joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005f40
Capabilities:
Check if file exists
Get file attributes
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140065340]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
lea rdx, [rsp + 0x40]
lea rcx, str.allusersprofile
mov r8d, 0x104
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140005fb1
lea r9, [rsp + 0x40]
lea r8, [0x14004f650]
lea rcx, [rdi + 0x58]
mov edx, 0x400
call fcn.140007df0
test eax, eax
js 0x140005fb1
lea rcx, [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000611f
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000606a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.Common_AppData
xor r8d, r8d
mov dword [rsp + 0x34], 0x20a
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140006057
cmp dword [rsp + 0x30], 1
jne 0x140006057
lea r9, [rsp + 0x40]
lea r8, [0x14004f650]
lea rcx, [rdi + 0x58]
mov edx, 0x400
call fcn.140007df0
test eax, eax
js 0x140006055
lea rcx, [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140006055
mov ebx, 1
jmp 0x140006057
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14000611f
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006127
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.NVDRS_PATH
xor r8d, r8d
mov dword [rsp + 0x30], 0x20a
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140006110
cmp dword [rsp + 0x34], 1
jne 0x140006110
lea r9, [rsp + 0x40]
lea r8, [0x14004f650]
lea rcx, [rdi + 0x58]
mov edx, 0x400
call fcn.140007df0
test eax, eax
js 0x14000610e
lea rcx, [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000610e
mov ebx, 1
jmp 0x140006110
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140006127
or dword [rdi + 0x50], 0x20
xor eax, eax
jmp 0x14000612c
mov eax, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400215b0
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
Function at 0x140006150
Capabilities:
Check if file exists
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x860
mov rax, qword [0x140065340]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rbx, rcx
lea rcx, str.kernel32
xor edi, edi
mov dword [rsp + 0x30], edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x1400061b6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
call rsi
test eax, eax
je 0x1400061ff
cmp dword [rsp + 0x30], edi
je 0x1400061ff
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400061e8
mov eax, 8
jmp 0x14000630e
lea rcx, [rbx + 0x48]
call rax
test eax, eax
je 0x1400061de
or dword [rbx + 0x50], 0x40
lea rcx, str.ProgramW6432
jmp 0x140006206
lea rcx, str.ProgramFiles
lea rdx, [rsp + 0x40]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000624c
lea r9, [rsp + 0x40]
lea r8, [0x14004f650]
lea rcx, [rbx + 0x58]
mov edx, 0x400
call fcn.140007df0
test eax, eax
js 0x14000624c
lea rcx, [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140006301
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006309
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.NVDRS_GOLD_PATH
xor r8d, r8d
mov dword [rsp + 0x30], 0x802
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400062f2
cmp dword [rsp + 0x34], 1
jne 0x1400062f2
lea r9, [rsp + 0x40]
lea r8, [0x14004f650]
lea rcx, [rbx + 0x58]
mov edx, 0x400
call fcn.140007df0
test eax, eax
js 0x1400062f0
lea rcx, [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400062f0
mov edi, 1
jmp 0x1400062f2
xor edi, edi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x140006309
or dword [rbx + 0x50], 0x20
xor eax, eax
jmp 0x14000630e
mov eax, 1
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1400215b0
lea r11, [rsp + 0x860]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140006340
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.kernel32
mov dword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x14000638e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x38]
mov rcx, rax
call rdi
test eax, eax
je 0x1400063d5
cmp dword [rsp + 0x38], 0
je 0x1400063d5
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400063c7
mov eax, 8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [rbx + 0x48]
call rax
test eax, eax
je 0x1400063b7
or dword [rbx + 0x50], 0x40
lea rcx, [rbx + 0x58]
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400063b7
or dword [rbx + 0x50], 0x20
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x140006540
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x840
mov rax, qword [0x140065340]
xor rax, rsp
mov qword [rsp + 0x830], rax
test byte [rcx + 0x50], 0x20
mov rbx, rcx
jne 0x140006571
call fcn.140005e70
test eax, eax
jne 0x140006690
lea rax, str.nvdrssel.bin
add rbx, 0x58
lea r8, str._s_s
lea rcx, [rsp + 0x30]
mov edx, 0x400
mov r9, rbx
mov qword [rsp + 0x20], rax
call fcn.140007df0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, str.nvdrswr.lk
lea r8, str._s_s
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.140007df0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, str.update.bin
lea r8, str._s_s
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.140007df0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, str._s_nvdrsdb_d.bin
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov qword [rsp + 0x20], 0
call fcn.140007df0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, str._s_nvdrsdb_d.bin
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov dword [rsp + 0x20], 1
call fcn.140007df0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, str.nvAppTimestamps
lea r8, str._s_s
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.140007df0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.1400215b0
add rsp, 0x840
pop rbx
ret
add rcx, 0x838
jmp 0x140006540
Function at 0x140006730
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x860
mov rax, qword [0x140065340]
xor rax, rsp
mov qword [rsp + 0x850], rax
test byte [rcx + 0x50], 0x20
mov rdi, rdx
mov rbx, rcx
jne 0x140006768
call fcn.140005e70
test eax, eax
jne 0x140006815
lea rax, str.nvdrssel.bin
lea r9, [rbx + 0x58]
lea r8, str._s_s
lea rcx, [rsp + 0x50]
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.140007df0
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 3]
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400067d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call fcn.140005dc0
mov eax, 8
jmp 0x140006815
or dword [rbx + 0x50], 0x10
lea r9, [rsp + 0x40]
mov r8d, 1
mov rdx, rdi
mov rcx, rax
mov qword [rbx + 0x20], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140006810
cmp dword [rsp + 0x40], 1
jne 0x140006810
xor eax, eax
jmp 0x140006815
mov eax, 0xf
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1400215b0
mov rbx, qword [rsp + 0x880]
add rsp, 0x860
pop rdi
ret

Function at 0x140006840
Capabilities:
Write file on windows

Disassembly:
mov byte [rsp + 0x10], dl
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x140006899
mov rcx, qword [rbx + 0x20]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov r8d, 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140006899
cmp dword [rsp + 0x40], 1
jne 0x140006899
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov rcx, rbx
call fcn.140005dc0
mov eax, 8
add rsp, 0x30
pop rbx
ret

Function at 0x1400068b0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov esi, edx
xor edx, edx
mov rdi, r9
mov r14d, r8d
mov r15, rcx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
je 0x14000698b
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], r12
mov r12d, 1
mov ecx, r12d
mov rdx, rbp
call fcn.140021380
mov rbx, rax
test rax, rax
je 0x14000697f
mov r9, rax
mov r8d, ebp
xor edx, edx
mov rcx, r15
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140006977
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [0x14004f64c]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140006977
mov rax, qword [rsp + 0x28]
movzx edx, word [rax + 0xa]
mov dword [rdi], 0
test r14d, r14d
jne 0x14000695b
cmp edx, esi
jb 0x14000696a
mov rcx, rbx
mov dword [rdi], r12d
call fcn.1400213c4
mov eax, r12d
jmp 0x140006981
cmp edx, esi
jb 0x14000696a
mov ecx, dword [rdi]
cmp edx, r14d
cmovbe ecx, r12d
mov dword [rdi], ecx
mov rcx, rbx
call fcn.1400213c4
mov eax, r12d
jmp 0x140006981
mov rcx, rbx
call fcn.1400213c4
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140006d40
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rsi, rdx
mov rbx, rcx
mov edi, ebp
nop
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x140006de0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x140006dbe
cmp eax, 2
je 0x140006dbe
cmp edi, 0xbb8
jae 0x140006dbe
mov ecx, 0x3c
call qword [sym.imp.KERNEL32.dll_Sleep]
add edi, 0x3c
cmp edi, 0xbb8
jb 0x140006d60
mov rcx, rbx
call fcn.140005dc0
mov eax, 8
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
or dword [rbx + 0x50], 8
lea rdx, [rsp + 0x60]
mov rcx, rax
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140006dbe
cmp dword [rsp + 0x64], ebp
jne 0x140006dbe
mov edx, dword [rsp + 0x60]
mov rcx, rbx
call fcn.140007270
test eax, eax
jne 0x140006dbe
mov rax, qword [rsp + 0x60]
lea rcx, [rbx + 0x58]
mov r8d, 0x400
mov dword [rbx + 8], eax
mov dword [rbx + 0xc], eax
mov rax, qword [rbx]
mov rdx, rsi
mov qword [rbx + 0x10], rax
call fcn.140007b60
xor eax, eax
jmp 0x140006dcb

Function at 0x140007130
Capabilities:
Clear file content
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rbx, rdx
mov rsi, rcx
mov edi, ebp
nop
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400071cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x1400071ad
cmp eax, 2
je 0x1400071ad
cmp edi, 0xbb8
jae 0x1400071ad
mov ecx, 0x3c
call qword [sym.imp.KERNEL32.dll_Sleep]
add edi, 0x3c
cmp edi, 0xbb8
jb 0x140007150
mov rcx, rsi
call fcn.140005dc0
mov eax, 8
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov r8d, dword [rsi + 0xc]
mov rdx, qword [rsi]
or dword [rsi + 0x50], 8
lea r9, [rsp + 0x60]
mov rcx, rax
mov qword [rsi + 0x28], rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
je 0x140007201
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [rsi + 0x50], 0xfffffff7
mov qword [rsi + 0x28], rbp
test edi, edi
je 0x1400071ad
mov eax, dword [rsi + 0xc]
cmp dword [rsp + 0x60], eax
jne 0x1400071ad
lea rax, [rsi + 0x58]
test rax, rax
je 0x140007257
test rbx, rbx
je 0x140007257
mov edx, ebp
cmp word [rbx], dx
je 0x140007254
sub rbx, rax
cmp edx, 0x400
ja 0x140007254
movzx ecx, word [rbx + rax]
add rax, 2
inc edx
mov word [rax - 2], cx
cmp word [rbx + rax], bp
jne 0x140007238
mov word [rax], bp
xor eax, eax
jmp 0x1400071ba
Function at 0x140007300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov rdi, qword [rsp + 0x38]
xor ebp, ebp
mov r14, r9
mov word [rcx + 0x7fe], bp
mov dword [r9], ebp
mov ebx, ebp
mov dword [rdi], ebp
mov rsi, rcx
mov r11d, ebp
mov rdx, rcx
mov r10, rcx
mov r9d, ebp
cmp word [rcx], bx
je 0x14000736f
cmp r9d, 0x400
jae 0x14000736f
movzx ecx, word [r10]
lea eax, [rcx - 0x41]
cmp ax, 0x19
ja 0x140007362
add cx, 0x20
mov word [r10], cx
add r10, 2
inc r9d
cmp word [r10], bx
jne 0x140007344
mov r15d, 0x2f
cmp word [rsi], bx
je 0x140007399
nop word [rax + rax]
cmp word [rdx], 0x5c
jne 0x140007390
mov word [rdx], r15w
mov dword [rdi], 1
add rdx, 2
cmp word [rdx], bx
jne 0x140007380
movzx eax, word [rsi]
mov rcx, rsi
test ax, ax
je 0x1400073d4
cmp ax, 0x22
jne 0x1400073b8
xor ebx, 1
test r11, r11
jne 0x1400073c7
lea r11, [rcx + 2]
jmp 0x1400073c7
cmp ax, 0x20
jne 0x1400073c7
test ebx, ebx
jne 0x1400073c7
test r8d, r8d
jne 0x1400073d4
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x1400073a4
test r11, r11
mov edx, ebp
setne dl
test r11, r11
cmove r11, rsi
cmp rcx, r11
jbe 0x140007408
mov r8d, 0xffdd
nop
movzx eax, word [rcx]
test r8w, ax
jne 0x140007413
cmp ax, 2
je 0x140007413
sub rcx, 2
cmp rcx, r11
ja 0x1400073f0
mov word [r11], bp
xor eax, eax
jmp 0x1400074dd
lea rax, [r11 + 6]
cmp rcx, rax
jb 0x14000743b
cmp word [rcx - 6], 0x2e
jne 0x14000743b
cmp word [rcx - 4], 0x65
jne 0x14000743b
cmp word [rcx - 2], 0x78
jne 0x14000743b
cmp word [rcx], 0x65
je 0x1400074cf
lea r9, [rcx + 0xa]
lea rax, [rsi + 0x800]
cmp r9, rax
jae 0x1400074cf
test edx, edx
jne 0x140007492
mov rdx, rcx
cmp word [rcx], bp
je 0x140007492
mov r10d, 0x4c5c
movzx r8d, word [rdx]
cmp r8w, 0x2e
je 0x1400074b4
cmp r8w, 0x22
je 0x140007492
cmp r8w, 0x5c
mov eax, ebp
sete al
or dword [rdi], eax
cmp word [rdx], r10w
jne 0x140007489
mov word [rdx], r15w
add rdx, 2
cmp word [rdx], bp
jne 0x140007461
cmp dword [r14], ebp
jne 0x1400074da
test byte [rsi + 0x818], 2
je 0x1400074da
mov dword [rcx + 2], 0x65002e
mov dword [rcx + 6], 0x650078
mov word [r9], bp
jmp 0x1400074da
cmp word [rdx + 2], 0x65
jne 0x140007492
cmp word [rdx + 4], 0x78
jne 0x140007492
cmp word [rdx + 6], 0x65
jne 0x140007492
mov word [rdx + 8], bp
jmp 0x1400074d3
mov word [rcx + 2], bp
mov dword [r14], 1
mov rax, r11
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
Function at 0x140007600
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x850
mov rax, qword [0x140065340]
xor rax, rsp
mov qword [rsp + 0x840], rax
xor edi, edi
mov r14, rcx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x34], edi
call fcn.140007880
test eax, eax
je 0x14000763d
xor eax, eax
jmp 0x140007853
mov r8d, 0x400
mov rdx, r14
xor ecx, ecx
mov qword [rsp + 0x868], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140007688
lea rcx, [rsp + 0x34]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, r14
mov edx, eax
call fcn.140007300
mov rbx, rax
test rax, rax
je 0x140007688
cmp dword [rsp + 0x30], edi
jne 0x14000770f
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
test rax, rax
je 0x140007806
mov qword [rsp + 0x870], rsi
mov esi, edi
mov rcx, rax
cmp word [rax], si
je 0x1400076c3
nop dword [rax]
cmp esi, 0x400
jae 0x1400076c3
add rcx, 2
inc esi
cmp word [rcx], di
jne 0x1400076b0
mov eax, 0x3ff
cmp esi, 0x400
mov rcx, r14
cmovae esi, eax
lea rbx, [rsi + rsi]
mov r8, rbx
call fcn.140020c00
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov r8d, 1
mov edx, esi
mov rcx, r14
mov qword [rsp + 0x20], rax
mov word [rbx + r14], di
call fcn.140007300
mov rsi, qword [rsp + 0x870]
mov rbx, rax
test rbx, rbx
je 0x140007806
cmp dword [rsp + 0x34], edi
jne 0x140007801
test byte [r14 + 0x818], 4
je 0x140007801
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x7fe
call fcn.140021100
lea rcx, [rsp + 0x40]
mov rax, rbx
or rax, rcx
lea r9, [rsp + 0x40]
and eax, 0xf
jne 0x1400077b4
mov eax, 8
nop dword [rax]
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
lea rcx, [rcx + 0x80]
lea rbx, [rbx + 0x80]
movaps xmmword [rcx - 0x80], xmm0
movaps xmm0, xmmword [rbx - 0x60]
movaps xmmword [rcx - 0x70], xmm1
movaps xmm1, xmmword [rbx - 0x50]
movaps xmmword [rcx - 0x60], xmm0
movaps xmm0, xmmword [rbx - 0x40]
movaps xmmword [rcx - 0x50], xmm1
movaps xmm1, xmmword [rbx - 0x30]
movaps xmmword [rcx - 0x40], xmm0
movaps xmm0, xmmword [rbx - 0x20]
movaps xmmword [rcx - 0x30], xmm1
movaps xmm1, xmmword [rbx - 0x10]
movaps xmmword [rcx - 0x20], xmm0
movaps xmmword [rcx - 0x10], xmm1
dec rax
jne 0x140007760
jmp 0x1400077c5
mov r8d, 0x400
mov rdx, rbx
mov rcx, r9
call fcn.140020c00
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov r8, r14
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov ecx, eax
mov edx, eax
mov word [r14 + rcx*2], di
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x20], rcx
mov rcx, r14
call fcn.140007300
mov rbx, rax
test rbx, rbx
jne 0x14000780d
mov word [r14], di
mov rbx, r14
mov rax, rbx
test rbx, rbx
je 0x140007834
cmp word [rbx], di
je 0x140007834
nop word [rax + rax]
cmp edi, 0x400
jae 0x140007834
add rax, 2
inc edi
cmp word [rax], 0
jne 0x140007820
lea r8d, [rdi*2 + 2]
lea rcx, [r14 + 0x800]
mov rdx, rbx
call fcn.140008070
mov rbx, qword [rsp + 0x868]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1400215b0
mov rdi, qword [rsp + 0x878]
add rsp, 0x850
pop r14
ret
Function at 0x140007980
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x140065340]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rdi, rdx
xor ebp, ebp
mov rsi, rcx
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x34]
lea r8d, [rbp + 2]
mov rcx, rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140007b4e
cmp dword [rsp + 0x30], 2
jne 0x140007b4e
cmp word [rsp + 0x34], 1
je 0x1400079e4
lea eax, [rbp + 2]
jmp 0x140007b18
mov qword [rsp + 0x880], rbx
mov qword [rsp + 0x888], r14
cmp eax, 1
jne 0x140007afa
mov r14d, 0x400
nop dword [rax]
nop word [rax + rax]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x34]
mov r8d, 4
mov rcx, rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x140007afa
test eax, eax
je 0x140007b47
cmp ecx, 4
jne 0x140007b47
movzx eax, word [rsp + 0x36]
test al, 1
jne 0x140007b40
movzx ebx, ax
shr bx, 1
cmp bx, r14w
ja 0x140007b40
cmp bx, 1
jbe 0x140007b40
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
movzx r8d, ax
mov rcx, rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140007b47
movzx eax, word [rsp + 0x36]
cmp dword [rsp + 0x30], eax
jne 0x140007b47
movzx eax, bx
cmp word [rsp + rax*2 + 0x3e], bp
jne 0x140007b47
mov rcx, qword [rsi + 0x808]
lea rdx, [rsp + 0x40]
call fcn.14002120c
test eax, eax
je 0x140007b33
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 8
mov rcx, rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140007b47
cmp dword [rsp + 0x30], 8
jne 0x140007b47
cmp eax, 1
je 0x140007a10
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call fcn.140005970
mov rbx, qword [rsp + 0x880]
mov r14, qword [rsp + 0x888]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1400215b0
add rsp, 0x850
pop rdi
pop rsi
pop rbp
ret
mov rdx, rdi
mov rcx, rsi
call fcn.140007c20
jmp 0x140007b08
mov eax, 0xb
jmp 0x140007b08
mov eax, 8
jmp 0x140007b08
mov eax, 8
jmp 0x140007b18

Function at 0x140007c20
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
lea rcx, [rsp + 0x68]
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [rsp + 0x68]
lea r9, [rsp + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x6c]
lea rdx, [rsp + 0x30]
mov r8d, 8
mov rcx, rbx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140007c79
cmp dword [rsp + 0x60], 8
jne 0x140007c79
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov eax, 8
add rsp, 0x40
pop rbx
ret
Function at 0x140007fc0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalNVTweak
xor ebx, ebx
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000804e
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, str.DisableSaveAppTimestamp
xor r8d, r8d
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000803f
cmp dword [rsp + 0x68], 4
jne 0x14000803f
cmp dword [rsp + 0x58], ebx
setne bl
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x58], ebx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x58]
add rsp, 0x40
pop rbx
ret