joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3719428e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
jne 0x371942af
lea eax, [ebp - 0x10]
push 0xd
push eax
call fcn.371972c6
pop ecx
lea eax, [ebp - 0x10]
pop ecx
mov dword [ebp + 0xc], eax
push esi
push edi
push dword [ebp + 8]
mov edi, 0x3719f068
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push str.Info
push edi
push esi
call fcn.3719b66a
push dword [ebp + 0xc]
push str.Time
push edi
push esi
call fcn.3719b66a
add esp, 0x20
cmp byte [ebp + 0x10], bl
pop edi
pop esi
jne 0x37194307
lea eax, [ebp + 0x10]
push eax
push ebx
push ebx
push fcn.3719b710
push ebx
push ebx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
cmp eax, 0xffffffff
je 0x37194307
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x3719430d
push ebx
call fcn.3719b710
pop ebx
leave
ret 0xc

Function at 0x371954be
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push 0
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x371954de
test byte [ebp - 4], 0x20
jne 0x371954de
test byte [ebp - 4], 7
jne 0x371954e2
xor eax, eax
leave
ret
push 1
pop eax
leave
ret

Function at 0x3719565c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x37195678
mov eax, dword [0x234]
test eax, eax
je 0x371956ab
mov dword [eax], 3
jmp 0x371956ab
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x371956b5
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x238], eax
test eax, eax
jne 0x371956af
mov esi, dword [esi + 0x234]
test esi, esi
je 0x371956ab
mov dword [esi], 3
xor eax, eax
jmp 0x371956b2
push 1
pop eax
pop esi
pop ebp
ret

Function at 0x371959c5
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsCA92B524_BC8A_4610_BD2C_6BD3E28155D0
push esi
call edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsB580CF65_E151_49C3_B73F_70B13FCA8E86
push esi
call edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push str.2C5AA40E_8814_4EB6_876E_7EFB8B3F9662
push str.SoftwareMicrosoftInternet_ExplorerURLSearchHooks
push SysReAllocString
call edi
push str.B580CF65_E151_49C3_B73F_70B13FCA8E86
push str.SOFTWAREMicrosoftInternet_ExplorerToolbar
push esi
call edi
lea eax, [ebp - 0x104]
push 0x104
push eax
call fcn.37195a4e
pop ecx
pop ecx
pop edi
test eax, eax
pop esi
je 0x37195a4c
lea eax, [ebp - 0x104]
push 2
push eax
call fcn.37197e94
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.3719750f
add esp, 0x10
call fcn.37195994
leave
ret
Function at 0x37195aa9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, 0x104
push edi
lea eax, [ebp - 0x104]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor ebx, ebx
test eax, eax
jbe 0x37195b6f
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strlen
cmp byte [ebp + eax - 0x105], 0x5c
lea eax, [ebp + eax - 0x105]
pop ecx
jne 0x37195af2
mov byte [eax], bl
cmp dword [0x371a0484], ebx
mov edi, 0x3719f288
jne 0x37195b2d
cmp byte [0x3719f288], bl
je 0x37195b23
mov edx, edi
mov ecx, edx
add edx, esi
mov al, byte [ecx]
cmp al, bl
jne 0x37195b18
cmp byte [ecx + 1], bl
je 0x37195b1f
xor al, 0x77
mov byte [ecx], al
inc ecx
jmp 0x37195b0d
cmp byte [edx], bl
jne 0x37195b09
mov dword [0x371a0484], 1
cmp byte [0x3719f288], bl
je 0x37195b6f
lea eax, [ebp - 0x104]
push edi
push eax
push str._s_s
lea eax, [ebp - 0x208]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea eax, [ebp - 0x208]
mov byte [ebp - 0x105], bl
push eax
add edi, esi
call fcn.37197182
add esp, 0x18
test eax, eax
jne 0x37195b7f
cmp byte [edi], bl
jne 0x37195b35
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x37195b78
mov byte [eax], bl
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x37195b9f
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push edi
push eax
push esi
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov byte [esi + edi - 1], bl
push 1
pop eax
jmp 0x37195b7a

Function at 0x37195ba4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [0x371a0488], ebx
push esi
push edi
mov edi, 0x104
jne 0x37195beb
cmp byte [0x3719f594], bl
je 0x37195be1
mov edx, 0x3719f594
mov ecx, edx
add edx, edi
mov al, byte [ecx]
cmp al, bl
jne 0x37195bd6
cmp byte [ecx + 1], bl
je 0x37195bdd
xor al, 0x77
mov byte [ecx], al
inc ecx
jmp 0x37195bcb
cmp byte [edx], bl
jne 0x37195bc7
mov dword [0x371a0488], 1
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x37195bf4
mov byte [eax], bl
mov eax, dword [ebp + 0xc]
cmp byte [0x3719f288], bl
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], eax
je 0x37195c38
mov eax, 0x3719f288
mov esi, eax
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 4]
push dword [ebp + 8]
push ecx
push str.CLSID
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x37195c3f
add esi, edi
mov eax, esi
cmp byte [esi], bl
jne 0x37195c10
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 1
pop eax
jmp 0x37195c3a
Function at 0x37195c44
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [ebp + 0x10]
push edi
push dword [ebp + 8]
mov dword [ebp + 0x10], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 4], 1
push str.CLSID_s
push 0x104
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
mov edi, dword [ebp + 0xc]
add esp, 0x10
lea eax, [ebp + 0x10]
and byte [ebp - 5], 0
push eax
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x108]
push str.InprocServer32
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x37195ca8
push 1
pop eax
jmp 0x37195cad
and byte [edi], 0
xor eax, eax
pop edi
leave
ret
Function at 0x371971a6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [ebp + 0xc]
push esi
push 0
push dword [ebp + 8]
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x371971f5
lea eax, [ebp - 0x104]
dec esi
push eax
push str._sdownlo1_
push esi
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
jmp 0x37197212
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
dec esi
push eax
push str._sdownlo1_s
push esi
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
push 1
pop eax
pop esi
leave
ret

Function at 0x37197334
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push esi
mov esi, dword [ebp + 8]
jne 0x3719735d
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp eax, 1
jne 0x3719735d
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
jmp 0x3719738a
call fcn.37197306
test eax, eax
je 0x37197374
push 5
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x3719737f
push dword [ebp + 0xc]
push esi
call fcn.3719738d
pop ecx
pop ecx
test eax, eax
je 0x37197387
push 2
jmp 0x37197389
push 1
pop eax
pop esi
pop ebp
ret

Function at 0x3719748d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, 0x103
lea eax, [ebp - 0x104]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x3719750a
cmp eax, esi
ja 0x3719750a
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strlen
cmp byte [ebp + eax - 0x105], 0x5c
pop ecx
je 0x371974dc
lea eax, [ebp - 0x104]
push 0x3719fd2c
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x104]
push str.wininit.ini
push eax
push str._s_s
push esi
push edi
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
and byte [edi + esi - 1], 0
push 1
pop eax
pop edi
jmp 0x3719750c
xor eax, eax
pop esi
leave
ret

Function at 0x3719750f
Capabilities:
Delete file
Move file

Disassembly:
cmp byte [esp + 8], 0
jne 0x37197530
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
jne 0x37197528
xor eax, eax
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x37197533
push 5
pop eax
cmp eax, 5
je 0x37197541
cmp eax, 0x20
je 0x37197541
push 1
jmp 0x3719755a
call fcn.37197306
test eax, eax
je 0x3719755c
push 4
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 2
pop eax
ret
push 0
push dword [esp + 8]
call fcn.3719738d
pop ecx
pop ecx
xor ecx, ecx
test eax, eax
setne cl
inc ecx
mov eax, ecx
ret
Function at 0x37197574
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3719d468
push 0x3719c886
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x45c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
or dword [ebp - 0x264], 0xffffffff
mov bl, 1
push 0x3719fda4
push dword [ebp + 8]
push str._s_s
mov edi, 0x104
push edi
lea eax, [ebp - 0x25c]
push eax
mov esi, dword [sym.imp.MSVCRT.dll__snprintf]
call esi
add esp, 0x14
and byte [ebp - 0x159], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x264], eax
cmp eax, 0xffffffff
jne 0x371975ff
or dword [ebp - 4], eax
xor al, al
jmp 0x37197727
push 0x3719fda0
lea eax, [ebp - 0x12c]
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x371976b0
push 0x3719fd9c
lea eax, [ebp - 0x12c]
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x371976b0
test byte [ebp - 0x158], 0x10
lea eax, [ebp - 0x12c]
push eax
push dword [ebp + 8]
je 0x37197670
push str._s_s_
push edi
lea eax, [ebp - 0x368]
push eax
call esi
and byte [ebp - 0x265], 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x368]
push eax
call fcn.37197574
add esp, 0x1c
mov bl, al
jmp 0x371976aa
push str._s_s
push edi
lea eax, [ebp - 0x46c]
push eax
call esi
add esp, 0x14
and byte [ebp - 0x369], 0
cmp dword [ebp + 0xc], 0
je 0x37197695
cmp dword [ebp + 0xc], 1
jne 0x371976b0
lea eax, [ebp - 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
mov byte [ebp - 0x260], bl
lea eax, [ebp - 0x158]
push eax
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x371975ff
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 0x264], 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x371976ea
cmp dword [ebp + 0xc], 2
jne 0x37197721
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
mov byte [ebp - 0x260], bl
jmp 0x37197721
or dword [ebp - 4], 0xffffffff
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x37197736
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [ebp + 8]
push esi
push edi
cmp byte [eax], 0
je 0x371977a1
push 0x3719fd2c
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x371977a1
mov esi, edi
sub esi, dword [ebp + 8]
test esi, esi
jle 0x3719779c
push 0x105
lea eax, [ebp - 0x108]
push 0
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x108]
push dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0x18
lea eax, [ebp - 0x108]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [edi + 1]
jmp 0x37197744
pop edi
pop esi
leave
ret
Function at 0x371977a5
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x658
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll__snprintf]
push edi
push dword [ebp + 8]
mov edi, 0x103
lea eax, [ebp - 0x658]
mov dword [ebp - 0x144], 0x80
push str._s.
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x658]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
mov ebx, 0x104
cmp dword [ebp - 4], 0xffffffff
je 0x37197927
test byte [ebp - 0x144], 0x20
je 0x3719787e
push ebx
lea eax, [ebp - 0x450]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x450]
push dword [ebp + 0xc]
push str._s_s
push edi
push eax
call esi
push ebx
lea eax, [ebp - 0x34c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x20
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x34c]
push dword [ebp + 8]
push str._s_s
push edi
push eax
call esi
push dword [ebp + 0x10]
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x34c]
push eax
call fcn.37197334
add esp, 0x20
jmp 0x3719790f
test byte [ebp - 0x144], 0x10
je 0x3719790f
cmp byte [ebp - 0x118], 0x2e
je 0x3719790f
push ebx
lea eax, [ebp - 0x554]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x554]
push dword [ebp + 8]
push str._s_s_
push edi
push eax
call esi
push ebx
lea eax, [ebp - 0x248]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x20
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x248]
push dword [ebp + 0xc]
push str._s_s_
push edi
push eax
call esi
lea eax, [ebp - 0x248]
push eax
call fcn.37197736
push dword [ebp + 0x10]
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x554]
push eax
call fcn.371977a5
add esp, 0x24
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x371977f7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x37197935
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x38], 0x440
mov dword [ebp - 0x30], str.open
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x371979aa
push 0x1388
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
leave
ret
xor eax, eax
leave
ret
Function at 0x371980e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
cmp dword [ebp + 0xc], 1
jne 0x371981be
call fcn.371959c5
push dword [ebp + 8]
mov eax, 0x371a04b8
mov dword [0x371a0528], 0x3719fde8
mov dword [0x371a0468], eax
push 0x3719fdf8
push eax
mov dword [0x371a04b8], 0x84
mov dword [0x371a051c], 0x300
call fcn.37199947
mov eax, 0x3719d4c0
mov ecx, eax
test ecx, ecx
je 0x37198149
push 0x10
push eax
push 0x371a0490
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
lea eax, [ebp - 0x104]
push 0x104
push eax
push dword [0x371a04bc]
call fcn.37197218
mov esi, str.1.1.0.5
push esi
call sub.MSVCRT.dll_strlen
add esp, 0x14
mov ebx, 0x3719f068
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push eax
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push 1
push str.Version
push ebx
push edi
call esi
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x104]
push eax
push 1
push str.Path
push ebx
push edi
call esi
pop edi
pop esi
pop ebx
jmp 0x371981ce
cmp dword [ebp + 0xc], 0
jne 0x371981ce
push 0x371a04b8
call fcn.37199cac
push 1
pop eax
leave
ret 0xc
Function at 0x3719860a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ebx
jne 0x37198624
xor esi, esi
jmp 0x37198652
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.3719c800
mov esi, esp
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
mov byte [esi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 4], edi
jne 0x3719868f
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x3719867a
call esi
mov esi, eax
jmp 0x37198724
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x37198724
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x371986c0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jle 0x371986d3
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x3719871b
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
mov dword [ebp + 8], edi
jne 0x371986d7
jmp 0x371986a2
call esi
jmp 0x37198719
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, dword [ebp + 8]
cmp byte [esi + eax], bl
je 0x3719870d
lea eax, [esi + 1]
add eax, 3
and al, 0xfc
call fcn.3719c800
lea eax, [esi + 1]
mov edi, esp
push eax
push dword [ebp + 8]
push edi
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov byte [edi + esi], bl
push dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push edi
call fcn.3719878b
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea esp, [ebp - 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x3719919a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x3719cbf8
call fcn.3719c6c0
sub esp, 0x114
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esi
push 0x2001f
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [ebx]
call fcn.3719915c
mov edi, eax
cmp edi, esi
je 0x371991e4
cmp dword [ebp - 0x10], esi
je 0x371991dd
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x37199281
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x37199255
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0x10]
push eax
call fcn.3719919a
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x37199242
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x120]
push eax
push esi
push dword [ebp - 0x10]
jmp 0x37199207
cmp dword [ebp - 0x10], esi
je 0x37199250
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
jmp 0x37199281
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x37199268
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 0x10], esi
mov ebx, eax
je 0x3719927f
push dword [ebp - 0x10]
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x37199292
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.3719c800
push ebx
push esi
lea eax, [ebp - 0x2014]
push edi
mov esi, ecx
push eax
mov dword [ebp - 0x14], esi
call fcn.371988e4
xor edi, edi
cmp eax, edi
jl 0x3719944a
lea eax, [ebp - 0xa]
push eax
lea eax, [ebp - 0x2014]
push eax
call fcn.37199457
pop ecx
test eax, eax
pop ecx
jne 0x371992dd
mov eax, 0x80020009
jmp 0x3719944a
mov ecx, esi
call fcn.371988bc
lea eax, [ebp - 0x1014]
mov ecx, esi
push eax
call fcn.371988e4
cmp eax, edi
jl 0x3719944a
movzx eax, word [ebp - 0xa]
sub eax, 8
je 0x37199412
sub eax, 9
je 0x37199377
dec eax
dec eax
jne 0x37199439
lea eax, [ebp - 0x1014]
test eax, eax
jne 0x37199322
xor ebx, ebx
jmp 0x37199357
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.3719c800
mov ebx, esp
push esi
push ebx
lea eax, [ebp - 0x1014]
push 0xffffffffffffffff
push eax
push edi
push edi
mov word [ebx], di
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push ebx
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov eax, dword [ebp - 0x10]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
jmp 0x3719942a
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test al, 1
mov dword [ebp - 8], eax
jne 0x371993b3
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.3719c800
mov dword [ebp - 4], esp
push ebx
push edi
push dword [ebp - 4]
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [ebp - 4], edi
jne 0x371993bd
mov eax, 0x80004005
jmp 0x3719944a
cmp dword [ebp - 8], 0
jle 0x371993f7
mov ecx, dword [ebp - 4]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + ecx]
mov al, byte [ebp + edi - 0x1014]
push eax
call fcn.371994de
pop ecx
mov ecx, edi
push 4
and ecx, 1
shl ecx, 2
mov edx, ecx
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc edi
cmp edi, dword [ebp - 8]
jl 0x371993c3
mov eax, dword [ebp + 8]
push ebx
push dword [ebp - 4]
mov eax, dword [eax]
push 3
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor edi, edi
jmp 0x37199439
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x1014]
push eax
push 1
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.371988e4
cmp eax, edi
jl 0x3719944a
xor eax, eax
lea esp, [ebp - 0x2020]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x3719b130
Capabilities:
Delete file
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push edi
push 1
push 0
push str.Close
add ecx, 0x20
mov dword [ebp - 0x20], str.mapiskin.dat
mov dword [ebp - 0x1c], str.mapihelp.exe
mov dword [ebp - 0x18], str.mapibar.dll
mov dword [ebp - 0x14], str.mapibar.inf
mov dword [ebp - 0x10], str.mapitemp
mov dword [ebp - 0xc], str.mapion
call fcn.3719428e
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov edi, 0x3719f068
push edi
push SysReAllocString
call esi
push edi
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call esi
push str.SOFTWAREMicrosoftCode_Store_DatabaseDistribution_Units11BD72CB_D678_42c3_AFF9_E6887040E9AF
push edi
call esi
call sym.mapibar.dll_DllUnregisterServer
push str.C:coollog.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, 0x104
push 0
lea eax, [ebp - 0x228]
push esi
push eax
push dword [0x371a04bc]
call fcn.37197218
mov edi, dword [sym.imp.MSVCRT.dll__snprintf]
lea eax, [ebp - 0x20]
add esp, 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 8], 4
mov ebx, 0x103
push esi
lea eax, [ebp - 0x124]
push 0
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp - 4]
add esp, 0xc
push dword [eax]
lea eax, [ebp - 0x228]
push eax
push str._s_s
lea eax, [ebp - 0x124]
push ebx
push eax
call edi
lea eax, [ebp - 0x124]
push 0
push eax
call fcn.3719750f
add dword [ebp - 4], 4
add esp, 0x1c
dec dword [ebp - 8]
jne 0x3719b1e0
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 2
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x124]
push 0
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp - 4]
add esp, 0xc
push dword [eax]
lea eax, [ebp - 0x228]
push eax
push str._s_s_
lea eax, [ebp - 0x124]
push ebx
push eax
call edi
lea eax, [ebp - 0x124]
push 0
push eax
call fcn.37197574
add dword [ebp - 4], 4
add esp, 0x1c
dec dword [ebp - 8]
jne 0x3719b234
pop edi
pop esi
pop ebx
leave
ret