joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18020b88c
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
xor r14d, r14d
mov qword [rbp - 0x19], r14
lea rax, [rbp - 0x29]
cmp rax, rdx
je 0x18020b8fe
mov rbx, qword [rdx]
mov qword [rbp - 0x29], rbx
mov qword [rdx], r14
mov rsi, qword [rdx + 8]
mov qword [rbp - 0x21], rsi
mov qword [rdx + 8], r14
mov rax, qword [rdx + 0x10]
mov qword [rbp - 0x19], rax
mov qword [rdx + 0x10], r14
jmp 0x18020b9b3
mov rsi, qword [rbp - 0x21]
mov rbx, qword [rbp - 0x29]
jmp 0x18020b9b3
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r14
mov word [rbp - 9], r14w
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 9]
call fcn.18005cbe0
nop
lea r8, str.Dict
lea rdx, [rbp - 9]
lea rcx, [rbp + 0x17]
call fcn.180065eb0
nop
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rcx, qword [rbp + 0x17]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18020b992
lea rcx, [0x1802ace18]
call fcn.1802547d0
mov r9, rax
xor r8d, r8d
lea rdx, [0x1802ace18]
lea rcx, [rbp + 0x17]
call fcn.18005fea0
cmp rax, 0xffffffffffffffff
jne 0x18020b992
lea rdx, [rbp - 9]
mov rcx, rdi
call fcn.180064a30
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x17]
call fcn.18005cb40
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 9]
call fcn.18005cb40
add rbx, 0x20
cmp rbx, rsi
jne 0x18020b90b
lea rcx, [rbp - 0x29]
call fcn.180069730
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18020b9ec
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5e8]
sub rsp, 0x6d0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x5c0], rax
mov rsi, r8
mov rdi, rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3b0]
call fcn.180233580
mov r8, rdi
lea rdx, [0x1802ac140]
lea rcx, [rbp + 0x3b0]
call fcn.18005c530
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18020bb46
xor r14d, r14d
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x18020bb46
cmp word [rsp + 0x7c], 0x2e
je 0x18020ba75
movzx eax, word [rsp + 0x7e]
test ax, ax
je 0x18020ba75
cmp ax, 0x2e
jne 0x18020baaa
cmp word [rbp - 0x80], r14w
je 0x18020ba75
test byte [rsp + 0x50], 0x10
je 0x18020ba75
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1a0]
call fcn.180233580
lea r9, [rsp + 0x7c]
mov r8, rdi
lea rdx, [0x1802abd18]
lea rcx, [rbp + 0x1a0]
call fcn.18005c530
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], r14
mov word [rsp + 0x28], r14w
cmp word [rbp + 0x1a0], r14w
jne 0x18020bb03
mov rax, r14
jmp 0x18020bb0f
lea rcx, [rbp + 0x1a0]
call fcn.1802547d0
mov r8, rax
lea rdx, [rbp + 0x1a0]
lea rcx, [rsp + 0x28]
call fcn.18005c660
nop
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.180064b30
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x28]
call fcn.18005cb40
jmp 0x18020ba75
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x5c0]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x18020bb78
Capabilities:
Delete registry key

Disassembly:
jmp 0x18020bb78
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov qword [rbp - 0x10], 7
lea rcx, [0x180283ae8]
mov qword [rbp - 0x18], rbx
mov word [rbp - 0x28], bx
call fcn.1802547d0
mov r8, rax
lea rdx, [0x180283ae8]
lea rcx, [rbp - 0x28]
call fcn.18005c660
lea rax, [rbp - 0x30]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftWareMicrosoftWindowsCurrentVersionUninstall
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18020bc10
cmp qword [rbp - 0x10], 8
lea rdx, [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
cmovae rdx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r8d, r8d
mov qword [rbp - 0x30], rbx
mov dl, 1
lea rcx, [rbp - 0x28]
call fcn.18005cb40
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18020bc3c
Capabilities:
Set registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x360], rax
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000000
lea rdx, str.WnWBImeDictFile
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x18020bdcd
mov rcx, qword [rsp + 0x30]
lea r9, str.WnWBImeDictFile
and dword [rsp + 0x20], eax
lea r8d, [rax + 1]
lea rdx, [0x1802abc2c]
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x208
call fcn.180233580
call fcn.180208104
mov rcx, rax
call fcn.18020a518
mov r8, rax
lea r9, str.WnDictInst.exe
lea rdx, [0x1802abef8]
lea rcx, [rbp + 0x150]
call fcn.18005c530
mov rcx, qword [rsp + 0x30]
lea r9, [rbp + 0x150]
mov r8d, 1
mov dword [rsp + 0x20], 0x104
lea rdx, str.DefaultIcon
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.180233580
call fcn.180208104
mov rcx, rax
call fcn.18020a518
mov r8, rax
lea r9, str.WnDictInst.exe
lea rdx, str.__s_s___install
lea rcx, [rsp + 0x40]
call fcn.18005c530
lea rdx, [0x180283bc4]
lea rcx, [rsp + 0x40]
call fcn.180254ad8
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
mov r8d, 1
mov dword [rsp + 0x20], 0x104
lea rdx, str.shellopencommand_
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000000
lea rdx, str..wncl
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x18020bdcd
mov rcx, qword [rsp + 0x38]
lea r9, str.WnWBImeDictFile
lea r8d, [rax + 1]
mov dword [rsp + 0x20], 0x104
lea rdx, [0x1802abc2c]
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x470
pop rbp
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.18020be04
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x18020bc3c
Function at 0x18020be04
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], r14
push rbp
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x360], rax
mov rsi, 0xffffffff80000000
lea r8, [rsp + 0x38]
mov rcx, rsi
lea rdx, str.WnWBImeSkinFile
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x18020bfe1
mov rcx, qword [rsp + 0x38]
lea r14d, [rax + 1]
and dword [rsp + 0x20], eax
lea r9, str.WnWBImeSkinFile
mov r8d, r14d
lea rdx, [0x1802abc2c]
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x208
call fcn.180233580
call fcn.180208104
mov rcx, rax
call fcn.18020a518
mov r8, rax
lea r9, str.WnSkinInst.exe
lea rdx, [0x1802abef8]
lea rcx, [rbp + 0x150]
call fcn.18005c530
mov rcx, qword [rsp + 0x38]
lea r9, [rbp + 0x150]
mov r8d, r14d
mov dword [rsp + 0x20], 0x104
lea rdx, str.DefaultIcon
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.180233580
call fcn.180208104
mov rcx, rax
call fcn.18020a518
mov r8, rax
lea r9, str.WnSkinInst.exe
lea rdx, str.__s_s___install
lea rcx, [rsp + 0x40]
call fcn.18005c530
lea rdx, [0x180283bc4]
lea rcx, [rsp + 0x40]
call fcn.180254ad8
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
mov r8d, r14d
mov dword [rsp + 0x20], 0x104
lea rdx, str.shellopencommand_
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x30]
mov rcx, rsi
lea rdx, str..wnpf
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x18020bfe1
mov rcx, qword [rsp + 0x30]
lea r9, str.WnWBImeSkinFile
mov r8d, r14d
mov dword [rsp + 0x20], 0x104
lea rdx, [0x1802abc2c]
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x30]
mov rcx, rsi
lea rdx, str..swnpf
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x18020bfe1
mov rcx, qword [rsp + 0x30]
lea r9, str.WnWBImeSkinFile
mov r8d, r14d
mov dword [rsp + 0x20], 0x104
lea rdx, [0x1802abc2c]
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x470]
mov rsi, qword [r11 + 0x10]
mov r14, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x18020c008
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x1802abc2c]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18020c066
mov rcx, qword [rsp + 0x48]
lea rdx, str.WnWBImeDictFile
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x48]
lea rdx, str..wncl
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.18020c088
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x18020c008
Function at 0x18020c088
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x1802abc2c]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18020c0f8
mov rcx, qword [rsp + 0x48]
lea rdx, str.WnWBImeSkinFile
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x48]
lea rdx, str..wnpf
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x48]
lea rdx, str..swnpf
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret

Function at 0x18020c100
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x1b8]
sub rsp, 0x2b0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x70]
call fcn.180233580
xor r9d, r9d
lea r8d, [r9 + 0x10]
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor esi, esi
test eax, eax
je 0x18020c2f1
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x48], si
cmp word [rbp - 0x70], si
jne 0x18020c186
mov eax, esi
jmp 0x18020c18f
lea rcx, [rbp - 0x70]
call fcn.1802547d0
mov r8, rax
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x48]
call fcn.18005c660
nop
lea rcx, [0x1802abc78]
call fcn.1802547d0
mov r8, rax
lea rdx, [0x1802abc78]
lea rcx, [rsp + 0x48]
call fcn.18005ffc0
lea rcx, [0x1802af220]
call fcn.1802547d0
mov r8, rax
lea rdx, [0x1802af220]
lea rcx, [rsp + 0x48]
call fcn.18005ffc0
lea rcx, str..lnk
call fcn.1802547d0
mov r8, rax
lea rdx, str..lnk
lea rcx, [rsp + 0x48]
call fcn.18005ffc0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18020c2e2
call fcn.180208104
mov rcx, rax
call fcn.18020a518
mov rbx, rax
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], rsi
mov word [rsp + 0x68], si
cmp word [rax], si
jne 0x18020c24c
mov rax, rsi
jmp 0x18020c254
mov rcx, rbx
call fcn.1802547d0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.18005c660
nop
lea rcx, str.wnwb.exe
call fcn.1802547d0
mov r8, rax
lea rdx, str.wnwb.exe
lea rcx, [rsp + 0x68]
call fcn.18005ffc0
lea r8, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae r8, qword [rsp + 0x68]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
mov eax, 0x657
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], 1
lea r9, [0x180283c60]
mov rcx, rdi
call fcn.18020c31c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x68]
call fcn.18005cb40
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.18005cb40
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
jmp 0x18020c100
Function at 0x18020c31c
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ecx, ecx
mov rdi, r9
mov rsi, r8
mov r14, rdx
xor ebx, ebx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x18020c430
lea rax, [rbp - 0x10]
xor edx, edx
lea r9, [0x18027f0a0]
mov qword [rsp + 0x20], rax
lea r8d, [rbx + 1]
lea rcx, [0x18027f0b0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18020c42a
mov rcx, qword [rbp - 0x10]
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0xa0]
test rdi, rdi
je 0x18020c39f
mov rcx, qword [rbp - 0x10]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x38]
mov edx, dword [rbp + 0x30]
test edx, edx
je 0x18020c3b0
mov rcx, qword [rbp - 0x10]
mov rax, qword [rcx]
call qword [rax + 0x78]
movzx edx, word [rbp + 0x38]
test dx, dx
je 0x18020c3c3
mov rcx, qword [rbp - 0x10]
mov rax, qword [rcx]
call qword [rax + 0x68]
mov rdx, qword [rbp + 0x40]
test rdx, rdx
je 0x18020c3d6
mov rcx, qword [rbp - 0x10]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rdx, qword [rbp + 0x48]
test rdx, rdx
je 0x18020c3e9
mov rcx, qword [rbp - 0x10]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rbp - 0x10]
lea r8, [rbp - 8]
lea rdx, [0x18027f0c0]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x18020c420
mov rcx, qword [rbp - 8]
xor r8d, r8d
mov rdx, r14
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov ebx, 1
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x18020c44c
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x1b8]
sub rsp, 0x2b0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x70]
call fcn.180233580
xor r9d, r9d
lea r8d, [r9 + 0x10]
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor esi, esi
test eax, eax
je 0x18020c2f1
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x48], si
cmp word [rbp - 0x70], si
jne 0x18020c186
mov eax, esi
jmp 0x18020c18f
lea rcx, [rbp - 0x70]
call fcn.1802547d0
mov r8, rax
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x48]
call fcn.18005c660
nop
lea rcx, [0x1802abc78]
call fcn.1802547d0
mov r8, rax
lea rdx, [0x1802abc78]
lea rcx, [rsp + 0x48]
call fcn.18005ffc0
lea rcx, [0x1802af220]
call fcn.1802547d0
mov r8, rax
lea rdx, [0x1802af220]
lea rcx, [rsp + 0x48]
call fcn.18005ffc0
lea rcx, str..lnk
call fcn.1802547d0
mov r8, rax
lea rdx, str..lnk
lea rcx, [rsp + 0x48]
call fcn.18005ffc0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18020c2e2
call fcn.180208104
mov rcx, rax
call fcn.18020a518
mov rbx, rax
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], rsi
mov word [rsp + 0x68], si
cmp word [rax], si
jne 0x18020c24c
mov rax, rsi
jmp 0x18020c254
mov rcx, rbx
call fcn.1802547d0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.18005c660
nop
lea rcx, str.wnwb.exe
call fcn.1802547d0
mov r8, rax
lea rdx, str.wnwb.exe
lea rcx, [rsp + 0x68]
call fcn.18005ffc0
lea r8, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae r8, qword [rsp + 0x68]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
mov eax, 0x657
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], 1
lea r9, [0x180283c60]
mov rcx, rdi
call fcn.18020c31c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x68]
call fcn.18005cb40
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.18005cb40
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
jmp 0x18020c100
Function at 0x18020e450
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
jne 0x18020e491
mov dword [rsp + 0x20], edx
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 2]
call fcn.180211790
xor al, al
jmp 0x18020e631
call fcn.18020dac0
mov qword [rdi + 8], 0xffffffffffffffff
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rbx
call fcn.18023bc70
mov rcx, rbx
call fcn.18023c1b0
movsxd rsi, eax
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.18023bc70
test esi, esi
jne 0x18020e4e4
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea edx, [rsi + 0xd]
mov rcx, rdi
call fcn.180211790
xor al, al
jmp 0x18020e631
lea r15, [0x180340558]
mov qword [rsp + 0x88], r15
mov r14, rsi
mov rdx, rsi
lea rcx, [rsp + 0x88]
call fcn.18020f840
lea eax, [rsi + 1]
movsxd rcx, eax
call fcn.180203f3c
mov rsi, rax
mov byte [rax], 0
mov r9, rbx
mov r8d, 1
mov rdx, r14
mov rcx, rax
call fcn.18023996c
cmp rax, 1
je 0x18020e550
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rdi
call fcn.180211790
jmp 0x18020e616
mov rdx, rsi
mov rbx, rsi
mov byte [r14 + rsi], 0
cmp byte [rsi], 0
je 0x18020e5d8
movzx eax, byte [rbx]
cmp al, 0xa
jne 0x18020e585
mov r8, rbx
sub r8, rdx
inc r8
lea rcx, [rsp + 0x88]
call fcn.18020f6e0
inc rbx
mov rdx, rbx
jmp 0x18020e5d3
cmp al, 0xd
jne 0x18020e5d0
mov r8, rbx
sub r8, rdx
test r8, r8
jle 0x18020e5a1
lea rcx, [rsp + 0x88]
call fcn.18020f6e0
mov byte [rsp + 0x78], 0xa
mov r8d, 1
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x88]
call fcn.18020f6e0
lea rdx, [rbx + 1]
cmp byte [rdx], 0xa
jne 0x18020e5cb
lea rdx, [rbx + 2]
mov rbx, rdx
jmp 0x18020e5d3
inc rbx
cmp byte [rbx], 0
jne 0x18020e560
sub rbx, rdx
je 0x18020e5ed
mov r8, rbx
lea rcx, [rsp + 0x88]
call fcn.18020f6e0
mov rcx, rsi
call fcn.180085310
mov rax, qword [rdi]
mov rdx, qword [rsp + 0x88]
add rdx, 0x10
mov r9d, ebp
xor r8d, r8d
mov rcx, rdi
call qword [rax + 0x10]
cmp byte [rdi + 0x50], 0
je 0x18020e61a
xor bl, bl
jmp 0x18020e61c
mov bl, 1
mov rcx, qword [rsp + 0x88]
cmp rcx, r15
je 0x18020e62e
call fcn.180085310
movzx eax, bl
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1802121dc
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r14
sub rsp, 0x1d0
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov r14, r8
lea rbx, [0x180332190]
mov rdi, rcx
cmp dword [rbx], edx
je 0x180212226
add rbx, 0x68
lea rax, [0x180332c88]
cmp rbx, rax
jl 0x18021220b
xor al, al
jmp 0x1802122ff
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x190
call fcn.180233580
lea rax, [rdi + 8]
cmp qword [rax + 0x18], 8
jb 0x180212246
mov rax, qword [rax]
lea r8, [rbx + 0x48]
cmp qword [r8 + 0x18], 8
jb 0x180212254
mov r8, qword [r8]
lea rdx, [rbx + 0x28]
cmp qword [rdx + 0x18], 8
jb 0x180212262
mov rdx, qword [rdx]
lea rcx, [rbx + 8]
cmp qword [rcx + 0x18], 8
jb 0x180212270
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SetErrorInfo
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor esi, esi
cmp word [rsp + 0x30], si
jne 0x180212295
mov eax, esi
jmp 0x18021229f
lea rcx, [rsp + 0x30]
call fcn.1802547d0
lea rdi, [r14 + 8]
mov r8, rax
mov rcx, rdi
lea rdx, [rsp + 0x30]
call fcn.18005c660
mov eax, dword [rbx + 4]
mov dword [r14], eax
cmp dword [rbx + 4], 1
jne 0x1802122d7
cmp qword [rdi + 0x18], 8
jb 0x1802122cb
mov rcx, qword [rdi]
jmp 0x1802122ce
mov rcx, rdi
call fcn.18023b52c
mov dword [r14 + 4], eax
cmp dword [rbx + 4], 3
jne 0x1802122fd
cmp qword [rdi + 0x18], 8
jb 0x1802122e7
mov rdi, qword [rdi]
mov rcx, rdi
call fcn.18023b52c
test eax, eax
mov dword [r14 + 4], eax
setg sil
mov dword [r14 + 0x28], esi
mov al, 1
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x1f8]
add rsp, 0x1d0
pop r14
pop rdi
pop rsi
ret

Function at 0x180214474
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x180214487
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.180214aec
lea rdx, [0x18032da50]
lea rcx, [rsp + 0x20]
call fcn.180232de8
int3

Function at 0x1802206f0
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x180340688]
xor edx, edx
jmp fcn.180214474

Function at 0x1802210dc
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x180340688]
jmp fcn.180214474
Function at 0x18024c624
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x18024c444
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18024c444
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18024c444
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18024c444
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18024c444
cmp dword [rcx + 0x84], 0xe
jbe 0x18024c444
cmp dword [rcx + 0xf8], esi
je 0x18024c444
mov ecx, r14d
call fcn.18024c58c
mov ecx, 2
call fcn.180250204
nop
cmp byte [0x180340978], 0
jne 0x18024c50e
mov r15d, 1
mov eax, r15d
xchg dword [0x18034096c], eax
test ebx, ebx
jne 0x18024c4b7
mov rdi, qword [0x180332088]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x180340970]
cmp rcx, rax
je 0x18024c4ae
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.180058ab0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x180340cc8]
jmp 0x18024c4c3
cmp ebx, r15d
jne 0x18024c4c9
lea rcx, [0x180340ce0]
call fcn.1802541cc
nop
test ebx, ebx
jne 0x18024c4e0
lea rdx, [0x18027f088]
lea rcx, [0x18027f060]
call fcn.180254420
lea rdx, [0x18027f098]
lea rcx, [0x18027f090]
call fcn.180254420
movzx eax, byte [0x180340978]
test esi, esi
cmove eax, r15d
mov byte [0x180340978], al
jmp 0x18024c50e
mov ecx, 2
call fcn.180250258
test esi, esi
jne 0x18024c525
mov ecx, r14d
call fcn.18024c540
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x18024c3d4