joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180406bd
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 0xc], eax
call fcn.180410c2
test al, al
je 0x180406e5
xor eax, eax
jmp 0x18040798
call fcn.1803fc9c
mov esi, eax
mov ecx, esi
call fcn.1801ccd7
test esi, esi
jns 0x18040701
lfence
mov eax, esi
jmp 0x18040798
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x1804072d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18040796
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18040796
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.180811cf
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x18040764
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
push 1
push 2
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x1804077d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18040779
movzx ebx, bx
or ebx, 0x80070000
test esi, esi
je 0x18040784
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18007012
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret

Function at 0x180407a7
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
xor ebx, ebx
mov edi, ecx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x180407ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18040861
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18040861
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.180811cf
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
call fcn.18041036
push ebx
push ebx
push str.RPCSS
push ebx
push ebx
push edi
mov edi, dword [ebp - 0xc]
push 1
push 2
push 0x10
push 0xf01ff
push edi
push dword [ebp - 8]
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
jne 0x18040840
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18040847
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18040847
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [edi - 0x10]
call fcn.18007012
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18007012
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret
Function at 0x180415d5
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push edi
push eax
xor edi, edi
lea eax, [ebp - 0x204]
push edi
push dword [ebp + 0xc]
push 0xff
push 0x100
push eax
call fcn.180079af
push dword [eax + 4]
push dword [eax]
call fcn.1813401b
xor eax, eax
add esp, 0x20
mov word [ebp - 6], ax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], eax
cmp dword [esi + 0x260], edi
jne 0x1804163b
push eax
call fcn.1813bda1
pop ecx
lea eax, [esi + 0x40]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x1804166a
push edi
lea eax, [ebp - 0x208]
push eax
push edi
push 1
push edi
push edi
push edi
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18117a58
leave
ret

Function at 0x18041903
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, 0x181c7f60
push edi
mov edi, ecx
cmp dword [0x181c7f60], ebx
je 0x18041944
push ecx
mov ecx, esi
call fcn.1803a3d9
mov ebx, eax
mov ecx, ebx
call fcn.1801ccd7
test ebx, ebx
js 0x180419b2
add esi, 0x24
xor ebx, ebx
cmp dword [esi], ebx
jne 0x18041926
lfence
cmp byte [edi + 0x3c], 0
je 0x180419c0
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x180419b9
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push edi
push 0x18041b10
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x18041987
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x180419b9
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x180419a9
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180419c8
lfence
mov eax, ebx
jmp 0x180419d3
mov esi, 0x80004005
jmp 0x180419cc
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x180419d1
call fcn.180418bf
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret 4
Function at 0x18041a28
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, 0x181c8030
push edi
mov edi, ecx
cmp dword [0x181c8030], ebx
je 0x18041a69
push ecx
mov ecx, esi
call fcn.1803a3d9
mov ebx, eax
mov ecx, ebx
call fcn.1801ccd7
test ebx, ebx
js 0x18041ad7
add esi, 0x24
xor ebx, ebx
cmp dword [esi], ebx
jne 0x18041a4b
lfence
cmp byte [edi + 0x3c], 0
je 0x18041ae5
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x18041ade
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push edi
push 0x18041b10
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x18041aac
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x18041ade
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x18041ace
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18041aed
lfence
mov eax, ebx
jmp 0x18041af8
mov esi, 0x80004005
jmp 0x18041af1
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x18041af6
call fcn.180419e4
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret 4

Function at 0x1804520b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
push edi
push 0
lea ecx, [esi + 0x1c]
call fcn.180468c9
mov edi, dword [esi + 0x18]
and dword [esi + 0x18], 0
test edi, edi
je 0x18045235
mov ecx, edi
call fcn.18084d94
push 0x24
push edi
call fcn.18117f86
pop ecx
pop ecx
mov ecx, dword [0x181cbfac]
pop edi
pop esi
mov ecx, dword [ecx]
jmp fcn.1803caee
Function at 0x18047cfc
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x14], 0
push ebx
push esi
mov byte [ebp - 0x41], cl
mov bh, dl
push edi
lea ecx, [ebp - 0x14]
call fcn.18014af5
mov edi, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
and dword [ebp - 0x10], 0
push edi
call fcn.1800759a
mov bl, byte [ebp + 8]
mov eax, str.MicrosoftEdgeComRegisterShellARM64.exe
test bl, bl
jne 0x18047d41
mov eax, str.MicrosoftEdgeUpdateComRegisterShell64.exe
push eax
lea ecx, [ebp - 0x10]
call fcn.1800f521
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x18047d5d
call fcn.1801b6cc
mov ebx, eax
jmp 0x18047e5f
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18047d72
mov ebx, 0x80070002
jmp 0x18047e5f
and dword [ebp - 0xc], 0
call fcn.1800703b
push eax
lea ecx, [ebp - 0xc]
call fcn.1800774f
mov eax, 0x1816bb7c
mov edx, eax
test bh, bh
jne 0x18047d94
mov edx, str._unregister
cmp byte [ebp - 0x41], 0
mov ecx, eax
jne 0x18047da1
mov ecx, str._user
test bl, bl
je 0x18047daa
mov eax, str._arm64
push edx
push ecx
push eax
lea eax, [ebp - 0xc]
push str._s__s__s
push eax
call fcn.1801682d
add esp, 0x14
lea eax, [ebp - 0x40]
push 0x2c
push 0
push eax
call fcn.1812c700
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.180174a3
push 0
push dword [ebp - 0xc]
lea ecx, [ebp - 0x40]
call fcn.18017610
mov ebx, eax
test ebx, ebx
jns 0x18047e2c
movzx ecx, byte [0x181cc106]
neg ecx
sbb ecx, ecx
and ecx, 0x181cc000
je 0x18047e4c
push 7
pop edx
push 0xfffffffffffffffe
pop eax
lfence
push eax
push edx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], eax
call fcn.18008bfd
push ebx
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x54]
push str._Failed_to_start_COM_register_process__0x_x_
push eax
call fcn.180072d0
add esp, 0xc
jmp 0x18047e4c
push 0x7530
lea ecx, [ebp - 0x40]
call fcn.18017764
movzx ebx, al
neg ebx
sbb ebx, ebx
and ebx, 0x7ff8fa4c
add ebx, 0x800705b4
lea ecx, [ebp - 0x40]
call fcn.180175c8
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.18007012
lea ecx, [esi - 0x10]
call fcn.18007012
lea ecx, [edi - 0x10]
call fcn.18007012
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret
Function at 0x1804951a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.18047ad0
mov edi, eax
xor ebx, ebx
test edi, edi
je 0x18049550
cmp dword [edi], ebx
je 0x18049550
push ecx
mov ecx, edi
call fcn.1803a3d9
test eax, eax
js 0x180495bd
add edi, 0x24
jne 0x1804953b
lfence
cmp byte [esi + 0x3c], bl
je 0x180495c9
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x30], eax
test eax, eax
je 0x180495c2
lea eax, [ebp - 8]
push eax
push ebx
push esi
push 0x1804c000
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x18049592
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x30], ebx
test ebx, ebx
je 0x180495c2
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov edi, eax
test edi, edi
jns 0x180495b4
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180495d1
lfence
jmp 0x180495de
mov edi, 0x80004005
jmp 0x180495d5
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov edi, eax
test edi, edi
jns 0x180495dc
mov ecx, esi
call fcn.18047bed
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret 4
Function at 0x1804d19c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x10], ecx
mov eax, dword [edi]
cmp dword [eax - 0xc], esi
jne 0x1804d1c8
mov eax, 0x80070057
jmp 0x1804d23d
mov dword [ebp - 0xc], esi
call fcn.1800703b
push eax
lea ecx, [ebp - 0xc]
call fcn.1800774f
push dword [edi]
lea eax, [ebp - 0xc]
push str._s_last.dmp
push eax
call fcn.1801682d
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
add edx, 4
mov dword [ebp - 8], esi
lea ecx, [ebp - 8]
call fcn.1801618c
mov eax, dword [ebp - 8]
add esp, 0x10
cmp dword [eax - 0xc], esi
jne 0x1804d210
mov esi, 0x80040709
jmp 0x1804d228
push esi
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1804d225
call fcn.1801b6cc
mov esi, eax
mov eax, dword [ebp - 8]
lea ecx, [eax - 0x10]
call fcn.18007012
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff0
call fcn.18007012
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret 8
Function at 0x1804d24e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, ecx
lea edi, [ebp - 0x60]
push 0x14
pop ecx
mov esi, str.____________________________________.dmp
lea edx, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, dword [eax + 4]
movsw word es:[edi], word [esi]
xor esi, esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
call fcn.180105fa
mov ebx, eax
pop ecx
test ebx, ebx
jns 0x1804d2a1
mov edi, dword [ebp - 0x68]
mov esi, dword [ebp - 0x6c]
jmp 0x1804d3a7
call fcn.18011c3e
mov edi, dword [ebp - 0x68]
mov ebx, esi
mov esi, dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
mov eax, edi
sub eax, esi
mov dword [ebp - 0x7c], edx
cmp eax, 4
jb 0x1804d3a5
xor edi, edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x70], edi
mov esi, dword [esi + ebx*4]
mov ecx, esi
call fcn.18010559
movzx eax, al
neg eax
push edi
sbb eax, eax
and eax, 0x2000000
push eax
push 3
push edi
push 1
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1804d2ff
call fcn.1801b6cc
mov edi, eax
jmp 0x1804d320
push 0
push 0
lea eax, [ebp - 0x74]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x1804d319
call fcn.1801b6cc
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
js 0x1804d38f
mov eax, dword [ebp - 0x78]
xor ecx, ecx
or ecx, dword [ebp - 0x74]
sub eax, ecx
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0x88], eax
sbb ecx, dword [ebp - 0x70]
and dword [ebp - 0x90], 0
mov eax, ecx
and ecx, 0x7fffffff
and eax, 0x80000000
mov dword [ebp - 0x84], ecx
fild qword [ebp - 0x88]
mov dword [ebp - 0x8c], eax
push ecx
push ecx
fild qword [ebp - 0x90]
fchs
faddp st(1)
fstp qword [esp]
call fcn.18139e56
fcomp qword [0x181bccc0]
fnstsw ax
pop ecx
pop ecx
test ah, 1
jne 0x1804d38f
mov eax, dword [ebp - 0x6c]
push dword [eax + ebx*4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp - 0x68]
inc ebx
mov esi, dword [ebp - 0x6c]
mov eax, edi
sub eax, esi
sar eax, 2
cmp ebx, eax
jne 0x1804d2c1
xor ebx, ebx
test esi, esi
je 0x1804d3d4
cmp esi, edi
je 0x1804d3c3
mov ecx, dword [esi]
sub ecx, 0x10
call fcn.18007012
add esi, 4
cmp esi, edi
jne 0x1804d3af
mov esi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
sub ecx, esi
and ecx, 0xfffffffc
push ecx
push esi
call fcn.1800a288
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret
Function at 0x1804d9b5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x181c600c]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x1e], 0
mov dword [edi], 0x18194bd8
je 0x1804d9df
call fcn.1804dfc3
and dword [esp + 0x14], 0
lea ecx, [edi + 4]
and dword [esp + 0x18], 0
mov eax, dword [ecx]
xchg dword [ecx], eax
add eax, 4
lea ecx, [esp + 0x14]
push eax
call fcn.1801548d
lea edx, [edi + 0x3c]
xor ebx, ebx
mov eax, dword [edx + 4]
mov ecx, dword [edx]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x1804da41
mov eax, dword [ecx + ebx*4]
mov dword [esp + 0x10], eax
test eax, eax
je 0x1804da32
mov eax, dword [eax]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x1815b3d4]
mov ecx, dword [esp + 0x14]
call esi
lea edx, [edi + 0x3c]
mov eax, dword [edx + 4]
inc ebx
mov ecx, dword [edx]
sub eax, ecx
sar eax, 2
cmp ebx, eax
jb 0x1804da10
lea edx, [edi + 0x48]
xor ebx, ebx
mov eax, dword [edx + 4]
mov ecx, dword [edx]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x1804da85
mov eax, dword [ecx + ebx*4]
mov dword [esp + 0x10], eax
test eax, eax
je 0x1804da76
mov eax, dword [eax]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x1815b3d4]
mov ecx, dword [esp + 0x14]
call esi
lea edx, [edi + 0x48]
mov eax, dword [edx + 4]
inc ebx
mov ecx, dword [edx]
sub eax, ecx
sar eax, 2
cmp ebx, eax
jb 0x1804da54
mov ebx, dword [edi + 0x38]
and dword [edi + 0x38], 0
test ebx, ebx
je 0x1804daa2
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x1815b3d4]
mov ecx, ebx
call esi
lea eax, [edi + 4]
mov ecx, dword [eax]
xchg dword [eax], ecx
call fcn.18065c74
lea ecx, [esp + 0x14]
call fcn.180154b8
mov ecx, dword [edi + 0x98]
sub ecx, 0x10
call fcn.18007012
lea ecx, [edi + 0x88]
mov esi, 0x181943e8
mov dword [ecx], esi
call fcn.1800bbd0
lea ecx, [edi + 0x78]
mov dword [ecx], esi
call fcn.1800bbd0
lea ecx, [edi + 0x68]
mov dword [ecx], esi
call fcn.1800bbd0
lea ecx, [edi + 0x58]
mov dword [ecx], esi
call fcn.1800bbd0
lea ecx, [edi + 0x54]
call fcn.1803f1b9
lea ecx, [edi + 0x48]
call fcn.1800f9a7
lea ecx, [edi + 0x3c]
call fcn.1800f9a7
mov ebx, dword [edi + 0x38]
test ebx, ebx
je 0x1804db26
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x1815b3d4]
mov ecx, ebx
call esi
mov ecx, dword [edi + 0x30]
push 0x10
pop ebx
sub ecx, ebx
call fcn.18007012
mov ecx, dword [edi + 0x2c]
sub ecx, ebx
call fcn.18007012
mov ecx, dword [edi + 0x28]
sub ecx, ebx
call fcn.18007012
mov ecx, dword [edi + 0x18]
sub ecx, ebx
call fcn.18007012
mov ecx, dword [edi + 0x14]
sub ecx, ebx
call fcn.18007012
mov ecx, dword [edi + 0x10]
sub ecx, ebx
call fcn.18007012
lea ecx, [edi + 8]
call fcn.18050701
lea ecx, [edi + 4]
call fcn.1804d7fe
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.18117a58
mov esp, ebp
pop ebp
ret
Function at 0x1806060b
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor al, al
mov ecx, dword [esi + 0x4c]
cmp ecx, 0xffffffff
je 0x18060767
mov edx, 0x10000000
cmp ecx, 0x7c
je 0x18060767
cmp ecx, 0x29
jne 0x1806064b
cmp dword [esi + 0x10], 0
jne 0x18060767
lea edi, [esi + 0x50]
test dword [edi], edx
je 0x1806076b
jmp 0x18060725
lea edi, [esi + 0x50]
cmp ecx, 0x2e
jne 0x18060669
push 5
lea ecx, [esi + 0x24]
call fcn.1806083b
mov ecx, esi
call fcn.180605e2
jmp 0x18060755
cmp ecx, 0x5c
jne 0x180606bf
mov ecx, esi
call fcn.180605e2
test byte [edi], 0x80
je 0x180606b3
movzx eax, word [esi + 0x48]
mov ecx, eax
cmp eax, 0x62
jne 0x1806069b
push 4
lea ecx, [esi + 0x24]
call fcn.1806083b
mov ecx, esi
call fcn.180605e2
jmp 0x1806075c
cmp ecx, 0x42
jne 0x180606b3
push 4
lea ecx, [esi + 0x24]
call fcn.1806083b
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x1806068f
mov ecx, esi
call fcn.1806117f
jmp 0x18060755
cmp ecx, 0x5b
jne 0x180606df
mov ecx, esi
call fcn.180605e2
mov ecx, esi
call fcn.18061133
cmp dword [esi + 0x4c], 0x5d
je 0x1806065d
push 4
jmp 0x1806076d
cmp ecx, 0x28
jne 0x180606fc
mov ecx, esi
call fcn.180605e2
mov ecx, esi
call fcn.18061250
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x1806076b
jmp 0x1806074a
cmp ecx, 0x5e
jne 0x18060705
push 2
jmp 0x18060687
cmp ecx, 0x24
jne 0x18060711
push 3
jmp 0x18060687
cmp ecx, 0x2a
je 0x18060763
cmp ecx, 0x2b
je 0x18060763
cmp ecx, 0x3f
je 0x18060763
cmp ecx, 0x7b
je 0x18060763
cmp ecx, 0x7d
jne 0x18060732
test dword [edi], edx
jne 0x1806073b
push 6
jmp 0x1806076d
cmp ecx, 0x5d
jne 0x1806073b
test dword [edi], edx
je 0x180606d8
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.180613b7
mov bl, 1
mov ecx, esi
call fcn.180605e2
test bl, bl
je 0x1806075c
mov ecx, esi
call fcn.180612d5
mov al, 1
jmp 0x18060612
push 0xa
jmp 0x1806076d
pop edi
pop esi
pop ebx
ret
push 5
call fcn.1805fcdf
int3
Function at 0x180696e0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x274
mov eax, dword [0x181c600c]
xor eax, esp
mov dword [esp + 0x270], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x250
mov dword [esp + 0x14], eax
xor edi, edi
lea eax, [esp + 0x2c]
mov dword [esp + 0x20], edx
mov ebx, ecx
push edi
push eax
mov dword [esp + 0x18], ebx
call fcn.1812c700
add esp, 0xc
lea ecx, [esp + 0x20]
mov edx, ebx
push 0x18198080
call fcn.18009d3c
pop ecx
lea ecx, [esp + 0x28]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [esp + 0x20]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.18007012
cmp esi, 0xffffffff
jne 0x18069780
call fcn.1801b6cc
mov ebx, eax
mov edi, ebx
cmp esi, 0xffffffff
je 0x18069769
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x27c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.18117a58
mov esp, ebp
pop ebp
ret
mov ebx, edi
mov eax, dword [esp + 0x1c]
sub eax, edi
je 0x18069820
sub eax, 1
je 0x180697ca
sub eax, 1
jne 0x1806988c
cmp dword [esp + 0x28], 0x80
je 0x180697b1
test byte [esp + 0x28], 0x10
jne 0x18069884
push dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x2c]
call fcn.1806961b
pop ecx
mov ebx, eax
jmp 0x18069884
test byte [esp + 0x28], 0x10
je 0x18069884
lea ecx, [esp + 0x28]
call fcn.180695de
test al, al
jne 0x18069884
lea eax, [esp + 0x54]
mov dword [esp + 0x24], edi
push eax
lea ecx, [esp + 0x18]
call fcn.1800759a
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
call fcn.1801618c
pop ecx
mov ecx, dword [esp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.18007012
push dword [esp + 0x10]
push 2
pop edx
jmp 0x1806986c
test byte [esp + 0x28], 0x10
je 0x18069884
lea ecx, [esp + 0x28]
call fcn.180695de
test al, al
jne 0x18069884
lea eax, [esp + 0x54]
mov dword [esp + 0x24], edi
push eax
lea ecx, [esp + 0x1c]
call fcn.1800759a
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.1801618c
pop ecx
mov ecx, dword [esp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.18007012
push dword [esp + 0x10]
xor edx, edx
inc edx
lea ecx, [esp + 0x28]
call fcn.180696e0
pop ecx
mov ecx, dword [esp + 0x24]
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.18007012
test ebx, ebx
js 0x1806975b
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18069782
jmp 0x18069762