joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180209124
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5d8]
sub rsp, 0x6d0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x5c0], rax
mov ebx, 0x208
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x3b0]
call fcn.180233580
mov r8d, ebx
xor edx, edx
lea rcx, [rbp - 0x70]
call fcn.180233580
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x1a0]
call fcn.180233580
lea rcx, [rsp + 0x40]
call fcn.1802065c0
nop
lea rcx, [rsp + 0x40]
call fcn.18020663c
test eax, eax
je 0x1802091b8
call fcn.180208104
mov rcx, rax
call fcn.18020a518
lea r9, str.WnRegIme64.exe
jmp 0x1802091cc
call fcn.180208104
mov rcx, rax
call fcn.18020a518
lea r9, str.WnRegIme32.exe
mov r8, rax
lea rdx, [0x1802abef8]
lea rcx, [rbp - 0x70]
call fcn.18005c530
lea rdx, str._UnInstallIME
lea rcx, [rbp + 0x1a0]
call fcn.18005c530
lea rcx, [rbp - 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18020925b
call fcn.18006e250
test eax, eax
je 0x180209222
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp - 0x70]
call fcn.180204ef0
jmp 0x18020925b
lea r9, [rbp + 0x1a0]
lea r8, [rbp - 0x70]
lea rdx, str.__s___s
lea rcx, [rbp + 0x3b0]
call fcn.18005c530
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x3b0]
call fcn.180204fd0
nop
lea rcx, [rsp + 0x40]
call fcn.1802065e0
mov rcx, qword [rbp + 0x5c0]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x6e0]
add rsp, 0x6d0
pop rbp
ret
Function at 0x180209288
Capabilities:
Check if file exists
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.180208bf8
mov rcx, rbx
call fcn.180208de0
mov rcx, rbx
call fcn.180208dd8
mov rcx, rbx
call fcn.180208ed8
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x180209390
mov rax, rsp
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x180], rax
call fcn.180208104
mov rcx, rax
call fcn.18020a518
mov rbx, rax
mov qword [rsp + 0x40], 7
xor edi, edi
mov qword [rsp + 0x38], rdi
mov word [rsp + 0x28], di
cmp word [rax], di
jne 0x1802093f2
mov eax, edi
jmp 0x1802093fa
mov rcx, rbx
call fcn.1802547d0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.18005c660
nop
lea rcx, str.WanNengWBInfo.ini
call fcn.1802547d0
mov r8, rax
lea rdx, str.WanNengWBInfo.ini
lea rcx, [rsp + 0x28]
call fcn.18005ffc0
lea rcx, [0x1802abc78]
call fcn.1802547d0
mov r9, rax
xor r8d, r8d
lea rdx, [0x1802abc78]
lea rcx, [rsp + 0x28]
call fcn.1800672f0
or r9, 0xffffffffffffffff
cmp eax, r9d
je 0x1802094fd
inc eax
movsxd r8, eax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.18005fdf0
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.180233580
xor r9d, r9d
lea r8d, [r9 + 0x1c]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, str.VirtualStore_
lea rcx, [rsp + 0x70]
call fcn.180254ad8
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.180254ad8
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1802094ed
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x70]
call fcn.180064870
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.18005cb40
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x28]
call fcn.18005cb40
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x180209390
Capabilities:
Check if file exists
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.180208bf8
mov rcx, rbx
call fcn.180208de0
mov rcx, rbx
call fcn.180208dd8
mov rcx, rbx
call fcn.180208ed8
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x180209390
mov rax, rsp
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x180], rax
call fcn.180208104
mov rcx, rax
call fcn.18020a518
mov rbx, rax
mov qword [rsp + 0x40], 7
xor edi, edi
mov qword [rsp + 0x38], rdi
mov word [rsp + 0x28], di
cmp word [rax], di
jne 0x1802093f2
mov eax, edi
jmp 0x1802093fa
mov rcx, rbx
call fcn.1802547d0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.18005c660
nop
lea rcx, str.WanNengWBInfo.ini
call fcn.1802547d0
mov r8, rax
lea rdx, str.WanNengWBInfo.ini
lea rcx, [rsp + 0x28]
call fcn.18005ffc0
lea rcx, [0x1802abc78]
call fcn.1802547d0
mov r9, rax
xor r8d, r8d
lea rdx, [0x1802abc78]
lea rcx, [rsp + 0x28]
call fcn.1800672f0
or r9, 0xffffffffffffffff
cmp eax, r9d
je 0x1802094fd
inc eax
movsxd r8, eax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.18005fdf0
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.180233580
xor r9d, r9d
lea r8d, [r9 + 0x1c]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, str.VirtualStore_
lea rcx, [rsp + 0x70]
call fcn.180254ad8
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.180254ad8
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1802094ed
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x70]
call fcn.180064870
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.18005cb40
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x28]
call fcn.18005cb40
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x180209f00
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rdx
lea rdx, [rsp + 0x20]
call fcn.180209b08
cmp qword [rsp + 0x38], 8
lea r9, [rsp + 0x20]
lea rdx, str.UserID
cmovae r9, qword [rsp + 0x20]
lea rcx, [0x1802abe90]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor ebx, ebx
test eax, eax
je 0x180209f58
mov dword [rdi], eax
mov bl, 1
xor r8d, r8d
lea rcx, [rsp + 0x20]
mov dl, 1
call fcn.18005cb40
mov al, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x18020a04c
Capabilities:
Read .ini file

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x20]
call fcn.180209b08
cmp qword [rsp + 0x38], 8
lea r9, [rsp + 0x20]
lea rdx, str.UserID
cmovae r9, qword [rsp + 0x20]
lea rcx, [0x1802abe90]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dl, 1
lea rcx, [rsp + 0x20]
test eax, eax
setg bl
xor r8d, r8d
call fcn.18005cb40
mov al, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x50
pop rbx
ret

Function at 0x18020a52c
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
lea rdx, [rbp - 0x30]
call fcn.18020a870
nop
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebx, ebx
test eax, eax
je 0x18020a5ce
mov rcx, rdi
call fcn.18020a9b8
lea rdi, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdi, qword [rbp - 0x30]
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], rbx
mov word [rbp - 0x60], bx
cmp word [rdi], bx
je 0x18020a5b5
mov rcx, rdi
call fcn.1802547d0
mov rbx, rax
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x60]
call fcn.18005c660
lea rcx, [rbp - 0x60]
call fcn.1800676d0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x30]
call fcn.18005cb40
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x18020a600
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xbe8]
sub rsp, 0xce0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0xbd0], rax
mov rdi, rcx
lea rcx, str.CImeBrokerReg::DoRun
call fcn.180207ab4
call fcn.18006e0d0
xor ebx, ebx
test eax, eax
je 0x18020a84c
mov r8d, 0x104
lea rdx, [rbp + 0x5b0]
mov rcx, rdi
call fcn.18020a924
lea r9, [0x1802abf08]
lea r8, [rbp + 0x5b0]
lea rdx, str._sIME_s_
lea rcx, [rbp - 0x80]
call fcn.18005c530
lea rcx, [rbp - 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18020a69c
lea rcx, [rbp - 0x80]
call fcn.1800675f0
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.180067510
nop
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae r8, qword [rsp + 0x58]
lea r9, str.WnImeBroker.exe
lea rdi, [0x1802abef8]
mov rdx, rdi
lea rcx, [rbp + 0x3a0]
call fcn.18005c530
lea r9, str.WnImeBroker.exe
lea r8, [rbp - 0x80]
mov rdx, rdi
lea rcx, [rbp + 0x190]
call fcn.18005c530
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x3a0]
call fcn.180064870
lea r8, [rbp + 0x190]
lea rdx, str.__s___RegServer
lea rcx, [rbp + 0x7c0]
call fcn.18005c530
lea rcx, [rbp + 0x7c0]
call fcn.1802054b0
lea rdx, [rbp + 0x7c0]
lea rcx, str.ImeBroker_cmd1___s
call fcn.180207ab4
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae r8, qword [rsp + 0x58]
lea r9, str.WnImeBrokerPS.dll
mov rdx, rdi
lea rcx, [rbp + 0x3a0]
call fcn.18005c530
lea r9, str.WnImeBrokerPS.dll
lea r8, [rbp - 0x80]
mov rdx, rdi
lea rcx, [rbp + 0x190]
call fcn.18005c530
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x3a0]
call fcn.180064870
lea r9, [rbp + 0x190]
lea r8, [rbp + 0x5b0]
lea rdx, str.__s_regsvr32___s___s_
lea rcx, [rbp + 0x7c0]
call fcn.18005c530
lea rcx, [rbp + 0x7c0]
call fcn.1802054b0
lea rdx, [rbp + 0x7c0]
lea rcx, str.ImeBroker_cmd2___s
call fcn.180207ab4
lea rcx, [rsp + 0x20]
call fcn.18020c930
nop
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x28], bx
cmp word [rbp - 0x80], bx
je 0x18020a801
lea rcx, [rbp - 0x80]
call fcn.1802547d0
mov rbx, rax
mov r8, rbx
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x28]
call fcn.18005c660
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x20]
call fcn.18020d018
lea rdx, [rbp - 0x80]
lea rcx, str.AddInstallEveryonePower_path___s
call fcn.180207ab4
nop
lea rcx, [rsp + 0x20]
call fcn.18020c954
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x58]
call fcn.18005cb40
mov rcx, qword [rbp + 0xbd0]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0xce0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x18020a924
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov ebx, r8d
mov rdi, rdx
lea rcx, [rax - 0x58]
call fcn.1802065c0
nop
lea rcx, [rsp + 0x30]
call fcn.18020663c
test eax, eax
je 0x18020a98f
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x30]
call fcn.18020679c
mov r8d, ebx
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.18020660c
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0x30]
call fcn.1802067c4
jmp 0x18020a99b
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop
lea rcx, [rsp + 0x30]
call fcn.1802065e0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret

Function at 0x18020a9b8
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x798]
sub rsp, 0x890
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov rbx, rcx
lea rdx, [rsp + 0x28]
call fcn.18020a870
nop
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18020aaf2
mov r8d, 0x104
lea rdx, [rbp + 0x570]
mov rcx, rbx
call fcn.18020a924
lea r8, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae r8, qword [rsp + 0x28]
lea r9, str.WnImeBroker.exe
lea rdx, [0x1802abef8]
lea rcx, [rsp + 0x50]
call fcn.18005c530
lea r8, [rsp + 0x50]
lea rdx, str.__s___Unregister
lea rcx, [rbp + 0x160]
call fcn.18005c530
lea rcx, [rbp + 0x160]
call fcn.1802054b0
lea rdx, [rbp + 0x160]
lea rcx, str.ImeBroker_cmd1___s
call fcn.1800669d0
lea r8, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae r8, qword [rsp + 0x28]
lea r9, str.WnImeBrokerPS.dll
lea rdx, [0x1802abef8]
lea rcx, [rsp + 0x50]
call fcn.18005c530
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x570]
lea rdx, str.__s_regsvr32___u__s___s_
lea rcx, [rbp + 0x160]
call fcn.18005c530
lea rcx, [rbp + 0x160]
call fcn.1802054b0
lea rdx, [rbp + 0x160]
lea rcx, str.ImeBroker_cmd2___s
call fcn.180207ab4
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x28]
call fcn.18005cb40
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x8a0]
add rsp, 0x890
pop rbp
ret
Function at 0x18020ab24
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, r8
mov rdi, rdx
xor ebx, ebx
test rdx, rdx
je 0x18020ac4e
test r8, r8
je 0x18020ac4e
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18020ac4e
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18020ac4e
mov qword [rbp - 0x39], 7
mov qword [rbp - 0x41], rbx
mov word [rbp - 0x51], bx
cmp word [rdi], bx
jne 0x18020aba4
mov eax, ebx
jmp 0x18020abac
mov rcx, rdi
call fcn.1802547d0
mov r8, rax
mov rdx, rdi
lea rcx, [rbp - 0x51]
call fcn.18005c660
lea rdx, [rbp - 0x51]
lea rcx, [rbp + 0x17]
call fcn.180064550
nop
mov qword [rbp - 0x19], 7
mov qword [rbp - 0x21], rbx
mov word [rbp - 0x31], bx
cmp word [rsi], bx
jne 0x18020abe3
mov rax, rbx
jmp 0x18020abeb
mov rcx, rsi
call fcn.1802547d0
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x31]
call fcn.18005c660
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 9]
call fcn.180064550
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rdx, qword [rbp - 9]
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rcx, qword [rbp + 0x17]
call fcn.18023c1c0
test eax, eax
sete bl
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 9]
call fcn.18005cb40
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x17]
call fcn.18005cb40
mov eax, ebx
jmp 0x18020ac50
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
Function at 0x18020ac70
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5a8]
sub rsp, 0x690
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x580], rax
mov rdi, rcx
call fcn.180208104
mov rcx, rax
call fcn.18020a518
mov r14, rax
call fcn.180208104
mov rcx, rax
call fcn.18020a4f0
mov rsi, rax
mov r15d, 0x208
mov r8d, r15d
xor edx, edx
lea rcx, [rbp + 0x370]
call fcn.180233580
mov r8, rsi
lea rdx, str._sEUDC_
lea rcx, [rbp + 0x370]
call fcn.18005c530
lea rcx, [rbp + 0x370]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebx, ebx
test eax, eax
jne 0x18020ad16
xor eax, eax
jmp 0x18020ae09
mov r8, r15
xor edx, edx
lea rcx, [rbp + 0x160]
call fcn.180233580
mov r8, r15
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.180233580
mov r8, rsi
lea rdx, str._sEUDCEUDC.EUF
lea rcx, [rsp + 0x50]
call fcn.18005c530
mov r8, r14
lea rdx, str._sEUDCEUDC.EUF
lea rcx, [rbp + 0x160]
call fcn.18005c530
lea r8, [rbp + 0x160]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.18020ab24
test eax, eax
je 0x18020ad0f
mov r8, rsi
lea rdx, str._sEUDCEUDC.TTE
lea rcx, [rsp + 0x50]
call fcn.18005c530
mov r8, r14
lea rdx, str._sEUDCEUDC.TTE
lea rcx, [rbp + 0x160]
call fcn.18005c530
lea r8, [rbp + 0x160]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.18020ab24
test eax, eax
je 0x18020ad0f
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x28], bx
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.18020b290
test eax, eax
je 0x18020adf8
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.18005bdb0
test eax, eax
jne 0x18020adf8
lea ebx, [rax + 1]
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x28]
call fcn.18005cb40
mov eax, ebx
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x18020ae38
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, rdx
mov rdi, r8
mov rbx, rdx
call fcn.180064120
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_CopyFileW]

Function at 0x18020aff4
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x58], rax
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
lea rdx, str.EUDC936
mov r9d, 0xf003f
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18020b080
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.18020b1e4
cmp qword [rsp + 0x50], 8
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
cmovae rdx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r8d, r8d
lea rcx, [rsp + 0x38]
mov dl, 1
call fcn.18005cb40
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x60
pop rbx
ret
Function at 0x18020b094
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.EUDC936
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18020b113
xor eax, eax
jmp 0x18020b1ba
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.18020b1e4
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.180233580
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x18020b17a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18020b1a9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [rsp + 0x70], bx
je 0x18020b194
lea rcx, [rsp + 0x70]
call fcn.1802547d0
mov rbx, rax
mov r8, rbx
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.18005c660
mov ebx, 1
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.18005cb40
mov eax, ebx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x18020b290
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov rdi, rdx
mov dword [rsp + 0x38], 0x208
lea rax, [rsp + 0x30]
xor ebx, ebx
lea rdx, str.EUDC936
mov qword [rsp + 0x30], rbx
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18020b2fc
xor eax, eax
jmp 0x18020b37a
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.180233580
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.SystemDefaultEUDCFont
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x18020b34b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18020b2f8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [rsp + 0x40], bx
je 0x18020b365
lea rcx, [rsp + 0x40]
call fcn.1802547d0
mov rbx, rax
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.18005c660
mov eax, 1
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18020b5c8
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rdx
lea rax, [rsp + 0x30]
xor edi, edi
mov qword [rsp + 0x20], rax
lea rdx, str.EUDC936
mov qword [rsp + 0x30], rdi
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18020b630
xor r8d, r8d
mov dl, 1
mov rcx, rbx
call fcn.18005cb40
xor eax, eax
jmp 0x18020b6b7
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.180233580
cmp qword [rbx + 0x18], 8
jb 0x18020b64e
mov rdx, qword [rbx]
jmp 0x18020b651
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1802547b4
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x30]
lea rdx, str.SystemDefaultEUDCFont
mov r9d, 1
xor r8d, r8d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18020b69d
lea edi, [rax + 1]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r8d, r8d
mov dl, 1
mov rcx, rbx
call fcn.18005cb40
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret

Function at 0x18020b884
Capabilities:
Delete registry key

Disassembly:
jmp 0x18020bb78
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov qword [rbp - 0x10], 7
lea rcx, [0x180283ae8]
mov qword [rbp - 0x18], rbx
mov word [rbp - 0x28], bx
call fcn.1802547d0
mov r8, rax
lea rdx, [0x180283ae8]
lea rcx, [rbp - 0x28]
call fcn.18005c660
lea rax, [rbp - 0x30]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftWareMicrosoftWindowsCurrentVersionUninstall
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18020bc10
cmp qword [rbp - 0x10], 8
lea rdx, [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r8d, r8d
mov qword [rbp - 0x30], rbx
mov dl, 1
lea rcx, [rbp - 0x28]
call fcn.18005cb40
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret