joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802eab5
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.18013e0c
test al, al
je 0x1802eb4c
call fcn.1802f50f
test al, al
jne 0x1802eb4c
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x1802eaf2
call fcn.18018dce
mov ebx, eax
jmp 0x1802eb48
lea ecx, [ebp - 4]
call fcn.180647b8
push 2
push dword [ebp - 4]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1802eb24
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1802eb2f
call fcn.18018dce
mov ebx, eax
test esi, esi
je 0x1802eb36
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.1800694d
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x1802eb4e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1802f1d9
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 8], eax
call fcn.1802fc87
test al, al
je 0x1802f1f7
xor eax, eax
jmp 0x1802f2a4
call fcn.1802e770
mov esi, eax
mov ecx, esi
call fcn.18019f92
test esi, esi
jns 0x1802f210
mov eax, esi
jmp 0x1802f2a4
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x1802f23c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1802f2a2
movzx ebx, bx
or ebx, 0x80070000
jmp 0x1802f2a2
lea ecx, [ebp - 4]
call fcn.1806484e
push 2
push dword [ebp - 4]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1802f270
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 8]
push 1
push 3
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x1802f289
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1802f285
movzx ebx, bx
or ebx, 0x80070000
test esi, esi
je 0x1802f290
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.1800694d
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1802f2a9
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0xf003f
xor edi, edi
mov ebx, ecx
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x1802f2df
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x1802f34e
movzx edi, di
or edi, 0x80070000
jmp 0x1802f34e
lea ecx, [ebp - 8]
call fcn.1806484e
lea ecx, [ebp - 4]
call fcn.1802fc23
push edi
push edi
push str.RPCSS
push edi
push edi
push ebx
push 1
push 3
push 0x10
push 0xf01ff
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x1802f332
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x1802f335
movzx edi, di
or edi, 0x80070000
jmp 0x1802f335
push eax
call ebx
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.1800694d
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.1800694d
push esi
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1802f5e1
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 8], eax
call fcn.1802fe07
test al, al
je 0x1802f5ff
xor eax, eax
jmp 0x1802f6ac
call fcn.1802ec98
mov esi, eax
mov ecx, esi
call fcn.18019f92
test esi, esi
jns 0x1802f618
mov eax, esi
jmp 0x1802f6ac
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x1802f644
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1802f6aa
movzx ebx, bx
or ebx, 0x80070000
jmp 0x1802f6aa
lea ecx, [ebp - 4]
call fcn.180647b8
push 2
push dword [ebp - 4]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1802f678
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 8]
push 1
push 2
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x1802f691
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1802f68d
movzx ebx, bx
or ebx, 0x80070000
test esi, esi
je 0x1802f698
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.1800694d
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1802f6b1
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0xf003f
xor edi, edi
mov ebx, ecx
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x1802f6e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x1802f756
movzx edi, di
or edi, 0x80070000
jmp 0x1802f756
lea ecx, [ebp - 8]
call fcn.180647b8
lea ecx, [ebp - 4]
call fcn.1802fda3
push edi
push edi
push str.RPCSS
push edi
push edi
push ebx
push 1
push 2
push 0x10
push 0xf01ff
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x1802f73a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x1802f73d
movzx edi, di
or edi, 0x80070000
jmp 0x1802f73d
push eax
call ebx
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.1800694d
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.1800694d
push esi
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x180302ea
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x1822b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push edi
push eax
xor edi, edi
lea eax, [ebp - 0x204]
push edi
push dword [ebp + 0xc]
push 0xff
push 0x100
push eax
call fcn.18007203
push dword [eax + 4]
push dword [eax]
call fcn.1817c8eb
xor eax, eax
add esp, 0x20
mov word [ebp - 6], ax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], eax
cmp dword [esi + 0x260], edi
jne 0x18030350
push eax
call fcn.1817f3cb
pop ecx
lea eax, [esi + 0x40]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x1803037f
push edi
lea eax, [ebp - 0x208]
push eax
push edi
push 1
push edi
push edi
push edi
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.181605f4
leave
ret
Function at 0x180305cd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
mov esi, 0x1822ce00
push edi
mov edi, ecx
cmp dword [0x1822ce00], ebx
je 0x18030603
push ecx
mov ecx, esi
call fcn.18029ab3
mov ebx, eax
mov ecx, ebx
call fcn.18019f92
test ebx, ebx
js 0x18030646
add esi, 0x24
xor ebx, ebx
cmp dword [esi], ebx
jne 0x180305e5
cmp byte [edi + 0x3c], 0
je 0x18030675
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x1803063f
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push edi
push 0x18030792
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x1803064a
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x80004005
jmp 0x18030681
mov eax, ebx
jmp 0x18030688
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x1803066c
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1803067d
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x18030686
call fcn.1803058c
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x180306d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
mov esi, 0x1822ced0
push edi
mov edi, ecx
cmp dword [0x1822ced0], ebx
je 0x18030706
push ecx
mov ecx, esi
call fcn.18029ab3
mov ebx, eax
mov ecx, ebx
call fcn.18019f92
test ebx, ebx
js 0x18030749
add esi, 0x24
xor ebx, ebx
cmp dword [esi], ebx
jne 0x180306e8
cmp byte [edi + 0x3c], 0
je 0x18030778
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x18030742
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push edi
push 0x18030792
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x1803074d
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x80004005
jmp 0x18030784
mov eax, ebx
jmp 0x1803078b
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x1803076f
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18030780
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x18030789
call fcn.1803068f
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x18033570
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x1c]
and dword [edi + 0x1c], 0
test ecx, ecx
je 0x18033585
mov eax, dword [ecx]
push 1
call dword [eax]
mov esi, dword [edi + 0x18]
and dword [edi + 0x18], 0
test esi, esi
je 0x180335a1
mov ecx, esi
call fcn.180675fd
push 0x24
push esi
call fcn.18160b12
pop ecx
pop ecx
mov ecx, dword [0x18233edc]
pop edi
pop esi
mov ecx, dword [ecx]
jmp fcn.1802be06

Function at 0x18035a3b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
mov byte [ebp - 5], cl
mov bh, dl
push edi
lea ecx, [ebp - 0x10]
call fcn.180131e6
mov edi, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
push edi
call fcn.18006e68
mov bl, byte [ebp + 8]
mov eax, str.MicrosoftEdgeComRegisterShellARM64.exe
test bl, bl
jne 0x18035a6e
mov eax, str.MicrosoftEdgeUpdateComRegisterShell64.exe
push eax
lea ecx, [ebp - 0x10]
call fcn.1800e48e
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x18035a8a
call fcn.18018dce
mov ebx, eax
jmp 0x18035b73
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18035a9f
mov ebx, 0x80070002
jmp 0x18035b73
lea ecx, [ebp - 0xc]
call fcn.18009d8f
mov eax, 0x181ca2ec
mov edx, eax
test bh, bh
jne 0x18035ab7
mov edx, str._unregister
cmp byte [ebp - 5], 0
mov ecx, eax
jne 0x18035ac4
mov ecx, str._user
test bl, bl
je 0x18035acd
mov eax, str._arm64
push edx
push ecx
push eax
lea eax, [ebp - 0xc]
push str._s__s__s
push eax
call fcn.1801487e
add esp, 0x10
lea ecx, [ebp - 0x4c]
push esi
call fcn.1801529d
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x4c]
push 0
push 0
push dword [ebp - 0xc]
call dword [eax + 8]
mov ebx, eax
test ebx, ebx
jns 0x18035b40
movzx ecx, byte [0x182340f3]
neg ecx
sbb ecx, ecx
and ecx, 0x18233ff0
je 0x18035b60
push 7
pop edx
push 0xfffffffffffffffe
pop eax
push eax
push edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
call fcn.18008a16
push ebx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push str._Failed_to_start_COM_register_process__0x_x_
push eax
call fcn.18006b74
add esp, 0xc
jmp 0x18035b60
push 0x7530
lea ecx, [ebp - 0x4c]
call fcn.180154f0
movzx ebx, al
neg ebx
sbb ebx, ebx
and ebx, 0x7ff8fa4c
add ebx, 0x800705b4
lea ecx, [ebp - 0x4c]
call fcn.1801539d
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.1800694d
lea ecx, [esi - 0x10]
call fcn.1800694d
lea ecx, [edi - 0x10]
call fcn.1800694d
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x18036e41
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
call fcn.18035847
mov edi, eax
xor ebx, ebx
test edi, edi
je 0x18036e70
cmp dword [edi], ebx
je 0x18036e70
push ecx
mov ecx, edi
call fcn.18029ab3
test eax, eax
js 0x18036ef2
add edi, 0x24
jne 0x18036e57
cmp byte [esi + 0x3c], bl
je 0x18036edd
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x30], eax
test eax, eax
je 0x18036eab
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x180394d6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x18036eb2
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x30], ebx
mov edi, 0x80004005
jmp 0x18036ee9
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov edi, eax
test edi, edi
jns 0x18036ed4
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18036ee5
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov edi, eax
test edi, edi
jns 0x18036ef0
mov ecx, esi
call fcn.18035955
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1803a464
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
mov ebx, ecx
mov eax, dword [edi]
cmp dword [eax - 0xc], esi
jne 0x1803a480
mov eax, 0x80070057
jmp 0x1803a4e9
lea ecx, [ebp - 4]
call fcn.18009d8f
push dword [edi]
lea eax, [ebp - 4]
push str._s_last.dmp
push eax
call fcn.1801487e
lea eax, [ebp - 4]
push eax
lea edx, [ebx + 4]
lea ecx, [ebp + 0xc]
call fcn.18014420
mov eax, dword [ebp + 0xc]
add esp, 0x10
cmp dword [eax - 0xc], esi
jne 0x1803a4b9
mov esi, 0x80040709
jmp 0x1803a4d4
mov ecx, dword [ebp + 8]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1803a4d1
call fcn.18018dce
mov esi, eax
mov eax, dword [ebp + 0xc]
lea ecx, [eax - 0x10]
call fcn.1800694d
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.1800694d
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1803a4f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x1822b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, ecx
lea edi, [ebp - 0x60]
push 0x14
pop ecx
mov esi, str.____________________________________.dmp
lea edx, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, dword [eax + 4]
movsw word es:[edi], word [esi]
xor esi, esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
call fcn.1800f2d2
mov ebx, eax
pop ecx
test ebx, ebx
jns 0x1803a543
mov edi, dword [ebp - 0x68]
mov esi, dword [ebp - 0x6c]
jmp 0x1803a649
call fcn.18010678
mov edi, dword [ebp - 0x68]
mov ebx, esi
mov esi, dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
mov eax, edi
sub eax, esi
mov dword [ebp - 0x7c], edx
cmp eax, 4
jb 0x1803a647
xor edi, edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x70], edi
mov esi, dword [esi + ebx*4]
mov ecx, esi
call fcn.1800f231
movzx eax, al
neg eax
push edi
sbb eax, eax
and eax, 0x2000000
push eax
push 3
push edi
push 1
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1803a5a1
call fcn.18018dce
mov edi, eax
jmp 0x1803a5c2
push 0
push 0
lea eax, [ebp - 0x74]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x1803a5bb
call fcn.18018dce
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
js 0x1803a631
mov eax, dword [ebp - 0x78]
xor ecx, ecx
or ecx, dword [ebp - 0x74]
sub eax, ecx
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0x88], eax
sbb ecx, dword [ebp - 0x70]
and dword [ebp - 0x90], 0
mov eax, ecx
and ecx, 0x7fffffff
and eax, 0x80000000
mov dword [ebp - 0x84], ecx
fild qword [ebp - 0x88]
mov dword [ebp - 0x8c], eax
push ecx
push ecx
fild qword [ebp - 0x90]
fchs
faddp st(1)
fstp qword [esp]
call fcn.1817f056
fcomp qword [0x1821fa50]
fnstsw ax
pop ecx
pop ecx
test ah, 1
jne 0x1803a631
mov eax, dword [ebp - 0x6c]
push dword [eax + ebx*4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp - 0x68]
inc ebx
mov esi, dword [ebp - 0x6c]
mov eax, edi
sub eax, esi
sar eax, 2
cmp ebx, eax
jne 0x1803a563
xor ebx, ebx
test esi, esi
je 0x1803a676
cmp esi, edi
je 0x1803a665
mov ecx, dword [esi]
sub ecx, 0x10
call fcn.1800694d
add esi, 4
cmp esi, edi
jne 0x1803a651
mov esi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
sub ecx, esi
and ecx, 0xfffffffc
push ecx
push esi
call fcn.1800a110
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.181605f4
leave
ret
Function at 0x180486a9
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x180487fc
mov edx, 0x10000000
cmp eax, 0x7c
je 0x180487fc
cmp eax, 0x29
jne 0x180486e2
cmp dword [esi + 0x10], 0
jne 0x180487fc
test dword [esi + 0x50], edx
je 0x18048802
cmp eax, 0x2e
jne 0x180486fd
push 5
lea ecx, [esi + 0x24]
call fcn.180488c5
mov ecx, esi
call fcn.18048680
jmp 0x180487e6
cmp eax, 0x5c
jne 0x18048752
mov ecx, esi
call fcn.18048680
test byte [esi + 0x50], 0x80
je 0x18048746
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x1804872e
push 4
lea ecx, [esi + 0x24]
call fcn.180488c5
mov ecx, esi
call fcn.18048680
jmp 0x180487ed
cmp eax, 0x42
jne 0x18048746
push 4
lea ecx, [esi + 0x24]
call fcn.180488c5
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x18048722
mov ecx, esi
call fcn.180494e5
jmp 0x180487e6
cmp eax, 0x5b
jne 0x18048772
mov ecx, esi
call fcn.18048680
mov ecx, esi
call fcn.18049499
cmp dword [esi + 0x4c], 0x5d
je 0x180486f1
push 4
jmp 0x18048804
cmp eax, 0x28
jne 0x1804878f
mov ecx, esi
call fcn.18048680
mov ecx, esi
call fcn.180495b6
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x18048802
jmp 0x180487db
cmp eax, 0x5e
jne 0x18048798
push 2
jmp 0x1804871a
cmp eax, 0x24
jne 0x180487a4
push 3
jmp 0x1804871a
cmp eax, 0x2a
je 0x180487f8
cmp eax, 0x2b
je 0x180487f8
cmp eax, 0x3f
je 0x180487f8
cmp eax, 0x7b
je 0x180487f8
cmp eax, 0x7d
jne 0x180487c2
test dword [esi + 0x50], edx
je 0x180487f4
cmp eax, 0x5d
jne 0x180487cc
test dword [esi + 0x50], edx
je 0x1804876b
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.1804971f
mov bl, 1
mov ecx, esi
call fcn.18048680
test bl, bl
je 0x180487ed
mov ecx, esi
call fcn.18049637
mov cl, 1
jmp 0x180486b0
push 6
jmp 0x18048804
push 0xa
jmp 0x18048804
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.18047bc1
int3
Function at 0x18050ac4
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x27c
mov eax, dword [0x1822b00c]
xor eax, esp
mov dword [esp + 0x278], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x250
mov dword [esp + 0x18], eax
xor ebx, ebx
lea eax, [esp + 0x34]
mov dword [esp + 0x30], edx
mov esi, ecx
push ebx
push eax
mov dword [esp + 0x1c], esi
call fcn.181757a0
add esp, 0xc
lea ecx, [esp + 0x28]
mov edx, esi
push 0x181f44e8
call fcn.18009b52
pop ecx
lea ecx, [esp + 0x30]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [esp + 0x28]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.1800694d
cmp esi, 0xffffffff
jne 0x18050b64
call fcn.18018dce
mov edi, eax
mov ebx, edi
cmp esi, 0xffffffff
je 0x18050b4d
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x284]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.181605f4
mov esp, ebp
pop ebp
ret
mov edi, ebx
mov eax, dword [esp + 0x2c]
sub eax, ebx
je 0x18050c0e
sub eax, 1
je 0x18050bae
sub eax, 1
jne 0x18050c76
cmp dword [esp + 0x30], 0x80
je 0x18050b95
test byte [esp + 0x30], 0x10
jne 0x18050c6e
push dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x34]
call fcn.18050a1b
pop ecx
mov edi, eax
jmp 0x18050c6e
test byte [esp + 0x30], 0x10
je 0x18050c6e
lea ecx, [esp + 0x30]
call fcn.180509de
test al, al
jne 0x18050c6e
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x1c]
call fcn.18006e68
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
call fcn.18014420
pop ecx
mov ecx, dword [esp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.1800694d
push dword [esp + 0x14]
lea ecx, [esp + 0x20]
push 2
pop edx
call fcn.18050ac4
pop ecx
mov ecx, dword [esp + 0x1c]
jmp 0x18050c64
test byte [esp + 0x30], 0x10
je 0x18050c6e
lea ecx, [esp + 0x30]
call fcn.180509de
test al, al
jne 0x18050c6e
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x24]
call fcn.18006e68
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x28]
call fcn.18014420
pop ecx
mov ecx, dword [esp + 0x20]
lea ecx, [ecx - 0x10]
call fcn.1800694d
push dword [esp + 0x14]
xor edx, edx
lea ecx, [esp + 0x28]
inc edx
call fcn.18050ac4
pop ecx
mov ecx, dword [esp + 0x24]
lea ecx, [ecx - 0x10]
mov edi, eax
call fcn.1800694d
test edi, edi
js 0x18050b3f
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18050b66
jmp 0x18050b46