joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011430
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov edi, ecx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x11c
call fcn.1800be330
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x1800114c0
cmp dword [rsp + 0x24], 6
jb 0x1800114c0
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.ChangeWindowMessageFilter
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800114b7
mov edx, 1
mov ecx, edi
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800b5370
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret

Function at 0x180013bd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
nop dword [rax]
mov rbx, qword [rdi]
mov eax, dword [rbx]
cmp eax, 0x270
jne 0x180013c3e
lea rax, [rbx + 8]
mov r9d, 0x270
nop word [rax + rax]
mov r8d, dword [rax - 4]
lea rax, [rax + 4]
xor r8d, dword [rax - 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
dec r9
jne 0x180013c00
jmp 0x180013c4d
cmp eax, 0x4e0
jb 0x180013c4d
mov rcx, rbx
call fcn.180013d50
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov eax, dword [rbx + 0x1384]
mov ecx, edx
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
cmp eax, dword [rdi + 0x10]
ja 0x180013be0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180013ca0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx]
mov r9d, 0x270
mov rbx, rcx
cmp eax, r9d
jne 0x180013cfb
lea r8, [rcx + 8]
nop word [rax + rax]
mov edx, dword [r8 - 4]
lea r8, [r8 + 4]
xor edx, dword [r8 - 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
dec r9
jne 0x180013cc0
jmp 0x180013d07
cmp eax, 0x4e0
jb 0x180013d07
call fcn.180013d50
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov eax, dword [rbx + 0x1384]
mov ecx, edx
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret
Function at 0x180013d50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r10, rcx
lea r9, [rcx + 0x9c4]
mov r11d, 0xe3
mov edx, dword [r9 + 4]
lea r9, [r9 + 4]
xor edx, dword [r9 - 4]
btr edx, 0x1f
xor edx, dword [r9 - 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x630]
xor ecx, edx
mov dword [r9 - 0x9c4], ecx
dec r11
jne 0x180013d60
lea r9, [r10 + 0xd50]
mov r11d, 0x18c
nop word [rax + rax]
mov edx, dword [r9 + 4]
lea r9, [r9 + 4]
xor edx, dword [r9 - 4]
btr edx, 0x1f
xor edx, dword [r9 - 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 - 0xd50]
xor ecx, edx
mov dword [r9 - 0x9c4], ecx
dec r11
jne 0x180013db0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov dword [r10], r11d
ret

Function at 0x180019ba0
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x248
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp dword [rcx], 0
jne 0x180019bdb
mov eax, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x248
ret
mov qword [rsp + 0x250], rbx
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
je 0x180019c11
nop word [rax + rax]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
jne 0x180019c00
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x180019c7a
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
mov qword [rsp + 0x240], rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor ebx, ebx
cmp qword [0x180252448], rbx
je 0x180019c70
lea rdi, [0x180252448]
mov rax, rdi
nop
mov rdx, qword [rax]
lea rcx, [rsp + 0x20]
call fcn.1800bae90
test rax, rax
jne 0x180019c9a
inc rbx
cmp qword [rdi + rbx*8], 0
lea rax, [rdi + rbx*8]
jne 0x180019c50
xor eax, eax
mov rdi, qword [rsp + 0x240]
mov rbx, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x248
ret
mov eax, 1
jmp 0x180019c72
Function at 0x18001a050
Capabilities:
Find taskbar

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea r8, [0x180019f90]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [0x180278bf8], 0
call qword [sym.imp.USER32.dll_EnumDisplayMonitors]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea r8, [rsp + 0x20]
lea ecx, [rdx + 0x30]
xor r9d, r9d
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x28]
mov ecx, dword [0x180278bf8]
sub eax, dword [rsp + 0x20]
cmp ecx, 2
jl 0x18001a100
lea rdx, [0x1802790c8]
mov r8d, ecx
cmp dword [rdx], eax
cmovg eax, dword [rdx]
lea rdx, [rdx + 0x10]
dec r8
jne 0x18001a0f2
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x60
pop rbx
ret

Function at 0x18001a120
Capabilities:
Find taskbar

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
lea r8, [0x180019f90]
xor esi, esi
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [0x180278bf8], esi
call qword [sym.imp.USER32.dll_EnumDisplayMonitors]
lea ecx, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rsp + 0x20]
lea ecx, [rsi + 0x30]
xor r9d, r9d
xor edx, edx
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [rsp + 0x2c]
mov eax, dword [0x180278bf8]
sub edi, dword [rsp + 0x24]
cmp eax, 1
jle 0x18001a234
test eax, eax
jle 0x18001a234
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], r14
lea r14, [0x1802790cc]
lea rbp, [0x1802790c0]
nop dword [rax + rax]
movsxd rcx, esi
mov rdx, rbx
shl rcx, 4
add rcx, rbp
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x18001a216
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x18001a213
mov edi, dword [rsp + 0x2c]
sub edi, dword [rsp + 0x24]
jmp 0x18001a216
mov edi, dword [r14]
inc esi
add r14, 0x10
cmp esi, dword [0x180278bf8]
jl 0x18001a1e0
mov r14, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov eax, edi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x18001a250
Capabilities:
Find taskbar

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rcx
lea r8, [0x180019f90]
xor ebp, ebp
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [0x180278bf8], ebp
call qword [sym.imp.USER32.dll_EnumDisplayMonitors]
lea ecx, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rsp + 0x28]
lea ecx, [rbp + 0x30]
xor r9d, r9d
xor edx, edx
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [rsp + 0x34]
mov ecx, dword [0x180278bf8]
sub edi, dword [rsp + 0x2c]
cmp ecx, 1
jle 0x18001a3d0
mov eax, dword [rsi + 8]
mov qword [rsp + 0xa0], r14
lea r14, [0x1802790cc]
mov dword [rsp + 0x20], eax
mov eax, dword [rsi + 0xc]
mov esi, ebp
mov dword [rsp + 0x24], eax
test ecx, ecx
jle 0x18001a3b0
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x60], r15
mov r15, r14
lea r12, [0x1802790c0]
movsxd rcx, esi
mov rdx, rbx
shl rcx, 4
add rcx, r12
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x18001a36c
lea rcx, [rsp + 0x28]
mov rdx, rbx
mov ebp, 1
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x18001a369
mov edi, dword [rsp + 0x34]
sub edi, dword [rsp + 0x2c]
jmp 0x18001a36c
mov edi, dword [r15]
mov ecx, dword [0x180278bf8]
inc esi
add r15, 0x10
cmp esi, ecx
jl 0x18001a331
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x98]
test ebp, ebp
jne 0x18001a3b0
test ecx, ecx
jle 0x18001a3b0
mov edx, ecx
nop word [rax + rax]
cmp dword [r14], edi
cmovl edi, dword [r14]
lea r14, [r14 + 0x10]
dec rdx
jne 0x18001a3a0
mov r14, qword [rsp + 0xa0]
mov eax, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, edi
jmp 0x18001a3ba

Function at 0x18001a610
Capabilities:
Find taskbar

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edx, edx
lea r8, [rsp + 0x30]
xor r9d, r9d
lea ecx, [rdx + 0x30]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x28]
sub eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x60
pop rbx
ret
Function at 0x18001a690
Capabilities:
Find taskbar

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edx, edx
lea r8, [rsp + 0x30]
xor r9d, r9d
lea ecx, [rdx + 0x30]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x2c]
sub eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x60
pop rbx
ret

Function at 0x18001a710
Capabilities:
Find taskbar

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edx, edx
lea r8, [rsp + 0x20]
xor r9d, r9d
lea ecx, [rdx + 0x30]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x2c]
sub eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x60
pop rbx
ret
Function at 0x18001a790
Capabilities:
Check if file exists
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rdi
lea rbp, [rsp - 0xb88]
sub rsp, 0xc88
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rbp + 0xb60], rax
xor edi, edi
lea rcx, [rbp + 0x142]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x140], di
call fcn.1800be330
mov ecx, edi
lea rdx, str.C:log_
nop dword [rax]
movzx eax, word [rcx + rdx]
lea rcx, [rcx + 2]
mov word [rbp + rcx + 0x13e], ax
test ax, ax
jne 0x18001a7f0
lea rcx, [rbp + 0x772]
xor edx, edx
mov r8d, 0x3e6
mov word [rbp + 0x770], di
call fcn.1800be330
lea r8, [rbp + 0x140]
lea rdx, str._sgswb.log
lea rcx, [rbp + 0x350]
call fcn.1800b5a54
lea rcx, [rbp + 0x562]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x560], di
call fcn.1800be330
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], di
call fcn.1800be330
lea rdx, [rsp + 0x30]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x30]
mov edx, 0x5c
call fcn.1800b59a4
lea rcx, [rbp + 0x350]
mov word [rax], di
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18001aa2d
mov qword [rsp + 0xc80], rbx
or rbx, 0xffffffffffffffff
mov qword [rsp + 0xc78], rsi
mov qword [rsp + 0xc70], r14
lea rcx, [rsp + 0x30]
mov rax, rbx
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], di
lea rax, [rax + 1]
jne 0x18001a8d0
lea rdx, [rsp + 0x32]
lea rax, [rdx + rax*2]
lea rdx, [rbp + 0x560]
sub rdx, rax
nop
movzx ecx, word [rax]
lea rax, [rax + 2]
mov word [rdx + rax - 2], cx
test cx, cx
jne 0x18001a8f0
lea r9, [rbp + 0x560]
lea r8, [rbp + 0x140]
lea rdx, str._s_s.txt
lea rcx, [rbp + 0x350]
call fcn.1800b5a54
mov r8, qword [rbp + 0xba0]
lea r9, [rbp + 0xba8]
lea rcx, [rbp + 0x770]
mov edx, 0x1f3
call fcn.1800bc150
lea rcx, [rbp + 0x350]
mov word [rbp + 0xb56], di
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea rdx, [0x1801ec778]
lea rcx, [rbp + 0x350]
test eax, eax
mov r14d, 1
cmovne edi, r14d
call fcn.1800bc264
mov rsi, rax
test rax, rax
je 0x18001aa15
test edi, edi
jne 0x18001a9a2
mov eax, 0xfeff
lea r8d, [r14 + 1]
lea rcx, [rsp + 0x24]
mov r9, rsi
mov edx, r14d
mov word [rsp + 0x24], ax
call fcn.1800bc4e0
lea rax, [rbp + 0x770]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18001a9b0
add ebx, ebx
lea rcx, [rbp + 0x770]
mov r9, rsi
movsxd r8, ebx
mov rdx, r14
call fcn.1800bc4e0
mov eax, 0xd
lea rcx, [rsp + 0x20]
lea r8d, [rax - 0xb]
mov r9, rsi
mov rdx, r14
mov word [rsp + 0x20], ax
call fcn.1800bc4e0
mov eax, 0xa
lea rcx, [rsp + 0x20]
lea r8d, [rax - 8]
mov r9, rsi
mov rdx, r14
mov word [rsp + 0x20], ax
call fcn.1800bc4e0
mov rcx, rsi
call fcn.1800bc5ec
mov rsi, qword [rsp + 0xc78]
mov rbx, qword [rsp + 0xc80]
mov r14, qword [rsp + 0xc70]
mov rcx, qword [rbp + 0xb60]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0xc88
pop rdi
pop rbp
ret
Function at 0x18002a2a0
Capabilities:
Read .ini file

Disassembly:
test rcx, rcx
je 0x18002a39e
push rbx
sub rsp, 0x130
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x120], rax
cmp byte [rcx + 0x110], 1
jne 0x18002a386
movzx edx, byte [rcx + 0x111]
lea rcx, [rsp + 0x28]
call fcn.18002a0c0
nop
call fcn.180006b40
lea r9, [rax + 0x128]
cmp qword [r9 + 0x18], 8
jb 0x18002a301
mov r9, qword [r9]
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
xor r8d, r8d
lea rcx, str.ActionCorrect
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea r8d, [rax + 1]
lea rdx, [0x1801ebd34]
lea rcx, [rsp + 0x50]
call fcn.1800b5a54
lea rbx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rbx, qword [rsp + 0x28]
call fcn.180006b40
lea r9, [rax + 0x128]
cmp qword [r9 + 0x18], 8
jb 0x18002a35e
mov r9, qword [r9]
lea r8, [rsp + 0x50]
mov rdx, rbx
lea rcx, str.ActionCorrect
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
nop
cmp qword [rsp + 0x40], 8
jb 0x18002a386
mov rcx, qword [rsp + 0x28]
call fcn.1800b5354
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x130
pop rbx
repz ret

Function at 0x18002a2a9
Capabilities:
Read .ini file

Disassembly:
test rcx, rcx
je 0x18002a39e
push rbx
sub rsp, 0x130
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x120], rax
cmp byte [rcx + 0x110], 1
jne 0x18002a386
movzx edx, byte [rcx + 0x111]
lea rcx, [rsp + 0x28]
call fcn.18002a0c0
nop
call fcn.180006b40
lea r9, [rax + 0x128]
cmp qword [r9 + 0x18], 8
jb 0x18002a301
mov r9, qword [r9]
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
xor r8d, r8d
lea rcx, str.ActionCorrect
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea r8d, [rax + 1]
lea rdx, [0x1801ebd34]
lea rcx, [rsp + 0x50]
call fcn.1800b5a54
lea rbx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rbx, qword [rsp + 0x28]
call fcn.180006b40
lea r9, [rax + 0x128]
cmp qword [r9 + 0x18], 8
jb 0x18002a35e
mov r9, qword [r9]
lea r8, [rsp + 0x50]
mov rdx, rbx
lea rcx, str.ActionCorrect
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
nop
cmp qword [rsp + 0x40], 8
jb 0x18002a386
mov rcx, qword [rsp + 0x28]
call fcn.1800b5354
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x130
pop rbx
repz ret

Function at 0x18002a440
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x28
call fcn.18002a4c0
test al, al
je 0x18002a454
xor al, al
add rsp, 0x28
ret
call fcn.18002a3a0
lea rdx, str.TipRegister
lea rcx, [0x1801f4110]
mov r9, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x18002a44d
mov rcx, qword [0x180278788]
test rcx, rcx
jne 0x18002a4a8
lea ecx, [rax + 8]
call fcn.1800b543c
mov rcx, rax
test rax, rax
je 0x18002a49f
lea rax, vtable.CShareConfigManager.0
mov qword [rcx], rax
jmp 0x18002a4a1
xor ecx, ecx
mov qword [0x180278788], rcx
mov rax, qword [rcx]
mov edx, 0xbb
call qword [rax]
test eax, eax
setle al
add rsp, 0x28
ret
Function at 0x18002a4c0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x460
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x450], rax
call fcn.18002a3a0
lea rcx, [rsp + 0x32]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], di
mov rbx, rax
call fcn.1800be330
lea r9, [rsp + 0x30]
lea r8, str.null
lea rdx, str.FirstInstallDate
lea rcx, [0x1801f4110]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x242]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x240], di
call fcn.1800be330
xor ecx, ecx
call fcn.1800ba5a4
mov ecx, eax
call fcn.18000de30
lea rdx, [0x1801f4130]
lea rcx, [rsp + 0x240]
mov r8d, eax
call fcn.1800b5a54
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x240]
sub r8, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x18002a594
add rax, 2
test ecx, ecx
jne 0x18002a580
test edx, edx
sete al
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1800b5370
mov rbx, qword [rsp + 0x470]
add rsp, 0x460
pop rdi
ret
Function at 0x18002c6e0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18000f650
test rax, rax
je 0x18000f697
mov r8, rcx
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x18000f697
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.18000f6a0
add rsp, 0x30
pop rbx
ret
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov rax, qword [0x18027b278]
test rax, rax
jne 0x18002c722
mov ecx, 0x358
call fcn.1800b543c
mov qword [rsp + 0x48], rax
test rax, rax
je 0x18002c71b
mov rcx, rax
call fcn.18003a340
nop
mov qword [0x18027b278], rax
mov rcx, qword [rax + 0x240]
test rcx, rcx
je 0x18002c795
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
jne 0x18002c795
mov rax, qword [0x18027b278]
test rax, rax
jne 0x18002c768
mov ecx, 0x358
call fcn.1800b543c
mov qword [rsp + 0x48], rax
test rax, rax
je 0x18002c761
mov rcx, rax
call fcn.18003a340
nop
mov qword [0x18027b278], rax
mov rcx, qword [rax + 0x240]
test rcx, rcx
je 0x18002c788
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x18002c788
mov rcx, rbx
call fcn.18000f3d0
jmp 0x18002c795
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp 0x18000f640
add rsp, 0x30
pop rbx
ret
Function at 0x18002cef0
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x270
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x280], rbx
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edi, edi
mov rbx, qword [0x180278790]
test rbx, rbx
jne 0x18002cf5b
mov ecx, 0x260
call fcn.1800b543c
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x18002cf51
mov rcx, rax
call fcn.180001a60
mov dword [rbx + 0x258], edi
jmp 0x18002cf54
mov rbx, rdi
mov qword [0x180278790], rbx
lea rdx, [rbx + 0xc8]
cmp qword [rdx + 0x18], 8
jb 0x18002cf6c
mov rdx, qword [rdx]
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x30], di
cmp word [rdx], 0
jne 0x18002cf8a
mov r8, rdi
jmp 0x18002cf9b
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x18002cf90
lea rcx, [rsp + 0x30]
call fcn.180005450
nop
mov r8d, 0xf
lea rdx, str.WnHandInput.exe
lea rcx, [rsp + 0x30]
call fcn.180004d10
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov word [rsp + 0x50], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x52]
test eax, eax
je 0x18002d013
call fcn.1800be330
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
lea rdx, [0x1801f44d8]
lea rcx, [rsp + 0x50]
call fcn.1800b5a54
jmp 0x18002d07e
call fcn.1800be330
mov rbx, qword [0x180278790]
test rbx, rbx
jne 0x18002d055
mov ecx, 0x260
call fcn.1800b543c
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x18002d04b
mov rcx, rax
call fcn.180001a60
mov dword [rbx + 0x258], edi
jmp 0x18002d04e
mov rbx, rdi
mov qword [0x180278790], rbx
lea r8, [rbx + 0xc8]
cmp qword [r8 + 0x18], 8
jb 0x18002d066
mov r8, qword [r8]
lea r9, str.WnTool.exe
lea rdx, str.__s_s__DownLoadHandInputByHand
lea rcx, [rsp + 0x50]
call fcn.1800b5a54
lea rcx, [rsp + 0x50]
call fcn.18002c6e0
nop
cmp qword [rsp + 0x48], 8
jb 0x18002d09b
mov rcx, qword [rsp + 0x30]
call fcn.1800b5354
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800b5370
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret