test eax, eax
js 0x1400447e9
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400447c9
bt eax, 0xa
jae 0x1400447c2
mov rcx, qword [rsp + 0x40]
test al, 0x10
je 0x1400447b4
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1400447ba
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400447c9
xor ebx, ebx
jmp 0x1400447d8
mov ebx, 0xffffffed
jmp 0x1400447d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001ee80
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call fcn.1400417e0
mov eax, ebx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x14004b190
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [0x140054850]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14004b200
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x1400a0f20]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, rcx
mov esi, r8d
mov ecx, 0xfffffff4
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ebp, ebp
lea r9, [rsp + 0x40]
mov rcx, rax
mov qword [rsp + 0x20], rbp
mov r8d, edi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9d, [rbp + 0xa]
mov dword [rsp + 0x30], 0x2010
mov dword [rsp + 0x28], ebp
lea rcx, [rsp + 0x50]
mov r8d, esi
mov dword [rsp + 0x20], ebp
lea edx, [r9 + 0x76]
call fcn.14004c490
mov ecx, 0xfffffff4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea r8d, [rbp + 2]
lea rdx, [0x1400747cc]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140001250
mov rbx, qword [rsp + 0x118]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret

Function at 0x14004b2f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14004b340
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0xe0
mov rax, qword [0x1400a0f20]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r9d, 0x10
mov dword [rsp + 0x30], 0x4080
mov r8, rcx
mov dword [rsp + 0x28], 0x10
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], 0x10
lea edx, [r9 + 0x70]
call fcn.14004c560
mov ecx, 0xfffffff4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140001250
add rsp, 0xe0
pop rbx
ret
Function at 0x14004b3d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x1400a0f20]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rdi, rcx
cmp rcx, 0x1000
jb 0x14004b42f
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x14004b42f
xor ebx, ebx
cmp byte [rcx], bl
je 0x14004b419
inc rbx
cmp byte [rcx + rbx], 0
jne 0x14004b410
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8d, ebx
mov rdx, rdi
jmp 0x14004b4d2
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._pszString
mov r8d, 0xb
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9d, 0x10
mov dword [rsp + 0x30], 0x4080
mov dword [rsp + 0x28], 0x10
lea rcx, [rsp + 0x50]
mov r8, rdi
mov dword [rsp + 0x20], 0x10
lea edx, [r9 + 0x70]
call fcn.14004c560
mov ecx, 0xfffffff4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8d, 1
lea rdx, [0x14006ab48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140001250
mov rbx, qword [rsp + 0xf8]
add rsp, 0xe0
pop rdi
ret

Function at 0x14004b510
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x110
mov rax, qword [0x1400a0f20]
xor rax, rsp
mov qword [rsp + 0x100], rax
xor ebp, ebp
mov dword [rsp + 0x30], 0x2000
mov esi, ecx
mov dword [rsp + 0x28], ebp
mov r8d, ecx
mov dword [rsp + 0x20], ebp
mov edi, 0xa8
lea rcx, [rsp + 0x50]
lea r9d, [rbp + 0xa]
mov edx, edi
call fcn.14004c490
mov dword [rsp + 0x30], 0x2008
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], ebp
lea r9d, [rbp + 0x10]
mov r8d, esi
mov dword [rsp + 0x20], ebp
lea rbx, [rax + 2]
mov word [rsp + rax + 0x50], 0x2820
sub rdi, rbx
add rcx, rbx
mov rdx, rdi
call fcn.14004c490
add rax, rbx
mov ecx, 0xfffffff4
mov byte [rsp + rax + 0x50], 0x29
lea ebx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140001250
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14004b600
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0xe0
mov rax, qword [0x1400a0f20]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r9d, 0x10
mov dword [rsp + 0x30], 0x2008
mov r8d, ecx
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], 0
lea edx, [r9 + 0x70]
call fcn.14004c490
mov ecx, 0xfffffff4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140001250
add rsp, 0xe0
pop rbx
ret

Function at 0x14004cae0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x40
mov rdi, r9
mov rbx, rdx
mov rbp, rcx
cmp r9, 0x1000
jb 0x14004cc23
movabs rax, 0xffff800000000000
test rax, r9
jne 0x14004cc23
mov ecx, r8d
lea rdx, [0x140054850]
add rcx, 2
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x68], r8d
call fcn.14001ed50
mov rsi, rax
test rax, rax
je 0x14004cc15
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov rdx, rbx
mov qword [rsp + 0x20], rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x14004cbc3
mov rcx, rsi
call fcn.14001ed80
mov eax, dword [rsp + 0x68]
lea rdx, [0x140054850]
add eax, 0x10
mov ecx, eax
add rcx, 2
mov dword [rsp + 0x68], eax
call fcn.14001ed50
mov rsi, rax
test rax, rax
jne 0x14004cba0
mov qword [rdi], rax
lea eax, [rsi - 0x14]
jmp 0x14004cc00
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov rdx, rbx
mov qword [rsp + 0x20], rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004cbe9
cmp dword [rsp + 0x30], 1
jne 0x14004cbe2
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxAdditionscommonVBoxGuestlibVBoxGuestR3LibAdditions.cpp
mov rdx, rdi
mov rcx, rsi
call fcn.140035d70
jmp 0x14004cbf0
mov ebx, 0xffffa877
jmp 0x14004cbf2
mov ecx, eax
call fcn.14001ee80
mov ebx, eax
mov rcx, rsi
call fcn.14001ed80
test ebx, ebx
js 0x14004cc1a
mov eax, ebx
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov ebx, 0xffffffec
mov qword [rdi], 0
jmp 0x14004cbfe
mov rbx, qword [rsp + 0x58]
mov eax, 0xfffffffa
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret