Function at 0x1800cf6c0
Capabilities:
Create thread
Get graphical window text
Read .ini file
Terminate thread

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0xa90
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x58], 0xfffffffffffffffe
mov qword [rbp + 0xa98], rbx
mov qword [rbp + 0xaa0], rsi
mov qword [rbp + 0xaa8], rdi
mov rax, qword [0x1801dc960]
xor rax, rbp
mov qword [rbp + 0xa50], rax
mov rdi, rcx
mov edx, 0xc9c2
lea rcx, str.line:_d__MyGetOpenFileNameW
call fcn.18005cd20
lea rdx, [sym.vrvhook64.dll_MyGetOpenFileNameW]
lea rcx, [0x18028d500]
call fcn.18000dae0
mov rbx, rax
test rax, rax
je 0x1800d038a
mov rcx, rax
call fcn.18000d7e0
mov rsi, rax
cmp dword [0x18025caa4], 0
jne 0x1800cf755
mov rcx, rdi
call rsi
jmp 0x1800d038a
mov rcx, rbx
call fcn.180083ad0
test eax, eax
je 0x1800cf76b
mov rcx, rdi
call rsi
jmp 0x1800d038a
cmp dword [0x180250e70], 0
jne 0x1800cf77e
mov rcx, rdi
call rsi
jmp 0x1800d038a
call fcn.1800a79a0
lea rdx, [0x18025c000]
mov rcx, qword [str._IEXPLORE.EXE_CHROME.EXE_FIREFOX.EXE_360SE.EXE_QQBROWSER.EXE_SOGOUEXPLORER.EXE_BAIDUBROWSER.EXE_HAO123JUZI.EXE_LIEBAO.EXE_TANGO3.EXE_TWCHROME.EXE_THEWORLD.EXE_UCBROWSER.EXE_JUZI.EXE_360CHROME.EXE_115BR.EXE_MAXTHON.EXE_2345EXPLORER.EXE_115CHROME.EXE_HAO123BROWSER.EXE_MYIE.EXE_]
call fcn.1800f4d08
test rax, rax
je 0x1800cf7a7
mov rcx, qword [0x1801e1af0]
call fcn.180036430
xor r15d, r15d
mov ebx, r15d
mov r12d, r15d
mov byte [rbp + 0x520], bl
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x521]
call fcn.1800f4fb0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r14d, [r15 + 1]
test rax, rax
je 0x1800cf825
mov r8d, 0x104
lea rdx, [rbp + 0x520]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rcx, [rbp + 0x520]
call fcn.1800fd3f0
lea r8, [rbp + 0x520]
mov edx, 0xc9f0
lea rcx, str.line:_d__MyGetOpenFileNameW:
call fcn.18005cd20
lea rcx, [rbp + 0x520]
call fcn.180064200
test eax, eax
cmovne r12d, r14d
mov r8d, r14d
lea rdx, str.VpDlpSettings.ini
lea rcx, [rbp + 0x68]
call fcn.18001f690
nop
cmp qword [rax + 0x20], 0x10
jb 0x1800cf846
mov r9, qword [rax + 8]
jmp 0x1800cf84a
lea r9, [rax + 8]
xor r8d, r8d
lea rdx, str.FuShun
lea rcx, [0x180162974]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov r13d, eax
cmp qword [rbp + 0x88], 0x10
jb 0x1800cf877
mov rcx, qword [rbp + 0x70]
call fcn.1800f4b9c
mov qword [rbp + 0x88], 0xf
mov qword [rbp + 0x80], r15
mov byte [rbp + 0x70], 0
cmp r13d, 1
jne 0x1800cf8f7
lea rdx, [0x180165a70]
lea rcx, [rbp + 0x520]
call fcn.1800f4d08
test rax, rax
jne 0x1800cf8c3
lea rdx, str.MAIL__
lea rcx, [rbp + 0x520]
call fcn.1800f4d08
test rax, rax
je 0x1800cf8c6
mov ebx, r14d
lea rdx, str._WLMAIL.EXE_
lea rcx, [0x18025c000]
call fcn.18010b680
test eax, eax
je 0x1800cf8f4
lea rdx, str._STEEDOS_DESKTOP.EXE_
lea rcx, [0x18025c000]
call fcn.18010b680
test eax, eax
jne 0x1800cf8f7
mov ebx, r14d
mov r14d, r15d
test ebx, ebx
mov r13d, 1
cmovne r14d, r13d
mov rbx, r15
lea rdx, [0x18025c000]
mov rcx, qword [str._BAIDUYUNGUANJIA.EXE_BAIDUNETDISK.EXE_360WANGPAN.EXE_WYDRIVE.EXE_FOXMAIL.EXE_OUTLOOK.EXE_ECLOUD.EXE_]
call fcn.1800f4d08
test rax, rax
je 0x1800cf9ac
lea r8, [0x180259780]
mov edx, 0xca12
lea rcx, str.line:_d__MyGetOpenFileNameW:Name___s
call fcn.18005cd20
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x1800a4f60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp qword [rdi + 0x78], 0
je 0x1800cf9ac
mov qword [0x180266560], r15
mov qword [0x180266528], r15
mov qword [0x180266530], r15
mov qword [0x180266550], r15
mov qword [0x180266558], r15
mov qword [0x180266548], r15
mov rcx, qword [rdi + 0x78]
mov qword [0x180266520], rcx
and dword [rdi + 0x60], 0xfffffdff
lea rax, [0x1800cf610]
mov qword [rdi + 0x78], rax
mov edx, 0xca2e
lea rcx, [0x1801680b8]
call fcn.18005cd20
mov dword [0x1802663c0], r13d
mov dword [0x1802633e4], r13d
mov rcx, rdi
call rsi
mov r13d, eax
mov dword [0x1802633e4], r15d
mov dword [0x1802663c0], r15d
test r12d, r12d
jne 0x1800d038a
mov r8d, eax
mov edx, 0xca3b
lea rcx, [0x180168080]
call fcn.18005cd20
lea rdx, [0x18025c000]
mov rcx, qword [str._BAIDUYUNGUANJIA.EXE_BAIDUNETDISK.EXE_360WANGPAN.EXE_WYDRIVE.EXE_FOXMAIL.EXE_OUTLOOK.EXE_ECLOUD.EXE_]
call fcn.1800f4d08
test rax, rax
je 0x1800cfa47
mov rcx, qword [0x1802663f8]
test rcx, rcx
je 0x1800cfa2f
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [0x1802663f8], r15
test rbx, rbx
je 0x1800cfa3f
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, r13d
jmp 0x1800d038a
test r13d, r13d
je 0x1800d0380
cmp dword [0x1802633e0], 0
jne 0x1800d0380
mov dword [0x1802633e0], r15d
cmp dword [0x180250e70], 0
je 0x1800d0380
lea r8, [0x180259780]
mov edx, 0xca56
lea rcx, str.line:_d__MyGetOpenFileNameW:Name___s
call fcn.18005cd20
lea rdx, [0x18025c000]
mov rcx, qword [str._IEXPLORE.EXE_CHROME.EXE_FIREFOX.EXE_360SE.EXE_QQBROWSER.EXE_SOGOUEXPLORER.EXE_BAIDUBROWSER.EXE_HAO123JUZI.EXE_LIEBAO.EXE_TANGO3.EXE_TWCHROME.EXE_THEWORLD.EXE_UCBROWSER.EXE_JUZI.EXE_360CHROME.EXE_115BR.EXE_MAXTHON.EXE_2345EXPLORER.EXE_115CHROME.EXE_HAO123BROWSER.EXE_BAIDUYUNGUANJIA.EXE_BAIDUNETDISK.EXE_360WANGPAN.EXE_WYDRIVE.EXE_FLASHUTIL_ACTIVEX.EXE_FOXMAIL.EXE_OUTLOOK.EXE_WLMAIL.EXE_ECLOUD.EXE_STEEDOS_DESKTOP.EXE_]
call fcn.1800f4d08
test rax, rax
jne 0x1800cfabd
lea rdx, str.FLASH
lea rcx, [0x180259780]
call fcn.1800f4d08
test rax, rax
je 0x1800d0380
mov rcx, qword [0x1801e1b60]
test rcx, rcx
je 0x1800cface
mov rax, qword [rcx]
call qword [rax]
mov qword [rbp + 0x88], 0xf
mov qword [rbp + 0x80], r15
mov byte [rbp + 0x70], 0
mov r8d, 0x17
lea rdx, str.MSGTYPERPT_r_nMSGSTRING
lea rcx, [rbp + 0x68]
call fcn.180003700
nop
mov qword [rbp + 0xb0], 0xf
mov qword [rbp + 0xa8], r15
mov byte [rbp + 0x98], 0
mov r8d, 0x17
lea rdx, str.MSGTYPERPT_r_nMSGSTRING
lea rcx, [rbp + 0x90]
call fcn.180003700
nop
mov r12d, r15d
mov rsi, qword [rdi + 0x30]
mov rbx, rsi
mov word [rbp + 0x630], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x632]
call fcn.1800f4fb0
mov rdx, rsi
lea rcx, [rbp + 0x630]
sub rcx, rsi
nop word [rax + rax]
movzx eax, word [rdx]
mov word [rcx + rdx], ax
add rdx, 2
test ax, ax
jne 0x1800cfb70
mov word [rbp + 0x840], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x842]
call fcn.1800f4fb0
mov rdx, rsi
lea rcx, [rbp + 0x840]
sub rcx, rsi
nop dword [rax]
movzx eax, word [rdx]
mov word [rcx + rdx], ax
add rdx, 2
test ax, ax
jne 0x1800cfbb0
test rbx, rbx
je 0x1800d0212
nop dword [rax]
cmp word [rbx], 0
jne 0x1800cff97
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x630]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test byte [rbp + 0xc0], 0x10
je 0x1800cfdcb
mov r12d, 1
cmp word [rbx + 2], 0
je 0x1800cff86
mov word [rbp + 0x310], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x312]
call fcn.1800f4fb0
mov rdx, r15
nop word [rax + rax]
movzx eax, word [rbp + rdx + 0x840]
mov word [rbp + rdx + 0x310], ax
add rdx, 2
test ax, ax
jne 0x1800cfc40
lea rdi, [rbp + 0x310]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x180155e50]
mov dword [rdi - 2], eax
lea rdi, [rbp + 0x310]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, word [rbx + rcx + 2]
mov word [rdi + rcx - 2], ax
add rcx, 2
test ax, ax
jne 0x1800cfc90
mov rcx, r15
nop word [rax + rax]
movzx eax, word [rbp + rcx + 0x310]
mov word [rbp + rcx + 0x630], ax
add rcx, 2
test ax, ax
jne 0x1800cfcb0
lea rcx, [rbp + 0x310]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1800cfce4
mov rax, r15
jmp 0x1800cfd26
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800cfd00
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180124410
sub rsp, rcx
lea rcx, [rsp + 0x30]
mov r9d, 3
lea rdx, [rbp + 0x310]
call fcn.180015500
mov r8, rax
mov edx, 0xca86
lea rcx, str.line:_d__MyGetOpenFileNameW:FilePath____s
call fcn.18005cd20
lea rcx, [rbp + 0x310]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1800cfd55
mov rax, r15
jmp 0x1800cfd97
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800cfd71
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180124410
sub rsp, rcx
lea rcx, [rsp + 0x30]
mov r9d, 3
lea rdx, [rbp + 0x310]
call fcn.180015500
mov r9d, r14d
mov r8, rax
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x68]
call fcn.18009b1e0
test eax, eax
je 0x1800cffa6
mov edx, 0xca8c
lea rcx, str.line:_d__DealGetOpenFileNameW
call fcn.18005cd20
jmp 0x1800cff86
test r12d, r12d
je 0x1800d0088
cmp word [rbx + 2], 0
je 0x1800cff86
mov word [rbp + 0x310], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x312]
call fcn.1800f4fb0
mov rdx, r15
nop
movzx eax, word [rbp + rdx + 0x840]
mov word [rbp + rdx + 0x310], ax
add rdx, 2
test ax, ax
jne 0x1800cfe00
lea rdi, [rbp + 0x310]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x180155e50]
mov dword [rdi - 2], eax
lea rdi, [rbp + 0x310]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, word [rbx + rcx + 2]
mov word [rdi + rcx - 2], ax
add rcx, 2
test ax, ax
jne 0x1800cfe50
mov rcx, r15
nop word [rax + rax]
movzx eax, word [rbp + rcx + 0x310]
mov word [rbp + rcx + 0x630], ax
add rcx, 2
test ax, ax
jne 0x1800cfe70
lea rcx, [rbp + 0x310]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1800cfea4
mov rax, r15
jmp 0x1800cfee6
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800cfec0
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180124410
sub rsp, rcx
lea rcx, [rsp + 0x30]
mov r9d, 3
lea rdx, [rbp + 0x310]
call fcn.180015500
mov r8, rax
mov edx, 0xca9e
lea rcx, str.line:_d__MyGetOpenFileNameW:FilePath____s
call fcn.18005cd20
lea rcx, [rbp + 0x310]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1800cff15
mov rax, r15
jmp 0x1800cff57
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800cff31
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180124410
sub rsp, rcx
lea rcx, [rsp + 0x30]
mov r9d, 3
lea rdx, [rbp + 0x310]
call fcn.180015500
mov r9d, r14d
mov r8, rax
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x68]
call fcn.18009b1e0
test eax, eax
je 0x1800d0017
mov edx, 0xcaa5
lea rcx, str.line:_d__DealGetOpenFileNameW
call fcn.18005cd20
cmp word [rbx], 0
jne 0x1800cff97
cmp word [rbx + 2], 0
je 0x1800d0212
add rbx, 2
je 0x1800d0212
jmp 0x1800cfbd0
mov edx, 0xca89
lea rcx, [0x180167ff8]
call fcn.18005cd20
nop
cmp qword [rbp + 0xb0], 0x10
jb 0x1800cffce
mov rcx, qword [rbp + 0x98]
call fcn.1800f4b9c
mov qword [rbp + 0xb0], 0xf
mov qword [rbp + 0xa8], r15
mov byte [rbp + 0x98], 0
cmp qword [rbp + 0x88], 0x10
jb 0x1800cfffa
mov rcx, qword [rbp + 0x70]
call fcn.1800f4b9c
mov qword [rbp + 0x88], 0xf
mov qword [rbp + 0x80], r15
mov byte [rbp + 0x70], 0
xor eax, eax
jmp 0x1800d038a
mov edx, 0xcaa2
lea rcx, [0x180167ff8]
call fcn.18005cd20
nop
cmp qword [rbp + 0xb0], 0x10
jb 0x1800d003f
mov rcx, qword [rbp + 0x98]
call fcn.1800f4b9c
mov qword [rbp + 0xb0], 0xf
mov qword [rbp + 0xa8], r15
mov byte [rbp + 0x98], 0
cmp qword [rbp + 0x88], 0x10
jb 0x1800d006b
mov rcx, qword [rbp + 0x70]
call fcn.1800f4b9c
mov qword [rbp + 0x88], 0xf
mov qword [rbp + 0x80], r15
mov byte [rbp + 0x70], 0
xor eax, eax
jmp 0x1800d038a
test rsi, rsi
jne 0x1800d009c
mov rax, r15
movabs rdi, 0xffffffffffffff0
jmp 0x1800d010a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1800d00bd
mov rax, r15
movabs rdi, 0xffffffffffffff0
jmp 0x1800d010a
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800d00de
movabs rdi, 0xffffffffffffff0
mov rcx, rdi
jmp 0x1800d00e8
movabs rdi, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180124410
sub rsp, rcx
lea rcx, [rsp + 0x30]
mov r9d, 3
mov rdx, rsi
call fcn.180015500
mov r8, rax
mov edx, 0xcaac
lea rcx, str.line:_d__MyGetOpenFileNameW:FilePath____s
call fcn.18005cd20
test rsi, rsi
jne 0x1800d0128
mov rax, r15
jmp 0x1800d0176
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1800d013f
mov rax, r15
jmp 0x1800d0176
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800d0154
mov rcx, rdi
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180124410
sub rsp, rcx
lea rcx, [rsp + 0x30]
mov r9d, 3
mov rdx, rsi
call fcn.180015500
mov r9d, r14d
mov r8, rax
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x68]
call fcn.18009b1e0
test eax, eax
jne 0x1800d0201
mov edx, 0xcaaf
lea rcx, [0x180167ff8]
call fcn.18005cd20
nop
cmp qword [rbp + 0xb0], 0x10
jb 0x1800d01b8
mov rcx, qword [rbp + 0x98]
call fcn.1800f4b9c
mov qword [rbp + 0xb0], 0xf
mov qword [rbp + 0xa8], r15
mov byte [rbp + 0x98], 0
cmp qword [rbp + 0x88], 0x10
jb 0x1800d01e4
mov rcx, qword [rbp + 0x70]
call fcn.1800f4b9c
mov qword [rbp + 0x88], 0xf
mov qword [rbp + 0x80], r15
mov byte [rbp + 0x70], 0
xor eax, eax
jmp 0x1800d038a
mov edx, 0xcab2
lea rcx, str.line:_d__DealGetOpenFileNameW
call fcn.18005cd20
mov edx, 0xcaca
lea rcx, str.line:_d__DealGetOpenFileNameW_11111111
call fcn.18005cd20
mov rcx, qword [0x1801e1b60]
test rcx, rcx
je 0x1800d0235
mov rax, qword [rcx]
call qword [rax + 8]
cmp qword [rbp + 0x80], 0x17
ja 0x1800d024d
cmp qword [rbp + 0xa8], 0x17
jbe 0x1800d0328
mov edx, 0xcad1
lea rcx, str.line:_d__DealGetOpenFileNameW_222222
call fcn.18005cd20
lea rdx, [rbp]
mov qword [rbp + 0x50], rdx
lea rax, [rbp + 0x28]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x20], 0xf
mov qword [rbp + 0x18], r15
mov byte [rbp + 8], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x90]
lea rcx, [rbp]
call fcn.1800035e0
nop
mov qword [rbp + 0x48], 0xf
mov qword [rbp + 0x40], r15
mov byte [rbp + 0x30], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x28]
call fcn.1800035e0
nop
lea rdx, [rbp]
lea rcx, [rbp + 0x28]
call fcn.18007bdb0
test eax, eax
jne 0x1800d0328
cmp qword [rbp + 0xb0], 0x10
jb 0x1800d02e2
mov rcx, qword [rbp + 0x98]
call fcn.1800f4b9c
mov qword [rbp + 0xb0], 0xf
mov qword [rbp + 0xa8], r15
mov byte [rbp + 0x98], 0
cmp qword [rbp + 0x88], 0x10
jb 0x1800d030e
mov rcx, qword [rbp + 0x70]
call fcn.1800f4b9c
mov qword [rbp + 0x88], 0xf
mov qword [rbp + 0x80], r15
mov byte [rbp + 0x70], 0
xor eax, eax
jmp 0x1800d038a
cmp qword [rbp + 0xb0], 0x10
jb 0x1800d033e
mov rcx, qword [rbp + 0x98]
call fcn.1800f4b9c
mov qword [rbp + 0xb0], 0xf
mov qword [rbp + 0xa8], r15
mov byte [rbp + 0x98], 0
cmp qword [rbp + 0x88], 0x10
jb 0x1800d036a
mov rcx, qword [rbp + 0x70]
call fcn.1800f4b9c
mov qword [rbp + 0x88], 0xf
mov qword [rbp + 0x80], r15
mov byte [rbp + 0x70], 0
mov dword [0x1802633e0], r15d
mov eax, r13d
mov rcx, qword [rbp + 0xa50]
xor rcx, rbp
call fcn.1800f4f80
mov rbx, qword [rbp + 0xa98]
mov rsi, qword [rbp + 0xaa0]
mov rdi, qword [rbp + 0xaa8]
lea rsp, [rbp + 0xa60]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret