joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800aa580
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x180079820
test rax, rax
jne 0x180079835
add rsp, 0x30
pop rbx
ret
mov dword [rsp + 0x28], 1
lea rdx, str.open
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x18007986d
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.180079880
mov eax, 1
add rsp, 0x30
pop rbx
ret
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov rax, qword [0x180344f48]
test rax, rax
jne 0x1800aa5bd
mov ecx, 0x320
call fcn.1802037c4
mov qword [rsp + 0x48], rax
mov rcx, rax
call fcn.1800c0bf0
nop
mov qword [0x180344f48], rax
mov rcx, qword [rax + 0x208]
test rcx, rcx
je 0x1800aa62b
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
jne 0x1800aa62b
mov rax, qword [0x180344f48]
test rax, rax
jne 0x1800aa5fe
mov ecx, 0x320
call fcn.1802037c4
mov qword [rsp + 0x48], rax
mov rcx, rax
call fcn.1800c0bf0
nop
mov qword [0x180344f48], rax
mov rcx, qword [rax + 0x208]
test rcx, rcx
je 0x1800aa61e
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x1800aa61e
mov rcx, rbx
call fcn.180076430
jmp 0x1800aa62b
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp 0x180079810
add rsp, 0x30
pop rbx
ret
Function at 0x1800aad20
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x270
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, qword [0x180344ad0]
test rbx, rbx
jne 0x1800aad72
mov ecx, 0x238
call fcn.1802037c4
mov rbx, rax
mov qword [rsp + 0x20], rax
mov rcx, rax
call fcn.18006f080
nop
mov qword [0x180344ad0], rbx
lea rdx, [rbx + 0xc8]
cmp qword [rdx + 0x18], 8
jb 0x1800aad83
mov rdx, qword [rdx]
mov qword [rsp + 0x48], 7
xor r8d, r8d
mov qword [rsp + 0x40], r8
mov word [rsp + 0x30], r8w
cmp word [rdx], r8w
je 0x1800aadaf
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x1800aada4
lea rcx, [rsp + 0x30]
call fcn.18005c660
nop
mov r8d, 0xf
lea rdx, str.WnHandInput.exe
lea rcx, [rsp + 0x30]
call fcn.18005ffc0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
test eax, eax
je 0x1800aae22
call fcn.180233580
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
lea rdx, [0x1802af898]
lea rcx, [rsp + 0x50]
call fcn.18005c530
jmp 0x1800aae7e
call fcn.180233580
mov rbx, qword [0x180344ad0]
test rbx, rbx
jne 0x1800aae55
mov ecx, 0x238
call fcn.1802037c4
mov rbx, rax
mov qword [rsp + 0x20], rax
mov rcx, rax
call fcn.18006f080
nop
mov qword [0x180344ad0], rbx
lea r8, [rbx + 0xc8]
cmp qword [r8 + 0x18], 8
jb 0x1800aae66
mov r8, qword [r8]
lea r9, str.WnPlugin.exe
lea rdx, str.__s_s__DownLoadHandInputByHand
lea rcx, [rsp + 0x50]
call fcn.18005c530
lea rcx, [rsp + 0x50]
call fcn.1800aa580
nop
mov r8, qword [rsp + 0x48]
cmp r8, 8
jb 0x1800aaea6
inc r8
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.18005cac0
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x270
pop rbx
ret
Function at 0x1800ab7d0
Capabilities:
Check if file exists

Disassembly:
push rbp
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x4a0], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x380], rax
lea r8, [0x1802af220]
lea rdx, [0x1802afa38]
lea rcx, [rbp + 0x170]
call fcn.18005c530
lea rdx, [rbp + 0x170]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
test rax, rax
je 0x1800ab85f
mov rcx, rax
call qword [sym.imp.USER32.dll_IsIconic]
mov rcx, rbx
test eax, eax
je 0x1800ab854
mov edx, 9
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1800ab9ce
call qword [sym.imp.USER32.dll_BringWindowToTop]
jmp 0x1800ab9ce
mov rbx, qword [0x180344ad0]
test rbx, rbx
jne 0x1800ab88d
mov ecx, 0x238
call fcn.1802037c4
mov rbx, rax
mov qword [rsp + 0x30], rax
mov rcx, rax
call fcn.18006f080
nop
mov qword [0x180344ad0], rbx
lea rdx, [rbx + 0xc8]
cmp qword [rdx + 0x18], 8
jb 0x1800ab89e
mov rdx, qword [rdx]
mov qword [rsp + 0x58], 7
xor r8d, r8d
mov qword [rsp + 0x50], r8
mov word [rsp + 0x40], r8w
cmp word [rdx], r8w
je 0x1800ab8cb
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x1800ab8c0
lea rcx, [rsp + 0x40]
call fcn.18005c660
nop
mov r8d, 0xc
lea rdx, str.WnOffice.exe
lea rcx, [rsp + 0x40]
call fcn.18005ffc0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
test eax, eax
je 0x1800ab93e
call fcn.180233580
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r8, qword [rsp + 0x40]
lea rdx, str.__s__ByStatusBar
lea rcx, [rsp + 0x60]
call fcn.18005c530
jmp 0x1800ab9a6
call fcn.180233580
mov rbx, qword [0x180344ad0]
test rbx, rbx
jne 0x1800ab971
mov ecx, 0x238
call fcn.1802037c4
mov rbx, rax
mov qword [rsp + 0x30], rax
mov rcx, rax
call fcn.18006f080
nop
mov qword [0x180344ad0], rbx
lea r8, [rbx + 0xc8]
cmp qword [r8 + 0x18], 8
jb 0x1800ab982
mov r8, qword [r8]
lea rax, [0x1802afa94]
mov qword [rsp + 0x20], rax
lea r9, str.WnPlugin.exe
lea rdx, str.__s_s___s_ByStatusBar
lea rcx, [rsp + 0x60]
call fcn.18005c530
lea rcx, [rsp + 0x60]
call fcn.1800aa580
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x1800ab9ce
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.18005cac0
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x490
pop rbp
ret
Function at 0x1800ac2a0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x100
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, r8
lea rcx, str.SearchCand
mov r9, r8
mov rdi, rdx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, [0x1802abc24]
lea rcx, [rsp + 0x20]
lea r8d, [rax + 1]
call fcn.18005c530
mov r9, rbx
lea r8, [rsp + 0x20]
mov rdx, rdi
lea rcx, str.SearchCand
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x110]
add rsp, 0x100
pop rdi
ret
Function at 0x1800af2d0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x148
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rax, qword [0x180344f48]
test rax, rax
jne 0x1800af31d
mov ecx, 0x320
call fcn.1802037c4
mov qword [rsp + 0x30], rax
mov rcx, rax
call fcn.1800c0bf0
nop
mov qword [0x180344f48], rax
mov rcx, qword [rax + 0x208]
test rcx, rcx
je 0x1800af413
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
jne 0x1800af413
mov rax, qword [0x180344f48]
test rax, rax
jne 0x1800af366
mov ecx, 0x320
call fcn.1802037c4
mov qword [rsp + 0x30], rax
mov rcx, rax
call fcn.1800c0bf0
nop
mov qword [0x180344f48], rax
mov rcx, qword [rax + 0x208]
test rcx, rcx
je 0x1800af3df
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x1800af3df
lea r8, str.http:__www.wnwb.com_
lea rdx, str.microsoft_edge:_s
lea rcx, [rsp + 0x60]
call fcn.18005c530
lea r8, [rsp + 0x60]
lea rdx, [0x1802abd74]
lea rcx, [0x1803451c0]
call fcn.18005c530
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor eax, eax
mov dword [rsp + 0x20], eax
lea r9, [0x1803451c0]
lea r8, [0x180076730]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800af413
mov qword [rsp + 0x50], 7
xor eax, eax
mov qword [rsp + 0x48], rax
mov word [rsp + 0x38], ax
lea r8d, [rax + 0x14]
lea rdx, str.http:__www.wnwb.com_
lea rcx, [rsp + 0x38]
call fcn.18005c660
lea rcx, [rsp + 0x38]
call fcn.1800781a0
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x148
ret
Function at 0x1800af430
Capabilities:
Create thread

Disassembly:
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rax, qword [0x180344f48]
test rax, rax
jne 0x1800af480
mov ecx, 0x320
call fcn.1802037c4
mov qword [rsp + 0x30], rax
mov rcx, rax
call fcn.1800c0bf0
nop
mov qword [0x180344f48], rax
mov rcx, qword [rax + 0x208]
test rcx, rcx
je 0x1800af62b
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
jne 0x1800af62b
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x40], al
lea r8d, [rax + 0x18]
lea rdx, str.http:__weibo.com_wnwbsrf
lea rcx, [rsp + 0x40]
call fcn.18005a720
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.18006cf70
nop
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jb 0x1800af532
inc rax
mov rcx, qword [rsp + 0x40]
cmp rax, 0x1000
jb 0x1800af52d
test cl, 0x1f
je 0x1800af500
call fcn.180234c4c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800af50f
call fcn.180234c4c
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800af51e
call fcn.180234c4c
int3
cmp rcx, 0x27
jbe 0x1800af52a
call fcn.180234c4c
int3
mov rcx, rax
call fcn.180203788
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
mov rax, qword [0x180344f48]
test rax, rax
jne 0x1800af574
mov ecx, 0x320
call fcn.1802037c4
mov qword [rsp + 0x30], rax
mov rcx, rax
call fcn.1800c0bf0
nop
mov qword [0x180344f48], rax
mov rcx, qword [rax + 0x208]
test rcx, rcx
je 0x1800af5f7
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x1800af5f7
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae r8, qword [rsp + 0x60]
lea rdx, str.microsoft_edge:_s
lea rcx, [rbp - 0x80]
call fcn.18005c530
lea r8, [rbp - 0x80]
lea rdx, [0x1802abd74]
lea rcx, [0x1803451c0]
call fcn.18005c530
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r9, [0x1803451c0]
lea r8, [0x180076730]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800af60e
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call fcn.180079680
nop
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x1800af62b
inc r8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.18005cac0
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x160
pop rbp
ret
Function at 0x1800af640
Capabilities:
Create thread

Disassembly:
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rax, qword [0x180344f48]
test rax, rax
jne 0x1800af690
mov ecx, 0x320
call fcn.1802037c4
mov qword [rsp + 0x30], rax
mov rcx, rax
call fcn.1800c0bf0
nop
mov qword [0x180344f48], rax
mov rcx, qword [rax + 0x208]
test rcx, rcx
je 0x1800af83b
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
jne 0x1800af83b
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x40], al
lea r8d, [rax + 0x1c]
lea rdx, str.http:__www.wnwb.com_help.htm
lea rcx, [rsp + 0x40]
call fcn.18005a720
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.18006cf70
nop
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jb 0x1800af742
inc rax
mov rcx, qword [rsp + 0x40]
cmp rax, 0x1000
jb 0x1800af73d
test cl, 0x1f
je 0x1800af710
call fcn.180234c4c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800af71f
call fcn.180234c4c
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800af72e
call fcn.180234c4c
int3
cmp rcx, 0x27
jbe 0x1800af73a
call fcn.180234c4c
int3
mov rcx, rax
call fcn.180203788
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
mov rax, qword [0x180344f48]
test rax, rax
jne 0x1800af784
mov ecx, 0x320
call fcn.1802037c4
mov qword [rsp + 0x30], rax
mov rcx, rax
call fcn.1800c0bf0
nop
mov qword [0x180344f48], rax
mov rcx, qword [rax + 0x208]
test rcx, rcx
je 0x1800af807
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x1800af807
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae r8, qword [rsp + 0x60]
lea rdx, str.microsoft_edge:_s
lea rcx, [rbp - 0x80]
call fcn.18005c530
lea r8, [rbp - 0x80]
lea rdx, [0x1802abd74]
lea rcx, [0x1803451c0]
call fcn.18005c530
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r9, [0x1803451c0]
lea r8, [0x180076730]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800af81e
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call fcn.180079680
nop
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x1800af83b
inc r8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.18005cac0
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x160
pop rbp
ret
Function at 0x1800b0db0
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x670
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x680], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x660], rax
call fcn.1800b0c40
mov rbx, rax
cmp qword [0x180344ab0], 0
jne 0x1800b0e18
mov ecx, 0x20
call fcn.1802037c4
mov qword [rsp + 0x20], rax
mov byte [rax], 1
xor ecx, ecx
mov qword [rax + 8], rcx
mov dword [rax + 0x10], 1
mov qword [rax + 0x18], rcx
mov qword [0x180344ab0], rax
mov rax, qword [0x180344ae0]
test rax, rax
jne 0x1800b0e43
mov ecx, 0x1f8
call fcn.1802037c4
mov qword [rsp + 0x20], rax
mov rcx, rax
call fcn.18011a420
nop
mov qword [0x180344ae0], rax
mov rdi, qword [rax + 8]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1800b0ff1
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x240]
call fcn.180233580
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.180233580
mov rbx, qword [0x180344ad0]
test rbx, rbx
jne 0x1800b0ead
mov ecx, 0x238
call fcn.1802037c4
mov rbx, rax
mov qword [rsp + 0x20], rax
mov rcx, rax
call fcn.18006f080
nop
mov qword [0x180344ad0], rbx
lea rcx, [rbx + 0xc8]
cmp qword [rcx + 0x18], 8
jb 0x1800b0ebe
mov rcx, qword [rcx]
lea rdx, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x1800b0ed0
lea rcx, [rsp + 0x30]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1800b0ef0
movups xmm0, xmmword [str.WnPlugin.exe]
movups xmmword [rcx], xmm0
movsd xmm1, qword [0x1802af258]
movsd qword [rcx + 0x10], xmm1
movzx eax, word [0x1802af260]
mov word [rcx + 0x18], ax
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800b1013
mov dword [rsp + 0x240], 0x22
lea rcx, [rsp + 0x240]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1800b0f46
lea r9, [rsp + 0x30]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r9 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1800b0f60
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x450]
call fcn.180233580
mov r8, rdi
lea rdx, str.__RunVipTipRegister__d
lea rcx, [rsp + 0x450]
call fcn.18005c530
lea rcx, [rsp + 0x240]
sub rcx, 2
nop word [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1800b0fb0
lea r8, [rsp + 0x450]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1800b0fd0
lea rcx, [rsp + 0x240]
call fcn.1800aa580
jmp 0x1800b1013
mov edx, 4
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
mov r8, rdi
mov edx, 0x532
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x680]
add rsp, 0x670
pop rdi
ret
Function at 0x1800b1040
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x670
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x680], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x660], rax
call fcn.1800b0cb0
mov rbx, rax
cmp qword [0x180344ab0], 0
jne 0x1800b10a8
mov ecx, 0x20
call fcn.1802037c4
mov qword [rsp + 0x20], rax
mov byte [rax], 1
xor ecx, ecx
mov qword [rax + 8], rcx
mov dword [rax + 0x10], 1
mov qword [rax + 0x18], rcx
mov qword [0x180344ab0], rax
mov rax, qword [0x180344ae0]
test rax, rax
jne 0x1800b10d3
mov ecx, 0x1f8
call fcn.1802037c4
mov qword [rsp + 0x20], rax
mov rcx, rax
call fcn.18011a420
nop
mov qword [0x180344ae0], rax
mov rdi, qword [rax + 8]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1800b1281
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x240]
call fcn.180233580
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.180233580
mov rbx, qword [0x180344ad0]
test rbx, rbx
jne 0x1800b113d
mov ecx, 0x238
call fcn.1802037c4
mov rbx, rax
mov qword [rsp + 0x20], rax
mov rcx, rax
call fcn.18006f080
nop
mov qword [0x180344ad0], rbx
lea rcx, [rbx + 0xc8]
cmp qword [rcx + 0x18], 8
jb 0x1800b114e
mov rcx, qword [rcx]
lea rdx, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x1800b1160
lea rcx, [rsp + 0x30]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1800b1180
movups xmm0, xmmword [str.WnPlugin.exe]
movups xmmword [rcx], xmm0
movsd xmm1, qword [0x1802af258]
movsd qword [rcx + 0x10], xmm1
movzx eax, word [0x1802af260]
mov word [rcx + 0x18], ax
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800b12a3
mov dword [rsp + 0x240], 0x22
lea rcx, [rsp + 0x240]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1800b11d6
lea r9, [rsp + 0x30]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r9 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1800b11f0
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x450]
call fcn.180233580
mov r8, rdi
lea rdx, str.__RunVipTipLogin__d
lea rcx, [rsp + 0x450]
call fcn.18005c530
lea rcx, [rsp + 0x240]
sub rcx, 2
nop word [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1800b1240
lea r8, [rsp + 0x450]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1800b1260
lea rcx, [rsp + 0x240]
call fcn.1800aa580
jmp 0x1800b12a3
mov edx, 4
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
mov r8, rdi
mov edx, 0x532
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x680]
add rsp, 0x670
pop rdi
ret
Function at 0x1800b12d0
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x670
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x680], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x660], rax
call fcn.1800b0d20
mov rbx, rax
cmp qword [0x180344ab0], 0
jne 0x1800b1338
mov ecx, 0x20
call fcn.1802037c4
mov qword [rsp + 0x20], rax
mov byte [rax], 1
xor ecx, ecx
mov qword [rax + 8], rcx
mov dword [rax + 0x10], 1
mov qword [rax + 0x18], rcx
mov qword [0x180344ab0], rax
mov rax, qword [0x180344ae0]
test rax, rax
jne 0x1800b1363
mov ecx, 0x1f8
call fcn.1802037c4
mov qword [rsp + 0x20], rax
mov rcx, rax
call fcn.18011a420
nop
mov qword [0x180344ae0], rax
mov rdi, qword [rax + 8]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1800b1521
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x240]
call fcn.180233580
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.180233580
mov rbx, qword [0x180344ad0]
test rbx, rbx
jne 0x1800b13cd
mov ecx, 0x238
call fcn.1802037c4
mov rbx, rax
mov qword [rsp + 0x20], rax
mov rcx, rax
call fcn.18006f080
nop
mov qword [0x180344ad0], rbx
lea rcx, [rbx + 0xc8]
cmp qword [rcx + 0x18], 8
jb 0x1800b13de
mov rcx, qword [rcx]
lea rdx, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x1800b13f0
lea rcx, [rsp + 0x30]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1800b1410
movups xmm0, xmmword [str.WnUserPage.exe]
movups xmmword [rcx], xmm0
movsd xmm1, qword [0x1802afd68]
movsd qword [rcx + 0x10], xmm1
mov eax, dword [0x1802afd70]
mov dword [rcx + 0x18], eax
movzx eax, word [0x1802afd74]
mov word [rcx + 0x1c], ax
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800b1543
mov dword [rsp + 0x240], 0x22
lea rcx, [rsp + 0x240]
sub rcx, 2
nop
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1800b1470
lea r9, [rsp + 0x30]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r9 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1800b1490
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x450]
call fcn.180233580
mov r8, rdi
lea rdx, str.__UserMiniStatus__d
lea rcx, [rsp + 0x450]
call fcn.18005c530
lea rcx, [rsp + 0x240]
sub rcx, 2
nop word [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1800b14e0
lea r8, [rsp + 0x450]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1800b1500
lea rcx, [rsp + 0x240]
call fcn.1800aa580
jmp 0x1800b1543
mov edx, 4
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
mov r8, rdi
mov edx, 0x532
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x680]
add rsp, 0x670
pop rdi
ret
Function at 0x1800b15e0
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x670
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x680], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x660], rax
call fcn.1800b1570
mov rbx, rax
cmp qword [0x180344ab0], 0
jne 0x1800b1648
mov ecx, 0x20
call fcn.1802037c4
mov qword [rsp + 0x20], rax
mov byte [rax], 1
xor ecx, ecx
mov qword [rax + 8], rcx
mov dword [rax + 0x10], 1
mov qword [rax + 0x18], rcx
mov qword [0x180344ab0], rax
mov rax, qword [0x180344ae0]
test rax, rax
jne 0x1800b1673
mov ecx, 0x1f8
call fcn.1802037c4
mov qword [rsp + 0x20], rax
mov rcx, rax
call fcn.18011a420
nop
mov qword [0x180344ae0], rax
mov rdi, qword [rax + 8]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1800b1821
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x240]
call fcn.180233580
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.180233580
mov rbx, qword [0x180344ad0]
test rbx, rbx
jne 0x1800b16dd
mov ecx, 0x238
call fcn.1802037c4
mov rbx, rax
mov qword [rsp + 0x20], rax
mov rcx, rax
call fcn.18006f080
nop
mov qword [0x180344ad0], rbx
lea rcx, [rbx + 0xc8]
cmp qword [rcx + 0x18], 8
jb 0x1800b16ee
mov rcx, qword [rcx]
lea rdx, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x1800b1700
lea rcx, [rsp + 0x30]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1800b1720
movups xmm0, xmmword [str.WnPlugin.exe]
movups xmmword [rcx], xmm0
movsd xmm1, qword [0x1802af258]
movsd qword [rcx + 0x10], xmm1
movzx eax, word [0x1802af260]
mov word [rcx + 0x18], ax
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800b1843
mov dword [rsp + 0x240], 0x22
lea rcx, [rsp + 0x240]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1800b1776
lea r9, [rsp + 0x30]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r9 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1800b1790
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x450]
call fcn.180233580
mov r8, rdi
lea rdx, str.__RunVipExpire__d
lea rcx, [rsp + 0x450]
call fcn.18005c530
lea rcx, [rsp + 0x240]
sub rcx, 2
nop word [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1800b17e0
lea r8, [rsp + 0x450]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1800b1800
lea rcx, [rsp + 0x240]
call fcn.1800aa580
jmp 0x1800b1843
mov edx, 4
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
mov r8, rdi
mov edx, 0x532
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x680]
add rsp, 0x670
pop rdi
ret