joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801b2b90
Capabilities:
Print debug messages

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov qword [rbp - 0x49], 0xfffffffffffffffe
mov qword [rsp + 0xf8], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r13, r8
mov rbx, rdx
mov r12, rcx
mov rsi, qword [rdx + 8]
mov rdi, qword [rdx]
cmp rdi, rsi
je 0x1801b2bf1
nop dword [rax + rax]
mov rcx, rdi
call fcn.18016de50
add rdi, 0x48
cmp rdi, rsi
jne 0x1801b2be0
mov rax, qword [rbx]
mov qword [rbx + 8], rax
xor eax, eax
mov edi, eax
mov r15, qword [r13 + 0x38]
sub r15, qword [r13 + 0x30]
sar r15, 7
sub r15d, dword [r13]
mov r14d, eax
mov esi, eax
test r15d, r15d
jle 0x1801b2d8a
nop word [rax + rax]
cmp r14d, 5
jge 0x1801b2d88
mov qword [rbp - 0x19], 7
mov qword [rbp - 0x21], rax
mov word [rbp - 0x31], ax
xorps xmm0, xmm0
movdqa xmmword [rbp - 9], xmm0
mov qword [rbp + 7], rax
mov dword [rbp - 0x11], eax
xor r8d, r8d
lea rdx, [0x1802abc2c]
lea rcx, [rbp - 0x31]
call fcn.18005c660
mov dword [rbp - 0x39], 0
mov edx, dword [r13 + 0x2c]
mov ecx, edx
sub ecx, 1
je 0x1801b2c81
cmp ecx, 1
je 0x1801b2c78
mov dword [rbp - 0xd], edx
jmp 0x1801b2c88
mov dword [rbp - 0xd], 4
jmp 0x1801b2c88
mov dword [rbp - 0xd], 3
mov r9d, esi
mov r8, r13
lea rdx, [rbp - 0x39]
mov rcx, r12
call fcn.1801b2dc0
test eax, eax
je 0x1801b2d48
mov r8, qword [rbx + 8]
lea rax, [rbp - 0x39]
cmp rax, r8
jae 0x1801b2d12
mov rax, qword [rbx]
lea rcx, [rbp - 0x39]
cmp rax, rcx
ja 0x1801b2d12
lea rcx, [rbp - 0x39]
sub rcx, rax
movabs rax, 0xe38e38e38e38e39
imul rcx
mov rdi, rdx
sar rdi, 2
mov rax, rdi
shr rax, 0x3f
add rdi, rax
cmp r8, qword [rbx + 0x10]
jne 0x1801b2cee
mov rcx, rbx
call fcn.180173210
mov rcx, qword [rbx + 8]
mov qword [rbp - 0x59], rcx
lea rdx, [rdi + rdi*8]
mov rax, qword [rbx]
lea rdx, [rax + rdx*8]
mov qword [rbp - 0x51], rcx
test rcx, rcx
je 0x1801b2d10
call fcn.18016e100
nop
jmp 0x1801b2d3b
cmp r8, qword [rbx + 0x10]
jne 0x1801b2d20
mov rcx, rbx
call fcn.180173210
mov rcx, qword [rbx + 8]
mov qword [rbp - 0x51], rcx
mov qword [rbp - 0x59], rcx
test rcx, rcx
je 0x1801b2d3b
lea rdx, [rbp - 0x39]
call fcn.18016e100
nop
add qword [rbx + 8], 0x48
inc r14d
mov edi, 1
lea rcx, [0x1802abc2c]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rbp - 9]
call fcn.180173390
mov r8, qword [rbp - 0x19]
cmp r8, 8
jb 0x1801b2d78
inc r8
mov rdx, qword [rbp - 0x31]
lea rcx, [rbp - 0x31]
call fcn.18005cac0
inc esi
cmp esi, r15d
mov eax, 0
jl 0x1801b2c20
mov eax, edi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801b7ca0
Capabilities:
Check if file exists

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x2e8], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x1801b7e2d
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1801b7e2d
mov qword [rsp + 0x78], 7
xor r15d, r15d
mov qword [rsp + 0x70], r15
mov word [rsp + 0x60], r15w
mov dword [rsp + 0x30], r15d
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x60]
mov rdx, rdi
mov rcx, rbx
call fcn.1801baa30
test eax, eax
jne 0x1801b7d39
mov ebx, r15d
jmp 0x1801b7e0c
mov ecx, 0xa
call fcn.1800787b0
mov r14d, eax
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r15
mov word [rsp + 0x40], r15w
lea r9, [rsp + 0x40]
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call fcn.1801bb1b0
test eax, eax
je 0x1801b7dd8
mov dword [rsp + 0x20], r14d
mov r9, rdi
lea r8, str.WanNengWBInput
lea rdx, str._s_s_Copy_d
lea rcx, [rbp - 0x80]
call fcn.18005c530
lea rcx, [rsi + 0x268]
lea rax, [rsp + 0x40]
cmp rcx, rax
je 0x1801b7db2
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x40]
call fcn.18005cbe0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
lea r8, [rbp - 0x80]
mov rcx, rsi
call fcn.1801b7f30
test eax, eax
mov ebx, 1
jne 0x1801b7ddb
mov ebx, r15d
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x1801b7df8
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.18005cac0
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r15
mov word [rsp + 0x40], r15w
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x1801b7e29
inc r8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.18005cac0
mov eax, ebx
jmp 0x1801b7e2f
xor eax, eax
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x2e8]
add rsp, 0x2a0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1801b7e60
Capabilities:
Check if file exists
Get common file path
Move file

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp dword [rcx + 0x260], 0
mov rbx, rcx
je 0x1801b7f10
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.180233580
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp word [rsp + 0x20], 0
jne 0x1801b7eba
xor r9d, r9d
jmp 0x1801b7ece
lea rax, [rsp + 0x20]
or r9, 0xffffffffffffffff
inc r9
cmp word [rax + r9*2], 0
jne 0x1801b7ec3
add rbx, 0x268
lea rdx, [rsp + 0x20]
mov rcx, rbx
xor r8d, r8d
call fcn.18005fea0
test rax, rax
jne 0x1801b7f10
cmp qword [rbx + 0x18], 8
jb 0x1801b7ef4
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1801b7f10
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x240
pop rbx
ret
Function at 0x1801b95c0
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov qword [rbp + 7], 7
xor edi, edi
mov qword [rbp - 1], rdi
mov word [rbp - 0x11], di
lea rcx, [rbp - 0x11]
call fcn.1801b9730
test eax, eax
je 0x1801b96ea
lea r9d, [rdi + 0xc]
xor r8d, r8d
lea rdx, str.WanNengWBIME
lea rcx, [rbp - 0x11]
call fcn.18005fea0
cmp rax, 0xffffffffffffffff
je 0x1801b96ea
lea rcx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rcx, qword [rbp - 0x11]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1801b96ea
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
lea rcx, [rbp + 0x2f]
call fcn.180066ff0
nop
lea r8, str.EUDC.EUF
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.180065eb0
lea rcx, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae rcx, qword [rbp + 0xf]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, edi
test eax, eax
setne bl
mov r8, qword [rbp + 0x27]
cmp r8, 8
jb 0x1801b96ae
inc r8
mov rdx, qword [rbp + 0xf]
lea rcx, [rbp + 0xf]
call fcn.18005cac0
mov qword [rbp + 0x27], 7
mov qword [rbp + 0x1f], rdi
mov word [rbp + 0xf], di
mov r8, qword [rbp + 0x47]
cmp r8, 8
jb 0x1801b96d8
inc r8
mov rdx, qword [rbp + 0x2f]
lea rcx, [rbp + 0x2f]
call fcn.18005cac0
mov qword [rbp + 0x47], 7
mov qword [rbp + 0x3f], rdi
mov word [rbp + 0x2f], di
jmp 0x1801b96ec
mov ebx, edi
mov r8, qword [rbp + 7]
cmp r8, 8
jb 0x1801b9706
inc r8
mov rdx, qword [rbp - 0x11]
lea rcx, [rbp - 0x11]
call fcn.18005cac0
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x1801b9730
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor ebx, ebx
mov dword [rsp + 0x38], 0x208
mov rdi, rcx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.EUDC936
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 1]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1801b97d7
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.180233580
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.SystemDefaultEUDCFont
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x1801b97db
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1801b9810
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [rsp + 0x40], bx
je 0x1801b97fb
lea rcx, [rsp + 0x40]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x1801b97f1
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.18005c660
mov eax, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
Function at 0x1801b9980
Capabilities:
Check if file exists
Get common file path
Move file

Disassembly:
mov r11, rsp
push rbp
sub rsp, 0x240
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp dword [rcx + 4], 0
mov rbp, rcx
je 0x1801b9ab9
mov qword [r11 + 0x10], rbx
lea rcx, [rsp + 0x20]
xor edx, edx
mov qword [r11 + 0x20], rdi
mov r8d, 0x208
call fcn.180233580
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor ebx, ebx
cmp word [rsp + 0x20], bx
jne 0x1801b99e2
mov r9d, ebx
jmp 0x1801b99fa
lea rax, [rsp + 0x20]
or r9, 0xffffffffffffffff
nop dword [rax + rax]
inc r9
cmp word [rax + r9*2], bx
jne 0x1801b99f0
lea rdi, [rbp + 0x48]
xor r8d, r8d
mov rcx, rdi
lea rdx, [rsp + 0x20]
call fcn.18005fea0
test rax, rax
jne 0x1801b9a4e
cmp qword [rdi + 0x18], 8
mov qword [rsp + 0x260], rsi
jb 0x1801b9a27
mov rsi, qword [rdi]
jmp 0x1801b9a2a
mov rsi, rdi
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1801b9a46
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rsi, qword [rsp + 0x260]
cmp word [rsp + 0x20], bx
je 0x1801b9a6a
lea rax, [rsp + 0x20]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1801b9a60
lea rcx, [rbp + 0x68]
mov r9, rbx
xor r8d, r8d
lea rdx, [rsp + 0x20]
call fcn.18005fea0
mov rbx, qword [rsp + 0x258]
test rax, rax
jne 0x1801b9ab1
cmp qword [rdi + 0x18], 8
jb 0x1801b9a95
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1801b9ab1
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rdi, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x240
pop rbp
ret
Function at 0x1801baa30
Capabilities:
Read .ini file

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x468
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r14, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1801bab8e
test rdx, rdx
je 0x1801bab8e
xor edx, edx
mov qword [rsp + 0x460], rbp
mov r8d, 0x208
lea rcx, [rsp + 0x240]
call fcn.180233580
lea r9, str.dict.conf
mov r8, rbx
lea rdx, [0x1802abef8]
lea rcx, [rsp + 0x240]
call fcn.18005c530
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.180233580
lea rax, [rsp + 0x240]
mov rdx, rdi
mov qword [rsp + 0x28], rax
lea rbp, str.default
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], 0x104
mov r8, rbp
lea rcx, [0x1802bc3d0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov eax, ebx
nop word [rax + rax]
movzx ecx, word [rdx + rax*2]
inc rax
cmp cx, word [rbp + rax*2 - 2]
jne 0x1801bab3b
cmp rax, 8
jne 0x1801bab00
xor eax, eax
mov rbp, qword [rsp + 0x460]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x468
pop r14
pop rdi
pop rsi
pop rbx
ret
cmp word [rsp + 0x30], bx
jne 0x1801bab47
mov r8, rbx
jmp 0x1801bab5a
lea rax, [rsp + 0x30]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], bx
jne 0x1801bab50
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.18005c660
lea r9, [rsp + 0x240]
xor r8d, r8d
mov rdx, rdi
lea rcx, str.size
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
mov dword [r14], eax
setne bl
mov eax, ebx
jmp 0x1801bab16
mov eax, 1
jmp 0x1801bab1e
Function at 0x1801baf70
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x178], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov rdi, r8
mov ebx, edx
mov r14, rcx
mov qword [rsp + 0x40], r8
test rcx, rcx
jne 0x1801bafef
mov r8, qword [r8 + 0x18]
cmp r8, 8
jb 0x1801bafcd
inc r8
mov rdx, qword [rdi]
mov rcx, rdi
call fcn.18005cac0
mov qword [rdi + 0x18], 7
xor esi, esi
mov qword [rdi + 0x10], rsi
cmp qword [rdi + 0x18], 8
jb 0x1801bafe5
mov rdi, qword [rdi]
mov word [rdi], si
xor eax, eax
jmp 0x1801bb18b
test edx, edx
jne 0x1801bb02b
mov r8, qword [r8 + 0x18]
cmp r8, 8
jb 0x1801bb00b
inc r8
mov rdx, qword [rdi]
mov rcx, rdi
call fcn.18005cac0
mov qword [rdi + 0x18], 7
xor esi, esi
mov qword [rdi + 0x10], rsi
cmp qword [rdi + 0x18], 8
jb 0x1801bb023
mov rdi, qword [rdi]
mov word [rdi], si
jmp 0x1801bb186
lea edx, [rbx + 2]
lea rcx, [rsp + 0x30]
call fcn.18016d7f0
nop
mov r15, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor esi, esi
mov qword [rsp + 0x20], rsi
mov r9, rbx
mov rbx, qword [rsp + 0x30]
mov r8, rbx
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x1801bb081
test rbx, rbx
je 0x1801bb072
mov rcx, rbx
call fcn.180085310
nop
mov rcx, rdi
call fcn.18005c830
xor eax, eax
jmp 0x1801bb18b
mov byte [rbp + 0x19], sil
mov qword [rbp - 0x60], rsi
mov dword [rbp - 0x70], 0x67452301
mov dword [rbp - 0x6c], 0xefcdab89
mov dword [rbp - 0x68], 0x98badcfe
mov dword [rbp - 0x64], 0x10325476
mov r8, r15
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.180058b10
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x70]
call fcn.180059800
nop
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.18006cf70
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
cmp qword [rdi + 0x18], 8
jb 0x1801bb0ef
mov rcx, qword [rdi]
jmp 0x1801bb0f2
mov rcx, rdi
call fcn.18023c1c0
mov r8, qword [rsp + 0x60]
test eax, eax
je 0x1801bb13a
cmp r8, 8
jb 0x1801bb118
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.18005cac0
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x48], si
lea rcx, [rsp + 0x68]
call fcn.18005ba50
jmp 0x1801bb064
cmp r8, 8
jb 0x1801bb152
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.18005cac0
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x48], si
lea rcx, [rsp + 0x68]
call fcn.18005ba50
nop
test rbx, rbx
je 0x1801bb17e
mov rcx, rbx
call fcn.180085310
nop
mov rcx, rdi
call fcn.18005c830
mov eax, 1
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x178]
add rsp, 0x130
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801bb1b0
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x5c0]
sub rsp, 0x6c0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x5b0], rax
mov r14, r9
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
test rcx, rcx
je 0x1801bb395
test rdx, rdx
je 0x1801bb395
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3a0]
call fcn.180233580
lea rdx, [rbp + 0x3a0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x190]
call fcn.180233580
mov r9, rdi
mov r8, rsi
lea rdx, [0x1802abef8]
lea rcx, [rbp + 0x190]
call fcn.18005c530
lea rcx, [rbp + 0x190]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1801bb395
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x80]
call fcn.180233580
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebx
lea r9, str.WanNengWBInput
lea r8, [rbp + 0x3a0]
lea rdx, str._s_s_d__s
lea rcx, [rbp - 0x80]
call fcn.18005c530
lea rcx, [rbp - 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1801bb2b6
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x80]
call fcn.1800675f0
xor r8d, r8d
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1801bb395
mov qword [rsp + 0x78], 7
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov word [rsp + 0x60], bx
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x60]
mov rdx, rdi
mov rcx, rsi
call fcn.1801baa30
test eax, eax
je 0x1801bb374
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.18005cbe0
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x80]
call fcn.1801baba0
test eax, eax
je 0x1801bb374
cmp word [rbp - 0x80], bx
je 0x1801bb360
lea rax, [rbp - 0x80]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1801bb356
mov r8, rbx
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.18005c660
mov ebx, 1
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x1801bb391
inc r8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.18005cac0
mov eax, ebx
jmp 0x1801bb397
xor eax, eax
mov rcx, qword [rbp + 0x5b0]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x6c0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1801bb490
Capabilities:
Check if file exists
Get common file path
Move file

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp dword [rcx + 4], 0
mov rbx, rcx
je 0x1801bb53a
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.180233580
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp word [rsp + 0x20], 0
jne 0x1801bb4e7
xor r9d, r9d
jmp 0x1801bb4fb
lea rax, [rsp + 0x20]
or r9, 0xffffffffffffffff
inc r9
cmp word [rax + r9*2], 0
jne 0x1801bb4f0
add rbx, 0x28
lea rdx, [rsp + 0x20]
mov rcx, rbx
xor r8d, r8d
call fcn.18005fea0
test rax, rax
jne 0x1801bb53a
cmp qword [rbx + 0x18], 8
jb 0x1801bb51e
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1801bb53a
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x240
pop rbx
ret
Function at 0x1801bbd80
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rsi, r8
mov rbx, rdx
mov r14, rcx
test rdx, rdx
je 0x1801bbf85
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1801bbf85
mov qword [rbp - 0x78], 7
xor r12d, r12d
mov qword [rbp - 0x80], r12
mov word [rsp + 0x70], r12w
mov dword [rsp + 0x40], r12d
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov rdx, rsi
mov rcx, rbx
call fcn.1801baa30
test eax, eax
jne 0x1801bbe12
mov ebx, r12d
jmp 0x1801bbf65
mov ecx, 0xa
call fcn.1800787b0
mov r15d, eax
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], r12
mov word [rbp - 0x70], r12w
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r12
mov word [rsp + 0x50], r12w
lea r9, [rsp + 0x50]
mov r8d, eax
mov rdx, rsi
mov rcx, rbx
call fcn.1801bb1b0
test eax, eax
je 0x1801bbf31
mov dword [rsp + 0x40], r12d
lea rdi, [r14 + 0x28]
lea rax, [rsp + 0x50]
or rbx, 0xffffffffffffffff
cmp rdi, rax
je 0x1801bbe89
mov r9, rbx
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.18005cbe0
mov dword [rsp + 0x20], r15d
mov r9, rsi
lea r8, str.WanNengWBInput
lea rdx, str._s_s_Copy_d
lea rcx, [rbp - 0x50]
call fcn.18005c530
cmp word [rbp - 0x50], 0
jne 0x1801bbeb4
mov rbx, r12
jmp 0x1801bbeca
lea rax, [rbp - 0x50]
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1801bbec0
lea rsi, [r14 + 0x48]
mov r8, rbx
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.18005c660
cmp qword [rsi + 0x18], 8
jb 0x1801bbee7
mov rsi, qword [rsi]
cmp qword [rdi + 0x18], 8
jb 0x1801bbef1
mov rdi, qword [rdi]
lea rax, [r14 + 8]
lea rcx, [r14 + 0xc]
lea r8, [r14 + 0x10]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x40]
mov rdx, rdi
mov rcx, r14
call fcn.1801dfea0
mov qword [r14 + 0x18], rax
cmp dword [rsp + 0x40], 0
jne 0x1801bbf31
test rax, rax
mov ebx, 1
jne 0x1801bbf34
mov ebx, r12d
mov r8, qword [rsp + 0x68]
cmp r8, 8
jb 0x1801bbf51
inc r8
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.18005cac0
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r12
mov word [rsp + 0x50], r12w
mov r8, qword [rbp - 0x78]
cmp r8, 8
jb 0x1801bbf81
inc r8
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.18005cac0
mov eax, ebx
jmp 0x1801bbf87
xor eax, eax
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x2d0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1801cfb60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1801cfb93
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1801cfbda
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1801cfbd5
nop
cmp rbx, rcx
jae 0x1801cfbda
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1801cfbc0
cmp rbx, rcx
jb 0x1801cfbde
xor eax, eax
jmp 0x1801cfbea
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1801cff60
Capabilities:
Check if file exists
Get common file path
Move file

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp dword [rcx + 4], 0
mov rbx, rcx
je 0x1801d000a
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.180233580
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp word [rsp + 0x20], 0
jne 0x1801cffb7
xor r9d, r9d
jmp 0x1801cffcb
lea rax, [rsp + 0x20]
or r9, 0xffffffffffffffff
inc r9
cmp word [rax + r9*2], 0
jne 0x1801cffc0
add rbx, 0x20
lea rdx, [rsp + 0x20]
mov rcx, rbx
xor r8d, r8d
call fcn.18005fea0
test rax, rax
jne 0x1801d000a
cmp qword [rbx + 0x18], 8
jb 0x1801cffee
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1801d000a
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x240
pop rbx
ret