joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028080
Capabilities:
Get disk size
Get file size

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x80
mov rax, qword [0x14013c170]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, rcx
or rbp, 0xffffffffffffffff
mov rbx, rdx
mov rcx, rbp
cmp rdi, rbp
lea rdx, [rsp + 0x44]
cmovne rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x40], eax
cmp eax, 0xffffffff
je 0x1400280d1
mov rax, qword [rsp + 0x40]
mov qword [rbx], rax
xor eax, eax
jmp 0x1400281b3
mov qword [rsp + 0xb0], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxControl.exe_RTErrConvertFromWin32
mov qword [rsp + 0x38], 0
mov rcx, rbp
mov esi, eax
lea rax, [rsp + 0x48]
cmp rdi, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
cmovne rcx, rdi
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov dword [rsp + 0x28], 0x18
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400281a9
mov eax, dword [rsp + 0x68]
cmp eax, 0xc
je 0x14002813b
cmp eax, 0xb
jne 0x1400281a9
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x74]
mov qword [rsp + 0x38], 0
imul rcx, rax
mov eax, dword [rsp + 0x6c]
mov edx, 0x7405c
imul rcx, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 8
imul rcx, qword [rsp + 0x60]
mov qword [rbx], rcx
cmp rdi, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
cmovne rbp, rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400281a5
mov rax, qword [rsp + 0x50]
mov qword [rbx], rax
xor eax, eax
jmp 0x1400281ab
mov eax, esi
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400057e0
add rsp, 0x80
pop rdi
pop rbp
pop rbx
ret

Function at 0x140028680
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
lea r8, str.D:_tinderbox_add_5.2_srcVBoxRuntime_r3win_fileio_win.cpp
lea rdx, [rsp + 0x38]
call sym.VBoxControl.exe_RTStrToUtf16Tag
mov ebx, eax
test eax, eax
js 0x1400286c7
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400286bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxControl.exe_RTErrConvertFromWin32
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call sym.VBoxControl.exe_RTStrFree
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1400286d0
Capabilities:
Check if file exists
Move file

Disassembly:
lea rax, [rcx + 0x1000]
cmp rax, 0x2000
jb 0x140028720
movabs r9, 0xffff800000000000
test r9, rcx
jne 0x140028720
lea rax, [rdx + 0x1000]
cmp rax, 0x2000
jb 0x140028720
test r9, rdx
jne 0x140028720
test r8d, 0xfffffffe
jne 0x14002871a
and r8d, 1
mov r9d, 0x8000
jmp 0x14003a170
mov eax, 0xfffffffe
ret
mov eax, 0xfffffffa
ret
Function at 0x140028730
Capabilities:
Check if file exists
Move file

Disassembly:
lea rax, [rcx + 0x1000]
cmp rax, 0x2000
jb 0x140028784
movabs r9, 0xffff800000000000
test r9, rcx
jne 0x140028784
lea rax, [rdx + 0x1000]
cmp rax, 0x2000
jb 0x140028784
test r9, rdx
jne 0x140028784
test r8d, 0xfffffffe
jne 0x14002877e
and r8d, 1
mov r9d, 0x8000
or r8d, 2
jmp 0x14003a170
mov eax, 0xfffffffe
ret
mov eax, 0xfffffffa
ret
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov esi, r8d
mov rbx, rdx
lea r8, str.D:_tinderbox_add_5.2_srcVBoxRuntime_r3winpath_win.cpp
lea rdx, [rsp + 0x20]
mov edi, r9d
call sym.VBoxControl.exe_RTStrToUtf16Tag
test eax, eax
js 0x14003a257
lea r8, str.D:_tinderbox_add_5.2_srcVBoxRuntime_r3winpath_win.cpp
lea rdx, [rsp + 0x28]
mov rcx, rbx
call sym.VBoxControl.exe_RTStrToUtf16Tag
mov ebx, eax
test eax, eax
js 0x14003a24b
mov qword [rsp + 0x40], rbp
xor ebp, ebp
test edi, edi
je 0x14003a20e
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14003a1eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxControl.exe_RTErrConvertFromWin32
mov ebx, eax
jmp 0x14003a20e
and edi, 0xf000
cmp edi, 0x4000
jne 0x14003a205
test al, 0x10
mov ebx, 0xffffff82
cmovne ebx, ebp
jmp 0x14003a20e
and al, 0x10
neg al
sbb ebx, ebx
and ebx, 0xffffff81
test ebx, ebx
js 0x14003a23c
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14003a22d
mov ebx, ebp
jmp 0x14003a23c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxControl.exe_RTErrConvertFromWin32
mov ebx, eax
mov rcx, qword [rsp + 0x28]
call sym.VBoxControl.exe_RTStrFree
mov rbp, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call sym.VBoxControl.exe_RTStrFree
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400289c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r12
sub rsp, 0x40
mov rsi, r9
mov rbx, r8
mov r12, rdx
mov rbp, rcx
test r8, r8
jne 0x1400289ee
xor eax, eax
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rsi
pop rbp
ret
mov eax, ebx
cmp rax, rbx
jne 0x140028ba3
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], r13
xor r13d, r13d
cmp rbp, rcx
lea r9, [rsp + 0x70]
cmovne rcx, rbp
mov dword [rsp + 0x70], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140028ade
mov eax, dword [rsp + 0x70]
test rsi, rsi
jne 0x140028b92
cmp eax, ebx
jae 0x140028b9c
or rcx, 0xffffffffffffffff
mov r8d, ebx
mov edx, eax
cmp rbp, rcx
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
cmovne rcx, rbp
sub r8d, eax
add rdx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140028a90
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x140028b88
mov eax, dword [rsp + 0x70]
add eax, ecx
mov dword [rsp + 0x70], eax
cmp eax, ebx
jb 0x140028a43
xor eax, eax
jmp 0x140028ac6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxControl.exe_RTErrConvertFromWin32
mov edi, eax
cmp eax, 0xffffff68
jne 0x140028ac4
sub ebx, dword [rsp + 0x70]
mov r8d, 1
mov rcx, rbp
mov edx, ebx
call fcn.140028830
mov ecx, 0xffffff80
test al, al
cmovne edi, ecx
mov eax, edi
mov rdi, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x140028a96
mov eax, ebx
mov edi, 0x8000
shr eax, 1
cmp eax, edi
ja 0x140028b02
lea edi, [rax + 0xff]
and edi, 0xffffff00
mov eax, r13d
mov dword [rsp + 0x70], eax
test ebx, ebx
je 0x140028b9c
mov r8d, ebx
mov edx, eax
lea r9, [rsp + 0x30]
sub r8d, eax
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x20], r13
cmp edi, r8d
cmovbe r8d, edi
or rcx, 0xffffffffffffffff
cmp rbp, rcx
cmovne rcx, rbp
add rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140028b66
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x140028a96
cmp edi, eax
jbe 0x140028a96
mov eax, dword [rsp + 0x70]
shr edi, 1
jmp 0x140028b7d
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x30]
add eax, ecx
mov dword [rsp + 0x70], eax
test rsi, rsi
jne 0x140028b92
test ecx, ecx
je 0x140028b88
cmp eax, ebx
jb 0x140028b11
xor eax, eax
jmp 0x140028ac6
mov eax, 0xffffff90
jmp 0x140028ac6
cmp eax, ebx
cmovbe ebx, eax
mov eax, ebx
mov qword [rsi], rax
xor eax, eax
jmp 0x140028ac6
mov eax, 0xffffffc9
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rsi
pop rbp
ret
Function at 0x140034f30
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
lea rdi, [rcx + 0x1f]
and rdi, 0xffffffffffffffe0
mov rcx, rdi
call fcn.14000de74
mov rbx, rax
test rax, rax
je 0x140034fb9
mov r8, rdi
mov edx, 0xcc
mov rcx, rax
call fcn.140005bc0
mov rcx, rbx
lea r9, [rsp + 0x30]
and ecx, 0xfff
mov r8d, 0x40
mov dword [rsp + 0x30], 0
lea rdx, [rcx + rdi + 0xfff]
mov rcx, rbx
and rdx, 0xfffffffffffff000
and rcx, 0xfffffffffffff000
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140034fb6
mov rcx, rbx
call fcn.14000a244
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400353d0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov edx, 0x3d
mov rbx, rcx
call fcn.140044688
test rax, rax
jne 0x1400353f5
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140044d74
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400359c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edx, 0x3d
mov rdi, rcx
call fcn.140044688
xor ebx, ebx
test rax, rax
jne 0x1400359f7
mov rcx, rdi
call fcn.140044d74
test rax, rax
setne al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test rbx, rbx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
setne al
add rsp, 0x20
pop rdi
ret

Function at 0x140039ae0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x2070
call fcn.140005810
sub rsp, rax
mov rax, qword [0x14013c170]
xor rax, rsp
mov qword [rsp + 0x2060], rax
mov qword [rsp + 0x38], rdx
mov rbx, r8
lea rdi, str.D:_tinderbox_add_5.2_srcVBoxRuntime_r3winpath_win.cpp
lea rdx, [rsp + 0x30]
mov r8, rdi
call sym.VBoxControl.exe_RTStrToUtf16Tag
test eax, eax
js 0x140039ba2
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov edx, 0x1004
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jle 0x140039b87
cmp eax, 0x1004
jae 0x140039b80
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140039b87
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x50]
mov r9, rbx
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
call sym.VBoxControl.exe_RTUtf16LittleToUtf8ExTag
jmp 0x140039b94
mov ebx, 0xffffff88
jmp 0x140039b96
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxControl.exe_RTErrConvertFromWin32
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call sym.VBoxControl.exe_RTStrFree
mov eax, ebx
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.1400057e0
mov rbx, qword [rsp + 0x2098]
add rsp, 0x2070
pop rdi
ret
Function at 0x140039bd0
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push rdi
mov eax, 0x2070
call fcn.140005810
sub rsp, rax
mov rax, qword [0x14013c170]
xor rax, rsp
mov qword [rsp + 0x2060], rax
lea rax, [rcx + 0x1000]
mov rdi, rdx
mov qword [rsp + 0x40], rcx
cmp rax, 0x2000
jb 0x140039d8a
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x140039d8a
test rdx, rdx
je 0x140039d83
lea r8, [rsp + 0x30]
lea rcx, str.Shell32.dll
mov dl, 1
mov qword [rsp + 0x2090], rbx
xor bl, bl
call sym.VBoxControl.exe_RTLdrLoadSystem
test eax, eax
js 0x140039ca8
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str.SHGetFolderPathW
call sym.VBoxControl.exe_RTLdrGetSymbol
test eax, eax
js 0x140039c82
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
lea edx, [r9 + 0x28]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [rsp + 0x38]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x30]
call sym.VBoxControl.exe_RTLdrClose
test bl, bl
je 0x140039ca8
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140039ca8
test al, 0x10
jne 0x140039d30
mov ebx, 0x1004
lea rdx, [rsp + 0x50]
lea rcx, [0x14012f5c8]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140039cda
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140039cda
test al, 0x10
jne 0x140039d30
lea rdx, [rsp + 0x50]
lea rcx, str.HOMEDRIVE
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140039d7c
lea rcx, [rsp + 0x50]
call sym.VBoxControl.exe_RTUtf16Len
lea rcx, str.HOMEPATH
sub ebx, eax
lea rdx, [rsp + rax*2 + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140039d7c
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140039d7c
test al, 0x10
je 0x140039d7c
lea rax, str.D:_tinderbox_add_5.2_srcVBoxRuntime_r3winpath_win.cpp
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov r9, rdi
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x20], 0
call sym.VBoxControl.exe_RTUtf16LittleToUtf8ExTag
mov rbx, qword [rsp + 0x2090]
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.1400057e0
add rsp, 0x2070
pop rdi
ret
mov eax, 0xffffff99
jmp 0x140039d5b
mov eax, 0xfffffffe
jmp 0x140039d63
mov eax, 0xfffffffa
jmp 0x140039d63
Function at 0x14003a170
Capabilities:
Check if file exists
Move file

Disassembly:
lea rax, [rcx + 0x1000]
cmp rax, 0x2000
jb 0x140028784
movabs r9, 0xffff800000000000
test r9, rcx
jne 0x140028784
lea rax, [rdx + 0x1000]
cmp rax, 0x2000
jb 0x140028784
test r9, rdx
jne 0x140028784
test r8d, 0xfffffffe
jne 0x14002877e
and r8d, 1
mov r9d, 0x8000
or r8d, 2
jmp 0x14003a170
mov eax, 0xfffffffe
ret
mov eax, 0xfffffffa
ret
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov esi, r8d
mov rbx, rdx
lea r8, str.D:_tinderbox_add_5.2_srcVBoxRuntime_r3winpath_win.cpp
lea rdx, [rsp + 0x20]
mov edi, r9d
call sym.VBoxControl.exe_RTStrToUtf16Tag
test eax, eax
js 0x14003a257
lea r8, str.D:_tinderbox_add_5.2_srcVBoxRuntime_r3winpath_win.cpp
lea rdx, [rsp + 0x28]
mov rcx, rbx
call sym.VBoxControl.exe_RTStrToUtf16Tag
mov ebx, eax
test eax, eax
js 0x14003a24b
mov qword [rsp + 0x40], rbp
xor ebp, ebp
test edi, edi
je 0x14003a20e
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14003a1eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxControl.exe_RTErrConvertFromWin32
mov ebx, eax
jmp 0x14003a20e
and edi, 0xf000
cmp edi, 0x4000
jne 0x14003a205
test al, 0x10
mov ebx, 0xffffff82
cmovne ebx, ebp
jmp 0x14003a20e
and al, 0x10
neg al
sbb ebx, ebx
and ebx, 0xffffff81
test ebx, ebx
js 0x14003a23c
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14003a22d
mov ebx, ebp
jmp 0x14003a23c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxControl.exe_RTErrConvertFromWin32
mov ebx, eax
mov rcx, qword [rsp + 0x28]
call sym.VBoxControl.exe_RTStrFree
mov rbp, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call sym.VBoxControl.exe_RTStrFree
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14003a270
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
lea rax, [rcx + 0x1000]
cmp rax, 0x2000
jb 0x14003a2c7
movabs r9, 0xffff800000000000
test r9, rcx
jne 0x14003a2c7
lea rax, [rdx + 0x1000]
cmp rax, 0x2000
jb 0x14003a2c7
test r9, rdx
jne 0x14003a2c7
cmp byte [rcx], 0
je 0x14003a2c1
cmp byte [rdx], 0
je 0x14003a2c1
test r8d, 0xfffffffe
jne 0x14003a2c1
and r8d, 1
xor r9d, r9d
jmp 0x14003a170
mov eax, 0xfffffffe
ret
mov eax, 0xfffffffa
ret
Function at 0x14003a2e0
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x4070
call fcn.140005810
sub rsp, rax
mov rax, qword [0x14013c170]
xor rax, rsp
mov qword [rsp + 0x4060], rax
mov rbx, rdx
mov qword [rsp + 0x30], rcx
lea rdx, [rsp + 0x40]
mov ecx, 0x1004
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x14003a36c
lea r8, [rsp + 0x2050]
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov edx, 0x1004
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x14003a36c
lea rax, str.D:_tinderbox_add_5.2_srcVBoxRuntime_r3winpath_win.cpp
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x2050]
mov qword [rsp + 0x28], rax
mov r9, rbx
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x20], 0
call sym.VBoxControl.exe_RTUtf16LittleToUtf8ExTag
jmp 0x14003a379
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxControl.exe_RTErrConvertFromWin32
mov rcx, qword [rsp + 0x4060]
xor rcx, rsp
call fcn.1400057e0
add rsp, 0x4070
pop rbx
ret

Function at 0x14003a3a0
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
lea rax, [rcx + 0x1000]
cmp rax, 0x2000
jb 0x14003a462
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x14003a462
cmp byte [rcx], 0
je 0x14003a458
lea r8, str.D:_tinderbox_add_5.2_srcVBoxRuntime_r3winpath_win.cpp
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call sym.VBoxControl.exe_RTStrToUtf16Tag
mov ebx, eax
test eax, eax
js 0x14003a44c
mov rcx, qword [rsp + 0x30]
call sym.VBoxControl.exe_RTUtf16Len
mov rcx, qword [rsp + 0x30]
cmp rax, 2
jb 0x14003a429
movzx edx, word [rcx + rax*2 - 2]
cmp dx, 0x2f
je 0x14003a415
cmp dx, 0x5c
jne 0x14003a429
cmp word [rcx + rax*2 - 4], 0x3a
je 0x14003a429
xor edx, edx
mov word [rcx + rax*2 - 2], dx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x14003a442
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxControl.exe_RTErrConvertFromWin32
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call sym.VBoxControl.exe_RTStrFree
mov eax, ebx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
mov eax, 0xfffffffe
add rsp, 0x28
ret
mov eax, 0xfffffffa
add rsp, 0x28
ret

Function at 0x14003a550
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
lea rax, [rcx + 0x1000]
cmp rax, 0x2000
jb 0x14003a5b9
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x14003a5b9
cmp byte [rcx], 0
je 0x14003a5b9
lea r8, str.D:_tinderbox_add_5.2_srcVBoxRuntime_r3winpath_win.cpp
lea rdx, [rsp + 0x30]
call sym.VBoxControl.exe_RTStrToUtf16Tag
test eax, eax
js 0x14003a5b9
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call sym.VBoxControl.exe_RTStrFree
cmp ebx, 0xffffffff
mov rbx, qword [rsp + 0x20]
je 0x14003a5b9
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x14003f230
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r12
push r13
sub rsp, 0x40
xor eax, eax
mov r13, r8
mov rbx, r9
mov rbp, rdx
mov r8, rdx
lea r9d, [rax + 0x68]
lea rdx, [rsp + 0x30]
mov r12, rcx
mov dword [rsp + 0x30], 0xc0000365
mov dword [rsp + 0x34], eax
mov qword [rsp + 0x38], 0xffffffffffffffd5
mov dword [rsp + 0x20], 0x12
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x14003f29c
cmp eax, 0x80000005
je 0x14003f29c
mov ecx, eax
call sym.VBoxControl.exe_RTErrConvertFromNtStatus
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rbp
ret
mov rax, qword [rbp + 0x30]
mov rdx, qword [rsp + 0x88]
movabs rcx, 0x5e6684f4b3960000
mov qword [rbx], rax
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x60], rsi
mov qword [rbx + 8], rax
mov rax, qword [rbp]
xor esi, esi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], r14
imul rax, rax, 0x64
add rax, rcx
mov qword [rbx + 0x28], rax
mov rax, qword [rbp + 8]
imul rax, rax, 0x64
add rax, rcx
mov qword [rbx + 0x10], rax
mov rax, qword [rbp + 0x10]
imul rax, rax, 0x64
add rax, rcx
mov qword [rbx + 0x18], rax
mov rax, qword [rbp + 0x18]
imul rax, rax, 0x64
add rax, rcx
mov qword [rbx + 0x20], rax
test rdx, rdx
je 0x14003f323
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
jmp 0x14003f326
mov r8, rsi
mov ecx, dword [rbp + 0x20]
mov r9d, dword [rsp + 0x90]
and ecx, 0x7fff
shl ecx, 0x10
call fcn.140039170
mov edi, dword [rsp + 0x80]
mov r14d, 1
mov dword [rbx + 0x30], eax
mov dword [rbx + 0x34], edi
cmp edi, 2
jne 0x14003f3b4
mov qword [rbx + 0x38], 0xffffffffffffffff
mov eax, dword [rbp + 0x38]
mov dword [rbx + 0x44], esi
cmp eax, r14d
lea rdx, [rsp + 0x30]
mov r8, rbp
cmovbe eax, r14d
mov rcx, r12
mov dword [rsp + 0x20], r14d
mov dword [rbx + 0x40], eax
mov rax, qword [rbp + 0x40]
mov qword [rbx + 0x50], rsi
mov qword [rbx + 0x48], rax
mov eax, 0x800
mov dword [rbx + 0x58], esi
cmp r13, rax
cmovbe eax, r13d
mov r9d, eax
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
jns 0x14003f3ae
cmp eax, 0x80000005
jne 0x14003f3b4
mov eax, dword [rbp + 8]
mov dword [rbx + 0x44], eax
dec edi
je 0x14003f40d
dec edi
je 0x14003f404
dec edi
je 0x14003f3f0
dec edi
je 0x14003f3dc
dec edi
je 0x14003f3cf
mov esi, 0xffffff1f
jmp 0x14003f411
mov dword [rbx + 0x34], 5
mov qword [rbx + 0x38], rsi
jmp 0x14003f411
mov dword [rbx + 0x34], 4
mov dword [rbx + 0x38], 0xffffffff
mov byte [rbx + 0x3c], sil
jmp 0x14003f411
mov dword [rbx + 0x34], 3
mov dword [rbx + 0x38], 0xffffffff
mov byte [rbx + 0x3c], sil
jmp 0x14003f411
mov dword [rbx + 0x34], 2
jmp 0x14003f411
mov dword [rbx + 0x34], r14d
mov r14, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x78]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop r13
pop r12
pop rbp
ret
Function at 0x14006f8ac
Capabilities:
Connect socket
Resolve dns

Disassembly:
jmp 0x1400765d0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x14018d500]
xor rax, rbp
mov qword [rbp + 0x188], rax
lea rcx, [0x14019f020]
call fcn.1400720d9
nop
lea rax, [rbp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea r9, [rbp + 8]
lea r8, [rbp + 0x28]
mov rdx, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1b0]
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
test eax, eax
jne 0x14007665b
mov dword [rbp + 0x184], 1
jmp 0x140076665
mov dword [rbp + 0x184], 0
mov eax, dword [rbp + 0x184]
mov dword [rbp + 0x74], eax
cmp dword [rbp + 0x74], 0
je 0x140076772
mov rax, qword [rbp + 8]
mov r8d, dword [rax + 0xc]
mov rax, qword [rbp + 8]
mov edx, dword [rax + 8]
mov rax, qword [rbp + 8]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbp + 0x98], rax
cmp qword [rbp + 0x98], 0xffffffffffffffff
je 0x14007674a
mov rax, qword [rbp + 8]
mov r8d, dword [rax + 0x10]
mov rax, qword [rbp + 8]
mov rdx, qword [rax + 0x20]
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.WS2_32.dll_connect]
mov dword [rbp + 0xb4], eax
cmp dword [rbp + 0xb4], 0xffffffff
je 0x14007672d
mov r9, qword [rbp + 0x1b8]
mov r8, qword [rbp + 0x1b0]
lea rdx, str.Connected_to__s:_s
xor ecx, ecx
call fcn.140070112
nop
mov rax, qword [rbp + 0x98]
mov qword [0x14018e790], rax
mov rax, qword [rbp + 0x1b0]
mov qword [0x14018e798], rax
mov rax, qword [rbp + 0x1b8]
mov qword [0x14018e7a0], rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
nop
mov al, 1
jmp 0x14007678a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.Connection_failed__error__0x_x_
mov ecx, 1
call fcn.140070112
nop
jmp 0x140076770
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.Failed_to_create_a_socket___0x_x_
mov ecx, 1
call fcn.140070112
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
nop
jmp 0x140076788
mov r8d, dword [rbp + 0x74]
lea rdx, str.GetAddrInfo_failed_with_param:__0x_x_
mov ecx, 1
call fcn.140070112
nop
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14015a4f0]
call fcn.140071832
mov rax, rdi
mov rcx, qword [rbp + 0x188]
xor rcx, rbp
call fcn.1400707ac
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret