joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10057920
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1005794a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10057947
cmp eax, 3
je 0x10057947
push 0
push 0
call fcn.100167a0
xor al, al
ret
mov al, 1
ret

Function at 0x10057950
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, ecx
test ebp, 0xffffced8
je 0x10057976
push 0
push 0x462
push str..FilePath.cpp
push 0x80070057
call fcn.10001ed0
mov eax, dword [esp + 0x10]
push esi
mov esi, ebp
not esi
test eax, esi
je 0x10057999
push 0
push 0x463
push str..FilePath.cpp
push 0x80070057
call fcn.10001ed0
mov eax, dword [ebx]
push edi
push eax
mov edi, 0x80
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100579b6
push 0
push 0
call fcn.100167a0
cmp ebp, edi
je 0x100579c2
and esi, eax
or esi, dword [esp + 0x18]
mov edi, esi
cmp edi, eax
je 0x100579e5
mov eax, dword [ebx]
push 0x479
push str..FilePath.cpp
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
call fcn.10014420
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x100579f0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1009e969
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x100d8dd0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 0x100e16bc
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], 0
call fcn.10001490
mov dword [esp + 0x24], 2
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, 0x104
nop
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x10057a63
push esi
lea ecx, [esp + 0x14]
call fcn.100018b0
mov edx, dword [esp + 0x10]
push esi
lea ecx, [esp + 0x14]
mov edi, edx
call fcn.10001930
push edi
push esi
call ebp
test eax, eax
je 0x10057ae7
cmp eax, esi
je 0x10057ae7
jb 0x10057a81
mov esi, eax
jmp 0x10057a40
cmp eax, 0x7fffffff
sbb ecx, ecx
neg ecx
jne 0x10057aa2
push 0
push 0x652
push str..FilePath.cpp
push 0x80004005
call fcn.10001ed0
push eax
lea ecx, [esp + 0x14]
call fcn.10001930
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.100154e0
mov dword [esp + 0x14], 1
mov byte [esp + 0x24], 0
lea ecx, [esp + 0x10]
call fcn.10001df0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret
push 0
push 0
call fcn.100167a0
int3
Function at 0x10057c10
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1009e969
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x100d8dd0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 0x100e16bc
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], 0
call fcn.10001490
mov dword [esp + 0x24], 2
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, 0x104
nop
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x10057c83
push esi
lea ecx, [esp + 0x14]
call fcn.100018b0
mov edx, dword [esp + 0x10]
push esi
lea ecx, [esp + 0x14]
mov edi, edx
call fcn.10001930
push edi
push esi
call ebp
test eax, eax
je 0x10057d07
cmp eax, esi
je 0x10057d07
jb 0x10057ca1
mov esi, eax
jmp 0x10057c60
cmp eax, 0x7fffffff
sbb ecx, ecx
neg ecx
jne 0x10057cc2
push 0
push 0x6c4
push str..FilePath.cpp
push 0x80004005
call fcn.10001ed0
push eax
lea ecx, [esp + 0x14]
call fcn.10001930
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.100154e0
mov dword [esp + 0x14], 1
mov byte [esp + 0x24], 0
lea ecx, [esp + 0x10]
call fcn.10001df0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret
push 0
push 0
call fcn.100167a0
int3

Function at 0x10057d20
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1009e969
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x100d8dd0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 0x100e16bc
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], 0
call fcn.10001490
mov dword [esp + 0x24], 2
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, 0x104
nop
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x10057d93
push esi
lea ecx, [esp + 0x14]
call fcn.100018b0
mov edx, dword [esp + 0x10]
push esi
lea ecx, [esp + 0x14]
mov edi, edx
call fcn.10001930
push esi
push edi
call ebp
test eax, eax
je 0x10057e17
cmp eax, esi
je 0x10057e17
jb 0x10057db1
mov esi, eax
jmp 0x10057d70
cmp eax, 0x7fffffff
sbb ecx, ecx
neg ecx
jne 0x10057dd2
push 0
push 0x6f2
push str..FilePath.cpp
push 0x80004005
call fcn.10001ed0
push eax
lea ecx, [esp + 0x14]
call fcn.10001930
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.100154e0
mov dword [esp + 0x14], 1
mov byte [esp + 0x24], 0
lea ecx, [esp + 0x10]
call fcn.10001df0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret
push 0
push 0
call fcn.100167a0
int3
Function at 0x100582e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1009ea79
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x100d8dd0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov esi, dword [esp + 0x28]
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x1005834b
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
push ecx
mov ecx, esi
call fcn.10001d70
mov dword [esp + 0x18], 0
mov dword [esp + 8], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
mov eax, dword [esp + 0x24]
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
jne 0x10058386
push esi
mov esi, dword [esp + 0x24]
mov ecx, esi
call fcn.10001d70
mov dword [esp + 0x18], 0
mov dword [esp + 8], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.10058180
add esp, 8
mov dword [esp + 0x18], 1
push 0x5c
lea ecx, [esp + 0x2c]
call fcn.100537b0
lea ecx, [esp + 0xc]
push esi
push ecx
call fcn.10058230
add esp, 8
mov byte [esp + 0x18], 2
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x30]
call fcn.10051ae0
mov byte [esp + 0x18], 1
lea ecx, [esp + 0xc]
call fcn.10001df0
mov esi, dword [esp + 0x20]
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.10001d70
mov dword [esp + 8], 1
mov byte [esp + 0x18], 0
lea ecx, [esp + 0x28]
call fcn.10001df0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret

Function at 0x100586e0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x1009eb00
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100d8dd0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
push esi
mov dword [esp + 0x18], esi
mov byte [esp + 0x1c], bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x18], 1
mov dword [esp + 0x24], ebx
or edi, 0xffffffff
cmp dword [esi + 0x1c], edi
jne 0x1005877a
mov eax, dword [esi + 0x18]
push ebx
push 0x4000100
push 3
push ebx
push 7
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], 1
cmp eax, edi
jne 0x10058773
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1005875d
cmp eax, 3
jne 0x1005876c
mov byte [esp + 0x24], bl
lea ecx, [esp + 0x10]
call fcn.1000dcc0
jmp 0x1005877a
push ebx
push ebx
call fcn.100167a0
mov dword [esp + 0x10], edi
mov dword [esi + 0x1c], eax
mov dword [esp + 0x24], edi
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [esp + 0x18], bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x100587a0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009eb48
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100d8dd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], esi
xor ebx, ebx
mov byte [ebp - 0x1c], bl
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov al, 1
mov byte [ebp - 0x1c], al
mov dword [ebp - 4], ebx
cmp byte [ebp + 8], bl
jne 0x10058837
cmp dword [esi + 0x1c], 0xffffffff
jne 0x10058837
mov ecx, dword [esi + 0x18]
cmp dword [ecx - 0xc], ebx
je 0x10058837
mov byte [ebp - 4], al
mov ecx, esi
call fcn.100586e0
mov dword [ebp - 4], ebx
jmp 0x10058837
mov eax, dword [esi + 0x1c]
or edi, 0xffffffff
cmp eax, edi
je 0x1005887a
cmp byte [ebp + 8], bl
je 0x1005885b
push ebx
push 0x9af
push str..FilePath.cpp
push 0xe0e00000
call fcn.10001ed0
push 0x9b3
push str..FilePath.cpp
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call fcn.10014420
add esp, 0xc
mov dword [esi + 0x1c], edi
jmp 0x1005889f
mov eax, dword [esi + 0x18]
cmp dword [eax - 0xc], ebx
je 0x1005889f
cmp byte [ebp + 8], bl
jne 0x10058892
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1005889f
mov eax, dword [esi + 0x18]
push 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x100e16bc
lea ecx, [ebp + 8]
call fcn.10001490
mov byte [ebp - 4], 5
lea ecx, [esi + 0x18]
lea eax, [ebp + 8]
push eax
call fcn.1001a720
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call fcn.10001df0
mov dword [ebp - 4], edi
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 0x1c], bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10059ab0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x1009ee1c
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x100d8dd0]
xor eax, esp
mov dword [esp + 0x264], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100d8dd0]
xor eax, esp
push eax
lea eax, [esp + 0x27c]
mov dword fs:[0], eax
test byte [0x100e10c4], 1
mov edi, dword [esp + 0x28c]
mov ebp, dword [esp + 0x290]
mov esi, ecx
jne 0x10059b3d
or dword [0x100e10c4], 1
mov dword [esp + 0x284], 0
push 0x100b184c
mov ecx, 0x100e10c0
call fcn.100170d0
push 0x100b08b0
call fcn.1007cff3
add esp, 4
mov dword [esp + 0x284], 0xffffffff
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
mov eax, 0x100e10c0
je 0x10059b4c
mov eax, edi
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.10018910
mov dword [esp + 0x284], 1
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x18]
call fcn.10058f30
mov byte [esp + 0x284], 2
push 0x24c
lea edx, [esp + 0x30]
push 0
push edx
mov dword [esp + 0x34], 0
call fcn.1007fda0
mov ecx, dword [esp + 0x20]
add esp, 0xc
lea eax, [esp + 0x28]
push eax
push ecx
xor bl, bl
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 0x20], esi
mov byte [esp + 0x284], 3
cmp esi, 0xffffffff
jne 0x10059be1
mov byte [esp + 0x284], 1
lea ecx, [esp + 0x18]
call fcn.10001df0
mov dword [esp + 0x284], esi
lea ecx, [esp + 0x14]
call fcn.10001df0
xor al, al
jmp 0x10059cfa
mov edi, dword [esp + 0x298]
jmp 0x10059bf0
mov eax, dword [esp + 0x28]
cmp eax, 0xffffffff
je 0x10059c94
mov ecx, dword [esp + 0x294]
mov edx, eax
xor edx, edi
test ecx, edx
jne 0x10059c94
test al, 0x10
je 0x10059c34
cmp word [esp + 0x54], 0x2e
jne 0x10059c34
mov ax, word [esp + 0x56]
cmp ax, 0x2e
jne 0x10059c2f
cmp word [esp + 0x58], 0
jmp 0x10059c32
test ax, ax
je 0x10059c94
lea edx, [esp + 0x54]
push edx
lea ecx, [esp + 0x20]
mov bl, 1
call fcn.10001a70
mov byte [esp + 0x284], 7
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x2c]
call fcn.10018910
mov byte [esp + 0x284], 8
mov edx, dword [ebp]
push eax
mov eax, dword [edx + 0x10]
mov ecx, ebp
call eax
mov byte [esp + 0x284], 7
lea ecx, [esp + 0x24]
call fcn.10001df0
mov byte [esp + 0x284], 3
lea ecx, [esp + 0x1c]
call fcn.10001df0
lea ecx, [esp + 0x28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10059bf0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x10059cc2
push 0x307
push str..FilePath.cpp
call fcn.100167a0
mov byte [esp + 0x284], 2
lea ecx, [esp + 0x20]
call fcn.10058970
mov byte [esp + 0x284], 1
lea ecx, [esp + 0x18]
call fcn.1001a900
mov dword [esp + 0x284], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.1001a900
mov al, bl
mov ecx, dword [esp + 0x27c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x264]
xor ecx, esp
call fcn.1007c94c
add esp, 0x274
ret 0x10
Function at 0x10059d30
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009ee50
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100d8dd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
call fcn.100586a0
mov dword [ebp - 4], 0xffffffff
jmp 0x10059d85
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10059d9c
push 0
push 0
call fcn.100167a0
shr eax, 4
test al, 1
mov eax, dword [esi]
push eax
je 0x10059dc4
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x10059de2
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10059de2
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esi]
push 0x44d
push str..FilePath.cpp
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call fcn.10014420
add esp, 0xc
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005d230
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1009f815
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x100d8dd0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.CDevDriverSnapshot.0
mov dword [esp + 0x10], ecx
call fcn.1001a7c0
mov dword [esp + 0x1c], 1
lea ecx, [esi + 8]
call fcn.1001a7c0
mov byte [esp + 0x1c], 2
lea ecx, [esi + 0xc]
call fcn.1001a7c0
mov byte [esp + 0x1c], 3
xor edi, edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
call fcn.1001a7c0
mov byte [esp + 0x1c], 4
lea ecx, [esi + 0x34]
call fcn.1001a7c0
mov byte [esp + 0x1c], 5
mov eax, 0xa
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], eax
mov byte [esp + 0x1c], 6
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], eax
mov byte [esp + 0x1c], 7
mov eax, dword [esp + 0x24]
push eax
mov ecx, esi
call fcn.10015160
mov dword [esp + 0x1c], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 4

Function at 0x1005f650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009fce1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
mov eax, dword [0x100d8dd0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], 1
push str.OriginalInfSourcePath
lea ecx, [esp + 0x14]
call fcn.10001a70
mov byte [esp + 0x3c], 2
push str.nv_CoInstaller_Data
lea ecx, [esp + 0x10]
call fcn.10001a70
mov byte [esp + 0x3c], 3
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x4c]
lea eax, [esp + 0x28]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
push edx
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x28], 0x100b1960
mov dword [esp + 0x2c], 0xffffffff
call fcn.1005e9c0
add esp, 0x10
mov byte [esp + 0x3c], 2
lea ecx, [esp + 0xc]
call fcn.10001df0
mov byte [esp + 0x3c], 1
lea ecx, [esp + 0x10]
call fcn.10001df0
cmp dword [esp + 0x28], 1
je 0x1005f725
push ebx
push 0xe8b
push str..DevContext.cpp
push 0xe0e00012
call fcn.10001ed0
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x44]
push edx
mov ecx, esi
call fcn.100154e0
mov dword [esp + 0x14], 1
mov byte [esp + 0x3c], bl
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x1005f761
mov ecx, dword [esp + 0x28]
push ecx
push eax
call fcn.10015f00
mov edx, dword [esp + 0x2c]
push edx
call fcn.1007d7a6
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x34
ret
Function at 0x10063590
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1009ea79
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x100d8dd0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov esi, dword [esp + 0x28]
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x100635fb
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
push ecx
mov ecx, esi
call fcn.10001d70
mov dword [esp + 0x18], 0
mov dword [esp + 8], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
mov eax, dword [esp + 0x24]
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
jne 0x10063636
push esi
mov esi, dword [esp + 0x24]
mov ecx, esi
call fcn.10001d70
mov dword [esp + 0x18], 0
mov dword [esp + 8], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.10062840
add esp, 8
mov dword [esp + 0x18], 1
push 0x5c
lea ecx, [esp + 0x2c]
call fcn.100537b0
lea ecx, [esp + 0xc]
push esi
push ecx
call fcn.100628f0
add esp, 8
mov byte [esp + 0x18], 2
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x30]
call fcn.10051ae0
mov byte [esp + 0x18], 1
lea ecx, [esp + 0xc]
call fcn.10001df0
mov esi, dword [esp + 0x20]
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.10001d70
mov dword [esp + 8], 1
mov byte [esp + 0x18], 0
lea ecx, [esp + 0x28]
call fcn.10001df0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x10063f80
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x100a0930
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100d8dd0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x34]
xor ebx, ebx
cmp esi, ebx
jne 0x10063fc7
push ebx
push 0x4f9
push str..Registry.cpp
push 0x80004003
call fcn.10001ed0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
mov eax, dword [esi]
mov edx, dword [eax + 4]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call edx
push ebx
push 2
lea eax, [esp + 0x3c]
push eax
mov ecx, edi
call fcn.10063e90
mov byte [esp + 0x28], 1
mov edx, dword [esp + 0x14]
cmp edx, 0xffffffff
jbe 0x1006401b
push ebx
push 0x20f
push str.c:dvsp4_build_sw_relgpu_drv_r265_r265_36installer2.0incNVI2Defns.h
push 0x80070057
call fcn.10001ed0
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
mov ecx, dword [esp + 0x34]
mov esi, dword [esi + 4]
cmp ecx, ebx
jne 0x10064041
push ebx
push 0x181
push str.c:dvsp4_build_sw_relgpu_drv_r265_r265_36installer2.0incRefCounted.h
push 0x80004003
call fcn.10001ed0
push edx
mov edx, dword [esp + 0x14]
push edx
push esi
push ebx
push eax
mov eax, dword [ecx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
je 0x10064075
jle 0x10064064
and eax, 0xffff
or eax, 0x80070000
push ebx
push 0x503
push str..Registry.cpp
push eax
call fcn.10001ed0
mov byte [esp + 0x28], bl
mov ecx, dword [esp + 0x34]
cmp ecx, ebx
je 0x1006408a
mov dword [esp + 0x34], ebx
call fcn.10018330
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x100640a3
push eax
call fcn.1007d7a6
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 8
Function at 0x10064450
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a09a0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100d8dd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
mov ebx, 1
mov byte [ebp - 4], bl
push edi
push 2
lea eax, [ebp - 0x18]
push eax
call fcn.10063e90
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x14]
call fcn.10016ee0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.10018380
mov dword [ebp - 4], edi
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov esi, dword [ebp - 0x14]
cmp esi, edi
jne 0x100644d6
push edi
push 0x181
push str.c:dvsp4_build_sw_relgpu_drv_r265_r265_36installer2.0incRefCounted.h
push 0x80004003
call fcn.10001ed0
push eax
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
je 0x10064520
cmp eax, ebx
jle 0x10064501
cmp eax, 3
jg 0x10064501
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
mov dword [ebp - 0x14], edi
call fcn.10018330
jmp 0x1006457f
cmp eax, edi
jle 0x1006450f
and eax, 0xffff
or eax, 0x80070000
push edi
push 0x652
push str..Registry.cpp
push eax
call fcn.10001ed0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
mov dword [ebp - 0x14], edi
call fcn.10018330
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4