joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002c00
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14013c170]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [0x14013e6b0]
xor r12d, r12d
xor edx, edx
mov r8d, 0x600
mov edi, r12d
call fcn.140005bc0
lea r8, str.CustomMode_dWidth
lea edx, [r12 + 0x14]
lea rcx, [rbp - 0x28]
xor r9d, r9d
mov dword [rbp - 0x38], r12d
mov dword [rbp - 0x40], 4
call sym.VBoxControl.exe_RTStrPrintf
lea r11, [rbp - 0x40]
lea rax, [rbp - 0x34]
mov qword [rsp + 0x28], r11
lea r9, [rbp - 0x3c]
lea rdx, [rbp - 0x28]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140002dc5
mov qword [rsp + 0x98], rbx
lea rbx, [0x14013e6b4]
nop dword [rax + rax]
lea r8, str.CustomMode_dHeight
lea rcx, [rbp - 0x28]
mov r9d, edi
mov edx, 0x14
call sym.VBoxControl.exe_RTStrPrintf
lea r11, [rbp - 0x40]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], r11
lea r9, [rbp - 0x3c]
lea rdx, [rbp - 0x28]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140002dbd
lea r8, str.CustomMode_dBPP
lea edx, [rax + 0x14]
lea rcx, [rbp - 0x28]
mov r9d, edi
call sym.VBoxControl.exe_RTStrPrintf
lea r11, [rbp - 0x40]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], r11
lea r9, [rbp - 0x3c]
lea rdx, [rbp - 0x28]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140002dbd
mov ecx, dword [rbp - 0x34]
cmp ecx, 0x10000
ja 0x140002dbd
mov edx, dword [rbp - 0x30]
cmp edx, 0x10000
ja 0x140002dbd
mov eax, dword [rbp - 0x38]
cmp eax, 0x10
je 0x140002d56
cmp eax, 0x18
je 0x140002d56
cmp eax, 0x20
jne 0x140002dbd
inc edi
mov dword [rbx - 4], ecx
mov dword [rbx], edx
mov dword [rbx + 4], eax
add rbx, 0xc
cmp edi, 0x80
jge 0x140002dbd
lea r8, str.CustomMode_dWidth
lea rcx, [rbp - 0x28]
mov r9d, edi
mov edx, 0x14
mov dword [rbp - 0x38], r12d
mov dword [rbp - 0x40], 4
call sym.VBoxControl.exe_RTStrPrintf
lea r11, [rbp - 0x40]
lea rax, [rbp - 0x34]
mov qword [rsp + 0x28], r11
lea r9, [rbp - 0x3c]
lea rdx, [rbp - 0x28]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x140002ca0
mov rbx, qword [rsp + 0x98]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400057e0
mov rsi, qword [rsp + 0xa0]
add rsp, 0x70
pop r12
pop rdi
pop rbp
ret
Function at 0x140002df0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14013c170]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
mov r13, rcx
mov r14d, edi
mov ebx, edi
nop word [rax + rax]
lea r8, str.CustomMode_dWidth
lea rcx, [rsp + 0x30]
mov r9d, ebx
mov edx, 0x14
call sym.VBoxControl.exe_RTStrPrintf
lea rdx, [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea r8, str.CustomMode_dHeight
lea rcx, [rsp + 0x30]
mov r9d, ebx
mov edx, 0x14
call sym.VBoxControl.exe_RTStrPrintf
lea rdx, [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea r8, str.CustomMode_dBPP
lea rcx, [rsp + 0x30]
mov r9d, ebx
mov edx, 0x14
call sym.VBoxControl.exe_RTStrPrintf
lea rdx, [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc ebx
cmp ebx, 0x80
jl 0x140002e30
lea r15, [0x14013e6b0]
lea r12, [0x14013e6b8]
lea rbp, [0x14013e6b4]
mov rsi, r15
nop word [rax + rax]
mov r8d, dword [rsi]
test r8d, r8d
je 0x140002fd7
mov r9d, dword [rbp]
test r9d, r9d
je 0x140002fd7
mov eax, dword [r12]
test eax, eax
je 0x140002fd7
lea rcx, str.writing_mode__d___dx_dx_d__n
mov edx, r14d
mov dword [rsp + 0x20], eax
call sym.VBoxControl.exe_RTPrintf
lea r8, str.CustomMode_dWidth
lea rcx, [rsp + 0x30]
mov r9d, r14d
mov edx, 0x14
call sym.VBoxControl.exe_RTStrPrintf
movsxd r11, edi
lea rdx, [rsp + 0x30]
lea rbx, [r11 + r11*2]
mov r9d, 4
xor r8d, r8d
lea rax, [r15 + rbx*4]
mov rcx, r13
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea r8, str.CustomMode_dHeight
lea rcx, [rsp + 0x30]
mov r9d, r14d
mov edx, 0x14
call sym.VBoxControl.exe_RTStrPrintf
lea rax, [r15 + rbx*4 + 4]
lea rdx, [rsp + 0x30]
mov r9d, 4
xor r8d, r8d
mov rcx, r13
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea r8, str.CustomMode_dBPP
lea rcx, [rsp + 0x30]
mov r9d, r14d
mov edx, 0x14
call sym.VBoxControl.exe_RTStrPrintf
lea rax, [r15 + rbx*4 + 8]
lea rdx, [rsp + 0x30]
mov r9d, 4
xor r8d, r8d
mov rcx, r13
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc r14d
inc edi
add rsi, 0xc
add rbp, 0xc
add r12, 0xc
cmp edi, 0x80
jl 0x140002ed0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400057e0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000612b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14013c170]
jne 0x1400057fa
rol rcx, 0x10
test cx, 0xffff
jne 0x1400057f6
repz ret
ror rcx, 0x10
jmp 0x140006084
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14013ed70]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14013ee68]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140006109
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14013ed70]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000612b
mov rax, qword [rsp + 0x88]
mov qword [0x14013ee68], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14013ee08], rax
mov rax, qword [0x14013ee68]
mov qword [0x14013ece0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14013edf0], rax
mov dword [0x14013ecd0], 0xc0000409
mov dword [0x14013ecd4], 1
mov rax, qword [0x14013c170]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14013c178]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14013ed68], eax
mov ecx, 1
call fcn.1400099c0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14004c4a0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14013ed68], 0
jne 0x1400061b2
mov ecx, 1
call fcn.1400099c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x140008984
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400087f4
Function at 0x14000d944
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14013c170]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140007030
xor ebx, ebx
cmp qword [0x14013fc98], rbx
mov rdi, rax
jne 0x14000da57
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14000db2e
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000db2e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14013fc98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14013fca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14013fca8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14013fcb8], rax
test rax, rax
je 0x14000da4e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14013fcb0], rax
jmp 0x14000da5e
mov rax, qword [0x14013fcb0]
jmp 0x14000da65
mov rax, qword [0x14013fcb0]
mov r11, qword [0x14013fcb8]
cmp rax, rdi
je 0x14000dacc
cmp r11, rdi
je 0x14000dacc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14013fcb8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14000dacc
test rax, rax
je 0x14000dacc
call rsi
test rax, rax
je 0x14000dac6
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000dac6
test byte [rsp + 0x40], 1
jne 0x14000dacc
bts ebp, 0x15
jmp 0x14000db0c
mov rcx, qword [0x14013fca0]
cmp rcx, rdi
je 0x14000db0c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000db0c
call rax
mov rbx, rax
test rax, rax
je 0x14000db0c
mov rcx, qword [0x14013fca8]
cmp rcx, rdi
je 0x14000db0c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000db0c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14013fc98]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000db2e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14000db30
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400057e0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000efb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rax, [rcx + 0x1000]
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
cmp rax, 0x2000
jb 0x14000f0b4
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x14000f0b4
cmp dword [rcx], 0xe44e44ee
jne 0x14000f0b4
mov edx, dword [rcx + 4]
test edx, edx
js 0x14000f0b0
cmp byte [rcx + 0x12], 0
je 0x14000f018
call fcn.14000ef30
mov r9, qword [rbx + 8]
mov rcx, rbp
test rdi, rdi
je 0x14000f064
mov r8, rsi
mov edx, 1
call fcn.140043f30
mov qword [rdi], rax
cmp rax, rsi
je 0x14000f060
mov rcx, qword [rbx + 8]
call fcn.140043c28
test eax, eax
je 0x14000f060
mov rcx, qword [rbx + 8]
call fcn.140043c00
test eax, eax
je 0x14000f093
cmp qword [rdi], 0
je 0x14000f085
mov eax, WSAGetLastError
jmp 0x14000f0b9
xor eax, eax
jmp 0x14000f0b9
mov r8d, 1
mov rdx, rsi
call fcn.140043f30
cmp rax, 1
je 0x14000f060
mov rcx, qword [rbx + 8]
call fcn.140043c00
test eax, eax
je 0x14000f093
mov edx, 0xffffff92
mov ecx, edx
mov eax, edx
xchg dword [rbx + 4], ecx
jmp 0x14000f0b9
mov rcx, qword [rbx + 8]
call fcn.140043c28
mov ecx, 0xffffff91
mov edx, 0xffffff1f
test eax, eax
cmovne edx, ecx
mov ecx, edx
xchg dword [rbx + 4], ecx
mov eax, edx
jmp 0x14000f0b9
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000f580
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
lea rax, [rcx + 0x1000]
mov rbx, rcx
cmp rax, 0x2000
jb 0x14000f621
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x14000f621
cmp dword [rcx], 0xe44e44ee
jne 0x14000f621
mov eax, dword [rcx + 4]
test eax, eax
js 0x14000f621
cmp byte [rcx + 0x12], 0
je 0x14000f5c5
call fcn.14000ef30
mov r9, qword [rbx + 8]
mov edx, 1
lea rcx, [rsp + 0x30]
mov r8d, edx
call fcn.140043f30
cmp rax, 1
je 0x14000f616
mov rcx, qword [rbx + 8]
call fcn.140043c00
test eax, eax
je 0x14000f5f5
mov ecx, 0xffffff92
jmp 0x14000f60d
mov rcx, qword [rbx + 8]
call fcn.140043c28
mov ecx, 0xffffff1f
mov edx, 0xffffff91
test eax, eax
cmovne ecx, edx
mov eax, ecx
xchg dword [rbx + 4], eax
test ecx, ecx
js 0x14000f621
movzx eax, byte [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
Function at 0x140013ec0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, r8
movsxd rsi, edx
test edx, edx
je 0x140014073
mov eax, dword [0x14013d0d0]
mov r12, qword [r8]
cmp eax, 0xffffffff
je 0x140013f13
cmp eax, esi
jne 0x140013f09
cmp qword [0x14013fd68], r12
je 0x140014073
mov eax, 0xffffffea
jmp 0x140014075
test cl, 8
jne 0x14001405f
lea eax, [rsi + 1]
lea rdx, str.D:_tinderbox_add_5.2_srcVBoxRuntime_r3init.cpp
movsxd rcx, eax
shl rcx, 3
call sym.VBoxControl.exe_RTMemAllocZTag
mov rdi, rax
test rax, rax
jne 0x140013f42
lea eax, [rdi - 8]
jmp 0x140014075
cmp r12, qword [0x14013f278]
mov dword [rsp + 0x58], 0xffffffff
jne 0x140014008
cmp esi, dword [0x14013f274]
jne 0x140014008
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x58]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r13, rax
test rax, rax
je 0x140014008
xor ebp, ebp
xor ebx, ebx
test esi, esi
jle 0x140013fb8
nop dword [rax + rax]
movsxd rcx, ebp
lea r8, str.D:_tinderbox_add_5.2_srcVBoxRuntime_r3init.cpp
lea rdx, [rdi + rcx*8]
mov rcx, qword [r13 + rbx*8]
call sym.VBoxControl.exe_RTUtf16LittleToUtf8Tag
mov r14d, eax
test eax, eax
js 0x140013fd8
inc ebp
inc rbx
cmp ebp, esi
jl 0x140013f90
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi + rsi*8], 0
mov qword [0x14013fd68], rdi
mov qword [r15], rdi
jmp 0x140014066
test rbx, rbx
je 0x140013ff2
nop dword [rax]
mov rcx, qword [rdi + rbx*8 - 8]
dec rbx
call sym.VBoxControl.exe_RTStrFree
test rbx, rbx
jne 0x140013fe0
mov rcx, rdi
call sym.VBoxControl.exe_RTMemExecFree
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, r14d
jmp 0x140014075
xor ebp, ebp
xor ebx, ebx
test esi, esi
jle 0x140013fc1
mov rdx, qword [r12 + rbx*8]
movsxd rax, ebp
lea r8, str.D:_tinderbox_add_5.2_srcVBoxRuntime_r3init.cpp
lea rcx, [rdi + rax*8]
call sym.VBoxControl.exe_RTStrCurrentCPToUtf8Tag
mov r13d, eax
test eax, eax
js 0x140014039
inc ebp
inc rbx
cmp ebp, esi
jl 0x140014010
jmp 0x140013fc1
test rbx, rbx
je 0x140014052
nop
mov rcx, qword [rdi + rbx*8 - 8]
dec rbx
call sym.VBoxControl.exe_RTStrFree
test rbx, rbx
jne 0x140014040
mov rcx, rdi
call sym.VBoxControl.exe_RTMemExecFree
mov eax, r13d
jmp 0x140014075
mov qword [0x14013fd68], r12
mov dword [0x14013d0d0], esi
mov qword [0x140140d90], r12
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001e7e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, dword [rcx + 0xc000]
mov rbx, rcx
test edi, edi
je 0x14001e9cb
mov eax, dword [rcx + 0xc00c]
test al, 0x20
je 0x14001e838
mov rcx, qword [rcx + 0xc010]
test rcx, rcx
je 0x14001e838
cmp qword [rcx + 0x50], 0
je 0x14001e838
mov r8d, edi
mov rdx, rbx
call fcn.14001d780
mov dword [rbx + 0xc000], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
bt eax, 0x11
jb 0x14001e96a
cmp edi, 0xc000
jae 0x14001e84e
mov byte [rdi + rbx], 0
test dword [rbx + 0xc00c], 0x40000000
je 0x14001e865
mov rdx, rdi
mov rcx, rbx
call sym.VBoxControl.exe_RTLogWriteUser
test byte [rbx + 0xc00c], 8
je 0x14001e879
mov rdx, rdi
mov rcx, rbx
call sym.VBoxControl.exe_RTLogWriteDebugger
mov eax, dword [rbx + 0xc00c]
and al, 0x21
cmp al, 1
jne 0x14001e8d4
mov rax, qword [rbx + 0xc010]
mov rcx, qword [rax + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x14001e8c0
mov r8, rdi
xor r9d, r9d
mov rdx, rbx
call sym.VBoxControl.exe_RTFileWrite
test dword [rbx + 0xc008], 0x200
je 0x14001e8c0
mov rcx, qword [rbx + 0xc010]
mov rcx, qword [rcx + 0x68]
call sym.VBoxControl.exe_RTFileFlush
mov rcx, qword [rbx + 0xc010]
cmp dword [rcx + 0x88], 0
je 0x14001e8d4
add qword [rcx + 0x78], rdi
test byte [rbx + 0xc00c], 2
je 0x14001e8e8
mov rdx, rdi
mov rcx, rbx
call sym.VBoxControl.exe_RTLogWriteStdOut
test byte [rbx + 0xc00c], 4
je 0x14001e8fc
mov rdx, rdi
mov rcx, rbx
call sym.VBoxControl.exe_RTLogWriteStdErr
mov rax, qword [rbx + 0xc010]
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x14001e911
mov rcx, rbx
call rdx
test byte [rbx + 0xc00c], 1
mov dword [rbx + 0xc000], 0
je 0x14001e9cb
mov rax, qword [rbx + 0xc010]
cmp dword [rax + 0x88], 0
je 0x14001e9cb
call sym.VBoxControl.exe_RTTimeProgramSecTS
mov rcx, qword [rbx + 0xc010]
xor edx, edx
div dword [rcx + 0x80]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14001e3f0
mov edx, 0x6000
cmp edi, edx
jbe 0x14001e9cb
test byte [rbx + 0xc008], 0x10
je 0x14001e988
mov byte [rbx + 0x6000], 0xd
mov edx, 0x6001
mov rax, qword [str._n_DROP_DROP_DROP_]
mov ecx, edx
add edx, 0x11
mov qword [rcx + rbx], rax
mov rax, qword [0x140057598]
mov qword [rcx + rbx + 8], rax
movzx eax, byte [0x1400575a0]
mov byte [rcx + rbx + 0x10], al
test byte [rbx + 0xc008], 0x10
je 0x14001e9be
mov byte [rdx + rbx], 0xd
inc edx
lea eax, [rdx + 1]
mov byte [rdx + rbx], 0xa
mov dword [rbx + 0xc000], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140024670
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbx
sub rsp, 0x20
rdtsc
shl rdx, 0x20
xor ecx, ecx
or rax, rdx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rbx
cmp rax, 0x5dc
seta al
add rsp, 0x20
pop rbx
ret

Function at 0x140024740
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ecx, ecx
mov edx, 0xffffffe9
cmp eax, 0xffffffff
mov dword [0x14013d344], eax
cmove ecx, edx
mov eax, ecx
add rsp, 0x28
ret

Function at 0x140024770
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x14013d344]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rbx, rax
jne 0x140024798
mov ecx, dword [0x14013d344]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rbx + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x1400247b0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x30], 0xffffffffffffffff
add rsp, 0x20
pop rbx
ret

Function at 0x1400249a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov esi, 0xffffffff
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], rsi
jae 0x140024a31
mov edx, dword [rbx + 0x68]
lea rax, [rsp + 0x40]
mov qword [rcx + 0x30], 0xffffffffffffffff
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea r8, [0x1400248e0]
mov r9, rbx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x40], ecx
call fcn.1400447dc
test rax, rax
je 0x140024a15
cmp rax, rsi
je 0x140024a15
mov qword [rbx + 0x30], rax
mov eax, dword [rsp + 0x40]
mov qword [rdi], rax
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
call fcn.140007788
mov ecx, dword [rax]
call sym.VBoxControl.exe_RTErrConvertFromErrno
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, 0xfffffffe
add rsp, 0x30
pop rdi
ret

Function at 0x140024c30
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rdx, rcx
mov ecx, dword [0x14013d344]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140024c57
mov eax, 0xffffffe8
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140024c75
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rbx + 0x8c0]
mov ecx, eax
call fcn.1400247c0
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140027930
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140044474
lea r9, [rax + 0x60]
mov r8, rbx
mov edx, 1
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400440dc
Function at 0x140027970
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140044474
lea r9, [rax + 0x30]
mov r8, rbx
mov edx, 1
mov rcx, rdi
call fcn.1400440dc
call fcn.140044474
lea rcx, [rax + 0x30]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140044320
Function at 0x140027e00
Capabilities:
Clear file content
Set file attributes

Disassembly:
cmp rdx, 1
je 0x140027e18
cmp rdx, 2
je 0x140027e18
cmp rdx, 3
je 0x140027e18
mov eax, 0xfffffffe
ret
or rdx, 0x780
mov r8, rdx
lea rdx, [0x140058c2c]
jmp sym.VBoxControl.exe_RTFileOpen

Function at 0x140027e60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r12
sub rsp, 0x40
mov rsi, r9
mov rbx, r8
mov r12, rdx
mov rbp, rcx
test r8, r8
jne 0x140027e8e
xor eax, eax
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rsi
pop rbp
ret
mov eax, ebx
cmp rax, rbx
jne 0x140028029
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x68], r13
xor r13d, r13d
cmp rbp, rcx
lea r9, [rsp + 0x70]
mov dword [rsp + 0x70], r13d
cmovne rcx, rbp
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140027f4c
test rsi, rsi
je 0x140027edc
mov eax, dword [rsp + 0x70]
mov qword [rsi], rax
xor eax, eax
jmp 0x140028008
mov eax, dword [rsp + 0x70]
cmp ebx, eax
jbe 0x140027ed5
or rcx, 0xffffffffffffffff
mov r8d, ebx
mov edx, eax
cmp rbp, rcx
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
cmovne rcx, rbp
sub r8d, eax
add rdx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140027f3a
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x140027f30
mov eax, dword [rsp + 0x70]
add eax, ecx
mov dword [rsp + 0x70], eax
cmp ebx, eax
ja 0x140027ee4
xor eax, eax
jmp 0x140028008
mov eax, 0xffffff92
jmp 0x140028008
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.VBoxControl.exe_RTErrConvertFromWin32
jmp 0x140028008
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x140027f40
mov eax, ebx
mov qword [rsp + 0x60], rdi
mov edi, 0x4000
shr eax, 1
cmp eax, edi
ja 0x140027f75
lea edi, [rax + 0xff]
and edi, 0xffffff00
mov eax, r13d
mov dword [rsp + 0x70], eax
test ebx, ebx
je 0x140028025
nop word [rax + rax]
mov r8d, ebx
mov edx, eax
lea r9, [rsp + 0x30]
sub r8d, eax
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x20], r13
cmp edi, r8d
cmovbe r8d, edi
or rcx, 0xffffffffffffffff
cmp rbp, rcx
cmovne rcx, rbp
add rdx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140027fdd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x140027ffc
cmp edi, eax
jbe 0x140027ffc
mov eax, dword [rsp + 0x70]
shr edi, 1
jmp 0x140027ff4
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x30]
add eax, ecx
mov dword [rsp + 0x70], eax
test rsi, rsi
jne 0x140028022
test ecx, ecx
je 0x14002801b
cmp ebx, eax
ja 0x140027f90
xor eax, eax
jmp 0x140028003
mov ecx, eax
call sym.VBoxControl.exe_RTErrConvertFromWin32
mov rdi, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rsi
pop rbp
ret
mov eax, 0xffffff92
jmp 0x140028003
mov qword [rsi], rax
xor eax, eax
jmp 0x140028003
mov eax, 0xffffffc9
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rsi
pop rbp
ret