joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140280740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x160], rax
cmp byte [rcx + 0x17], 0
jns 0x140280767
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140280797
test eax, 0x410
sete sil
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14016c920
mov eax, esi
add rsp, 0x168
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140124e30
test al, al
je 0x1402807f8
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x73
mov r9d, 2
call fcn.1401dd8a0
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400fe0b0
mov rcx, rax
mov rdx, rsi
call fcn.1401deb10
mov rcx, rdi
call fcn.1401dd910
xor esi, esi
jmp 0x14028077b

Function at 0x140282360
Capabilities:
Enumerate processes

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
lea rsi, [rcx + 0x18]
mov r8d, 0x238
mov rcx, rsi
xor edx, edx
call fcn.1401a5320
mov dword [rdi + 0x18], 0x238
cmp byte [rdi + 0x10], 0
jne 0x14028239c
mov byte [rdi + 0x10], 1
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x1402823a8
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne al
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140298940
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x14039c7d0]
mov ecx, dword [0x14038f0a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1402989a2
cmp rdi, rsi
je 0x14029899e
mov eax, 0xffffffff
lea rcx, [0x14039c3d0]
mov dl, byte [rdi]
xor dl, al
movzx edx, dl
shr eax, 8
xor eax, dword [rcx + rdx*4]
inc rdi
cmp rdi, rsi
jne 0x14029897f
not eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x140298996
lea rcx, [0x14039c7d0]
call fcn.14016b42c
cmp dword [0x14039c7d0], 0xffffffff
jne 0x14029896e
lea rbx, [0x14039c3d0]
mov r8d, 0x400
mov rcx, rbx
mov dl, 0xaa
call fcn.1401a5320
xor eax, eax
mov ecx, 0xedb88320
mov r8d, eax
shr r8d, 1
mov edx, eax
and edx, 1
neg edx
and edx, ecx
xor edx, r8d
mov r9d, edx
shr r9d, 1
mov r8d, eax
shl r8d, 0x1e
sar r8d, 0x1f
and r8d, ecx
xor r8d, r9d
mov r9d, r8d
shr r9d, 6
mov r10d, eax
shl r10d, 0x1d
sar r10d, 0x1f
and r10d, 0x76dc419
mov r11d, eax
shl r11d, 0x1c
sar r11d, 0x1f
and r11d, 0xedb8832
xor r11d, r10d
mov r10d, eax
shl r10d, 0x1b
sar r10d, 0x1f
and r10d, 0x1db71064
xor r10d, r11d
mov r11d, eax
shl r11d, 0x1a
sar r11d, 0x1f
and r11d, 0x3b6e20c8
xor r11d, r10d
xor r11d, r9d
shl edx, 0x1a
sar edx, 0x1f
and edx, 0x76dc4190
xor edx, r11d
shl r8d, 0x1a
sar r8d, 0x1f
and r8d, ecx
xor r8d, edx
mov dword [rbx], r8d
inc rax
add rbx, 4
cmp rax, 0x100
jne 0x1402989d5
lea rcx, [0x14039c7d0]
call fcn.14016b4e0
jmp 0x14029896e
Function at 0x1402cbf00
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x1402cbf60
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14016c920
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x1402da890
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x1402da8cf
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x1402da89f
mov dword [rsi], 7
jmp 0x1402da89f
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.1400e8940
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x1402da8ab
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1402da8ab
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x1402da981
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x1402da8a1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1402da89f
Function at 0x140002970
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov r14, r8
mov rbp, rdx
mov rbx, rcx
xor r15d, r15d
mov qword [rcx], r15
mov qword [rcx + 8], r15
mov rcx, qword [rcx]
or edi, 0xffffffff
test rcx, rcx
je 0x1400029bf
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400029bc
call fcn.140077fa0
mov qword [rbx], r15
mov rcx, rbp
call fcn.140025900
mov qword [rbx], rax
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400029e7
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400029e3
call fcn.140077fa0
mov qword [rbx + 8], r15
mov rcx, r14
call fcn.140025900
mov qword [rbx + 8], rax
lea r8, [0x1400e6a4c]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140025d90
nop
lea r8, [rbx + 8]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140025d30
mov rdx, qword [rax]
test rdx, rdx
je 0x140002a27
add rdx, 0x18
jmp 0x140002a2e
lea rdx, [0x1400e68d8]
mov ecx, 0x811c9dc5
movzx eax, byte [rdx]
test al, al
je 0x140002a58
nop word [rax + rax]
movzx eax, al
xor rcx, rax
lea rdx, [rdx + 1]
imul rcx, rcx, 0x1000193
movzx eax, byte [rdx]
test al, al
jne 0x140002a40
imul rax, rcx, 0x2001
mov rcx, rax
shr rcx, 7
xor rcx, rax
lea rax, [rcx + rcx*8]
mov rcx, rax
shr rcx, 0x11
xor rcx, rax
imul rax, rcx, 0x21
mov qword [rbx + 0x10], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140002a9e
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140002a99
call fcn.140077fa0
mov qword [rsp + 0x78], r15
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140002ab7
lock xadd dword [rcx], edi
cmp edi, 1
jne 0x140002ab7
call fcn.140077fa0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002b70
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
lea rcx, [rsp + 0x28]
call fcn.140002970
nop
lea r9, [rbx + 0x18]
or r9, 1
mov r10, qword [rbx + 8]
test r10, r10
je 0x140002ca3
mov r8, qword [rsp + 0x38]
movzx eax, r8b
mov ecx, 0x811c9dc5
xor rax, rcx
imul rcx, rax, 0x1000193
mov rdx, r8
shr rdx, 8
movzx eax, dl
xor rax, rcx
imul rcx, rax, 0x1000193
shr rdx, 8
movzx eax, dl
xor rax, rcx
imul rcx, rax, 0x1000193
shr rdx, 8
movzx eax, dl
xor rax, rcx
imul rcx, rax, 0x1000193
shr rdx, 8
movzx eax, dl
xor rax, rcx
imul rcx, rax, 0x1000193
shr rdx, 8
movzx eax, dl
xor rax, rcx
imul rcx, rax, 0x1000193
shr rdx, 8
movzx eax, dl
xor rax, rcx
imul rcx, rax, 0x1000193
shr rdx, 8
xor rcx, rdx
imul rax, rcx, 0x1000193
imul rcx, rax, 0x2001
mov rax, rcx
shr rax, 7
xor rax, rcx
lea rcx, [rax + rax*8]
mov rax, rcx
shr rax, 0x11
xor rcx, rax
imul rax, rcx, 0x21
mov ecx, dword [rbx + 0x20]
mov edx, 1
shl rdx, cl
dec rdx
and rdx, rax
mov rax, qword [r10 + rdx*8]
test rax, rax
je 0x140002ca3
cmp qword [rax + 0x10], r8
je 0x140002c99
mov ecx, dword [rax + 0x20]
shr ecx, 0x1f
test cl, 1
jne 0x140002ca3
mov rax, qword [rax + 0x30]
cmp qword [rax + 0x10], r8
jne 0x140002c84
cmp rax, r9
je 0x140002ca3
mov dil, 1
jmp 0x140002cb4
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.140002ef0
movzx edi, al
or ebx, 0xffffffff
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140002cda
mov edx, ebx
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x140002cd1
call fcn.140077fa0
mov qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140002cf2
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x140002cf2
call fcn.140077fa0
movzx eax, dil
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140002d10
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov rax, r8
mov rdi, rdx
mov rsi, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov qword [rdx], rbp
mov ebx, 1
mov dword [rsp + 0x20], ebx
mov r8, r9
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140002970
mov r9, qword [rsi + 8]
test r9, r9
je 0x140002e56
mov r8, qword [rsp + 0x40]
movzx eax, r8b
mov ecx, 0x811c9dc5
xor rax, rcx
imul rcx, rax, 0x1000193
mov rdx, r8
shr rdx, 8
movzx eax, dl
xor rax, rcx
imul rcx, rax, 0x1000193
shr rdx, 8
movzx eax, dl
xor rax, rcx
imul rcx, rax, 0x1000193
shr rdx, 8
movzx eax, dl
xor rax, rcx
imul rcx, rax, 0x1000193
shr rdx, 8
movzx eax, dl
xor rax, rcx
imul rcx, rax, 0x1000193
shr rdx, 8
movzx eax, dl
xor rax, rcx
imul rcx, rax, 0x1000193
shr rdx, 8
movzx eax, dl
xor rax, rcx
imul rcx, rax, 0x1000193
shr rdx, 8
xor rcx, rdx
imul rax, rcx, 0x1000193
imul rcx, rax, 0x2001
mov rax, rcx
shr rax, 7
xor rax, rcx
lea rdx, [rax + rax*8]
mov ecx, dword [rsi + 0x20]
shl rbx, cl
dec rbx
mov rax, rdx
shr rax, 0x11
xor rax, rdx
imul rax, rax, 0x21
and rbx, rax
mov rbx, qword [r9 + rbx*8]
test rbx, rbx
je 0x140002e56
cmp qword [rbx + 0x10], r8
je 0x140002e5e
nop word [rax + rax]
mov eax, dword [rbx + 0x20]
shr eax, 0x1f
test al, 1
jne 0x140002e56
mov rbx, qword [rbx + 0x30]
cmp qword [rbx + 0x10], r8
jne 0x140002e40
jmp 0x140002e5e
lea rbx, [rsi + 0x18]
or rbx, 1
lea rax, [rsi + 0x18]
or rax, 1
or esi, 0xffffffff
cmp rbx, rax
je 0x140002e9e
mov rcx, qword [rdi]
cmp qword [rbx + 0x18], rcx
je 0x140002e9e
test rcx, rcx
je 0x140002e8f
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140002e8c
call fcn.140077fa0
mov qword [rdi], rbp
mov rax, qword [rbx + 0x18]
mov qword [rdi], rax
test rax, rax
je 0x140002e9e
lock inc dword [rax]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140002ebd
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140002eb8
call fcn.140077fa0
mov qword [rsp + 0x38], rbp
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140002ed5
lock xadd dword [rcx], esi
cmp esi, 1
jne 0x140002ed5
call fcn.140077fa0
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140002ef0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140108708]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
call fcn.140023d00
test al, al
je 0x140003110
mov qword [rsp + 0x180], rbx
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp byte [rdi + rax], 0
jne 0x140002f32
mov qword [rsp + 0x198], r14
cmp rax, 0xfc
jae 0x1400030fe
mov r8, rdi
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.14009f17c
xor r14d, r14d
lea rcx, [rsp + 0x40]
test eax, eax
cmovne rcx, r14
test rcx, rcx
jne 0x1400030fe
lea r8, str._forced
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14009f9a8
test eax, eax
lea rcx, [rsp + 0x40]
cmovne rcx, r14
test rcx, rcx
jne 0x1400030fe
lea r8, [rsp + 0x40]
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.140002970
mov r11, qword [rsi + 8]
lea r9, [rsi + 0x18]
or r9, 1
test r11, r11
je 0x1400030b7
mov r10, qword [rsp + 0x30]
mov ecx, 0x811c9dc5
movzx eax, r10b
mov rdx, r10
xor rax, rcx
shr rdx, 8
imul rcx, rax, 0x1000193
movzx eax, dl
mov r8d, 1
xor rax, rcx
shr rdx, 8
imul rcx, rax, 0x1000193
movzx eax, dl
xor rax, rcx
shr rdx, 8
imul rcx, rax, 0x1000193
movzx eax, dl
xor rax, rcx
shr rdx, 8
imul rcx, rax, 0x1000193
movzx eax, dl
xor rax, rcx
shr rdx, 8
imul rcx, rax, 0x1000193
movzx eax, dl
xor rax, rcx
shr rdx, 8
imul rcx, rax, 0x1000193
movzx eax, dl
xor rax, rcx
shr rdx, 8
imul rcx, rax, 0x1000193
xor rcx, rdx
imul rax, rcx, 0x1000193
imul rcx, rax, 0x2001
mov rax, rcx
shr rax, 7
xor rax, rcx
mov ecx, dword [rsi + 0x20]
shl r8, cl
dec r8
lea rdx, [rax + rax*8]
mov rax, rdx
shr rax, 0x11
xor rax, rdx
imul rax, rax, 0x21
and r8, rax
mov rax, qword [r11 + r8*8]
test rax, rax
je 0x1400030b7
cmp qword [rax + 0x10], r10
je 0x1400030ba
nop dword [rax]
mov ecx, dword [rax + 0x20]
shr ecx, 0x1f
test cl, 1
jne 0x1400030b7
mov rax, qword [rax + 0x30]
cmp qword [rax + 0x10], r10
jne 0x1400030a0
jmp 0x1400030ba
mov rax, r9
mov rcx, qword [rsp + 0x28]
cmp rax, r9
setne dil
test rcx, rcx
je 0x1400030e0
mov eax, ebx
lock xadd dword [rcx], eax
sub eax, 1
jne 0x1400030db
call fcn.140077fa0
mov qword [rsp + 0x28], r14
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400030f8
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x1400030f8
call fcn.140077fa0
movzx eax, dil
jmp 0x140003100
xor al, al
mov r14, qword [rsp + 0x198]
mov rbx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140077880
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400036c0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rbx, rcx
lea rcx, [rsp + 0x28]
call fcn.140002970
nop
mov r9, qword [rbx + 8]
test r9, r9
je 0x1400037d8
mov r8, qword [rsp + 0x38]
movzx eax, r8b
mov ecx, 0x811c9dc5
xor rax, rcx
imul rcx, rax, 0x1000193
mov rdx, r8
shr rdx, 8
movzx eax, dl
xor rax, rcx
imul rcx, rax, 0x1000193
shr rdx, 8
movzx eax, dl
xor rax, rcx
imul rcx, rax, 0x1000193
shr rdx, 8
movzx eax, dl
xor rax, rcx
imul rcx, rax, 0x1000193
shr rdx, 8
movzx eax, dl
xor rax, rcx
imul rcx, rax, 0x1000193
shr rdx, 8
movzx eax, dl
xor rax, rcx
imul rcx, rax, 0x1000193
shr rdx, 8
movzx eax, dl
xor rax, rcx
imul rcx, rax, 0x1000193
shr rdx, 8
xor rcx, rdx
imul rax, rcx, 0x1000193
imul rcx, rax, 0x2001
mov rax, rcx
shr rax, 7
xor rax, rcx
lea rcx, [rax + rax*8]
mov rax, rcx
shr rax, 0x11
xor rcx, rax
imul rax, rcx, 0x21
mov ecx, dword [rbx + 0x20]
mov edx, 1
shl rdx, cl
dec rdx
and rdx, rax
mov rax, qword [r9 + rdx*8]
test rax, rax
je 0x1400037d8
cmp qword [rax + 0x10], r8
je 0x1400037e0
mov ecx, dword [rax + 0x20]
shr ecx, 0x1f
test cl, 1
jne 0x1400037d8
mov rax, qword [rax + 0x30]
cmp qword [rax + 0x10], r8
jne 0x1400037c1
jmp 0x1400037e0
lea rax, [rbx + 0x18]
or rax, 1
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14001f090
movzx edi, al
or ebx, 0xffffffff
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000381b
mov edx, ebx
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x140003812
call fcn.140077fa0
mov qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140003833
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x140003833
call fcn.140077fa0
movzx eax, dil
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400038b0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rdi, rdx
mov rbx, rcx
xor esi, esi
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rcx + 0x10], rsi
cmp qword [rcx + 0x18], 0x10
jb 0x1400038ed
mov rax, qword [rcx]
jmp 0x1400038f0
mov rax, rbx
mov byte [rax], sil
xor r8d, r8d
lea rdx, [0x1400e68d8]
call fcn.1400199b0
nop
mov qword [rbx + 0x20], rsi
mov dword [rbx + 0x28], esi
cmp rbx, rdi
je 0x140003921
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.140019ae0
cmp qword [rbx + 0x18], 0x10
jb 0x14000392d
mov r8, qword [rbx]
jmp 0x140003930
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbx + 0x20], rax
test rax, rax
je 0x1400039d8
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rbx + 0x28], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx + 0x28]
test ecx, ecx
je 0x1400039d8
cmp ecx, 0x80
je 0x1400039a4
cmp qword [rbx + 0x18], 0x10
jb 0x140003977
mov rcx, qword [rbx]
jmp 0x14000397a
mov rcx, rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
lea r9, str.warning:_WaitForSingleObject_failed_when_waiting_for_mutex_with_name___s__with_error_code:__d._Resuming_current_instance...
lea r8, [0x1400e6ac8]
mov edx, 0x138
lea rcx, str.C:dvsp4_build_sw_relgpu_drv_r560_r560_88drivers_ngxcommon_nvngx_common.h
call fcn.1400268e0
jmp 0x1400039d8
cmp qword [rbx + 0x18], 0x10
jb 0x1400039b0
mov rax, qword [rbx]
jmp 0x1400039b3
mov rax, rbx
mov qword [rsp + 0x20], rax
lea r9, str.warning:_WaitForSingleObject_captured_abandoned_mutex_with_name___s._Resuming_current_instance...
lea r8, [0x1400e6ac8]
mov edx, 0x134
lea rcx, str.C:dvsp4_build_sw_relgpu_drv_r560_r560_88drivers_ngxcommon_nvngx_common.h
call fcn.1400268e0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14001f620
Capabilities:
Hash data using fnv

Disassembly:
mov r8, qword [rdx]
mov ecx, 0x811c9dc5
movzx eax, r8b
xor rax, rcx
shr r8, 8
imul rcx, rax, 0x1000193
movzx eax, r8b
xor rax, rcx
shr r8, 8
imul rcx, rax, 0x1000193
movzx eax, r8b
xor rax, rcx
shr r8, 8
imul rcx, rax, 0x1000193
movzx eax, r8b
xor rax, rcx
shr r8, 8
imul rcx, rax, 0x1000193
movzx eax, r8b
xor rax, rcx
shr r8, 8
imul rcx, rax, 0x1000193
movzx eax, r8b
xor rax, rcx
shr r8, 8
imul rcx, rax, 0x1000193
movzx eax, r8b
xor rax, rcx
shr r8, 8
imul rcx, rax, 0x1000193
xor rcx, r8
imul rax, rcx, 0x1000193
imul rcx, rax, 0x2001
mov rax, rcx
shr rax, 7
xor rax, rcx
lea rax, [rax + rax*8]
mov rcx, rax
shr rcx, 0x11
xor rcx, rax
imul rax, rcx, 0x21
ret

Function at 0x14001f6e0
Capabilities:
Hash data using fnv

Disassembly:
mov r8, qword [rdx + 0x10]
mov ecx, 0x811c9dc5
movzx eax, r8b
xor rax, rcx
shr r8, 8
imul rcx, rax, 0x1000193
movzx eax, r8b
xor rax, rcx
shr r8, 8
imul rcx, rax, 0x1000193
movzx eax, r8b
xor rax, rcx
shr r8, 8
imul rcx, rax, 0x1000193
movzx eax, r8b
xor rax, rcx
shr r8, 8
imul rcx, rax, 0x1000193
movzx eax, r8b
xor rax, rcx
shr r8, 8
imul rcx, rax, 0x1000193
movzx eax, r8b
xor rax, rcx
shr r8, 8
imul rcx, rax, 0x1000193
movzx eax, r8b
xor rax, rcx
shr r8, 8
imul rcx, rax, 0x1000193
xor rcx, r8
imul rax, rcx, 0x1000193
imul rcx, rax, 0x2001
mov rax, rcx
shr rax, 7
xor rax, rcx
lea rax, [rax + rax*8]
mov rcx, rax
shr rcx, 0x11
xor rcx, rax
imul rax, rcx, 0x21
ret

Function at 0x140023c60
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
lea rax, [rsp + 0x50]
mov r9d, 0x20019
mov qword [rsp + 0x50], rbx
xor r8d, r8d
mov dword [rsp + 0x40], ebx
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalNGXCore
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140023cf3
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.CDNServerType
lea rax, [rsp + 0x40]
mov dword [rsp + 0x48], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
jne 0x140023ced
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x40], 1
sete al
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x1400242c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
cmp byte [0x14010cc90], 0
je 0x1400242f3
lea r9, str.UWP_Mode:_OTA_Updates_disabled._Snippet_loading_locations_restricted_to_app_and_driver_folders._Cannot_check_to_load_from_update_cache.
mov edx, 0x236
lea r8, str.NGXIsUpdaterEnabledBase
lea rcx, str.C:_dvs_p4_build_sw_rel_gpu_drv_r560_r560_88_drivers_ngx_common_nvngx_common.cpp
call fcn.1400268e0
xor al, al
add rsp, 0x38
ret
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rbx
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x50], 0
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalNGXCore
mov rcx, 0xffffffff80000002
mov bl, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002439f
mov rcx, qword [rsp + 0x50]
lea rdx, str.EnableOTA
mov dword [rsp + 0x40], eax
xor r9d, r9d
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140024371
cmp dword [rsp + 0x40], eax
seta bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x14002439f
lea r9, str.OTA_disabled._Using_embedded_snippet_only
mov edx, 0x250
lea r8, str.NGXIsUpdaterEnabledBase
lea rcx, str.C:_dvs_p4_build_sw_rel_gpu_drv_r560_r560_88_drivers_ngx_common_nvngx_common.cpp
call fcn.1400268e0
movzx eax, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
Function at 0x140024430
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x140108708]
xor rax, rsp
mov qword [rsp + 0x250], rax
cmp byte [0x14010cc90], 0
mov rbx, rcx
je 0x14002445e
mov al, 1
jmp 0x1400245c9
mov qword [rsp + 0x278], rdi
lea r9, [rsp + 0x30]
xor edi, edi
lea rcx, [0x1400ee4b8]
xor r8d, r8d
mov qword [rsp + 0x30], rdi
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x1400245a0
mov r8, qword [rsp + 0x30]
mov edx, 0x104
mov rcx, rbx
call fcn.14009b500
test eax, eax
mov ecx, edi
cmove rcx, rbx
test rcx, rcx
je 0x1400245a0
lea r8, str._NVIDIA_NGX_
mov edx, 0x104
mov rcx, rbx
call fcn.14009b568
test eax, eax
jne 0x1400245a0
call fcn.140023d00
lea rcx, [rsp + 0x40]
mov edx, 0x104
lea r8, str.Staging_models
test al, al
jne 0x1400244ec
lea r8, str.models
call fcn.14009b500
test eax, eax
lea rcx, [rsp + 0x40]
cmovne rcx, rdi
test rcx, rcx
jne 0x14002453f
lea r9, str.error:_NGXReturnModelsDirectory_model_path_couldnt_be_properly_built
mov edx, 0x21d
lea r8, str.NGXReturnModelsDirectory
lea rcx, str.C:_dvs_p4_build_sw_rel_gpu_drv_r560_r560_88_drivers_ngx_common_nvngx_common.cpp
call fcn.1400268e0
lea r8, str.models_
mov edx, 0x104
mov rcx, rbx
call fcn.14009b568
test eax, eax
jne 0x1400245a0
mov edx, 0x39a
jmp 0x140024572
lea r8, [rsp + 0x40]
mov edx, 0x104
mov rcx, rbx
call fcn.14009b568
test eax, eax
jne 0x1400245a0
lea r8, [0x1400e6f38]
mov edx, 0x104
mov rcx, rbx
call fcn.14009b568
test eax, eax
jne 0x1400245a0
mov edx, 0x391
lea r8, str.NGXGetPath
mov qword [rsp + 0x20], rbx
lea r9, str.using_path_for_models:__ls
lea rcx, str.C:_dvs_p4_build_sw_rel_gpu_drv_r560_r560_88_drivers_ngx_common_nvngx_common.cpp
call fcn.1400268e0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov al, 1
jmp 0x1400245c1
lea r9, str.error:_NGXGetPath_failed_to_obtain_path_to_models
mov edx, 0x3a3
lea r8, str.NGXGetPath
lea rcx, str.C:_dvs_p4_build_sw_rel_gpu_drv_r560_r560_88_drivers_ngx_common_nvngx_common.cpp
call fcn.1400268e0
xor al, al
mov rdi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140077880
add rsp, 0x260
pop rbx
ret