joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800439f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call fcn.18002dd1
push eax
lea ecx, [ebp - 4]
call fcn.18005b92
mov esi, dword [ebp - 4]
xor ecx, ecx
inc ecx
mov edx, 0x104
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or ecx, eax
jge 0x180043d5
push edx
lea ecx, [ebp - 4]
call fcn.18005c68
mov esi, dword [ebp - 4]
push esi
xor eax, eax
push eax
push eax
push 0x23
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x1800440b
mov ecx, dword [ebp + 8]
push 0x18158a9c
call fcn.1800585a
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.180058b5
lea ecx, [esi - 0x10]
call fcn.18003435
mov eax, dword [ebp + 8]
jmp 0x18004442
push str.GoogleUpdateLog
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x180043e7
push edi
lea edi, [esi - 0x10]
mov ecx, edi
call fcn.18005c0f
mov esi, dword [ebp + 8]
lea ecx, [ebp - 4]
add eax, 0x10
push 0xffffffffffffffff
mov dword [esi], eax
call fcn.180058b5
mov ecx, edi
call fcn.18003435
mov eax, esi
pop edi
pop esi
leave
ret 4

Function at 0x1800451a
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
cmp byte [ebx + 0x77], 0
je 0x180045e3
mov eax, dword [ebx + 0xcc]
push esi
push edi
test eax, eax
jne 0x180045d9
lea eax, [ebp - 4]
push eax
call fcn.18004447
mov esi, dword [ebp - 4]
cmp dword [esi - 0xc], 0
je 0x1800457a
lea edx, [ebp - 4]
lea ecx, [ebp - 8]
call fcn.1800d838
mov edi, dword [ebp - 8]
mov ecx, edi
call fcn.1800943d
test al, al
jne 0x18004584
mov ecx, edi
call fcn.18007567
test eax, eax
jns 0x18004584
lea ecx, [edi - 0x10]
call fcn.18003435
lea ecx, [esi - 0x10]
call fcn.18003435
jmp 0x180045e1
mov al, byte [ebx + 0x7d]
push 0x20
mov byte [ebp - 8], al
call fcn.1812136a
pop ecx
push dword [ebp - 8]
mov ecx, eax
push esi
call fcn.18004f73
mov dword [ebx + 0xcc], eax
test eax, eax
jne 0x180045bf
push esi
push dword [ebx + 0x54]
push str.LOG_SYSTEM:___s_:_ERROR___Cannot_create_log_writer_to__s
call fcn.1800a012
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [edi - 0x10]
call fcn.18003435
lea ecx, [esi - 0x10]
call fcn.18003435
mov eax, dword [ebx + 0xcc]
test eax, eax
je 0x180045e1
push eax
mov ecx, ebx
call fcn.18004e13
pop edi
pop esi
pop ebx
leave
ret
Function at 0x18004b22
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, ecx
push edi
test esi, esi
je 0x18004be3
cmp dword [ebp + 8], 0
jne 0x18004b47
cmp dword [ebp + 0x10], 2
jg 0x18004be3
call fcn.18002dd1
push eax
lea ecx, [ebp - 4]
call fcn.18005b92
call fcn.18002dd1
push eax
lea ecx, [ebp + 0x14]
call fcn.18005b92
xor edi, edi
lea eax, [ebx + 0x58]
inc edi
push 0
mov ecx, eax
call fcn.1800d601
test al, al
jne 0x18004b89
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
lea eax, [ebx + 0x58]
cmp edi, 0x14
jle 0x18004b69
jmp 0x18004bad
push dword [ebp + 0x18]
lea eax, [ebp + 0x14]
mov ecx, ebx
push esi
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.18004a4e
lea ecx, [ebx + 0x58]
mov eax, dword [ecx]
call dword [eax + 8]
cmp edi, 0x14
jle 0x18004bcd
push str.LOG_SYSTEM:_Couldnt_acquire_lock__
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call esi
push 0x18173280
call esi
mov ecx, dword [ebp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.18003435
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.18003435
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x18004f73
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 0xc]
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebx], fcn.18005121
mov dword [ebx + 4], 0x989680
mov word [ebx + 8], 0
mov byte [ebx + 0xa], al
mov byte [ebx + 0xb], 1
call fcn.18002dd1
push eax
lea ecx, [ebx + 0xc]
call fcn.18005b92
push dword [ebp + 8]
xor edi, edi
lea ecx, [ebx + 0x14]
mov dword [ebx + 0x10], edi
call fcn.1800585a
mov dword [ebx + 0x18], edi
call fcn.18002dd1
push eax
lea ecx, [ebx + 0x1c]
call fcn.18005b92
movzx eax, byte [0x1819d65c]
neg eax
sbb eax, eax
and eax, 0x1819d030
mov dword [ebp + 8], eax
je 0x18005046
lea ecx, [ebp + 0xc]
push ecx
mov ecx, eax
call fcn.18004e86
mov esi, dword [ebp + 0xc]
cmp dword [esi - 0xc], edi
je 0x18005022
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
push 0x989680
push str.MaxLogFileSize
push str.LoggingSettings
call edi
mov dword [ebx + 4], eax
xor eax, eax
push esi
inc eax
push eax
push str.LogFileWide
push str.LoggingSettings
call edi
test eax, eax
setne al
jmp 0x1800502c
xor eax, eax
mov dword [ebx + 4], 0x989680
inc eax
mov byte [ebx + 0xb], al
lea ecx, [ebx + 0x1c]
mov eax, dword [ebp + 8]
add eax, 0x54
push eax
call fcn.18005802
lea ecx, [esi - 0x10]
call fcn.18003435
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
Function at 0x1800509e
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x1800511f
mov byte [esi + 8], 1
call fcn.1800514d
cmp dword [esi + 0x10], 0
je 0x1800511f
test al, al
je 0x180050be
mov byte [esi + 0xa], 1
mov ecx, esi
call fcn.180056ad
test al, al
jne 0x180050e5
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.1800a012
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop esi
ret
mov ecx, esi
call fcn.18005217
cmp dword [esi + 0x18], 0
jne 0x1800510c
push dword [esi + 0x14]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_create_logging_file__s_n
call fcn.1800a012
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [esi + 0x10], 0
mov byte [esi + 9], 1
je 0x1800511f
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop esi
ret

Function at 0x18005217
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x18195008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
lea edx, [ebp - 0x6c]
push edi
xor edi, edi
mov dword [ebp - 0x6c], edi
mov ecx, dword [esi + 0x14]
call fcn.18009c2f
mov eax, dword [ebp - 0x6c]
cmp eax, dword [esi + 4]
jbe 0x1800524e
mov ecx, esi
call fcn.18005384
xor eax, eax
cmp byte [esi + 0xa], al
push edi
setne al
push 0x80
lea eax, [eax*2 + 2]
push eax
push edi
push 3
push 0x40000000
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x18], eax
cmp eax, 0xffffffff
jne 0x18005287
mov dword [esi + 0x18], edi
xor al, al
jmp 0x1800531c
lea ecx, [ebp - 0x8c]
call fcn.18003865
push 0x221
push 0x20
push 2
lea eax, [ebp - 0x68]
push 0x18172d58
push eax
call fcn.180034ac
add esp, 0x14
lea eax, [ebp - 0x68]
lea ecx, [ebp - 0x8c]
push edi
push 0xc0010000
push eax
call fcn.180038e2
lea ecx, [ebp - 0x68]
mov bl, al
call fcn.18003595
test bl, bl
je 0x180052e4
push ecx
mov ecx, dword [esi + 0x14]
lea eax, [ebp - 0x8c]
xor edx, edx
push eax
inc edx
call fcn.18003e11
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1800530f
cmp byte [esi + 0xb], 0
je 0x1800530f
push edi
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x6c], edi
push ecx
push 2
push 0x18159c04
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x8c]
call fcn.180038ab
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18120ca0
leave
ret

Function at 0x1800532b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 0x80
push 5
push ebx
push 3
push 0x40000000
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [esi + 0x18], 0xffffffff
mov edi, eax
jne 0x1800535b
xor al, al
jmp 0x1800537f
cmp byte [esi + 0xb], bl
je 0x18005376
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 2
push 0x18159c04
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x180053ef
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x18195008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x18
mov dword [ebp - 0x74], ecx
lea edi, [ebp - 0x68]
pop ecx
mov esi, str.SYSTEMCurrentControlSetControlSession_Manager
lea eax, [ebp - 0x70]
rep movsd dword es:[edi], dword [esi]
push eax
push 0x20019
xor ebx, ebx
lea eax, [ebp - 0x68]
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
movsw word es:[edi], word [esi]
mov dword [ebp - 0x70], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18005517
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x6c]
push 7
pop esi
push eax
push ebx
lea eax, [ebp - 0x78]
mov dword [ebp - 0x6c], ebx
push eax
push ebx
push str.PendingFileRenameOperations
push dword [ebp - 0x70]
mov dword [ebp - 0x78], esi
call edi
test eax, eax
jne 0x18005517
cmp dword [ebp - 0x78], esi
jne 0x18005517
push dword [ebp - 0x6c]
call fcn.1812139a
push dword [ebp - 0x6c]
mov esi, eax
push ebx
push esi
call fcn.181237a0
add esp, 0x10
lea eax, [ebp - 0x6c]
push eax
push esi
push ebx
push ebx
push str.PendingFileRenameOperations
push dword [ebp - 0x70]
call edi
test eax, eax
jne 0x18005508
mov edi, dword [ebp - 0x6c]
shr edi, 1
mov dword [ebp - 0x7c], edi
lea eax, [edi - 2]
cmp eax, 0xffffd
ja 0x18005508
cmp word [esi + edi*2 - 4], bx
jne 0x18005508
cmp word [esi + edi*2 - 2], bx
jne 0x18005508
mov eax, dword [ebp - 0x74]
lea ecx, [ebp - 0x74]
add eax, 0x14
mov edx, 0x181735b4
push eax
call fcn.18005750
test edi, edi
mov edi, dword [ebp - 0x74]
pop ecx
je 0x180054f7
lea eax, [esi + ebx*2]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x180054fa
lea eax, [esi + ebx*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
add ebx, eax
cmp ebx, dword [ebp - 0x7c]
jb 0x180054d6
or ebx, 0xffffffff
cmp ebx, 0xffffffff
lea ecx, [edi - 0x10]
setne bl
call fcn.18003435
test esi, esi
je 0x18005513
push esi
call fcn.18121365
pop ecx
mov al, bl
jmp 0x18005519
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18120ca0
leave
ret

Function at 0x180056ad
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x180056ba
xor al, al
pop esi
ret
push 0x1f4
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180056f3
cmp eax, 0x80
je 0x180056f3
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.1800a012
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [esi + 9], 0
jmp 0x180056b6
mov al, 1
pop esi
ret
Function at 0x1800604e
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
lea ebx, [ecx + 4]
push edi
mov edi, edx
test ebx, ebx
je 0x18006084
lea esi, [edi + 4]
test esi, esi
je 0x18006084
call fcn.1800366d
test al, al
je 0x18006084
mov ecx, edi
call fcn.1800366d
test al, al
je 0x18006084
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x18006086
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x18007681
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x18195008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov ecx, esi
call fcn.18005904
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.181237a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push ebx
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test edi, edi
jns 0x1800771b
movzx ecx, bl
cmp ecx, 0x26
jne 0x180076df
mov edx, str.ProgramFiles
jmp 0x180076e9
cmp ecx, 0x1c
jne 0x1800770a
mov edx, str.LocalAppData
lea ecx, [ebp - 0x210]
call fcn.1800833e
push eax
mov ecx, esi
call fcn.18005802
mov ecx, dword [ebp - 0x210]
lea ecx, [ecx - 0x10]
call fcn.18003435
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x18007717
xor eax, eax
inc eax
jmp 0x18007739
mov eax, edi
jmp 0x18007739
lea eax, [ebp - 0x20c]
push eax
call fcn.1812b770
pop ecx
push eax
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.18005b15
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18120ca0
leave
ret
Function at 0x18007748
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
mov eax, dword [0x18195008]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
push edi
push 0x250
xor ebx, ebx
lea eax, [esp + 0x1c]
mov edi, ecx
push ebx
push eax
mov dword [esp + 0x20], edi
call fcn.181237a0
add esp, 0xc
lea ecx, [esp + 0x10]
push edi
call fcn.1800585a
push 0x18173768
lea ecx, [esp + 0x14]
call fcn.180086b6
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x180077ba
call fcn.18011439
mov edi, eax
jmp 0x18007850
push edi
lea ecx, [esp + 0x10]
call fcn.1800585a
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x10]
call fcn.180086b6
lea eax, [esp + 0x44]
push 0x18173770
push eax
call fcn.1812b9dc
pop ecx
pop ecx
test eax, eax
je 0x18007816
lea eax, [esp + 0x44]
push 0x18173714
push eax
call fcn.1812b9dc
pop ecx
pop ecx
test eax, eax
je 0x18007816
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.18007bef
test eax, eax
jns 0x1800780d
mov ebx, eax
lea ecx, [edi - 0x10]
mov edi, dword [esp + 0x14]
jmp 0x1800781d
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.18003435
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180077ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x12
je 0x1800784e
test edi, edi
jle 0x18007850
movzx edi, di
or edi, 0x80070000
jmp 0x18007850
mov edi, ebx
cmp esi, 0xffffffff
je 0x1800785c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.18003435
mov ecx, dword [esp + 0x26c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.18120ca0
mov esp, ebp
pop ebp
ret
Function at 0x1800787f
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x18195008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x250
xor ebx, ebx
lea eax, [ebp - 0x258]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x264], edi
call fcn.181237a0
add esp, 0xc
lea ecx, [ebp - 0x25c]
push edi
call fcn.1800585a
push 0x5c
lea ecx, [ebp - 0x25c]
call fcn.18005939
push 0x18173778
lea ecx, [ebp - 0x25c]
call fcn.18005cbf
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x18007912
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x180079a7
call fcn.18011439
mov ebx, eax
jmp 0x180079a7
test byte [ebp - 0x258], 0x10
jne 0x1800797c
push edi
lea ecx, [ebp - 0x260]
call fcn.1800585a
push 0x5c
lea ecx, [ebp - 0x260]
call fcn.18005939
lea eax, [ebp - 0x22c]
push eax
call fcn.1812b770
pop ecx
push eax
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x260]
call fcn.18005966
mov edi, dword [ebp - 0x260]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1800796e
mov ecx, edi
call fcn.18009631
mov ebx, eax
lea ecx, [edi - 0x10]
call fcn.18003435
mov edi, dword [ebp - 0x264]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18007912
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x180079a0
call fcn.18011439
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x25c]
lea ecx, [ecx - 0x10]
call fcn.18003435
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18120ca0
leave
ret
Function at 0x180079c6
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
mov eax, dword [0x18195008]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edi
test edi, edi
je 0x18007a48
movzx eax, word [edi]
test ax, ax
je 0x18007a48
push 0x3a
mov ecx, eax
xor dl, dl
pop eax
push 0x2e
mov esi, edi
pop ebx
cmp cx, 0x5c
je 0x18007a19
cmp cx, 0x2f
je 0x18007a19
cmp cx, ax
je 0x18007a19
cmp cx, bx
je 0x18007a1e
mov dl, 1
cmp cx, bx
jne 0x18007a2c
cmp esi, edi
jbe 0x18007a2c
cmp word [esi - 2], bx
je 0x18007bd5
cmp cx, ax
push 0x3a
sete al
add esi, 2
dec al
and dl, al
movzx eax, word [esi]
mov ecx, eax
test ax, ax
pop eax
jne 0x18007a01
jmp 0x18007a4a
xor dl, dl
test dl, dl
je 0x18007bd5
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x18007a7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x18007a70
xor eax, eax
jmp 0x18007bda
call fcn.18011439
jmp 0x18007bda
test al, 0x10
je 0x18007bd5
mov ecx, edi
call fcn.1800787f
push 0x250
mov ebx, eax
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.181237a0
add esp, 0xc
lea ecx, [esp + 0x10]
push edi
call fcn.1800585a
mov esi, 0x1817377c
push esi
call fcn.1812b770
pop ecx
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.18005966
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x18007af7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x18007bc5
call fcn.18011439
test ebx, ebx
jns 0x18007bc3
jmp 0x18007bc5
test byte [esp + 0x18], 0x10
je 0x18007b8e
push 0
push 2
mov edx, 0x18173714
lea ecx, [esp + 0x4c]
call fcn.1800bbd6
pop ecx
pop ecx
test eax, eax
je 0x18007b8e
push 0
push 3
mov edx, 0x18173770
lea ecx, [esp + 0x4c]
call fcn.1800bbd6
pop ecx
pop ecx
test eax, eax
je 0x18007b8e
push edi
lea ecx, [esp + 0x10]
call fcn.1800585a
mov edi, 0x18172d80
push edi
call fcn.1812b770
pop ecx
push eax
push edi
lea ecx, [esp + 0x14]
call fcn.18005966
lea eax, [esp + 0x44]
push eax
call fcn.1812b770
pop ecx
push eax
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x14]
call fcn.18005966
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.180079c6
test ebx, ebx
js 0x18007b82
test eax, eax
jns 0x18007b82
mov ebx, eax
lea ecx, [edi - 0x10]
call fcn.18003435
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18007af7
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x18007bc5
mov ecx, edi
call fcn.18009631
test ebx, ebx
js 0x18007bc5
test eax, eax
jns 0x18007bc5
mov ebx, eax
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.18003435
mov eax, ebx
jmp 0x18007bda
mov eax, 0x80004005
mov ecx, dword [esp + 0x26c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.18120ca0
mov esp, ebp
pop ebp
ret
Function at 0x18007bef
Capabilities:
Check if file exists
Delete directory
Enumerate files on windows
Get file attributes

Disassembly:
push esi
mov esi, ecx
call fcn.1800943d
test al, al
jne 0x18007c02
mov eax, 0x80070002
pop esi
ret
mov ecx, esi
call fcn.18009479
mov ecx, esi
test al, al
je 0x18007c15
pop esi
jmp fcn.180079c6
call fcn.180095e6
test eax, eax
jns 0x18007c00
mov ecx, esi
pop esi
jmp fcn.18009631

Function at 0x180080f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [esp + 0x14], eax
mov ebx, eax
cmp dword [esi + 8], eax
jne 0x18008151
call fcn.1800f9cd
test al, al
je 0x18008151
call fcn.18006bff
mov edi, eax
test edi, edi
je 0x180081c1
mov dword [esp + 0x14], eax
mov dword [esi + 8], edi
cmp dword [esi + 0xc], ebx
je 0x18008151
push str.runas
push dword [esi + 0xc]
call fcn.1812b867
pop ecx
pop ecx
test eax, eax
jne 0x18008151
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne byte [esp + 0x13]
test eax, eax
je 0x1800820e
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x180081cb
call fcn.1800ea67
movzx ecx, byte [0x1819d65c]
mov esi, eax
neg ecx
sbb ecx, ecx
and ecx, 0x1819d030
je 0x180081b8
push 7
pop edx
xor eax, eax
mov dword [esp + 0x18], ecx
inc eax
mov dword [esp + 0x1c], edx
push eax
push edx
mov dword [esp + 0x28], eax
call fcn.18004986
push esi
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push str._Started_process___u_
push eax
call fcn.18002f73
add esp, 0xc
push esi
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
jmp 0x18008216
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1800822d
movzx ecx, byte [0x1819d65c]
neg ecx
sbb ecx, ecx
and ecx, 0x1819d030
je 0x18008216
push 7
pop edx
xor eax, eax
mov dword [esp + 0x18], ecx
inc eax
mov dword [esp + 0x1c], edx
push eax
push edx
mov dword [esp + 0x28], eax
call fcn.18004986
mov dword [esp + 0x24], eax
lea eax, [esp + 0x18]
push str._Started_process__PID_unknown_
push eax
call fcn.18002f73
pop ecx
pop ecx
jmp 0x18008216
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x18008225
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov al, byte [esp + 0x13]
mov byte [esp + 0x14], al
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret