joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000c1fb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rsi
push rbx
sub rsp, 0x6e8
mov qword [rsp + 0x6d8], 0
mov qword [rsp + 0x6d0], 0
mov qword [rsp + 0x6c8], 0
mov byte [rsp + 0x6a0], 0x46
mov byte [rsp + 0x6a1], 0x37
mov byte [rsp + 0x6a2], 0x30
mov byte [rsp + 0x6a3], 0x3f
mov byte [rsp + 0x6a4], 0x71
mov byte [rsp + 0x6a5], 0x64
mov byte [rsp + 0x6a6], 0x6b
mov byte [rsp + 0x6a7], 0x4a
mov byte [rsp + 0x6a8], 0x67
mov byte [rsp + 0x6a9], 0x71
mov byte [rsp + 0x6aa], 0x75
mov byte [rsp + 0x6ab], 0x28
mov byte [rsp + 0x6ac], 0x39
mov byte [rsp + 0x6ad], 0x41
mov byte [rsp + 0x6ae], 0x29
mov byte [rsp + 0x6af], 0x4a
mov byte [rsp + 0x6b0], 0x36
mov byte [rsp + 0x6b1], 0x73
mov byte [rsp + 0x6b2], 0x53
mov byte [rsp + 0x6b3], 0x37
mov byte [rsp + 0x6b4], 0x5f
mov byte [rsp + 0x6b5], 0x51
mov byte [rsp + 0x6b6], 0x74
mov byte [rsp + 0x6b7], 0x24
mov byte [rsp + 0x6b8], 0x77
mov byte [rsp + 0x6b9], 0
mov ecx, 0x6d97a
lea r8, [rsp + 0x30]
lea rdx, [r8 + 0x640]
jmp 0x18000c320
mov qword [rax], 0xe3b578
add rax, 8
cmp rax, rdx
jne 0x18000c30b
sub ecx, 1
je 0x18000c329
lea rax, [r8 + 0x88]
jmp 0x18000c30b
cmp qword [rsp + 0x620], 0xe3b578
jne 0x18000c48d
call fcn.18000c4c6
mov rbx, rax
mov r8d, 0
mov edx, 0x6d92a5e2
mov rcx, rax
call fcn.18000c160
mov rsi, rax
mov r8d, 0
mov edx, 0x3803e5e2
mov rcx, rbx
call fcn.18000c160
mov rbx, rax
mov qword [rsp + 0x6d0], 0x3d439
lea rdx, [rsp + 0x6d8]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea r9, [rsp + 0x6d0]
mov r8d, 0
mov rcx, 0xffffffffffffffff
call rsi
test eax, eax
jns 0x18000c3d1
mov r9d, 0
mov r8d, 0
lea rdx, [0x18004b136]
mov ecx, 0
call qword [0x18004e16e]
jmp 0x18000c4ad
lea rdx, [rsp + 0x6d8]
lea rax, [rsp + 0x6c8]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rsp + 0x6d0]
mov rcx, 0xffffffffffffffff
call rbx
test eax, eax
js 0x18000c41d
mov ecx, 0
movabs r8, 0x4ec4ec4ec4ec4ec5
cmp qword [rsp + 0x6d0], 0
jne 0x18000c43d
jmp 0x18000c486
mov r9d, 0
mov r8d, 0
lea rdx, [0x18004b14e]
mov ecx, 0
call qword [0x18004e16e]
jmp 0x18000c4ad
mov rax, rcx
mul r8
mov rax, rdx
shr rax, 3
lea rdx, [rax + rax*2]
lea rax, [rax + rdx*4]
add rax, rax
mov rsi, rcx
sub rsi, rax
movzx eax, byte [rsp + rsi + 0x6a0]
lea rdx, resource.1
xor al, byte [rdx + rcx]
mov rdx, qword [rsp + 0x6d8]
mov byte [rdx + rcx], al
add rcx, 1
cmp qword [rsp + 0x6d0], rcx
ja 0x18000c43d
call qword [rsp + 0x6d8]
mov r9d, 0
mov r8d, 0
lea rdx, [0x18004b165]
mov ecx, 0
call qword [0x18004e16e]
jmp 0x18000c4b2
mov eax, 0
add rsp, 0x6e8
pop rbx
pop rsi
ret
Function at 0x18000c230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rsi
push rbx
sub rsp, 0x6e8
mov qword [rsp + 0x6d8], 0
mov qword [rsp + 0x6d0], 0
mov qword [rsp + 0x6c8], 0
mov byte [rsp + 0x6a0], 0x46
mov byte [rsp + 0x6a1], 0x37
mov byte [rsp + 0x6a2], 0x30
mov byte [rsp + 0x6a3], 0x3f
mov byte [rsp + 0x6a4], 0x71
mov byte [rsp + 0x6a5], 0x64
mov byte [rsp + 0x6a6], 0x6b
mov byte [rsp + 0x6a7], 0x4a
mov byte [rsp + 0x6a8], 0x67
mov byte [rsp + 0x6a9], 0x71
mov byte [rsp + 0x6aa], 0x75
mov byte [rsp + 0x6ab], 0x28
mov byte [rsp + 0x6ac], 0x39
mov byte [rsp + 0x6ad], 0x41
mov byte [rsp + 0x6ae], 0x29
mov byte [rsp + 0x6af], 0x4a
mov byte [rsp + 0x6b0], 0x36
mov byte [rsp + 0x6b1], 0x73
mov byte [rsp + 0x6b2], 0x53
mov byte [rsp + 0x6b3], 0x37
mov byte [rsp + 0x6b4], 0x5f
mov byte [rsp + 0x6b5], 0x51
mov byte [rsp + 0x6b6], 0x74
mov byte [rsp + 0x6b7], 0x24
mov byte [rsp + 0x6b8], 0x77
mov byte [rsp + 0x6b9], 0
mov ecx, 0x6d97a
lea r8, [rsp + 0x30]
lea rdx, [r8 + 0x640]
jmp 0x18000c320
mov qword [rax], 0xe3b578
add rax, 8
cmp rax, rdx
jne 0x18000c30b
sub ecx, 1
je 0x18000c329
lea rax, [r8 + 0x88]
jmp 0x18000c30b
cmp qword [rsp + 0x620], 0xe3b578
jne 0x18000c48d
call fcn.18000c4c6
mov rbx, rax
mov r8d, 0
mov edx, 0x6d92a5e2
mov rcx, rax
call fcn.18000c160
mov rsi, rax
mov r8d, 0
mov edx, 0x3803e5e2
mov rcx, rbx
call fcn.18000c160
mov rbx, rax
mov qword [rsp + 0x6d0], 0x3d439
lea rdx, [rsp + 0x6d8]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea r9, [rsp + 0x6d0]
mov r8d, 0
mov rcx, 0xffffffffffffffff
call rsi
test eax, eax
jns 0x18000c3d1
mov r9d, 0
mov r8d, 0
lea rdx, [0x18004b136]
mov ecx, 0
call qword [0x18004e16e]
jmp 0x18000c4ad
lea rdx, [rsp + 0x6d8]
lea rax, [rsp + 0x6c8]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rsp + 0x6d0]
mov rcx, 0xffffffffffffffff
call rbx
test eax, eax
js 0x18000c41d
mov ecx, 0
movabs r8, 0x4ec4ec4ec4ec4ec5
cmp qword [rsp + 0x6d0], 0
jne 0x18000c43d
jmp 0x18000c486
mov r9d, 0
mov r8d, 0
lea rdx, [0x18004b14e]
mov ecx, 0
call qword [0x18004e16e]
jmp 0x18000c4ad
mov rax, rcx
mul r8
mov rax, rdx
shr rax, 3
lea rdx, [rax + rax*2]
lea rax, [rax + rdx*4]
add rax, rax
mov rsi, rcx
sub rsi, rax
movzx eax, byte [rsp + rsi + 0x6a0]
lea rdx, resource.1
xor al, byte [rdx + rcx]
mov rdx, qword [rsp + 0x6d8]
mov byte [rdx + rcx], al
add rcx, 1
cmp qword [rsp + 0x6d0], rcx
ja 0x18000c43d
call qword [rsp + 0x6d8]
mov r9d, 0
mov r8d, 0
lea rdx, [0x18004b165]
mov ecx, 0
call qword [0x18004e16e]
jmp 0x18000c4b2
mov eax, 0
add rsp, 0x6e8
pop rbx
pop rsi
ret
Function at 0x18000c270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rsi
push rbx
sub rsp, 0x6e8
mov qword [rsp + 0x6d8], 0
mov qword [rsp + 0x6d0], 0
mov qword [rsp + 0x6c8], 0
mov byte [rsp + 0x6a0], 0x46
mov byte [rsp + 0x6a1], 0x37
mov byte [rsp + 0x6a2], 0x30
mov byte [rsp + 0x6a3], 0x3f
mov byte [rsp + 0x6a4], 0x71
mov byte [rsp + 0x6a5], 0x64
mov byte [rsp + 0x6a6], 0x6b
mov byte [rsp + 0x6a7], 0x4a
mov byte [rsp + 0x6a8], 0x67
mov byte [rsp + 0x6a9], 0x71
mov byte [rsp + 0x6aa], 0x75
mov byte [rsp + 0x6ab], 0x28
mov byte [rsp + 0x6ac], 0x39
mov byte [rsp + 0x6ad], 0x41
mov byte [rsp + 0x6ae], 0x29
mov byte [rsp + 0x6af], 0x4a
mov byte [rsp + 0x6b0], 0x36
mov byte [rsp + 0x6b1], 0x73
mov byte [rsp + 0x6b2], 0x53
mov byte [rsp + 0x6b3], 0x37
mov byte [rsp + 0x6b4], 0x5f
mov byte [rsp + 0x6b5], 0x51
mov byte [rsp + 0x6b6], 0x74
mov byte [rsp + 0x6b7], 0x24
mov byte [rsp + 0x6b8], 0x77
mov byte [rsp + 0x6b9], 0
mov ecx, 0x6d97a
lea r8, [rsp + 0x30]
lea rdx, [r8 + 0x640]
jmp 0x18000c320
mov qword [rax], 0xe3b578
add rax, 8
cmp rax, rdx
jne 0x18000c30b
sub ecx, 1
je 0x18000c329
lea rax, [r8 + 0x88]
jmp 0x18000c30b
cmp qword [rsp + 0x620], 0xe3b578
jne 0x18000c48d
call fcn.18000c4c6
mov rbx, rax
mov r8d, 0
mov edx, 0x6d92a5e2
mov rcx, rax
call fcn.18000c160
mov rsi, rax
mov r8d, 0
mov edx, 0x3803e5e2
mov rcx, rbx
call fcn.18000c160
mov rbx, rax
mov qword [rsp + 0x6d0], 0x3d439
lea rdx, [rsp + 0x6d8]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea r9, [rsp + 0x6d0]
mov r8d, 0
mov rcx, 0xffffffffffffffff
call rsi
test eax, eax
jns 0x18000c3d1
mov r9d, 0
mov r8d, 0
lea rdx, [0x18004b136]
mov ecx, 0
call qword [0x18004e16e]
jmp 0x18000c4ad
lea rdx, [rsp + 0x6d8]
lea rax, [rsp + 0x6c8]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rsp + 0x6d0]
mov rcx, 0xffffffffffffffff
call rbx
test eax, eax
js 0x18000c41d
mov ecx, 0
movabs r8, 0x4ec4ec4ec4ec4ec5
cmp qword [rsp + 0x6d0], 0
jne 0x18000c43d
jmp 0x18000c486
mov r9d, 0
mov r8d, 0
lea rdx, [0x18004b14e]
mov ecx, 0
call qword [0x18004e16e]
jmp 0x18000c4ad
mov rax, rcx
mul r8
mov rax, rdx
shr rax, 3
lea rdx, [rax + rax*2]
lea rax, [rax + rdx*4]
add rax, rax
mov rsi, rcx
sub rsi, rax
movzx eax, byte [rsp + rsi + 0x6a0]
lea rdx, resource.1
xor al, byte [rdx + rcx]
mov rdx, qword [rsp + 0x6d8]
mov byte [rdx + rcx], al
add rcx, 1
cmp qword [rsp + 0x6d0], rcx
ja 0x18000c43d
call qword [rsp + 0x6d8]
mov r9d, 0
mov r8d, 0
lea rdx, [0x18004b165]
mov ecx, 0
call qword [0x18004e16e]
jmp 0x18000c4b2
mov eax, 0
add rsp, 0x6e8
pop rbx
pop rsi
ret
Function at 0x18000c2b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x6e8
mov qword [rsp + 0x6d8], 0
mov qword [rsp + 0x6d0], 0
mov qword [rsp + 0x6c8], 0
mov byte [rsp + 0x6a0], 0x46
mov byte [rsp + 0x6a1], 0x37
mov byte [rsp + 0x6a2], 0x30
mov byte [rsp + 0x6a3], 0x3f
mov byte [rsp + 0x6a4], 0x71
mov byte [rsp + 0x6a5], 0x64
mov byte [rsp + 0x6a6], 0x6b
mov byte [rsp + 0x6a7], 0x4a
mov byte [rsp + 0x6a8], 0x67
mov byte [rsp + 0x6a9], 0x71
mov byte [rsp + 0x6aa], 0x75
mov byte [rsp + 0x6ab], 0x28
mov byte [rsp + 0x6ac], 0x39
mov byte [rsp + 0x6ad], 0x41
mov byte [rsp + 0x6ae], 0x29
mov byte [rsp + 0x6af], 0x4a
mov byte [rsp + 0x6b0], 0x36
mov byte [rsp + 0x6b1], 0x73
mov byte [rsp + 0x6b2], 0x53
mov byte [rsp + 0x6b3], 0x37
mov byte [rsp + 0x6b4], 0x5f
mov byte [rsp + 0x6b5], 0x51
mov byte [rsp + 0x6b6], 0x74
mov byte [rsp + 0x6b7], 0x24
mov byte [rsp + 0x6b8], 0x77
mov byte [rsp + 0x6b9], 0
mov ecx, 0x6d97a
lea r8, [rsp + 0x30]
lea rdx, [r8 + 0x640]
jmp 0x18000c320
mov qword [rax], 0xe3b578
add rax, 8
cmp rax, rdx
jne 0x18000c30b
sub ecx, 1
je 0x18000c329
lea rax, [r8 + 0x88]
jmp 0x18000c30b
cmp qword [rsp + 0x620], 0xe3b578
jne 0x18000c48d
call fcn.18000c4c6
mov rbx, rax
mov r8d, 0
mov edx, 0x6d92a5e2
mov rcx, rax
call fcn.18000c160
mov rsi, rax
mov r8d, 0
mov edx, 0x3803e5e2
mov rcx, rbx
call fcn.18000c160
mov rbx, rax
mov qword [rsp + 0x6d0], 0x3d439
lea rdx, [rsp + 0x6d8]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea r9, [rsp + 0x6d0]
mov r8d, 0
mov rcx, 0xffffffffffffffff
call rsi
test eax, eax
jns 0x18000c3d1
mov r9d, 0
mov r8d, 0
lea rdx, [0x18004b136]
mov ecx, 0
call qword [0x18004e16e]
jmp 0x18000c4ad
lea rdx, [rsp + 0x6d8]
lea rax, [rsp + 0x6c8]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rsp + 0x6d0]
mov rcx, 0xffffffffffffffff
call rbx
test eax, eax
js 0x18000c41d
mov ecx, 0
movabs r8, 0x4ec4ec4ec4ec4ec5
cmp qword [rsp + 0x6d0], 0
jne 0x18000c43d
jmp 0x18000c486
mov r9d, 0
mov r8d, 0
lea rdx, [0x18004b14e]
mov ecx, 0
call qword [0x18004e16e]
jmp 0x18000c4ad
mov rax, rcx
mul r8
mov rax, rdx
shr rax, 3
lea rdx, [rax + rax*2]
lea rax, [rax + rdx*4]
add rax, rax
mov rsi, rcx
sub rsi, rax
movzx eax, byte [rsp + rsi + 0x6a0]
lea rdx, resource.1
xor al, byte [rdx + rcx]
mov rdx, qword [rsp + 0x6d8]
mov byte [rdx + rcx], al
add rcx, 1
cmp qword [rsp + 0x6d0], rcx
ja 0x18000c43d
call qword [rsp + 0x6d8]
mov r9d, 0
mov r8d, 0
lea rdx, [0x18004b165]
mov ecx, 0
call qword [0x18004e16e]
jmp 0x18000c4b2
mov eax, 0
add rsp, 0x6e8
pop rbx
pop rsi
ret

Function at 0x18000c4c6
Capabilities:
Access peb ldr_data

Disassembly:
xor rax, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
ret
Function at 0x1800166e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
mov esi, edi
test rcx, rcx
je 0x1800167bf
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebp, eax
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rbx + rdx*2], si
jne 0x180016717
lea ecx, [rax + 1]
add rdx, rcx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x1800167c2
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r8d, eax
lea ecx, [r8 - 1]
cmp word [rsi + rcx*2], 0x5c
je 0x180016766
mov eax, 0x5c
mov word [rsi + r8*2], ax
inc r8d
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], di
jne 0x180016770
test rax, rax
je 0x1800167bf
lfence
mov rdx, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rbx + rdx*2]
lea ecx, [rdi + r8]
inc edi
mov word [rsi + rcx*2], ax
mov edx, edi
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x1800167b0
cmp rdx, rax
jb 0x180016790
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18001a7a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x30
mov rbx, rcx
xor ebp, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x18001a9cc
xor edx, edx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], dx
jne 0x18001a7d0
test rax, rax
je 0x18001a804
xor ecx, ecx
movzx r8d, word [rbx + rcx*2]
cmp r8w, 0x5c
je 0x18001a9cc
cmp r8w, 0x2f
je 0x18001a9cc
inc edx
mov ecx, edx
cmp rcx, rax
jb 0x18001a7e0
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x48], rdi
call fcn.180019c40
mov rsi, rax
test rax, rax
je 0x18001a8fe
mov qword [rsp + 0x50], r14
call fcn.18001b140
mov r14, rax
test rax, rax
je 0x18001a8eb
mov rcx, rsi
call fcn.180016a30
test eax, eax
je 0x18001a8d4
lea rax, str.system32_
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x20]
lea rax, str.SystemRoot_system32_
mov qword [rsp + 0x28], rax
nop word [rax + rax]
mov rdx, qword [rdi]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rdx + rbx*2], bp
jne 0x18001a880
mov r8, rbx
mov rcx, rsi
call fcn.180071410
test eax, eax
je 0x18001a8a8
add rdi, 8
lea rax, [rsp + 0x30]
cmp rdi, rax
jb 0x18001a870
jmp 0x18001a8b7
lea rdx, [rsi + rbx*2]
mov rcx, r14
call fcn.18001b3a0
mov rbp, rax
lea rax, [rsp + 0x30]
cmp rdi, rax
jne 0x18001a8e2
mov rcx, rsi
call fcn.180016a80
test eax, eax
je 0x18001a8e2
mov rbp, rsi
xor esi, esi
jmp 0x18001a8e2
mov rdx, rsi
mov rcx, r14
call fcn.18001b3a0
mov rbp, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x50]
jmp 0x18001a998
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x18001a9a1
mov rcx, rbx
call fcn.18001bff0
mov rdi, rax
test rax, rax
je 0x18001a9a1
mov ecx, 0x37e4
call fcn.18001b8e0
test eax, eax
je 0x18001a936
call fcn.18001adb0
jmp 0x18001a93b
call fcn.18001b140
mov rbx, rax
test rax, rax
je 0x18001a98f
mov rdx, rdi
mov rcx, rax
call fcn.18001b3a0
mov rbp, rax
test rax, rax
je 0x18001a986
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18001a968
test al, 0x50
je 0x18001a986
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x18001a97b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ebp, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbp, rbp
je 0x18001a9a1
xor ecx, ecx
jmp 0x18001a9ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18001a9b4
lea ecx, [rax + 0x7e]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsp + 0x48]
mov rax, rbp
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rbp
ret
Function at 0x18001b140
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov ecx, 0x40
add rdx, rdx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x18001b1a2
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x18001b197
cmp edi, eax
jb 0x18001b197
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18001cb80
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x180145010]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x48], rax
xor esi, esi
mov dword [rsp + 0x44], esi
lea rbx, [0x18014c2c0]
mov qword [rsp + 0x48], rbx
xor edx, edx
mov r8d, 0x107
lea rcx, [rsp + 0x60]
call fcn.180063de0
nop
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x70]
call fcn.180063de0
mov dword [rsp + 0x40], 0x104
lea r8, str.C:Program_FilesNVIDIA_CorporationNvStreamSrv
mov edx, 0x104
lea rcx, [rbp + 0x70]
call fcn.180071648
cmp byte [str.SOFTWARENVIDIA_CorporationNvStreamSrv], sil
je 0x18001ccfa
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x18001cc57
lea rdx, [rsp + 0x68]
lea rcx, str.SOFTWARENVIDIA_CorporationNvStreamSrv
call fcn.1800f0b80
test eax, eax
je 0x18001cca8
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x18001cc57
mov qword [rsp + 0x60], rsi
mov byte [rsp + 0x68], al
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SOFTWARENVIDIA_CorporationNvStreamSrv
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
sete dil
test eax, eax
jne 0x18001cc9e
lea r8, str.SOFTWARENVIDIA_CorporationNvStreamSrv
mov edx, 0xff
lea rcx, [rsp + 0x68]
call fcn.180071648
test dil, dil
je 0x18001ccfa
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x18001ccfa
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov r9d, 0xffff
lea r8, str.InstallLocation
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18001ccfa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x18001ccfa
mov qword [rsp + 0x60], rsi
mov byte [rsp + 0x68], al
mov qword [0x18014c2d0], rsi
mov qword [0x18014c2d8], 0xf
mov byte [0x18014c2c0], 0
lea rax, [rbp + 0x70]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x18001cd20
lea rdx, [rbp + 0x70]
mov rcx, rbx
call fcn.180002820
mov dword [rsp + 0x44], 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18001cd5b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x18001cd5b
mov qword [rsp + 0x60], rsi
mov byte [rsp + 0x68], al
mov rax, rbx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.180034ab0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18001cd90
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x170
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180145010]
xor rax, rsp
mov qword [rsp + 0x160], rax
call fcn.18001d130
test al, 1
je 0x18001cde1
call fcn.18001d130
shr eax, 1
not eax
and eax, 1
jmp 0x18001cf42
xor ebx, ebx
cmp byte [0x180145ff2], bl
jne 0x18001cf32
mov byte [0x180145ff2], 1
movzx edi, byte [0x180145ff0]
mov r14, qword [str.RxDiagDevelopment]
mov rsi, qword [str.SOFTWARENVIDIA_CorporationNvStreamSrv]
xor edx, edx
mov r8d, 0x107
lea rcx, [rsp + 0x50]
call fcn.180063de0
nop
test rsi, rsi
je 0x18001cf0c
cmp byte [rsi], bl
je 0x18001cf0c
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18001ce7d
mov rax, rsi
lea r9, [rsp + 0x58]
sub r9, rsi
nop dword [rax]
nop dword [rax + rax]
movzx r8d, byte [rax]
movzx edx, byte [rax + r9]
sub r8d, edx
jne 0x18001ce65
inc rax
test edx, edx
jne 0x18001ce50
test r8d, r8d
je 0x18001cec6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x18001ce7d
mov qword [rsp + 0x50], rbx
mov byte [rsp + 0x58], al
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
sete bpl
test eax, eax
jne 0x18001cebc
mov r8, rsi
mov edx, 0xff
lea rcx, [rsp + 0x58]
call fcn.180071648
test bpl, bpl
je 0x18001cf0c
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x34], 4
test rcx, rcx
je 0x18001cf0c
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, 0xfffffffd
jne 0x18001cf0c
cmp dword [rsp + 0x30], 0
setne dil
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18001cf29
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x18001cf29
mov qword [rsp + 0x50], rbx
mov byte [rsp + 0x58], al
mov byte [0x180145ff1], dil
jmp 0x18001cf39
movzx edi, byte [0x180145ff1]
test dil, dil
setne bl
lea eax, [rbx + 2]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180034ab0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x18001d130
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x170
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x180145010]
xor rax, rsp
mov qword [rsp + 0x160], rax
cmp byte [0x180146010], 0
jne 0x18001d2b5
mov byte [0x180146010], 1
mov ebx, dword [0x180146008]
mov rbp, qword [str.RxDiagDisabledLogsBitmap]
mov rdi, qword [str.SOFTWARENVIDIA_CorporationNvStreamSrv]
xor edx, edx
mov r8d, 0x107
lea rcx, [rsp + 0x50]
call fcn.180063de0
nop
test rdi, rdi
je 0x18001d28a
cmp byte [rdi], 0
je 0x18001d28a
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18001d201
mov rax, rdi
lea r9, [rsp + 0x58]
sub r9, rdi
nop dword [rax]
nop dword [rax + rax]
movzx r8d, byte [rax]
movzx edx, byte [rax + r9]
sub r8d, edx
jne 0x18001d1e5
inc rax
test edx, edx
jne 0x18001d1d0
test r8d, r8d
je 0x18001d24a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x18001d201
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x58], al
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
sete sil
test eax, eax
jne 0x18001d240
mov r8, rdi
mov edx, 0xff
lea rcx, [rsp + 0x58]
call fcn.180071648
test sil, sil
je 0x18001d28a
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], 4
test rcx, rcx
je 0x18001d28a
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, 0xfffffffd
cmove ebx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18001d2ab
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x18001d2ab
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x58], al
mov dword [0x18014600c], ebx
mov eax, ebx
jmp 0x18001d2bb
mov eax, dword [0x18014600c]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180034ab0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret