joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18044208
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, 0x181d9030
push edi
mov edi, ecx
cmp dword [0x181d9030], ebx
je 0x18044249
push ecx
mov ecx, esi
call fcn.1803cb01
mov ebx, eax
mov ecx, ebx
call fcn.1801cd4c
test ebx, ebx
js 0x180442b7
add esi, 0x24
xor ebx, ebx
cmp dword [esi], ebx
jne 0x1804422b
lfence
cmp byte [edi + 0x3c], 0
je 0x180442c5
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x180442be
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push edi
push 0x180442f0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x1804428c
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x180442be
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x180442ae
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180442cd
lfence
mov eax, ebx
jmp 0x180442d8
mov esi, 0x80004005
jmp 0x180442d1
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x180442d6
call fcn.180441c4
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122538
leave
ret 4

Function at 0x180477eb
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
push edi
push 0
lea ecx, [esi + 0x1c]
call fcn.18048ea9
mov edi, dword [esi + 0x18]
and dword [esi + 0x18], 0
test edi, edi
je 0x18047815
mov ecx, edi
call fcn.18087cf4
push 0x24
push edi
call fcn.18122a66
pop ecx
pop ecx
mov ecx, dword [0x181dcefc]
pop edi
pop esi
mov ecx, dword [ecx]
jmp fcn.1803f21e
Function at 0x1804a2dc
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x14], 0
push ebx
push esi
mov byte [ebp - 0x41], cl
mov bh, dl
push edi
lea ecx, [ebp - 0x14]
call fcn.18014e95
mov edi, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
and dword [ebp - 0x10], 0
push edi
call fcn.180074fa
mov bl, byte [ebp + 8]
mov eax, str.MicrosoftEdgeComRegisterShellARM64.exe
test bl, bl
jne 0x1804a321
mov eax, str.MicrosoftEdgeUpdateComRegisterShell64.exe
push eax
lea ecx, [ebp - 0x10]
call fcn.1800f7f4
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x1804a33d
call fcn.1801bab5
mov ebx, eax
jmp 0x1804a43f
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1804a352
mov ebx, 0x80070002
jmp 0x1804a43f
and dword [ebp - 0xc], 0
call fcn.18006f9c
push eax
lea ecx, [ebp - 0xc]
call fcn.180076af
mov eax, 0x18176bcc
mov edx, eax
test bh, bh
jne 0x1804a374
mov edx, str._unregister
cmp byte [ebp - 0x41], 0
mov ecx, eax
jne 0x1804a381
mov ecx, str._user
test bl, bl
je 0x1804a38a
mov eax, str._arm64
push edx
push ecx
push eax
lea eax, [ebp - 0xc]
push str._s__s__s
push eax
call fcn.18016b2d
add esp, 0x14
lea eax, [ebp - 0x40]
push 0x2c
push 0
push eax
call fcn.181371e0
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.180177a2
push 0
push dword [ebp - 0xc]
lea ecx, [ebp - 0x40]
call fcn.18017910
mov ebx, eax
test ebx, ebx
jns 0x1804a40c
movzx ecx, byte [0x181dd05a]
neg ecx
sbb ecx, ecx
and ecx, 0x181dcf50
je 0x1804a42c
push 7
pop edx
push 0xfffffffffffffffe
pop eax
lfence
push eax
push edx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], eax
call fcn.18008b5d
push ebx
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x54]
push str._Failed_to_start_COM_register_process__0x_x_
push eax
call fcn.18007230
add esp, 0xc
jmp 0x1804a42c
push 0x7530
lea ecx, [ebp - 0x40]
call fcn.18017a64
movzx ebx, al
neg ebx
sbb ebx, ebx
and ebx, 0x7ff8fa4c
add ebx, 0x800705b4
lea ecx, [ebp - 0x40]
call fcn.180178c8
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.18006f72
lea ecx, [esi - 0x10]
call fcn.18006f72
lea ecx, [edi - 0x10]
call fcn.18006f72
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122538
leave
ret
Function at 0x1804bb8a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.1804a0b3
mov edi, eax
xor ebx, ebx
test edi, edi
je 0x1804bbc0
cmp dword [edi], ebx
je 0x1804bbc0
push ecx
mov ecx, edi
call fcn.1803cb01
test eax, eax
js 0x1804bc2d
add edi, 0x24
jne 0x1804bbab
lfence
cmp byte [esi + 0x3c], bl
je 0x1804bc39
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x30], eax
test eax, eax
je 0x1804bc32
lea eax, [ebp - 8]
push eax
push ebx
push esi
push 0x1804e670
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x1804bc02
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x30], ebx
test ebx, ebx
je 0x1804bc32
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov edi, eax
test edi, edi
jns 0x1804bc24
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1804bc41
lfence
jmp 0x1804bc4e
mov edi, 0x80004005
jmp 0x1804bc45
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov edi, eax
test edi, edi
jns 0x1804bc4c
mov ecx, esi
call fcn.1804a1cd
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122538
leave
ret 4
Function at 0x1804f80c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x10], ecx
mov eax, dword [edi]
cmp dword [eax - 0xc], esi
jne 0x1804f838
mov eax, 0x80070057
jmp 0x1804f8ad
mov dword [ebp - 0xc], esi
call fcn.18006f9c
push eax
lea ecx, [ebp - 0xc]
call fcn.180076af
push dword [edi]
lea eax, [ebp - 0xc]
push str._s_last.dmp
push eax
call fcn.18016b2d
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
add edx, 4
mov dword [ebp - 8], esi
lea ecx, [ebp - 8]
call fcn.1801648c
mov eax, dword [ebp - 8]
add esp, 0x10
cmp dword [eax - 0xc], esi
jne 0x1804f880
mov esi, 0x80040709
jmp 0x1804f898
push esi
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1804f895
call fcn.1801bab5
mov esi, eax
mov eax, dword [ebp - 8]
lea ecx, [eax - 0x10]
call fcn.18006f72
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff0
call fcn.18006f72
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122538
leave
ret 8
Function at 0x1804f8be
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, ecx
lea edi, [ebp - 0x60]
push 0x14
pop ecx
mov esi, str.____________________________________.dmp
lea edx, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, dword [eax + 4]
movsw word es:[edi], word [esi]
xor esi, esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
call fcn.18010903
mov ebx, eax
pop ecx
test ebx, ebx
jns 0x1804f911
mov edi, dword [ebp - 0x68]
mov esi, dword [ebp - 0x6c]
jmp 0x1804f9de
call fcn.18011f9e
mov edi, dword [ebp - 0x68]
mov ebx, esi
mov esi, dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
mov eax, edi
sub eax, esi
mov dword [ebp - 0x7c], edx
cmp eax, 4
jb 0x1804f9dc
push ecx
xor edi, edi
lea edx, [ebp - 0x74]
push ecx
mov ecx, dword [esi + ebx*4]
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x70], edi
call fcn.18010eea
pop ecx
pop ecx
test eax, eax
js 0x1804f9c6
mov edx, dword [ebp - 0x70]
xor ecx, ecx
or ecx, dword [ebp - 0x74]
or edx, edi
mov eax, dword [ebp - 0x78]
sub eax, ecx
mov dword [ebp - 0x90], edi
mov ecx, dword [ebp - 0x7c]
sbb ecx, edx
mov dword [ebp - 0x88], eax
mov eax, ecx
and ecx, 0x7fffffff
mov dword [ebp - 0x84], ecx
and eax, 0x80000000
fild qword [ebp - 0x88]
mov dword [ebp - 0x8c], eax
push ecx
push ecx
fild qword [ebp - 0x90]
fchs
faddp st(1)
fstp qword [ebp - 0x98]
fld qword [ebp - 0x98]
fstp qword [esp]
call fcn.18144936
fcomp qword [0x181cd900]
fnstsw ax
pop ecx
pop ecx
test ah, 1
jne 0x1804f9c6
mov eax, dword [ebp - 0x6c]
push dword [eax + ebx*4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp - 0x68]
inc ebx
mov esi, dword [ebp - 0x6c]
mov eax, edi
sub eax, esi
sar eax, 2
cmp ebx, eax
jne 0x1804f931
xor ebx, ebx
test esi, esi
je 0x1804fa0b
cmp esi, edi
je 0x1804f9fa
mov ecx, dword [esi]
sub ecx, 0x10
call fcn.18006f72
add esi, 4
cmp esi, edi
jne 0x1804f9e6
mov esi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
sub ecx, esi
and ecx, 0xfffffffc
push ecx
push esi
call fcn.1800a1ed
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122538
leave
ret
Function at 0x1804ffe5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x181d700c]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x1e], 0
mov dword [edi], 0x181a213c
je 0x1805000f
call fcn.1805060f
and dword [esp + 0x14], 0
lea ecx, [edi + 4]
and dword [esp + 0x18], 0
mov eax, dword [ecx]
xchg dword [ecx], eax
add eax, 4
lea ecx, [esp + 0x14]
push eax
call fcn.1801582d
lea edx, [edi + 0x3c]
xor ebx, ebx
mov eax, dword [edx + 4]
mov ecx, dword [edx]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x18050071
mov eax, dword [ecx + ebx*4]
mov dword [esp + 0x10], eax
test eax, eax
je 0x18050062
mov eax, dword [eax]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x181663e8]
mov ecx, dword [esp + 0x14]
call esi
lea edx, [edi + 0x3c]
mov eax, dword [edx + 4]
inc ebx
mov ecx, dword [edx]
sub eax, ecx
sar eax, 2
cmp ebx, eax
jb 0x18050040
lea edx, [edi + 0x48]
xor ebx, ebx
mov eax, dword [edx + 4]
mov ecx, dword [edx]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x180500b5
mov eax, dword [ecx + ebx*4]
mov dword [esp + 0x10], eax
test eax, eax
je 0x180500a6
mov eax, dword [eax]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x181663e8]
mov ecx, dword [esp + 0x14]
call esi
lea edx, [edi + 0x48]
mov eax, dword [edx + 4]
inc ebx
mov ecx, dword [edx]
sub eax, ecx
sar eax, 2
cmp ebx, eax
jb 0x18050084
mov ebx, dword [edi + 0x38]
and dword [edi + 0x38], 0
test ebx, ebx
je 0x180500d2
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x181663e8]
mov ecx, ebx
call esi
lea eax, [edi + 4]
mov ecx, dword [eax]
xchg dword [eax], ecx
call fcn.18068654
lea ecx, [esp + 0x14]
call fcn.18015858
mov ecx, dword [edi + 0x98]
sub ecx, 0x10
call fcn.18006f72
lea ecx, [edi + 0x88]
mov esi, 0x181a1928
mov dword [ecx], esi
call fcn.1800bba0
lea ecx, [edi + 0x78]
mov dword [ecx], esi
call fcn.1800bba0
lea ecx, [edi + 0x68]
mov dword [ecx], esi
call fcn.1800bba0
lea ecx, [edi + 0x58]
mov dword [ecx], esi
call fcn.1800bba0
lea ecx, [edi + 0x54]
call fcn.18041999
lea ecx, [edi + 0x48]
call fcn.1800fcb0
lea ecx, [edi + 0x3c]
call fcn.1800fcb0
mov ebx, dword [edi + 0x38]
test ebx, ebx
je 0x18050156
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x181663e8]
mov ecx, ebx
call esi
mov ecx, dword [edi + 0x30]
push 0x10
pop ebx
sub ecx, ebx
call fcn.18006f72
mov ecx, dword [edi + 0x2c]
sub ecx, ebx
call fcn.18006f72
mov ecx, dword [edi + 0x28]
sub ecx, ebx
call fcn.18006f72
mov ecx, dword [edi + 0x18]
sub ecx, ebx
call fcn.18006f72
mov ecx, dword [edi + 0x14]
sub ecx, ebx
call fcn.18006f72
mov ecx, dword [edi + 0x10]
sub ecx, ebx
call fcn.18006f72
lea ecx, [edi + 8]
call fcn.18052d41
lea ecx, [edi + 4]
call fcn.1804fe2e
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.18122538
mov esp, ebp
pop ebp
ret
Function at 0x18062f6b
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor al, al
mov ecx, dword [esi + 0x4c]
cmp ecx, 0xffffffff
je 0x180630c7
mov edx, 0x10000000
cmp ecx, 0x7c
je 0x180630c7
cmp ecx, 0x29
jne 0x18062fab
cmp dword [esi + 0x10], 0
jne 0x180630c7
lea edi, [esi + 0x50]
test dword [edi], edx
je 0x180630cb
jmp 0x18063085
lea edi, [esi + 0x50]
cmp ecx, 0x2e
jne 0x18062fc9
push 5
lea ecx, [esi + 0x24]
call fcn.1806319b
mov ecx, esi
call fcn.18062f42
jmp 0x180630b5
cmp ecx, 0x5c
jne 0x1806301f
mov ecx, esi
call fcn.18062f42
test byte [edi], 0x80
je 0x18063013
movzx eax, word [esi + 0x48]
mov ecx, eax
cmp eax, 0x62
jne 0x18062ffb
push 4
lea ecx, [esi + 0x24]
call fcn.1806319b
mov ecx, esi
call fcn.18062f42
jmp 0x180630bc
cmp ecx, 0x42
jne 0x18063013
push 4
lea ecx, [esi + 0x24]
call fcn.1806319b
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x18062fef
mov ecx, esi
call fcn.18063adf
jmp 0x180630b5
cmp ecx, 0x5b
jne 0x1806303f
mov ecx, esi
call fcn.18062f42
mov ecx, esi
call fcn.18063a93
cmp dword [esi + 0x4c], 0x5d
je 0x18062fbd
push 4
jmp 0x180630cd
cmp ecx, 0x28
jne 0x1806305c
mov ecx, esi
call fcn.18062f42
mov ecx, esi
call fcn.18063bb0
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x180630cb
jmp 0x180630aa
cmp ecx, 0x5e
jne 0x18063065
push 2
jmp 0x18062fe7
cmp ecx, 0x24
jne 0x18063071
push 3
jmp 0x18062fe7
cmp ecx, 0x2a
je 0x180630c3
cmp ecx, 0x2b
je 0x180630c3
cmp ecx, 0x3f
je 0x180630c3
cmp ecx, 0x7b
je 0x180630c3
cmp ecx, 0x7d
jne 0x18063092
test dword [edi], edx
jne 0x1806309b
push 6
jmp 0x180630cd
cmp ecx, 0x5d
jne 0x1806309b
test dword [edi], edx
je 0x18063038
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.18063d17
mov bl, 1
mov ecx, esi
call fcn.18062f42
test bl, bl
je 0x180630bc
mov ecx, esi
call fcn.18063c35
mov al, 1
jmp 0x18062f72
push 0xa
jmp 0x180630cd
pop edi
pop esi
pop ebx
ret
push 5
call fcn.1806263f
int3
Function at 0x1806c150
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x274
mov eax, dword [0x181d700c]
xor eax, esp
mov dword [esp + 0x270], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x250
mov dword [esp + 0x14], eax
xor edi, edi
lea eax, [esp + 0x2c]
mov dword [esp + 0x20], edx
mov ebx, ecx
push edi
push eax
mov dword [esp + 0x18], ebx
call fcn.181371e0
add esp, 0xc
lea ecx, [esp + 0x20]
mov edx, ebx
push 0x181a5618
call fcn.18009ca1
pop ecx
lea ecx, [esp + 0x28]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [esp + 0x20]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.18006f72
cmp esi, 0xffffffff
jne 0x1806c1f0
call fcn.1801bab5
mov ebx, eax
mov edi, ebx
cmp esi, 0xffffffff
je 0x1806c1d9
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x27c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.18122538
mov esp, ebp
pop ebp
ret
mov ebx, edi
mov eax, dword [esp + 0x1c]
sub eax, edi
je 0x1806c290
sub eax, 1
je 0x1806c23a
sub eax, 1
jne 0x1806c2fc
cmp dword [esp + 0x28], 0x80
je 0x1806c221
test byte [esp + 0x28], 0x10
jne 0x1806c2f4
push dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x2c]
call fcn.1806c08b
pop ecx
mov ebx, eax
jmp 0x1806c2f4
test byte [esp + 0x28], 0x10
je 0x1806c2f4
lea ecx, [esp + 0x28]
call fcn.1806c04e
test al, al
jne 0x1806c2f4
lea eax, [esp + 0x54]
mov dword [esp + 0x24], edi
push eax
lea ecx, [esp + 0x18]
call fcn.180074fa
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
call fcn.1801648c
pop ecx
mov ecx, dword [esp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push dword [esp + 0x10]
push 2
pop edx
jmp 0x1806c2dc
test byte [esp + 0x28], 0x10
je 0x1806c2f4
lea ecx, [esp + 0x28]
call fcn.1806c04e
test al, al
jne 0x1806c2f4
lea eax, [esp + 0x54]
mov dword [esp + 0x24], edi
push eax
lea ecx, [esp + 0x1c]
call fcn.180074fa
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.1801648c
pop ecx
mov ecx, dword [esp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push dword [esp + 0x10]
xor edx, edx
inc edx
lea ecx, [esp + 0x28]
call fcn.1806c150
pop ecx
mov ecx, dword [esp + 0x24]
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.18006f72
test ebx, ebx
js 0x1806c1cb
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1806c1f2
jmp 0x1806c1d2
Function at 0x1806ce32
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
lea ecx, [ebp - 0x14]
lea eax, [edi + 0x14]
push eax
call fcn.1801582d
mov ecx, esi
call fcn.1800c099
mov ecx, eax
mov dword [ebp - 0x27c], eax
or ecx, edx
mov dword [ebp - 0x278], edx
jne 0x1806ce87
mov edi, 0x80070057
jmp 0x1806d078
and dword [ebp - 0xc], 0
call fcn.18006f9c
push eax
lea ecx, [ebp - 0xc]
call fcn.180076af
call fcn.18006f9c
push eax
lea ecx, [ebp - 0x26c]
call fcn.180076af
call fcn.18006f9c
push eax
lea ecx, [ebp - 8]
call fcn.180076af
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 8]
push eax
push ebx
call fcn.1806d2a9
mov ecx, dword [ebp - 8]
mov edi, eax
lea ecx, [ecx - 0x10]
call fcn.18006f72
mov ecx, dword [ebp - 0x26c]
lea ecx, [ecx - 0x10]
call fcn.18006f72
test edi, edi
js 0x1806d06d
push 0x250
lea eax, [ebp - 0x268]
push 0
push eax
call fcn.181371e0
add esp, 0xc
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x274]
push 0x181a5618
call fcn.18009ca1
pop ecx
lea ecx, [ebp - 0x268]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x274]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.18006f72
cmp esi, 0xffffffff
jne 0x1806cf4c
call fcn.1801bab5
mov edi, eax
jmp 0x1806d06d
lea ecx, [ebp - 0x268]
call fcn.1806c04e
test al, al
jne 0x1806d04e
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x26c]
call fcn.180074fa
lea ecx, [ebp - 0x26c]
call fcn.1800c099
mov ecx, dword [ebp - 0x26c]
mov ebx, eax
add ecx, 0xfffffff0
mov edi, edx
call fcn.18006f72
mov ecx, ebx
or ecx, edi
je 0x1806d04e
cmp edi, dword [ebp - 0x278]
ja 0x1806d04e
jb 0x1806cfb2
cmp ebx, dword [ebp - 0x27c]
jae 0x1806d04e
and dword [ebp - 8], 0
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x270]
call fcn.180074fa
lea eax, [ebp - 0x270]
push eax
lea edx, [ebp - 0xc]
lea ecx, [ebp - 8]
call fcn.1801648c
pop ecx
mov ecx, dword [ebp - 0x270]
lea ecx, [ecx - 0x10]
call fcn.18006f72
mov ecx, dword [ebp - 8]
call fcn.1800d0cf
movzx ecx, byte [0x181dd05a]
mov edi, eax
neg ecx
sbb ecx, ecx
and ecx, 0x181dcf50
je 0x1806d043
push 7
pop ebx
push 3
pop eax
push eax
push ebx
mov dword [ebp - 0x28c], ecx
mov dword [ebp - 0x288], ebx
mov dword [ebp - 0x284], eax
call fcn.18008b5d
push edi
push dword [ebp - 8]
mov dword [ebp - 0x280], eax
lea eax, [ebp - 0x28c]
push str._Purge_version___s__0x_x_
push eax
call fcn.18007230
add esp, 0x10
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f72
lea eax, [ebp - 0x268]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1806cf4c
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.18006f72
lea ecx, [ebp - 0x14]
call fcn.18015858
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122538
leave
ret 8
Function at 0x180701d3
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x18], ebx
call fcn.18006f9c
push eax
mov ecx, ebx
call fcn.180076af
xor ecx, ecx
lea eax, [ebx + 4]
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [ebp - 8], ecx
mov ecx, dword [esi]
sub ecx, 0x10
mov dword [ebp - 0x14], eax
call fcn.1800a0da
xor ebx, ebx
inc ebx
lea edi, [eax + 0x10]
mov dword [ebp - 0xc], edi
cmp dword [edi - 4], ebx
jle 0x18070234
push dword [edi - 0xc]
lea ecx, [ebp - 0xc]
call fcn.1800785c
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x180702cf
cmp dword [ebp - 8], ebx
jl 0x180702c8
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x1807025b
xor ecx, ecx
jmp 0x18070267
push eax
call fcn.1813b230
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x18]
push eax
call fcn.180075ed
cmp dword [ebp - 8], ebx
jle 0x180702c8
mov edi, dword [ebp - 0x14]
push dword [esi + ebx*4]
lea ecx, [ebp - 0x10]
call fcn.180074fa
mov eax, dword [edi + 4]
mov dword [ebp - 0x14], eax
cmp eax, dword [edi + 8]
je 0x180702a8
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.1800a0da
mov ecx, dword [ebp - 0x14]
add eax, 0x10
mov dword [ecx], eax
add dword [edi + 4], 4
jmp 0x180702b4
lea ecx, [ebp - 0x10]
push ecx
push eax
mov ecx, edi
call fcn.1800a147
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.18006f72
inc ebx
cmp ebx, dword [ebp - 8]
jl 0x18070279
mov edi, dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [edi - 0x10]
call fcn.18006f72
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.18122538
leave
ret 4

Function at 0x18070470
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [edi + 0x24]
cmp eax, esi
je 0x18070493
test eax, eax
je 0x18070490
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x24], esi
mov edx, dword [ebp + 0xc]
lea ecx, [edi + 0x28]
call fcn.180187c5
mov eax, dword [ebx + 4]
test eax, eax
je 0x180704a9
lock inc dword [eax + 4]
mov ecx, dword [edi + 0x30]
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], edx
test ecx, ecx
je 0x180704c0
call fcn.1801e4e4
test edi, edi
je 0x180704d4
mov eax, dword [edi]
push edi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x181663e8]
call esi
xor ebx, ebx
push ebx
push ebx
push edi
push 0x18070830
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, eax
lea ecx, [edi + 0x34]
call fcn.180187c5
cmp dword [edi + 0x34], ebx
jne 0x1807050c
call fcn.1801bab5
mov ecx, dword [edi]
mov ebx, eax
push edi
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x181663e8]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc