joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140038620
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov r14d, r9d
mov rbx, r9
mov r15, r8
mov rdi, rdx
mov rsi, rcx
cmp r14, r9
jne 0x140038793
mov qword [r11 + 8], rbp
lea r9, [r11 + 0x20]
mov dword [rsp + 0x48], edi
mov rax, rdx
sar rax, 0x20
mov rbp, rcx
mov dword [rsp + 0x4c], eax
mov r8d, ebx
mov rax, 0xffffffffffffffff
mov qword [r11 + 0x10], r12
xor r12d, r12d
mov rdx, r15
cmp rcx, rax
mov qword [r11 - 0x38], r12
mov qword [r11 - 0x50], r12
cmove rbp, rax
mov qword [r11 - 0x48], r12
lea rax, [r11 - 0x50]
mov dword [r11 + 0x20], r12d
mov rcx, rbp
mov qword [r11 - 0x68], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14003876a
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x1400386e3
cmp dword [rsp + 0xa8], ebx
cmovbe ebx, dword [rsp + 0xa8]
mov eax, ebx
mov qword [rcx], rax
xor eax, eax
mov rbp, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov edx, dword [rsp + 0xa8]
cmp edx, ebx
jae 0x1400386c5
nop
mov ecx, edx
lea eax, [rdi + rdx]
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x30]
mov r8d, ebx
mov qword [rsp + 0x50], r12
sub r8d, edx
mov qword [rsp + 0x38], r12
lea rax, [rcx + rdi]
mov qword [rsp + 0x40], r12
sar rax, 0x20
lea rdx, [rcx + r15]
mov dword [rsp + 0x4c], eax
mov rcx, rbp
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14003876a
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140038760
mov edx, dword [rsp + 0xa8]
add edx, eax
mov dword [rsp + 0xa8], edx
cmp edx, ebx
jb 0x1400386f0
jmp 0x1400386c5
mov eax, 0xffffff90
jmp 0x1400386c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db40
cmp eax, 0xffffff68
jne 0x1400386c7
lea rdx, [r14 + rdi]
mov rcx, rsi
call fcn.140037180
jmp 0x1400386c7
mov eax, 0xffffffc9
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14003aa30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp rcx, 0x1000
jb 0x14003aa92
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x14003aa92
cmp byte [rcx], 0
je 0x14003aa92
mov rdx, rcx
xor r8d, r8d
lea rcx, [rsp + 0x30]
call fcn.14005d980
test eax, eax
js 0x14003aa92
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call fcn.14005d970
cmp ebx, 0xffffffff
mov rbx, qword [rsp + 0x20]
je 0x14003aa92
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x14003aaa0
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x4070
call fcn.140001130
sub rsp, rax
mov rax, qword [0x1400f54e0]
xor rax, rsp
mov qword [rsp + 0x4060], rax
mov qword [rsp + 0x30], rcx
mov rbx, rdx
test rdx, rdx
je 0x14003ab65
lea rdx, [rsp + 0x2050]
mov ecx, 0x1004
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x14003ab56
xor r9d, r9d
lea r8, [rsp + 0x40]
mov edx, 0x1004
lea rcx, [rsp + 0x2050]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x14003ab56
cmp word [rsp + 0x42], 0x3a
jne 0x14003ab26
movzx ecx, word [rsp + 0x40]
lea eax, [rcx - 0x61]
cmp eax, 0x1a
jae 0x14003ab26
sub cx, 0x20
mov word [rsp + 0x40], cx
lea rax, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntime_r3winpath_win.cpp
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x30]
mov rdx, 0xffffffffffffffff
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call fcn.1400594a0
jmp 0x14003ab6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db40
jmp 0x14003ab6a
mov eax, 0xffffffd7
mov rcx, qword [rsp + 0x4060]
xor rcx, rsp
call fcn.140001270
add rsp, 0x4070
pop rbx
ret

Function at 0x14003ac60
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, r8d
mov rdi, rdx
cmp rcx, 0x1000
jb 0x14003ad59
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x14003ad59
cmp rdx, 0x1000
jb 0x14003ad59
test rax, rdx
jne 0x14003ad59
cmp byte [rcx], 0
je 0x14003ad49
cmp byte [rdx], 0
je 0x14003ad49
test r8d, 0xfffffffe
jne 0x14003ad49
mov rdx, rcx
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x48]
xor r8d, r8d
call fcn.14005d980
mov ebx, eax
test eax, eax
js 0x14003ad37
xor r8d, r8d
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.14005d980
mov ebx, eax
test eax, eax
js 0x14003ad2d
mov rdx, qword [rsp + 0x30]
and esi, 1
mov rcx, qword [rsp + 0x48]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14003ad14
xor ebx, ebx
jmp 0x14003ad23
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db40
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call fcn.14005d970
mov rcx, qword [rsp + 0x48]
call fcn.14005d970
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, 0xfffffffe
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x40]
mov eax, 0xfffffffa
add rsp, 0x20
pop rdi
ret
Function at 0x14003d720
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
jne 0x14003d736
xor eax, eax
add rsp, 0x30
pop rbx
ret
cmp rbx, 0x1000
jb 0x14003d9d8
movabs rax, 0xffff800000000000
test rax, rbx
jne 0x14003d9d8
cmp dword [rcx], 0x19750113
jne 0x14003d9d8
cmp byte [rcx + 0x60], 0
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
jne 0x14003d77e
lea rdx, [0x1400a8a48]
call fcn.14003ca60
xor ebp, ebp
mov qword [rsp + 0x50], rdi
cmp byte [rbx + 0xc8], bpl
je 0x14003d8e7
mov rax, qword [rbx + 0xe0]
test rax, rax
jne 0x14003d7b8
cmp byte [rbx + 0xc9], bpl
jne 0x14003d89c
cmp byte [rbx + 0xca], bpl
jne 0x14003d8ee
cmp rax, 1
jbe 0x14003d84d
mov ecx, dword [rbx + 0xcc]
lea rdi, [rax + rax]
lea rsi, [rax - 1]
mov rax, qword [rbx + 0xe0]
sub rdi, 2
mov r8, qword [rbx + rax*8 + 0xe8]
test ecx, ecx
jne 0x14003d807
mov qword [rsp + 0x20], r8
lea r9, [0x1400a1620]
mov r8, rdi
lea rdx, str._n_s___s__n
mov rcx, rbx
call fcn.14003d060
jmp 0x14003d838
cmp ecx, 2
mov rcx, rbx
jne 0x14003d82c
mov qword [rsp + 0x20], r8
lea r9, [0x1400a1620]
mov r8, rdi
lea rdx, str._s___s__n
call fcn.14003d060
jmp 0x14003d838
lea rdx, str.___s__n
call fcn.14003d060
mov dword [rbx + 0xcc], 2
mov ecx, 2
sub rsi, 1
jne 0x14003d7d0
cmp byte [rbx + 0xc9], bpl
jne 0x14003d89c
cmp byte [rbx + 0xca], bpl
je 0x14003d89c
mov eax, dword [rbx + 4]
lea r8, str.SubTests__u__SubTestsFailed__u__errors__u_
mov r9d, dword [rbx + 0xb8]
lea rdx, [0x1400b3e90]
mov dword [rsp + 0x28], eax
mov rcx, rbx
mov eax, dword [rbx + 0xbc]
mov dword [rsp + 0x20], eax
call fcn.14003cd10
lea rdx, str.__Test__n
mov rcx, rbx
call fcn.14003d060
mov rcx, qword [rbx + 0xd0]
cmp rcx, 0xffffffffffffffff
je 0x14003d8b9
call fcn.140055900
mov qword [rbx + 0xd0], 0xffffffffffffffff
mov rcx, qword [rbx + 0xd8]
cmp rcx, 0xffffffffffffffff
je 0x14003d8d6
call fcn.140037250
mov qword [rbx + 0xd8], 0xffffffffffffffff
mov byte [rbx + 0xc8], bpl
mov dword [rbx + 0xcc], 2
mov qword [rbx + 0xe0], rbp
mov rcx, qword [0x1400f52a8]
call sub.KERNEL32.dll_TlsGetValue
cmp rax, rbx
jne 0x14003d90d
mov rcx, qword [0x1400f52a8]
xor edx, edx
call fcn.140066d60
mov eax, 0xe68afeec
lea rcx, [rbx + 0x68]
xchg dword [rbx], eax
call fcn.140051860
lea rcx, [rbx + 0x28]
call fcn.140051860
mov rsi, qword [rbx + 0x98]
mov qword [rbx + 0x98], rbp
test rsi, rsi
je 0x14003d986
nop dword [rax]
mov rdi, rsi
mov r8d, 3
mov rsi, qword [rsi]
mov rdx, qword [rdi + 0x28]
mov rcx, qword [rdi + 0x20]
call fcn.140066e70
mov rdx, qword [rdi + 0x38]
mov r8d, 3
mov rcx, qword [rdi + 0x30]
call fcn.140066e70
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
call fcn.140066e50
mov rcx, rdi
call fcn.140041950
test rsi, rsi
jne 0x14003d940
mov rcx, qword [rbx + 0xa0]
call fcn.140041e90
mov rcx, qword [rbx + 8]
mov qword [rbx + 0xa0], rbp
call fcn.140041e90
mov rcx, qword [rbx + 0xc0]
mov qword [rbx + 8], rbp
call fcn.140041e90
mov rcx, rbx
mov qword [rbx + 0xc0], rbp
call fcn.140041950
mov rdi, qword [rsp + 0x50]
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
mov eax, 0xfffffffc
add rsp, 0x30
pop rbx
ret
Function at 0x14003d9f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
sub rsp, 0x48
lea rax, [rsp + 0x70]
mov rsi, rdx
mov qword [rsp + 0x20], rax
mov rbx, rcx
test rcx, rcx
jne 0x14003da29
mov rcx, qword [0x1400f52a8]
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
cmp rbx, 0x1000
jb 0x14003db11
movabs rax, 0xffff800000000000
test rax, rbx
jne 0x14003db11
cmp dword [rbx], 0x19750113
jne 0x14003db11
mov qword [rsp + 0x38], rdi
lock inc dword [rbx + 4]
xor edi, edi
cmp dword [rbx + 0x1c], 2
jl 0x14003db03
mov rax, qword [rsp + 0x20]
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], rbp
call sym.vkat.exe_nocrt_strchr
cmp rsi, rax
je 0x14003da91
cmp byte [rax - 1], 0xa
jne 0x14003da91
mov dil, 1
lea rcx, [rbx + 0x28]
call fcn.1400518e0
lea rax, [0x1400b3f6c]
test dil, dil
lea rdx, [0x1400b3f68]
mov r8, rsi
cmovne rdx, rax
lea r9, [rsp + 0x20]
mov rcx, rbx
call fcn.14003ca60
mov r8, qword [rbx + 0xc0]
mov edi, eax
test r8, r8
je 0x14003daf5
lea rdx, str.context:__s_n
mov rcx, rbx
call fcn.14003ca60
mov rcx, qword [rbx + 0xc0]
add edi, eax
call fcn.140041e90
mov qword [rbx + 0xc0], 0
lea rcx, [rbx + 0x28]
call fcn.140051ac0
mov rbp, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x38]
add rsp, 0x48
pop rsi
pop rbx
ret
mov eax, 0xfffffffc
add rsp, 0x48
pop rsi
pop rbx
ret

Function at 0x14003db60
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x30
mov r14, r9
mov r15, r8
mov ebp, edx
mov rbx, rcx
test rcx, rcx
jne 0x14003db8d
mov rcx, qword [0x1400f52a8]
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
cmp rbx, 0x1000
jb 0x14003dc27
movabs rax, 0xffff800000000000
test rax, rbx
jne 0x14003dc27
cmp dword [rbx], 0x19750113
jne 0x14003dc27
mov qword [rsp + 0x50], rsi
lea rcx, [rbx + 0x28]
mov qword [rsp + 0x58], rdi
call fcn.1400518e0
xor edi, edi
cmp ebp, dword [rbx + 0x1c]
jg 0x14003dc03
cmp byte [rbx + 0x60], dil
jne 0x14003dbe2
lea rdx, [0x1400a8a48]
mov rcx, rbx
call fcn.14003ca60
mov edi, eax
mov qword [rsp + 0x28], r14
lea rcx, [0x14003caa0]
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov rdx, rbx
call fcn.1400659b0
add edi, eax
lea rcx, [rbx + 0x28]
call fcn.140051ac0
mov rsi, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
mov rbx, qword [rsp + 0x60]
mov eax, 0xffffffff
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
Function at 0x14003dc40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x30
mov r14, r9
mov r15, r8
mov ebp, edx
mov rbx, rcx
test rcx, rcx
jne 0x14003dc6d
mov rcx, qword [0x1400f52a8]
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
cmp rbx, 0x1000
jb 0x14003dced
movabs rax, 0xffff800000000000
test rax, rbx
jne 0x14003dced
cmp dword [rbx], 0x19750113
jne 0x14003dced
mov qword [rsp + 0x50], rsi
lea rcx, [rbx + 0x28]
mov qword [rsp + 0x58], rdi
call fcn.1400518e0
xor esi, esi
cmp ebp, dword [rbx + 0x1c]
jg 0x14003dcc9
mov qword [rsp + 0x28], r14
lea rcx, [0x14003caa0]
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov rdx, rbx
call fcn.1400659b0
mov rsi, rax
lea rcx, [rbx + 0x28]
call fcn.140051ac0
mov rdi, qword [rsp + 0x58]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
mov rbx, qword [rsp + 0x60]
mov eax, 0xffffffff
add rsp, 0x30
pop r15
pop r14
pop rbp
ret

Function at 0x14003dd10
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x40
lea rbx, [rsp + 0x70]
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
jne 0x14003dd45
mov rcx, qword [0x1400f52a8]
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
cmp rdi, 0x1000
jb 0x14003ddc2
movabs rax, 0xffff800000000000
test rax, rdi
jne 0x14003ddc2
cmp dword [rdi], 0x19750113
jne 0x14003ddc2
mov qword [rsp + 0x38], rbp
xor ebp, ebp
mov byte [rdi + 0xb0], 1
test rsi, rsi
je 0x14003ddb3
cmp byte [rsi], bpl
je 0x14003ddb3
cmp dword [rdi + 0x1c], 4
jl 0x14003ddb3
lea rcx, [rdi + 0x28]
mov qword [rsp + 0x20], rbx
call fcn.1400518e0
lea r9, [rsp + 0x20]
mov r8, rsi
lea rdx, [0x1400b3f68]
mov rcx, rdi
call fcn.14003ca60
lea rcx, [rdi + 0x28]
mov ebp, eax
call fcn.140051ac0
mov eax, ebp
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov eax, 0xfffffffc
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x14003ddd0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, rcx
test rcx, rcx
jne 0x14003ddfc
mov rcx, qword [0x1400f52a8]
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
cmp rbx, 0x1000
jb 0x14003df07
movabs rax, 0xffff800000000000
test rax, rbx
jne 0x14003df07
cmp dword [rbx], 0x19750113
jne 0x14003df07
mov qword [rsp + 0x30], rbp
lea rcx, [rbx + 0x68]
mov qword [rsp + 0x38], r14
call fcn.1400518e0
mov rcx, rbx
call fcn.14003cb90
inc dword [rbx + 0xb8]
lea rdx, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntime_r3_test.cpp
mov eax, dword [rbx + 4]
mov rcx, rsi
mov dword [rbx + 0xb4], eax
call fcn.140041e30
mov rcx, rsi
mov qword [rbx + 0xa0], rax
call sym.vkat.exe_nocrt_strlen
xor ebp, ebp
mov qword [rbx + 0xa8], rax
cmp dword [rbx + 0x1c], 5
mov word [rbx + 0xb0], 0
jl 0x14003de9f
mov r9, rsi
lea r8, str.debug:_Starting_sub_test__s_n
lea edx, [rbp + 5]
mov rcx, rdi
call fcn.14003db40
mov ebp, eax
cmp byte [rbx + 0xca], 0
jne 0x14003dec9
mov r9, qword [rbx + 8]
lea r8, str.name_RMas
lea rdx, str.Test
mov byte [rbx + 0xca], 1
mov rcx, rbx
call fcn.14003cf10
mov r9, rsi
lea r8, str.name_RMas
lea rdx, str.Test
mov rcx, rbx
call fcn.14003cf10
lea rcx, [rbx + 0x68]
call fcn.140051ac0
mov r14, qword [rsp + 0x38]
mov eax, ebp
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14003df20
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14003df3d
mov rcx, qword [0x1400f52a8]
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
cmp rbx, 0x1000
jb 0x14003df8d
movabs rax, 0xffff800000000000
test rax, rbx
jne 0x14003df8d
cmp dword [rbx], 0x19750113
jne 0x14003df8d
mov qword [rsp + 0x30], rdi
lea rdi, [rbx + 0x68]
mov rcx, rdi
call fcn.1400518e0
mov rcx, rbx
call fcn.14003cb90
mov rcx, rdi
mov ebx, eax
call fcn.140051ac0
mov rdi, qword [rsp + 0x30]
mov eax, ebx
add rsp, 0x20
pop rbx
ret
mov eax, 0xfffffffc
add rsp, 0x20
pop rbx
ret
Function at 0x14003dfa0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
lea r8, [rsp + 0x70]
lea rcx, [rsp + 0x20]
lea r9, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntime_r3_test.cpp
call fcn.1400508d0
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14003e12e
mov qword [rsp + 0x40], rbx
mov rbx, rsi
mov qword [rsp + 0x38], rbp
mov rbp, rcx
test rsi, rsi
jne 0x14003e005
mov rcx, qword [0x1400f52a8]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x20]
mov rbx, rax
cmp rbx, 0x1000
jb 0x14003e111
movabs rax, 0xffff800000000000
test rax, rbx
jne 0x14003e111
cmp dword [rbx], 0x19750113
jne 0x14003e111
lea rcx, [rbx + 0x68]
mov qword [rsp + 0x30], r14
call fcn.1400518e0
mov rcx, rbx
call fcn.14003cb90
inc dword [rbx + 0xb8]
lea rdx, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntime_r3_test.cpp
mov eax, dword [rbx + 4]
mov rcx, rbp
mov dword [rbx + 0xb4], eax
call fcn.140041e30
mov rcx, rbp
mov qword [rbx + 0xa0], rax
call sym.vkat.exe_nocrt_strlen
xor edi, edi
mov qword [rbx + 0xa8], rax
cmp dword [rbx + 0x1c], 5
mov word [rbx + 0xb0], 0
jl 0x14003e0a3
mov r9, rbp
lea r8, str.debug:_Starting_sub_test__s_n
lea edx, [rdi + 5]
mov rcx, rsi
call fcn.14003db40
mov edi, eax
cmp byte [rbx + 0xca], 0
jne 0x14003e0cd
mov r9, qword [rbx + 8]
lea r8, str.name_RMas
lea rdx, str.Test
mov byte [rbx + 0xca], 1
mov rcx, rbx
call fcn.14003cf10
mov r9, rbp
lea r8, str.name_RMas
lea rdx, str.Test
mov rcx, rbx
call fcn.14003cf10
lea rcx, [rbx + 0x68]
call fcn.140051ac0
mov rcx, qword [rsp + 0x20]
mov r14, qword [rsp + 0x30]
call fcn.140041e90
mov rbp, qword [rsp + 0x38]
mov eax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
pop rdi
pop rsi
ret
mov edi, 0xffffffff
call fcn.140041e90
mov rbp, qword [rsp + 0x38]
mov eax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
pop rdi
pop rsi
ret
xor edi, edi
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x14003e140
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rdi, rcx
test rcx, rcx
jne 0x14003e164
mov rcx, qword [0x1400f52a8]
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov qword [rsp + 0x30], rbx
cmp rdi, 0x1000
jb 0x14003e215
movabs rax, 0xffff800000000000
test rax, rdi
jne 0x14003e215
cmp dword [rdi], 0x19750113
jne 0x14003e215
lea rcx, [rdi + 0x68]
call fcn.1400518e0
mov rcx, rdi
call fcn.14003cc00
lea rcx, [rdi + 0x68]
call fcn.140051ac0
mov eax, dword [rdi + 4]
mov rcx, rsi
test eax, eax
jne 0x14003e1e4
lea r8, str.SUCCESS_n
lea edx, [rax + 1]
call fcn.14003db40
mov rcx, rdi
xor ebx, ebx
call fcn.14003d720
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9d, dword [rdi + 4]
lea r8, str.FAILURE____u_errors_n
mov ebx, 1
mov edx, ebx
call fcn.14003db40
mov rcx, rdi
call fcn.14003d720
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14003fd10
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x40
mov r10, qword [rcx + 0x40]
mov r11, r9
mov rbx, rcx
xor r9d, r9d
mov rcx, qword [r10 + 0x18]
test rcx, rcx
je 0x14003fd3a
movzx eax, byte [rcx]
test al, al
je 0x14003fd3a
mov byte [rcx], r9b
mov dword [r10 + 0xc], r9d
mov eax, dword [rbx + 0x28]
test rax, 0x7dff8010
je 0x14003fd66
mov dword [rsp + 0x28], edx
lea rcx, [0x14003e620]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x2c], r8d
mov qword [rsp + 0x30], r9
jmp 0x14003fd70
mov rdx, rbx
lea rcx, [0x14003e490]
mov r9, qword [rsp + 0x70]
mov r8, r11
call fcn.14006b110
test byte [rbx + 0x28], 2
mov rax, qword [rbx + 0x40]
jne 0x14003fd9c
cmp dword [rax + 0xc], 0
je 0x14003fd9c
xor edx, edx
mov rcx, rbx
add rsp, 0x40
pop rbx
jmp fcn.14003f7f0
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x14003fdab
mov eax, dword [rax + 0xc]
mov dword [rcx + 4], eax
add rsp, 0x40
pop rbx
ret

Function at 0x140041a20
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbx
sub rsp, 0x20
rdtsc
shl rdx, 0x20
xor ecx, ecx
or rax, rdx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rbx
cmp rax, 0x5dc
seta al
add rsp, 0x20
pop rbx
ret
Function at 0x140043ff0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x20
mov rbx, qword gs:[0x60]
mov r12, rcx
call qword [sym.imp.ntdll.dll_RtlAcquirePebLock]
mov rdi, qword [rbx + 0x20]
xor r15d, r15d
mov esi, r15d
test rdi, rdi
je 0x14004405b
mov rdi, qword [rdi + 0x80]
test rdi, rdi
je 0x14004405e
mov rbx, rdi
cmp word [rdi], r15w
je 0x14004405e
nop
mov rcx, rbx
inc rsi
call fcn.140059470
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], r15w
jne 0x140044040
jmp 0x14004405e
mov rdi, r15
lea rdx, [0x1400a1620]
mov qword [rsp + 0x40], r14
mov ecx, 0x30
lea rbp, [rsi + 1]
call fcn.1400418f0
mov rbx, rax
test rax, rax
je 0x14004418e
mov ecx, 0x10
mov dword [rax], 0x19571010
cmp rbp, rcx
mov word [rax + 4], 0x100
lea rax, [fcn.14003c7c0]
mov qword [rbx + 0x20], r15
cmovae rcx, rbp
mov qword [rbx + 0x28], rax
add rcx, 0xf
mov qword [rbx + 8], r15
and rcx, 0xfffffffffffffff0
lea rdx, [0x1400a1620]
mov qword [rbx + 0x10], rcx
lea rcx, [rcx*8]
call fcn.140041920
mov qword [rbx + 0x18], rax
test rax, rax
je 0x140044186
mov rbp, r15
test rsi, rsi
je 0x140044159
cmp word [rdi], r15w
je 0x140044159
mov rax, qword [rbx + 0x18]
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntimegenericenv_generic.cpp
mov rcx, rdi
lea rdx, [rax + rbp*8]
call fcn.1400596a0
mov r14d, eax
test eax, eax
js 0x14004416b
mov rcx, qword [rbx + 0x18]
mov edx, 0x3d
mov rcx, qword [rcx + rbp*8]
call sym.vkat.exe_nocrt_strchr
test rax, rax
jne 0x140044141
mov rax, qword [rbx + 0x18]
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntimegenericenv_generic.cpp
lea rdx, [0x1400b4b14]
lea rcx, [rax + rbp*8]
call fcn.140041bd0
mov r14d, eax
test eax, eax
js 0x14004416b
mov rcx, rdi
inc rbp
call fcn.140059470
lea rdi, [rdi + rax*2]
add rdi, 2
cmp rbp, rsi
jb 0x1400440e4
mov rax, qword [rbx + 0x18]
mov qword [rbx + 8], rbp
mov qword [rax + rbp*8], r15
mov qword [r12], rbx
jmp 0x140044194
lea rax, [rbp + 1]
mov qword [rbx + 8], rax
call qword [sym.imp.ntdll.dll_RtlReleasePebLock]
mov rcx, rbx
call fcn.140044a50
mov eax, r14d
jmp 0x14004419d
mov rcx, rbx
call fcn.140041950
mov r15d, 0xfffffff8
call qword [sym.imp.ntdll.dll_RtlReleasePebLock]
mov eax, r15d
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r12
pop rdi
ret