Function at 0x180682d7
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x72c
mov eax, dword [0x180af1d0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x724], 0
push ebx
push esi
mov esi, ecx
mov al, byte [esi]
mov byte [ebp - 0x710], al
test al, al
push edi
mov dword [ebp - 0x728], esi
mov eax, str.GoogleUpdateTask
jne 0x18068312
mov eax, str.GoogleUpdateTaskUser
push eax
lea eax, [ebp - 0x704]
call fcn.18003b7f
mov edi, dword [ebp - 0x704]
push edi
call fcn.18075156
pop ecx
push dword [ebp - 0x710]
lea ebx, [ebp - 0x704]
call fcn.18075291
mov ebx, dword [ebp - 0x704]
pop ecx
push ebx
call fcn.18075156
pop ecx
lea eax, [ebx - 0x10]
call fcn.18003e0a
lea eax, [edi - 0x10]
call fcn.18003e0a
cmp byte [esi], 0
je 0x18068374
xor ebx, ebx
inc ebx
call fcn.1805251d
lea eax, [ebp - 0x724]
call fcn.180528ed
jmp 0x18068387
push 2
pop ebx
call fcn.1805251d
lea eax, [ebp - 0x72c]
call fcn.18052742
mov eax, dword [eax]
sub eax, 0x10
call fcn.1800392c
mov esi, eax
add esi, 0x10
mov dword [ebp - 0x718], esi
test bl, 2
je 0x180683b2
mov eax, dword [ebp - 0x72c]
add eax, 0xfffffff0
and ebx, 0xfffffffd
call fcn.18003e0a
test bl, 1
je 0x180683c5
mov eax, dword [ebp - 0x724]
add eax, 0xfffffff0
call fcn.18003e0a
xor edi, edi
cmp dword [esi - 0xc], edi
jne 0x180683ea
mov edi, 0x8000ffff
lea eax, [esi - 0x10]
call fcn.18003e0a
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18075e75
leave
ret
push 0x24c
lea eax, [ebp - 0x254]
push edi
push eax
mov dword [ebp - 0x258], edi
call fcn.180769e0
add esp, 0xc
push esi
lea eax, [ebp - 0x708]
call fcn.18003b7f
push 0x1809ccbc
lea eax, [ebp - 0x708]
call fcn.180057d9
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x708]
call ebx
mov dword [ebp - 0x714], eax
cmp eax, 0xffffffff
jne 0x1806846a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x18068455
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, dword [ebp - 0x708]
add eax, 0xfffffff0
call fcn.18003e0a
jmp 0x180683d1
push str.DealPlyLiveUpdateDownload
lea eax, [ebp - 0x700]
call fcn.18003b7f
mov eax, dword [ebp - 0x700]
push dword [eax - 0xc]
lea esi, [ebp - 0x700]
call fcn.18003ce3
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
or eax, 0xffffffff
call fcn.18003baa
mov edi, 0x250
push dword [ebp - 0x718]
lea eax, [ebp - 0x70c]
call fcn.18003b7f
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x70c]
call fcn.180057d9
test byte [ebp - 0x258], 0x10
lea eax, [ebp - 0x22c]
jne 0x180684f9
push str.DealPlyLive.exe
push eax
call fcn.18076ee5
pop ecx
pop ecx
test eax, eax
je 0x180686d9
mov esi, dword [ebp - 0x70c]
call fcn.18004a3d
jmp 0x180686d9
push 0x1809c3c0
push eax
call fcn.180793ba
pop ecx
pop ecx
test eax, eax
je 0x180686d9
lea eax, [ebp - 0x22c]
push 0x1809c398
push eax
call fcn.180793ba
pop ecx
pop ecx
test eax, eax
je 0x180686d9
mov eax, dword [ebp - 0x728]
push dword [eax + 4]
lea eax, [ebp - 0x22c]
push eax
call fcn.18076ee5
pop ecx
pop ecx
test eax, eax
je 0x180686d9
push dword [ebp - 0x700]
lea eax, [ebp - 0x22c]
push eax
call fcn.18076ee5
pop ecx
pop ecx
test eax, eax
je 0x180686d9
mov esi, dword [ebp - 0x70c]
add esi, 0xfffffff0
mov eax, esi
call fcn.1800392c
add eax, 0x10
mov dword [ebp - 0x71c], eax
push str.npGoogleOneClick.dll
lea eax, [ebp - 0x71c]
call fcn.180057d9
push edi
lea eax, [ebp - 0x6f8]
push 0
push eax
call fcn.180769e0
add esp, 0xc
lea eax, [ebp - 0x6f8]
push eax
push dword [ebp - 0x71c]
call ebx
mov dword [ebp - 0x704], eax
inc eax
neg eax
sbb eax, eax
and eax, dword [fcn.1800a31f]
je 0x180685fd
mov eax, esi
call fcn.1800392c
add eax, 0x10
mov dword [ebp - 0x6fc], eax
lea eax, [ebp - 0x6cc]
push eax
lea eax, [ebp - 0x6fc]
call fcn.180057d9
push dword [ebp - 0x6fc]
call fcn.18004ae0
mov eax, dword [ebp - 0x6fc]
pop ecx
add eax, 0xfffffff0
call fcn.18003e0a
mov eax, esi
call fcn.1800392c
add eax, 0x10
mov dword [ebp - 0x6fc], eax
push str.npGoogleUpdate.dll
lea eax, [ebp - 0x6fc]
call fcn.180057d9
push edi
lea eax, [ebp - 0x4a8]
push 0
push eax
call fcn.180769e0
add esp, 0xc
lea eax, [ebp - 0x4a8]
push eax
push dword [ebp - 0x6fc]
call ebx
mov dword [ebp - 0x710], eax
inc eax
neg eax
sbb eax, eax
and eax, dword [fcn.1800a31f]
je 0x18068688
mov eax, esi
call fcn.1800392c
add eax, 0x10
mov dword [ebp - 0x720], eax
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x720]
call fcn.180057d9
mov esi, dword [ebp - 0x720]
push esi
call fcn.18004ae0
pop ecx
lea eax, [esi - 0x10]
call fcn.18003e0a
mov esi, dword [ebp - 0x70c]
call fcn.18004a3d
cmp dword [ebp - 0x710], 0xffffffff
je 0x180686a8
push dword [ebp - 0x710]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x6fc]
add eax, 0xfffffff0
call fcn.18003e0a
cmp dword [ebp - 0x704], 0xffffffff
je 0x180686cb
push dword [ebp - 0x704]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x71c]
add eax, 0xfffffff0
call fcn.18003e0a
mov eax, dword [ebp - 0x70c]
add eax, 0xfffffff0
call fcn.18003e0a
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x714]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180684a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x18068750
test eax, eax
jle 0x1806871b
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, dword [ebp - 0x700]
add eax, 0xfffffff0
call fcn.18003e0a
push dword [ebp - 0x714]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x708]
add eax, 0xfffffff0
call fcn.18003e0a
mov esi, dword [ebp - 0x718]
jmp 0x180683d1
call fcn.1805251d
push 0x180a930c
push str.HKLMSoftwareDealPlyLiveUpdate_
call fcn.1800c5f1
pop ecx
pop ecx
call fcn.1805251d
mov eax, dword [ebp - 0x728]
movzx eax, byte [eax]
push 0x180a5dd8
push eax
call fcn.1801216b
push eax
call fcn.1800c5f1
mov eax, dword [ebp - 0x700]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.18003e0a
push dword [ebp - 0x714]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x708]
add eax, 0xfffffff0
call fcn.18003e0a
xor edi, edi
jmp 0x18068745