joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180075ec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov r9, qword [sym.VBoxRT.dll_g_pSUPGlobalInfoPage]
mov rdi, rcx
test r9, r9
je 0x180075fa1
cmp dword [r9], 0x19590106
jne 0x180075fa1
mov eax, 1
xor ecx, ecx
cpuid
mov dword [rsp + 0x20], eax
mov r8d, ebx
mov dword [rsp + 0x24], ebx
shr r8, 0x18
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x2c], edx
movzx eax, r8b
movzx r11d, word [r9 + rax*2 + 0x100]
add r11, 0xa
shl r11, 7
add r11, r9
mov r10d, dword [r11]
mov eax, r10d
xchg dword [rsp + 0x88], eax
mov r13d, dword [r11 + 4]
mov rsi, qword [r11 + 8]
mov r14, qword [r11 + 0x10]
mov r12d, dword [r9 + 0x14]
rdtsc
shl rdx, 0x20
xor ecx, ecx
or rax, rdx
mov rdx, qword [rdi]
xchg dword [rsp + 0x90], ecx
mov rbp, qword [rdx]
mov r9, rax
xor ecx, ecx
mov eax, 1
cpuid
mov dword [rsp + 0x30], eax
mov eax, ebx
mov dword [rsp + 0x34], ebx
shr rax, 0x18
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x3c], edx
cmp r8b, al
jne 0x180075f91
mov eax, dword [r11]
cmp eax, r10d
jne 0x180075f91
test r10b, 1
je 0x180075fb6
mov r9, qword [sym.VBoxRT.dll_g_pSUPGlobalInfoPage]
test r9, r9
jne 0x180075ee2
mov rcx, rdi
call qword [rdi + reloc.WS2_32.dll_recv]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
sub r9, r14
mov rbx, r13
cmp r9, r13
jbe 0x180075fc7
inc dword [rdi + 0x24]
mov r9, rbx
xor edx, edx
mov eax, r9d
imul rax, r12
div rbx
mov ecx, eax
add rsi, rcx
mov r8, rsi
sub r8, rbp
je 0x180075fef
movabs rax, 0x4e376f736000
cmp r8, rax
jb 0x18007601c
test r8, r8
jg 0x180076007
lea ecx, [r12 + r12]
add rcx, r8
js 0x180076007
lock inc dword [rdi + 0x20]
lea rsi, [rbp + 1]
jmp 0x18007601c
test rbp, rbp
je 0x18007601c
lock inc dword [rdi + 0x28]
mov r9, rbp
mov rdx, rsi
mov rcx, rdi
call qword [rdi + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi]
mov rax, rbp
lock cmpxchg qword [rcx], rsi
je 0x180076055
inc dword [rdi + 0x2c]
mov edx, 0x19
mov rcx, qword [rdi]
xor eax, eax
xchg dword [rsp + 0x98], eax
mov rax, qword [rcx]
cmp rax, rsi
jae 0x180076055
mov rcx, qword [rdi]
lock cmpxchg qword [rcx], rsi
je 0x180076055
dec edx
test edx, edx
jg 0x180076031
mov rax, rsi
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180076de0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x48
call sym.VBoxRT.dll_RTAssertMayPanic
test al, al
jne 0x180076df2
add rsp, 0x48
ret
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rdi
call sym.VBoxRT.dll_RTErrVarsSave
lea rcx, str.VBOX_ASSERT
call sym.VBoxRT.dll_RTEnvGet
test rax, rax
jne 0x180076e17
mov dil, 1
jmp 0x180076e4f
mov qword [rsp + 0x50], rsi
lea rdi, str.breakpoint
mov ecx, ntohl
mov rsi, rax
repe cmpsb byte [rsi], byte [rdi]
je 0x180076e47
lea rdi, str.panic
mov rsi, rax
mov ecx, 6
repe cmpsb byte [rsi], byte [rdi]
je 0x180076e47
xor dil, dil
jmp 0x180076e4a
mov dil, 1
mov rsi, qword [rsp + 0x50]
lea rcx, [rsp + 0x20]
call sym.VBoxRT.dll_RTErrVarsRestore
movzx eax, dil
mov rdi, qword [rsp + 0x40]
add rsp, 0x48
ret
Function at 0x180078330
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180172800
mov r11d, eax
mov eax, edi
cmp rax, rdi
jne 0x18007836e
mov r8d, edi
mov rdx, rsi
mov ecx, r11d
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.180172800
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov ebp, 0xffffffff
nop dword [rax]
mov ebx, ebp
cmp rdi, rbp
mov rdx, rsi
cmovbe ebx, edi
mov ecx, r11d
mov r8d, ebx
call fcn.180172800
mov ecx, ebx
add rsi, rcx
sub rdi, rcx
mov r11d, eax
je 0x180078380
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800783d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, r8d
mov rdi, r8
mov rsi, rdx
mov r9d, ecx
cmp rax, r8
jne 0x1800783fa
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.180172800
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov ebp, 0xffffffff
nop dword [rax]
mov ebx, ebp
cmp rdi, rbp
mov rdx, rsi
cmovbe ebx, edi
mov ecx, r9d
mov r8d, ebx
call fcn.180172800
mov ecx, ebx
add rsi, rcx
sub rdi, rcx
mov r9d, eax
je 0x180078410
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18007da80
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
setne al
add rsp, 0x28
ret

Function at 0x18007eca0
Capabilities:
Shutdown system

Disassembly:
push rbx
push rbp
sub rsp, 0x68
lea rax, [r8 + 0x1000]
mov r9, r8
mov ebp, edx
mov ebx, ecx
cmp rax, 0x2000
jb 0x18007eed4
movabs rax, 0xffff800000000000
test rax, r8
jne 0x18007eed4
test edx, 0xfffffff0
je 0x18007ece8
mov eax, 0xfffffffe
add rsp, 0x68
pop rbp
pop rbx
ret
lea r8, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3winRTSystemShutdown_win.cpp
lea rdx, [rsp + 0x98]
mov rcx, r9
call sym.VBoxRT.dll_RTStrToUtf16Tag
test eax, eax
js 0x18007eed9
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r13
mov r12d, ebp
lea ecx, [rbx + 0x1f3]
mov eax, 0x10624dd3
mov qword [rsp + 0x50], r14
mov esi, 0
mov r14d, esi
mul ecx
mov r13d, edx
mov rdx, qword [rsp + 0x98]
shr r13d, 6
and r12d, 3
sete r14b
shr ebp, 3
mov r8d, r13d
and ebp, 1
xor ecx, ecx
mov dword [rsp + 0x20], r14d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
test eax, eax
je 0x18007ed85
mov eax, 0x57e5
cmp r12d, 1
cmove esi, eax
mov edi, esi
jmp 0x18007ee9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov ebx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov edi, eax
cmp ebx, 5
jne 0x18007ee9f
mov qword [rsp + 0x90], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rsp + 0x90]
lea edx, [rbx + 0x1b]
lea r8d, [rbx - 4]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x18007ee02
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x18007edfa
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x90]
lea edx, [rbx + 0x1b]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x18007ee02
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18007ee9f
lea r8, [rsp + 0x34]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x18007ee9f
mov rcx, qword [rsp + 0x90]
lea r8, [rsp + 0x30]
mov r9d, reloc.WS2_32.dll_recv
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x18007ee91
mov rdx, qword [rsp + 0x98]
mov r9d, ebp
mov r8d, r13d
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
test eax, eax
je 0x18007ee82
mov edi, esi
mov eax, 0x57e5
cmp r12d, 1
cmove edi, eax
jmp 0x18007ee91
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov edi, eax
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x98]
call sym.VBoxRT.dll_RTUtf16Free
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x80]
mov eax, edi
mov rdi, qword [rsp + 0x88]
add rsp, 0x68
pop rbp
pop rbx
ret
mov eax, 0xfffffffa
add rsp, 0x68
pop rbp
pop rbx
ret
Function at 0x18007f3c0
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x60
lea rax, [rcx + 0x1000]
mov rbx, rcx
cmp rax, 0x2000
jb 0x18007f421
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x18007f421
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x18007f411
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
add rsp, 0x60
pop rbx
ret
mov rax, qword [rsp + 0x28]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x60
pop rbx
ret
mov eax, 0xfffffffa
add rsp, 0x60
pop rbx
ret

Function at 0x18007f430
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x60
lea rax, [rcx + 0x1000]
mov rbx, rcx
cmp rax, 0x2000
jb 0x18007f491
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x18007f491
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x18007f481
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
add rsp, 0x60
pop rbx
ret
mov rax, qword [rsp + 0x30]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x60
pop rbx
ret
mov eax, 0xfffffffa
add rsp, 0x60
pop rbx
ret

Function at 0x18007f4a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
lea rdi, [rcx + 0x1f]
and rdi, 0xffffffffffffffe0
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_malloc]
mov rbx, rax
test rax, rax
je 0x18007f52b
mov r8, rdi
mov edx, 0xcc
mov rcx, rax
call sub.MSVCR100.dll_memset
mov rcx, rbx
lea r9, [rsp + 0x30]
and ecx, 0xfff
mov r8d, 0x40
mov dword [rsp + 0x30], 0
lea rdx, [rcx + rdi + 0xfff]
mov rcx, rbx
and rdx, 0xfffffffffffff000
and rcx, 0xfffffffffffff000
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18007f528
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_free]
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18007f6f0
Capabilities:
Create directory
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov eax, edx
mov rbx, rcx
mov rdx, rcx
mov ecx, eax
xor r8d, r8d
call fcn.18006c890
mov ecx, eax
call fcn.18006c900
test al, al
je 0x18007f79c
lea r8, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3windir_win.cpp
lea rdx, [rsp + 0x48]
mov rcx, rbx
call sym.VBoxRT.dll_RTStrToUtf16Tag
test eax, eax
js 0x18007f7a1
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x18007f753
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov ebx, eax
test eax, eax
js 0x18007f78a
mov rcx, qword [rsp + 0x48]
mov edx, 0x2000
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x18007f77b
mov rcx, qword [rsp + 0x48]
xor ebx, ebx
call sym.VBoxRT.dll_RTUtf16Free
mov eax, ebx
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov ebx, eax
mov rcx, qword [rsp + 0x48]
call sym.VBoxRT.dll_RTUtf16Free
mov eax, ebx
add rsp, 0x20
pop rbx
ret
mov eax, 0xffffffeb
add rsp, 0x20
pop rbx
ret

Function at 0x18007f7b0
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
lea r8, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3windir_win.cpp
lea rdx, [rsp + 0x38]
call sym.VBoxRT.dll_RTStrToUtf16Tag
test eax, eax
js 0x18007f801
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x18007f7e1
xor ebx, ebx
jmp 0x18007f7f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call sym.VBoxRT.dll_RTUtf16Free
mov eax, ebx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x18007fdc0
Capabilities:
Check if file exists
Move file

Disassembly:
lea rax, [rcx + 0x1000]
cmp rax, 0x2000
jb 0x18007fe1a
movabs r9, 0xffff800000000000
test r9, rcx
jne 0x18007fe1a
lea rax, [rdx + 0x1000]
cmp rax, 0x2000
jb 0x18007fe1a
test r9, rdx
jne 0x18007fe1a
cmp byte [rcx], 0
jne 0x18007fdfd
mov eax, 0xfffffffe
ret
cmp byte [rdx], 0
je 0x18007fdf7
test r8d, 0xfffffffe
jne 0x18007fdf7
and r8d, 1
mov r9d, 0x4000
jmp fcn.180083890
mov eax, 0xfffffffa
ret
Function at 0x1800803f0
Capabilities:
Clear file content
Set file attributes

Disassembly:
cmp rdx, 1
je 0x180080408
cmp rdx, 2
je 0x180080408
cmp rdx, 3
je 0x180080408
mov eax, 0xfffffffe
ret
or rdx, 0x780
mov r8, rdx
lea rdx, [0x18027460c]
jmp sym.VBoxRT.dll_RTFileOpen

Function at 0x1800804a0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push r12
sub rsp, 0x48
mov rsi, r9
mov rbx, r8
mov r12, rdx
mov rbp, rcx
test r8, r8
jne 0x1800804c7
xor eax, eax
add rsp, 0x48
pop r12
pop rsi
pop rbp
pop rbx
ret
mov eax, ebx
cmp rax, rbx
je 0x1800804dd
mov eax, 0xffffffc9
add rsp, 0x48
pop r12
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x78], r13
xor r13d, r13d
mov qword [rsp + 0x40], r14
or r14, 0xffffffffffffffff
lea r9, [rsp + 0x80]
mov dword [rsp + 0x80], r13d
cmp rbp, r14
mov qword [rsp + 0x20], r13
cmove rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800805ae
test rsi, rsi
je 0x18008052e
mov eax, dword [rsp + 0x80]
mov qword [rsi], rax
xor eax, eax
jmp 0x18008067d
mov eax, dword [rsp + 0x80]
cmp ebx, eax
jbe 0x180080527
nop dword [rax]
mov r8d, ebx
mov edx, eax
mov rcx, rbp
cmp rbp, 0xffffffffffffffff
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
cmove rcx, r14
sub r8d, eax
add rdx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18008059c
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x180080592
mov eax, dword [rsp + 0x80]
add eax, ecx
mov dword [rsp + 0x80], eax
cmp ebx, eax
ja 0x180080540
xor eax, eax
jmp 0x18008067d
mov eax, 0xffffff92
jmp 0x18008067d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
jmp 0x18008067d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x1800805a2
mov eax, ebx
mov qword [rsp + 0x70], rdi
mov edi, 0x4000
shr eax, 1
cmp eax, edi
ja 0x1800805d7
lea edi, [rax + 0xff]
and edi, 0xffffff00
mov eax, r13d
mov dword [rsp + 0x80], eax
test ebx, ebx
je 0x180080676
nop dword [rax]
mov r8d, ebx
mov edx, eax
mov rcx, rbp
sub r8d, eax
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
cmp edi, r8d
mov qword [rsp + 0x20], r13
cmovbe r8d, edi
cmp rbp, 0xffffffffffffffff
cmove rcx, r14
add rdx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180080640
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x180080663
cmp edi, eax
jbe 0x180080663
mov eax, dword [rsp + 0x80]
shr edi, 1
jmp 0x18008065d
mov eax, dword [rsp + 0x80]
mov ecx, dword [rsp + 0x30]
add eax, ecx
mov dword [rsp + 0x80], eax
test rsi, rsi
jne 0x180080673
test ecx, ecx
je 0x18008066c
cmp ebx, eax
ja 0x1800805f0
jmp 0x180080676
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
jmp 0x180080678
mov eax, 0xffffff92
jmp 0x180080678
mov qword [rsi], rax
xor eax, eax
mov rdi, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800806e0
Capabilities:
Get disk size
Get file size

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x60
or rbp, 0xffffffffffffffff
mov rbx, rdx
mov rdi, rcx
cmp rcx, rbp
lea rdx, [rsp + 0x9c]
cmove rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x98], eax
cmp eax, 0xffffffff
je 0x180080728
mov rax, qword [rsp + 0x98]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x60
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x88], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov qword [rsp + 0x38], 0
mov rcx, rdi
mov esi, eax
lea rax, [rsp + 0x80]
cmp rdi, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
cmove rcx, rbp
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov dword [rsp + 0x28], 0x18
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180080818
mov eax, dword [rsp + 0x50]
cmp eax, 0xc
je 0x180080799
cmp eax, 0xb
jne 0x180080818
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x5c]
mov qword [rsp + 0x38], 0
imul rcx, rax
mov eax, dword [rsp + 0x54]
mov edx, 0x7405c
imul rcx, rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 8
imul rcx, qword [rsp + 0x48]
mov qword [rbx], rcx
cmp rdi, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
cmove rdi, rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180080806
mov rax, qword [rsp + 0x40]
mov qword [rbx], rax
xor eax, eax
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rbp
pop rbx
ret
mov eax, esi
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rbp
pop rbx
ret

Function at 0x180080cc0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
lea r8, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3win_fileio_win.cpp
lea rdx, [rsp + 0x38]
call sym.VBoxRT.dll_RTStrToUtf16Tag
mov ebx, eax
test eax, eax
js 0x180080d07
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180080cfb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call sym.VBoxRT.dll_RTUtf16Free
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x180080d10
Capabilities:
Check if file exists
Move file

Disassembly:
lea rax, [rcx + 0x1000]
cmp rax, 0x2000
jb 0x180080d60
movabs r9, 0xffff800000000000
test r9, rcx
jne 0x180080d60
lea rax, [rdx + 0x1000]
cmp rax, 0x2000
jb 0x180080d60
test r9, rdx
jne 0x180080d60
test r8d, 0xfffffffe
je 0x180080d51
mov eax, 0xfffffffe
ret
and r8d, 1
mov r9d, 0x8000
jmp fcn.180083890
mov eax, 0xfffffffa
ret

Function at 0x180080d70
Capabilities:
Check if file exists
Move file

Disassembly:
lea rax, [rcx + 0x1000]
cmp rax, 0x2000
jb 0x180080dc4
movabs r9, 0xffff800000000000
test r9, rcx
jne 0x180080dc4
lea rax, [rdx + 0x1000]
cmp rax, 0x2000
jb 0x180080dc4
test r9, rdx
jne 0x180080dc4
test r8d, 0xfffffffe
je 0x180080db1
mov eax, 0xfffffffe
ret
and r8d, 1
mov r9d, 0x8000
or r8d, 2
jmp fcn.180083890
mov eax, 0xfffffffa
ret
Function at 0x180081000
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push r12
sub rsp, 0x48
mov rsi, r9
mov rbx, r8
mov r12, rdx
mov rbp, rcx
test r8, r8
jne 0x180081027
xor eax, eax
add rsp, 0x48
pop r12
pop rsi
pop rbp
pop rbx
ret
mov eax, ebx
cmp rax, rbx
je 0x18008103d
mov eax, 0xffffffc9
add rsp, 0x48
pop r12
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], r13
xor r13d, r13d
mov qword [rsp + 0x40], r14
or r14, 0xffffffffffffffff
lea r9, [rsp + 0x80]
cmp rbp, r14
mov dword [rsp + 0x80], r13d
mov qword [rsp + 0x20], r13
cmove rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180081145
test rsi, rsi
je 0x180081093
mov eax, dword [rsp + 0x80]
mov qword [rsi], rax
xor eax, eax
jmp 0x18008112c
mov eax, dword [rsp + 0x80]
cmp ebx, eax
jbe 0x18008108c
nop
mov r8d, ebx
mov edx, eax
mov rcx, rbp
cmp rbp, 0xffffffffffffffff
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
cmove rcx, r14
sub r8d, eax
add rdx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800810f3
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x180081204
mov eax, dword [rsp + 0x80]
add eax, ecx
mov dword [rsp + 0x80], eax
cmp ebx, eax
ja 0x1800810a0
xor eax, eax
jmp 0x18008112c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov edi, eax
cmp eax, 0xffffff68
jne 0x18008112a
sub ebx, dword [rsp + 0x80]
mov r8d, 1
mov rcx, rbp
mov edx, ebx
call fcn.180080e70
mov ecx, 0xffffff80
test al, al
cmovne edi, ecx
mov eax, edi
mov r13, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop r12
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x1800810f9
mov eax, ebx
mov edi, 0x8000
shr eax, 1
cmp eax, edi
ja 0x180081169
lea edi, [rax + 0xff]
and edi, 0xffffff00
mov eax, r13d
mov dword [rsp + 0x80], eax
test ebx, ebx
je 0x18008108c
nop dword [rax + rax]
mov r8d, ebx
mov edx, eax
mov rcx, rbp
sub r8d, eax
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
cmp edi, r8d
mov qword [rsp + 0x20], r13
cmovbe r8d, edi
cmp rbp, 0xffffffffffffffff
cmove rcx, r14
add rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800811d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x1800810f9
cmp edi, eax
jbe 0x1800810f9
mov eax, dword [rsp + 0x80]
shr edi, 1
jmp 0x1800811f9
mov eax, dword [rsp + 0x80]
mov ecx, dword [rsp + 0x30]
add eax, ecx
mov dword [rsp + 0x80], eax
test rsi, rsi
jne 0x180081089
test ecx, ecx
je 0x180081204
cmp ebx, eax
ja 0x180081180
xor eax, eax
jmp 0x18008112c
mov eax, 0xffffff90
jmp 0x18008112c
Function at 0x1800815c0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x1050
call fcn.18008c1c0
sub rsp, rax
mov rbx, rdx
mov rdi, rcx
call fcn.180081520
mov rcx, rdi
test al, al
je 0x180081605
lea r8, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3win_fs_win.cpp
mov rdx, rbx
call sym.VBoxRT.dll_RTStrToUtf16Tag
mov rbx, qword [rsp + 0x1070]
add rsp, 0x1050
pop rdi
ret
lea rdx, [rsp + 0x40]
mov r8d, 0x1004
call sym.VBoxRT.dll_RTPathAbs
test eax, eax
js 0x180081750
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
movzx eax, byte [rsp + rcx + 0x3e]
cmp al, 0x5c
je 0x180081663
cmp al, 0x2f
je 0x180081663
cmp rcx, 0x1004
jb 0x180081659
mov eax, 0xffffff88
mov rbx, qword [rsp + 0x1070]
add rsp, 0x1050
pop rdi
ret
mov byte [rsp + rcx + 0x3f], 0x5c
mov byte [rsp + rcx + 0x40], 0
lea r8, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3win_fs_win.cpp
lea rcx, [rsp + 0x40]
mov rdx, rbx
call sym.VBoxRT.dll_RTStrToUtf16Tag
test eax, eax
jns 0x180081697
mov ecx, 0xffffff88
cmp eax, 0xffffffd7
cmove eax, ecx
mov rbx, qword [rsp + 0x1070]
add rsp, 0x1050
pop rdi
ret
mov qword [rsp + 0x1060], rbp
xor ebp, ebp
mov qword [rsp + 0x1068], rsi
mov rsi, qword [rbx]
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x18008173e
mov rcx, rsi
call sym.VBoxRT.dll_RTUtf16Len
lea rbx, [rsi + 4]
lea rdi, [rsi + rax*2]
cmp rdi, rbx
jbe 0x180081709
nop dword [rax]
movzx eax, word [rdi - 2]
sub rdi, 2
cmp ax, 0x5c
je 0x18008170d
cmp ax, 0x2f
je 0x18008170d
cmp rdi, rbx
ja 0x1800816f0
sub rdi, 2
cmp rdi, rbx
jb 0x180081761
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x28], rbp
mov word [rdi + 2], bp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1800816e4
xor eax, eax
mov rbp, qword [rsp + 0x1060]
mov rsi, qword [rsp + 0x1068]
mov rbx, qword [rsp + 0x1070]
add rsp, 0x1050
pop rdi
ret
mov eax, 0xffffff1f
jmp 0x180081740