joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022f30
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, rcx
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.1400417f0
mov ebx, eax
test eax, eax
js 0x140022f76
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140022f6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001ee80
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call fcn.1400417e0
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140022fe0
Capabilities:
Clear file content

Disassembly:
mov rax, r8
mov r10, rdx
mov r8, rcx
mov rdx, rax
mov rcx, r10
xor r9d, r9d
jmp fcn.140023030

Function at 0x140023000
Capabilities:
Clear file content

Disassembly:
lea rax, [rdx - 1]
cmp rax, 2
jbe 0x140023010
mov eax, 0xfffffffe
ret
mov r8, rcx
or rdx, 0x780
lea rcx, [0x140064cb0]
xor r9d, r9d
jmp fcn.140023030
Function at 0x1400237d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r9
mov rdi, r8
mov r15, rdx
mov rbp, rcx
test r8, r8
jne 0x14002380e
test r9, r9
je 0x14002396f
xor esi, esi
mov qword [r9], rsi
xor eax, eax
jmp 0x140023978
mov eax, edi
cmp rax, rdi
jne 0x140023973
xor esi, esi
lea r9, [rsp + 0x70]
mov rax, 0xffffffffffffffff
mov dword [rsp + 0x70], esi
cmp rbp, rax
mov qword [rsp + 0x20], rsi
cmove rbp, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400238c9
test r14, r14
je 0x14002385b
mov eax, dword [rsp + 0x70]
mov qword [r14], rax
xor eax, eax
jmp 0x140023978
mov eax, dword [rsp + 0x70]
cmp edi, eax
jbe 0x14002396f
nop word [rax + rax]
mov r8d, edi
mov edx, eax
sub r8d, eax
mov dword [rsp + 0x30], esi
add rdx, r15
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400238b7
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x140023963
mov eax, dword [rsp + 0x70]
add eax, ecx
mov dword [rsp + 0x70], eax
cmp edi, eax
ja 0x140023870
xor eax, eax
jmp 0x140023978
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001ee80
jmp 0x140023978
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x1400238bd
mov eax, edi
mov ebx, 0x4000
shr eax, 1
cmp eax, ebx
ja 0x1400238ed
lea ebx, [rax + 0xff]
and ebx, 0xffffff00
mov ecx, esi
mov dword [rsp + 0x70], ecx
test edi, edi
je 0x14002396f
nop word [rax + rax]
mov edx, ecx
lea r9, [rsp + 0x30]
mov eax, edi
mov dword [rsp + 0x30], esi
sub eax, ecx
mov qword [rsp + 0x20], rsi
add rdx, r15
mov r8d, ebx
cmp ebx, eax
mov rcx, rbp
cmova r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140023944
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x1400238bd
cmp ebx, eax
jbe 0x1400238bd
mov ecx, dword [rsp + 0x70]
shr ebx, 1
jmp 0x14002395b
mov ecx, dword [rsp + 0x70]
mov edx, dword [rsp + 0x30]
add ecx, edx
mov dword [rsp + 0x70], ecx
test r14, r14
jne 0x14002396a
test edx, edx
je 0x140023963
cmp edi, ecx
ja 0x140023900
xor eax, eax
jmp 0x140023978
mov eax, 0xffffff92
jmp 0x140023978
mov eax, ecx
mov qword [r14], rax
xor eax, eax
jmp 0x140023978
mov eax, 0xffffffc9
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1400239a0
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov eax, r9d
mov rbx, r9
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
cmp rax, r9
jne 0x140023b0a
mov dword [rsp + 0x48], edi
lea r9, [r11 + 0x20]
mov rax, rdx
mov qword [r11 + 8], r14
sar rax, 0x20
xor r14d, r14d
mov dword [rsp + 0x4c], eax
mov r8d, ebx
mov rax, 0xffffffffffffffff
mov qword [r11 - 0x28], r14
cmp rcx, rax
mov qword [r11 - 0x40], r14
mov rdx, rbp
mov qword [r11 - 0x38], r14
cmove rsi, rax
mov dword [r11 + 0x20], r14d
lea rax, [r11 - 0x40]
mov rcx, rsi
mov qword [r11 - 0x58], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140023aeb
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x140023a3b
mov eax, dword [rsp + 0x98]
mov qword [rcx], rax
xor eax, eax
jmp 0x140023ac4
mov edx, dword [rsp + 0x98]
cmp ebx, edx
jbe 0x140023b06
nop word [rax + rax]
mov ecx, edx
lea eax, [rdi + rdx]
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x30]
mov r8d, ebx
mov qword [rsp + 0x50], r14
sub r8d, edx
mov qword [rsp + 0x38], r14
lea rax, [rcx + rdi]
mov qword [rsp + 0x40], r14
sar rax, 0x20
lea rdx, [rcx + rbp]
mov dword [rsp + 0x4c], eax
mov rcx, rsi
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140023adc
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140023abf
mov edx, dword [rsp + 0x98]
add edx, eax
mov dword [rsp + 0x98], edx
cmp ebx, edx
ja 0x140023a50
xor eax, eax
jmp 0x140023ac4
mov eax, 0xffffff92
mov r14, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001ee80
jmp 0x140023ac4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x140023ae2
cmp eax, 0x26
jne 0x140023ae2
mov qword [rcx], r14
xor eax, eax
jmp 0x140023ac4
mov rbx, qword [rsp + 0x88]
mov eax, 0xffffffc9
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140023ee0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, r9
mov rbx, r8
mov r12, rdx
mov r14, rcx
test r8, r8
je 0x140023f62
mov edi, ebx
cmp rdi, rbx
jne 0x14002412a
xor r13d, r13d
lea r9, [r11 + 0x18]
mov rax, 0xffffffffffffffff
mov dword [r11 + 0x18], r13d
cmp rcx, rax
mov qword [r11 - 0x48], r13
mov r15, rcx
cmove r15, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140024014
test rsi, rsi
je 0x140023f84
cmp dword [rsp + 0x80], ebx
cmovbe ebx, dword [rsp + 0x80]
mov eax, ebx
mov qword [rsi], rax
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, dword [rsp + 0x80]
cmp eax, ebx
jae 0x140023f62
nop
mov r8d, ebx
mov edx, eax
sub r8d, eax
mov dword [rsp + 0x30], r13d
add rdx, r12
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140023fd9
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x1400240eb
mov eax, dword [rsp + 0x80]
add eax, ecx
mov dword [rsp + 0x80], eax
cmp eax, ebx
jb 0x140023f90
jmp 0x140023f62
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001ee80
cmp eax, 0xffffff68
jne 0x140023f64
mov rcx, r14
call fcn.1400323c0
mov ecx, dword [rsp + 0x80]
sub rdi, rcx
mov rcx, r14
lea rdx, [rdi + rax]
call fcn.140022e30
jmp 0x140023f64
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x1400240ff
mov eax, ebx
mov edi, 0x8000
shr eax, 1
cmp eax, edi
ja 0x14002403c
lea edi, [rax + 0xff]
and edi, 0xffffff00
mov ecx, r13d
mov dword [rsp + 0x80], ecx
test ebx, ebx
je 0x140023f62
nop
mov edx, ecx
lea r9, [rsp + 0x30]
mov eax, ebx
mov dword [rsp + 0x30], r13d
sub eax, ecx
mov qword [rsp + 0x20], r13
cmp edi, eax
mov ebp, edi
mov rcx, r15
cmova ebp, eax
add rdx, r12
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140024099
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x1400240bf
cmp edi, eax
jbe 0x1400240bf
mov ecx, dword [rsp + 0x80]
shr edi, 1
jmp 0x1400240b6
mov ecx, dword [rsp + 0x80]
mov edx, dword [rsp + 0x30]
add ecx, edx
mov dword [rsp + 0x80], ecx
test rsi, rsi
jne 0x1400240f5
test edx, edx
je 0x1400240eb
cmp ecx, ebx
jb 0x140024050
jmp 0x140023f62
mov ecx, eax
call fcn.14001ee80
cmp eax, 0xffffff68
jne 0x140023f64
mov rcx, r14
call fcn.1400323c0
mov edx, ebp
mov rcx, r14
add rdx, rax
call fcn.140022e30
jmp 0x140023f64
mov eax, 0xffffff90
jmp 0x140023f64
cmp ecx, ebx
cmovbe ebx, ecx
jmp 0x140023f5d
mov ecx, eax
call fcn.14001ee80
cmp eax, 0xffffff68
jne 0x140023f64
mov rcx, r14
call fcn.1400323c0
mov rcx, r14
lea rdx, [rdi + rax]
call fcn.140022e30
jmp 0x140023f64
mov eax, 0xffffffc9
jmp 0x140023f64
Function at 0x140024140
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov r14d, r9d
mov rbx, r9
mov r15, r8
mov rdi, rdx
mov rsi, rcx
cmp r14, r9
jne 0x1400242b3
mov qword [r11 + 8], rbp
lea r9, [r11 + 0x20]
mov dword [rsp + 0x48], edi
mov rax, rdx
sar rax, 0x20
mov rbp, rcx
mov dword [rsp + 0x4c], eax
mov r8d, ebx
mov rax, 0xffffffffffffffff
mov qword [r11 + 0x10], r12
xor r12d, r12d
mov rdx, r15
cmp rcx, rax
mov qword [r11 - 0x38], r12
mov qword [r11 - 0x50], r12
cmove rbp, rax
mov qword [r11 - 0x48], r12
lea rax, [r11 - 0x50]
mov dword [r11 + 0x20], r12d
mov rcx, rbp
mov qword [r11 - 0x68], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002428a
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x140024203
cmp dword [rsp + 0xa8], ebx
cmovbe ebx, dword [rsp + 0xa8]
mov eax, ebx
mov qword [rcx], rax
xor eax, eax
mov rbp, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov edx, dword [rsp + 0xa8]
cmp edx, ebx
jae 0x1400241e5
nop
mov ecx, edx
lea eax, [rdi + rdx]
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x30]
mov r8d, ebx
mov qword [rsp + 0x50], r12
sub r8d, edx
mov qword [rsp + 0x38], r12
lea rax, [rcx + rdi]
mov qword [rsp + 0x40], r12
sar rax, 0x20
lea rdx, [rcx + r15]
mov dword [rsp + 0x4c], eax
mov rcx, rbp
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002428a
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140024280
mov edx, dword [rsp + 0xa8]
add edx, eax
mov dword [rsp + 0xa8], edx
cmp edx, ebx
jb 0x140024210
jmp 0x1400241e5
mov eax, 0xffffff90
jmp 0x1400241e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001ee80
cmp eax, 0xffffff68
jne 0x1400241e7
lea rdx, [r14 + rdi]
mov rcx, rsi
call fcn.140022e30
jmp 0x1400241e7
mov eax, 0xffffffc9
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140025dc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp rcx, 0x1000
jb 0x140025e22
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x140025e22
cmp byte [rcx], 0
je 0x140025e22
mov rdx, rcx
xor r8d, r8d
lea rcx, [rsp + 0x30]
call fcn.1400417f0
test eax, eax
js 0x140025e22
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call fcn.1400417e0
cmp ebx, 0xffffffff
mov rbx, qword [rsp + 0x20]
je 0x140025e22
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x140025e30
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x4070
call fcn.140001110
sub rsp, rax
mov rax, qword [0x1400a0f20]
xor rax, rsp
mov qword [rsp + 0x4060], rax
mov qword [rsp + 0x30], rcx
mov rbx, rdx
test rdx, rdx
je 0x140025ef5
lea rdx, [rsp + 0x2050]
mov ecx, 0x1004
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140025ee6
xor r9d, r9d
lea r8, [rsp + 0x40]
mov edx, 0x1004
lea rcx, [rsp + 0x2050]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x140025ee6
cmp word [rsp + 0x42], 0x3a
jne 0x140025eb6
movzx ecx, word [rsp + 0x40]
lea eax, [rcx - 0x61]
cmp eax, 0x1a
jae 0x140025eb6
sub cx, 0x20
mov word [rsp + 0x40], cx
lea rax, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntime_r3winpath_win.cpp
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x30]
mov rdx, 0xffffffffffffffff
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call fcn.140035c80
jmp 0x140025efa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001ee80
jmp 0x140025efa
mov eax, 0xffffffd7
mov rcx, qword [rsp + 0x4060]
xor rcx, rsp
call fcn.140001250
add rsp, 0x4070
pop rbx
ret

Function at 0x140025ff0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, r8d
mov rdi, rdx
cmp rcx, 0x1000
jb 0x1400260e9
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x1400260e9
cmp rdx, 0x1000
jb 0x1400260e9
test rax, rdx
jne 0x1400260e9
cmp byte [rcx], 0
je 0x1400260d9
cmp byte [rdx], 0
je 0x1400260d9
test r8d, 0xfffffffe
jne 0x1400260d9
mov rdx, rcx
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x48]
xor r8d, r8d
call fcn.1400417f0
mov ebx, eax
test eax, eax
js 0x1400260c7
xor r8d, r8d
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.1400417f0
mov ebx, eax
test eax, eax
js 0x1400260bd
mov rdx, qword [rsp + 0x30]
and esi, 1
mov rcx, qword [rsp + 0x48]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1400260a4
xor ebx, ebx
jmp 0x1400260b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001ee80
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call fcn.1400417e0
mov rcx, qword [rsp + 0x48]
call fcn.1400417e0
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, 0xfffffffe
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x40]
mov eax, 0xfffffffa
add rsp, 0x20
pop rdi
ret
Function at 0x140026220
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push rdi
mov eax, 0x2070
call fcn.140001110
sub rsp, rax
mov rax, qword [0x1400a0f20]
xor rax, rsp
mov qword [rsp + 0x2060], rax
mov qword [rsp + 0x40], rcx
mov rdi, rdx
cmp rcx, 0x1000
jb 0x1400263e2
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x1400263e2
test rdx, rdx
je 0x1400263db
mov qword [rsp + 0x2090], rbx
lea r8, [rsp + 0x30]
mov dl, 1
lea rcx, str.Shell32.dll
xor bl, bl
call fcn.14001fa90
test eax, eax
js 0x1400262f9
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str.SHGetFolderPathW
call fcn.140036180
test eax, eax
js 0x1400262d3
xor r9d, r9d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rax, qword [rsp + 0x38]
xor ecx, ecx
lea edx, [r9 + 0x28]
call qword [case.0x14004be35.0]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x30]
call fcn.140036070
test bl, bl
je 0x1400262f9
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400262f9
test al, 0x10
jne 0x140026385
mov ebx, 0x1004
lea rdx, [rsp + 0x50]
mov r8d, ebx
lea rcx, [0x140064e98]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14002632b
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14002632b
test al, 0x10
jne 0x140026385
mov r8d, ebx
lea rdx, [rsp + 0x50]
lea rcx, str.HOMEDRIVE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400263d4
lea rcx, [rsp + 0x50]
call fcn.140035bb0
sub ebx, eax
lea rdx, [rsp + 0x50]
mov r8d, ebx
lea rcx, str.HOMEPATH
lea rdx, [rdx + rax*2]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400263d4
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400263d4
test al, 0x10
je 0x1400263d4
lea rax, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntime_r3winpath_win.cpp
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
mov rdx, 0xffffffffffffffff
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x50]
call fcn.140035c80
mov rbx, qword [rsp + 0x2090]
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.140001250
add rsp, 0x2070
pop rdi
ret
mov eax, 0xffffff99
jmp 0x1400263b3
mov eax, 0xfffffffe
jmp 0x1400263bb
mov eax, 0xfffffffa
jmp 0x1400263bb
Function at 0x140027b10
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
push r12
push r14
sub rsp, 0x40
xor eax, eax
mov dword [rsp + 0x30], 0xc0000365
mov r14, r8
mov dword [rsp + 0x34], eax
mov rbx, r9
mov qword [rsp + 0x38], 0xffffffffffffffd5
mov rdi, rdx
mov dword [rsp + 0x20], 0x12
mov r8, rdx
lea r9d, [rax + 0x68]
lea rdx, [rsp + 0x30]
mov rbp, rcx
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov r12d, 0x80000000
lea ecx, [rax + r12]
test r12d, ecx
jne 0x140027b82
cmp eax, 0x80000005
je 0x140027b82
mov ecx, eax
call fcn.1400392e0
jmp 0x140027ca4
mov rax, qword [rdi + 0x30]
movabs rcx, 0x5e6684f4b3960000
mov qword [rbx], rax
mov rax, qword [rdi + 0x28]
mov qword [rbx + 8], rax
imul rax, qword [rdi], 0x64
mov qword [rsp + 0x60], rsi
mov rsi, qword [rsp + 0x88]
add rax, rcx
mov qword [rbx + 0x28], rax
imul rax, qword [rdi + 8], 0x64
mov qword [rsp + 0x68], r15
xor r15d, r15d
add rax, rcx
mov qword [rbx + 0x10], rax
imul rax, qword [rdi + 0x10], 0x64
add rax, rcx
mov qword [rbx + 0x18], rax
imul rax, qword [rdi + 0x18], 0x64
add rax, rcx
mov qword [rbx + 0x20], rax
test rsi, rsi
je 0x140027bee
mov rcx, rsi
call sym.NetMonitor.exe_nocrt_strlen
jmp 0x140027bf1
mov rax, r15
mov ecx, dword [rdi + 0x20]
mov r8, rax
mov r9d, dword [rsp + 0x90]
and ecx, 0x7fff
shl ecx, 0x10
mov rdx, rsi
mov dword [rsp + 0x20], r15d
call fcn.1400419b0
mov esi, dword [rsp + 0x80]
mov dword [rbx + 0x30], eax
mov dword [rbx + 0x34], esi
cmp esi, 2
jne 0x140027c8d
mov ecx, 1
mov qword [rbx + 0x38], 0xffffffffffffffff
mov eax, dword [rdi + 0x38]
lea rdx, [rsp + 0x30]
cmp eax, ecx
mov dword [rbx + 0x44], r15d
mov dword [rsp + 0x20], ecx
mov r8, rdi
cmovbe eax, ecx
mov rcx, rbp
mov dword [rbx + 0x40], eax
mov rax, qword [rdi + 0x40]
mov qword [rbx + 0x48], rax
mov eax, 0x800
cmp r14, rax
mov qword [rbx + 0x50], r15
mov dword [rbx + 0x58], r15d
cmovbe eax, r14d
mov r9d, eax
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
lea ecx, [rax + r12]
test r12d, ecx
jne 0x140027c87
cmp eax, 0x80000005
jne 0x140027c8d
mov eax, dword [rdi + 8]
mov dword [rbx + 0x44], eax
mov r8d, esi
mov rdx, rbx
xor ecx, ecx
call fcn.140027560
mov r15, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r12
pop rdi
ret
Function at 0x1400294a0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x20
mov rbx, qword gs:[0x60]
mov r12, rcx
call qword [sym.imp.ntdll.dll_RtlAcquirePebLock]
mov rdi, qword [rbx + 0x20]
xor r15d, r15d
mov esi, r15d
test rdi, rdi
je 0x14002950b
mov rdi, qword [rdi + 0x80]
test rdi, rdi
je 0x14002950e
mov rbx, rdi
cmp word [rdi], r15w
je 0x14002950e
nop
mov rcx, rbx
inc rsi
call fcn.140035bb0
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], r15w
jne 0x1400294f0
jmp 0x14002950e
mov rdi, r15
lea rdx, [0x140054850]
mov qword [rsp + 0x40], r14
mov ecx, 0x30
lea rbp, [rsi + 1]
call fcn.14001ed20
mov rbx, rax
test rax, rax
je 0x14002963e
mov ecx, 0x10
mov dword [rax], 0x19571010
cmp rbp, rcx
mov word [rax + 4], 0x100
lea rax, [fcn.140017d40]
mov qword [rbx + 0x20], r15
cmovae rcx, rbp
mov qword [rbx + 0x28], rax
add rcx, 0xf
mov qword [rbx + 8], r15
and rcx, 0xfffffffffffffff0
lea rdx, [0x140054850]
mov qword [rbx + 0x10], rcx
lea rcx, [rcx*8]
call fcn.14001ed50
mov qword [rbx + 0x18], rax
test rax, rax
je 0x140029636
mov rbp, r15
test rsi, rsi
je 0x140029609
cmp word [rdi], r15w
je 0x140029609
mov rax, qword [rbx + 0x18]
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntimegenericenv_generic.cpp
mov rcx, rdi
lea rdx, [rax + rbp*8]
call fcn.140035d70
mov r14d, eax
test eax, eax
js 0x14002961b
mov rcx, qword [rbx + 0x18]
mov edx, 0x3d
mov rcx, qword [rcx + rbp*8]
call sym.NetMonitor.exe_nocrt_strchr
test rax, rax
jne 0x1400295f1
mov rax, qword [rbx + 0x18]
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxRuntimegenericenv_generic.cpp
lea rdx, [0x1400695f4]
lea rcx, [rax + rbp*8]
call fcn.140017410
mov r14d, eax
test eax, eax
js 0x14002961b
mov rcx, rdi
inc rbp
call fcn.140035bb0
lea rdi, [rdi + rax*2]
add rdi, 2
cmp rbp, rsi
jb 0x140029594
mov rax, qword [rbx + 0x18]
mov qword [rbx + 8], rbp
mov qword [rax + rbp*8], r15
mov qword [r12], rbx
jmp 0x140029644
lea rax, [rbp + 1]
mov qword [rbx + 8], rax
call qword [sym.imp.ntdll.dll_RtlReleasePebLock]
mov rcx, rbx
call fcn.140029f00
mov eax, r14d
jmp 0x14002964d
mov rcx, rbx
call fcn.14001ed80
mov r15d, 0xfffffff8
call qword [sym.imp.ntdll.dll_RtlReleasePebLock]
mov eax, r15d
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r12
pop rdi
ret
Function at 0x14002b630
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400a0f20]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor ebx, ebx
mov ebp, edx
mov rdi, rcx
cmp byte [rcx + 0x14], bl
jne 0x14002b6c5
movzx eax, byte [rcx + 0x12]
cmp byte [rcx + 0x10], bl
je 0x14002b6cf
test al, al
jne 0x14002b766
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x14002b6b6
test bpl, 1
je 0x14002b766
cmp dword [rsp + 0x30], ebx
jbe 0x14002b766
mov ebx, 1
jmp 0x14002b766
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x14002b6c5
mov byte [rdi + 0x14], 1
mov ebx, 4
jmp 0x14002b766
mov esi, 4
test al, al
je 0x14002b6e3
call fcn.14002b790
cmp byte [rdi + 0x14], bl
cmovne ebx, esi
cmp byte [rdi + 0x12], 0
jne 0x14002b766
test ebx, ebx
jne 0x14002b766
xor edx, edx
lea r8d, [rbx + 0x10]
lea rcx, [rsp + 0x38]
call sym.NetMonitor.exe_nocrt_memset
xor edx, edx
lea r8d, [rbx + 0x28]
lea rcx, [rsp + 0x48]
call sym.NetMonitor.exe_nocrt_memset
mov rcx, qword [rdi + 8]
lea r9d, [rbx + 0x28]
lea r8, [rsp + 0x48]
mov dword [rsp + 0x20], 0x18
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x14002b75a
cmp dword [rsp + 0x68], esi
jne 0x14002b73f
mov ebx, esi
mov byte [rdi + 0x14], 1
jmp 0x14002b766
test bpl, 2
je 0x14002b766
cmp dword [rsp + 0x64], 0
ja 0x14002b753
cmp dword [rsp + 0x60], 0
jne 0x14002b766
mov ebx, 2
jmp 0x14002b766
test bpl, 2
mov eax, 2
cmovne ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140001250
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret