joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001786c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400178b8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400178b0
cmp dword [rcx + 0x3c], edx
jl 0x1400178b0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400178b0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400178b8
mov rax, rdx
add rsp, 0x18
ret

Function at 0x14001be40
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
and qword [rcx + 0x18], 0
mov rbx, rcx
and qword [rcx + 0x20], 0
xor edx, edx
and qword [rcx + 0x28], 0
mov r8d, 0x800
and qword [rcx + 0x30], 0
and qword [rcx + 0x38], 0
mov byte [rcx + 0x10], 0
lea rcx, str.amsi.dll
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
nop dword [rax + rax]
mov qword [rbx], rax
test rax, rax
je 0x14001bf62
lea rdx, str.AmsiInitialize
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbx]
lea rdx, str.AmsiUninitialize
mov qword [rbx + 0x18], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbx]
lea rdx, str.AmsiScanBuffer
mov qword [rbx + 0x28], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbx]
lea rdx, str.AmsiOpenSession
mov qword [rbx + 0x20], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbx]
lea rdx, str.AmsiCloseSession
mov qword [rbx + 0x30], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
cmp qword [rbx + 0x18], 0
mov qword [rbx + 0x38], rax
je 0x14001bf4d
cmp qword [rbx + 0x20], 0
je 0x14001bf4d
cmp qword [rbx + 0x28], 0
je 0x14001bf4d
cmp qword [rbx + 0x30], 0
je 0x14001bf4d
test rax, rax
je 0x14001bf4d
mov rax, qword [rbx + 0x18]
lea rdx, [rbx + 8]
lea rcx, str.VSSAMSI
call qword [0x1400faf30]
test eax, eax
js 0x14001bf4d
mov byte [rbx + 0x10], 1
cmp byte [rbx + 0x10], 0
jne 0x14001bf62
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140044514
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
and qword [rcx + 8], 0
xorps xmm0, xmm0
and dword [rcx + 0x18], 0
xor eax, eax
and qword [rcx + 0x20], 0
mov rbx, rcx
and dword [rcx + 0x28], 0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
mov qword [rcx + 0x50], rax
mov byte [rcx + 0x58], al
add rcx, 0x60
call fcn.14001b8a8
and qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
lea rdi, [rbx + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov dword [rdi], 1
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftOle
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400445fc
and dword [rsp + 0x48], eax
lea r9, [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.EnableATLEnumClassLock
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x40], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
cmp dword [rsp + 0x48], 4
mov ecx, 0xd
cmovne eax, ecx
test eax, eax
je 0x1400445eb
mov dword [rdi], 1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
lea rax, [0x1400f9a08]
mov qword [rbx], rax
call fcn.140012130
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400c7550
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x810]
sub rsp, 0x910
mov rax, qword [0x1401613e0]
xor rax, rsp
mov qword [rbp + 0x800], rax
mov rdi, rcx
call qword [sym.imp.VssTrace.DLL_Ordinal_11]
nop dword [rax + rax]
cmp eax, dword [rdi + 4]
je 0x1400c76c4
mov rdx, qword [rdi + 0x28]
lea r8, [rsp + 0x50]
mov ecx, dword [rdi + 0x24]
xor ebx, ebx
mov dword [rsp + 0x50], ebx
mov dword [rdi + 4], eax
call qword [sym.imp.VssTrace.DLL_Ordinal_8]
nop dword [rax + rax]
test eax, eax
je 0x1400c75be
mov eax, dword [rsp + 0x50]
jmp 0x1400c75da
mov rcx, qword [rdi + 0x60]
test rcx, rcx
je 0x1400c75ce
call fcn.1400c3f00
jmp 0x1400c75da
call qword [sym.imp.VssTrace.DLL_Ordinal_6]
nop dword [rax + rax]
mov dword [rdi], eax
mov eax, dword [rdi + 4]
cmp dword [0x140161400], eax
je 0x1400c76c4
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x800
call sub.msvcrt.dll_memset
lea rdx, [rbp]
call fcn.1400c39a4
lea rax, str.base_stor_vssmodules_trace_fntracer.cpp
mov dword [rsp + 0x70], 0x24f
mov qword [rsp + 0x58], rax
lea rcx, [rbp - 0x80]
xor edx, edx
mov dword [rsp + 0x74], reloc.VssTrace.DLL_Ordinal_11
lea rax, str.CVssFunctionTracer::UpdateLocalIsTracingEnabledFlag
mov dword [rsp + 0x78], 0xff
mov qword [rsp + 0x60], rax
lea rax, str.TRCTRCC
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 0x78]
mov dword [rbp - 8], 0x1000000
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
nop dword [rax + rax]
mov rbx, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
nop dword [rax + rax]
mov ecx, dword [rdi + 4]
lea r8, str.TRACING_STARTED
mov dword [rsp + 0x48], ecx
lea rdx, [rsp + 0x58]
mov ecx, dword [0x140161400]
mov r9d, 0x78
mov dword [rsp + 0x40], ecx
lea rcx, [rbp]
mov qword [rsp + 0x38], rcx
mov rcx, rdi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
lea rax, str.Tracing_started_or_updated._PID_d__CommandLine__s___UserName__s_._SQN__d_____d_
mov qword [rsp + 0x20], rax
call fcn.140004730
mov eax, dword [rdi + 4]
mov dword [0x140161400], eax
mov rcx, qword [rbp + 0x800]
xor rcx, rsp
call fcn.140017100
lea r11, [rsp + 0x910]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400daa4c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
lea r12, str.base_stor_vssmodules_registry_registry.cxx
mov qword [rsp + 0x40], r12
lea r13, str.CVssRegistryKey::SetBinaryValue
mov qword [rsp + 0x48], r13
lea rax, str.REGREGSC
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x16a
mov dword [rsp + 0x5c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rsp + 0x60], 0xff
mov dword [rbp - 0x20], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x68]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.1400c21a0
nop
mov dword [rsp + 0x28], 0x48
mov qword [rsp + 0x20], rsi
mov r9d, 3
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x1400dab9e
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r13
lea rax, str.REGREGSC
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x17d
mov dword [rsp + 0x5c], reloc.VssTrace.DLL_Ordinal_11
mov dword [rsp + 0x60], 0xff
mov dword [rbp - 0x20], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x68]
call sub.msvcrt.dll_memset
mov rcx, qword [rdi + 0x18]
test ebx, ebx
jle 0x1400dab6a
movzx ebx, bx
or ebx, 0x80070000
mov dword [rsp + 0x38], 0x48
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rcx
mov rax, qword [rdi + 8]
mov qword [rsp + 0x20], rax
lea r9, str.RegSetValueExW_0x_08lx__s_0_REG_BINARY__p._lu_
mov r8d, ebx
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.1400c6008
nop
lea rcx, [rbp - 0x10]
call fcn.140006990
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x180001096
Capabilities:
Parse pe header

Disassembly:
jmp 0x1800ace0c
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1800acbd7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800acbd7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1800acbd7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1800acbd7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1800acbd7
cmp dword [rcx + 0x84], 0xe
jbe 0x1800acbd7
cmp dword [rcx + 0xf8], 0
je 0x1800acbd7
mov ecx, ebx
call fcn.1800acd68
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1800ac8e8
cmp dword [rbp + 0x20], 0
je 0x1800acc24
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1800acc5c
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1800acb70

Function at 0x180001195
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1800c33e0
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1801131b8]
mov ecx, 5
lea r8, [0x1801131b0]
lea rdx, str.FlsGetValue
call fcn.1800c29d8
mov ecx, ebx
test rax, rax
je 0x1800c341a
add rsp, 0x20
pop rbx
jmp qword [case.0x18007552e.0]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x180001343
Capabilities:
Delete file
Get file size

Disassembly:
jmp 0x180058540
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov esi, edx
mov rbx, rcx
lea rax, vtable.FileWriter.0
mov qword [rcx], rax
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x18005862f
mov dil, 1
xor eax, eax
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop
test eax, eax
je 0x18005859e
movzx edi, dil
xor eax, eax
cmp qword [rsp + 0x40], rax
cmovg edi, eax
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test eax, eax
jne 0x1800585de
mov dword [0x180132050], 7
cmp dword [0x18013218c], 7
jg 0x1800585de
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov r8d, eax
lea rdx, str.FileWriter::FileWriter:_Cannot_close_handle___errno___d
lea rcx, vtable.CLogger.0
call fcn.1800024fa
nop
mov qword [rbx + 8], 0xffffffffffffffff
test dil, dil
je 0x18005862f
lea rcx, [rbx + 0x12]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
test eax, eax
jne 0x18005862f
mov dword [0x180132050], 7
cmp dword [0x18013218c], 7
jg 0x18005862f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov r9d, eax
lea r8, [rbx + 0x12]
lea rdx, str.FileWriter::FileWriter:_could_not_delete_empty_file__s__errno___d
lea rcx, vtable.CLogger.0
call fcn.1800024fa
nop
test sil, 1
je 0x180058643
mov edx, 0x118
mov rcx, rbx
call fcn.180001bf4
nop
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180001370
Capabilities:
Check if file exists

Disassembly:
jmp 0x180013fc0
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x30
mov rbx, rcx
xor ebp, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x1800141ee
xor edx, edx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], dx
jne 0x180013ff0
test rax, rax
je 0x180014024
xor ecx, ecx
movzx r8d, word [rbx + rcx*2]
cmp r8w, 0x5c
je 0x1800141ee
cmp r8w, 0x2f
je 0x1800141ee
inc edx
mov ecx, edx
cmp rcx, rax
jb 0x180014000
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x48], rdi
call fcn.180001c85
mov rsi, rax
test rax, rax
je 0x18001411e
mov qword [rsp + 0x50], r14
call fcn.180001e6a
mov r14, rax
test rax, rax
je 0x18001410b
mov rcx, rsi
call fcn.18000e490
test eax, eax
je 0x1800140f4
lea rax, str.system32_
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x20]
lea rax, str.SystemRoot_system32_
mov qword [rsp + 0x28], rax
nop word [rax + rax]
mov rdx, qword [rdi]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rdx + rbx*2], bp
jne 0x1800140a0
mov r8, rbx
mov rcx, rsi
call fcn.180002aa9
test eax, eax
je 0x1800140c8
add rdi, 8
lea rax, [rsp + 0x30]
cmp rdi, rax
jb 0x180014090
jmp 0x1800140d7
lea rdx, [rsi + rbx*2]
mov rcx, r14
call fcn.180012360
mov rbp, rax
lea rax, [rsp + 0x30]
cmp rdi, rax
jne 0x180014102
mov rcx, rsi
call fcn.18000e420
test eax, eax
je 0x180014102
mov rbp, rsi
xor esi, esi
jmp 0x180014102
mov rdx, rsi
mov rcx, r14
call fcn.180012360
mov rbp, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x50]
jmp 0x1800141ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x1800141c3
mov rcx, rbx
call fcn.18000e2f0
mov rdi, rax
test rax, rax
je 0x1800141c3
mov ecx, 0x37e4
call fcn.180011c20
test eax, eax
je 0x180014158
xor ecx, ecx
call fcn.1800024d2
jmp 0x18001415d
call fcn.180001e6a
mov rbx, rax
test rax, rax
je 0x1800141b1
mov rdx, rdi
mov rcx, rax
call fcn.180012360
mov rbp, rax
test rax, rax
je 0x1800141a8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18001418a
test al, 0x50
je 0x1800141a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x18001419d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ebp, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbp, rbp
je 0x1800141c3
xor ecx, ecx
jmp 0x1800141d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1800141d6
lea ecx, [rax + 0x7e]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsp + 0x48]
mov rax, rbp
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rbp
ret
Function at 0x18000144c
Capabilities:
Get file size
Write file on windows

Disassembly:
jmp 0x18006ae50
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x18013218c], 6
mov rdi, rcx
mov dword [0x180132050], 6
jg 0x18006ae88
lea rdx, str.CH265EncodeVideo::DeleteInstance:_IN
lea rcx, vtable.CLogger.0
call fcn.1800024fa
lea rcx, [rdi + 8]
call fcn.180005277
mov esi, eax
test eax, eax
jns 0x18006aede
lfence
lea rcx, [rdi + 8]
call fcn.1800013a7
cmp dword [0x18013218c], 7
mov dword [0x180132050], 7
jg 0x18006aef5
lfence
mov r8d, esi
lea rdx, str.CH265EncodeVideo::DeleteInstance:_EventListener_stop_failed._0x_08X
lea rcx, vtable.CLogger.0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800024fa
test rdi, rdi
je 0x18006aef5
lfence
mov rax, qword [rdi + 8]
lea rcx, [rdi + 8]
mov edx, 1
call qword [rax]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180001834
Capabilities:
Get file size
Write file on windows

Disassembly:
jmp 0x1800459b0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.180005277
mov edi, eax
test eax, eax
jns 0x180045a09
lfence
mov rcx, rbx
call fcn.1800013a7
cmp dword [0x18013218c], 7
mov dword [0x180132050], 7
jg 0x180045a1e
lfence
mov r8d, edi
lea rdx, str.AudioCapture::DeleteInstance:_AudioCapture_stop_failed._0x_08X
lea rcx, vtable.CLogger.0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800024fa
test rbx, rbx
je 0x180045a1e
lfence
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180001988
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x1800d8130
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
add r8, rcx
mov r10, rdx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
test r11d, r11d
je 0x1800d8171
mov edx, dword [rax + 0xc]
cmp r10, rdx
jb 0x1800d8165
mov ecx, dword [rax + 8]
add ecx, edx
cmp r10, rcx
jb 0x1800d8173
inc r9d
add rax, 0x28
cmp r9d, r11d
jb 0x1800d8153
xor eax, eax
ret
Function at 0x180001e56
Capabilities:
Terminate process

Disassembly:
jmp 0x180075dbc
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x180001e5b
Capabilities:
Get common file path

Disassembly:
jmp 0x18001fbe0
push rdi
sub rsp, 0x280
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x298], rbx
mov rax, qword [0x180135088]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x58], rcx
call fcn.180003251
nop
lea rax, str.FrameProviderCreateInterface
mov qword [rsp + 0x48], rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.180003a85
mov qword [rsp + 0x40], 0
lea r9, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
lea rcx, [0x18010c3a0]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jns 0x18001fc80
mov dword [0x180132050], 7
cmp dword [0x18013218c], 7
jg 0x18001fd1c
lea rdx, str.CFrameProviderDll::Initialize:_SHGetKnownFolderPath_failed.HRESULT__0x_08X
jmp 0x18001fd09
lea rax, str.nvfp64.dll
mov qword [rsp + 0x30], rax
lea rax, str.NVIDIA_CorporationShadowPlay
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, str._s_s_s
mov edx, 0x104
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x60]
call fcn.180002bfd
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x40], 0
mov r9d, 1
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1800032e2
test eax, eax
jns 0x18001fd1c
mov dword [0x180132050], 7
cmp dword [0x18013218c], 7
jg 0x18001fd1c
lea rdx, str.CFrameProviderDll::Initialize:_InitializeSystemDll_failed_0x_08X_
lfence
mov r8d, eax
lea rcx, vtable.CLogger.0
call fcn.1800024fa
nop
mov dword [rbx + 0x18], edi
mov qword [rbx + 0x20], 0
mov rax, rbx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180002397
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rdi
ret

Function at 0x180001e6a
Capabilities:
Get common file path

Disassembly:
jmp 0x1800154e0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov ecx, 0x40
add rdx, rdx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x180015542
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x180015537
cmp edi, eax
jb 0x180015537
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000212b
Capabilities:
Get common file path

Disassembly:
jmp 0x1800730b0
push rbx
sub rsp, 0x250
mov rax, qword [0x180135088]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x1800732ad
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x180073120
cmp dword [0x18013218c], 7
mov dword [0x180132050], 7
jg 0x18007311c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.NvFBCDLL::LoadNVFBCDll:_GetSystemDirectoryW_failed._gle___X_
lea rcx, vtable.CLogger.0
call fcn.1800024fa
xor eax, eax
jmp 0x18007319c
cmp eax, 0x104
jbe 0x18007315d
cmp dword [0x18013218c], 7
mov dword [0x180132050], 7
jg 0x18007311c
lfence
mov r9d, 0x104
lea rdx, str.NvFBCDLL::LoadNVFBCDll:_Given_string_buffer_size_is_insufficient._required__d__provided__d_
mov r8d, eax
lea rcx, vtable.CLogger.0
call fcn.1800024fa
xor eax, eax
jmp 0x18007319c
lea rax, str.NvFBC64.dll
mov edx, 0x104
mov qword [rsp + 0x28], rax
lea r9, str._s_s
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.180002bfd
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180003b8e
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x1800731d4
cmp dword [0x18013218c], 7
mov dword [0x180132050], 7
jg 0x1800732ad
lea rdx, str.NvFBCDLL::Initialize:_failed_to_load_NVFBC_DLL
lea rcx, vtable.CLogger.0
call fcn.1800024fa
jmp 0x1800732ad
lea rdx, str.NvFBC_GetStatusEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
jne 0x18007321b
cmp dword [0x18013218c], 7
mov dword [0x180132050], 7
jg 0x18007321b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.NvFBCDLL::Initialize:_Failed_to_get_fptr_for_NvFBC_GetStatusEx._gle___X_
lea rcx, vtable.CLogger.0
call fcn.1800024fa
mov rcx, qword [rbx + 0x18]
lea rdx, str.NvFBC_CreateEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 8], rax
test rax, rax
jne 0x180073264
cmp dword [0x18013218c], 7
mov dword [0x180132050], 7
jg 0x180073264
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.NvFBCDLL::Initialize:_Failed_to_get_fptr_for_NvFBC_CreateEx._gle___X_
lea rcx, vtable.CLogger.0
call fcn.1800024fa
mov rcx, qword [rbx + 0x18]
lea rdx, str.NvFBC_SetGlobalFlags
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1800732ad
cmp dword [0x18013218c], 7
mov dword [0x180132050], 7
jg 0x1800732ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.NvFBCDLL::Initialize:_Failed_to_get_fptr_for_NvFBC_SetGlobalFlags_._gle___X_
lea rcx, vtable.CLogger.0
call fcn.1800024fa
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180002397
add rsp, 0x250
pop rbx
ret