joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180147420
Capabilities:
Delete file
Get common file path

Disassembly:
push rdi
sub rsp, 0x240
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp dword [rcx + 4], 0
mov rdi, rcx
je 0x1801474d1
mov qword [rsp + 0x258], rbx
lea rcx, [rsp + 0x22]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], bx
call fcn.1800be330
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp word [rsp + 0x20], bx
je 0x18014749a
lea rax, [rsp + 0x20]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180147490
add rdi, 0x20
lea rdx, [rsp + 0x20]
mov r9, rbx
mov rcx, rdi
xor r8d, r8d
call fcn.1800128a0
mov rbx, qword [rsp + 0x258]
test rax, rax
jne 0x1801474d1
cmp qword [rdi + 0x18], 8
jb 0x1801474c8
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x240
pop rdi
ret
Function at 0x180149820
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rsi, r8
mov rbx, rdx
mov r14, rcx
mov rdx, r8
lea rcx, str.LoadCopy_DictName___s
call fcn.18001a790
test rbx, rbx
je 0x180149a11
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180149a11
mov qword [rbp - 0x78], 7
xor r12d, r12d
mov qword [rbp - 0x80], r12
mov word [rsp + 0x70], r12w
lea r8, [rsp + 0x70]
mov rdx, rsi
mov rcx, rbx
call fcn.180158480
test eax, eax
jne 0x1801498b7
mov ebx, r12d
jmp 0x1801499fc
mov edx, 0x3e8
mov ecx, 0xa
call fcn.18000dc90
mov r15d, eax
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], r12
mov word [rbp - 0x70], r12w
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r12
mov word [rsp + 0x50], r12w
lea r9, [rsp + 0x50]
mov r8d, eax
mov rdx, rsi
mov rcx, rbx
call fcn.180158280
test eax, eax
je 0x1801499d3
mov dword [rsp + 0x40], r12d
lea rdi, [r14 + 0x20]
lea rax, [rsp + 0x50]
or rbx, 0xffffffffffffffff
cmp rdi, rax
je 0x180149933
mov r9, rbx
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.180005100
mov dword [rsp + 0x20], r15d
mov r9, rsi
lea r8, str.WanNengWBInput
lea rdx, str._s_s_Copy_d
lea rcx, [rbp - 0x50]
call fcn.1800b5a54
cmp word [rbp - 0x50], 0
jne 0x18014995e
mov rbx, r12
jmp 0x18014996c
lea rax, [rbp - 0x50]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180149962
lea rsi, [r14 + 0x40]
mov r8, rbx
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.180005450
cmp qword [rsi + 0x18], 8
jb 0x180149989
mov rsi, qword [rsi]
cmp qword [rdi + 0x18], 8
jb 0x180149993
mov rdi, qword [rdi]
lea rax, [r14 + 8]
lea rcx, [r14 + 0xc]
lea r8, [r14 + 0x10]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x40]
mov rdx, rdi
mov rcx, r14
call fcn.180158690
mov qword [r14 + 0x18], rax
cmp dword [rsp + 0x40], 0
jne 0x1801499d3
test rax, rax
mov ebx, 1
jne 0x1801499d6
mov ebx, r12d
cmp qword [rsp + 0x68], 8
jb 0x1801499e8
mov rcx, qword [rsp + 0x50]
call fcn.1800b5354
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r12
mov word [rsp + 0x50], r12w
cmp qword [rbp - 0x78], 8
jb 0x180149a0d
mov rcx, qword [rsp + 0x70]
call fcn.1800b5354
mov eax, ebx
jmp 0x180149a13
xor eax, eax
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x2d0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18014a3d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x18014a403
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x18014a449
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x18014a444
nop
cmp rbx, rcx
jae 0x18014a449
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
dec edi
jne 0x18014a430
cmp rbx, rcx
jb 0x18014a44d
xor eax, eax
jmp 0x18014a459
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18014c370
Capabilities:
Delete file
Get common file path

Disassembly:
mov r11, rsp
push rbp
sub rsp, 0x240
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp dword [rcx + 4], 0
mov rbp, rcx
je 0x18014c48a
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
lea rcx, [rsp + 0x22]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], bx
mov qword [r11 + 0x20], rdi
call fcn.1800be330
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
movzx esi, word [rsp + 0x20]
test si, si
jne 0x18014c3de
mov r9d, ebx
jmp 0x18014c3fa
lea rax, [rsp + 0x20]
or r9, 0xffffffffffffffff
nop word [rax + rax]
inc r9
cmp word [rax + r9*2], bx
jne 0x18014c3f0
lea rdi, [rbp + 0x48]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov rcx, rdi
call fcn.1800128a0
test rax, rax
jne 0x18014c42b
cmp qword [rdi + 0x18], 8
jb 0x18014c41d
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movzx esi, word [rsp + 0x20]
test si, si
mov rsi, qword [rsp + 0x260]
je 0x18014c44b
lea rax, [rsp + 0x20]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18014c441
lea rdi, [rbp + 0x68]
lea rdx, [rsp + 0x20]
mov r9, rbx
mov rcx, rdi
xor r8d, r8d
call fcn.1800128a0
mov rbx, qword [rsp + 0x258]
test rax, rax
jne 0x18014c482
cmp qword [rdi + 0x18], 8
jb 0x18014c479
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdi, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x240
pop rbp
ret
Function at 0x1801514a0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x880
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov rbp, r8
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
jne 0x1801514d2
xor eax, eax
jmp 0x180151647
mov qword [rsp + 0x8a8], rdi
lea rcx, [rsp + 0x242]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x240], di
call fcn.1800be330
lea rcx, [rsp + 0x662]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x660], di
call fcn.1800be330
lea rcx, [rsp + 0x240]
sub rcx, rbx
movzx eax, word [rbx]
lea rbx, [rbx + 2]
mov word [rcx + rbx - 2], ax
test ax, ax
jne 0x180151521
lea rdx, [rsp + 0x660]
lea rcx, [rsp + 0x240]
call fcn.18000f880
lea rcx, [rsp + 0x452]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x450], di
call fcn.1800be330
lea r8, [rsi + 0xa0]
cmp qword [r8 + 0x18], 8
jb 0x180151575
mov r8, qword [r8]
lea r9, str.dict.conf
lea rdx, [0x1801eb788]
lea rcx, [rsp + 0x450]
call fcn.1800b5a54
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], di
call fcn.1800be330
lea rax, [rsp + 0x450]
lea rbx, str.default
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x660]
lea rcx, [0x1801e1d38]
mov r8, rbx
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rax, rdi
lea rdx, [rsp + 0x30]
nop dword [rax + rax]
movzx ecx, word [rdx + rax*2]
inc rax
cmp cx, word [rbx + rax*2 - 2]
jne 0x180151608
cmp rax, 8
jne 0x1801515f0
xor eax, eax
jmp 0x18015163f
cmp word [rsp + 0x30], di
je 0x18015162a
lea rax, [rsp + 0x30]
or rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x180151620
lea rdx, [rsp + 0x30]
mov r8, rdi
mov rcx, rbp
call fcn.180005450
mov eax, 1
mov rdi, qword [rsp + 0x8a8]
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x880
pop rsi
pop rbp
pop rbx
ret
Function at 0x1801530b0
Capabilities:
Get file size

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xb0
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rbx, rdx
mov rdi, rcx
add rcx, 0x18
xor edx, edx
mov r8d, 0x208
call fcn.1800be330
xor esi, esi
mov dword [rdi + 0x220], esi
lea rcx, [rsp + 0x50]
call fcn.180001000
nop
mov r8d, 0x10000000
lea rdx, str.Everyone
lea rcx, [rsp + 0x50]
call fcn.1800010d0
mov r8d, 0x10000000
lea rdx, str.ALL_APPLICATION_PACKAGES
lea rcx, [rsp + 0x50]
call fcn.1800010d0
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rsi + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18015318b
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rdi + 0x220], eax
sub rdi, rbx
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rdi + rbx + 0x18], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x180153170
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x50]
call fcn.180001050
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1801531c0
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov rax, rsp
push r14
sub rsp, 0xb0
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r14, r8
mov rbx, rdx
mov rsi, rcx
call fcn.1801530b0
mov r8, r14
mov edx, 1
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov qword [rsi + 8], rax
xor edi, edi
test rax, rax
je 0x18015323d
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x10], rax
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
je 0x18015323d
lea eax, [rdi + 1]
jmp 0x180153321
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x180153277
xor eax, eax
jmp 0x180153321
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea rcx, [rsp + 0x50]
call fcn.180001000
nop
mov r8d, 0x10000000
lea rdx, str.Everyone
lea rcx, [rsp + 0x50]
call fcn.1800010d0
mov r8d, 0x10000000
lea rdx, str.ALL_APPLICATION_PACKAGES
lea rcx, [rsp + 0x50]
call fcn.1800010d0
lea rcx, [rsp + 0x50]
call fcn.180001860
mov rdx, rax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8d, [r9 + 2]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsi + 8], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x10], rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsi + 0x10], 0
setne dil
lea rcx, [rsp + 0x50]
call fcn.180001050
mov eax, edi
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x180153490
Capabilities:
Delete file
Get common file path

Disassembly:
push rdi
sub rsp, 0x240
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp dword [rcx + 0x288], 0
mov rdi, rcx
je 0x180153544
mov qword [rsp + 0x258], rbx
lea rcx, [rsp + 0x22]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], bx
call fcn.1800be330
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp word [rsp + 0x20], bx
je 0x18015350a
lea rax, [rsp + 0x20]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180153500
add rdi, 0x290
lea rdx, [rsp + 0x20]
mov r9, rbx
mov rcx, rdi
xor r8d, r8d
call fcn.1800128a0
mov rbx, qword [rsp + 0x258]
test rax, rax
jne 0x180153544
cmp qword [rdi + 0x18], 8
jb 0x18015353b
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x240
pop rdi
ret
Function at 0x180153ba0
Capabilities:
Check if file exists

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x2a0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rdx, r8
lea rcx, str.LoadCopy_DictName___s
call fcn.18001a790
test rbx, rbx
je 0x180153d16
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180153d16
mov qword [rsp + 0x70], 7
xor r14d, r14d
mov qword [rsp + 0x68], r14
mov word [rsp + 0x58], r14w
lea r8, [rsp + 0x58]
mov rdx, rdi
mov rcx, rbx
call fcn.180158480
test eax, eax
jne 0x180153c2e
mov ebx, r14d
jmp 0x180153d00
mov edx, 0x3e8
mov ecx, 0xa
call fcn.18000dc90
mov ebp, eax
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
lea r9, [rsp + 0x38]
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call fcn.180158280
test eax, eax
je 0x180153cd7
mov dword [rsp + 0x20], ebp
mov r9, rdi
lea r8, str.WanNengWBInput
lea rdx, str._s_s_Copy_d
lea rcx, [rsp + 0x80]
call fcn.1800b5a54
lea rbx, [rsi + 0x290]
lea rax, [rsp + 0x38]
cmp rbx, rax
je 0x180153cb1
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.180005100
cmp qword [rbx + 0x18], 8
jb 0x180153cbb
mov rbx, qword [rbx]
lea r8, [rsp + 0x80]
mov rdx, rbx
mov rcx, rsi
call fcn.180153d40
test eax, eax
mov ebx, 1
jne 0x180153cda
mov ebx, r14d
cmp qword [rsp + 0x50], 8
jb 0x180153cec
mov rcx, qword [rsp + 0x38]
call fcn.1800b5354
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
cmp qword [rsp + 0x70], 8
jb 0x180153d12
mov rcx, qword [rsp + 0x58]
call fcn.1800b5354
mov eax, ebx
jmp 0x180153d18
xor eax, eax
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x2a0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180154a59
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rcx, rdx
je 0x180154be3
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r15, r8
mov r12, rdx
mov rbp, rcx
lea rsi, [rcx + 0x28]
cmp rsi, rdx
je 0x180154bbf
lea r14, [rsi - 0x28]
xor r13d, r13d
nop word [rax + rax]
mov rdi, rsi
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], r13
mov word [rsp + 0x28], r13w
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.180005100
movzx eax, word [r14 + 0x48]
mov word [rsp + 0x48], ax
mov rdx, rbp
lea rcx, [rsp + 0x28]
call r15
test al, al
je 0x180154b2c
lea r8, [r14 + 0x50]
mov rdx, rsi
mov rcx, rbp
call fcn.180154fc0
lea rax, [rsp + 0x28]
cmp rbp, rax
je 0x180154b21
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x28]
mov rcx, rbp
call fcn.180005100
movzx eax, word [rsp + 0x48]
mov word [rbp + 0x20], ax
jmp 0x180154b9c
mov rbx, r14
mov rdx, r14
lea rcx, [rsp + 0x28]
call r15
test al, al
je 0x180154b75
nop
cmp rdi, rbx
je 0x180154b57
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.180005100
movzx eax, word [rbx + 0x20]
mov word [rdi + 0x20], ax
mov rdi, rbx
sub rbx, 0x28
mov rdx, rbx
lea rcx, [rsp + 0x28]
call r15
test al, al
jne 0x180154b40
lea rax, [rsp + 0x28]
cmp rdi, rax
je 0x180154b93
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.180005100
movzx eax, word [rsp + 0x48]
mov word [rdi + 0x20], ax
cmp qword [rsp + 0x40], 8
jb 0x180154bae
mov rcx, qword [rsp + 0x28]
call fcn.1800b5354
add rsi, 0x28
add r14, 0x28
cmp rsi, r12
jne 0x180154ab0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800b5370
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
repz ret
Function at 0x180157e60
Capabilities:
Check if file exists

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x180], rbx
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x48], rdx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180157ebc
cmp qword [rdi + 0x18], 8
jb 0x180157eb3
mov rcx, qword [rdi]
call fcn.1800b5354
xor ebx, ebx
xor eax, eax
jmp 0x180158097
mov qword [rbp - 0x38], 7
xor ebx, ebx
mov qword [rbp - 0x40], rbx
mov word [rbp - 0x50], bx
cmp word [rsi], bx
jne 0x180157ed8
mov r8d, ebx
jmp 0x180157eea
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rsi + r8*2], bx
jne 0x180157ee0
mov rdx, rsi
lea rcx, [rbp - 0x50]
call fcn.180005450
nop
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x70]
call fcn.18000fc80
nop
cmp qword [rbp - 0x38], 8
jb 0x180157f15
mov rcx, qword [rbp - 0x50]
call fcn.1800b5354
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], rbx
mov word [rbp - 0x50], bx
lea rcx, [rbp - 0x30]
call fcn.1801595b0
mov qword [rsp + 0x38], 0xf
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x20], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x20]
call fcn.18000c150
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x30]
call fcn.1801595e0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.18000fb80
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
cmp qword [rdi + 0x18], 8
jb 0x180157f96
mov rcx, qword [rdi]
jmp 0x180157f99
mov rcx, rdi
call fcn.1800b9e44
test eax, eax
je 0x18015801c
cmp qword [rsp + 0x68], 8
jb 0x180157fb4
mov rcx, qword [rsp + 0x50]
call fcn.1800b5354
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
cmp qword [rbp - 0x78], 0x10
jb 0x180157fd8
mov rcx, qword [rsp + 0x70]
call fcn.1800b5354
mov qword [rbp - 0x78], 0xf
mov qword [rbp - 0x80], rbx
mov byte [rsp + 0x70], 0
cmp qword [rbp - 0x58], 0x10
jb 0x180157ff9
mov rcx, qword [rbp - 0x70]
call fcn.1800b5354
mov qword [rbp - 0x58], 0xf
mov qword [rbp - 0x60], rbx
mov byte [rbp - 0x70], 0
cmp qword [rdi + 0x18], 8
jb 0x180158018
mov rcx, qword [rdi]
call fcn.1800b5354
xor eax, eax
jmp 0x180158097
cmp qword [rsp + 0x68], 8
jb 0x18015802e
mov rcx, qword [rsp + 0x50]
call fcn.1800b5354
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
cmp qword [rbp - 0x78], 0x10
jb 0x180158052
mov rcx, qword [rsp + 0x70]
call fcn.1800b5354
mov qword [rbp - 0x78], 0xf
mov qword [rbp - 0x80], rbx
mov byte [rsp + 0x70], 0
cmp qword [rbp - 0x58], 0x10
jb 0x180158073
mov rcx, qword [rbp - 0x70]
call fcn.1800b5354
mov qword [rbp - 0x58], 0xf
mov qword [rbp - 0x60], rbx
mov byte [rbp - 0x70], 0
cmp qword [rdi + 0x18], 8
jb 0x180158092
mov rcx, qword [rdi]
call fcn.1800b5354
mov eax, 1
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
mov word [rdi], bx
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1800b5370
mov rbx, qword [rsp + 0x180]
add rsp, 0x150
pop rdi
pop rsi
pop rbp
ret
Function at 0x180158280
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x5c8]
sub rsp, 0x6c8
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rbp + 0x5b0], rax
mov r15, r9
mov r14d, r8d
mov rdi, rdx
mov rsi, rcx
test rcx, rcx
je 0x180158455
test rdx, rdx
je 0x180158455
xor ebx, ebx
mov word [rbp + 0x3a0], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x3a2]
call fcn.1800be330
lea rdx, [rbp + 0x3a0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov word [rbp + 0x190], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x192]
call fcn.1800be330
mov r9, rdi
mov r8, rsi
lea rdx, [0x1801eb788]
lea rcx, [rbp + 0x190]
call fcn.1800b5a54
lea rcx, [rbp + 0x190]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180158455
mov word [rbp - 0x80], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp - 0x7e]
call fcn.1800be330
mov qword [rsp + 0x20], rdi
mov r9d, r14d
lea r8, [rbp + 0x3a0]
lea rdx, str._s_d__s
lea rcx, [rbp - 0x80]
call fcn.1800b5a54
lea rcx, [rbp - 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180158394
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x180158455
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rbx
mov word [rsp + 0x58], bx
lea r8, [rsp + 0x58]
mov rdx, rdi
mov rcx, rsi
call fcn.180158480
test eax, eax
je 0x18015843f
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x30]
call fcn.180005100
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x80]
call fcn.180157e60
test eax, eax
je 0x18015843f
cmp word [rbp - 0x80], 0
je 0x18015842b
lea rax, [rbp - 0x80]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180158421
mov r8, rbx
lea rdx, [rbp - 0x80]
mov rcx, r15
call fcn.180005450
mov ebx, 1
cmp qword [rsp + 0x70], 8
jb 0x180158451
mov rcx, qword [rsp + 0x58]
call fcn.1800b5354
mov eax, ebx
jmp 0x180158457
xor eax, eax
mov rcx, qword [rbp + 0x5b0]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x6c8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180158480
Capabilities:
Read .ini file

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
test rcx, rcx
je 0x1801585c1
test rdx, rdx
je 0x1801585c1
mov qword [rsp + 0x498], rbx
lea rcx, [rsp + 0x242]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x240], bx
call fcn.1800be330
lea r9, str.dict.conf
lea rdx, [0x1801eb788]
lea rcx, [rsp + 0x240]
mov r8, rsi
call fcn.1800b5a54
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], bx
call fcn.1800be330
lea rax, [rsp + 0x240]
lea rsi, str.default
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rcx, [0x1801e1d38]
mov r8, rsi
mov rdx, rdi
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, ebx
lea rdx, [rsp + 0x30]
nop
movzx ecx, word [rdx + rax*2]
inc rax
cmp cx, word [rsi + rax*2 - 2]
jne 0x180158589
cmp rax, 8
jne 0x180158550
xor eax, eax
mov rbx, qword [rsp + 0x498]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x460
pop rdi
pop rsi
pop rbp
ret
cmp word [rsp + 0x30], bx
je 0x1801585aa
lea rax, [rsp + 0x30]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1801585a0
lea rdx, [rsp + 0x30]
mov r8, rbx
mov rcx, rbp
call fcn.180005450
mov eax, 1
jmp 0x180158566
mov eax, 1
jmp 0x18015856e