Function at 0x18002fda0
Capabilities:
Enumerate files on windows
Print debug messages
Read .ini file

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x16a0
call fcn.180056f80
sub rsp, rax
mov rax, qword [0x1800a2de8]
xor rax, rsp
mov qword [rsp + 0x1690], rax
mov qword [rsp + 0x120], rsp
mov r15, r8
mov qword [rsp + 0x100], r8
mov rdi, rdx
mov rbx, rcx
xor esi, esi
mov r13d, esi
mov r14d, esi
mov word [rsp + 0x140], si
xor eax, eax
mov qword [rsp + 0x142], rax
mov dword [rsp + 0x14a], eax
mov word [rsp + 0x14e], ax
mov word [rsp + 0x150], si
mov qword [rsp + 0x152], rax
mov dword [rsp + 0x15a], eax
mov word [rsp + 0x15e], ax
mov dword [rsp + 0x160], esi
xor edx, edx
mov r8d, 0x24c
lea rcx, [rsp + 0x164]
call fcn.180056c20
mov qword [rsp + 0xd8], 0xffffffffffffffff
mov qword [rsp + 0xc0], rsi
lea rax, str..css
mov qword [rsp + 0x3b0], rax
lea rax, str..gif
mov qword [rsp + 0x3b8], rax
lea rax, str..png
mov qword [rsp + 0x3c0], rax
lea rax, str..jpg
mov qword [rsp + 0x3c8], rax
lea rax, str..jpeg
mov qword [rsp + 0x3d0], rax
lea rax, str..bmp
mov qword [rsp + 0x3d8], rax
lea rax, str..ico
mov qword [rsp + 0x3e0], rax
lea rax, str..eot
mov qword [rsp + 0x3e8], rax
mov qword [rsp + 0x118], rsi
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
movabs rax, 0x165a0bc00
sub qword [rsp + 0xd0], rax
mov r8, rbx
mov edx, 0x104
lea rcx, [rsp + 0xa70]
call fcn.180054b48
lea r8, str.MozillaFirefox
mov edx, 0x104
lea rcx, [rsp + 0xa70]
call fcn.18005384c
mov r8, rdi
mov edx, 0x104
lea rcx, [rsp + 0x860]
call fcn.180054b48
lea r8, str.MozillaFirefox
mov edx, 0x104
lea rcx, [rsp + 0x860]
call fcn.18005384c
lea r8, [rsp + 0xa70]
lea rdx, str._sprofiles.ini
lea rcx, [rsp + 0x650]
call fcn.180003d50
lea rax, [rsp + 0x650]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x103
lea r9, [rsp + 0xc80]
lea r8, [0x180088b34]
lea rdx, str.Path
lea rcx, str.Profile0
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x18003008f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0x1e]
mov dword [rsp + 0xb8], edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rax + 0x1e]
mov ecx, 0x1000a
call fcn.180053ad4
mov rbx, rax
test rax, rax
jne 0x18002fffa
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x180030065
lea r8, [0x180088a64]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a70
test eax, eax
jle 0x180030042
mov byte [rbx + 0xffff], 0
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
lea r9, str.GetUserCacheFilesFromFF
mov edx, 0x349
mov r8d, 1
lea rcx, str...StandAloneSvcExploitFiles.cpp
call fcn.180001b40
jmp 0x18003005d
mov edx, esi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call fcn.180053a94
mov dword [rsp + 0x128], edi
lea rdx, [0x180030083]
mov rcx, qword [rsp + 0x120]
call fcn.180057580
nop
nop
nop
mov eax, dword [rsp + 0xb8]
jmp 0x180030c6f
lea r9, [rsp + 0xc80]
lea r8, [rsp + 0x860]
lea rdx, str._s_scache2entries.
lea rcx, [rsp + 0x650]
call fcn.180003d50
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x650]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
mov qword [rsp + 0xd8], rax
cmp rax, 0xffffffffffffffff
jne 0x1800301c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0x1e]
mov dword [rsp + 0xb8], edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rax + 0x1e]
mov ecx, 0x1000a
call fcn.180053ad4
mov rbx, rax
test rax, rax
jne 0x180030124
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x18003018f
lea r8, [0x180088a64]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a70
test eax, eax
jle 0x18003016c
mov byte [rbx + 0xffff], 0
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
lea r9, str.GetUserCacheFilesFromFF
mov edx, 0x34f
mov r8d, 1
lea rcx, str...StandAloneSvcExploitFiles.cpp
call fcn.180001b40
jmp 0x180030187
mov edx, esi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call fcn.180053a94
mov dword [rsp + 0x138], edi
lea rdx, [0x1800301ad]
mov rcx, qword [rsp + 0x120]
call fcn.180057580
nop
nop
nop
mov eax, dword [rsp + 0xb8]
jmp 0x180030c6f
lea rdx, [0x180089400]
lea rcx, [rsp + 0x18c]
call fcn.180052ca8
test eax, eax
je 0x1800306bb
lea rdx, [0x180089404]
lea rcx, [rsp + 0x18c]
call fcn.180052ca8
test eax, eax
je 0x1800306bb
mov eax, dword [rsp + 0x180]
mov dword [rsp + 0xc0], eax
mov eax, dword [rsp + 0x17c]
mov dword [rsp + 0xc4], eax
mov rbx, qword [rsp + 0xc0]
lea rax, [rbx - 1]
cmp rax, 0x1dfffff
ja 0x1800306bb
mov r9d, 8
lea r8, [rsp + 0x16c]
mov edx, r9d
lea rcx, [rsp + 0xe8]
call fcn.180055cbc
mov rax, qword [rsp + 0xd0]
cmp qword [rsp + 0xe8], rax
jb 0x1800306bb
lea rax, [rsp + 0x18c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x860]
lea r8, str._s_scache2entries_s
mov edx, 0x104
lea rcx, [rsp + 0x440]
call fcn.180053a4c
lea rdx, [rsp + 0xe90]
lea rcx, [rsp + 0x440]
call fcn.180030ca0
test eax, eax
je 0x1800303e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0x1e]
mov qword [rsp + 0xc8], rsi
mov ecx, 0x1000a
call fcn.180053ad4
mov rsi, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test rsi, rsi
je 0x1800303a9
test rax, rax
je 0x1800303a9
lea r9, [rsp + 0x440]
lea r8, [0x18008890c]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x180030392
xor eax, eax
mov word [rbx + 0x1fffe], ax
lea rdx, [rax - 2]
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, rsi
lea rcx, [rsp + 0xc8]
call fcn.180054798
test eax, eax
je 0x180030369
mov r8d, edi
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
lea r9, str.GetUserCacheFilesFromFF
mov edx, 0x369
mov r8d, 1
lea rcx, str...StandAloneSvcExploitFiles.cpp
call fcn.180001b40
jmp 0x1800303c2
mov edx, edi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x1800303bc
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rsi, rsi
je 0x1800303cf
mov rcx, rsi
call fcn.180053a94
test rbx, rbx
je 0x1800306b9
mov rcx, rbx
call fcn.180053a94
jmp 0x1800306b9
mov edx, 0x2e
lea rcx, [rsp + 0xe90]
call fcn.180054988
mov r10, rax
test rax, rax
je 0x18003045e
mov r9d, esi
mov dword [rsp + 0xb0], esi
nop dword [rax]
cmp r9d, 8
jge 0x18003045e
movsxd rdx, r9d
mov rcx, r10
mov r8, qword [rsp + rdx*8 + 0x3b0]
sub r8, r10
nop word [rax + rax]
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x180030443
inc rcx
test eax, eax
jne 0x180030430
test edx, edx
je 0x180030454
inc r9d
mov dword [rsp + 0xb0], r9d
jmp 0x180030410
cmp r9d, 8
jl 0x1800306bb
mov eax, dword [r15 + 0x20c]
cmp eax, 0x28
jae 0x180030476
mov r14d, eax
mov dword [rsp + 0xf0], eax
jmp 0x1800304dc
mov r8d, 1
mov dword [rsp + 0xb0], r8d
movsxd rax, r14d
cmp r8d, 0x28
jge 0x1800304bf
imul rdx, rax, 0x3228
movsxd rax, r8d
imul rcx, rax, 0x3228
mov rax, qword [rdx + r15 + 0x1420]
cmp qword [rcx + r15 + 0x1420], rax
cmovb r14d, r8d
mov dword [rsp + 0xf0], r14d
inc r8d
jmp 0x18003047c
imul rcx, rax, 0x3228
mov rax, qword [rcx + r15 + 0x1420]
cmp qword [rsp + 0xe8], rax
jb 0x1800306bb
movsxd rax, r14d
imul rsi, rax, 0x3228
add rsi, r15
xor edx, edx
mov r8d, 0x3228
lea rcx, [rsi + 0x210]
call fcn.180056c20
mov qword [rsi + 0x1418], rbx
mov rax, qword [rsp + 0xe8]
mov qword [rsi + 0x1420], rax
lea rcx, [rsi + 0x1428]
mov r9d, 8
lea r8, [rsp + 0x174]
mov edx, r9d
call fcn.180055cbc
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0xe90]
mov r8d, 0x800
lea rdx, [rsi + 0x210]
lea rcx, [rsp + 0x118]
call fcn.1800559b0
test eax, eax
je 0x18003068b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0x1e]
xor eax, eax
mov qword [rsp + 0xb8], rax
mov ecx, 0x1000a
call fcn.180053ad4
mov rsi, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test rsi, rsi
je 0x180030656
test rax, rax
je 0x180030656
lea r9, [rsp + 0x440]
lea r8, [0x18008890c]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x18003063f
xor eax, eax
mov word [rbx + 0x1fffe], ax
lea rdx, [rax - 2]
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, rsi
lea rcx, [rsp + 0xb8]
call fcn.180054798
test eax, eax
je 0x180030616
mov r8d, edi
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
lea r9, str.GetUserCacheFilesFromFF
mov edx, 0x396
mov r8d, 1
lea rcx, str...StandAloneSvcExploitFiles.cpp
call fcn.180001b40
jmp 0x18003066f
mov edx, edi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x180030669
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rsi, rsi
je 0x18003067c
mov rcx, rsi
call fcn.180053a94
test rbx, rbx
je 0x1800306b9
mov rcx, rbx
call fcn.180053a94
jmp 0x1800306b9
lea rcx, [rsi + 0x1210]
lea r8, [rsp + 0x440]
mov edx, 0x104
call fcn.180054b48
mov eax, dword [r15 + 0x20c]
cmp eax, 0x28
jae 0x1800306b9
inc eax
mov dword [r15 + 0x20c], eax
xor esi, esi
lea rdx, [rsp + 0x160]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1800301c0
inc r13d
mov dword [rsp + 0xe0], r13d
mov r14d, esi
mov dword [rsp + 0xb0], esi
nop dword [rax]
cmp r14d, dword [r15 + 0x20c]
jge 0x180030b25
movsxd rax, r14d
imul rbx, rax, 0x3228
add rbx, r15
mov qword [rsp + 0x130], rbx
lea rcx, [rbx + 0x1420]
lea rdx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rcx, [rbx + 0x1428]
lea rdx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rcx, [rbx + 0x1210]
lea rdx, [rsp + 0x3f0]
call fcn.180009df0
mov esi, eax
xor r12d, r12d
test eax, eax
je 0x180030873
mov qword [rsp + 0x108], r12
mov ecx, 0x1000a
call fcn.180053ad4
mov rdi, rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
test rdi, rdi
je 0x180030840
test rax, rax
je 0x180030840
mov r9d, esi
lea r8, [0x180088b38]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a4c
test eax, eax
jle 0x180030829
mov word [rbx + 0x1fffe], r12w
lea rdx, [r12 - 2]
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rdx, rdi
lea rcx, [rsp + 0x108]
call fcn.180054798
test eax, eax
je 0x180030800
mov r8d, esi
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
lea r9, str.GetUserCacheFilesFromFF
mov edx, 0x3ad
mov r8d, 3
lea rcx, str...StandAloneSvcExploitFiles.cpp
call fcn.180001b40
jmp 0x180030859
mov edx, esi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
jmp 0x180030853
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rdi, rdi
je 0x180030866
mov rcx, rdi
call fcn.180053a94
test rbx, rbx
je 0x180030873
mov rcx, rbx
call fcn.180053a94
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0x1e
mov dword [rsp + 0xb8], eax
mov qword [rsp + 0xf8], r12
mov ecx, 0x1000a
call fcn.180053ad4
mov rsi, rax
mov qword [rsp + 0xc8], rax
mov ecx, 0x2000a
call fcn.180053ad4
mov rbx, rax
mov qword [rsp + 0x110], rax
test rsi, rsi
je 0x180030ae2
test rax, rax
je 0x180030ae2
inc r13d
mov dword [rsp + 0xc0], r13d
mov dword [rsp + 0xe0], r13d
movzx edx, word [rsp + 0x15c]
movzx r8d, word [rsp + 0x15a]
movzx r9d, word [rsp + 0x158]
movzx r10d, word [rsp + 0x156]
movzx r11d, word [rsp + 0x152]
movzx eax, word [rsp + 0x150]
movzx ebx, word [rsp + 0x14e]
movzx edi, word [rsp + 0x14c]
movzx esi, word [rsp + 0x14a]
movzx r14d, word [rsp + 0x148]
movzx r15d, word [rsp + 0x146]
movzx r12d, word [rsp + 0x142]
movzx r13d, word [rsp + 0x140]
movzx ecx, word [rsp + 0x15e]
mov dword [rsp + 0xa8], ecx
mov dword [rsp + 0xa0], edx
mov dword [rsp + 0x98], r8d
mov dword [rsp + 0x90], r9d
mov dword [rsp + 0x88], r10d
mov dword [rsp + 0x80], r11d
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r13d
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x130]
mov rax, qword [rcx + 0x1418]
mov qword [rsp + 0x30], rax
lea rax, [rcx + 0x1210]
mov qword [rsp + 0x28], rax
lea rax, [rcx + 0x210]
mov qword [rsp + 0x20], rax
mov r13d, dword [rsp + 0xc0]
mov r9d, r13d
lea r8, str.__d___s_____s:__I64d____s____04d__02d__02d____02d:_02d:_02d._03d____04d__02d__02d____02d:_02d:_02d._03d
mov edx, 0xffff
mov rbx, qword [rsp + 0x110]
mov rcx, rbx
call fcn.180053a4c
test eax, eax
jle 0x180030aa8
xor eax, eax
mov word [rbx + 0x1fffe], ax
lea rdx, [rax - 2]
mov rcx, rbx
call fcn.180053398
lea r8, [rax + 1]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov rsi, qword [rsp + 0xc8]
mov rdx, rsi
lea rcx, [rsp + 0xf8]
call fcn.180054798
mov edi, dword [rsp + 0xb8]
test eax, eax
je 0x180030a6f
mov r8d, edi
mov rdx, rbx
lea rcx, str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.180053f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
lea r9, str.GetUserCacheFilesFromFF
mov edx, 0x3b6
mov r8d, 3
lea rcx, str...StandAloneSvcExploitFiles.cpp
call fcn.180001b40
mov r14d, dword [rsp + 0xb0]
mov r15, qword [rsp + 0x100]
jmp 0x180030afb
mov edx, dword [rsp + 0xb8]
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rsi, qword [rsp + 0xc8]
mov r14d, dword [rsp + 0xb0]
mov r15, qword [rsp + 0x100]
jmp 0x180030afb
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test rsi, rsi
je 0x180030b08
mov rcx, rsi
call fcn.180053a94
test rbx, rbx
je 0x180030b15
mov rcx, rbx
call fcn.180053a94
inc r14d
mov dword [rsp + 0xb0], r14d
jmp 0x1800306f0
mov r12, qword [rsp + 0xd8]
cmp r12, 0xffffffffffffffff
je 0x180030b3c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x180030c6d
xor eax, eax
mov rcx, qword [rsp + 0x1690]
xor rcx, rsp
call fcn.180052be0
add rsp, 0x16a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret