joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180142360
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [rcx + 0x50], 0
jge 0x180142360
jmp 0x180142230
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x478
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r12, r9
mov r15, r8
mov r14, rdx
mov rsi, rcx
xor dil, dil
mov byte [rsp + 0x30], dil
xor edx, edx
mov r8d, 0x412
lea rcx, [rsp + 0x40]
call fcn.180180df0
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.180141f20
cmp byte [rsi + 0x40], dil
je 0x1801422bd
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1801422b9
test al, 0x10
jne 0x1801422b9
call fcn.180143950
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.180143c20
test al, al
jne 0x1801422bd
xor al, al
jmp 0x180142336
mov qword [rsi + 0x48], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x180142336
lea rdx, str.ExtractArchive
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180142313
mov qword [rsi + 0x48], rbx
mov qword [rsp + 0x20], rsi
lea r9, [0x180141e50]
mov r8, r12
mov rdx, r15
mov rcx, r14
call rax
test eax, eax
sete dil
mov byte [rsp + 0x30], dil
mov qword [rsi + 0x48], 0
jmp 0x180142324
test rbx, rbx
je 0x180142332
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, dil
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18017e6e0
add rsp, 0x478
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x478
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r12, r9
mov r15, r8
mov r14, rdx
mov rdi, rcx
xor sil, sil
mov byte [rsp + 0x30], sil
xor edx, edx
mov r8d, 0x412
lea rcx, [rsp + 0x40]
call fcn.180180df0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.180141f20
cmp byte [rdi + 0x40], sil
je 0x1801423f0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1801423e9
test al, 0x10
jne 0x1801423e9
call fcn.180143950
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.180143c20
test al, al
jne 0x1801423f0
xor al, al
jmp 0x180142474
mov qword [rdi + 0x48], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x180142474
lea rdx, str.ExtractArchive2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x180142451
mov qword [rdi + 0x48], rbx
mov eax, dword [rdi + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
lea r9, [0x180141e50]
mov r8, r12
mov rdx, r15
mov rcx, r14
call r10
test eax, eax
sete sil
mov byte [rsp + 0x30], sil
mov qword [rdi + 0x48], 0
jmp 0x180142462
test rbx, rbx
je 0x180142470
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, sil
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18017e6e0
add rsp, 0x478
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x18014b7e0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
mov rdi, rdx
cmp rcx, 0xffffffffffffffff
je 0x18014b83e
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x18014b829
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18014b83e
mov ecx, dword [rsp + 0x20]
mov rax, rbx
shl rcx, 0x20
mov al, 1
add rcx, rbx
mov qword [rdi], rcx
jmp 0x18014b840
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18017e6e0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18014cc50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, r9
mov edi, r8d
test rax, rax
je 0x18014cca2
mov rax, qword [rax]
test rax, rax
je 0x18014cca2
test rdx, rdx
je 0x18014cca2
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x18014cca2
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18014cca2
cmp edi, dword [rbx]
sete al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x18014fee0
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x60], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r13, r8
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rdx]
test rcx, rcx
je 0x1801500ca
cmp qword [rcx], 0xffffffffffffffff
je 0x1801500ca
mov qword [r11 - 0x50], 0xffffffffffff8000
mov ebx, 2
mov r9d, ebx
lea r8, [r11 - 0x4c]
mov edx, 0xffff8000
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x48], eax
cmp eax, 0xffffffff
jne 0x18014ff65
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1801500ca
mov ecx, 0x10000
call fcn.18017f23c
mov r15, rax
xor ebp, ebp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x50], rax
xor edx, edx
mov r8d, 0x10000
mov rcx, rax
call fcn.180180df0
mov dword [rsp + 0x40], ebp
mov rcx, qword [rsi]
test rcx, rcx
je 0x1801500a8
test r15, r15
je 0x1801500a8
cmp qword [rcx], 0xffffffffffffffff
je 0x1801500a8
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov r8d, 0x8000
mov rdx, r15
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1801500a8
xor ecx, ecx
mov ebp, ecx
mov esi, ecx
mov r14d, 0x8000
lea r12, [r15 + 0x8000]
nop dword [rax + rax]
movzx eax, byte [rdi + 0xd8]
test al, al
jne 0x1801500b9
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x30], ecx
mov edx, esi
add rdx, r12
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov r8d, r14d
mov rcx, r13
call fcn.18015ed40
test al, al
je 0x18015009d
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x18015005c
mov rcx, qword [rdi + 0x110]
test rcx, rcx
je 0x180150049
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx eax, byte [rdi + 0xd8]
test al, al
jne 0x1801500b9
inc ebp
mov eax, dword [rsp + 0x30]
jmp 0x180150066
add esi, eax
cmp esi, 0x8000
je 0x180150077
cmp ebp, 0xf
ja 0x180150096
sub r14d, eax
je 0x180150077
xor ecx, ecx
jmp 0x18014fff0
mov r8d, 0x8000
mov rdx, r12
mov rcx, r15
call fcn.180181380
xor ebp, ebp
mov ebx, ebp
test eax, eax
setne bl
add ebx, 4
jmp 0x1801500b9
mov ebx, 3
jmp 0x1801500b9
mov eax, dword [rsp + 0x34]
mov ebx, 3
jmp 0x1801500b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 1
mov dword [rdi + 0x100], eax
test r15, r15
je 0x1801500c6
mov rcx, r15
call fcn.18017ebfc
mov eax, ebx
jmp 0x1801500cf
mov eax, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18017e6e0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180150500
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, r9
mov rbx, r8
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rdx
mov rdi, rcx
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13d, eax
xor sil, sil
mov ecx, 0x4000
call fcn.18017f23c
mov r12, rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x48], rax
xor edx, edx
mov r8d, 0x4000
mov rcx, rax
call fcn.180180df0
xor r15d, r15d
cmp qword [rbp + 0x20], r15
jbe 0x1801506e1
nop
movzx eax, byte [rdi + 0xd8]
test al, al
jne 0x1801506de
xor esi, esi
cmp qword [rbx + 8], rsi
jne 0x18015059e
mov ebx, 0xffffffff
jmp 0x18015060e
mov dword [rsp + 0x40], esi
add rbx, 0x30
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xchg dword [rbx], eax
lea r9, [rsp + 0x40]
mov rdx, r12
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
call fcn.18015ecd0
test al, al
jne 0x1801505e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor edx, edx
mov rcx, qword [rsp + 0x20]
xchg dword [rcx], edx
mov ebx, 0xffffffff
jmp 0x18015060e
xor ecx, ecx
mov rax, qword [rsp + 0x20]
xchg dword [rax], ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [rsp + 0x40]
add r14, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, r13d
cmovne r13d, eax
mov ebx, dword [rsp + 0x40]
mov dword [rdi + 0x100], esi
movzx eax, byte [rdi + 0xd8]
test al, al
jne 0x1801506de
cmp ebx, 0xffffffff
je 0x1801506de
test ebx, ebx
je 0x18015066b
mov dword [rsp + 0x44], 0
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsi]
lea r9, [rsp + 0x44]
mov r8d, ebx
mov rdx, r12
mov rcx, rsi
call qword [rax]
test al, al
je 0x18015065a
cmp dword [rsp + 0x44], ebx
je 0x180150696
mov sil, 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0x100], eax
jmp 0x1801506e1
cmp byte [rbp + 0x30], 0
jne 0x1801506de
mov rcx, qword [rdi + 0x110]
test rcx, rcx
je 0x180150688
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx eax, byte [rdi + 0xd8]
test al, al
jne 0x1801506de
inc r15d
cmp r15d, 0xf
ja 0x1801506de
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
je 0x1801506c9
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x28]
cmp rdx, 0xffffffffffffffff
je 0x1801506b9
add rdx, rax
mov r8d, r14d
add r8, rax
mov rax, qword [rcx]
call qword [rax + 0x10]
test al, al
je 0x1801506d9
cmp r14, qword [rbp + 0x20]
jae 0x1801506de
mov rbx, qword [rsp + 0x28]
jmp 0x180150580
mov sil, 1
jmp 0x1801506e1
xor sil, sil
mov qword [rsp + 0x48], 0
test r12, r12
je 0x1801506f7
mov rcx, r12
call fcn.18017ebfc
mov qword [rdi + 0x108], r14
cmp r14, qword [rbp + 0x20]
sete al
test sil, sil
je 0x180150717
xor al, al
movzx ecx, byte [rdi + 0xd8]
test cl, cl
jne 0x180150726
movzx eax, al
mov ecx, 1
cmp byte [rbp + 0x30], 0
cmovne eax, ecx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18017e6e0
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180152ee0
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, r8
mov rbx, rdx
mov r8, rdx
lea rdx, [rbp - 0x30]
call fcn.180153aa0
nop
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
xor r14d, r14d
mov qword [rbp - 0x50], r14
mov word [rbp - 0x48], ax
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.180016020
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x40], rax
mov byte [rbp - 0x38], r14b
mov rcx, qword [rbp - 0x50]
test rcx, rcx
jne 0x180152f68
xor dil, dil
jmp 0x180152f86
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x180152f7f
xor dil, dil
jmp 0x180152f86
mov byte [rbp - 0x48], 1
mov dil, 1
mov byte [rbp - 0x38], dil
mov byte [rbp - 0x60], 0
lea r9, [rbp - 0x60]
mov r8, rsi
mov rdx, rbx
call fcn.180153070
test al, al
jne 0x180152fba
cmp byte [rbp - 0x60], al
je 0x180152fba
cmp qword [rbx + 0x18], 8
jb 0x180152fb0
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
test dil, dil
je 0x180152fd2
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x180152fce
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbp - 0x48], 0
mov qword [rbp - 0x40], r14
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x180152fe9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x50], r14
mov word [rbp - 0x48], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x18015302b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180153026
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180153061
call fcn.18017ebfc
movdqa xmm0, xmmword [0x1801f4bb0]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r14w
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18017e6e0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.18018341c
int3
Function at 0x180154ca0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor eax, eax
mov dword [rsp + 0x20], VarUI4FromDisp
mov qword [rcx + 8], rax
mov rbx, rcx
mov qword [rcx + 0x10], rax
xor edx, edx
mov qword [rcx + 0x18], rax
mov r8d, VarUI4FromDisp
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x50], rax
mov byte [rcx], al
lea rcx, [rsp + 0x24]
call fcn.180180df0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x180154d20
cmp dword [rsp + 0x24], 6
jb 0x180154d20
mov byte [rbx], 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18017e6e0
add rsp, 0x150
pop rbx
ret
Function at 0x180159210
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [rcx + 0x28]
mov rbx, r9
mov edi, r8d
test rcx, rcx
jne 0x180159236
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
test rdx, rdx
je 0x180159229
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x180159229
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180159229
cmp edi, dword [rbx]
mov rbx, qword [rsp + 0x40]
sete al
add rsp, 0x30
pop rdi
ret
Function at 0x18015cad0
Capabilities:
Get file size

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.180016590
nop
lea rcx, [rsp + 0x48]
call fcn.180011d60
xor ebp, ebp
test al, al
jne 0x18015cb21
xor dil, dil
jmp 0x18015cc13
mov qword [rsp + 0x30], rbp
mov ecx, 8
call fcn.18017e70c
mov qword [rsp + 0x40], rax
mov qword [rax], 0xffffffffffffffff
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov r9d, 1
mov r8d, 0x80000000
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.18001b5c0
mov rbx, qword [rsp + 0x30]
test al, al
je 0x18015cbe3
mov rdi, rbp
test rbx, rbx
je 0x18015cbe3
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
jne 0x18015cb8b
xor sil, sil
jmp 0x18015cbba
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
jne 0x18015cbac
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x18015cbac
xor sil, sil
jmp 0x18015cbba
mov edi, dword [rsp + 0x40]
shl rdi, 0x20
add rdi, rsi
mov sil, 1
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x18015cbd4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x18015cbd4
mov qword [rbx], 0xffffffffffffffff
test sil, sil
je 0x18015cbe3
test rdi, rdi
je 0x18015cbe3
mov dil, 1
jmp 0x18015cbe6
xor dil, dil
test rbx, rbx
je 0x18015cc13
mov rcx, qword [rbx]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18015cc01
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rbp
mov edx, 8
mov rcx, rbx
call fcn.18017ebfc
mov qword [rsp + 0x30], rbp
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x18015cc51
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18015cc4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18015cc85
call fcn.18017ebfc
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], bp
movzx eax, dil
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18017e6e0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
call fcn.18018341c
int3
Function at 0x180162190
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
mov dword [rsp + 0x20], VarUI4FromDisp
mov r8d, VarUI4FromDisp
lea rcx, [rsp + 0x24]
call fcn.180180df0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1801621fe
mov eax, dword [rsp + 0x24]
cmp eax, 5
ja 0x1801621e4
jne 0x1801621fe
cmp dword [rsp + 0x28], 0
jbe 0x1801621fe
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18017e6e0
add rsp, 0x158
ret
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18017e6e0
add rsp, 0x158
ret

Function at 0x180162220
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
mov dword [rsp + 0x20], VarUI4FromDisp
mov r8d, VarUI4FromDisp
lea rcx, [rsp + 0x24]
call fcn.180180df0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x18016228e
mov eax, dword [rsp + 0x24]
cmp eax, 6
ja 0x180162274
jb 0x18016228e
cmp dword [rsp + 0x28], 1
jb 0x18016228e
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18017e6e0
add rsp, 0x158
ret
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18017e6e0
add rsp, 0x158
ret

Function at 0x1801622b0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
mov dword [rsp + 0x20], 0x11c
mov r8d, 0x118
lea rcx, [rsp + 0x24]
call fcn.180180df0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x18016232d
mov eax, dword [rsp + 0x24]
cmp eax, 6
ja 0x180162313
jne 0x18016232d
mov eax, dword [rsp + 0x28]
cmp eax, 1
ja 0x180162313
jne 0x18016232d
cmp word [rsp + 0x134], 1
jb 0x18016232d
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18017e6e0
add rsp, 0x158
ret
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18017e6e0
add rsp, 0x158
ret
Function at 0x1801672e0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x330
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0x70]
call fcn.1801677d0
nop
lea rdx, str.config.ini
lea rcx, [rsp + 0x90]
call fcn.180009770
nop
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.180016590
nop
lea rcx, [rsp + 0x90]
call fcn.1800096f0
lea rcx, [rsp + 0x50]
call fcn.180011d60
movzx eax, al
test eax, eax
jne 0x1801673a7
lea rdx, [0x1801db0b8]
mov rcx, qword [rsp + 0x340]
call fcn.180009770
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x50]
call fcn.1800096f0
nop
lea rcx, [rsp + 0x70]
call fcn.1800096f0
mov rax, qword [rsp + 0x340]
jmp 0x180167514
lea rax, [rsp + 0x110]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rcx, [rsp + 0x50]
call fcn.180009650
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x110]
lea r8, [0x1801db0b8]
lea rdx, str.Version
lea rcx, str.Upgrade
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rax, [rsp + 0x110]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0xffffffffffffffff
inc qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
cmp word [rax + rcx*2], 0
jne 0x18016740b
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x18016746c
lea rdx, [0x1801db0b8]
mov rcx, qword [rsp + 0x340]
call fcn.180009770
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x50]
call fcn.1800096f0
nop
lea rcx, [rsp + 0x70]
call fcn.1800096f0
mov rax, qword [rsp + 0x340]
jmp 0x180167514
lea rcx, [rsp + 0xf0]
call fcn.1801671f0
nop
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0xb0]
call fcn.180009770
nop
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0xd0]
call fcn.180016590
nop
lea rcx, [rsp + 0xb0]
call fcn.1800096f0
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x340]
call fcn.18000eac0
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0xd0]
call fcn.1800096f0
nop
lea rcx, [rsp + 0xf0]
call fcn.1800096f0
nop
lea rcx, [rsp + 0x50]
call fcn.1800096f0
nop
lea rcx, [rsp + 0x70]
call fcn.1800096f0
mov rax, qword [rsp + 0x340]
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.18017e6e0
add rsp, 0x330
pop rdi
ret
Function at 0x180168270
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x108
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0x78]
call fcn.180167530
nop
lea rcx, [rsp + 0x60]
call fcn.18001dcd0
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
call fcn.18001de30
lea rcx, [rsp + 0x50]
call fcn.18001dcd0
mov dword [rsp + 0x20], 0x25d
xor r9d, r9d
mov r8d, 3
mov edx, 1
lea rcx, [rsp + 0x50]
call fcn.18001dce0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.18001dd30
movzx eax, al
test eax, eax
je 0x18016830f
mov byte [rsp + 0x30], 1
lea rcx, [rsp + 0x78]
call fcn.1800096f0
movzx eax, byte [rsp + 0x30]
jmp 0x1801683e0
lea rdx, str.config.ini
lea rcx, [rsp + 0x98]
call fcn.180009770
nop
lea rcx, [rsp + 0xd8]
call fcn.1801677d0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x98]
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0xb8]
call fcn.180016590
nop
lea rcx, [rsp + 0xd8]
call fcn.1800096f0
nop
lea rcx, [rsp + 0x98]
call fcn.1800096f0
lea rcx, [rsp + 0xb8]
call fcn.180009650
mov r9, rax
xor r8d, r8d
lea rdx, str.Status
lea rcx, str.Open
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 2
jne 0x1801683b2
mov dword [rsp + 0x34], 1
jmp 0x1801683ba
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
mov byte [rsp + 0x31], al
lea rcx, [rsp + 0xb8]
call fcn.1800096f0
nop
lea rcx, [rsp + 0x78]
call fcn.1800096f0
movzx eax, byte [rsp + 0x31]
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.18017e6e0
add rsp, 0x108
ret

Function at 0x180168520
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0xb8
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0xa8], rax
lea rdx, str.config.ini
lea rcx, [rsp + 0x48]
call fcn.180009770
nop
lea rcx, [rsp + 0x88]
call fcn.1801677d0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x68]
call fcn.180016590
nop
lea rcx, [rsp + 0x88]
call fcn.1800096f0
nop
lea rcx, [rsp + 0x48]
call fcn.1800096f0
lea rcx, [rsp + 0x68]
call fcn.180009650
mov r9, rax
xor r8d, r8d
lea rdx, str.PreferPdfReader
lea rcx, str.Open
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 1
jne 0x1801685d6
mov dword [rsp + 0x24], 1
jmp 0x1801685de
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x68]
call fcn.1800096f0
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.18017e6e0
add rsp, 0xb8
ret