joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b2c0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1400bb4a8]
xor rax, rsp
mov qword [rsp + 0x240], rax
test byte [rcx + 0x54], 1
mov rbx, rcx
je 0x14000b3db
xor edi, edi
mov dword [rsp + 0x30], 0x11c
xor edx, edx
mov qword [rsp + 0x38], rdi
mov r8d, 0xfe
mov dword [rsp + 0x40], edi
lea rcx, [rsp + 0x46]
mov word [rsp + 0x44], di
call fcn.14002b5b0
mov r8b, 1
mov qword [rsp + 0x144], rdi
lea edx, [rdi + 2]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea edx, [rdi + 2]
mov dword [rsp + 0x34], 5
mov r8, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x14000b3db
lea rcx, str.kernel32
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x14000b38a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x20]
call rdi
test eax, eax
je 0x14000b3c1
cmp dword [rsp + 0x20], 0
je 0x14000b3c1
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.Wow64DisableWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000b3d4
lea rcx, [rbx + 0x48]
call rax
test eax, eax
je 0x14000b3d4
or dword [rbx + 0x50], 0x40
lea rcx, [rbx + 0x58]
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14000b424
mov eax, 8
jmp 0x14000b431
mov r8d, 0x104
lea rdx, [rsp + 0x30]
lea rcx, str.allusersprofile
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000b42c
lea r9, [rsp + 0x30]
mov edx, 0x400
lea r8, str._sNVIDIA_CorporationDrs
lea rcx, [rbx + 0x58]
call fcn.14000da20
test eax, eax
js 0x14000b42c
lea rcx, [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b42c
or dword [rbx + 0x50], 0x20
xor eax, eax
jmp 0x14000b431
mov eax, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140028460
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x14000b500
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x1400bb4a8]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x802
call fcn.14002b5b0
xor ebx, ebx
lea rcx, str.kernel32
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x14000b617
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x20]
call rsi
test eax, eax
jne 0x14000b617
mov ebp, ebx
mov edx, 0x400
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14000b65f
lea r8, str.drivers
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.140070f48
lea rsi, [rdi + 0x58]
mov edx, 0x400
mov rcx, rsi
lea r9, [rsp + 0x30]
lea r8, str._sNVIDIA_CorporationDrs
call fcn.14000da20
test eax, eax
js 0x14000b663
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b663
or dword [rdi + 0x50], 0x20
xor eax, eax
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140028460
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ebp, dword [rsp + 0x20]
test ebp, ebp
je 0x14000b587
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.Wow64DisableWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000b658
lea rcx, [rdi + 0x48]
call rax
test eax, eax
je 0x14000b658
or dword [rdi + 0x50], 0x40
jmp 0x14000b587
mov eax, 8
jmp 0x14000b5ee
lea rsi, [rdi + 0x58]
lea rcx, str.nvldumd.dll
test ebp, ebp
jne 0x14000b675
lea rcx, str.nvldumdx.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000b6da
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000b6da
mov edx, 0x5c
lea rcx, [rsp + 0x30]
call fcn.14002a240
lea r9, [rsp + 0x30]
mov edx, 0x400
lea r8, [0x14009fc04]
mov rcx, rsi
mov word [rax], bx
call fcn.14000da20
test eax, eax
js 0x14000b6da
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b6da
mov ebx, 1
test ebx, ebx
jne 0x14000b5e8
lea rcx, [rsp + 0x30]
call fcn.14000a760
test eax, eax
jne 0x14000b71f
lea r9, [rsp + 0x30]
mov edx, 0x400
lea r8, [0x14009fc04]
mov rcx, rsi
call fcn.14000da20
test eax, eax
js 0x14000b71f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000b5e8
mov eax, 1
jmp 0x14000b5ee
Function at 0x14000b910
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x840
mov rax, qword [0x1400bb4a8]
xor rax, rsp
mov qword [rsp + 0x830], rax
test byte [rcx + 0x50], 0x20
mov rbx, rcx
jne 0x14000b941
call fcn.14000b2c0
test eax, eax
jne 0x14000ba60
lea rax, str.nvdrssel.bin
add rbx, 0x58
mov r9, rbx
mov qword [rsp + 0x20], rax
lea r8, str._s_s
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.14000da20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, str.nvdrswr.lk
mov r9, rbx
lea r8, str._s_s
mov qword [rsp + 0x20], rax
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.14000da20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, str.update.bin
mov r9, rbx
lea r8, str._s_s
mov qword [rsp + 0x20], rax
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.14000da20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r9, rbx
mov qword [rsp + 0x20], 0
lea r8, str._s_nvdrsdb_d.bin
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.14000da20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r9, rbx
mov dword [rsp + 0x20], 1
lea r8, str._s_nvdrsdb_d.bin
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.14000da20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, str.nvAppTimestamps
mov r9, rbx
lea r8, str._s_s
mov qword [rsp + 0x20], rax
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.14000da20
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140028460
add rsp, 0x840
pop rbx
ret
add rcx, 0x838
jmp 0x14000b910

Function at 0x14000bb00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x860
mov rax, qword [0x1400bb4a8]
xor rax, rsp
mov qword [rsp + 0x850], rax
test byte [rcx + 0x50], 0x20
mov rdi, rdx
mov rbx, rcx
jne 0x14000bb38
call fcn.14000b2c0
test eax, eax
jne 0x14000bc02
lea rax, str.nvdrssel.bin
mov edx, 0x400
lea r9, [rbx + 0x58]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [rsp + 0x50]
call fcn.14000da20
lea rcx, [rsp + 0x50]
call fcn.14000a2c0
test eax, eax
je 0x14000bb76
mov eax, 8
jmp 0x14000bc02
mov qword [rsp + 0x880], rsi
lea rcx, [rsp + 0x50]
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
lea r8d, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14000bbc5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call fcn.14000b200
lea eax, [rsi + 8]
jmp 0x14000bbfa
or dword [rbx + 0x50], 0x10
lea r9, [rsp + 0x40]
mov r8d, 1
mov qword [rbx + 0x20], rax
mov rdx, rdi
mov qword [rsp + 0x20], rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov eax, 0xf
je 0x14000bbfa
cmp dword [rsp + 0x40], 1
cmove eax, esi
mov rsi, qword [rsp + 0x880]
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.140028460
mov rbx, qword [rsp + 0x888]
add rsp, 0x860
pop rdi
ret
Function at 0x14000bc30
Capabilities:
Write file on windows

Disassembly:
mov byte [rsp + 0x10], dl
push rbx
sub rsp, 0x30
mov rbx, rcx
xor r9d, r9d
mov rcx, qword [rcx + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x14000bc89
mov rcx, qword [rbx + 0x20]
lea r9, [rsp + 0x40]
mov r8d, 1
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000bc89
cmp dword [rsp + 0x40], 1
jne 0x14000bc89
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov rcx, rbx
call fcn.14000b200
mov eax, 8
add rsp, 0x30
pop rbx
ret

Function at 0x14000bca0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r15d, edx
mov rdi, r9
xor edx, edx
mov esi, r8d
mov r14, rcx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
je 0x14000bd4f
mov edx, ebp
mov ecx, 1
call fcn.140070fc0
mov rbx, rax
test rax, rax
je 0x14000bd4f
mov r9, rax
mov r8d, ebp
xor edx, edx
mov rcx, r14
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14000bd47
lea r9, [rsp + 0x20]
mov rcx, rbx
lea r8, [rsp + 0x28]
lea rdx, [0x14009de78]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14000bd47
mov rax, qword [rsp + 0x28]
movzx ecx, word [rax + 0xa]
mov dword [rdi], 0
cmp ecx, r15d
jb 0x14000bd38
test esi, esi
je 0x14000bd32
cmp ecx, esi
ja 0x14000bd38
mov dword [rdi], 1
mov rcx, rbx
call fcn.140070fc8
mov eax, 1
jmp 0x14000bd51
mov rcx, rbx
call fcn.140070fc8
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14000c040
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1060
call fcn.140028490
sub rsp, rax
mov rax, qword [0x1400bb4a8]
xor rax, rsp
mov qword [rsp + 0x1050], rax
test byte [rcx + 0x50], 0x20
mov rdi, rcx
jne 0x14000c07b
call fcn.14000b2c0
test eax, eax
jne 0x14000c183
lea rax, str.nvdrssel.bin
mov edx, 0x400
lea r9, [rdi + 0x58]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [rsp + 0x50]
call fcn.14000da20
lea rcx, [rsp + 0x50]
call fcn.14000a2c0
test eax, eax
jne 0x14000c0f1
xor esi, esi
lea r8d, [rax + 3]
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14000c0fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call fcn.14000b200
mov eax, 8
jmp 0x14000c183
or dword [rdi + 0x50], 0x10
lea r9, [rsp + 0x44]
mov r8d, 1
mov qword [rdi + 0x20], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000c1f2
cmp dword [rsp + 0x44], 1
jne 0x14000c1f2
movzx eax, byte [rsp + 0x40]
lea r8, str._s_nvdrsdb_d.bin
mov qword [rsp + 0x1078], rbx
lea rcx, [rsp + 0x850]
lea rbx, [rdi + 0x58]
mov dword [rsp + 0x20], eax
mov r9, rbx
mov edx, 0x400
call fcn.14000da20
lea rcx, [rsp + 0x850]
call fcn.14000a2c0
test eax, eax
je 0x14000c1a4
mov eax, 8
mov rbx, qword [rsp + 0x1078]
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140028460
mov rsi, qword [rsp + 0x1080]
add rsp, 0x1060
pop rdi
ret
lea rdx, [rsp + 0x850]
mov rcx, rdi
call fcn.14000c200
test eax, eax
jne 0x14000c17b
test rbx, rbx
je 0x14000c1ee
lea rdx, str.SYSTEM_DB
mov ecx, esi
sub rdx, rbx
nop dword [rax]
cmp ecx, 0x3ff
jae 0x14000c1eb
movzx eax, word [rdx + rbx]
inc ecx
mov word [rbx], ax
add rbx, 2
cmp word [rdx + rbx], si
jne 0x14000c1d0
mov word [rbx], si
xor eax, eax
jmp 0x14000c17b
mov eax, 0xf
jmp 0x14000c183
Function at 0x14000c200
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rbx, rdx
mov edi, ebp
mov rsi, rcx
nop
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000c2a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 1
jbe 0x14000c27f
cmp edi, 0xbb8
jae 0x14000c27f
mov ecx, 0x3c
call qword [sym.imp.KERNEL32.dll_Sleep]
add edi, 0x3c
cmp edi, 0xbb8
jb 0x14000c220
mov rcx, rsi
call fcn.14000b200
mov eax, 8
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
or dword [rsi + 0x50], 8
lea rdx, [rsp + 0x60]
mov qword [rsi + 0x28], rcx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14000c27f
cmp dword [rsp + 0x64], ebp
jne 0x14000c27f
mov rcx, qword [rsi + 0x28]
xor r9d, r9d
mov edi, dword [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
je 0x14000c27f
or dword [rsi + 0x50], 4
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor r8d, r8d
mov rcx, rax
mov qword [rsi + 0x30], rax
mov qword [rsp + 0x20], rdi
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov qword [rsi], rax
test rax, rax
je 0x14000c27f
mov rcx, qword [rsp + 0x60]
mov qword [rsi + 0x10], rax
lea rax, [rsi + 0x58]
mov dword [rsi + 8], ecx
mov dword [rsi + 0xc], ecx
test rax, rax
je 0x14000c35e
test rbx, rbx
je 0x14000c35e
mov edx, ebp
cmp word [rbx], dx
je 0x14000c35b
sub rbx, rax
nop dword [rax + rax]
cmp edx, 0x3ff
jae 0x14000c35b
movzx ecx, word [rbx + rax]
inc edx
mov word [rax], cx
add rax, 2
cmp word [rbx + rax], bp
jne 0x14000c340
mov word [rax], bp
xor eax, eax
jmp 0x14000c28c
Function at 0x14000c5b0
Capabilities:
Clear file content
Persist via application shimming
Write file on windows

Disassembly:
push rbx
push rsi
sub rsp, 0x868
mov rax, qword [0x1400bb4a8]
xor rax, rsp
mov qword [rsp + 0x850], rax
lea rbx, [rcx + 0x58]
movzx eax, dl
mov rsi, rcx
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, str._s_nvdrsdb_d.bin
mov edx, 0x400
lea rcx, [rsp + 0x50]
call fcn.14000da20
lea rcx, [rsp + 0x50]
call fcn.14000a2c0
test eax, eax
je 0x14000c60b
mov eax, 8
jmp 0x14000c76f
mov qword [rsp + 0x890], rbp
xor ebp, ebp
mov qword [rsp + 0x860], rdi
mov edi, ebp
nop
mov qword [rsp + 0x30], rbp
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000c68d
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 1
jbe 0x14000c750
cmp edi, 0xbb8
jae 0x14000c750
mov ecx, 0x3c
call qword [sym.imp.KERNEL32.dll_Sleep]
add edi, 0x3c
cmp edi, 0xbb8
jb 0x14000c620
jmp 0x14000c750
mov r8d, dword [rsi + 0xc]
lea r9, [rsp + 0x40]
mov rdx, qword [rsi]
or dword [rsi + 0x50], 8
mov qword [rsi + 0x28], rcx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsi + 0x28]
test eax, eax
je 0x14000c742
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [rsi + 0x50], 0xfffffff7
mov eax, dword [rsi + 0xc]
mov qword [rsi + 0x28], rbp
cmp dword [rsp + 0x40], eax
jne 0x14000c750
mov rcx, rbx
test rbx, rbx
je 0x14000c73e
mov edx, ebp
cmp word [rsp + 0x50], dx
je 0x14000c70f
lea r8, [rsp + 0x50]
sub r8, rbx
cmp edx, 0x3ff
jae 0x14000c70f
movzx eax, word [r8 + rcx]
inc edx
mov word [rcx], ax
add rcx, 2
cmp word [r8 + rcx], bp
jne 0x14000c6f2
lea rdx, str.SYSTEM_DB
mov word [rcx], bp
sub rdx, rbx
mov ecx, ebp
nop
cmp ecx, 0x3ff
jae 0x14000c73b
movzx eax, word [rdx + rbx]
inc ecx
mov word [rbx], ax
add rbx, 2
cmp word [rdx + rbx], bp
jne 0x14000c720
mov word [rbx], bp
xor eax, eax
jmp 0x14000c75f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [rsi + 0x50], 0xfffffff7
mov qword [rsi + 0x28], rbp
mov rcx, rsi
mov ebx, 8
call fcn.14000b200
mov eax, ebx
mov rbp, qword [rsp + 0x890]
mov rdi, qword [rsp + 0x860]
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.140028460
add rsp, 0x868
pop rsi
pop rbx
ret
Function at 0x14000c790
Capabilities:
Clear file content
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rbx, rdx
mov edi, ebp
mov rsi, rcx
nop
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000c81b
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 1
jbe 0x14000c8b0
cmp edi, 0xbb8
jae 0x14000c8b0
mov ecx, 0x3c
call qword [sym.imp.KERNEL32.dll_Sleep]
add edi, 0x3c
cmp edi, 0xbb8
jb 0x14000c7b0
jmp 0x14000c8b0
mov r8d, dword [rsi + 0xc]
lea r9, [rsp + 0x60]
mov rdx, qword [rsi]
or dword [rsi + 0x50], 8
mov qword [rsi + 0x28], rcx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsi + 0x28]
test eax, eax
je 0x14000c8a2
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [rsi + 0x50], 0xfffffff7
mov eax, dword [rsi + 0xc]
mov qword [rsi + 0x28], rbp
cmp dword [rsp + 0x60], eax
jne 0x14000c8b0
lea rax, [rsi + 0x58]
test rax, rax
je 0x14000c89e
test rbx, rbx
je 0x14000c89e
mov edx, ebp
cmp word [rbx], dx
je 0x14000c89b
sub rbx, rax
nop dword [rax + rax]
cmp edx, 0x3ff
jae 0x14000c89b
movzx ecx, word [rbx + rax]
inc edx
mov word [rax], cx
add rax, 2
cmp word [rbx + rax], bp
jne 0x14000c880
mov word [rax], bp
xor eax, eax
jmp 0x14000c8bd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [rsi + 0x50], 0xfffffff7
mov qword [rsi + 0x28], rbp
mov rcx, rsi
call fcn.14000b200
mov eax, 8
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x14000c980
Capabilities:
Query environment variable

Disassembly:
push rbx
mov eax, 0x1890
call fcn.140028490
sub rsp, rax
mov rax, qword [0x1400bb4a8]
xor rax, rsp
mov qword [rsp + 0x1880], rax
mov rbx, rcx
mov qword [rcx], 0
lea rcx, str.PROGRAMDATA
mov r8d, 0x104
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000ca7f
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], 0
lea r8, str._sNVIDIA_CorporationDrs_nvdrsdb_d.bin
mov edx, 0x400
lea rcx, [rsp + 0x880]
call fcn.14000da20
lea r9, [rsp + 0x80]
mov dword [rsp + 0x20], 1
lea r8, str._sNVIDIA_CorporationDrs_nvdrsdb_d.bin
mov edx, 0x400
lea rcx, [rsp + 0x1080]
call fcn.14000da20
lea r8, [rsp + 0x30]
xor edx, edx
lea rcx, [rsp + 0x880]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x14000ca7f
lea r8, [rsp + 0x58]
xor edx, edx
lea rcx, [rsp + 0x1080]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x14000ca7f
mov eax, dword [rsp + 0x44]
mov edx, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x70]
shl rcx, 0x20
shl rdx, 0x20
or rdx, rax
mov eax, dword [rsp + 0x6c]
or rcx, rax
cmp rdx, rcx
cmovae rcx, rdx
xor eax, eax
mov qword [rbx], rcx
jmp 0x14000ca84
mov eax, 8
mov rcx, qword [rsp + 0x1880]
xor rcx, rsp
call fcn.140028460
add rsp, 0x1890
pop rbx
ret
Function at 0x14000cc80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov rdi, qword [rsp + 0x38]
xor r15d, r15d
mov word [rcx + 0x7fe], r15w
mov r14, r9
mov dword [r9], r15d
mov rsi, rcx
mov ebx, r15d
mov r10, rcx
mov dword [rdi], r15d
mov r11d, r15d
mov rdx, rcx
mov r9d, r15d
cmp word [rcx], r15w
je 0x14000ccf8
nop dword [rax]
cmp r9d, 0x400
jae 0x14000ccf8
movzx ecx, word [rdx]
lea eax, [rcx - 0x41]
cmp ax, 0x19
ja 0x14000ccec
add cx, 0x20
mov word [rdx], cx
add rdx, 2
inc r9d
cmp word [rdx], bx
jne 0x14000ccd0
movzx eax, word [rsi]
mov ebp, 0x2f
test ax, ax
je 0x14000cd23
cmp ax, 0x5c
jne 0x14000cd15
mov word [r10], bp
mov dword [rdi], 1
movzx eax, word [r10 + 2]
add r10, 2
test ax, ax
jne 0x14000cd05
movzx eax, word [rsi]
mov rcx, rsi
test ax, ax
je 0x14000cd67
nop
cmp ax, 0x22
jne 0x14000cd4a
xor r11d, 1
lea rax, [rcx + 2]
test rbx, rbx
cmovne rax, rbx
mov rbx, rax
jmp 0x14000cd5a
cmp ax, 0x20
jne 0x14000cd5a
test r11d, r11d
jne 0x14000cd5a
test r8d, r8d
jne 0x14000cd67
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14000cd30
test rbx, rbx
mov r9, rbx
cmove r9, rsi
cmp rcx, r9
jbe 0x14000cd97
mov eax, 0xffdd
nop dword [rax + rax]
movzx edx, word [rcx]
test ax, dx
jne 0x14000cdb6
cmp dx, 2
je 0x14000cdb6
sub rcx, 2
cmp rcx, r9
ja 0x14000cd80
mov word [r9], r15w
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
lea rax, [r9 + 6]
cmp rcx, rax
jb 0x14000cdde
cmp word [rcx - 6], 0x2e
jne 0x14000cdde
cmp word [rcx - 4], 0x65
jne 0x14000cdde
cmp word [rcx - 2], 0x78
jne 0x14000cdde
cmp dx, 0x65
je 0x14000ce84
lea r10, [rcx + 0xa]
lea rax, [rsi + 0x800]
cmp r10, rax
jae 0x14000ce84
test rbx, rbx
jne 0x14000ce30
mov r8, rcx
mov r11d, 0x4c5c
cmp dx, 0x2e
je 0x14000ce58
cmp dx, 0x22
je 0x14000ce30
cmp dx, 0x5c
mov eax, r15d
sete al
or dword [rdi], eax
cmp word [r8], r11w
jne 0x14000ce22
mov word [r8], bp
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x14000ce00
cmp dword [r14], r15d
jne 0x14000ce90
test byte [rsi + 0x818], 2
je 0x14000ce90
mov dword [rcx + 2], 0x65002e
mov rax, r9
mov dword [rcx + 6], 0x650078
mov word [r10], r15w
jmp 0x14000cd9d
cmp word [r8 + 2], 0x65
jne 0x14000ce30
cmp word [r8 + 4], 0x78
jne 0x14000ce30
cmp word [r8 + 6], 0x65
jne 0x14000ce30
mov word [r8 + 8], r15w
mov rax, r9
mov dword [r14], 1
jmp 0x14000cd9d
mov word [rcx + 2], r15w
mov dword [r14], 1
mov rax, r9
jmp 0x14000cd9d