joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ea50
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov r15, rdx
mov r14, rcx
mov esi, 0x32f54a96
mov eax, dword [rdx + 8]
test eax, eax
je 0x14000eab4
mov r9, qword [rdx]
mov edx, eax
nop dword [rax]
movzx eax, word [r9]
imul ecx, eax, 0xc5
imul eax, esi, 0x34c3
add ecx, eax
mov eax, esi
shr eax, 2
mov esi, ecx
xor esi, eax
lea r9, [r9 + 2]
dec rdx
jne 0x14000ea90
and esi, 0x3fffffff
mov ecx, dword [r14 + 8]
mov edi, 1
mov r12d, edi
shl r12d, cl
dec r12d
mov ebx, r12d
and ebx, esi
mov r13d, ebx
nop dword [rax]
nop dword [rax + rax]
mov rdx, r15
lea rcx, [rsp + 0x28]
call fcn.14001deb0
mov rbp, rax
mov qword [rsp + 0x80], rax
mov ecx, ebx
shl rcx, 5
mov rax, qword [r14]
test byte [rcx + rax], 1
je 0x14000eb73
lea rdx, [rax + 8]
add rdx, rcx
mov rcx, rbp
call fcn.14001e2f0
test al, al
jne 0x14000eb5a
mov rcx, rbp
call fcn.14001e770
add ebx, edi
and ebx, r12d
inc edi
cmp ebx, r13d
jne 0x14000eae0
mov ecx, dword [r14 + 0x10]
lea eax, [rcx + 1]
mov dword [r14 + 0x10], eax
cmp ecx, 4
jbe 0x14000eb4e
mov rcx, r14
call fcn.140018ab0
mov dword [r14 + 0x10], 0
mov rcx, r15
call fcn.14001e770
xor eax, eax
jmp 0x14000ebd3
mov edx, ebx
shl rdx, 5
mov rcx, qword [r14]
mov rax, qword [rsp + 0x90]
mov eax, dword [rax]
mov dword [rdx + rcx + 0x18], eax
jmp 0x14000ebc0
mov edi, ebx
shl rdi, 5
or dword [rdi + rax], 1
mov rax, qword [r14]
and dword [rdi + rax], 0xfffffffd
mov rdx, qword [r14]
mov ecx, dword [rdx + rdi]
and ecx, 3
lea eax, [rsi*4]
or ecx, eax
mov dword [rdx + rdi], ecx
mov rcx, qword [r14]
add rcx, 8
add rcx, rdi
mov rdx, rbp
call fcn.14001e090
mov rdx, qword [r14]
mov rax, qword [rsp + 0x90]
mov ecx, dword [rax]
mov dword [rdi + rdx + 0x18], ecx
inc dword [r14 + 0xc]
mov rcx, rbp
call fcn.14001e770
nop
mov rcx, r15
call fcn.14001e770
mov eax, ebx
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000ebf0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov r15, rdx
mov r14, rcx
mov r9d, 0x32f54a96
mov eax, dword [rdx + 8]
test eax, eax
je 0x14000ec58
mov r10, qword [rdx]
mov r8d, eax
nop
movzx eax, word [r10]
imul ecx, eax, 0xc5
imul eax, r9d, 0x34c3
add ecx, eax
mov eax, r9d
shr eax, 2
mov r9d, ecx
xor r9d, eax
lea r10, [r10 + 2]
dec r8
jne 0x14000ec30
and r9d, 0x3fffffff
mov ecx, dword [r14 + 8]
mov r12d, 1
mov ebp, r12d
shl ebp, cl
dec ebp
mov edi, ebp
and edi, r9d
mov r13d, edi
mov esi, r12d
nop dword [rax + rax]
mov rdx, r15
lea rcx, [rsp + 0x28]
call fcn.14001deb0
mov rbx, rax
mov qword [rsp + 0x80], rax
mov edx, edi
shl rdx, 5
mov rcx, qword [r14]
test byte [rdx + rcx], 2
jne 0x14000ecba
add rcx, 8
add rdx, rcx
mov rcx, rax
call fcn.14001e350
test al, al
je 0x14000eccf
mov rcx, rbx
call fcn.14001e770
add edi, esi
and edi, ebp
inc esi
cmp edi, r13d
je 0x14000ed14
jmp 0x14000ec80
mov edx, edi
shl rdx, 5
add rdx, qword [r14]
test byte [rdx], 1
je 0x14000ecf7
mov rax, qword [rsp + 0x90]
mov eax, dword [rax]
mov dword [rdx + 0x18], eax
mov rcx, rbx
call fcn.14001e770
xor r12d, r12d
jmp 0x14000ecff
mov rcx, rbx
call fcn.14001e770
or ebx, 0xffffffff
test r12d, r12d
cmove ebx, edi
mov rcx, r15
call fcn.14001e770
mov eax, ebx
jmp 0x14000ed3d
mov ecx, dword [r14 + 0x10]
lea eax, [rcx + 1]
mov dword [r14 + 0x10], eax
cmp ecx, 4
jbe 0x14000ed33
mov rcx, r14
call fcn.140018ab0
xor r12d, r12d
mov dword [r14 + 0x10], r12d
mov rcx, r15
call fcn.14001e770
xor eax, eax
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000ed60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov r14, rdx
mov r15, rcx
mov r8d, 0x32f54a96
mov eax, dword [rdx + 8]
test eax, eax
je 0x14000edc8
mov r9, qword [rdx]
mov r10d, eax
nop
movzx eax, word [r9]
imul ecx, eax, 0xc5
imul eax, r8d, 0x34c3
add ecx, eax
mov eax, r8d
shr eax, 2
mov r8d, ecx
xor r8d, eax
lea r9, [r9 + 2]
dec r10
jne 0x14000eda0
and r8d, 0x3fffffff
mov ecx, dword [r15 + 8]
mov r12d, 1
mov ebp, r12d
shl ebp, cl
dec ebp
mov edi, ebp
and edi, r8d
mov r13d, edi
mov esi, r12d
nop dword [rax + rax]
mov rdx, r14
lea rcx, [rsp + 0x28]
call fcn.14001deb0
mov rbx, rax
mov qword [rsp + 0x80], rax
mov edx, edi
shl rdx, 5
add rdx, qword [r15]
mov ecx, dword [rdx]
mov eax, ecx
and eax, 1
jne 0x14000ee1f
test cl, 2
je 0x14000ee48
test eax, eax
je 0x14000ee33
add rdx, 8
mov rcx, rbx
call fcn.14001e2f0
test al, al
jne 0x14000ee52
mov rcx, rbx
call fcn.14001e770
add edi, esi
and edi, ebp
inc esi
cmp edi, r13d
je 0x14000ee72
jmp 0x14000edf0
mov rcx, rbx
call fcn.14001e770
jmp 0x14000ee5d
mov rcx, rbx
call fcn.14001e770
xor r12d, r12d
or ebx, 0xffffffff
test r12d, r12d
cmove ebx, edi
mov rcx, r14
call fcn.14001e770
mov eax, ebx
jmp 0x14000ee9b
mov ecx, dword [r15 + 0x10]
lea eax, [rcx + 1]
mov dword [r15 + 0x10], eax
cmp ecx, 4
jbe 0x14000ee91
mov rcx, r15
call fcn.140018ab0
xor r12d, r12d
mov dword [r15 + 0x10], r12d
mov rcx, r14
call fcn.14001e770
xor eax, eax
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400125e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], rbp
mov r15, r9
movzx r12d, r8b
mov rdi, rdx
mov r14, rcx
mov r10d, dword [rdx + 8]
test r10d, r10d
je 0x140012768
mov r11, qword [rdx]
cmp word [r11], 0
je 0x140012768
xor esi, esi
mov edx, esi
test r10d, r10d
je 0x140012651
mov eax, edx
cmp word [r11 + rax*2], 0x2c
je 0x140012647
inc edx
cmp edx, r10d
jb 0x140012634
jmp 0x140012651
mov eax, 0x11
jmp 0x14001276d
mov rdx, rdi
add rcx, 0x48
call fcn.140014c10
test rax, rax
je 0x14001266c
mov eax, 8
jmp 0x14001276d
mov ebx, 0x32f54a96
mov eax, dword [rdi + 8]
test eax, eax
je 0x1400126a3
mov rdx, qword [rdi]
mov r8d, eax
nop
movzx eax, word [rdx]
imul ecx, eax, 0xc5
imul eax, ebx, 0x34c3
add ecx, eax
mov eax, ebx
shr eax, 2
mov ebx, ecx
xor ebx, eax
lea rdx, [rdx + 2]
dec r8
jne 0x140012680
mov dword [rsp + 0x78], ebx
mov rdx, qword [r14]
mov rax, rdx
test rdx, rdx
je 0x1400126fc
mov ecx, dword [rax + 8]
cmp ebx, ecx
je 0x1400126d0
jae 0x1400126c1
mov rax, qword [rax + 0x18]
jmp 0x1400126c5
mov rax, qword [rax + 0x20]
test rax, rax
jne 0x1400126b2
jmp 0x1400126fc
inc ebx
mov rax, rdx
test rdx, rdx
je 0x1400126f8
nop word [rax + rax]
mov ecx, dword [rax + 8]
cmp ebx, ecx
je 0x1400126d0
jae 0x1400126ef
mov rax, qword [rax + 0x18]
jmp 0x1400126f3
mov rax, qword [rax + 0x20]
test rax, rax
jne 0x1400126e0
mov dword [rsp + 0x78], ebx
mov ecx, 0x70
call fcn.1400223e8
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001272a
mov qword [rsp + 0x20], r14
movzx r9d, r12b
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call fcn.14000f170
mov rsi, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
jne 0x140012739
lea eax, [rsi + 6]
jmp 0x14001276d
mov r8, rdi
lea rdx, [rsp + 0x78]
lea rcx, [r14 + 0x48]
call fcn.140011ed0
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.140011ff0
test r15, r15
je 0x140012764
mov qword [r15], rsi
xor eax, eax
jmp 0x14001276d
mov eax, 9
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140014b20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx + 8]
mov rdi, rdx
mov rsi, rcx
test r9, r9
jne 0x140014b4c
lea rax, [rcx + 0x18]
or rax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rdi + 8]
mov qword [rsp + 0x30], rbx
mov edx, 0x811c9dc5
test eax, eax
je 0x140014b79
mov rcx, qword [rdi]
mov r8d, eax
movzx eax, word [rcx]
lea rcx, [rcx + 2]
xor rax, rdx
imul rdx, rax, 0x1000193
dec r8
jne 0x140014b63
imul rax, rdx, 0x2001
mov ebx, 1
mov rcx, rax
shr rcx, 7
xor rcx, rax
lea rdx, [rcx + rcx*8]
mov ecx, dword [rsi + 0x20]
shl rbx, cl
mov rax, rdx
shr rax, 0x11
dec rbx
xor rax, rdx
imul rax, rax, 0x21
and rbx, rax
mov rbx, qword [r9 + rbx*8]
test rbx, rbx
je 0x140014bf5
mov rdx, rdi
mov rcx, rbx
call fcn.14001e2f0
test al, al
jne 0x140014be2
mov eax, dword [rbx + 0x18]
shr eax, 0x1f
test al, 1
jne 0x140014bf5
mov rbx, qword [rbx + 0x28]
mov rdx, rdi
mov rcx, rbx
call fcn.14001e2f0
test al, al
je 0x140014bc5
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
lea rax, [rsi + 0x18]
mov rsi, qword [rsp + 0x38]
or rax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x14001f020
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x270
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140066360]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rdx
mov rsi, rcx
xor edi, edi
mov word [rsp + 0x50], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x52]
call fcn.140021bd0
lea rdx, str.Entering__GetDrsFolder__function....._n
mov rcx, qword [0x140067de8]
call fcn.1400208e0
mov rcx, qword [0x140067de8]
call fcn.140020a60
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14001f161
lea rcx, [rsp + 0x30]
call fcn.14001e040
nop
lea rdx, str._SHGetFolderPath__fn_successfully_retrieved_the__Common_App_data__path__n
mov rcx, qword [0x140067de8]
call fcn.1400208e0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14001caf0
mov rcx, qword [0x140067de8]
cmp eax, 1
jbe 0x14001f0f7
mov r8d, eax
lea rdx, str.WARNING:__obtainDrsPath__fn_failed_to_retrieve_the__Drs__path__err:_d__n
call fcn.1400208e0
jmp 0x14001f155
lea rdx, str._obtainDrsPath__fn_successfully_retrieved_the__Drs__path__n
call fcn.1400208e0
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14001e1e0
lea rdx, [0x14004f64c]
mov rcx, rbx
call fcn.14001e660
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14001e490
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x14001f13e
lea edi, [rax + 1]
jmp 0x14001f155
mov r8, qword [rbx]
lea rdx, str.WARNING:__s_Path_is_not_absolute___n
mov rcx, qword [0x140067de8]
call fcn.1400208e0
nop
lea rcx, [rsp + 0x30]
call fcn.14001e770
jmp 0x14001f17d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.WARNING:__SHGetFolderPath__fn_failed_to_retrieve__Common_App_data__path__error___u__n
mov rcx, qword [0x140067de8]
call fcn.1400208e0
mov rcx, qword [0x140067de8]
call fcn.140020aa0
mov r8d, edi
lea rdx, str.Exiting__GetDrsFolder__function.Return__d_n
mov rcx, qword [0x140067de8]
call fcn.1400208e0
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400220e0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14001f1d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [0x140067de8]
xor eax, eax
lea r8, str.SOFTWARENVIDIA_CorporationGlobalNVUpdatus
lea rdx, str.Checking_for_ForceUpdate_on____s__n
xor bl, bl
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], eax
call fcn.1400208e0
lea rax, [rsp + 0x58]
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalNVUpdatus
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001f274
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.ForcePackages
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001f269
cmp dword [rsp + 0x40], eax
setne bl
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
add rsp, 0x30
pop rbx
ret
Function at 0x14001f510
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rcx, qword [0x140067de8]
lea rdx, str.Entering__SetLDDMRegistry__function....._n
call fcn.1400208e0
mov rcx, qword [0x140067de8]
call fcn.140020a60
xor ebp, ebp
mov eax, 2
mov r14d, 0x105
mov rbx, 0xffffffffffffffff
mov esi, 1
mov qword [rsp + 0x78], rbp
mul r14
cmovo rax, rbx
mov rcx, rax
call fcn.1400223e8
xor edx, edx
mov r8d, 0x20a
mov rcx, rax
mov rdi, rax
call fcn.140021bd0
mov rcx, qword [0x140067de8]
lea rdx, str.Querying_the_OS_for_the_ALLUSERSPROFILE__n
call fcn.1400208e0
lea r9, [rsp + 0x70]
lea rcx, [0x140054de0]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x70], rbp
call sub.SHELL32.dll_SHGetKnownFolderPath
mov r8, qword [rsp + 0x70]
test r8, r8
je 0x14001f5cf
mov edx, r14d
mov rcx, rdi
call fcn.140023548
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x140067de8]
lea rdx, str.ALLUSERSPROFILE_obtained_as___s__n
mov r8, rdi
call fcn.1400208e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [0x140067de8]
cmp eax, 0xffffffff
jne 0x14001f60d
lea rdx, str.WARNING:_ALLUSERSPROFILE_is_not_a_valid_System_path__n
mov esi, ebp
call fcn.1400208e0
jmp 0x14001f6e7
lea r8, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
lea rdx, str.Creating_Opening_the_reg_path___s__n
call fcn.1400208e0
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [0x140067de8]
lea r8, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
test eax, eax
jne 0x14001f6d9
lea rdx, str.Setting_NVDRS_PATH_key_on___s__n
call fcn.1400208e0
nop dword [rax + rax]
cmp word [rdi + rbx*2 + 2], bp
lea rbx, [rbx + 1]
jne 0x14001f680
mov rcx, qword [rsp + 0x78]
lea eax, [rbx*2 + 2]
lea rdx, str.NVDRS_PATH
mov dword [rsp + 0x28], eax
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14001f6cc
mov rcx, qword [0x140067de8]
lea rdx, str.WARNING:_Could_not_set_the_registry_entry_for_NVDRS_PATH__n
mov esi, ebp
call fcn.1400208e0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001f6e7
lea rdx, str.WARNING:_Could_not_Create_or_Open_the_reg_path___s___n
call fcn.1400208e0
mov esi, ebp
mov rcx, rdi
call fcn.140022490
mov rcx, qword [0x140067de8]
call fcn.140020aa0
mov rcx, qword [0x140067de8]
lea rdx, str.Exiting__SetLDDMRegistry__function._Return__d_n
mov r8d, esi
call fcn.1400208e0
lea r11, [rsp + 0x50]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14001fee0
Capabilities:
Check if file exists
Get file attributes
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
mov rcx, qword [0x140067de8]
lea rdx, str.Entering__SetProgramFilesPath__function....._n
call fcn.1400208e0
mov rcx, qword [0x140067de8]
call fcn.140020a60
mov rcx, qword [0x140067de8]
lea rdx, str.Setting_the_Gold_Path_as___s__n
xor esi, esi
mov r8, rdi
mov ebx, 1
mov qword [rsp + 0x68], rsi
call fcn.1400208e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [0x140067de8]
cmp eax, 0xffffffff
jne 0x14001ff5b
lea rdx, str.WARNING:___Program_Files___is_not_a_valid_System_path__n
mov ebx, esi
call fcn.1400208e0
jmp 0x140020037
lea r8, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
lea rdx, str.Creating_Opening_the_reg_path___s__n
call fcn.1400208e0
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [0x140067de8]
lea r8, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
test eax, eax
jne 0x140020029
lea rdx, str.Setting_NVDRS_GOLD_PATH_key_on___s__n
call fcn.1400208e0
or rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rdi + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14001ffd0
mov rcx, qword [rsp + 0x68]
lea eax, [rax*2 + 2]
lea rdx, str.NVDRS_GOLD_PATH
mov dword [rsp + 0x28], eax
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14002001c
mov rcx, qword [0x140067de8]
lea rdx, str.WARNING:_Could_not_set_the_registry_entry_for_NVDRS_GOLD_PATH__n
mov ebx, esi
call fcn.1400208e0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140020037
lea rdx, str.WARNING:_Could_not_Create_or_Open_the_reg_path___s___n
call fcn.1400208e0
mov ebx, esi
mov rcx, qword [0x140067de8]
call fcn.140020aa0
mov rcx, qword [0x140067de8]
lea rdx, str.Exiting__SetProgramFilesPath__function._Return__d_n
mov r8d, ebx
call fcn.1400208e0
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400208e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
mov eax, 0x2860
call fcn.140022080
sub rsp, rax
mov rax, qword [0x140066360]
xor rax, rsp
mov qword [rsp + 0x2840], rax
cmp dword [rcx + 0x18], 0xffffffff
mov rdi, rcx
je 0x140020a43
mov rcx, qword [rcx + 8]
or edx, 0xffffffff
mov qword [rsp + 0x2850], rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, qword [rsp + 0x2878]
lea r8, [rsp + 0x2880]
lea rcx, [rsp + 0x840]
call fcn.1400243a8
lea rcx, [rsp + 0x840]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rdi + 0x9c]
lea rdx, [0x140053bf0]
call fcn.140024494
mov rsi, rax
test rax, rax
je 0x140020a31
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x2858], rbx
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rax, [rsp + 0x40]
lea r9, str.hh:mm:ss_tt
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x800
mov dword [rsp + 0x28], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetTimeFormatW]
test eax, eax
je 0x1400209dc
mov eax, dword [rdi + 0x18]
lea r9, [rdi + 0x1c]
lea r8, [rsp + 0x40]
lea rdx, str._s____s__d___
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.140023fac
mov rax, qword [rdi]
xor ebx, ebx
cmp dword [rax + 4], ebx
jle 0x140020a09
nop word [rax + rax]
lea rcx, [0x140053c38]
mov rdx, rsi
call fcn.140023e74
mov rax, qword [rdi]
inc ebx
cmp ebx, dword [rax + 4]
jl 0x1400209f0
lea rcx, [rsp + 0x840]
mov rdx, rsi
call fcn.140023e74
mov rcx, rsi
call fcn.14002478c
mov rcx, rsi
call fcn.140024650
mov rbx, qword [rsp + 0x2858]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rsi, qword [rsp + 0x2850]
mov rcx, qword [rsp + 0x2840]
xor rcx, rsp
call fcn.1400220e0
add rsp, 0x2860
pop rdi
ret
Function at 0x140020b50
Capabilities:
Check if file exists
Check mutex on windows
Get file attributes
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x460
mov rax, qword [0x140066360]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x242]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x240], bp
call fcn.140021bd0
lea rdx, [rsp + 0x240]
mov r8d, 0x104
mov rcx, rdi
call fcn.140020ff0
test eax, eax
je 0x140020d4d
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], bp
call fcn.140021bd0
lea r8, [rsp + 0x240]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.140023548
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea r8, [rdi + 0x2a4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi + 8], rax
test rax, rax
je 0x140020d4d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rax, [rdi + 0x4ac]
lea r8d, [rbp + 4]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x140020c67
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 8], rbp
jmp 0x140020d4d
mov qword [rsp + 0x478], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi + 0x10]
cmp eax, 0xb7
mov qword [rsp + 0x20], rbp
sete sil
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi], rax
test rax, rax
jne 0x140020cc7
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 8]
mov qword [rdi + 0x10], rbp
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 8], rbp
jmp 0x140020d45
test sil, sil
jne 0x140020cd4
mov dword [rax], ebp
mov rax, qword [rdi]
mov dword [rax + 4], ebp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140020cf7
lea rdx, [rsp + 0x30]
mov r8d, 0x104
mov rcx, rdi
call fcn.140020d80
lea rcx, [rdi + 0x9c]
lea r8, [rsp + 0x240]
mov edx, 0x104
call fcn.140023548
mov rcx, rdi
sub rcx, rbx
nop word [rax + rax]
movzx eax, word [rbx]
lea rbx, [rbx + 2]
mov word [rcx + rbx + 0x1a], ax
test ax, ax
jne 0x140020d20
mov rcx, qword [rdi]
mov eax, dword [rcx]
mov dword [rdi + 0x18], eax
inc dword [rcx]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rsi, qword [rsp + 0x478]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400220e0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret