joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000cd80
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x840
mov rax, qword [0x140065340]
xor rax, rsp
mov qword [rsp + 0x830], rax
test byte [rcx + 0x50], 0x20
mov rbx, rcx
jne 0x140006571
call fcn.140005e70
test eax, eax
jne 0x140006690
lea rax, str.nvdrssel.bin
add rbx, 0x58
lea r8, str._s_s
lea rcx, [rsp + 0x30]
mov edx, 0x400
mov r9, rbx
mov qword [rsp + 0x20], rax
call fcn.140007df0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, str.nvdrswr.lk
lea r8, str._s_s
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.140007df0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, str.update.bin
lea r8, str._s_s
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.140007df0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, str._s_nvdrsdb_d.bin
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov qword [rsp + 0x20], 0
call fcn.140007df0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, str._s_nvdrsdb_d.bin
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov dword [rsp + 0x20], 1
call fcn.140007df0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, str.nvAppTimestamps
lea r8, str._s_s
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.140007df0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.1400215b0
add rsp, 0x840
pop rbx
ret
add rcx, 0x838
jmp 0x140006540
Function at 0x14000e900
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov r15, rdx
mov r14, rcx
mov esi, 0x32f54a96
mov eax, dword [rdx + 8]
test eax, eax
je 0x14000e964
mov r9, qword [rdx]
mov edx, eax
nop dword [rax]
movzx eax, word [r9]
imul ecx, eax, 0xc5
imul eax, esi, 0x34c3
add ecx, eax
mov eax, esi
shr eax, 2
mov esi, ecx
xor esi, eax
lea r9, [r9 + 2]
dec rdx
jne 0x14000e940
and esi, 0x3fffffff
mov ecx, dword [r14 + 8]
mov edi, 1
mov r12d, edi
shl r12d, cl
dec r12d
mov ebx, r12d
and ebx, esi
mov r13d, ebx
nop dword [rax]
nop dword [rax + rax]
mov rdx, r15
lea rcx, [rsp + 0x28]
call fcn.14001d380
mov rbp, rax
mov qword [rsp + 0x80], rax
mov ecx, ebx
shl rcx, 5
mov rax, qword [r14]
test byte [rcx + rax], 1
je 0x14000ea23
lea rdx, [rax + 8]
add rdx, rcx
mov rcx, rbp
call fcn.14001d7c0
test al, al
jne 0x14000ea0a
mov rcx, rbp
call fcn.14001dc40
add ebx, edi
and ebx, r12d
inc edi
cmp ebx, r13d
jne 0x14000e990
mov ecx, dword [r14 + 0x10]
lea eax, [rcx + 1]
mov dword [r14 + 0x10], eax
cmp ecx, 4
jbe 0x14000e9fe
mov rcx, r14
call fcn.1400187d0
mov dword [r14 + 0x10], 0
mov rcx, r15
call fcn.14001dc40
xor eax, eax
jmp 0x14000ea83
mov edx, ebx
shl rdx, 5
mov rcx, qword [r14]
mov rax, qword [rsp + 0x90]
mov eax, dword [rax]
mov dword [rdx + rcx + 0x18], eax
jmp 0x14000ea70
mov edi, ebx
shl rdi, 5
or dword [rdi + rax], 1
mov rax, qword [r14]
and dword [rdi + rax], 0xfffffffd
mov rdx, qword [r14]
mov ecx, dword [rdx + rdi]
and ecx, 3
lea eax, [rsi*4]
or ecx, eax
mov dword [rdx + rdi], ecx
mov rcx, qword [r14]
add rcx, 8
add rcx, rdi
mov rdx, rbp
call fcn.14001d560
mov rdx, qword [r14]
mov rax, qword [rsp + 0x90]
mov ecx, dword [rax]
mov dword [rdi + rdx + 0x18], ecx
inc dword [r14 + 0xc]
mov rcx, rbp
call fcn.14001dc40
nop
mov rcx, r15
call fcn.14001dc40
mov eax, ebx
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000eaa0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov r15, rdx
mov r14, rcx
mov r9d, 0x32f54a96
mov eax, dword [rdx + 8]
test eax, eax
je 0x14000eb08
mov r10, qword [rdx]
mov r8d, eax
nop
movzx eax, word [r10]
imul ecx, eax, 0xc5
imul eax, r9d, 0x34c3
add ecx, eax
mov eax, r9d
shr eax, 2
mov r9d, ecx
xor r9d, eax
lea r10, [r10 + 2]
dec r8
jne 0x14000eae0
and r9d, 0x3fffffff
mov ecx, dword [r14 + 8]
mov r12d, 1
mov ebp, r12d
shl ebp, cl
dec ebp
mov edi, ebp
and edi, r9d
mov r13d, edi
mov esi, r12d
nop dword [rax + rax]
mov rdx, r15
lea rcx, [rsp + 0x28]
call fcn.14001d380
mov rbx, rax
mov qword [rsp + 0x80], rax
mov edx, edi
shl rdx, 5
mov rcx, qword [r14]
test byte [rdx + rcx], 2
jne 0x14000eb6a
add rcx, 8
add rdx, rcx
mov rcx, rax
call fcn.14001d820
test al, al
je 0x14000eb7f
mov rcx, rbx
call fcn.14001dc40
add edi, esi
and edi, ebp
inc esi
cmp edi, r13d
je 0x14000ebc4
jmp 0x14000eb30
mov edx, edi
shl rdx, 5
add rdx, qword [r14]
test byte [rdx], 1
je 0x14000eba7
mov rax, qword [rsp + 0x90]
mov eax, dword [rax]
mov dword [rdx + 0x18], eax
mov rcx, rbx
call fcn.14001dc40
xor r12d, r12d
jmp 0x14000ebaf
mov rcx, rbx
call fcn.14001dc40
or ebx, 0xffffffff
test r12d, r12d
cmove ebx, edi
mov rcx, r15
call fcn.14001dc40
mov eax, ebx
jmp 0x14000ebed
mov ecx, dword [r14 + 0x10]
lea eax, [rcx + 1]
mov dword [r14 + 0x10], eax
cmp ecx, 4
jbe 0x14000ebe3
mov rcx, r14
call fcn.1400187d0
xor r12d, r12d
mov dword [r14 + 0x10], r12d
mov rcx, r15
call fcn.14001dc40
xor eax, eax
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000ec10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov r14, rdx
mov r15, rcx
mov r8d, 0x32f54a96
mov eax, dword [rdx + 8]
test eax, eax
je 0x14000ec78
mov r9, qword [rdx]
mov r10d, eax
nop
movzx eax, word [r9]
imul ecx, eax, 0xc5
imul eax, r8d, 0x34c3
add ecx, eax
mov eax, r8d
shr eax, 2
mov r8d, ecx
xor r8d, eax
lea r9, [r9 + 2]
dec r10
jne 0x14000ec50
and r8d, 0x3fffffff
mov ecx, dword [r15 + 8]
mov r12d, 1
mov ebp, r12d
shl ebp, cl
dec ebp
mov edi, ebp
and edi, r8d
mov r13d, edi
mov esi, r12d
nop dword [rax + rax]
mov rdx, r14
lea rcx, [rsp + 0x28]
call fcn.14001d380
mov rbx, rax
mov qword [rsp + 0x80], rax
mov edx, edi
shl rdx, 5
add rdx, qword [r15]
mov ecx, dword [rdx]
mov eax, ecx
and eax, 1
jne 0x14000eccf
test cl, 2
je 0x14000ecf8
test eax, eax
je 0x14000ece3
add rdx, 8
mov rcx, rbx
call fcn.14001d7c0
test al, al
jne 0x14000ed02
mov rcx, rbx
call fcn.14001dc40
add edi, esi
and edi, ebp
inc esi
cmp edi, r13d
je 0x14000ed22
jmp 0x14000eca0
mov rcx, rbx
call fcn.14001dc40
jmp 0x14000ed0d
mov rcx, rbx
call fcn.14001dc40
xor r12d, r12d
or ebx, 0xffffffff
test r12d, r12d
cmove ebx, edi
mov rcx, r14
call fcn.14001dc40
mov eax, ebx
jmp 0x14000ed4b
mov ecx, dword [r15 + 0x10]
lea eax, [rcx + 1]
mov dword [r15 + 0x10], eax
cmp ecx, 4
jbe 0x14000ed41
mov rcx, r15
call fcn.1400187d0
xor r12d, r12d
mov dword [r15 + 0x10], r12d
mov rcx, r14
call fcn.14001dc40
xor eax, eax
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140012490
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], rbp
mov r15, r9
movzx r12d, r8b
mov rdi, rdx
mov r14, rcx
mov r10d, dword [rdx + 8]
test r10d, r10d
je 0x140012618
mov r11, qword [rdx]
cmp word [r11], 0
je 0x140012618
xor esi, esi
mov edx, esi
test r10d, r10d
je 0x140012501
mov eax, edx
cmp word [r11 + rax*2], 0x2c
je 0x1400124f7
inc edx
cmp edx, r10d
jb 0x1400124e4
jmp 0x140012501
mov eax, 0x11
jmp 0x14001261d
mov rdx, rdi
add rcx, 0x48
call fcn.140014c00
test rax, rax
je 0x14001251c
mov eax, 8
jmp 0x14001261d
mov ebx, 0x32f54a96
mov eax, dword [rdi + 8]
test eax, eax
je 0x140012553
mov rdx, qword [rdi]
mov r8d, eax
nop
movzx eax, word [rdx]
imul ecx, eax, 0xc5
imul eax, ebx, 0x34c3
add ecx, eax
mov eax, ebx
shr eax, 2
mov ebx, ecx
xor ebx, eax
lea rdx, [rdx + 2]
dec r8
jne 0x140012530
mov dword [rsp + 0x78], ebx
mov rdx, qword [r14]
mov rax, rdx
test rdx, rdx
je 0x1400125ac
mov ecx, dword [rax + 8]
cmp ebx, ecx
je 0x140012580
jae 0x140012571
mov rax, qword [rax + 0x18]
jmp 0x140012575
mov rax, qword [rax + 0x20]
test rax, rax
jne 0x140012562
jmp 0x1400125ac
inc ebx
mov rax, rdx
test rdx, rdx
je 0x1400125a8
nop word [rax + rax]
mov ecx, dword [rax + 8]
cmp ebx, ecx
je 0x140012580
jae 0x14001259f
mov rax, qword [rax + 0x18]
jmp 0x1400125a3
mov rax, qword [rax + 0x20]
test rax, rax
jne 0x140012590
mov dword [rsp + 0x78], ebx
mov ecx, 0x70
call fcn.1400218b8
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400125da
mov qword [rsp + 0x20], r14
movzx r9d, r12b
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call fcn.14000f020
mov rsi, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
jne 0x1400125e9
lea eax, [rsi + 6]
jmp 0x14001261d
mov r8, rdi
lea rdx, [rsp + 0x78]
lea rcx, [r14 + 0x48]
call fcn.140011d80
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.140011ea0
test r15, r15
je 0x140012614
mov qword [r15], rsi
xor eax, eax
jmp 0x14001261d
mov eax, 9
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140014b10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx + 8]
mov rdi, rdx
mov rsi, rcx
test r9, r9
jne 0x140014b3c
lea rax, [rcx + 0x18]
or rax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rdi + 8]
mov qword [rsp + 0x30], rbx
mov edx, 0x811c9dc5
test eax, eax
je 0x140014b69
mov rcx, qword [rdi]
mov r8d, eax
movzx eax, word [rcx]
lea rcx, [rcx + 2]
xor rax, rdx
imul rdx, rax, 0x1000193
dec r8
jne 0x140014b53
imul rax, rdx, 0x2001
mov ebx, 1
mov rcx, rax
shr rcx, 7
xor rcx, rax
lea rdx, [rcx + rcx*8]
mov ecx, dword [rsi + 0x20]
shl rbx, cl
mov rax, rdx
shr rax, 0x11
dec rbx
xor rax, rdx
imul rax, rax, 0x21
and rbx, rax
mov rbx, qword [r9 + rbx*8]
test rbx, rbx
je 0x140014be5
mov rdx, rdi
mov rcx, rbx
call fcn.14001d7c0
test al, al
jne 0x140014bd2
mov eax, dword [rbx + 0x18]
shr eax, 0x1f
test al, 1
jne 0x140014be5
mov rbx, qword [rbx + 0x28]
mov rdx, rdi
mov rcx, rbx
call fcn.14001d7c0
test al, al
je 0x140014bb5
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
lea rax, [rsi + 0x18]
mov rsi, qword [rsp + 0x38]
or rax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x14001e4f0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x270
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140065340]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rdx
mov rsi, rcx
xor edi, edi
mov word [rsp + 0x50], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x52]
call fcn.140021100
lea rdx, str.Entering__GetDrsFolder__function....._n
mov rcx, qword [0x140066dc8]
call fcn.14001fe10
mov rcx, qword [0x140066dc8]
call int.14001ff90
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14001e631
lea rcx, [rsp + 0x30]
call fcn.14001d510
nop
lea rdx, str._SHGetFolderPath__fn_successfully_retrieved_the__Common_App_data__path__n
mov rcx, qword [0x140066dc8]
call fcn.14001fe10
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14001c030
mov rcx, qword [0x140066dc8]
cmp eax, 1
jbe 0x14001e5c7
mov r8d, eax
lea rdx, str.WARNING:__obtainDrsPath__fn_failed_to_retrieve_the__Drs__path__err:_d__n
call fcn.14001fe10
jmp 0x14001e625
lea rdx, str._obtainDrsPath__fn_successfully_retrieved_the__Drs__path__n
call fcn.14001fe10
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14001d6b0
lea rdx, [0x14004f64c]
mov rcx, rbx
call fcn.14001db30
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14001d960
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x14001e60e
lea edi, [rax + 1]
jmp 0x14001e625
mov r8, qword [rbx]
lea rdx, str.WARNING:__s_Path_is_not_absolute___n
mov rcx, qword [0x140066dc8]
call fcn.14001fe10
nop
lea rcx, [rsp + 0x30]
call fcn.14001dc40
jmp 0x14001e64d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.WARNING:__SHGetFolderPath__fn_failed_to_retrieve__Common_App_data__path__error___u__n
mov rcx, qword [0x140066dc8]
call fcn.14001fe10
mov rcx, qword [0x140066dc8]
call fcn.14001ffd0
mov r8d, edi
lea rdx, str.Exiting__GetDrsFolder__function.Return__d_n
mov rcx, qword [0x140066dc8]
call fcn.14001fe10
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400215b0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14001e6a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [0x140066dc8]
xor eax, eax
lea r8, str.SOFTWARENVIDIA_CorporationGlobalNVUpdatus
lea rdx, str.Checking_for_ForceUpdate_on____s__n
xor bl, bl
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], eax
call fcn.14001fe10
lea rax, [rsp + 0x58]
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalNVUpdatus
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001e744
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.ForcePackages
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001e739
cmp dword [rsp + 0x40], eax
setne bl
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
add rsp, 0x30
pop rbx
ret
Function at 0x14001e9e0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rcx, qword [0x140066dc8]
lea rdx, str.Entering__SetLDDMRegistry__function....._n
call fcn.14001fe10
mov rcx, qword [0x140066dc8]
call int.14001ff90
xor ebp, ebp
mov eax, 2
mov r14d, 0x105
mov rbx, 0xffffffffffffffff
mov esi, 1
mov qword [rsp + 0x78], rbp
mul r14
cmovo rax, rbx
mov rcx, rax
call fcn.1400218b8
xor edx, edx
mov r8d, 0x20a
mov rcx, rax
mov rdi, rax
call fcn.140021100
mov rcx, qword [0x140066dc8]
lea rdx, str.Querying_the_OS_for_the_ALLUSERSPROFILE__n
call fcn.14001fe10
lea r9, [rsp + 0x70]
lea rcx, [0x140054c50]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x70], rbp
call sub.SHELL32.dll_SHGetKnownFolderPath
mov r8, qword [rsp + 0x70]
test r8, r8
je 0x14001ea9f
mov edx, r14d
mov rcx, rdi
call fcn.1400229ec
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x140066dc8]
lea rdx, str.ALLUSERSPROFILE_obtained_as___s__n
mov r8, rdi
call fcn.14001fe10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [0x140066dc8]
cmp eax, 0xffffffff
jne 0x14001eadd
lea rdx, str.WARNING:_ALLUSERSPROFILE_is_not_a_valid_System_path__n
mov esi, ebp
call fcn.14001fe10
jmp 0x14001ebb7
lea r8, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
lea rdx, str.Creating_Opening_the_reg_path___s__n
call fcn.14001fe10
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [0x140066dc8]
lea r8, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
test eax, eax
jne 0x14001eba9
lea rdx, str.Setting_NVDRS_PATH_key_on___s__n
call fcn.14001fe10
nop dword [rax + rax]
cmp word [rdi + rbx*2 + 2], bp
lea rbx, [rbx + 1]
jne 0x14001eb50
mov rcx, qword [rsp + 0x78]
lea eax, [rbx*2 + 2]
lea rdx, str.NVDRS_PATH
mov dword [rsp + 0x28], eax
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14001eb9c
mov rcx, qword [0x140066dc8]
lea rdx, str.WARNING:_Could_not_set_the_registry_entry_for_NVDRS_PATH__n
mov esi, ebp
call fcn.14001fe10
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001ebb7
lea rdx, str.WARNING:_Could_not_Create_or_Open_the_reg_path___s___n
call fcn.14001fe10
mov esi, ebp
mov rcx, rdi
call fcn.140021960
mov rcx, qword [0x140066dc8]
call fcn.14001ffd0
mov rcx, qword [0x140066dc8]
lea rdx, str.Exiting__SetLDDMRegistry__function._Return__d_n
mov r8d, esi
call fcn.14001fe10
lea r11, [rsp + 0x50]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14001f3b0
Capabilities:
Check if file exists
Get file attributes
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
mov rcx, qword [0x140066dc8]
lea rdx, str.Entering__SetProgramFilesPath__function....._n
call fcn.14001fe10
mov rcx, qword [0x140066dc8]
call int.14001ff90
mov rcx, qword [0x140066dc8]
lea rdx, str.Setting_the_Gold_Path_as___s__n
xor esi, esi
mov r8, rdi
mov ebx, 1
mov qword [rsp + 0x68], rsi
call fcn.14001fe10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [0x140066dc8]
cmp eax, 0xffffffff
jne 0x14001f42b
lea rdx, str.WARNING:___Program_Files___is_not_a_valid_System_path__n
mov ebx, esi
call fcn.14001fe10
jmp 0x14001f507
lea r8, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
lea rdx, str.Creating_Opening_the_reg_path___s__n
call fcn.14001fe10
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [0x140066dc8]
lea r8, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
test eax, eax
jne 0x14001f4f9
lea rdx, str.Setting_NVDRS_GOLD_PATH_key_on___s__n
call fcn.14001fe10
or rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rdi + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14001f4a0
mov rcx, qword [rsp + 0x68]
lea eax, [rax*2 + 2]
lea rdx, str.NVDRS_GOLD_PATH
mov dword [rsp + 0x28], eax
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14001f4ec
mov rcx, qword [0x140066dc8]
lea rdx, str.WARNING:_Could_not_set_the_registry_entry_for_NVDRS_GOLD_PATH__n
mov ebx, esi
call fcn.14001fe10
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001f507
lea rdx, str.WARNING:_Could_not_Create_or_Open_the_reg_path___s___n
call fcn.14001fe10
mov ebx, esi
mov rcx, qword [0x140066dc8]
call fcn.14001ffd0
mov rcx, qword [0x140066dc8]
lea rdx, str.Exiting__SetProgramFilesPath__function._Return__d_n
mov r8d, ebx
call fcn.14001fe10
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14001fe10
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
mov eax, 0x2860
call fcn.140022910
sub rsp, rax
mov rax, qword [0x140065340]
xor rax, rsp
mov qword [rsp + 0x2840], rax
cmp dword [rcx + 0x18], 0xffffffff
mov rdi, rcx
je 0x14001ff73
mov rcx, qword [rcx + 8]
or edx, 0xffffffff
mov qword [rsp + 0x2850], rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, qword [rsp + 0x2878]
lea r8, [rsp + 0x2880]
lea rcx, [rsp + 0x840]
call fcn.1400238dc
lea rcx, [rsp + 0x840]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rdi + 0x9c]
lea rdx, [0x140053a60]
call fcn.1400239c8
mov rsi, rax
test rax, rax
je 0x14001ff61
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x2858], rbx
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rax, [rsp + 0x40]
lea r9, str.hh:mm:ss_tt
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x800
mov dword [rsp + 0x28], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetTimeFormatW]
test eax, eax
je 0x14001ff0c
mov eax, dword [rdi + 0x18]
lea r9, [rdi + 0x1c]
lea r8, [rsp + 0x40]
lea rdx, str._s____s__d___
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.1400234e0
mov rax, qword [rdi]
xor ebx, ebx
cmp dword [rax + 4], ebx
jle 0x14001ff39
nop word [rax + rax]
lea rcx, [0x140053aa8]
mov rdx, rsi
call fcn.1400233a8
mov rax, qword [rdi]
inc ebx
cmp ebx, dword [rax + 4]
jl 0x14001ff20
lea rcx, [rsp + 0x840]
mov rdx, rsi
call fcn.1400233a8
mov rcx, rsi
call fcn.140023cc0
mov rcx, rsi
call fcn.140023b84
mov rbx, qword [rsp + 0x2858]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rsi, qword [rsp + 0x2850]
mov rcx, qword [rsp + 0x2840]
xor rcx, rsp
call fcn.1400215b0
add rsp, 0x2860
pop rdi
ret
Function at 0x140020080
Capabilities:
Check if file exists
Check mutex on windows
Get file attributes
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x460
mov rax, qword [0x140065340]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x242]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x240], bp
call fcn.140021100
lea rdx, [rsp + 0x240]
mov r8d, 0x104
mov rcx, rdi
call fcn.140020520
test eax, eax
je 0x14002027d
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], bp
call fcn.140021100
lea r8, [rsp + 0x240]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.1400229ec
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea r8, [rdi + 0x2a4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi + 8], rax
test rax, rax
je 0x14002027d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rax, [rdi + 0x4ac]
lea r8d, [rbp + 4]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x140020197
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 8], rbp
jmp 0x14002027d
mov qword [rsp + 0x478], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi + 0x10]
cmp eax, 0xb7
mov qword [rsp + 0x20], rbp
sete sil
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi], rax
test rax, rax
jne 0x1400201f7
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 8]
mov qword [rdi + 0x10], rbp
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 8], rbp
jmp 0x140020275
test sil, sil
jne 0x140020204
mov dword [rax], ebp
mov rax, qword [rdi]
mov dword [rax + 4], ebp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140020227
lea rdx, [rsp + 0x30]
mov r8d, 0x104
mov rcx, rdi
call fcn.1400202b0
lea rcx, [rdi + 0x9c]
lea r8, [rsp + 0x240]
mov edx, 0x104
call fcn.1400229ec
mov rcx, rdi
sub rcx, rbx
nop word [rax + rax]
movzx eax, word [rbx]
lea rbx, [rbx + 2]
mov word [rcx + rbx + 0x1a], ax
test ax, ax
jne 0x140020250
mov rcx, qword [rdi]
mov eax, dword [rcx]
mov dword [rdi + 0x18], eax
inc dword [rcx]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rsi, qword [rsp + 0x478]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400215b0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret