Function at 0x140095b40
Capabilities:
Print debug messages

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x218
mov rax, qword [0x140292cc0]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov eax, dword [0x1402a6e8c]
mov dword [rsp + 0x44], eax
lea rdi, [rsp + 0x50]
lea rsi, str.0x00000000_n
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rcx, str._WARNING___PE_SIGNATURE_VERIFICATION_FAILED_____n_Filename:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, str._n_Error:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x40], 0
jmp 0x140095bbe
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 8
jge 0x140095c43
mov eax, 7
sub eax, dword [rsp + 0x40]
shl eax, 2
movzx ecx, al
mov eax, dword [rsp + 0x238]
shr eax, cl
mov ecx, eax
and ecx, 0xf
mov eax, dword [rsp + 0x40]
add eax, 2
cdqe
mov word [rsp + rax*2 + 0x50], cx
mov eax, dword [rsp + 0x40]
add eax, 2
cdqe
movzx eax, word [rsp + rax*2 + 0x50]
cmp eax, 0xa
jge 0x140095c10
mov dword [rsp + 0x1f0], 0x30
jmp 0x140095c1b
mov dword [rsp + 0x1f0], 0x37
mov eax, dword [rsp + 0x40]
add eax, 2
cdqe
movzx ecx, word [rsp + rax*2 + 0x50]
add ecx, dword [rsp + 0x1f0]
mov eax, dword [rsp + 0x40]
add eax, 2
cdqe
mov word [rsp + rax*2 + 0x50], cx
jmp 0x140095bb3
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rsp + 0x44], 0
jne 0x140096036
cmp dword [0x1402926ac], 0
je 0x140096036
mov eax, 0x100
mov word [rsp + 0x78], ax
mov eax, 0x200
mov word [rsp + 0x7a], ax
xor eax, eax
mov word [rsp + 0x7c], ax
mov dword [rsp + 0x68], 0x41fcc608
mov eax, 0x8496
mov word [rsp + 0x6c], ax
mov eax, 0x4def
mov word [rsp + 0x6e], ax
mov byte [rsp + 0x70], 0xb4
mov byte [rsp + 0x71], 0x3e
mov byte [rsp + 0x72], 0x7d
mov byte [rsp + 0x73], 0x9b
mov byte [rsp + 0x74], 0xd6
mov byte [rsp + 0x75], 0x75
mov byte [rsp + 0x76], 0xa6
mov byte [rsp + 0x77], 0xff
mov dword [0x1402926ac], 0
cmp qword [0x1402a6d08], 0
jne 0x140095d49
xor edx, edx
lea rcx, str.Advapi32.dll
call fcn.1400932b0
mov qword [0x1402a6d08], rax
cmp qword [0x1402a6d08], 0
je 0x140095d49
lea rdx, str.RegOpenKeyExW
mov rcx, qword [0x1402a6d08]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402a6d10], rax
lea rdx, str.RegEnumValueW
mov rcx, qword [0x1402a6d08]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402a6d18], rax
lea rdx, str.RegCloseKey
mov rcx, qword [0x1402a6d08]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402a6d20], rax
cmp qword [0x1402a6d10], 0
je 0x140095d67
cmp qword [0x1402a6d18], 0
je 0x140095d67
cmp qword [0x1402a6d20], 0
jne 0x140095d6e
xor eax, eax
jmp 0x140096081
cmp qword [0x1402a6d28], 0
jne 0x140095db2
xor edx, edx
lea rcx, str.Ole32.dll
call fcn.1400932b0
mov qword [0x1402a6d28], rax
cmp qword [0x1402a6d28], 0
je 0x140095db2
lea rdx, str.StringFromGUID2
mov rcx, qword [0x1402a6d28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402a6d30], rax
cmp qword [0x1402a6d30], 0
jne 0x140095dc3
xor eax, eax
jmp 0x140096081
lea rdi, [rsp + 0x80]
xor eax, eax
mov ecx, 0x4e
rep stosb byte [rdi], al
mov r8d, 0x27
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x68]
call qword [0x1402a6d30]
cdqe
cmp rax, 0x27
je 0x140095dfc
xor eax, eax
jmp 0x140096081
mov dword [rsp + 0x40], 0
jmp 0x140095e11
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x44], 0
jne 0x140096036
movsxd rax, dword [rsp + 0x40]
movzx eax, word [rsp + rax*2 + 0x78]
test eax, eax
je 0x140096036
mov qword [rsp + 0xd0], 0
movsxd rax, dword [rsp + 0x40]
movzx r9d, word [rsp + rax*2 + 0x78]
or r9d, 0x20019
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWARENVIDIA_CorporationGlobal
mov rcx, 0xffffffff80000002
call qword [0x1402a6d10]
mov dword [rsp + 0xd8], eax
cmp dword [rsp + 0xd8], 0
jne 0x140096031
mov dword [rsp + 0xe0], 0
mov dword [rsp + 0xdc], 0
mov dword [rsp + 0xe8], 0x80
mov dword [rsp + 0xe4], 4
lea rdi, [rsp + 0xf0]
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x1f4], eax
lea rax, [rsp + 0xe4]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xec]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xe8]
lea r8, [rsp + 0xf0]
mov edx, dword [rsp + 0x1f4]
mov rcx, qword [rsp + 0xd0]
call qword [0x1402a6d18]
mov dword [rsp + 0xd8], eax
mov eax, dword [rsp + 0xe0]
add eax, 1
mov dword [rsp + 0xe0], eax
cmp dword [rsp + 0xd8], 0
jne 0x140095fd9
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov eax, dword [rsp + 0xe8]
cmp rcx, rax
jne 0x140095fd9
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xf0]
sub rcx, rdx
movzx eax, word [rdx]
cmp ax, word [rdx + rcx]
jne 0x140095f97
add rdx, 2
test ax, ax
jne 0x140095f81
xor eax, eax
jmp 0x140095f9c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x140095fd9
cmp dword [rsp + 0xec], 0
je 0x140095fb7
mov dword [rsp + 0x1f8], 1
jmp 0x140095fc2
mov dword [rsp + 0x1f8], 0
mov ecx, dword [rsp + 0x1f8]
mov eax, dword [rsp + 0xdc]
or eax, ecx
mov dword [rsp + 0xdc], eax
cmp dword [rsp + 0xd8], 0x103
jne 0x140095e9b
mov rcx, qword [rsp + 0xd0]
call qword [0x1402a6d20]
cmp dword [rsp + 0xdc], 0
je 0x14009600f
mov dword [rsp + 0x1fc], 1
jmp 0x14009601a
mov dword [rsp + 0x1fc], 0
mov eax, dword [rsp + 0x1fc]
mov dword [0x1402a6e8c], eax
mov eax, dword [0x1402a6e8c]
mov dword [rsp + 0x44], eax
jmp 0x140095e06
cmp dword [rsp + 0x44], 0
jne 0x140096046
cmp dword [0x1402a6e8c], 0
je 0x140096072
lea rcx, str._Signature_override_detected..._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x238], 0
mov ecx, dword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
jmp 0x140096081
mov ecx, dword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1401557c0
add rsp, 0x218
pop rdi
pop rsi
ret