joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802054b0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x7c0]
sub rsp, 0x8c0
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.180233580
xor edx, edx
mov dword [rsp + 0x70], 0x68
lea rcx, [rsp + 0x58]
lea r8d, [rdx + 0x18]
call fcn.180233580
mov r8, rbx
lea rdx, [0x1802abd74]
lea rcx, [rbp - 0x20]
call fcn.18005c530
xor ebx, ebx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x20]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rbx
xor ecx, ecx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x18020558a
mov rcx, qword [rsp + 0x58]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x8d8]
add rsp, 0x8c0
pop rbp
ret
Function at 0x180205948
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1f8]
sub rsp, 0x2e0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rsi, rcx
xor ebx, ebx
mov edi, ebx
mov dword [rsp + 0x20], ebx
test rcx, rcx
jne 0x180205996
xor eax, eax
jmp 0x180205b0a
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
cmp word [rcx], bx
jne 0x1802059b3
mov rax, rbx
jmp 0x1802059b8
call fcn.1802547d0
mov r8, rax
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.18005c660
nop
lea rcx, [rsp + 0x50]
call fcn.18006d350
mov r14d, 0x238
mov r8d, r14d
xor edx, edx
lea rcx, [rbp - 0x70]
call fcn.180233580
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180205af9
mov dword [rbp - 0x70], r14d
lea rdx, [rbp - 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180205aef
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
cmp word [rbp - 0x44], bx
jne 0x180205a34
mov rax, rbx
jmp 0x180205a3d
lea rcx, [rbp - 0x44]
call fcn.1802547d0
mov r8, rax
lea rdx, [rbp - 0x44]
lea rcx, [rsp + 0x30]
call fcn.18005c660
nop
lea rcx, [rsp + 0x30]
call fcn.18006d350
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.180060170
test al, al
jne 0x180205a92
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.18006d6b0
or edi, 1
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.180060170
test al, al
mov r14b, bl
je 0x180205a95
mov r14b, 1
test dil, 1
je 0x180205aad
and edi, 0xfffffffe
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x70]
call fcn.18005cb40
test r14b, r14b
jne 0x180205ad2
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.18005cb40
lea rdx, [rbp - 0x70]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
jmp 0x180205a0e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp - 0x68]
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.18005cb40
jmp 0x180205af9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x50]
call fcn.18005cb40
mov eax, ebx
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180206064
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1f8]
sub rsp, 0x2e0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rsi, rcx
xor ebx, ebx
mov edi, ebx
mov dword [rsp + 0x20], ebx
test rcx, rcx
jne 0x1802060b2
xor eax, eax
jmp 0x180206226
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
cmp word [rcx], bx
jne 0x1802060cf
mov rax, rbx
jmp 0x1802060d4
call fcn.1802547d0
mov r8, rax
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.18005c660
nop
lea rcx, [rsp + 0x50]
call fcn.180206cbc
mov r14d, 0x238
mov r8d, r14d
xor edx, edx
lea rcx, [rbp - 0x70]
call fcn.180233580
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180206215
mov dword [rbp - 0x70], r14d
lea rdx, [rbp - 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x18020620b
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
cmp word [rbp - 0x44], bx
jne 0x180206150
mov rax, rbx
jmp 0x180206159
lea rcx, [rbp - 0x44]
call fcn.1802547d0
mov r8, rax
lea rdx, [rbp - 0x44]
lea rcx, [rsp + 0x30]
call fcn.18005c660
nop
lea rcx, [rsp + 0x30]
call fcn.180206cbc
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.180060170
test al, al
jne 0x1802061ae
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.1802067ec
or edi, 1
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.180060170
test al, al
mov r14b, bl
je 0x1802061b1
mov r14b, 1
test dil, 1
je 0x1802061c9
and edi, 0xfffffffe
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x70]
call fcn.18005cb40
test r14b, r14b
jne 0x1802061ee
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.18005cb40
lea rdx, [rbp - 0x70]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
jmp 0x18020612a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp - 0x68]
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.18005cb40
jmp 0x180206215
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x50]
call fcn.18005cb40
mov eax, ebx
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180206438
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x1c8]
sub rsp, 0x2c0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rdi, rcx
xor ebx, ebx
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x70]
call fcn.180233580
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
cmp word [rdi], bx
jne 0x18020649f
mov eax, ebx
jmp 0x1802064a7
mov rcx, rdi
call fcn.1802547d0
mov r8, rax
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.18005c660
nop
lea rcx, [rsp + 0x48]
call fcn.180206cbc
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180206588
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x18020657e
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x28], bx
cmp word [rbp - 0x64], bx
jne 0x180206514
mov rax, rbx
jmp 0x18020651d
lea rcx, [rbp - 0x64]
call fcn.1802547d0
mov r8, rax
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x28]
call fcn.18005c660
nop
lea rcx, [rsp + 0x28]
call fcn.180206cbc
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.180060170
test al, al
jne 0x18020656a
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x28]
call fcn.18005cb40
lea rdx, [rsp + 0x70]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
jmp 0x1802064ee
mov ebx, 1
xor r8d, r8d
mov dl, bl
lea rcx, [rsp + 0x28]
call fcn.18005cb40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.18005cb40
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18020669c
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx], rax
test rax, rax
jne 0x1802066c1
xor eax, eax
jmp 0x18020676d
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.IsWow64Process
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.Wow64DisableWow64FsRedirection
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.Wow64RevertWow64FsRedirection
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.GetSystemWow64DirectoryW
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.advapi32.dll
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 8], rax
test rax, rax
je 0x1802066ba
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
lea rdx, str.Wow64RevertWow64FsRedirection
mov qword [rbx + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x38], rax
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x180208380
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x350], rax
xor r9d, r9d
mov rbx, rdx
lea rdx, [rsp + 0x30]
xor ecx, ecx
lea r8d, [r9 + 0x2c]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, [0x1802abc78]
lea rcx, [rsp + 0x30]
call fcn.180254ad8
lea rdx, str.WanNengWBInput
lea rcx, [rsp + 0x30]
call fcn.180254ad8
lea rdx, [0x1802abc78]
lea rcx, [rsp + 0x30]
call fcn.180254ad8
lea rdx, [0x1802abf08]
lea rcx, [rsp + 0x30]
call fcn.180254ad8
lea rdx, str..ini
lea rcx, [rsp + 0x30]
call fcn.180254ad8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x140]
lea r8, [0x1802abc2c]
mov dword [rsp + 0x20], 0x104
lea rdx, str.InstallPath
lea rcx, str.Globals
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rbp + 0x140]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor r8d, r8d
test eax, eax
je 0x180208484
cmp word [rbp + 0x140], r8w
je 0x180208473
lea rcx, [rbp + 0x140]
call fcn.1802547d0
mov r8, rax
lea rdx, [rbp + 0x140]
mov rcx, rbx
call fcn.18005c660
mov al, 1
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x470]
add rsp, 0x460
pop rbp
ret

Function at 0x1802084a4
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x1b8]
sub rsp, 0x2b0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, rdx
mov qword [rsp + 0x60], 7
xor ebx, ebx
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
lea rdx, [rsp + 0x48]
call fcn.180208380
test al, al
je 0x1802085ad
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x70]
call fcn.180233580
lea r8, [rbp - 0x70]
lea rdx, str.Version
lea rcx, [0x1802abf08]
call fcn.18006a7c0
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call fcn.180065eb0
nop
lea r8, [0x1802abc78]
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.18006db50
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x68]
call fcn.18005cb40
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18020859d
lea rax, [rsp + 0x28]
cmp rdi, rax
je 0x18020859b
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.18005cbe0
mov bl, 1
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x28]
call fcn.18005cb40
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.18005cb40
mov al, bl
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1802088fc
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
xor eax, eax
mov qword [rbp - 0x48], 7
mov rbx, r8
mov rdi, rdx
mov qword [rbp - 0x50], rax
mov word [rbp - 0x60], ax
cmp word [r8], ax
je 0x180208937
mov rcx, rbx
call fcn.1802547d0
mov r8, rax
lea rcx, [rbp - 0x60]
mov rdx, rbx
call fcn.18005c660
lea rcx, [rbp - 0x60]
call fcn.1800676d0
xor edx, edx
lea rcx, [rbp - 0x40]
lea r8d, [rdx + 0x38]
call fcn.180233580
mov eax, 0x614
mov qword [rbp - 0x30], rdi
lea rcx, [rbp - 0x40]
mov word [rbp - 0x20], ax
mov qword [rbp - 0x28], rbx
mov dword [rbp - 0x38], 2
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x180208998
Capabilities:
Check if file exists
Create directory

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x388]
sub rsp, 0x480
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov rbx, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x160]
call fcn.180233580
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.180233580
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.180209530
nop
lea r8, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae r8, qword [rsp + 0x28]
lea r9, str.Dict
lea rdx, [0x1802abd18]
lea rcx, [rbp + 0x160]
call fcn.18005c530
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.1802547b4
lea rdx, str.BackMB
lea rcx, [rsp + 0x50]
call fcn.180254ad8
lea rdx, [0x1802abc78]
lea rcx, [rsp + 0x50]
call fcn.180254ad8
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180208a83
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x160]
mov rcx, rbx
call fcn.1802088fc
call fcn.180208104
mov rcx, rax
call fcn.18020a504
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1802547b4
lea rdx, str.BackMB
lea rcx, [rsp + 0x50]
call fcn.180254ad8
lea rdx, [0x1802abc78]
lea rcx, [rsp + 0x50]
call fcn.180254ad8
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180208aef
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x160]
mov rcx, rbx
call fcn.1802088fc
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x28]
call fcn.18005cb40
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x490]
add rsp, 0x480
pop rbp
ret
jmp 0x180208998
Function at 0x180208b34
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x468
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor edx, edx
lea rcx, [rsp + 0x240]
mov r8d, 0x208
call fcn.180233580
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.180233580
call fcn.180208104
mov rcx, rax
call fcn.18020a518
mov r8, rax
lea rdx, str._sWnAssociation.exe
lea rcx, [rsp + 0x30]
call fcn.18005c530
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180208bdf
lea r9, str.1e19cf
lea r8, [rsp + 0x30]
lea rdx, str.__s___s
lea rcx, [rsp + 0x240]
call fcn.18005c530
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x240]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.180204fd0
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x468
ret

Function at 0x180208bf8
Capabilities:
Check if file exists
Create directory

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x388]
sub rsp, 0x480
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov rbx, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x160]
call fcn.180233580
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.180233580
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.180209530
nop
lea r8, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae r8, qword [rsp + 0x28]
lea r9, str.Dict
lea rdx, [0x1802abd18]
lea rcx, [rbp + 0x160]
call fcn.18005c530
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.1802547b4
lea rdx, str.BackMB
lea rcx, [rsp + 0x50]
call fcn.180254ad8
lea rdx, [0x1802abc78]
lea rcx, [rsp + 0x50]
call fcn.180254ad8
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180208a83
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x160]
mov rcx, rbx
call fcn.1802088fc
call fcn.180208104
mov rcx, rax
call fcn.18020a504
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1802547b4
lea rdx, str.BackMB
lea rcx, [rsp + 0x50]
call fcn.180254ad8
lea rdx, [0x1802abc78]
lea rcx, [rsp + 0x50]
call fcn.180254ad8
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180208aef
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x160]
mov rcx, rbx
call fcn.1802088fc
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x28]
call fcn.18005cb40
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x490]
add rsp, 0x480
pop rbp
ret
jmp 0x180208998
Function at 0x180208c00
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x468
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor edx, edx
lea rcx, [rsp + 0x240]
mov r8d, 0x208
call fcn.180233580
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.180233580
call fcn.180208104
mov rcx, rax
call fcn.18020a518
mov rdx, rax
lea rcx, [rsp + 0x240]
call fcn.1802547b4
lea rdx, str.WnWizard.exe
lea rcx, [rsp + 0x240]
call fcn.180254ad8
lea rdx, [0x1802ad5fc]
lea rcx, [rsp + 0x30]
call fcn.1802547b4
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
call fcn.180254ad8
lea rdx, [0x1802ad5fc]
lea rcx, [rsp + 0x30]
call fcn.180254ad8
lea rdx, str._RunAutoLoadDict
lea rcx, [rsp + 0x30]
call fcn.180254ad8
lea rcx, [rsp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180208ce0
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.180204fd0
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x468
ret
jmp 0x180208c00

Function at 0x180208dd8
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x468
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor edx, edx
lea rcx, [rsp + 0x240]
mov r8d, 0x208
call fcn.180233580
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.180233580
call fcn.180208104
mov rcx, rax
call fcn.18020a518
mov rdx, rax
lea rcx, [rsp + 0x240]
call fcn.1802547b4
lea rdx, str.WnWizard.exe
lea rcx, [rsp + 0x240]
call fcn.180254ad8
lea rdx, [0x1802ad5fc]
lea rcx, [rsp + 0x30]
call fcn.1802547b4
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
call fcn.180254ad8
lea rdx, [0x1802ad5fc]
lea rcx, [rsp + 0x30]
call fcn.180254ad8
lea rdx, str._RunAutoLoadDict
lea rcx, [rsp + 0x30]
call fcn.180254ad8
lea rcx, [rsp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180208ce0
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.180204fd0
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x468
ret
jmp 0x180208c00

Function at 0x180208de0
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x468
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor edx, edx
lea rcx, [rsp + 0x240]
mov r8d, 0x208
call fcn.180233580
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.180233580
call fcn.180208104
mov rcx, rax
call fcn.18020a518
mov rdx, rax
lea rcx, [rsp + 0x240]
call fcn.1802547b4
lea rdx, str.WnDictManager.exe
lea rcx, [rsp + 0x240]
call fcn.180254ad8
lea rdx, [0x1802ad5fc]
lea rcx, [rsp + 0x30]
call fcn.1802547b4
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
call fcn.180254ad8
lea rdx, [0x1802ad5fc]
lea rcx, [rsp + 0x30]
call fcn.180254ad8
lea rdx, str._CheckSysMb
lea rcx, [rsp + 0x30]
call fcn.180254ad8
lea rcx, [rsp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180208ec0
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.180204fd0
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x468
ret
Function at 0x180208ed8
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f8]
sub rsp, 0x6f0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x5e0], rax
lea rcx, str.DoRunRegImeInterFace
call fcn.180207ab4
lea rcx, [rsp + 0x40]
call fcn.1802065c0
nop
lea rcx, [rsp + 0x40]
call fcn.18020663c
xor esi, esi
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], rsi
mov word [rbp - 0x70], si
test eax, eax
je 0x180208f97
lea rcx, str.WnRegIme64.exe
call fcn.1802547d0
mov r8, rax
lea rdx, str.WnRegIme64.exe
lea rcx, [rbp - 0x70]
call fcn.18005c660
nop
lea rbx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rbx, qword [rbp - 0x70]
call fcn.180208104
mov rcx, rax
call fcn.18020a518
mov r8, rax
mov r9, rbx
lea rdx, [0x1802abef8]
lea rcx, [rbp - 0x50]
call fcn.18005c530
nop
jmp 0x180208fe9
lea rcx, str.WnRegIme32.exe
call fcn.1802547d0
mov r8, rax
lea rdx, str.WnRegIme32.exe
lea rcx, [rbp - 0x70]
call fcn.18005c660
nop
lea rbx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rbx, qword [rbp - 0x70]
call fcn.180208104
mov rcx, rax
call fcn.18020a518
mov r8, rax
mov r9, rbx
lea rdx, [0x1802abef8]
lea rcx, [rbp - 0x50]
call fcn.18005c530
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x70]
call fcn.18005cb40
lea rcx, [rbp - 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1802090e3
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], rsi
mov word [rbp - 0x70], si
lea rcx, str._InstallIME
call fcn.1802547d0
mov r8, rax
lea rdx, str._InstallIME
lea rcx, [rbp - 0x70]
call fcn.18005c660
nop
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rdx, qword [rbp - 0x70]
lea rcx, [rbp + 0x1c0]
call fcn.18005c530
call fcn.18006e250
test eax, eax
je 0x180209088
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp - 0x50]
call fcn.180204ef0
lea rdx, [rbp + 0x1c0]
lea rcx, str.DoRunRegImeInterFace_Parameter__s
call fcn.180207ab4
jmp 0x1802090d3
lea r9, [rbp + 0x1c0]
lea r8, [rbp - 0x50]
lea rdx, str.__s___s
lea rcx, [rbp + 0x3d0]
call fcn.18005c530
lea rdx, [rbp + 0x3d0]
lea rcx, str.DoRunRegImeInterFace_Cmd__s
call fcn.180207ab4
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x3d0]
call fcn.180204fd0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x70]
call fcn.18005cb40
jmp 0x1802090f4
lea rdx, [rbp - 0x50]
lea rcx, str.PathFileExists_false_file___s
call fcn.180207ab4
nop
lea rcx, [rsp + 0x40]
call fcn.1802065e0
mov rcx, qword [rbp + 0x5e0]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x6f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret