Function at 0x140032f90
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov rax, qword [0x1402854d8]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov rax, qword [str.0x00000000_n]
mov ebx, dword [0x14028b5fc]
mov rdi, rcx
lea rcx, [rsp + 0x70]
mov r13d, edx
mov qword [rcx], rax
mov rax, qword [0x14023e620]
mov qword [rcx + 8], rax
mov rax, qword [0x14023e628]
mov qword [rcx + 0x10], rax
lea rcx, str._WARNING___PE_SIGNATURE_VERIFICATION_FAILED_____n_Filename:
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
lea rcx, str._n_Error:
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
mov edi, 0x37
mov r8d, 0x30
mov eax, edi
mov ecx, r13d
mov edx, r13d
shr edx, 0x1c
and dx, 0xf
cmp dx, 0xa
cmovb ax, r8w
shr ecx, 0x18
and cx, 0xf
add dx, ax
mov eax, edi
cmp cx, 0xa
mov word [rsp + 0x74], dx
cmovb ax, r8w
add cx, ax
mov eax, edi
mov word [rsp + 0x76], cx
mov ecx, r13d
shr ecx, 0x14
and cx, 0xf
cmp cx, 0xa
cmovb ax, r8w
add cx, ax
mov eax, edi
mov word [rsp + 0x78], cx
mov ecx, r13d
shr ecx, 0x10
and cx, 0xf
cmp cx, 0xa
cmovb ax, r8w
add cx, ax
mov eax, edi
mov word [rsp + 0x7a], cx
mov ecx, r13d
shr ecx, 0xc
and cx, 0xf
cmp cx, 0xa
cmovb ax, r8w
add cx, ax
mov eax, edi
mov word [rsp + 0x7c], cx
mov ecx, r13d
shr ecx, 8
and cx, 0xf
cmp cx, 0xa
cmovb ax, r8w
add cx, ax
mov eax, edi
mov word [rsp + 0x7e], cx
mov ecx, r13d
shr ecx, 4
and cx, 0xf
cmp cx, 0xa
cmovb ax, r8w
add cx, ax
movzx eax, r13w
and ax, 0xf
mov word [rsp + 0x80], cx
lea rcx, [rsp + 0x70]
cmp ax, 0xa
cmovb di, r8w
add ax, di
mov word [rsp + 0x82], ax
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
test ebx, ebx
jne 0x14003345f
cmp dword [0x1402854b0], ebx
je 0x1400334a8
mov eax, 0x200
mov r15d, 0x100
xor r14d, r14d
mov word [rsp + 0x6a], ax
mov eax, 0x8496
mov ecx, 0x42ea
mov word [rsp + 0x5c], ax
mov eax, 0x4def
mov word [rsp + 0x68], r15w
mov word [rsp + 0x6c], r14w
mov dword [rsp + 0x58], 0x41fcc608
mov byte [rsp + 0x60], 0xb4
mov word [rsp + 0x5e], ax
mov byte [rsp + 0x61], 0x3e
mov byte [rsp + 0x62], 0x7d
mov byte [rsp + 0x63], 0x9b
mov byte [rsp + 0x64], 0xd6
mov byte [rsp + 0x65], 0x75
mov byte [rsp + 0x66], 0xa6
mov byte [rsp + 0x67], 0xff
call fcn.14002e940
test eax, eax
mov rax, qword [0x14028b510]
lea rcx, str.SYSTEMControlSet001Services_nvlddmkm
lea r12, str.SOFTWARENVIDIA_CorporationGlobal
mov dword [0x1402854b0], r14d
cmovne r12, rcx
test rax, rax
jne 0x1400331d3
lea rcx, str.Advapi32.dll
xor edx, edx
call fcn.14002dd50
mov qword [0x14028b510], rax
test rax, rax
je 0x1400334ba
cmp qword [0x14028b518], r14
jne 0x140033203
lea rdx, str.RegOpenKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x14028b518], rax
test rax, rax
je 0x1400334ba
mov rax, qword [0x14028b510]
cmp qword [0x14028b520], r14
jne 0x140033233
lea rdx, str.RegEnumValueW
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x14028b520], rax
test rax, rax
je 0x1400334ba
mov rax, qword [0x14028b510]
cmp qword [0x14028b530], r14
jne 0x14003325c
lea rdx, str.RegCloseKey
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x14028b530], rax
test rax, rax
je 0x1400334ba
cmp qword [0x14028b560], r14
jne 0x140033298
lea rcx, str.Ole32.dll
xor edx, edx
call fcn.14002dd50
mov qword [0x14028b560], rax
test rax, rax
je 0x140033298
lea rdx, str.StringFromGUID2
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x14028b568], rax
jmp 0x14003329f
mov rax, qword [0x14028b568]
test rax, rax
je 0x1400334ba
xor ecx, ecx
lea rdx, [rsp + 0x90]
lea r8d, [rcx + 0x27]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xc8], rcx
mov qword [rsp + 0xd0], rcx
mov dword [rsp + 0xd8], ecx
mov word [rsp + 0xdc], cx
lea rcx, [rsp + 0x58]
call rax
cmp eax, 0x27
jne 0x1400334ba
lea rbp, [rsp + 0x68]
movzx eax, word [rbp]
test ax, ax
je 0x1400334a4
movzx r9d, ax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov rdx, r12
mov rcx, 0xffffffff80000002
or r9d, 0x20019
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], r14
call qword [0x14028b518]
test eax, eax
jne 0x140033453
mov ebx, r14d
mov esi, r14d
nop word [rax + rax]
lea rcx, [rsp + 0xe0]
mov r8, r15
xor edx, edx
mov dword [rsp + 0x40], 0x80
mov dword [rsp + 0x54], 4
call fcn.140107f60
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x54]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xe0]
mov edx, ebx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [0x14028b520]
inc ebx
test eax, eax
jne 0x14003342f
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x90]
repne scasw ax, word [rdi]
mov eax, dword [rsp + 0x40]
not rcx
dec rcx
cmp rcx, rax
jne 0x140033370
lea rax, [rsp + 0x90]
lea rdi, [rsp + 0xe0]
sub rdi, rax
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x140033416
add rax, 2
test ecx, ecx
jne 0x140033403
test edx, edx
jne 0x140033370
mov eax, r14d
cmp dword [rsp + 0x50], eax
setne al
or esi, eax
jmp 0x140033370
cmp eax, 0x103
jne 0x140033370
mov rcx, qword [rsp + 0x48]
call qword [0x14028b530]
mov ebx, r14d
test esi, esi
setne bl
mov dword [0x14028b5fc], ebx
add rbp, 2
test ebx, ebx
je 0x140033322
lea rcx, str._Signature_override_detected..._n
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, 1
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140106650
mov rbx, qword [rsp + 0x240]
add rsp, 0x1f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test ebx, ebx
jne 0x14003345f
cmp dword [0x14028b5fc], 0
jne 0x14003345f
mov ecx, r13d
call qword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
jmp 0x140033479