joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18018b18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
call fcn.180b59e0
cmp byte [edi + 0x88], 0
mov eax, str.HKLMSoftwareGoogleUpdate_
jne 0x18018b3b
mov eax, str.HKCUSoftwareGoogleUpdate_
push eax
lea ecx, [ebp - 0xc]
call fcn.18006e44
mov esi, dword [ebp - 0xc]
lea ecx, [ebp - 0x1c]
and dword [ebp - 0x18], 0
push 0x20019
push esi
mov dword [ebp - 0x1c], 0x181a9c78
mov dword [ebp - 0x14], 0x200
call fcn.180126f7
mov ebx, eax
mov ecx, ebx
call fcn.18014c58
test ebx, ebx
js 0x18018ca0
lea ecx, [ebp - 0x1c]
call fcn.18013483
test eax, eax
je 0x18018c9b
push str.Clients
lea ecx, [ebp - 0x1c]
call fcn.18012740
test al, al
je 0x18018c9b
push str.ClientState
lea ecx, [ebp - 0x1c]
call fcn.18012740
test al, al
je 0x18018c9b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor eax, eax
push eax
push eax
push eax
push eax
push str.version
push dword [ebp - 0x18]
call ebx
test eax, eax
jne 0x18018c9b
push eax
push eax
push eax
push eax
push str.path
push dword [ebp - 0x18]
call ebx
test eax, eax
jne 0x18018c9b
call fcn.180040b1
push eax
lea ecx, [ebp - 4]
call fcn.1800717c
lea eax, [ebp - 4]
push eax
push str.version
lea ecx, [ebp - 0x1c]
call fcn.18012ba7
mov ebx, eax
mov ecx, ebx
call fcn.18014c58
test ebx, ebx
js 0x18018c8e
call fcn.180b59e0
cmp byte [edi + 0x88], 0
mov eax, str.HKLMSoftwareGoogleUpdateClients430FD4D0_B729_4F61_AA34_91526481799D
jne 0x18018c2a
mov eax, str.HKCUSoftwareGoogleUpdateClients430FD4D0_B729_4F61_AA34_91526481799D
push eax
lea ecx, [ebp - 0x10]
call fcn.18006e44
call fcn.180040b1
push eax
lea ecx, [ebp - 8]
call fcn.1800717c
mov edi, dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
mov edx, 0x181aaf90
mov ecx, edi
call fcn.1801457c
pop ecx
mov ebx, eax
mov ecx, ebx
call fcn.18014c58
mov esi, dword [ebp - 8]
test ebx, ebx
js 0x18018c7b
push esi
lea ecx, [ebp - 4]
call fcn.1800c345
test eax, eax
je 0x18018c79
mov ebx, 0xa043090b
jmp 0x18018c7b
xor ebx, ebx
lea ecx, [esi - 0x10]
call fcn.18004715
lea ecx, [edi - 0x10]
call fcn.18004715
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.18004715
jmp 0x18018ca0
mov ebx, 0x80070003
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x181a9c78
call fcn.18012552
lea ecx, [esi - 0x10]
call fcn.18004715
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x18018d96
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor esi, esi
mov ebx, ecx
push esi
push esi
push str.GOOGLE_UPDATE_NO_CRASH_HANDLER
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x18018eba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x18018dd9
test eax, eax
jle 0x18018dd3
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x18018eba
lea edi, [ebx + 0x90]
mov ecx, dword [edi]
test ecx, ecx
je 0x18018dec
mov dword [edi], esi
call fcn.1801a0a9
lea ecx, [ebp - 0x18]
call fcn.1800f1bf
call fcn.180040b1
push eax
lea ecx, [ebp - 8]
call fcn.1800717c
push dword [ebx + 0xc]
lea eax, [ebp - 8]
push 0x181ab26c
push eax
call fcn.1800f2dc
add esp, 0xc
lea ecx, [ebp - 4]
push str.CommandLineMode
call fcn.18006e44
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x18]
call fcn.1801b897
mov esi, dword [ebp - 0xc]
cmp esi, dword [ebp - 0x18]
je 0x18018e4a
push dword [esi + 0x10]
lea ecx, [ebp - 4]
call fcn.1800c345
test eax, eax
jns 0x18018e65
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push ecx
push esi
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
call fcn.1801b8d4
mov esi, dword [eax]
lea eax, [ebp - 8]
push eax
lea ecx, [esi + 0x14]
call fcn.18006dec
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.18004715
mov cl, byte [ebx + 0x88]
lea edx, [ebp - 0x18]
push edi
call fcn.180b2ed5
pop ecx
mov ecx, dword [ebp - 8]
mov esi, eax
add ecx, 0xfffffff0
call fcn.18004715
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x18]
push dword [ecx + 4]
mov ecx, eax
push eax
call fcn.1800f25d
push 0x18
push dword [ebp - 0x18]
call fcn.1800a736
pop ecx
pop ecx
mov eax, esi
jmp 0x18018ebd
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x18019a56
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.1801125c
test al, al
je 0x18019aed
call fcn.1801a35d
test al, al
jne 0x18019aed
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x18019a93
call fcn.18013e1e
mov ebx, eax
jmp 0x18019ae9
lea ecx, [ebp - 4]
call fcn.1804c319
push 2
push dword [ebp - 4]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x18019ac5
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x18019acc
call fcn.18013e1e
mov ebx, eax
test esi, esi
je 0x18019ad7
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.18004715
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x18019aef
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x18019d6c
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.1801125c
test al, al
je 0x18019e03
call fcn.1801a6a5
test al, al
jne 0x18019e03
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x18019da9
call fcn.18013e1e
mov ebx, eax
jmp 0x18019dff
lea ecx, [ebp - 4]
call fcn.1804c279
push 2
push dword [ebp - 4]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x18019ddb
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x18019de2
call fcn.18013e1e
mov ebx, eax
test esi, esi
je 0x18019ded
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.18004715
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x18019e05
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1801a42f
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 8], eax
call fcn.1801ab84
test al, al
je 0x1801a44d
xor eax, eax
jmp 0x1801a4fa
call fcn.18019c23
mov esi, eax
mov ecx, esi
call fcn.18014c58
test esi, esi
jns 0x1801a466
mov eax, esi
jmp 0x1801a4fa
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x1801a492
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1801a4f8
movzx ebx, bx
or ebx, 0x80070000
jmp 0x1801a4f8
lea ecx, [ebp - 4]
call fcn.1804c319
push 2
push dword [ebp - 4]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1801a4c6
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 8]
push 1
push 3
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x1801a4db
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1801a4db
movzx ebx, bx
or ebx, 0x80070000
test esi, esi
je 0x1801a4e6
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.18004715
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1801a777
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 8], eax
call fcn.1801ad10
test al, al
je 0x1801a795
xor eax, eax
jmp 0x1801a842
call fcn.18019f39
mov esi, eax
mov ecx, esi
call fcn.18014c58
test esi, esi
jns 0x1801a7ae
mov eax, esi
jmp 0x1801a842
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x1801a7da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1801a840
movzx ebx, bx
or ebx, 0x80070000
jmp 0x1801a840
lea ecx, [ebp - 4]
call fcn.1804c279
push 2
push dword [ebp - 4]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1801a80e
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 8]
push 1
push 2
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x1801a823
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1801a823
movzx ebx, bx
or ebx, 0x80070000
test esi, esi
je 0x1801a82e
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.18004715
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1801a847
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0xf003f
xor ebx, ebx
mov edi, ecx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x1801a87d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1801a8ec
movzx ebx, bx
or ebx, 0x80070000
jmp 0x1801a8ec
lea ecx, [ebp - 4]
call fcn.1804c279
lea ecx, [ebp - 8]
call fcn.1801aca0
push ebx
push ebx
push str.RPCSS
push ebx
push ebx
push edi
mov edi, dword [ebp - 8]
push 1
push 2
push 0x10
push 0xf01ff
push edi
push dword [ebp - 4]
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
jne 0x1801a8cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1801a8d2
movzx ebx, bx
or ebx, 0x80070000
jmp 0x1801a8d2
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [edi - 0x10]
call fcn.18004715
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.18004715
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x1801b1b9
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x181cf008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push edi
push eax
xor edi, edi
lea eax, [ebp - 0x204]
push edi
push dword [ebp + 0xc]
push 0xff
push 0x100
push eax
call fcn.1800454a
push dword [eax + 4]
push dword [eax]
call fcn.1815299c
xor eax, eax
add esp, 0x20
mov word [ebp - 6], ax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], eax
cmp dword [esi + 0x260], edi
jne 0x1801b21f
push eax
call fcn.18154a3a
pop ecx
lea eax, [esi + 0x40]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x1801b24e
push edi
lea eax, [ebp - 0x208]
push eax
push edi
push 1
push edi
push edi
push edi
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18145fe4
leave
ret

Function at 0x1801b47f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x181d0d70], 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, 0x181d0d70
je 0x1801b4b7
push ecx
mov ecx, ebx
call fcn.18014e5e
mov esi, eax
mov ecx, esi
call fcn.18014c58
test esi, esi
js 0x1801b534
add ebx, 0x24
cmp dword [ebx], 0
jne 0x1801b496
xor ebx, ebx
mov esi, ebx
test esi, esi
js 0x1801b555
jne 0x1801b552
cmp byte [edi + 0x3c], 0
je 0x1801b53f
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x1801b538
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push edi
push 0x1801b6bf
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x1801b509
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1801b538
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x1801b52b
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [edi + 0x34]
add eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1801b547
xor ebx, ebx
jmp 0x1801b4bb
mov esi, 0x80004005
jmp 0x1801b54b
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x1801b555
call fcn.1801b63d
jmp 0x1801b555
mov byte [edi + 0x3c], bl
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x1801b55e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x181d0e30], 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, 0x181d0e30
je 0x1801b596
push ecx
mov ecx, ebx
call fcn.18014e5e
mov esi, eax
mov ecx, esi
call fcn.18014c58
test esi, esi
js 0x1801b613
add ebx, 0x24
cmp dword [ebx], 0
jne 0x1801b575
xor ebx, ebx
mov esi, ebx
test esi, esi
js 0x1801b634
jne 0x1801b631
cmp byte [edi + 0x3c], 0
je 0x1801b61e
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x1801b617
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push edi
push 0x1801b6bf
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x1801b5e8
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1801b617
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x1801b60a
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [edi + 0x34]
add eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1801b626
xor ebx, ebx
jmp 0x1801b59a
mov esi, 0x80004005
jmp 0x1801b62a
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x1801b634
call fcn.1801b67e
jmp 0x1801b634
mov byte [edi + 0x3c], bl
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x1801e0b8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x1c]
and dword [esi + 0x1c], 0
test ecx, ecx
je 0x1801e0cc
mov eax, dword [ecx]
push 1
call dword [eax]
push 0
lea ecx, [esi + 0x18]
call fcn.1801f0f0
mov ecx, dword [0x181d5de8]
pop esi
mov ecx, dword [ecx]
jmp fcn.180172be
Function at 0x1802210a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push edi
xor edi, edi
mov bl, dl
mov bh, cl
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [ebp - 4]
mov ecx, eax
call fcn.180a5210
test eax, eax
je 0x18022224
cmp dword [ebp - 4], edi
je 0x18022224
push esi
lea ecx, [ebp - 0xc]
call fcn.1800e7fd
push dword [ebp - 0xc]
lea ecx, [ebp - 8]
call fcn.18006e44
push str.GoogleUpdateComRegisterShell64.exe
lea ecx, [ebp - 8]
call fcn.18009e3d
mov esi, dword [ebp - 8]
test eax, eax
jne 0x18022170
call fcn.18013e1e
mov ebx, eax
jmp 0x1802220c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18022185
mov ebx, 0x80070002
jmp 0x1802220c
call fcn.180040b1
push eax
lea ecx, [ebp - 8]
call fcn.1800717c
mov eax, 0x18181c4c
mov ecx, eax
test bl, bl
jne 0x180221a3
mov ecx, str._unregister
test bh, bh
jne 0x180221ac
mov eax, str._user
push ecx
push eax
lea eax, [ebp - 8]
push 0x181ad9f8
push eax
call fcn.1800f2dc
add esp, 0xc
lea ecx, [ebp - 0x38]
push esi
call fcn.1800f5e1
push edi
push edi
mov edi, dword [ebp - 8]
lea ecx, [ebp - 0x38]
push edi
call fcn.1800f755
mov ebx, eax
test ebx, ebx
js 0x180221fc
push 0x7530
lea ecx, [ebp - 0x38]
call fcn.1800f839
movzx ebx, al
neg ebx
sbb ebx, ebx
and ebx, 0x7ff8fa4c
add ebx, 0x800705b4
lea ecx, [ebp - 0x38]
call fcn.1800f6fc
lea ecx, [edi - 0x10]
call fcn.18004715
lea ecx, [esi - 0x10]
call fcn.18004715
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.18004715
mov eax, ebx
pop esi
jmp 0x18022226
xor eax, eax
pop edi
pop ebx
leave
ret

Function at 0x18023599
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
call fcn.18021ef6
mov ebx, eax
test ebx, ebx
je 0x180235c9
cmp dword [ebx], 0
je 0x180235c9
push ecx
mov ecx, ebx
call fcn.18014e5e
mov esi, eax
test esi, esi
js 0x18023646
add ebx, 0x24
jne 0x180235ad
xor ebx, ebx
mov esi, ebx
test esi, esi
js 0x18023669
jne 0x18023666
cmp byte [edi + 0x3c], 0
je 0x18023651
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x1802364a
lea eax, [ebp - 4]
push eax
push ebx
push edi
push 0x18025a28
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x1802361b
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [edi + 0x30], ebx
test ebx, ebx
je 0x1802364a
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x1802363d
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [edi + 0x34]
add eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18023659
xor ebx, ebx
jmp 0x180235cd
mov esi, 0x80004005
jmp 0x1802365d
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x18023669
mov ecx, edi
call fcn.18022022
jmp 0x18023669
mov byte [edi + 0x3c], bl
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x18026093
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x181cf008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
lea eax, [ebp - 0x210]
push 0x208
push esi
mov ebx, 0x181a9bf4
mov dword [ebp - 0x220], esi
push eax
mov edi, ecx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x218], esi
call fcn.18148b00
lea ecx, [ebp - 0x224]
mov dword [esp], 0x20008
call fcn.18007f9f
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x220]
push 0x1c
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
js 0x1802613a
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x214]
call fcn.18006e44
mov edx, edi
lea ecx, [ebp - 0x214]
call fcn.18008574
mov ecx, dword [ebp - 0x214]
mov esi, eax
add ecx, 0xfffffff0
call fcn.18004715
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x224], ebx
call fcn.18007fd8
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18145fe4
leave
ret
Function at 0x18026eb5
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
xor edi, edi
mov eax, dword [esi]
cmp dword [eax - 0xc], edi
jne 0x18026ed1
mov eax, 0x80070057
jmp 0x18026f3d
call fcn.180040b1
push eax
lea ecx, [ebp + 0xc]
call fcn.1800717c
push dword [esi]
lea eax, [ebp + 0xc]
push str._s_last.dmp
push eax
call fcn.1800f2dc
lea eax, [ebp + 0xc]
push eax
lea edx, [ebx + 4]
lea ecx, [ebp - 4]
call fcn.1800eeae
mov esi, dword [ebp - 4]
add esp, 0x10
cmp dword [esi - 0xc], edi
jne 0x18026f10
mov edi, 0x80040709
jmp 0x18026f28
mov eax, dword [ebp + 8]
push edi
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x18026f28
call fcn.18013e1e
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.18004715
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.18004715
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x18026f44
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x181cf008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, ecx
lea edi, [ebp - 0x60]
push 0x14
pop ecx
mov esi, str.____________________________________.dmp
lea edx, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x70]
xor ebx, ebx
push ecx
mov ecx, dword [eax + 4]
movsw word es:[edi], word [esi]
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
call fcn.1800aa6f
mov esi, eax
pop ecx
test esi, esi
js 0x18027092
call fcn.1800be1f
mov edi, dword [ebp - 0x6c]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x70]
sub edi, eax
mov dword [ebp - 0x80], edx
cmp edi, 4
jb 0x18027090
sar edi, 2
and dword [ebp - 0x78], 0
and dword [ebp - 0x74], 0
mov esi, dword [eax + ebx*4]
mov ecx, esi
call fcn.18008227
movzx eax, al
neg eax
push 0
sbb eax, eax
and eax, 0x2000000
push eax
push 3
push 0
push 1
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
xor eax, eax
mov dword [ebp - 0x64], eax
cmp esi, 0xffffffff
jne 0x18026ff2
call fcn.18013e1e
jmp 0x18027015
push eax
push eax
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x1802700b
call fcn.18013e1e
mov dword [ebp - 0x64], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x64]
test eax, eax
js 0x18027084
mov eax, dword [ebp - 0x7c]
xor ecx, ecx
or ecx, dword [ebp - 0x78]
sub eax, ecx
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x88], eax
sbb ecx, dword [ebp - 0x74]
and dword [ebp - 0x90], 0
mov eax, ecx
and ecx, 0x7fffffff
and eax, 0x80000000
mov dword [ebp - 0x84], ecx
fild qword [ebp - 0x88]
mov dword [ebp - 0x8c], eax
push ecx
push ecx
fild qword [ebp - 0x90]
fchs
faddp st(1)
fstp qword [esp]
call fcn.18154c02
fcomp qword [0x181c8fa0]
fnstsw ax
pop ecx
pop ecx
test ah, 1
jne 0x18027084
mov eax, dword [ebp - 0x70]
push dword [eax + ebx*4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x70]
inc ebx
cmp ebx, edi
jne 0x18026faf
xor esi, esi
lea ecx, [ebp - 0x70]
call fcn.1800b4cd
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18145fe4
leave
ret
Function at 0x1803308f
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x180331e2
mov edx, 0x10000000
cmp eax, 0x7c
je 0x180331e2
cmp eax, 0x29
jne 0x180330c8
cmp dword [esi + 0x10], 0
jne 0x180331e2
test dword [esi + 0x50], edx
je 0x180331e8
cmp eax, 0x2e
jne 0x180330e3
push 5
lea ecx, [esi + 0x24]
call fcn.180332bb
mov ecx, esi
call fcn.18033066
jmp 0x180331cc
cmp eax, 0x5c
jne 0x18033138
mov ecx, esi
call fcn.18033066
test byte [esi + 0x50], 0x80
je 0x1803312c
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x18033114
push 4
lea ecx, [esi + 0x24]
call fcn.180332bb
mov ecx, esi
call fcn.18033066
jmp 0x180331d3
cmp eax, 0x42
jne 0x1803312c
push 4
lea ecx, [esi + 0x24]
call fcn.180332bb
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x18033108
mov ecx, esi
call fcn.18034129
jmp 0x180331cc
cmp eax, 0x5b
jne 0x18033158
mov ecx, esi
call fcn.18033066
mov ecx, esi
call fcn.180340dd
cmp dword [esi + 0x4c], 0x5d
je 0x180330d7
push 4
jmp 0x180331ea
cmp eax, 0x28
jne 0x18033175
mov ecx, esi
call fcn.18033066
mov ecx, esi
call fcn.18034202
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x180331e8
jmp 0x180331c1
cmp eax, 0x5e
jne 0x1803317e
push 2
jmp 0x18033100
cmp eax, 0x24
jne 0x1803318a
push 3
jmp 0x18033100
cmp eax, 0x2a
je 0x180331de
cmp eax, 0x2b
je 0x180331de
cmp eax, 0x3f
je 0x180331de
cmp eax, 0x7b
je 0x180331de
cmp eax, 0x7d
jne 0x180331a8
test dword [esi + 0x50], edx
je 0x180331da
cmp eax, 0x5d
jne 0x180331b2
test dword [esi + 0x50], edx
je 0x18033151
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.180343cb
mov bl, 1
mov ecx, esi
call fcn.18033066
test bl, bl
je 0x180331d3
mov ecx, esi
call fcn.180342f1
mov cl, 1
jmp 0x18033096
push 6
jmp 0x180331ea
push 0xa
jmp 0x180331ea
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.180324c8
int3