joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18006b280
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rdx
mov rbx, rcx
mov dword [rcx + 0xb8], 1
lea rdx, [0x1801f3ee0]
add rcx, 0x58
xor r8d, r8d
call fcn.180005450
xor ebp, ebp
cmp dword [rbx + 0x88], ebp
jne 0x18006b2d7
mov edi, 1
mov dword [rbx], edi
jmp 0x18006b307
lea rcx, [rbx + 0x78]
lea r9, str.default
xor edx, edx
mov r8, qword [rcx + 0x10]
mov qword [rsp + 0x20], 7
call fcn.18000a270
test eax, eax
jne 0x18006b303
mov edi, 1
mov dword [rbx], edi
jmp 0x18006b307
mov edi, ebp
mov dword [rbx], ebp
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], bp
call fcn.1800be330
cmp dword [rbx + 0xc], ebp
je 0x18006b369
test edi, edi
lea rdi, [rbx + 0x18]
mov dword [rbx], ebp
cmp qword [rdi + 0x18], 8
jb 0x18006b337
mov r8, qword [rdi]
jmp 0x18006b33a
mov r8, rdi
lea rdx, str._sTempSkinSkin.xml
lea rcx, [rsp + 0x30]
call fcn.1800b5a54
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18006b388
cmp qword [rdi + 0x18], 8
jb 0x18006b364
mov rdi, qword [rdi]
mov r8, rdi
jmp 0x18006b377
cmp qword [rbx + 0x30], 8
lea r8, [rbx + 0x18]
jb 0x18006b377
mov r8, qword [r8]
lea rdx, str._sSkinSkin.xml
lea rcx, [rsp + 0x30]
call fcn.1800b5a54
cmp dword [rbx], ebp
jne 0x18006b497
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18006b497
mov rcx, qword [0x180278788]
mov dword [rbx], 1
lea rdi, vtable.CShareConfigManager.0
test rcx, rcx
jne 0x18006b3db
lea ecx, [rax + 8]
call fcn.1800b543c
mov rcx, rax
test rax, rax
je 0x18006b3d1
mov qword [rax], rdi
jmp 0x18006b3d4
mov rcx, rbp
mov qword [0x180278788], rcx
mov rax, qword [rcx]
xor r8d, r8d
lea edx, [r8 + 0x5a]
call qword [rax + 0x18]
mov rcx, qword [0x180278788]
test rcx, rcx
jne 0x18006b415
mov ecx, 8
call fcn.1800b543c
mov rcx, rax
test rax, rax
je 0x18006b40b
mov qword [rax], rdi
jmp 0x18006b40e
mov rcx, rbp
mov qword [0x180278788], rcx
mov rax, qword [rcx]
lea r8, str.default
mov edx, 0xa2
call qword [rax + 0x10]
mov rcx, qword [0x180278788]
test rcx, rcx
jne 0x18006b454
mov ecx, 8
call fcn.1800b543c
mov rcx, rax
test rax, rax
je 0x18006b44a
mov qword [rax], rdi
jmp 0x18006b44d
mov rcx, rbp
mov qword [0x180278788], rcx
mov rax, qword [rcx]
mov edx, 0x5a
call qword [rax + 0x28]
mov rcx, qword [0x180278788]
test rcx, rcx
jne 0x18006b48c
mov ecx, 8
call fcn.1800b543c
mov rcx, rax
test rax, rax
je 0x18006b482
mov qword [rax], rdi
jmp 0x18006b485
mov rcx, rbp
mov qword [0x180278788], rcx
mov rax, qword [rcx]
mov edx, 0xa2
call qword [rax + 0x28]
mov rcx, rbx
call fcn.18006d1d0
mov rcx, rbx
call fcn.18006d4b0
mov rdx, rsi
mov rcx, rbx
call fcn.18006b4e0
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1800b5370
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret
Function at 0x180075af0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0xe8], 1
mov rbx, rcx
jne 0x180075b4b
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
cmp al, 1
jne 0x180075b1b
mov rcx, rbx
call fcn.18007af80
jmp 0x180075b4b
mov rcx, qword [rbx + 0xc8]
mov edx, 0x7d
mov rax, qword [rcx]
call qword [rax + 0x88]
test eax, eax
jne 0x180075b3e
mov rcx, rbx
call fcn.18007a840
jmp 0x180075b4b
cmp eax, 1
jne 0x180075b4b
mov rcx, rbx
call fcn.18007abe0
cmp byte [rbx + 0xe9], 1
jne 0x180075b7c
mov rcx, qword [rbx + 0xc8]
mov edx, 0x7f
mov rax, qword [rcx]
call qword [rax + 0x88]
mov rcx, rbx
test eax, eax
jne 0x180075b77
call fcn.18007bad0
jmp 0x180075b7c
call fcn.18007bea0
cmp byte [rbx + 0xea], 1
jne 0x180075bad
mov rcx, qword [rbx + 0xc8]
mov edx, 0x80
mov rax, qword [rcx]
call qword [rax + 0x88]
mov rcx, rbx
test eax, eax
jne 0x180075ba8
call fcn.18007b320
jmp 0x180075bad
call fcn.18007b6f0
cmp byte [rbx + 0xed], 1
jne 0x180075c00
mov rcx, qword [rbx + 0xc8]
mov edx, 0x7e
mov rax, qword [rcx]
call qword [rax + 0x88]
test eax, eax
je 0x180075bf3
cmp eax, 1
jne 0x180075be1
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18007c650
cmp eax, 2
jne 0x180075bf3
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18007ca30
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18007c280
add rsp, 0x20
pop rbx
ret
Function at 0x180077d10
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov edi, edx
mov rcx, qword [rcx + 0xc8]
mov rax, qword [rcx]
mov edx, 0xa2
call qword [rax + 0x20]
xor esi, esi
mov ecx, esi
lea r8, str.default
nop dword [rax + rax]
movzx edx, word [rax + rcx*2]
inc rcx
cmp dx, word [r8 + rcx*2 - 2]
jne 0x180077dd6
cmp rcx, 8
jne 0x180077d50
mov rbx, qword [0x180278790]
test rbx, rbx
jne 0x180077da2
mov ecx, 0x260
call fcn.1800b543c
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180077d98
mov rcx, rax
call fcn.180001a60
mov dword [rbx + 0x258], esi
jmp 0x180077d9b
mov rbx, rsi
mov qword [0x180278790], rbx
lea r9, [rbx + 0x168]
cmp qword [r9 + 0x18], 8
jb 0x180077db3
mov r9, qword [r9]
xor r8d, r8d
lea rdx, str.MakeStatusWndShow
lea rcx, str.Setting
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
cmove edi, esi
mov ecx, edi
call fcn.18002f360
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180078780
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rdi, rcx
mov eax, dword [0x1802789ec]
test rdx, rdx
je 0x1800788d6
test eax, eax
jne 0x1800788ba
call fcn.18002a4c0
test al, al
jne 0x1800788ba
mov rbx, qword [0x180278790]
test rbx, rbx
jne 0x1800787ff
mov ecx, 0x260
call fcn.1800b543c
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1800787f6
mov rcx, rax
call fcn.180001a60
mov dword [rbx + 0x258], 0
jmp 0x1800787f8
xor ebx, ebx
mov qword [0x180278790], rbx
lea r8, [rbx + 0x48]
cmp qword [r8 + 0x18], 8
jb 0x18007880d
mov r8, qword [r8]
lea rax, str.vip.conf
mov qword [rsp + 0x20], rax
lea r9, str.Config
lea rdx, str._s_s_s
lea rcx, [0x18027b070]
call fcn.1800b5a54
lea r9, [0x18027b070]
xor r8d, r8d
lea rdx, str.TipRegister
lea rcx, [0x1801f4110]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x1800788ba
mov rcx, qword [0x180278788]
test rcx, rcx
jne 0x180078886
lea ecx, [rax + 8]
call fcn.1800b543c
mov rcx, rax
test rax, rax
je 0x18007887d
lea rax, vtable.CShareConfigManager.0
mov qword [rcx], rax
jmp 0x18007887f
xor ecx, ecx
mov qword [0x180278788], rcx
mov rax, qword [rcx]
mov edx, 0xbb
call qword [rax]
test eax, eax
jg 0x1800788ba
mov edx, 2
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_KillTimer]
xor r9d, r9d
lea edx, [r9 + 2]
mov r8d, 0x1388
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetTimer]
call fcn.180032280
mov rbx, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x180078904
mov edx, 4
jmp 0x1800788fb
test eax, eax
je 0x1800788e4
mov dword [0x1802789ec], 0
call fcn.180032280
mov rbx, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x180078904
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x18007fa00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r9
mov rbx, rdx
mov qword [rsp + 0x48], rdx
mov r15, rcx
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], r9
call fcn.180021500
xor esi, esi
mov rcx, rbx
mov qword [rsp + 0x30], rsi
mov ebp, esi
movaps xmm6, xmm0
call qword [sym.imp.USER32.dll_GetDC]
mov rdx, qword [r15 + 0x50]
mov rcx, rax
mov r13, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [r15 + 0x88]
mov r12d, dword [r15 + 0x6c]
mov rbx, qword [rcx]
mov r14d, esi
cmp rbx, qword [rcx + 8]
je 0x18007fb11
cmp qword [rbx + 0x18], 8
jb 0x18007fa91
mov rdx, qword [rbx]
jmp 0x18007fa94
mov rdx, rbx
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x18007faa0
lea r9, [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov ecx, dword [r15 + 0x68]
mov dword [rbx + 0x24], r12d
mov dword [rbx + 0x20], ecx
add ecx, dword [rsp + 0x30]
mov dword [rbx + 0x28], ecx
mov ecx, dword [rsp + 0x34]
add ecx, r12d
mov dword [rbx + 0x2c], ecx
add ebp, dword [rsp + 0x34]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
addss xmm0, xmm6
cvttss2si r12d, xmm0
test r14d, r14d
jle 0x18007faf0
inc ebp
cmp esi, dword [rsp + 0x30]
mov rax, qword [r15 + 0x88]
cmovl esi, dword [rsp + 0x30]
add rbx, 0x30
inc r14d
cmp rbx, qword [rax + 8]
jne 0x18007fa85
mov r12, qword [rsp + 0x48]
mov rdx, r13
mov rcx, r12
call qword [sym.imp.USER32.dll_ReleaseDC]
mov ebx, dword [r15 + 0x60]
lea r8, [rsp + 0x50]
movd xmm0, esi
movaps xmm2, xmm6
movd xmm1, ebp
mulss xmm2, dword [0x1801fad94]
xor r9d, r9d
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
addss xmm0, xmm2
addss xmm1, xmm2
cvttss2si r14d, xmm0
cvttss2si esi, xmm1
mov eax, r14d
cdq
sub eax, edx
xor edx, edx
sar eax, 1
lea ecx, [rdx + 0x30]
sub ebx, eax
add ebx, edi
mov edi, dword [rsp + 0x3c]
add edi, dword [r15 + 0x64]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, dword [rsp + 0x58]
lea eax, [rbx + r14]
cmp eax, ecx
jle 0x18007fb88
mov ebx, ecx
sub ebx, r14d
lea eax, [rdi + rsi]
cmp eax, dword [rsp + 0x5c]
jle 0x18007fbb5
movd xmm1, dword [rsp + 0x44]
mulss xmm6, dword [0x1801fad88]
movd xmm0, esi
cvtdq2ps xmm1, xmm1
cvtdq2ps xmm0, xmm0
subss xmm1, xmm6
subss xmm1, xmm0
cvttss2si edi, xmm1
mov r9d, r14d
mov r8d, edi
mov edx, ebx
mov rcx, r12
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_MoveWindow]
mov eax, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800b5370
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180086c90
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rcx
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, qword [rbx + 0x18]
cmp al, 1
mov rax, qword [rcx]
jne 0x180086d5e
mov edx, 0x7d
call qword [rax + 0x88]
mov edi, eax
cmp eax, 2
je 0x180086dd1
mov rax, qword [0x1802787a8]
test rax, rax
jne 0x180086d07
mov ecx, 0x138
call fcn.1800b543c
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180086d00
mov rcx, rax
call fcn.180072da0
nop
mov qword [0x1802787a8], rax
mov rcx, rax
call fcn.18007af80
mov rax, qword [0x1802787a8]
test rax, rax
jne 0x180086d3f
mov ecx, 0x138
call fcn.1800b543c
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180086d38
mov rcx, rax
call fcn.180072da0
nop
mov qword [0x1802787a8], rax
mov rcx, rax
call fcn.18007b6f0
mov rcx, qword [rbx + 0x18]
mov rax, qword [rcx]
mov r8d, edi
mov edx, 0x82
call qword [rax + 0x90]
jmp 0x180086dd1
mov edx, 0x5d
call qword [rax]
mov edi, eax
mov rcx, qword [rbx + 0x18]
mov r8, qword [rcx]
mov edx, 0x7d
call qword [r8 + 0x88]
cmp eax, 2
jne 0x180086dd1
mov rcx, qword [rbx + 0x18]
mov r8, qword [rcx]
mov edx, 0x82
call qword [r8 + 0x88]
cmp eax, 1
jne 0x180086db3
call fcn.180008ea0
mov rcx, rax
call fcn.18007abe0
call fcn.180008ea0
mov rcx, rax
call fcn.18007b6f0
jmp 0x180086dd1
call fcn.180008ea0
mov rcx, rax
call fcn.18007a840
call fcn.180008ea0
mov rcx, rax
test edi, edi
jne 0x180086dac
call fcn.18007b320
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180093d70
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rbx, [rcx + 0x138]
mov rdi, rcx
cmp qword [rbx + 0x18], 8
jb 0x180093d90
mov r9, qword [rbx]
jmp 0x180093d93
mov r9, rbx
lea r8, [0x1801ebd7c]
lea rdx, str.ModifySetConfig
lea rcx, str.SetModify
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp qword [rbx + 0x18], 8
jb 0x180093dba
mov r9, qword [rbx]
jmp 0x180093dbd
mov r9, rbx
lea r8, [0x1801ebd7c]
lea rdx, str.ModifySetConfig64
lea rcx, str.SetModify
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp qword [rbx + 0x18], 8
jb 0x180093de4
mov r9, qword [rbx]
jmp 0x180093de7
mov r9, rbx
lea r8, [0x1801ebd7c]
lea rdx, str.TempModifySetConfig
lea rcx, str.SetModify
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp qword [rbx + 0x18], 8
jb 0x180093e0c
mov rbx, qword [rbx]
lea r8, [0x1801ebd7c]
lea rdx, str.TempModifySetConfig64
lea rcx, str.SetModify
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea rdx, [rdi + 0x118]
cmp qword [rdx + 0x18], 8
jb 0x180093e3b
mov rdx, qword [rdx]
lea rcx, [rdi + 0xf8]
cmp qword [rcx + 0x18], 8
jb 0x180093e4c
mov rcx, qword [rcx]
xor r8d, r8d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_CopyFileW]

Function at 0x180093f40
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rcx, [rsp + 0x72]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], bx
call fcn.1800be330
xor eax, eax
lea rdx, [0x1801ebd34]
lea rcx, [rsp + 0x58]
xor r8d, r8d
mov word [rsp + 0x58], bx
mov qword [rsp + 0x5a], rax
mov qword [rsp + 0x62], rax
mov word [rsp + 0x6a], ax
mov word [rsp + 0x40], bx
mov qword [rsp + 0x42], rax
mov qword [rsp + 0x4a], rax
mov word [rsp + 0x52], ax
call fcn.1800b5a54
movzx eax, word [rsp + 0x36]
movzx r9d, word [rsp + 0x32]
movzx r8d, word [rsp + 0x30]
lea rdx, [0x1801f5010]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x20], eax
call fcn.1800b5a54
add rdi, 0x158
cmp qword [rdi + 0x18], 8
jb 0x180093ffd
mov r9, qword [rdi]
jmp 0x180094000
mov r9, rdi
lea rdx, str.LastUseDay
lea rcx, str.Setting
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
movzx ecx, word [rsp + 0x32]
movzx edx, word [rsp + 0x30]
imul edx, edx, 0x64
add edx, ecx
movzx ecx, word [rsp + 0x36]
imul edx, edx, 0x64
add edx, ecx
cmp eax, edx
je 0x180094070
cmp qword [rdi + 0x18], 8
jb 0x18009403e
mov rdi, qword [rdi]
lea r8, [rsp + 0x40]
lea rdx, str.LastUseDay
lea rcx, str.Setting
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea rcx, str.UseDayTotal
movzx eax, word [rbx + rcx]
lea rbx, [rbx + 2]
test ax, ax
jne 0x180094061
nop
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1800b5370
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x290
pop rdi
ret
Function at 0x180094440
Capabilities:
Read .ini file

Disassembly:
push rbx
push r12
push r14
sub rsp, 0x470
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r14, rcx
lea rcx, [rsp + 0x242]
xor r12d, r12d
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x240], r12w
call fcn.1800be330
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], r12w
call fcn.1800be330
mov rax, qword [r14 + 0x40]
mov rcx, qword [rax]
mov rbx, qword [rcx]
cmp rbx, rcx
je 0x18009468b
mov qword [rsp + 0x498], rbp
mov qword [rsp + 0x4a0], rsi
mov qword [rsp + 0x460], r15
lea r15, str.nothing
mov qword [rsp + 0x468], rdi
mov rbp, qword [rbx + 0x28]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbp + rax*2 + 0x18], r12w
jne 0x1800944e0
test eax, eax
jle 0x180094614
lea r8, [rbp + 0x18]
lea rdx, str.Is_s
lea rcx, [rsp + 0x240]
call fcn.1800b5a54
lea rdi, [r14 + 0xf8]
cmp qword [rdi + 0x18], 8
jb 0x18009451e
mov rax, qword [rdi]
jmp 0x180094521
mov rax, rdi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea r8, [0x1801ebba0]
lea rdx, [rsp + 0x240]
lea rcx, str.HotKey
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx eax, word [rsp + 0x30]
cmp ax, word [0x1801ebba0]
jne 0x180094579
movzx eax, word [rsp + 0x32]
cmp ax, word [0x1801ebba2]
jne 0x180094579
movzx eax, word [rsp + 0x34]
cmp ax, word [0x1801ebba4]
je 0x180094589
lea rcx, [rsp + 0x30]
call fcn.1800baa0c
mov rcx, qword [rbp + 8]
mov byte [rcx], al
lea r8, [rbp + 0x18]
lea rdx, str.Use_s
lea rcx, [rsp + 0x240]
call fcn.1800b5a54
cmp qword [rdi + 0x18], 8
jb 0x1800945ab
mov rdi, qword [rdi]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x240]
lea rcx, str.HotKey
mov r8, r15
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rcx, r12
lea rdx, [rsp + 0x30]
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r15 + rcx*2 - 2]
jne 0x1800945f7
cmp rcx, 8
jne 0x1800945e0
jmp 0x180094614
mov rdx, qword [rbp + 0x10]
lea rcx, [rsp + 0x30]
movzx eax, word [rcx]
lea rdx, [rdx + 2]
lea rcx, [rcx + 2]
mov word [rdx - 2], ax
test ax, ax
jne 0x180094600
cmp byte [rbx + 0x19], r12b
jne 0x18009465e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], r12b
jne 0x18009463e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r12b
jne 0x18009465e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r12b
je 0x180094630
jmp 0x18009465e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], r12b
jne 0x18009465b
cmp rbx, qword [rax + 0x10]
jne 0x18009465b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], r12b
je 0x180094648
mov rbx, rax
mov rax, qword [r14 + 0x40]
cmp rbx, qword [rax]
jne 0x1800944d5
mov r15, qword [rsp + 0x460]
mov rdi, qword [rsp + 0x468]
mov rsi, qword [rsp + 0x4a0]
mov rbp, qword [rsp + 0x498]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x470
pop r14
pop r12
pop rbx
ret
Function at 0x18009c160
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov rbp, r8
mov r14d, edx
mov rsi, rcx
call fcn.18009ccd0
mov rbx, rax
lea rdi, [rsi - 0x20]
mov qword [rax + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0x28], eax
mov dword [rbx + 0x18], 0
mov rcx, qword [0x180278788]
test rcx, rcx
jne 0x18009c1d8
mov ecx, 8
call fcn.1800b543c
mov rcx, rax
test rax, rax
je 0x18009c1cf
lea rax, vtable.CShareConfigManager.0
mov qword [rcx], rax
jmp 0x18009c1d1
xor ecx, ecx
mov qword [0x180278788], rcx
mov rax, qword [rcx]
mov edx, 0x84
call qword [rax + 0x88]
mov ebx, eax
mov rax, qword [0x18027b380]
test rax, rax
jne 0x18009c216
lea ecx, [rax + 0x40]
call fcn.1800b543c
mov qword [rsp + 0x50], rax
test rax, rax
je 0x18009c20f
mov rcx, rax
call fcn.1800a07f0
nop
mov qword [0x18027b380], rax
cmp dword [rax + 0x34], 0
je 0x18009c24b
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x18009c2e1
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x18009c2e1
mov rax, qword [0x18027b380]
test ebx, ebx
jne 0x18009c2e1
test rax, rax
jne 0x18009c27a
lea ecx, [rbx + 0x40]
call fcn.1800b543c
mov qword [rsp + 0x50], rax
test rax, rax
je 0x18009c273
mov rcx, rax
call fcn.1800a07f0
nop
mov qword [0x18027b380], rax
cmp dword [rax + 0x30], 0
je 0x18009c2ab
call fcn.180031080
call fcn.18009fd30
mov ebx, eax
call fcn.180031080
call fcn.18009fe50
test ebx, ebx
jne 0x18009c2e1
test eax, eax
jne 0x18009c2e1
call fcn.18002b350
cmp dword [rax + 0xe8], ebx
jne 0x18009c2e1
mov r8, rbp
mov edx, r14d
call fcn.18009cb80
mov rbx, qword [rsi + 0xa0]
test rbx, rbx
je 0x18009c2cb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, rdi
call fcn.1800ae550
test rbx, rbx
je 0x18009c2e1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x18009ddd0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov rsi, qword [0x18027b288]
xor ebp, ebp
mov rbx, rcx
test rsi, rsi
je 0x18009de2c
mov qword [rsp + 0x38], rdi
mov rdi, qword [0x180278798]
test rdi, rdi
je 0x18009de18
mov rcx, rdi
call fcn.1800a40d0
mov rcx, rdi
call fcn.1800b5354
mov qword [0x180278798], rbp
mov rcx, rsi
call fcn.1800b5354
mov rdi, qword [rsp + 0x38]
mov qword [0x18027b288], rbp
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], ebp
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rbp
mov rbp, qword [rsp + 0x48]
lea rax, vtable.CDBSystemEventHandler.0
mov qword [rbx + 0x10], rax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x18009ecf0
Capabilities:
Read .ini file

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
call fcn.180001fd0
mov qword [rsp + 0x40], 7
xor eax, eax
mov qword [rsp + 0x38], rax
mov word [rsp + 0x28], ax
lea rdx, [rbx + 0xc8]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x28]
call fcn.180005100
nop
mov r8d, 0x11
lea rdx, str.WanNengWBInfo.ini
lea rcx, [rsp + 0x28]
call fcn.180004d10
lea r9, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae r9, qword [rsp + 0x28]
xor r8d, r8d
lea rdx, str.ActivityMode
lea rcx, str.AppInfo
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rbx + 0x258], eax
cmp qword [rsp + 0x40], 8
jb 0x18009ed9b
mov rcx, qword [rsp + 0x28]
call fcn.1800b5354
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x50
pop rbx
ret
Function at 0x1800a8570
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x160
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x178], rbx
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, r9
mov rbx, rcx
mov dword [rcx + 0xc8], edx
mov qword [rcx + 0xc0], r8
cmp qword [rcx + 0xa8], 0
jne 0x1800a85f6
lea rdx, [0x180276784]
mov ecx, 0x90
call fcn.1800bcbf4
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1800a85e0
mov rdx, rbx
mov rcx, rax
call fcn.18009a970
nop
mov qword [rbx + 0xa8], rax
test rax, rax
jne 0x1800a85f6
mov eax, 0x8007000e
jmp 0x1800a86b2
mov byte [rsp + 0x50], 0
xor edx, edx
mov r8d, 0xff
lea rcx, [rsp + 0x51]
call fcn.1800be330
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov rax, qword [rsp + 0x190]
shr rax, 0x10
movzx edx, ax
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
mov ecx, edi
call qword [sym.imp.USER32.dll_ToAscii]
cmp eax, 1
jne 0x1800a8656
movzx eax, word [rsp + 0x30]
movzx eax, al
shl eax, 0x10
cdqe
or rdi, rax
cmp qword [0x180278750], 0
jne 0x1800a8671
mov ecx, 1
call fcn.1800b543c
mov qword [0x180278750], rax
mov rax, qword [0x18027b278]
test rax, rax
jne 0x1800a86a1
mov ecx, 0x358
call fcn.1800b543c
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1800a869a
mov rcx, rax
call fcn.18003a340
nop
mov qword [0x18027b278], rax
lea r9, [rsp + 0x50]
mov edx, edi
mov rcx, rax
call fcn.18003c460
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800b5370
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret