joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800cc880
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [sym.imp.VBoxRT.dll_g_pSUPGlobalInfoPage]
mov rdx, qword [rax]
test rdx, rdx
je 0x1800cc8d9
mov rax, qword [rdx + 0x20]
movabs rbx, 0xffffeffffe
lea rcx, [rax - 0x100001]
cmp rcx, rbx
jbe 0x1800cca92
cmp dword [rdx], 0x19590106
jne 0x1800cc8d9
mov ecx, dword [rdx + 8]
sub ecx, 1
je 0x1800ccaa6
sub ecx, 1
je 0x1800cca98
cmp ecx, 1
je 0x1800ccaa6
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r15
call qword [sym.imp.VBoxRT.dll_RTTimeNanoTS]
call qword [sym.imp.VBoxRT.dll_RTThreadYield]
lea r15, [rsp + 0x20]
mov ebp, 5
lea r14, [0x1804fc120]
movabs r13, 0x431bde82d7b634db
nop dword [rax]
mov ebx, 5
rdtsc
shl rdx, 0x20
or rax, rdx
mov r12, rax
call qword [sym.imp.VBoxRT.dll_RTTimeNanoTS]
mov edi, 0x7a120
sub rdi, rax
nop
mov ecx, dword [r14]
call qword [sym.imp.VBoxRT.dll_RTThreadSleep]
rdtsc
shl rdx, 0x20
or rax, rdx
mov rsi, rax
call qword [sym.imp.VBoxRT.dll_RTTimeNanoTS]
lea rcx, [rdi + rax]
mov rax, r13
mul rcx
shr rdx, 0x12
test edx, edx
je 0x1800cc950
cmp edx, 0x14
jae 0x1800cc988
dec ebx
test ebx, ebx
jg 0x1800cc950
sub rsi, r12
mov ecx, edx
imul rax, rsi, 0x3e8
xor edx, edx
add r14, 4
div rcx
mov qword [r15], rax
add r15, 8
sub rbp, 1
jne 0x1800cc930
mov rcx, qword [rsp + 0x30]
xor r11d, r11d
mov rdx, qword [rsp + 0x28]
mov r9d, 1
cmp rdx, qword [rsp + 0x20]
mov r8d, r9d
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
cmovbe r9d, r11d
mov r13, qword [rsp + 0x60]
cmovae r8d, r11d
mov r12, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
cmp rcx, qword [rsp + r8*8 + 0x20]
mov rbp, qword [rsp + 0x80]
mov edx, r9d
mov r9d, 2
mov eax, r9d
cmovae eax, r8d
mov r8d, eax
cmp rcx, qword [rsp + rdx*8 + 0x20]
mov rcx, qword [rsp + 0x38]
cmovbe r9d, edx
mov edx, 3
cmp rcx, qword [rsp + r8*8 + 0x20]
mov eax, edx
cmovae eax, r8d
cmp rcx, qword [rsp + r9*8 + 0x20]
mov r8d, eax
mov rax, qword [rsp + 0x40]
cmovbe edx, r9d
mov r9d, edx
mov edx, 4
mov ecx, edx
cmp rax, qword [rsp + r8*8 + 0x20]
cmovae ecx, r8d
cmp rax, qword [rsp + r9*8 + 0x20]
movabs rax, 0xaaaaaaaaaaaaaaab
cmovbe edx, r9d
mov qword [rsp + rcx*8 + 0x20], r11
mov qword [rsp + rdx*8 + 0x20], r11
mov rdx, qword [rsp + 0x40]
add rdx, qword [rsp + 0x38]
add rdx, qword [rsp + 0x30]
add rdx, qword [rsp + 0x28]
add rdx, qword [rsp + 0x20]
mul rdx
shr rdx, 1
mov rax, rdx
add rsp, 0x70
pop rbx
ret
mov rcx, rdx
call qword [sym.imp.VBoxRT.dll_SUPGetCpuHzFromGipForAsyncMode]
mov rcx, rax
jmp 0x1800ccaad
mov rcx, qword [rdx + 0x2e98]
lea rax, [rcx - 0x100001]
cmp rax, rbx
ja 0x1800cc8d9
mov rax, rcx
add rsp, 0x70
pop rbx
ret
Function at 0x1800e1ba0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push r13
push r14
push r15
sub rsp, 0x70
xor eax, eax
lea r10, str.FLUSH_n
add r9, r9
lea r14, str.END_n
mov ebp, dword [r8 + r9*8 + 4]
lea rsi, [r8 + r9*8]
cmp ebp, 0x100
mov rbx, r8
mov r15, rdx
mov r13, rcx
cmovb r10, rax
cmovb r14, rax
mov eax, dword [r8 + 0x44]
test eax, eax
je 0x1800e1d3d
mov qword [rsp + 0xa0], r12
rdtsc
shl rdx, 0x20
or rax, rdx
mov r12, rax
call qword [sym.imp.VBoxRT.dll_RTTimeNanoTS]
mov rcx, qword [rsp + 0xc0]
lea r8, [0x18020e04a]
xor r9d, r9d
mov qword [rsp + 0xb0], rax
xor edx, edx
mov qword [rsp + 0x20], 0
call qword [sym.imp.VBoxRT.dll_RTLogBulkWrite]
mov ecx, dword [rbx + 0x44]
test ecx, ecx
je 0x1800e1c98
mov rcx, qword [rsp + 0xc0]
lea r8, [0x18020e04a]
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor edx, edx
call qword [sym.imp.VBoxRT.dll_RTLogBulkWrite]
mov eax, dword [rbx + 0x44]
test eax, eax
je 0x1800e1c98
mov rax, qword [rbx + 0xa0]
xor r9d, r9d
inc rax
mov qword [rsp + 0x20], 0
mov qword [rbx + 0xa0], rax
mov edx, dword [r15 + 0x80b8]
mov rcx, qword [r13 + 0x28]
lea r8d, [r9 + 0x45]
call qword [sym.imp.VBoxRT.dll_SUPR3CallVMMR0Ex]
call qword [sym.imp.VBoxRT.dll_RTTimeNanoTS]
mov ecx, dword [rbx + 0x44]
lea r9, str._MISORDERED
sub rax, qword [rsp + 0xb0]
lea r8, str._sFLUSH_waited__RU64_ns_n
test ecx, ecx
mov qword [rsp + 0x20], rax
lea rcx, [0x18020e04a]
mov edx, 0x40
cmove r9, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.VBoxRT.dll_RTStrPrintf]
lea r10, [rsp + 0x30]
rdtsc
mov rcx, qword [rbx + 0x88]
shl rdx, 0x20
or rax, rdx
mov r8, rax
sub r8, r12
mov r12, qword [rsp + 0xa0]
add rcx, r8
mov qword [rbx + 0x88], rcx
mov rcx, qword [rbx + 0x80]
inc rcx
mov qword [rbx + 0x80], rcx
mov rcx, qword [rbx + 0x90]
cmp rcx, r8
jae 0x1800e1d2a
mov qword [rbx + 0x90], r8
mov rax, qword [rbx + 0x98]
cmp rax, r8
jbe 0x1800e1d3d
mov qword [rbx + 0x98], r8
mov r8, qword [rsi + 8]
mov r9, rbp
mov rcx, qword [rsp + 0xc0]
mov rdx, r10
mov qword [rsp + 0x20], r14
call qword [sym.imp.VBoxRT.dll_RTLogBulkWrite]
mov rbx, qword [rsp + 0xa8]
mov byte [rsi], 1
add rsp, 0x70
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret
Function at 0x1800f53f0
Capabilities:
Inspect section memory permissions

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r13
push r14
sub rsp, 0x20
xor ebp, ebp
mov r14, r8
mov rsi, rdx
mov r13, rcx
cmp byte [rcx + 0x11d0e4], bpl
jbe 0x1800f5455
mov r10d, ebp
lea r9, [rcx + 0x11d134]
nop dword [rax]
cmp qword [r9 - 0xc], r14
jne 0x1800f5448
cmp byte [r9], bpl
jne 0x1800f5448
cmp byte [r9 + 1], 1
jne 0x1800f5448
movzx eax, byte [r9 + 2]
test al, al
je 0x1800f5448
mov eax, dword [r9 - 4]
cmp eax, 0xffffffff
jne 0x1800f55c5
inc r10d
add r9, 0x10
cmp r10d, 4
jb 0x1800f5420
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov edi, dword [rdx + 0x191b8]
mov qword [rsp + 0x50], r15
mov r15d, edi
and r15d, 3
je 0x1800f547b
test edi, 0xf0000
je 0x1800f54ad
test dil, 0xc
je 0x1800f5489
test edi, 0xf00000
je 0x1800f54ad
test dil, 0x30
je 0x1800f5497
test edi, 0xf000000
je 0x1800f54ad
test dil, 0xc0
je 0x1800f55f5
test edi, 0xf0000000
jne 0x1800f55f5
test dword [rdx + 0x19148], 0x10000
jne 0x1800f55f5
mov eax, dword [rdx + 0x19150]
bt rax, 0x1d
jae 0x1800f54df
mov edx, 0x20000000
mov rcx, rsi
call fcn.1800f2440
test eax, eax
js 0x1800f55f7
mov ebx, ebp
test edi, 0xf0000
jne 0x1800f54fd
test r15d, r15d
setne bl
cmp qword [rsi + 0x19180], r14
jne 0x1800f54fd
mov ebp, 1
test edi, 0xf00000
jne 0x1800f551f
mov ecx, ebx
mov eax, edi
or ecx, 2
and al, 0xc
cmove ecx, ebx
mov ebx, ecx
cmp qword [rsi + 0x19188], r14
jne 0x1800f551f
or ebp, 2
test edi, 0xf000000
jne 0x1800f5541
mov ecx, ebx
mov eax, edi
or ecx, 4
and al, 0x30
cmove ecx, ebx
mov ebx, ecx
cmp qword [rsi + 0x19190], r14
jne 0x1800f5541
or ebp, 4
test edi, 0xf0000000
jne 0x1800f5563
mov eax, ebx
or eax, 8
and dil, 0xc0
cmove eax, ebx
mov ebx, eax
cmp qword [rsi + 0x19198], r14
jne 0x1800f5563
or ebp, 8
and ebx, ebp
je 0x1800f55f5
mov eax, dword [rsi + 0x19150]
bt rax, 0x1e
jae 0x1800f5589
mov edx, 0x40000000
mov rcx, rsi
call fcn.1800f2440
test eax, eax
js 0x1800f55f7
mov rcx, qword [rsi + 0x191b0]
and rcx, 0xfffffffffffffff0
mov qword [rsi + 0x191b0], rcx
cmp byte [r13 + 0xf0], 1
cmovne ebp, ebx
mov eax, ebp
or rax, rcx
mov qword [rsi + 0x191b0], rax
mov eax, 0xffffdfff
and qword [rsi + 0x191b8], rax
mov eax, 0x461
jmp 0x1800f55f7
mov eax, r10d
add rax, 0x11d13
add rax, rax
mov eax, dword [rcx + rax*8]
mov dword [rdx + 0xf908], eax
mov eax, 0x453
mov byte [rdx + 0xf905], bpl
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop rsi
ret
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop rsi
ret
Function at 0x18015b3a0
Capabilities:
Enumerate pe sections

Disassembly:
movzx eax, word [r8]
mov r9, rcx
mov word [rcx + 0x19300], ax
test dl, dl
jne 0x18015b48c
movzx eax, word [r8 + 2]
mov word [rcx + 0x19302], ax
movzx edx, word [r8 + 4]
mov word [rcx + 0x19304], dx
test byte [rcx + 0x19160], 1
je 0x18015b3e7
test dword [rcx + 0x19148], 0x20000
jne 0x18015b3e7
xor al, al
jmp 0x18015b3e9
mov al, 1
test al, al
movzx eax, word [r8 + 6]
je 0x18015b44a
movzx ecx, word [r8 + 8]
and ecx, 0xf000
shl ecx, 4
or ecx, eax
mov dword [r9 + 0x19308], ecx
movzx eax, word [r8 + 0xa]
movzx ecx, word [r8 + 0xc]
and ecx, 0xf000
shl ecx, 4
or ecx, eax
mov dword [r9 + 0x19310], ecx
mov ecx, 0x7ff
movzx eax, word [r8 + 8]
and ax, cx
xor r10d, r10d
mov word [r9 + 0x19306], ax
mov dword [r9 + 0x1930c], r10d
movzx eax, r10w
jmp 0x18015b477
mov dword [rcx + 0x19308], eax
xor r10d, r10d
movzx eax, word [r8 + 8]
mov word [rcx + 0x1930c], ax
mov word [rcx + 0x1930e], r10w
movzx eax, word [r8 + 0xa]
mov dword [rcx + 0x19310], eax
movzx eax, word [r8 + 0xc]
mov word [r9 + 0x19314], ax
mov word [r9 + 0x19316], r10w
jmp 0x18015b56c
movzx eax, word [r8 + 4]
mov word [rcx + 0x19302], ax
movzx edx, word [r8 + 8]
mov word [rcx + 0x19304], dx
test byte [rcx + 0x19160], 1
je 0x18015b4bd
test dword [rcx + 0x19148], 0x20000
jne 0x18015b4bd
xor al, al
jmp 0x18015b4bf
mov al, 1
test al, al
je 0x18015b521
movzx eax, word [r8 + 0xc]
mov ecx, dword [r8 + 0x10]
and ecx, 0xfffff000
shl ecx, 4
or ecx, eax
mov dword [r9 + 0x19308], ecx
mov ecx, 0x7ff
movzx eax, word [r8 + 0x10]
and ax, cx
mov word [r9 + 0x19306], ax
mov ecx, dword [r8 + 0x18]
movzx eax, word [r8 + 0x14]
and ecx, 0xfffff000
shl ecx, 4
or ecx, eax
xor r10d, r10d
mov dword [r9 + 0x19310], ecx
mov dword [r9 + 0x1930c], r10d
mov dword [r9 + 0x19314], r10d
jmp 0x18015b56c
mov eax, dword [r8 + 0xc]
xor r10d, r10d
mov dword [rcx + 0x19308], eax
movzx eax, word [r8 + 0x10]
mov word [rcx + 0x1930c], ax
mov word [rcx + 0x1930e], r10w
movzx eax, word [r8 + 0x12]
mov word [rcx + 0x19306], ax
mov eax, dword [r8 + 0x14]
mov dword [rcx + 0x19310], eax
movzx eax, word [r8 + 0x18]
mov word [rcx + 0x19314], ax
mov word [rcx + 0x19316], r10w
movzx eax, dl
xor cl, cl
and al, 3
cmp al, 3
je 0x18015b57e
mov ecx, r10d
bts ecx, 0
shr dx, 2
movzx eax, dl
and al, 3
cmp al, 3
je 0x18015b592
movzx ecx, cl
bts ecx, 1
shr dx, 2
movzx eax, dl
and al, 3
cmp al, 3
je 0x18015b5a6
movzx ecx, cl
bts ecx, 2
shr dx, 2
movzx eax, dl
and al, 3
cmp al, 3
je 0x18015b5ba
movzx ecx, cl
bts ecx, 3
shr dx, 2
movzx eax, dl
and al, 3
cmp al, 3
je 0x18015b5ce
movzx ecx, cl
bts ecx, 4
shr dx, 2
movzx eax, dl
and al, 3
cmp al, 3
je 0x18015b5e2
movzx ecx, cl
bts ecx, 5
shr dx, 2
movzx eax, dl
and al, 3
cmp al, 3
je 0x18015b5f6
movzx ecx, cl
bts ecx, 6
mov eax, 0xfffc
and dx, ax
cmp dx, 0xc
je 0x18015b60b
movzx ecx, cl
bts ecx, 7
movzx edx, word [r9 + 0x19302]
mov r8d, 0x7f7f
movzx eax, cl
mov word [r9 + 0x19304], ax
mov eax, 0xf7f
and word [r9 + 0x19300], ax
movzx eax, dx
movzx ecx, word [r9 + 0x19300]
and ax, r8w
and ecx, 0x3f
mov r8d, 0x8080
not ecx
and ecx, edx
or dx, r8w
and cl, 0x7f
cmove dx, ax
mov word [r9 + 0x19302], dx
ret
Function at 0x18015f530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
movzx edi, r8b
movzx ebp, dl
mov eax, 0x5e
mov dword [rsp + 0x30], 3
test dil, dil
mov dword [rsp + 0x28], 0x122
mov r8d, 0x6c
lea rdx, [rsp + 0x40]
cmove r8d, eax
mov rsi, rcx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
call fcn.1800ffcd0
test eax, eax
jne 0x18015f706
mov r8, qword [rsp + 0x40]
movzx edx, dil
mov qword [rsp + 0x60], rbx
mov rcx, rsi
lea rbx, [rsi + 0x19300]
call fcn.18015b670
mov eax, 0xe
test dil, dil
mov ecx, 0x1c
mov r8d, 0x122
cmove ecx, eax
mov eax, dword [rbx + 0x20]
add rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rbx + 0x24]
mov dword [rcx + 4], eax
movzx eax, word [rbx + 0x28]
mov word [rcx + 8], ax
mov eax, dword [rbx + 0x30]
mov dword [rcx + 0xa], eax
mov eax, dword [rbx + 0x34]
mov dword [rcx + 0xe], eax
movzx eax, word [rbx + 0x38]
mov word [rcx + 0x12], ax
mov eax, dword [rbx + 0x40]
mov dword [rcx + 0x14], eax
mov eax, dword [rbx + 0x44]
mov dword [rcx + 0x18], eax
movzx eax, word [rbx + 0x48]
mov word [rcx + 0x1c], ax
mov eax, dword [rbx + 0x50]
mov dword [rcx + 0x1e], eax
mov eax, dword [rbx + 0x54]
mov dword [rcx + 0x22], eax
movzx eax, word [rbx + 0x58]
mov word [rcx + 0x26], ax
mov eax, dword [rbx + 0x60]
mov dword [rcx + 0x28], eax
mov eax, dword [rbx + 0x64]
mov dword [rcx + 0x2c], eax
movzx eax, word [rbx + 0x68]
mov word [rcx + 0x30], ax
mov eax, dword [rbx + 0x70]
mov dword [rcx + 0x32], eax
mov eax, dword [rbx + 0x74]
mov dword [rcx + 0x36], eax
movzx eax, word [rbx + 0x78]
mov word [rcx + 0x3a], ax
mov eax, dword [rbx + 0x80]
mov dword [rcx + 0x3c], eax
mov eax, dword [rbx + 0x84]
mov dword [rcx + 0x40], eax
movzx eax, word [rbx + 0x88]
mov word [rcx + 0x44], ax
mov eax, dword [rbx + 0x90]
mov dword [rcx + 0x46], eax
mov eax, dword [rbx + 0x94]
mov dword [rcx + 0x4a], eax
movzx eax, word [rbx + 0x98]
mov word [rcx + 0x4e], ax
mov rcx, rsi
mov rdx, qword [rsp + 0x40]
call fcn.1800ff2f0
test eax, eax
jne 0x18015f701
xor edx, edx
mov rcx, rbx
call fcn.18013de90
xor edi, edi
mov dword [rbx], 0x37f
mov rcx, rsi
mov qword [rbx + 4], rdi
mov qword [rbx + 0x10], rdi
mov dword [rbx + 0xc], edi
lea edx, [rdi + 1]
call sym.VBoxVMM.dll_CPUMSetChangedFlags
mov rcx, qword [rsi + 0x19140]
lea rdx, [rcx + rbp]
mov rax, rdx
xor rax, rcx
movabs rcx, 0x100010000
test rcx, rax
je 0x18015f6e2
cmp byte [rsi + 0x44], 2
je 0x18015f6e2
cmp byte [rsi + 0x784], 5
jb 0x18015f6df
mov edx, edx
jmp 0x18015f6e2
movzx edx, dx
test dword [rsi + 0x19148], 0x7ec10100
mov qword [rsi + 0x19140], rdx
je 0x18015f6ff
mov rcx, rsi
call fcn.18013d7f0
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x18015fa50
Capabilities:
Inspect section memory permissions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, word [rcx + 0x19302]
mov rbx, rcx
mov ecx, eax
movzx r10d, r8b
shr ecx, 0xb
xor esi, esi
and ecx, 7
movzx edi, dl
test byte [rbx + 0x19300], 1
je 0x18015fb56
movzx r9d, word [rbx + 0x19304]
mov edx, 0xffff
bt r9d, ecx
jae 0x18015fb06
lea eax, [rcx + r10]
and eax, 7
bt r9d, eax
jae 0x18015fac0
mov dword [rbx + 0x19320], esi
mov dword [rbx + 0x19324], 0xc0000000
mov word [rbx + 0x19328], dx
jmp 0x18015fae3
lea rax, [r10 + 0x1932]
add rax, rax
movsd xmm0, qword [rbx + rax*8]
movsd qword [rbx + 0x19320], xmm0
movzx eax, word [rbx + rax*8 + 8]
mov word [rbx + 0x19328], ax
lea rax, [r10 + 2]
add rax, rax
mov dword [rbx + rax*8 + 0x19300], esi
mov dword [rbx + rax*8 + 0x19304], 0xc0000000
mov word [rbx + rax*8 + 0x19308], dx
jmp 0x18015fb40
movsd xmm0, qword [rbx + 0x19320]
lea rcx, [r10 + 0x1932]
add rcx, rcx
movsd qword [rbx + rcx*8], xmm0
movzx eax, word [rbx + 0x19328]
mov word [rbx + rcx*8 + 8], ax
mov dword [rbx + 0x19320], esi
mov dword [rbx + 0x19324], 0xc0000000
mov word [rbx + 0x19328], dx
movzx eax, word [rbx + 0x19302]
mov ecx, 0xb8ff
and ax, cx
mov ecx, 0x241
jmp 0x18015fb63
mov ecx, 0xc780
and ax, cx
mov ecx, 0x82c1
or ax, cx
mov word [rbx + 0x19302], ax
movzx eax, word [rbx + 0x5c]
mov word [rbx + 0x19306], ax
test byte [rbx + 0x19160], 1
je 0x18015fbc1
test dword [rbx + 0x19148], 0x20000
jne 0x18015fbc1
mov eax, dword [rbx + 0x191f8]
shr rax, 0xa
test al, 1
jne 0x18015fbb1
movzx eax, word [rbx + 0x19098]
mov word [rbx + 0x1930c], ax
mov eax, dword [rbx + 0x19140]
jmp 0x18015fbd8
mov rax, qword [rbx + 0x19140]
mov qword [rbx + 0x19308], rax
jmp 0x18015fbde
mov word [rbx + 0x1930c], si
movzx eax, word [rbx + 0x19098]
shl eax, 4
or eax, dword [rbx + 0x19140]
mov dword [rbx + 0x19308], eax
mov edx, 1
mov rcx, rbx
call sym.VBoxVMM.dll_CPUMSetChangedFlags
mov rcx, qword [rbx + 0x19140]
lea rdx, [rcx + rdi]
mov rax, rdx
xor rax, rcx
movabs rcx, 0x100010000
test rcx, rax
je 0x18015fc21
cmp byte [rbx + 0x44], 2
je 0x18015fc21
cmp byte [rbx + 0x784], 5
jb 0x18015fc1e
mov edx, edx
jmp 0x18015fc21
movzx edx, dx
test dword [rbx + 0x19148], 0x7ec10100
mov qword [rbx + 0x19140], rdx
jne 0x18015fc46
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.18013d7f0
Function at 0x1801997d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1801d6700
mov r8, qword [rsp + 0x30]
jmp 0x1801ce4d0

Function at 0x180199bd0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbx
push rsi
sub rsp, 0x48
mov rsi, r9
mov rbx, r8
lock inc dword [r8 + 4]
jne 0x180199bf9
mov dword [r8 + 0x10], 1
xor eax, eax
xchg qword [r8 + 8], rsi
add rsp, 0x48
pop rsi
pop rbx
ret
mov rax, qword [r8 + 0x98]
mov qword [rsp + 0x60], rbp
inc rax
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
mov qword [r8 + 0x98], rax
rdtsc
mov r14, qword [rcx + 0x10]
mov r15, qword [r8 + 0x18]
shl rdx, 0x20
or rax, rdx
mov r12, rax
call qword [sym.imp.VBoxRT.dll_RTThreadSelf]
mov r8b, 1
mov edx, 4
mov rcx, rax
mov rbp, rax
call qword [sym.imp.VBoxRT.dll_RTThreadBlocking]
mov r8d, 0x1388
mov rdx, r15
mov rcx, r14
call qword [sym.imp.VBoxRT.dll_SUPSemEventWaitNoResume]
mov edx, 4
mov rcx, rbp
mov edi, eax
call qword [sym.imp.VBoxRT.dll_RTThreadUnblocked]
mov ecx, dword [rbx]
cmp ecx, 0x19790326
jne 0x180199cd0
nop dword [rax]
test edi, edi
je 0x180199d34
lea ecx, [rdi + 0x28]
cmp ecx, 1
ja 0x180199d29
mov r8b, 1
mov edx, 4
mov rcx, rbp
call qword [sym.imp.VBoxRT.dll_RTThreadBlocking]
mov r8d, 0x1388
mov rdx, r15
mov rcx, r14
call qword [sym.imp.VBoxRT.dll_SUPSemEventWaitNoResume]
mov edx, 4
mov rcx, rbp
mov edi, eax
call qword [sym.imp.VBoxRT.dll_RTThreadUnblocked]
mov eax, dword [rbx]
cmp eax, 0x19790326
je 0x180199c80
mov ecx, 0x15f0010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180199d04
mov dword [rsp + 0x28], edi
lea r9, str.PDMCritSectEnter:_Destroyed_while_waiting__pCritSect_p_rc_Rrc_n
mov edx, 0x10
mov qword [rsp + 0x20], rbx
mov r8d, 0x15f
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov eax, 0xfffffe95
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r15, qword [rsp + 0x30]
add rsp, 0x48
pop rsi
pop rbx
ret
mov eax, edi
cdq
xor eax, edx
sub eax, edx
neg eax
jmp 0x180199d09
rdtsc
mov rcx, qword [rbx + 0xa8]
shl rdx, 0x20
or rdx, rax
sub rdx, r12
add rcx, rdx
mov qword [rbx + 0xa8], rcx
mov rcx, qword [rbx + 0xa0]
inc rcx
mov qword [rbx + 0xa0], rcx
mov rcx, qword [rbx + 0xb0]
cmp rcx, rdx
jae 0x180199d75
mov qword [rbx + 0xb0], rdx
mov rax, qword [rbx + 0xb8]
cmp rax, rdx
jbe 0x180199d88
mov qword [rbx + 0xb8], rdx
mov dword [rbx + 0x10], 1
xor eax, eax
xchg qword [rbx + 8], rsi
jmp 0x180199d09
Function at 0x1801c3220
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
cmp byte [rcx + 0xba58], 0
mov rbx, rcx
je 0x1801c33b2
mov rcx, qword [rcx + 0x8080]
mov r8d, dword [rcx + 0x11b300]
test r8d, r8d
je 0x1801c3384
sub r8d, 1
je 0x1801c3267
sub r8d, 1
je 0x1801c3384
cmp r8d, 1
je 0x1801c328f
mov rax, qword [sym.imp.VBoxRT.dll_g_pSUPGlobalInfoPage]
mov rcx, qword [rax]
test rcx, rcx
je 0x1801c3379
cmp dword [rcx + 0x34], 3
jle 0x1801c3379
call qword [sym.imp.VBoxRT.dll_SUPReadTscWithDelta]
jmp 0x1801c3389
xor r8d, r8d
mov qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1801d5730
mov edi, eax
test eax, eax
jns 0x1801c3372
mov ecx, 0x17f0010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1801c3309
lea rdx, str.RT_SUCCESS_NP_rcNem_
mov r8d, 0x17f
mov qword [rsp + 0x38], rdx
lea r9, str.AssertLogRel__s__d___s:__s_n
lea rdx, str.unsigned___int64___cdecl_tmCpuTickGetInternal_struct_VMCPU__bool_
mov rcx, rax
mov qword [rsp + 0x30], rdx
lea rdx, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxVMMVMMAllTMAllCpu.cpp
mov dword [rsp + 0x28], 0x1fc
mov qword [rsp + 0x20], rdx
mov edx, 0x10
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0x17f0010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1801c3338
lea r9, str._Rra_n
mov dword [rsp + 0x20], edi
mov edx, 0x10
mov r8d, 0x17f
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov rax, qword [sym.imp.VBoxRT.dll_g_pSUPGlobalInfoPage]
mov rcx, qword [rax]
test rcx, rcx
je 0x1801c335e
cmp dword [rcx + 0x34], 3
jle 0x1801c335e
call qword [sym.imp.VBoxRT.dll_SUPReadTscWithDelta]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
rdtsc
shl rdx, 0x20
or rax, rdx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rax, qword [rsp + 0x50]
jmp 0x1801c3389
rdtsc
shl rdx, 0x20
or rax, rdx
jmp 0x1801c3389
call fcn.1801c33d0
sub rax, qword [rbx + 0xba40]
mov rcx, qword [rbx + 0xba50]
cmp rax, rcx
ja 0x1801c33a0
lea rax, [rcx + 0x40]
mov qword [rbx + 0xba50], rax
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rax, qword [rcx + 0xba48]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1801ce4d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
cmp byte [r8], 1
mov rsi, r8
mov r14, rdx
mov rdi, rcx
ja 0x1801ce506
mov byte [r8], 1
xor eax, eax
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
rdtsc
mov rcx, qword [rcx + 0x119718]
mov r8d, 0x1000
shl rdx, 0x20
or rax, rdx
mov rdx, r14
mov rbx, rax
and rdx, 0xfffffffffffff000
mov rax, qword [0x180598598]
call qword [case.0x180097796.0]
mov ebp, eax
rdtsc
mov rcx, qword [rdi + 0x1197b8]
shl rdx, 0x20
or rdx, rax
sub rdx, rbx
mov rbx, qword [rsp + 0x60]
add rcx, rdx
mov qword [rdi + 0x1197b8], rcx
mov rcx, qword [rdi + 0x1197b0]
inc rcx
mov qword [rdi + 0x1197b0], rcx
mov rcx, qword [rdi + 0x1197c0]
cmp rcx, rdx
jae 0x1801ce588
mov qword [rdi + 0x1197c0], rdx
mov rax, qword [rdi + 0x1197c8]
cmp rax, rdx
jbe 0x1801ce59b
mov qword [rdi + 0x1197c8], rdx
test ebp, ebp
js 0x1801ce5be
mov rax, qword [rdi + 0x119738]
inc rax
mov qword [rdi + 0x119738], rax
lock dec dword [rdi + 0x119728]
xor eax, eax
mov byte [rsi], 1
jmp 0x1801ce62f
mov rax, qword [rdi + 0x119748]
mov ecx, 0x1550010
inc rax
mov qword [rdi + 0x119748], rax
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1801ce62a
mov rcx, qword gs:[0x30]
lea r9, str.nemHCJustUnmapPageFromHyperV__RGp_:_failed__hrc_Rhrc___x__Last_x__u_n
mov rdx, qword gs:[0x30]
mov r8d, 0x155
mov ecx, dword [rcx + 0x68]
mov dword [rsp + 0x40], ecx
mov ecx, dword [rdx + 0x1250]
mov edx, 0x10
mov dword [rsp + 0x38], ecx
mov rcx, rax
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r14
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov eax, 0xffffe510
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
mov r8, qword [rsp + 0x40]
jmp 0x1801ce4d0