Function at 0x180685c4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x72c
mov eax, dword [0x180af1d0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x724], 0
push ebx
push esi
mov esi, ecx
mov al, byte [esi]
mov byte [ebp - 0x710], al
test al, al
push edi
mov dword [ebp - 0x728], esi
mov eax, str.CatalinaUpdateTask
jne 0x180685ff
mov eax, str.CatalinaUpdateTaskUser
push eax
lea eax, [ebp - 0x704]
call fcn.18003b93
mov edi, dword [ebp - 0x704]
push edi
call fcn.1807549d
pop ecx
push dword [ebp - 0x710]
lea ebx, [ebp - 0x704]
call fcn.180755d8
mov ebx, dword [ebp - 0x704]
pop ecx
push ebx
call fcn.1807549d
pop ecx
lea eax, [ebx - 0x10]
call fcn.18003e1e
lea eax, [edi - 0x10]
call fcn.18003e1e
cmp byte [esi], 0
je 0x18068661
xor ebx, ebx
inc ebx
call fcn.18052c3a
lea eax, [ebp - 0x724]
call fcn.1805300a
jmp 0x18068674
push 2
pop ebx
call fcn.18052c3a
lea eax, [ebp - 0x72c]
call fcn.18052e5f
mov eax, dword [eax]
sub eax, 0x10
call fcn.18003940
mov esi, eax
add esi, 0x10
mov dword [ebp - 0x718], esi
test bl, 2
je 0x1806869f
mov eax, dword [ebp - 0x72c]
add eax, 0xfffffff0
and ebx, 0xfffffffd
call fcn.18003e1e
test bl, 1
je 0x180686b2
mov eax, dword [ebp - 0x724]
add eax, 0xfffffff0
call fcn.18003e1e
xor edi, edi
cmp dword [esi - 0xc], edi
jne 0x180686d7
mov edi, 0x8000ffff
lea eax, [esi - 0x10]
call fcn.18003e1e
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.180761c5
leave
ret
push 0x24c
lea eax, [ebp - 0x254]
push edi
push eax
mov dword [ebp - 0x258], edi
call fcn.18076d30
add esp, 0xc
push esi
lea eax, [ebp - 0x708]
call fcn.18003b93
push 0x1809cce4
lea eax, [ebp - 0x708]
call fcn.180057ed
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x708]
call ebx
mov dword [ebp - 0x714], eax
cmp eax, 0xffffffff
jne 0x18068757
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x18068742
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, dword [ebp - 0x708]
add eax, 0xfffffff0
call fcn.18003e1e
jmp 0x180686be
push str.CatalinaGroupUpdateDownload
lea eax, [ebp - 0x700]
call fcn.18003b93
mov eax, dword [ebp - 0x700]
push dword [eax - 0xc]
lea esi, [ebp - 0x700]
call fcn.18003cf7
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
or eax, 0xffffffff
call fcn.18003bbe
mov edi, 0x250
push dword [ebp - 0x718]
lea eax, [ebp - 0x70c]
call fcn.18003b93
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x70c]
call fcn.180057ed
test byte [ebp - 0x258], 0x10
lea eax, [ebp - 0x22c]
jne 0x180687e6
push str.CatalinaUpdate.exe
push eax
call fcn.18077235
pop ecx
pop ecx
test eax, eax
je 0x180689c6
mov esi, dword [ebp - 0x70c]
call fcn.18004a51
jmp 0x180689c6
push 0x1809c3e8
push eax
call fcn.1807970a
pop ecx
pop ecx
test eax, eax
je 0x180689c6
lea eax, [ebp - 0x22c]
push 0x1809c3c0
push eax
call fcn.1807970a
pop ecx
pop ecx
test eax, eax
je 0x180689c6
mov eax, dword [ebp - 0x728]
push dword [eax + 4]
lea eax, [ebp - 0x22c]
push eax
call fcn.18077235
pop ecx
pop ecx
test eax, eax
je 0x180689c6
push dword [ebp - 0x700]
lea eax, [ebp - 0x22c]
push eax
call fcn.18077235
pop ecx
pop ecx
test eax, eax
je 0x180689c6
mov esi, dword [ebp - 0x70c]
add esi, 0xfffffff0
mov eax, esi
call fcn.18003940
add eax, 0x10
mov dword [ebp - 0x71c], eax
push str.npCatalinaOneClick.dll
lea eax, [ebp - 0x71c]
call fcn.180057ed
push edi
lea eax, [ebp - 0x6f8]
push 0
push eax
call fcn.18076d30
add esp, 0xc
lea eax, [ebp - 0x6f8]
push eax
push dword [ebp - 0x71c]
call ebx
mov dword [ebp - 0x704], eax
inc eax
neg eax
sbb eax, eax
and eax, dword [fcn.18019f46]
je 0x180688ea
mov eax, esi
call fcn.18003940
add eax, 0x10
mov dword [ebp - 0x6fc], eax
lea eax, [ebp - 0x6cc]
push eax
lea eax, [ebp - 0x6fc]
call fcn.180057ed
push dword [ebp - 0x6fc]
call fcn.18004af4
mov eax, dword [ebp - 0x6fc]
pop ecx
add eax, 0xfffffff0
call fcn.18003e1e
mov eax, esi
call fcn.18003940
add eax, 0x10
mov dword [ebp - 0x6fc], eax
push str.npCatalinaUpdate.dll
lea eax, [ebp - 0x6fc]
call fcn.180057ed
push edi
lea eax, [ebp - 0x4a8]
push 0
push eax
call fcn.18076d30
add esp, 0xc
lea eax, [ebp - 0x4a8]
push eax
push dword [ebp - 0x6fc]
call ebx
mov dword [ebp - 0x710], eax
inc eax
neg eax
sbb eax, eax
and eax, dword [fcn.18019f46]
je 0x18068975
mov eax, esi
call fcn.18003940
add eax, 0x10
mov dword [ebp - 0x720], eax
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x720]
call fcn.180057ed
mov esi, dword [ebp - 0x720]
push esi
call fcn.18004af4
pop ecx
lea eax, [esi - 0x10]
call fcn.18003e1e
mov esi, dword [ebp - 0x70c]
call fcn.18004a51
cmp dword [ebp - 0x710], 0xffffffff
je 0x18068995
push dword [ebp - 0x710]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x6fc]
add eax, 0xfffffff0
call fcn.18003e1e
cmp dword [ebp - 0x704], 0xffffffff
je 0x180689b8
push dword [ebp - 0x704]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x71c]
add eax, 0xfffffff0
call fcn.18003e1e
mov eax, dword [ebp - 0x70c]
add eax, 0xfffffff0
call fcn.18003e1e
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x714]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1806878f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x18068a3d
test eax, eax
jle 0x18068a08
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, dword [ebp - 0x700]
add eax, 0xfffffff0
call fcn.18003e1e
push dword [ebp - 0x714]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x708]
add eax, 0xfffffff0
call fcn.18003e1e
mov esi, dword [ebp - 0x718]
jmp 0x180686be
call fcn.18052c3a
push 0x180a9594
push str.HKLMSoftwareCatalinaGroupUpdate_
call fcn.1800c521
pop ecx
pop ecx
call fcn.18052c3a
mov eax, dword [ebp - 0x728]
movzx eax, byte [eax]
push 0x180a5fa0
push eax
call fcn.180121ae
push eax
call fcn.1800c521
mov eax, dword [ebp - 0x700]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.18003e1e
push dword [ebp - 0x714]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x708]
add eax, 0xfffffff0
call fcn.18003e1e
xor edi, edi
jmp 0x18068a32