joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1409a2665
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r9
mov ax, r15w
lahf
cmovne rsi, rcx
push r13
mov dl, dil
cbw
movsx ax, spl
push r8
bswap r8w
movzx r10w, dil
jmp 0x14097d6fd
push rdi
cbw
push r12
movzx si, r15b
push r14
rdtsc
push r11
setle r11b
cbw
movsxd r10, r8d
pushfq
mov bpl, bpl
bswap dx
movzx r10w, al
push r15
cdqe
movabs rax, 0
cwd
dec r11w
push rax
cqo
mov rsi, qword [rsp + 0x90]
movzx r11d, bx
cqo
not esi
xchg r8b, dl
bswap r8
inc esi
not r11b
bswap r11w
rol esi, 1
shr r11b, 0x47
or r10w, 0x6017
and r10b, r9b
sub esi, 0x5f970158
bsr rdx, rsp
xchg ebp, ebp
sal dh, 0x3b
add rsi, rax
test r9b, 0x35
bts r11d, r14d
bt r8w, 0xc3
movabs rax, 0x100000000
xor r10b, sil
mov dl, r14b
lea rsi, [rsi + rax]
test sil, bl
not r10b
movsxd rbp, r14d
mov rbp, rsp
rol dl, 0x3c
and r8w, r15w
sub rsp, 0x180
and rsp, 0xfffffffffffffff0
and r8b, 0x51
mov r10, rsi
ror r11d, 0x2c
test dil, spl
cmp r15b, 0x84
movabs rdx, 0
movsx r11, r15w
sub r10, rdx
xadd r11w, r8w
lea r8, [0x14097d7e4]
rcr r11b, cl
mov r11d, dword [rsi]
test r11b, spl
cmp r8w, dx
add rsi, 4
cmp bx, 0xd28
test r11w, r9w
stc
xor r11d, r10d
cmp r11b, 0xaf
test r13w, r11w
not r11d
xor r11d, 0x3aac089a
stc
cmp r15w, r13w
not r11d
stc
cmp sil, cl
clc
neg r11d
jmp 0x140a52316
push rdx
push rbp
push rax
movsx bp, al
movsx edx, si
rdtsc
push rsi
movzx dx, dil
push rcx
cbw
push r10
movzx r10d, ax
push rbx
not si
jmp 0x140957ddc
jmp r8
push r10
xor dword [rsp], r11d
pop r10
cmp r8w, r8w
movsxd r11, r11d
cmp r8, 0x611e0bd4
add r8, r11
jmp 0x1409dc41d
rol r11d, 3
cmp r11b, dl
test bl, r8b
jmp 0x140a29f73
Function at 0x40de20
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x40de2d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x40de3d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x40de25
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x40de55
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x40de42
sub eax, 3
jb 0x40de6f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x40dea6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x40de96
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x40de94
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x40de83
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.0040dde2
jmp 0x40de2d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2200
mov dl, 4
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x40def2
cmp rsi, rcx
jae 0x40defa
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x40ded9
cmp al, 0x8f
ja 0x40ded9
cmp byte [rsi - 2], 0xf
je 0x40dedf
sub al, 0xe8
cmp al, 1
ja 0x40dec3
cmp rsi, rcx
jae 0x40defa
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x40dec9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x40defa
lodsb al, byte [rsi]
jmp 0x40ded9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xb000]
mov eax, dword [rdi]
or eax, eax
je 0x40df57
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xe000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x40df07
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x40df51
mov qword [rbx], rax
add rbx, 8
jmp 0x40df27
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.0040dfda], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.0040dfda
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x40dfca
sub rsp, 0xffffffffffffff80
jmp 0x4014e0
Function at 0x140001290
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Securely_exiting_blood_hound...
call fcn.140001f70
mov rcx, rax
lea rdx, [0x140002150]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140001000
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x28], 5
lea r8, str.http:__twitch.tv_OdsScott
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
add rsp, 0x38
ret

Function at 0x140001908
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001952
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001952
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001952
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001952
cmp dword [rcx + 0x84], 0xe
jbe 0x140001952
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001954
xor al, al
add rsp, 0x28
ret
Function at 0x1400174b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.14003f370
sub rsp, rax
mov rax, qword [0x140057040]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x140017572
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.140033774
cmp rax, 1
jne 0x1400175ce
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14001754f
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140017543
cmp rcx, 1
jb 0x1400175ce
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140017510
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x1400175a3
lea rcx, [rsp + 0x80]
call fcn.140034b80
jmp 0x1400175a5
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.140024cd0
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140028430
int3

Function at 0x1400175e0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140057040]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor ebp, ebp
lea rsi, str.NUITKA_PYTHONPATH
mov word [rsp + 0x30], bp
lea rbx, [rsp + 0x30]
mov edi, 0x28
mov al, 0x4e
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.140033774
cmp rax, 1
jne 0x1400176c5
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14001766c
nop
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140017660
cmp rcx, 1
jb 0x1400176c5
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140017630
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140024cd0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140028430
int3
Function at 0x14001fc70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x14005c02e], 0
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
jne 0x14001fcf3
mov edx, 3
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x14005c000], rax
mov ebx, dword [rax]
lea rdx, [rax + 4]
mov qword [0x14005c000], rdx
mov r8d, dword [rdx]
add rdx, 4
mov qword [0x14005c000], rdx
call fcn.14001dff0
cmp eax, ebx
jne 0x14001fe5d
mov byte [0x14005c02e], 1
lea rdx, [0x14004a3e0]
mov rcx, rsi
call fcn.14003f4b0
test eax, eax
je 0x14001fd7e
cmp byte [0x14005c02f], 1
je 0x14001fd7e
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x14005c638], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x14005caf0], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x14005c358], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x14005c2c0], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x14005cb50], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x14005c3e8], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x14005caf8], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x14005cb10], rax
mov byte [0x14005c02f], 1
mov r8, qword [0x14005c000]
mov rax, rsi
mov rdx, r8
sub rdx, rsi
nop
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x14001fda7
inc rax
test cl, cl
jne 0x14001fd90
mov ecx, r9d
jmp 0x14001fdac
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [r8 + rax + 1], r9b
lea rax, [rax + 1]
jne 0x14001fdb3
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 1]
add rdx, 5
test ecx, ecx
je 0x14001fe18
nop
add rdx, rax
mov rax, rsi
mov r8, rdx
sub r8, rsi
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x14001fdf5
inc rax
test cl, cl
jne 0x14001fde0
mov ecx, r9d
jmp 0x14001fdfa
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x14001fe01
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x14001fdd0
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x14001fe48
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.14001ecf0
add rdi, 8
sub rbx, 1
jne 0x14001fe30
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.1400302a4
call fcn.140028430
int3

Function at 0x1400256dc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140025726
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140025726
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140025726
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140025726
cmp dword [rcx + 0x84], 0xe
jbe 0x140025726
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140025728
xor al, al
add rsp, 0x28
ret
Function at 0x14002858c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400285fb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400285fb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400285fb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400285fb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400285fb
cmp dword [rcx + 0x84], 0xe
jbe 0x1400285fb
cmp dword [rcx + 0xf8], 0
je 0x1400285fb
mov ecx, ebx
call fcn.1400286ac
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140028488
nop
cmp dword [rbp + 0x20], 0
je 0x140028649
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140028654
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002858c

Function at 0x140028790
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400285fb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400285fb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400285fb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400285fb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400285fb
cmp dword [rcx + 0x84], 0xe
jbe 0x1400285fb
cmp dword [rcx + 0xf8], 0
je 0x1400285fb
mov ecx, ebx
call fcn.1400286ac
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140028488
nop
cmp dword [rbp + 0x20], 0
je 0x140028649
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140028654
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002858c
Function at 0x1400394a8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14003952f
mov rsi, rbx
cmp word [rax], bp
je 0x1400394ee
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400394d8
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400394d4
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400370b0
mov rdi, rax
test rax, rax
je 0x14003951c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14003f950
mov rbp, rdi
xor ecx, ecx
call fcn.1400351ec
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003b7d8
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14003b7ee
mov al, 1
jmp 0x14003b84e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14003b7ff
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14003b84c
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400397f0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003b84c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003b84c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003b84c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14003b84e
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14003f280
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003f2a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14003f2a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400010c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs rax, 0xb2d05e00
mov rbx, rax
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rcx
cmp rax, rbx
jb 0x1400010d9
push rbp
mov rbp, rsp
sub rsp, 8
mov r10, 0xa
mov rcx, 0xffffffff9f345678
dec rcx
xor r9, r9
mov rax, rcx
jne 0x140001100
xor rax, rax
mov rax, rbx
add rax, rdx
nop
nop
nop
dec r10
xor r11, r11
jne 0x1400010f9
xor rax, rax
mov rax, 0xa
dec rax
nop
nop
add rsp, 8
pop rbp
ret

Function at 0x140004910
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.kernel32
mov dword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x14000495e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x38]
mov rcx, rax
call rdi
test eax, eax
je 0x1400049a5
cmp dword [rsp + 0x38], 0
je 0x1400049a5
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140004997
mov eax, 8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [rbx + 0x48]
call rax
test eax, eax
je 0x140004987
or dword [rbx + 0x50], 0x40
lea rcx, [rbx + 0x58]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140004987
or dword [rbx + 0x50], 0x20
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140004e20
Capabilities:
Check if file exists
Get file attributes
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140036460]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
lea rdx, [rsp + 0x40]
lea rcx, str.allusersprofile
mov r8d, 0x104
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140004e91
lea r9, [rsp + 0x40]
lea r8, str._sNVIDIA_CorporationDrs
lea rcx, [rdi + 0x58]
mov edx, 0x200
call fcn.140004d00
test eax, eax
js 0x140004e91
lea rcx, [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140004fff
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004f4a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.Common_AppData
xor r8d, r8d
mov dword [rsp + 0x34], 0x20a
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004f37
cmp dword [rsp + 0x30], 1
jne 0x140004f37
lea r9, [rsp + 0x40]
lea r8, str._sNVIDIA_CorporationDrs
lea rcx, [rdi + 0x58]
mov edx, 0x200
call fcn.140004d00
test eax, eax
js 0x140004f35
lea rcx, [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140004f35
mov ebx, 1
jmp 0x140004f37
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140004fff
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005007
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.NVDRS_PATH
xor r8d, r8d
mov dword [rsp + 0x30], 0x20a
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004ff0
cmp dword [rsp + 0x34], 1
jne 0x140004ff0
lea r9, [rsp + 0x40]
lea r8, str._sNVIDIA_CorporationDrs
lea rcx, [rdi + 0x58]
mov edx, 0x200
call fcn.140004d00
test eax, eax
js 0x140004fee
lea rcx, [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140004fee
mov ebx, 1
jmp 0x140004ff0
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140005007
or dword [rdi + 0x50], 0x20
xor eax, eax
jmp 0x14000500c
mov eax, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400177a0
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
Function at 0x140005030
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x140036460]
xor rax, rsp
mov qword [rsp + 0x140], rax
test byte [rcx + 0x54], 1
mov rbx, rcx
je 0x140005087
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140005080
cmp dword [rsp + 0x24], 5
jne 0x140005087
mov rcx, rbx
call fcn.140004910
test eax, eax
je 0x140005093
jmp 0x140005095
mov eax, 8
jmp 0x140005095
mov rcx, rbx
call fcn.140004e20
test eax, eax
jne 0x140005095
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400177a0
add rsp, 0x150
pop rbx
ret
Function at 0x1400050b0
Capabilities:
Check if file exists
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x140036460]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, rcx
lea rcx, str.kernel32
xor ebx, ebx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x140005116
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
call rsi
test eax, eax
je 0x14000515f
cmp dword [rsp + 0x30], ebx
je 0x14000515f
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140005148
mov eax, 8
jmp 0x14000526e
lea rcx, [rdi + 0x48]
call rax
test eax, eax
je 0x14000513e
or dword [rdi + 0x50], 0x40
lea rcx, str.ProgramW6432
jmp 0x140005166
lea rcx, str.ProgramFiles
lea rdx, [rsp + 0x40]
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400051ac
lea r9, [rsp + 0x40]
lea r8, str._sNVIDIA_CorporationDrs
lea rcx, [rdi + 0x58]
mov edx, 0x200
call fcn.140004d00
test eax, eax
js 0x1400051ac
lea rcx, [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140005261
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005269
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.NVDRS_GOLD_PATH
xor r8d, r8d
mov dword [rsp + 0x30], 0x402
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005252
cmp dword [rsp + 0x34], 1
jne 0x140005252
lea r9, [rsp + 0x40]
lea r8, str._sNVIDIA_CorporationDrs
lea rcx, [rdi + 0x58]
mov edx, 0x200
call fcn.140004d00
test eax, eax
js 0x140005250
lea rcx, [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140005250
mov ebx, 1
jmp 0x140005252
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140005269
or dword [rdi + 0x50], 0x20
xor eax, eax
jmp 0x14000526e
mov eax, 1
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400177a0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret