joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002f60
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov r10, qword [rcx + 0xa8]
mov rbx, r9
mov rdi, r8
test r10, r10
jne 0x140002faf
lea ecx, [r10 + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdx, rax
lea rcx, str.far_field:_internal_error:_no_data_n
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputs]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movsd xmm1, qword [r10 + 0x28]
mulsd xmm1, qword [0x140060a90]
movsd xmm0, qword [0x1400609e8]
divsd xmm1, qword [0x140060af0]
movsd qword [rbp + 0x17], xmm1
mulsd xmm1, xmm1
comisd xmm0, xmm1
jbe 0x140002fe9
movsd xmm0, qword [0x1400609f0]
movsd qword [rbp + 0x17], xmm0
mov qword [rsp + 0x60], rdx
lea r9, [rbp + 0x67]
mov qword [rsp + 0x58], r10
lea r8, [0x140002690]
xorps xmm0, xmm0
mov edx, 0xa
movsd qword [rbp + 0x47], xmm0
movsd qword [rbp + 0x3f], xmm0
movsd qword [rbp + 0x37], xmm0
movsd qword [rbp + 0x2f], xmm0
movsd qword [rbp + 0x27], xmm0
movsd qword [rbp + 0x1f], xmm0
mov rax, qword [r10 + 0x20]
mov ecx, dword [rax]
lea rax, [rbp + 0x17]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x27]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x2f]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x37]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x3f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x47]
mov dword [rbp + 0x67], ecx
nop
lea ecx, [rdx - 9]
mov qword [rsp + 0x20], rax
call sub.libiomp5md.dll__vcomp_fork
nop
lea r11, [rsp + 0xb0]
movsd xmm2, qword [rbp + 0x17]
mulsd xmm2, qword [0x140060ad8]
mulsd xmm2, qword [rbp + 0x17]
divsd xmm2, qword [0x140060aa8]
movaps xmm0, xmm2
movaps xmm1, xmm2
mulsd xmm0, qword [rbp + 0x1f]
mulsd xmm1, qword [rbp + 0x27]
movsd qword [rdi], xmm0
movaps xmm0, xmm2
mulsd xmm0, qword [rbp + 0x2f]
movsd qword [rdi + 8], xmm1
movaps xmm1, xmm2
mulsd xmm1, qword [rbp + 0x37]
movsd qword [rdi + 0x10], xmm0
movaps xmm0, xmm2
mulsd xmm0, qword [rbp + 0x3f]
mov rdi, qword [r11 + 0x20]
mulsd xmm2, qword [rbp + 0x47]
movsd qword [rbx], xmm1
movsd qword [rbx + 8], xmm0
movsd qword [rbx + 0x10], xmm2
mov rbx, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140026470
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
je 0x1400264f8
mov edx, 0xb2
mov r8d, 0x61a8
call fcn.14002feb0
cmp ebx, dword [0x1418452e8]
mov rdi, rax
je 0x1400264b2
mov rcx, qword [rax + 0x2e8]
xor r9d, r9d
mov r8d, ebx
lea edx, [r9 + 0x47]
call fcn.140035bd0
call fcn.140028df0
mov rcx, qword [rdi]
mov edx, 0x23
call fcn.14002feb0
test rax, rax
jne 0x1400264d2
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rdi]
mov edx, 0x23
call fcn.14002feb0
mov rcx, rax
call fcn.140028030
mov dword [0x1418452e8], ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp ebx, dword [0x1418452e8]
je 0x140026531
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, ebx
lea rdx, str.Percent_Done:__3d_n
mov rcx, rax
call fcn.140012100
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov dword [0x1418452e8], ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14002d6f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ebx, edx
xor ecx, ecx
mov edx, ecx
test rdi, rdi
je 0x14002d7c4
mov rax, rdi
cmp byte [rdi], cl
je 0x14002d71d
lea rax, [rax + 1]
inc edx
cmp byte [rax], cl
jne 0x14002d713
cmp edx, ebx
jge 0x14002d725
mov ebx, edx
jmp 0x14002d72a
test ebx, ebx
cmovs ebx, ecx
cmp edx, r8d
jl 0x14002d738
test r8d, r8d
mov edx, r8d
cmovs edx, ecx
cmp edx, ebx
mov ecx, edx
cmovge ecx, ebx
movsxd rax, ecx
add rdi, rax
cmp edx, ebx
cmovge ebx, edx
sub ebx, ecx
je 0x14002d7c4
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14002d7c4
mov qword [rsp + 0x30], rsi
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [rbx + 1]
mov ecx, 0x2000
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x14002d7b9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
nop word [rax + rax]
movzx ecx, byte [rdi]
lea rdi, [rdi + 1]
mov byte [rax], cl
lea rax, [rax + 1]
sub ebx, 1
jne 0x14002d790
mov rcx, rsi
mov byte [rax], bl
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rsi
lea ecx, [rbx + 1]
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14002ffb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov dword [rax + 0x10], edx
mov dword [rax + 8], ecx
push rsi
sub rsp, 0x70
mov rsi, qword [rsp + 0xa0]
test rsi, rsi
je 0x1400301e7
mov qword [rax + 0x18], rbx
mov qword [rax - 0x10], rbp
mov qword [rax - 0x28], r13
mov qword [rax - 0x38], r15
test r8d, r8d
je 0x14002ffec
mov r13d, 5
jmp 0x14002fff6
neg r9d
sbb r13, r13
add r13, 4
mov rax, rsi
mov qword [rsp + 0x58], r12
nop
xor r8d, r8d
cmp dword [rax + 8], 0x28
je 0x140030016
mov rax, qword [rax]
test rax, rax
jne 0x140030000
mov r12d, r8d
jmp 0x14003001a
mov r12d, dword [rax + 0x10]
mov rax, rsi
nop dword [rax]
cmp dword [rax + 8], 0x29
je 0x140030033
mov rax, qword [rax]
test rax, rax
jne 0x140030020
mov ebx, r8d
jmp 0x140030036
mov ebx, dword [rax + 0x10]
mov dword [rsp + 0xa0], ebx
nop dword [rax]
cmp dword [rsi + 8], 0x35
je 0x140030053
mov rsi, qword [rsi]
test rsi, rsi
jne 0x140030040
mov rsi, r8
jmp 0x140030057
mov rsi, qword [rsi + 0x10]
add dword [0x141845370], ecx
movzx ebp, r8w
add dword [0x141845374], edx
mov r15d, r8d
test ebx, ebx
jle 0x1400301bf
mov eax, dword [rsp + 0xa0]
lea rdx, [0x141845380]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x48], r14
nop word [rax + rax]
mov edi, r8d
mov ebx, r8d
test r12d, r12d
jle 0x14003018e
nop
mov ecx, ebx
and ecx, 0xf
je 0x1400300ac
add bp, bp
jmp 0x1400300af
movzx ebp, word [rsi]
test ecx, ecx
lea rax, [rsi + 2]
cmove rsi, rax
test bp, bp
jns 0x1400300c2
inc edi
jmp 0x140030126
test edi, edi
je 0x140030126
mov r14d, ebx
sub r14d, edi
cmp qword [rdx + r13*8], 0
jne 0x1400300d8
call fcn.14002d7d0
mov edx, dword [0x141845370]
lea r8, [0x141845380]
mov ecx, dword [0x141845374]
add edx, r14d
mov r8, qword [r8 + r13*8]
add ecx, r15d
mov dword [rsp + 0x20], edx
mov dword [rsp + 0x24], ecx
lea eax, [rdx + rdi]
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x20]
lea eax, [rcx + 1]
mov rcx, qword [0x141845378]
mov dword [rsp + 0x2c], eax
call qword [sym.imp.USER32.dll_FillRect]
xor edi, edi
lea rdx, [0x141845380]
inc ebx
cmp ebx, r12d
jl 0x1400300a0
test edi, edi
je 0x140030187
sub ebx, edi
cmp qword [rdx + r13*8], 0
jne 0x140030143
call fcn.14002d7d0
mov edx, dword [0x141845370]
lea r8, [0x141845380]
mov ecx, dword [0x141845374]
add edx, ebx
mov r8, qword [r8 + r13*8]
add ecx, r15d
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x34], ecx
lea eax, [rdx + rdi]
mov dword [rsp + 0x38], eax
lea rdx, [rsp + 0x30]
lea eax, [rcx + 1]
mov rcx, qword [0x141845378]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.USER32.dll_FillRect]
mov eax, dword [rsp + 0xa0]
inc r15d
lea rdx, [0x141845380]
mov r8d, 0
cmp r15d, eax
jl 0x140030090
mov edx, dword [rsp + 0x88]
mov ecx, dword [rsp + 0x80]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x60]
sub dword [0x141845370], ecx
sub dword [0x141845374], edx
mov r15, qword [rsp + 0x40]
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x1400410d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r10, rcx
mov rbx, r8
mov rcx, qword [r9]
test rcx, rcx
je 0x1400410fd
mov rax, qword [rcx]
imul rdx, rbx
mov r8, rdx
mov rdx, r10
call qword [rax + 8]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
mov r9, qword [r9 + 0x10]
test r9, r9
je 0x140041115
mov rcx, r10
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140041140
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov rbp, r9
mov rsi, r8
mov rbx, rcx
cmp rdx, 4
je 0x140041174
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rdi
xor edi, edi
test r8, r8
je 0x1400411cb
movzx eax, byte [rbx]
mov edx, 4
movzx ecx, byte [rbx + 3]
lea rbx, [rbx + 4]
mov byte [rsp + 0x3b], al
mov r9, rbp
movzx eax, byte [rbx - 3]
dec rsi
mov byte [rsp + 0x3a], al
lea r8d, [rdx - 3]
movzx eax, byte [rbx - 2]
mov byte [rsp + 0x38], cl
lea rcx, [rsp + 0x38]
mov byte [rsp + 0x39], al
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, 1
jne 0x1400411cb
inc rdi
test rsi, rsi
jne 0x140041180
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret

Function at 0x1400418e0
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x1400419b7
mov rcx, qword [rcx + 0x160]
cmp rcx, 0xffffffffffffffff
jne 0x140041906
lea rcx, [rbx + 0x14]
jmp 0x140041946
lea rdx, [rbx + 0x168]
test rcx, rcx
je 0x140041921
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__findnext64i32]
xor edx, edx
test eax, eax
sete dl
jmp 0x14004193e
mov rcx, qword [rbx + 0x158]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__findfirst64i32]
xor edx, edx
mov qword [rbx + 0x160], rax
cmp rax, 0xffffffffffffffff
setne dl
lea rcx, [rbx + 0x14]
test edx, edx
jne 0x140041969
cmp dword [rbx + 0x10], 0
je 0x1400419ef
mov word [rcx], 0x2e2e
mov byte [rcx + 2], 0
mov dword [rbx + 0x10], 0
mov rax, rcx
add rsp, 0x20
pop rbx
ret
lea rdx, [rbx + 0x18c]
mov r8, rcx
movzx eax, byte [rdx]
inc rdx
mov byte [rcx], al
test al, al
je 0x140041992
nop
movzx eax, byte [rdx]
lea r8, [r8 + 1]
mov byte [r8], al
lea rdx, [rdx + 1]
test al, al
jne 0x140041980
cmp byte [rcx], 0
jne 0x14004199c
mov word [rcx], 0x2e
cmp byte [rcx], 0x2e
jne 0x140041960
cmp byte [rcx + 1], 0x2e
mov rax, rcx
jne 0x1400419f1
mov dword [rbx + 0x10], 0
add rsp, 0x20
pop rbx
ret
cmp dword [rcx + 8], 0
je 0x1400419ef
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, dword [rbx + 0xc]
inc ecx
mov dword [rbx + 0xc], ecx
cmp ecx, 0x1a
jge 0x1400419ef
bt eax, ecx
jae 0x1400419c3
cmp ecx, 0x1a
jge 0x1400419ef
lea rax, [rbx + 0x14]
add cl, 0x41
mov word [rax + 1], 0x3a
mov byte [rax], cl
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140042050
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [0x141845408]
test rcx, rcx
jne 0x14004208e
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
lea rdx, str.Error:_malc__zu_:_no_segment_open_n
mov rcx, rax
call fcn.140012100
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400420a0

Function at 0x140051ce0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [rcx + 0x10]
mov rbx, rcx
movabs rcx, 0x7fffffffffffffff
mov byte [rsp + 0x70], 0xa
cmp rax, rcx
je 0x140051dd1
cmp qword [rbx + 0x18], 0x10
mov r9, rbx
jb 0x140051d12
mov r9, qword [rbx]
movzx edx, byte [rsp + 0x70]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x30], 1
mov r8, rbx
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.140045520
cmp qword [rsp + 0x58], 0x10
lea rcx, [rsp + 0x40]
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140051d93
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051d8e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051d8e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005ade0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.TRACE:
call fcn.14003edd0
cmp qword [rbx + 0x18], 0x10
jb case.default.0x140051dca
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.14003edd0
lea rdx, [fcn.14003f5f0]
mov rcx, rax
add rsp, 0x60
pop rbx
jmp qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.140040490
int3
Function at 0x140057eb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, rdx
mov r9, qword [rcx + 8]
test r9, r9
je 0x140057f9e
test byte [r9 + 8], 1
je 0x140057efe
mov r9, qword [r9]
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1e0
pop rbp
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x30]
call fcn.14003fbe0
nop
lea rdx, str.File_not_open_for_reading
mov rcx, rax
call fcn.140056820
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.1400401e0
nop
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.14003fc80
mov rbx, rax
lea rdx, [0x14005fc85]
lea rcx, [rsp + 0x70]
call fcn.14003fad0
nop
lea rdx, str.CST::FileReadError
lea rcx, [rsp + 0x50]
call fcn.14003fad0
nop
lea rcx, [rbp + 0x58]
call fcn.1400573d0
nop
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x50]
mov r8, rax
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.140056dc0
lea rdx, [0x140070ac0]
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x30]
call fcn.14003fbe0
nop
lea rdx, str.Cannot_read_a_non_opened_file
mov rcx, rax
call fcn.14003ebc0
lea rdx, [rbp - 0x70]
mov rcx, rax
call fcn.1400401e0
nop
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.14003fc80
mov rbx, rax
lea rdx, [0x14005fc85]
lea rcx, [rsp + 0x50]
call fcn.14003fad0
nop
lea rdx, str.CST::FileNotOpen
lea rcx, [rsp + 0x70]
call fcn.14003fad0
nop
lea rcx, [rbp + 0x58]
call fcn.140057230
nop
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x70]
mov r8, rax
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.140056c80
lea rdx, [0x140070c60]
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140058d90
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rbx, rcx
mov dword [rsp + 0x30], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, eax
test eax, eax
je 0x140058ef4
mov edx, edi
xor r8d, r8d
mov rcx, rbx
call fcn.140048030
mov dword [rsp + 0x30], 1
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140058df0
mov rdx, qword [rbx]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x140058e3c
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140058e09
mov rax, qword [rbx]
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rax + rdx], 0
jne 0x140058e10
xor r8d, r8d
mov rcx, rbx
call fcn.1400590d0
mov rax, rbx
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x38]
call fcn.14003fbe0
nop
lea rdx, str.Could_not_get_current_directory:
mov rcx, rax
call fcn.14003ebc0
mov rbx, rax
lea rcx, [rbp - 0x28]
call fcn.1400591b0
nop
mov rdx, rax
mov rcx, rbx
call fcn.140050450
lea rdx, [rbp - 0x48]
mov rcx, rax
call fcn.1400401e0
nop
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.14003fc80
mov rbx, rax
lea rdx, [0x14005fc85]
lea rcx, [rsp + 0x78]
call fcn.14003fad0
nop
lea rdx, str.Error
lea rcx, [rsp + 0x58]
call fcn.14003fad0
nop
lea rcx, [rbp + 0x78]
call fcn.140058cd0
nop
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x58]
mov r8, rax
lea rdx, [rbp - 8]
mov rcx, rbx
call fcn.140058c00
lea rdx, [0x140070fa0]
lea rcx, [rbp - 8]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x38]
call fcn.14003fbe0
nop
lea rdx, str.GetCurrentDirectory_could_not_tell_buffer_size:
mov rcx, rax
call fcn.14003ebc0
mov rbx, rax
lea rcx, [rbp - 0x68]
call fcn.1400591b0
nop
mov rdx, rax
mov rcx, rbx
call fcn.140050450
lea rdx, [rbp - 0x48]
mov rcx, rax
call fcn.1400401e0
nop
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14003fc80
mov rbx, rax
lea rdx, [0x14005fc85]
lea rcx, [rsp + 0x58]
call fcn.14003fad0
nop
lea rdx, str.Error
lea rcx, [rsp + 0x78]
call fcn.14003fad0
nop
lea rcx, [rbp + 0x78]
call fcn.140058cd0
nop
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x78]
mov r8, rax
lea rdx, [rbp - 8]
mov rcx, rbx
call fcn.140058c00
lea rdx, [0x140070fa0]
lea rcx, [rbp - 8]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x14005b5b8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005b602
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005b602
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005b602
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005b602
cmp dword [rcx + 0x84], 0xe
jbe 0x14005b602
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005b604
xor al, al
add rsp, 0x28
ret
Function at 0x14005b958
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14005b9dc
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140066dc0]
cmp byte [rcx + rax], 0
je 0x14005b9dc
dec r8
sub rdx, 1
jne 0x14005b9c2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400018c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp byte [0x14009f466], 0
movzx esi, dl
mov rdi, r8
setne al
add dl, 2
add al, dl
movzx ebp, al
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
cmp byte [0x14009f466], 0
mov rbx, rax
je 0x140001953
movzx r8d, sil
movzx r9d, sil
or r8b, 0x80
mov byte [rax], 0x51
mov byte [rax + 1], r8b
xor r8b, 0x3f
lea ecx, [r9 + 2]
mov r10d, ecx
mov byte [rcx + rax], r8b
test sil, sil
je 0x140001945
lea rcx, [rax + 2]
sub rdi, rax
nop
movzx eax, byte [rdi + rcx - 2]
mov byte [rcx], al
lea rcx, [rcx + 1]
xor byte [r10 + rbx], al
sub r9, 1
jne 0x140001930
mov r9, rbx
movzx r8d, bpl
call fcn.140002110
jmp 0x1400019a1
movzx edx, sil
movzx r8d, sil
or dl, 0x80
mov byte [rax], dl
xor dl, 0x3f
lea eax, [r8 + 1]
mov r9d, eax
mov byte [rax + rbx], dl
test sil, sil
je 0x140001995
lea rcx, [rbx + 1]
sub rdi, rbx
nop dword [rax]
movzx eax, byte [rdi + rcx - 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
xor byte [r9 + rbx], al
sub r8, 1
jne 0x140001980
mov r9, rbx
movzx r8d, bpl
call fcn.140001c10
mov rcx, rbx
mov edi, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140004650
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x70
mov qword [r11 - 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x140099110]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14, r9
mov rsi, rcx
mov qword [r11 - 0x48], rcx
mov qword [r11 - 0x40], r9
mov dword [rcx], edx
mov dword [rcx + 4], r8d
mov byte [rcx + 8], 0
lea rdi, [rcx + 0x10]
mov qword [r11 - 0x38], rdi
mov eax, dword [r9]
mov dword [rdi], eax
lea rbx, [rdi + 8]
mov qword [rsp + 0x30], rbx
xor ebp, ebp
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
xor r8d, r8d
xor edx, edx
call fcn.140018f10
mov qword [rbx], rax
mov qword [rdi + 0x18], rbp
mov qword [rdi + 0x20], rbp
mov qword [rdi + 0x28], rbp
mov rdx, r14
mov rcx, rdi
call fcn.140015340
nop
mov r8d, dword [rsi]
mov dword [rsp + 0x50], r8d
movzx edx, r8b
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, byte [rsp + 0x51]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x52]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x53]
xor rdx, rax
imul rdx, rcx
mov rcx, qword [rdi + 0x30]
and rcx, rdx
mov rdx, qword [rdi + 0x18]
mov rax, rcx
add rax, rax
mov rax, qword [rdx + rax*8]
add rcx, rcx
lea r9, [rcx*8 + 8]
mov r10, qword [rdx + rcx*8]
cmp r10, qword [rdi + 8]
jne 0x140004751
mov rcx, qword [rdi + 8]
jmp 0x140004758
mov rcx, qword [r9 + rdx]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140004768
cmp r8d, dword [rax + 0x10]
je 0x14000476c
mov rax, qword [rax]
jmp 0x140004745
mov rax, qword [rdi + 8]
cmp qword [rsi + 0x18], rax
je 0x1400047ea
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x50]
call fcn.14001f960
nop
mov byte [rsp + 0x20], 1
mov edx, dword [rsi]
lea rcx, [rsp + 0x50]
call fcn.14001fbf0
test eax, eax
setne cl
mov byte [rsi + 8], cl
lea rcx, str.SUCCESS
lea r8, str.FAILED
test eax, eax
cmovne r8, rcx
mov edx, dword [rsi]
lea rcx, str.INFO:_SetNvidiaButtonLatencyTest__d__0x0000__0x0000__1_____s_n
call fcn.140021800
nop
mov r8, qword [rsp + 0x50]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140020560
mov rcx, qword [rsp + 0x50]
call fcn.14006ec98
nop
mov rcx, r14
call fcn.140009630
mov rax, rsi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14006e6d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret