joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006150
Capabilities:
Check if file exists
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x860
mov rax, qword [0x140066360]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rbx, rcx
lea rcx, str.kernel32
xor edi, edi
mov dword [rsp + 0x30], edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x1400061b6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
call rsi
test eax, eax
je 0x1400061ff
cmp dword [rsp + 0x30], edi
je 0x1400061ff
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400061e8
mov eax, 8
jmp 0x14000630e
lea rcx, [rbx + 0x48]
call rax
test eax, eax
je 0x1400061de
or dword [rbx + 0x50], 0x40
lea rcx, str.ProgramW6432
jmp 0x140006206
lea rcx, str.ProgramFiles
lea rdx, [rsp + 0x40]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000624c
lea r9, [rsp + 0x40]
lea r8, [0x14004f650]
lea rcx, [rbx + 0x58]
mov edx, 0x400
call fcn.140007f20
test eax, eax
js 0x14000624c
lea rcx, [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140006301
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006309
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.NVDRS_GOLD_PATH
xor r8d, r8d
mov dword [rsp + 0x30], 0x802
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400062f2
cmp dword [rsp + 0x34], 1
jne 0x1400062f2
lea r9, [rsp + 0x40]
lea r8, [0x14004f650]
lea rcx, [rbx + 0x58]
mov edx, 0x400
call fcn.140007f20
test eax, eax
js 0x1400062f0
lea rcx, [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400062f0
mov edi, 1
jmp 0x1400062f2
xor edi, edi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x140006309
or dword [rbx + 0x50], 0x20
xor eax, eax
jmp 0x14000630e
mov eax, 1
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1400220e0
lea r11, [rsp + 0x860]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140006340
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.kernel32
mov dword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x14000638e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x38]
mov rcx, rax
call rdi
test eax, eax
je 0x1400063d5
cmp dword [rsp + 0x38], 0
je 0x1400063d5
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400063c7
mov eax, 8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [rbx + 0x48]
call rax
test eax, eax
je 0x1400063b7
or dword [rbx + 0x50], 0x40
lea rcx, [rbx + 0x58]
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400063b7
or dword [rbx + 0x50], 0x20
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x140006540
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x840
mov rax, qword [0x140066360]
xor rax, rsp
mov qword [rsp + 0x830], rax
test byte [rcx + 0x50], 0x20
mov rbx, rcx
jne 0x140006571
call fcn.140005e70
test eax, eax
jne 0x140006690
lea rax, str.nvdrssel.bin
add rbx, 0x58
lea r8, str._s_s
lea rcx, [rsp + 0x30]
mov edx, 0x400
mov r9, rbx
mov qword [rsp + 0x20], rax
call fcn.140007f20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, str.nvdrswr.lk
lea r8, str._s_s
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.140007f20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, str.update.bin
lea r8, str._s_s
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.140007f20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, str._s_nvdrsdb_d.bin
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov qword [rsp + 0x20], 0
call fcn.140007f20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, str._s_nvdrsdb_d.bin
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov dword [rsp + 0x20], 1
call fcn.140007f20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, str.nvAppTimestamps
lea r8, str._s_s
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.140007f20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.1400220e0
add rsp, 0x840
pop rbx
ret
add rcx, 0x838
jmp 0x140006540
Function at 0x140006730
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x860
mov rax, qword [0x140066360]
xor rax, rsp
mov qword [rsp + 0x850], rax
test byte [rcx + 0x50], 0x20
mov rdi, rdx
mov rbx, rcx
jne 0x140006768
call fcn.140005e70
test eax, eax
jne 0x140006815
lea rax, str.nvdrssel.bin
lea r9, [rbx + 0x58]
lea r8, str._s_s
lea rcx, [rsp + 0x50]
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.140007f20
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 3]
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400067d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call fcn.140005dc0
mov eax, 8
jmp 0x140006815
or dword [rbx + 0x50], 0x10
lea r9, [rsp + 0x40]
mov r8d, 1
mov rdx, rdi
mov rcx, rax
mov qword [rbx + 0x20], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140006810
cmp dword [rsp + 0x40], 1
jne 0x140006810
xor eax, eax
jmp 0x140006815
mov eax, 0xf
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1400220e0
mov rbx, qword [rsp + 0x880]
add rsp, 0x860
pop rdi
ret

Function at 0x140006840
Capabilities:
Write file on windows

Disassembly:
mov byte [rsp + 0x10], dl
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x140006899
mov rcx, qword [rbx + 0x20]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov r8d, 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140006899
cmp dword [rsp + 0x40], 1
jne 0x140006899
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov rcx, rbx
call fcn.140005dc0
mov eax, 8
add rsp, 0x30
pop rbx
ret

Function at 0x1400068b0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov esi, edx
xor edx, edx
mov rdi, r9
mov r14d, r8d
mov r15, rcx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
je 0x14000698b
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], r12
mov r12d, 1
mov ecx, r12d
mov rdx, rbp
call fcn.140021e50
mov rbx, rax
test rax, rax
je 0x14000697f
mov r9, rax
mov r8d, ebp
xor edx, edx
mov rcx, r15
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140006977
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [0x14004f64c]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140006977
mov rax, qword [rsp + 0x28]
movzx edx, word [rax + 0xa]
mov dword [rdi], 0
test r14d, r14d
jne 0x14000695b
cmp edx, esi
jb 0x14000696a
mov rcx, rbx
mov dword [rdi], r12d
call fcn.140021e94
mov eax, r12d
jmp 0x140006981
cmp edx, esi
jb 0x14000696a
mov ecx, dword [rdi]
cmp edx, r14d
cmovbe ecx, r12d
mov dword [rdi], ecx
mov rcx, rbx
call fcn.140021e94
mov eax, r12d
jmp 0x140006981
mov rcx, rbx
call fcn.140021e94
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140006d40
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rsi, rdx
mov rbx, rcx
mov edi, ebp
nop
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x140006de0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x140006dbe
cmp eax, 2
je 0x140006dbe
cmp edi, 0xbb8
jae 0x140006dbe
mov ecx, 0x3c
call qword [sym.imp.KERNEL32.dll_Sleep]
add edi, 0x3c
cmp edi, 0xbb8
jb 0x140006d60
mov rcx, rbx
call fcn.140005dc0
mov eax, 8
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
or dword [rbx + 0x50], 8
lea rdx, [rsp + 0x60]
mov rcx, rax
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140006dbe
cmp dword [rsp + 0x64], ebp
jne 0x140006dbe
mov edx, dword [rsp + 0x60]
mov rcx, rbx
call fcn.140007270
test eax, eax
jne 0x140006dbe
mov rax, qword [rsp + 0x60]
lea rcx, [rbx + 0x58]
mov r8d, 0x400
mov dword [rbx + 8], eax
mov dword [rbx + 0xc], eax
mov rax, qword [rbx]
mov rdx, rsi
mov qword [rbx + 0x10], rax
call fcn.140007c90
xor eax, eax
jmp 0x140006dcb

Function at 0x140007130
Capabilities:
Clear file content
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rbx, rdx
mov rsi, rcx
mov edi, ebp
nop
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400071cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x1400071ad
cmp eax, 2
je 0x1400071ad
cmp edi, 0xbb8
jae 0x1400071ad
mov ecx, 0x3c
call qword [sym.imp.KERNEL32.dll_Sleep]
add edi, 0x3c
cmp edi, 0xbb8
jb 0x140007150
mov rcx, rsi
call fcn.140005dc0
mov eax, 8
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov r8d, dword [rsi + 0xc]
mov rdx, qword [rsi]
or dword [rsi + 0x50], 8
lea r9, [rsp + 0x60]
mov rcx, rax
mov qword [rsi + 0x28], rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
je 0x140007201
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [rsi + 0x50], 0xfffffff7
mov qword [rsi + 0x28], rbp
test edi, edi
je 0x1400071ad
mov eax, dword [rsi + 0xc]
cmp dword [rsp + 0x60], eax
jne 0x1400071ad
lea rax, [rsi + 0x58]
test rax, rax
je 0x140007257
test rbx, rbx
je 0x140007257
mov edx, ebp
cmp word [rbx], dx
je 0x140007254
sub rbx, rax
cmp edx, 0x400
ja 0x140007254
movzx ecx, word [rbx + rax]
add rax, 2
inc edx
mov word [rax - 2], cx
cmp word [rbx + rax], bp
jne 0x140007238
mov word [rax], bp
xor eax, eax
jmp 0x1400071ba
Function at 0x140007300
Capabilities:
Query environment variable

Disassembly:
push rbx
mov eax, 0x18a0
call fcn.140022080
sub rsp, rax
mov rax, qword [0x140066360]
xor rax, rsp
mov qword [rsp + 0x1890], rax
mov rbx, rcx
mov qword [rcx], 0
lea rdx, [rsp + 0x90]
lea rcx, str.PROGRAMDATA
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x140007354
mov eax, 8
jmp 0x140007415
lea r9, [rsp + 0x90]
lea r8, str._sNVIDIA_CorporationDrs_nvdrsdb_d.bin
lea rcx, [rsp + 0x890]
mov edx, 0x800
mov qword [rsp + 0x20], 0
call fcn.140007f20
lea r9, [rsp + 0x90]
lea r8, str._sNVIDIA_CorporationDrs_nvdrsdb_d.bin
lea rcx, [rsp + 0x1090]
mov edx, 0x800
mov dword [rsp + 0x20], 1
call fcn.140007f20
lea r8, [rsp + 0x68]
lea rcx, [rsp + 0x890]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x14000734a
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x1090]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x14000734a
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rcx
cmovae rcx, qword [rsp + 0x38]
xor eax, eax
mov qword [rbx], rcx
mov rcx, qword [rsp + 0x1890]
xor rcx, rsp
call fcn.1400220e0
add rsp, 0x18a0
pop rbx
ret
Function at 0x140007430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov rdi, qword [rsp + 0x38]
xor ebp, ebp
mov r14, r9
mov word [rcx + 0x7fe], bp
mov dword [r9], ebp
mov ebx, ebp
mov dword [rdi], ebp
mov rsi, rcx
mov r11d, ebp
mov rdx, rcx
mov r10, rcx
mov r9d, ebp
cmp word [rcx], bx
je 0x14000749f
cmp r9d, 0x400
jae 0x14000749f
movzx ecx, word [r10]
lea eax, [rcx - 0x41]
cmp ax, 0x19
ja 0x140007492
add cx, 0x20
mov word [r10], cx
add r10, 2
inc r9d
cmp word [r10], bx
jne 0x140007474
mov r15d, 0x2f
cmp word [rsi], bx
je 0x1400074c9
nop word [rax + rax]
cmp word [rdx], 0x5c
jne 0x1400074c0
mov word [rdx], r15w
mov dword [rdi], 1
add rdx, 2
cmp word [rdx], bx
jne 0x1400074b0
movzx eax, word [rsi]
mov rcx, rsi
test ax, ax
je 0x140007504
cmp ax, 0x22
jne 0x1400074e8
xor ebx, 1
test r11, r11
jne 0x1400074f7
lea r11, [rcx + 2]
jmp 0x1400074f7
cmp ax, 0x20
jne 0x1400074f7
test ebx, ebx
jne 0x1400074f7
test r8d, r8d
jne 0x140007504
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x1400074d4
test r11, r11
mov edx, ebp
setne dl
test r11, r11
cmove r11, rsi
cmp rcx, r11
jbe 0x140007538
mov r8d, 0xffdd
nop
movzx eax, word [rcx]
test r8w, ax
jne 0x140007543
cmp ax, 2
je 0x140007543
sub rcx, 2
cmp rcx, r11
ja 0x140007520
mov word [r11], bp
xor eax, eax
jmp 0x14000760d
lea rax, [r11 + 6]
cmp rcx, rax
jb 0x14000756b
cmp word [rcx - 6], 0x2e
jne 0x14000756b
cmp word [rcx - 4], 0x65
jne 0x14000756b
cmp word [rcx - 2], 0x78
jne 0x14000756b
cmp word [rcx], 0x65
je 0x1400075ff
lea r9, [rcx + 0xa]
lea rax, [rsi + 0x800]
cmp r9, rax
jae 0x1400075ff
test edx, edx
jne 0x1400075c2
mov rdx, rcx
cmp word [rcx], bp
je 0x1400075c2
mov r10d, 0x4c5c
movzx r8d, word [rdx]
cmp r8w, 0x2e
je 0x1400075e4
cmp r8w, 0x22
je 0x1400075c2
cmp r8w, 0x5c
mov eax, ebp
sete al
or dword [rdi], eax
cmp word [rdx], r10w
jne 0x1400075b9
mov word [rdx], r15w
add rdx, 2
cmp word [rdx], bp
jne 0x140007591
cmp dword [r14], ebp
jne 0x14000760a
test byte [rsi + 0x818], 2
je 0x14000760a
mov dword [rcx + 2], 0x65002e
mov dword [rcx + 6], 0x650078
mov word [r9], bp
jmp 0x14000760a
cmp word [rdx + 2], 0x65
jne 0x1400075c2
cmp word [rdx + 4], 0x78
jne 0x1400075c2
cmp word [rdx + 6], 0x65
jne 0x1400075c2
mov word [rdx + 8], bp
jmp 0x140007603
mov word [rcx + 2], bp
mov dword [r14], 1
mov rax, r11
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
Function at 0x140007730
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x850
mov rax, qword [0x140066360]
xor rax, rsp
mov qword [rsp + 0x840], rax
xor edi, edi
mov r14, rcx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x34], edi
call fcn.1400079b0
test eax, eax
je 0x14000776d
xor eax, eax
jmp 0x140007983
mov r8d, 0x400
mov rdx, r14
xor ecx, ecx
mov qword [rsp + 0x868], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400077b8
lea rcx, [rsp + 0x34]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, r14
mov edx, eax
call fcn.140007430
mov rbx, rax
test rax, rax
je 0x1400077b8
cmp dword [rsp + 0x30], edi
jne 0x14000783f
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
test rax, rax
je 0x140007936
mov qword [rsp + 0x870], rsi
mov esi, edi
mov rcx, rax
cmp word [rax], si
je 0x1400077f3
nop dword [rax]
cmp esi, 0x400
jae 0x1400077f3
add rcx, 2
inc esi
cmp word [rcx], di
jne 0x1400077e0
mov eax, 0x3ff
cmp esi, 0x400
mov rcx, r14
cmovae esi, eax
lea rbx, [rsi + rsi]
mov r8, rbx
call fcn.1400216d0
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov r8d, 1
mov edx, esi
mov rcx, r14
mov qword [rsp + 0x20], rax
mov word [rbx + r14], di
call fcn.140007430
mov rsi, qword [rsp + 0x870]
mov rbx, rax
test rbx, rbx
je 0x140007936
cmp dword [rsp + 0x34], edi
jne 0x140007931
test byte [r14 + 0x818], 4
je 0x140007931
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x7fe
call fcn.140021bd0
lea rcx, [rsp + 0x40]
mov rax, rbx
or rax, rcx
lea r9, [rsp + 0x40]
and eax, 0xf
jne 0x1400078e4
mov eax, 8
nop dword [rax]
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
lea rcx, [rcx + 0x80]
lea rbx, [rbx + 0x80]
movaps xmmword [rcx - 0x80], xmm0
movaps xmm0, xmmword [rbx - 0x60]
movaps xmmword [rcx - 0x70], xmm1
movaps xmm1, xmmword [rbx - 0x50]
movaps xmmword [rcx - 0x60], xmm0
movaps xmm0, xmmword [rbx - 0x40]
movaps xmmword [rcx - 0x50], xmm1
movaps xmm1, xmmword [rbx - 0x30]
movaps xmmword [rcx - 0x40], xmm0
movaps xmm0, xmmword [rbx - 0x20]
movaps xmmword [rcx - 0x30], xmm1
movaps xmm1, xmmword [rbx - 0x10]
movaps xmmword [rcx - 0x20], xmm0
movaps xmmword [rcx - 0x10], xmm1
dec rax
jne 0x140007890
jmp 0x1400078f5
mov r8d, 0x400
mov rdx, rbx
mov rcx, r9
call fcn.1400216d0
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov r8, r14
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov ecx, eax
mov edx, eax
mov word [r14 + rcx*2], di
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x20], rcx
mov rcx, r14
call fcn.140007430
mov rbx, rax
test rbx, rbx
jne 0x14000793d
mov word [r14], di
mov rbx, r14
mov rax, rbx
test rbx, rbx
je 0x140007964
cmp word [rbx], di
je 0x140007964
nop word [rax + rax]
cmp edi, 0x400
jae 0x140007964
add rax, 2
inc edi
cmp word [rax], 0
jne 0x140007950
lea r8d, [rdi*2 + 2]
lea rcx, [r14 + 0x800]
mov rdx, rbx
call fcn.1400081a0
mov rbx, qword [rsp + 0x868]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1400220e0
mov rdi, qword [rsp + 0x878]
add rsp, 0x850
pop r14
ret
Function at 0x140007ab0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x140066360]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rdi, rdx
xor ebp, ebp
mov rsi, rcx
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x34]
lea r8d, [rbp + 2]
mov rcx, rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140007c7e
cmp dword [rsp + 0x30], 2
jne 0x140007c7e
cmp word [rsp + 0x34], 1
je 0x140007b14
lea eax, [rbp + 2]
jmp 0x140007c48
mov qword [rsp + 0x880], rbx
mov qword [rsp + 0x888], r14
cmp eax, 1
jne 0x140007c2a
mov r14d, 0x400
nop dword [rax]
nop word [rax + rax]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x34]
mov r8d, 4
mov rcx, rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x140007c2a
test eax, eax
je 0x140007c77
cmp ecx, 4
jne 0x140007c77
movzx eax, word [rsp + 0x36]
test al, 1
jne 0x140007c70
movzx ebx, ax
shr bx, 1
cmp bx, r14w
ja 0x140007c70
cmp bx, 1
jbe 0x140007c70
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
movzx r8d, ax
mov rcx, rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140007c77
movzx eax, word [rsp + 0x36]
cmp dword [rsp + 0x30], eax
jne 0x140007c77
movzx eax, bx
cmp word [rsp + rax*2 + 0x3e], bp
jne 0x140007c77
mov rcx, qword [rsi + 0x808]
lea rdx, [rsp + 0x40]
call fcn.140021cdc
test eax, eax
je 0x140007c63
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 8
mov rcx, rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140007c77
cmp dword [rsp + 0x30], 8
jne 0x140007c77
cmp eax, 1
je 0x140007b40
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call fcn.140005970
mov rbx, qword [rsp + 0x880]
mov r14, qword [rsp + 0x888]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1400220e0
add rsp, 0x850
pop rdi
pop rsi
pop rbp
ret
mov rdx, rdi
mov rcx, rsi
call fcn.140007d50
jmp 0x140007c38
mov eax, 0xb
jmp 0x140007c38
mov eax, 8
jmp 0x140007c38
mov eax, 8
jmp 0x140007c48

Function at 0x140007d50
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
lea rcx, [rsp + 0x68]
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [rsp + 0x68]
lea r9, [rsp + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x6c]
lea rdx, [rsp + 0x30]
mov r8d, 8
mov rcx, rbx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140007da9
cmp dword [rsp + 0x60], 8
jne 0x140007da9
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov eax, 8
add rsp, 0x40
pop rbx
ret
Function at 0x1400080f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalNVTweak
xor ebx, ebx
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000817e
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, str.DisableSaveAppTimestamp
xor r8d, r8d
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000816f
cmp dword [rsp + 0x68], 4
jne 0x14000816f
cmp dword [rsp + 0x58], ebx
setne bl
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x58], ebx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x58]
add rsp, 0x40
pop rbx
ret
Function at 0x14000ceb0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x840
mov rax, qword [0x140066360]
xor rax, rsp
mov qword [rsp + 0x830], rax
test byte [rcx + 0x50], 0x20
mov rbx, rcx
jne 0x140006571
call fcn.140005e70
test eax, eax
jne 0x140006690
lea rax, str.nvdrssel.bin
add rbx, 0x58
lea r8, str._s_s
lea rcx, [rsp + 0x30]
mov edx, 0x400
mov r9, rbx
mov qword [rsp + 0x20], rax
call fcn.140007f20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, str.nvdrswr.lk
lea r8, str._s_s
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.140007f20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, str.update.bin
lea r8, str._s_s
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.140007f20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, str._s_nvdrsdb_d.bin
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov qword [rsp + 0x20], 0
call fcn.140007f20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, str._s_nvdrsdb_d.bin
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov dword [rsp + 0x20], 1
call fcn.140007f20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, str.nvAppTimestamps
lea r8, str._s_s
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.140007f20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.1400220e0
add rsp, 0x840
pop rbx
ret
add rcx, 0x838
jmp 0x140006540