joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140784058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407841df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140784089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14078406f
add dl, dl
jne 0x140784096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407840f6
xor eax, eax
add dl, dl
jne 0x1407840a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407841ad
add dl, dl
jne 0x1407840b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407840c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407840d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407840dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407840ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14078407e
mov eax, 1
add dl, dl
jne 0x140784106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140784113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407840fb
sub eax, ebx
mov ebx, 1
jne 0x14078414c
mov ecx, 1
add dl, dl
jne 0x14078412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14078413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140784123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14078407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140784168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140784175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14078415d
cmp eax, 0x7d00
jae 0x14078419b
cmp eax, 0x500
jb 0x140784196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14078407e
cmp eax, 0x7f
ja 0x14078419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14078407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407841d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14078407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x420e20
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x005d9713], 0
jne 0x420f85
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
sub rdx, qword [rbx + 0x18]
nop
test rdx, rdx
jne 0x420f2e
xor eax, eax
nop
nop
nop
mov rcx, rax
shr rax, 3
and rcx, 7
mov edx, 1
shl edx, cl
nop
add rax, qword [rbx + 0x50]
lock or byte [rax], dl
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x420f7a
lea rbx, [0x005d0ce0]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov esi, 1
shl esi, cl
test sil, bl
jne 0x420eef
lock or byte [rdx], sil
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
mov rcx, qword [rsp + 0x30]
add qword [rax + 0x16a8], rcx
mov rcx, qword [rsp + 0x38]
add qword [rax + 0x16b0], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp word [rbx + 0x5e], 0
je 0x420f4a
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
shr rdx, cl
and rax, rdx
jmp 0x420e55
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
movzx esi, byte [rbx + 0x66]
cmp sil, 0x40
sbb rdi, rdi
shr rdx, cl
and rax, rdx
movzx edx, word [rbx + 0x5c]
imul rax, rdx
mov ecx, esi
shr rax, cl
and rax, rdi
jmp 0x420e55
mov ecx, 0x40
nop
call fcn.00467480
lea rax, [0x004fafb0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.00436a60
nop
int3
Function at 0x140001840
Capabilities:
Set console window title

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, [0x1400033cc]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.1400011c0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.ID:
mov rbx, rax
call fcn.140001ba0
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140001d70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Press_ENTER_to_exit
call fcn.140001ba0
lea rdx, [0x140001d70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140002bf8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002c42
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002c42
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002c42
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002c42
cmp dword [rcx + 0x84], 0xe
jbe 0x140002c42
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002c44
xor al, al
add rsp, 0x28
ret
Function at 0x1400016a0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov qword [rcx + 8], 1
mov word [rcx + 0x10], ax
mov rbx, rcx
mov word [rcx + 0x13], ax
mov word [rcx + 0x16], ax
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
mov rcx, rbx
call fcn.140001850
cmp dword [rbx + 8], 1
jne 0x1400016e6
lea rcx, [rbx + 0xc]
call fcn.140002960
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400019d0
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
call fcn.140002b00
mov rcx, rbx
call fcn.1400022e0
mov qword [rsp + 0x48], 0
call fcn.140001430
mov rcx, rax
lea rdx, str.SoftwareNVIDIA_CorporationGlobal
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001a43
mov rcx, qword [rsp + 0x48]
lea rdx, str.nView
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret
Function at 0x1400022e0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push rdi
sub rsp, 0x460
mov rax, qword [0x140071008]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.1400088d0
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, str.NVIDIA_TwinView_Window
xor dil, dil
lea rcx, str.NVIDIA_TwinView_Window
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140002403
xor edx, edx
mov qword [rsp + 0x470], rbx
mov r8d, 0x208
lea rcx, [rsp + 0x240]
call fcn.1400088d0
lea rax, str.nViewUnload
mov edx, 0x208
lea r9, str.nView64.dll
mov qword [rsp + 0x20], rax
lea r8, str._s__s
lea rcx, [rsp + 0x240]
call fcn.140001360
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 1
lea r9, [rsp + 0x240]
mov qword [rsp + 0x20], rax
lea r8, str.rundll32.exe
xor ecx, ecx
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
nop dword [rax + rax]
lea rdx, str.NVIDIA_TwinView_Window
lea rcx, str.NVIDIA_TwinView_Window
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1400023ed
mov ecx, 0x64
inc ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 0x64
jb 0x1400023c0
jmp 0x1400023f0
mov dil, 1
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0x470]
movzx eax, dil
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140006f70
add rsp, 0x460
pop rdi
ret

Function at 0x140002420
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140002490
test al, al
je 0x140002473
cmp qword [0x140071d80], 0
je 0x140002473
lea r8, str.nwiz.exe
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
test rax, rax
je 0x140002473
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000247b
mov rcx, qword [rbx]
mov edx, 0xbb8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor al, al
add rsp, 0x20
pop rbx
ret
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1400036e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x38
cmp byte [0x140071d9c], 0
mov rbx, 0xffffffff80000001
lea rdi, [rbx + 1]
jne 0x14000383c
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov qword [rsp + 0x68], rsi
xor r8d, r8d
lea rdx, str.SoftwareNVIDIA_CorporationGlobal_nView
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400037ec
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.UseHKLM
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x60], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003787
cmp dword [rsp + 0x50], esi
je 0x140003787
mov byte [0x140071d9d], 1
jmp 0x140003790
cmp byte [0x140071d9d], sil
je 0x1400037dc
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.HKLMIsWritable
mov dword [rsp + 0x50], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], rsi
jmp 0x1400037ec
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140003830
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x140071d9d], sil
je 0x140003830
lea rax, [rsp + 0x68]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareNVIDIA_CorporationGlobal_nView
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003829
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140003830
mov byte [0x140071d9d], sil
mov rsi, qword [rsp + 0x30]
mov byte [0x140071d9c], 1
cmp byte [0x140071d9d], 0
cmovne rbx, rdi
mov rax, rbx
add rsp, 0x38
pop rdi
pop rbx
ret

Function at 0x140003dc0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 0
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0x50]
add rsp, 0x38
ret

Function at 0x140003e00
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
add rsp, 0x38
ret

Function at 0x140004030
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x20], r9d
sub rsp, 0x38
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
add rsp, 0x38
ret
Function at 0x1400053e0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
xor r14d, r14d
mov ebp, 1
mov rsi, r8
movzx ebx, r14w
sub edx, ebp
je 0x140005421
sub edx, ebp
je 0x14000541a
cmp edx, ebp
jne 0x140005424
lea ebx, [rbp + 3]
jmp 0x140005424
mov ebx, 2
jmp 0x140005424
movzx ebx, bp
lea rdx, str.nview
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x14000546f
mov qword [rsp + 0x40], r14
xor r8d, r8d
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov dword [rsp + 0x30], r14d
movzx edx, bx
mov word [rsp + 0x28], bp
mov rcx, rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret

Function at 0x140006120
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140071008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.1400088d0
xor r9d, r9d
lea r8d, [rdi + 0x23]
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], di
jne 0x140006190
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140003910
mov dword [rsp + 0x20], 1
mov r8d, 0x19
lea rdx, str.NVIDIA_Corporation_nView
mov rcx, rbx
call fcn.140004320
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140006f70
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x1400061f0
Capabilities:
Get common file path
Get installed programs
Get program files directory
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x140071008]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r9d, dword [0x140071dec]
xor r14d, r14d
mov rdi, rdx
mov rsi, rcx
test r9d, r9d
jne 0x14000626d
mov dword [0x140071dec], 0x20019
mov dword [rsp + 0x30], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x140006266
cmp dword [rsp + 0x30], r14d
je 0x140006266
mov r9d, dword [0x140071dec]
bts r9d, 8
mov dword [0x140071dec], r9d
jmp 0x14000626d
mov r9d, dword [0x140071dec]
test rsi, rsi
je 0x140006448
test rdi, rdi
je 0x140006448
lea rax, [rsp + 0x38]
mov qword [rsp + 0x298], rbp
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallB2FE1952_0186_46C3_BAEC_A80AA35AC5B8_Display.NView
mov qword [rsp + 0x38], r14
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000632b
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.InstallLocation
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov qword [rsp + 0x290], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
mov ebx, eax
sete bpl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x290]
jne 0x14000632b
movzx eax, bpl
mov rbp, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140006f70
add rsp, 0x260
pop r14
pop rdi
pop rsi
ret
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.1400088d0
xor r9d, r9d
lea rdx, [rsp + 0x40]
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
shr rdi, 1
mov r9d, 0x7ffffffe
lea rax, [rdi - 1]
cmp rax, r9
ja 0x1400063a8
sub r9, rdi
lea r8, [rsp + 0x40]
sub r8, rsi
mov rdx, rdi
mov rcx, rsi
lea rax, [r9 + rdx]
test rax, rax
je 0x140006394
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140006394
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140006374
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov rcx, rdi
mov word [rax], r14w
jmp 0x1400063ca
test rdi, rdi
je 0x140006441
mov word [rsi], r14w
cmp rdi, 0x7fffffff
ja 0x140006441
mov rcx, rdi
test rdi, rdi
je 0x1400063e0
mov rax, rsi
nop dword [rax]
cmp word [rax], r14w
je 0x1400063e0
add rax, 2
sub rcx, 1
jne 0x1400063d0
mov rax, rdi
sub rax, rcx
test rcx, rcx
cmove rax, r14
je 0x140006441
mov rdx, rdi
lea rcx, [rsi + rax*2]
sub rdx, rax
je 0x140006432
sub rax, rdi
lea r9, str.NVIDIA_Corporation_nView
add rax, 0x7ffffffe
add rax, rdx
sub r9, rcx
test rax, rax
je 0x140006432
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x140006432
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x140006411
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r14w
mov al, 1
jmp 0x140006307
xor al, al
jmp 0x14000630f
Function at 0x140055b70
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
mov esi, edi
test rcx, rcx
je 0x140055c4f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebp, eax
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rbx + rdx*2], si
jne 0x140055ba7
lea ecx, [rax + 1]
add rdx, rcx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x140055c52
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r8d, eax
lea ecx, [r8 - 1]
cmp word [rsi + rcx*2], 0x5c
je 0x140055bf6
mov eax, 0x5c
mov word [rsi + r8*2], ax
inc r8d
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], di
jne 0x140055c00
test rax, rax
je 0x140055c4f
mov rdx, rdi
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbx + rdx*2]
lea ecx, [rdi + r8]
inc edi
mov word [rsi + rcx*2], ax
mov edx, edi
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140055c40
cmp rdx, rax
jb 0x140055c20
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140055d10
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push r12
push r14
sub rsp, 0x40
mov rax, qword [0x140071008]
xor rax, rsp
mov qword [rsp + 0x38], rax
movdqa xmm0, xmmword [0x140068100]
xor r12d, r12d
mov ebx, r12d
mov rsi, rcx
cmp dword [0x140073950], ebx
mov r14d, r12d
mov ebp, r12d
movdqu xmmword [rsp + 0x20], xmm0
jne 0x140055dcd
mov r8b, 3
lea edx, [r12 + 2]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
lea edx, [r12 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
lea edx, [r12 + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea edx, [r12 + 0x23]
mov dword [0x140073950], 0x11c
mov r8, rax
mov dword [0x140073954], 6
lea rcx, [0x140073950]
mov dword [0x140073958], 1
mov word [0x140073a64], r12w
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov ecx, r12d
test eax, eax
sete cl
mov dword [0x140071a64], ecx
jmp 0x140055dd3
mov ecx, dword [0x140071a64]
test ecx, ecx
je 0x140055de1
mov eax, 1
jmp 0x140055f72
test rsi, rsi
je 0x140055f5e
xor r9d, r9d
mov qword [rsp + 0x78], rdi
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov edi, eax
test eax, eax
je 0x140055f59
mov edx, edi
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
je 0x140055f59
xor r9d, r9d
mov r8, rax
mov edx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp edi, eax
jbe 0x140055f59
mov rsi, r12
mov rdi, 0xffffffffffffffff
nop dword [rax]
mov ecx, dword [rsp + rsi*4 + 0x20]
lea rdx, [0x140063cb0]
call fcn.140055960
mov rbx, rax
test rax, rax
je 0x140055f59
mov r8, rdi
nop
inc r8
cmp word [rax + r8*2], r12w
jne 0x140055e70
mov rdx, rbx
mov rcx, r14
call fcn.14004d28c
test eax, eax
mov ebp, r12d
sete bpl
test eax, eax
je 0x140055f59
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
inc rsi
cmp rsi, 4
jl 0x140055e50
mov rbx, r12
cmp ebp, 1
je 0x140055f59
movups xmm0, xmmword [str.WinSxS_]
movzx eax, word [0x140067d90]
lea rcx, str._SystemRoot_
xor r8d, r8d
mov word [rsp + 0x30], ax
xor edx, edx
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
test eax, eax
je 0x140055f59
lea rdx, [rsi + 0x12]
mov qword [rsp + 0x80], r15
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140055f51
mov r8d, esi
lea rcx, str._SystemRoot_
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp esi, eax
jne 0x140055f51
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsi + 0x12]
call fcn.140002d90
nop dword [rax + rax]
inc rdi
cmp word [rbx + rdi*2], r12w
jne 0x140055f30
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call fcn.14004d28c
test eax, eax
mov ebp, r12d
sete bpl
mov r15, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140006f70
add rsp, 0x40
pop r14
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0xb5a2c0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00b5a447
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0xb5a2f1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xb5a2d7
add dl, dl
jne 0xb5a2fe
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xb5a35e
xor eax, eax
add dl, dl
jne 0xb5a30d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xb5a415
add dl, dl
jne 0xb5a31e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb5a32b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb5a338
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb5a345
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0xb5a352
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0xb5a2e6
mov eax, 1
add dl, dl
jne 0xb5a36e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb5a37b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xb5a363
sub eax, ebx
mov ebx, 1
jne 0xb5a3b4
mov ecx, 1
add dl, dl
jne 0xb5a396
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb5a3a3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xb5a38b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xb5a2e6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xb5a3d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb5a3dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xb5a3c5
cmp eax, 0x7d00
jae 0xb5a403
cmp eax, 0x500
jb 0xb5a3fe
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xb5a2e6
cmp eax, 0x7f
ja 0xb5a406
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xb5a2e6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0xb5a43a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0xb5a2e6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20