joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4159a2
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x4193e0
call fcn.004159c0
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x41db08
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x4157c1
cmp eax, esi
jne 0x4157b4
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x4157c4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41579b
xor esi, esi
inc esi
mov eax, dword [0x41db04]
cmp eax, esi
jne 0x4157d7
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x415812
mov eax, dword [0x41db04]
test eax, eax
jne 0x41580c
mov dword [0x41db04], esi
push 0x417358
push 0x41734c
call fcn.00415722
pop ecx
pop ecx
test eax, eax
je 0x415812
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4158dc
mov dword [0x41b7bc], esi
mov eax, dword [0x41db04]
cmp eax, esi
jne 0x415836
push 0x417348
push 0x4172f4
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x41db04], 2
cmp dword [ebp - 0x1c], ebx
jne 0x415843
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x41db0c], ebx
je 0x415864
push 0x41db0c
call fcn.00415b24
pop ecx
test eax, eax
je 0x415864
push ebx
push 2
push ebx
call dword [0x41db0c]
push dword [0x41b7a4]
push dword [0x41b7a8]
push dword [0x41b7a0]
call fcn.00404afc
add esp, 0xc
mov dword [0x41b7b8], eax
cmp dword [0x41b7ac], ebx
jne 0x4158c2
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x41b7bc], ebx
jne 0x4158d0
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x41b7b8]
call fcn.00415a05
ret
call fcn.00415c4d
jmp 0x415779
Function at 0x37f7e59e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
test esi, esi
jne 0x37f7e5b1
push 0xd
pop eax
jmp 0x37f7e5d9
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x37f7e5b4
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x37f7ed7c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x37f7d24c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x108], esi
call fcn.37f7e50d
mov ebx, eax
cmp ebx, esi
je 0x37f7ede7
lea ecx, [ebp - 0x10c]
call fcn.37f7e498
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.37facac9
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x37f7ee05
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x10c]
call fcn.37f7ed7c
cmp eax, esi
jne 0x37f7ee4c
lea eax, [ebp - 0x11c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp - 0x10c]
mov dword [ebp - 0x110], 0x100
call ebx
test eax, eax
je 0x37f7edef
lea ecx, [ebp - 0x10c]
call fcn.37f7e498
push dword [ebp - 0x114]
mov ecx, edi
call fcn.37f7e43b
lea ecx, [ebp - 0x10c]
mov esi, eax
call fcn.37f7e498
mov eax, esi
jmp 0x37f7edd6
Function at 0x37f81d90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x37f7d24c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x410], ebx
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x408], ebx
cmp esi, ebx
je 0x37f81e37
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x414], eax
lea eax, [ebp - 0x414]
push eax
call fcn.37f7e0c6
test eax, eax
jl 0x37f81e37
mov edi, dword [ebp - 0x414]
cmp edi, 0x400
jg 0x37f81e1d
push edi
call fcn.37f7ec8c
test al, al
je 0x37f81e1d
mov eax, edi
call fcn.37fad7a0
mov eax, esp
jmp 0x37f81e29
push edi
lea ecx, [ebp - 0x410]
call fcn.37f7f062
push 3
push edi
push esi
push eax
call fcn.37f7e1ae
cmp eax, ebx
jne 0x37f81e77
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x37f81e50
lea ecx, [ebp - 0x408]
call fcn.37f7ebc8
lea ecx, [ebp - 0x410]
call fcn.37f7eae3
mov eax, 0x8007000e
lea esp, [ebp - 0x42c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.37facac9
leave
ret 0x10
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
jne 0x37f81e93
call fcn.37f7e36a
mov esi, eax
jmp 0x37f81f60
push dword [ebp - 0x418]
push dword [ebp - 0x40c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x37f81eb6
call fcn.37f7e36a
jmp 0x37f81f57
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x40c], eax
cmp eax, ebx
je 0x37f81eac
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x37f81f09
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x37f81ef2
lea ecx, [ebp - 0x408]
call fcn.37f7ebc8
mov esi, 0x8007000e
lea ecx, [ebp - 0x410]
call fcn.37f7eae3
mov eax, esi
jmp 0x37f81e60
push eax
lea ecx, [ebp - 0x408]
call fcn.37f800e4
cmp dword [ebp - 0x408], ebx
jne 0x37f81f24
mov esi, 0x8007000e
jmp 0x37f81f59
push esi
push dword [ebp - 0x40c]
push esi
push dword [ebp - 0x408]
call fcn.37f7e275
mov eax, dword [ebp - 0x408]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x408]
lea ecx, [ebp - 0x420]
call fcn.37f8182d
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x37f81ef7
lea ecx, [ebp - 0x408]
call fcn.37f7ebc8
jmp 0x37f81ef7
Function at 0x37f82d48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x37f7d24c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x41c]
push eax
push 1
xor esi, esi
push esi
push 0x37f61c50
push SysReAllocString
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x424], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x37f82db0
mov ecx, dword [ebp - 0x420]
call fcn.37f7e36a
jmp 0x37f82f18
push 0x208
lea eax, [ebp - 0x20c]
push esi
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x428]
push eax
push esi
push esi
push dword [ebp - 0x41c]
mov dword [ebp - 0x424], 0x206
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x37f82efd
push dword [ebp - 0x41c]
mov word [ebp - 6], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x37f82e25
mov eax, 0x80004005
jmp 0x37f82f18
call fcn.37f899c0
mov dword [ebp - 0x418], eax
cmp eax, esi
ja 0x37f82e4e
call fcn.37f8a489
mov dword [ebp - 0x418], eax
cmp eax, esi
ja 0x37f82e4e
call fcn.37f8a4aa
mov dword [ebp - 0x418], eax
push 0xa
push dword [ebp - 0x418]
mov esi, 0x104
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.37f99dea
test eax, eax
je 0x37f82e1b
push ebx
push edi
mov edi, dword [sym.imp.MSVCR90.dll_wcsncat_s]
push 0xffffffffffffffff
mov ebx, 0x37f61c4c
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call edi
push 0xffffffffffffffff
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push esi
push eax
call edi
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call edi
push 0xffffffffffffffff
push 0x37f61c28
lea eax, [ebp - 0x20c]
push esi
push eax
call edi
add esp, 0x40
call fcn.37f97e00
neg eax
sbb eax, eax
and eax, 0x20
or eax, 2
push eax
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
pop edi
pop ebx
test eax, eax
je 0x37f82da0
mov ecx, dword [ebp - 0x42c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 0x430]
mov dword [ecx], eax
xor eax, eax
jmp 0x37f82f18
mov ecx, dword [ebp - 0x420]
call fcn.37f7e36a
push dword [ebp - 0x41c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.37facac9
leave
ret 8
Function at 0x37f83a0f
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x37fe2444], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
jne 0x37f83a53
call ebx
test eax, eax
jns 0x37f83a49
push 0x37f61cd4
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x37f61cc8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x37fe2440], eax
mov dword [0x37fe2444], 1
mov eax, dword [0x37fe2440]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x37f83a6f
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
test eax, eax
jne 0x37f83a9f
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x37f83a95
call ebx
test eax, eax
mov eax, dword [ebp + 8]
jns 0x37f83a8a
push dword [eax + 0xc]
call dword [eax + 8]
jmp 0x37f83a8f
push dword [eax + 4]
call dword [eax]
test eax, eax
je 0x37f83a9e
mov dword [edi], eax
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc

Function at 0x37f8473c
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x37fae8e0
call fcn.37fad6a0
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
movzx edx, word [eax]
mov ecx, 0x5a4d
cmp dx, cx
jne 0x37f8477a
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov esi, 0xe0
cmp word [ecx + 0x14], si
jne 0x37f8477a
add esi, 0x2b
cmp word [ecx + 0x18], si
jne 0x37f8477a
mov eax, dword [ecx + 0x50]
jmp 0x37f8479b
mov ecx, 0x4550
cmp dx, cx
jne 0x37f847a7
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x37f847a7
add ecx, 0x2b
cmp word [eax + 0x18], cx
jne 0x37f847a7
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x1c], eax
jmp 0x37f847ab
and dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.37fad6e5
ret

Function at 0x37f84f7d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x37f84fc3
push edi
push esi
push esi
push 0x80
push 2
push esi
push 1
push 0xc0000000
push dword [ebp + 8]
call fcn.37f98066
mov edi, eax
cmp edi, 0xffffffff
je 0x37f84fc2
push esi
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
ret
Function at 0x37f8615a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0xffffffff
jne 0x37f8616a
xor eax, eax
leave
ret
push esi
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor esi, esi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
inc edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call fcn.37f860f3
add esp, 0x10
test eax, eax
je 0x37f862b7
cmp dword [ebp - 4], esi
je 0x37f862b7
push ebx
mov ebx, 0x37fe57d8
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
call fcn.37f870cd
pop ecx
test eax, eax
jne 0x37f861c5
xor edi, edi
jmp 0x37f862af
cmp dword [0x37fe5a84], esi
je 0x37f861d8
push esi
push 0x72766c72
call fcn.37f8b30c
lea eax, [ebp - 0x14]
push eax
mov dword [0x37fe5a84], 1
mov dword [ebp - 0x14], esi
call fcn.37f84ee9
pop ecx
cmp eax, dword [ebp - 8]
jne 0x37f861fc
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
je 0x37f86235
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.37f8613f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.37f860f3
add esp, 0x18
test eax, eax
je 0x37f86228
cmp dword [ebp - 4], esi
jne 0x37f86235
push esi
push 0x72766c73
call fcn.37f8b30c
xor edi, edi
cmp dword [ebp + 0x14], esi
jne 0x37f86247
cmp dword [ebp - 8], 0xea60
ja 0x37f861be
cmp edi, esi
je 0x37f86261
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.37f85ead
add esp, 0x10
mov edi, eax
mov dword [0x37fe5a84], esi
push esi
cmp edi, esi
je 0x37f862a5
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x37f86290
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jne 0x37f86290
xor edi, edi
inc edi
jmp 0x37f86292
xor edi, edi
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 0x10]
call fcn.37f84f7d
add esp, 0xc
jmp 0x37f862af
push 0x74697970
call fcn.37f8b30c
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], esi
je 0x37f862d2
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.37f8613f
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x37f8659f
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp ebx, edi
jne 0x37f865c1
push edi
push 0x36717370
call fcn.37f8b30c
jmp 0x37f866fe
push esi
mov esi, dword [ebp + 0x10]
cmp esi, edi
jne 0x37f865d4
push edi
push 0x36717371
jmp 0x37f866d3
cmp dword [ebp + 8], 2
je 0x37f865f1
cmp dword [ebp + 8], 8
je 0x37f865f1
cmp dword [ebp + 8], 3
je 0x37f865f1
push edi
push 0x36717372
jmp 0x37f866d3
cmp dword [ebx], edi
je 0x37f86600
push edi
push 0x36717373
call fcn.37f8b30c
cmp dword [esi], edi
je 0x37f8660f
push edi
push 0x37667270
call fcn.37f8b30c
push esi
push edi
push dword [ebp + 8]
mov dword [esi], edi
call sub.Secur32.dll_GetUserNameExW
movzx edi, al
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x37f866da
cmp eax, 0xea
jne 0x37f866da
mov eax, dword [esi]
push 2
xor ecx, ecx
pop edx
mul edx
seto cl
neg ecx
or eax, ecx
push eax
call fcn.37f8ab5b
mov dword [ebx], eax
test eax, eax
jne 0x37f8665e
push eax
push 0x36717375
jmp 0x37f866e1
mov ecx, dword [esi]
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
push ecx
push eax
push edi
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x37f8667e
push 0
push 0x36717376
jmp 0x37f866e1
mov eax, dword [esi]
dec eax
cmp dword [ebp - 4], eax
je 0x37f86692
push 0
push 0x36717377
call fcn.37f8b30c
cmp edi, 2
jne 0x37f866ae
push dword [esi]
push dword [ebx]
call fcn.37f8652b
pop ecx
pop ecx
test eax, eax
jne 0x37f866fd
push eax
push 0x36717378
jmp 0x37f866e1
cmp edi, 8
jne 0x37f866c7
push dword [ebx]
call fcn.37f852c0
pop ecx
test eax, eax
jne 0x37f866fd
push eax
push 0x36717379
jmp 0x37f866e1
cmp edi, 3
je 0x37f866fd
push 0
push 0x3671737a
call fcn.37f8b30c
jmp 0x37f866fd
push 0
push 0x36717374
call fcn.37f8b30c
mov eax, dword [ebx]
xor edi, edi
cmp eax, edi
je 0x37f866f7
push eax
call fcn.37f83ace
pop ecx
mov dword [ebx], edi
cmp dword [esi], edi
je 0x37f866fd
mov dword [esi], edi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x37f86c14
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x37f7d24c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x240], eax
mov ebx, 0x104
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.37f85dee
pop ecx
pop ecx
test eax, eax
jne 0x37f86c51
or eax, 0xffffffff
jmp 0x37f86e2c
cmp word [ebp - 0x22c], 0
push esi
lea esi, [ebp - 0x22c]
push edi
mov dword [ebp - 0x238], esi
je 0x37f86c77
inc esi
inc esi
cmp word [esi], 0
jne 0x37f86c69
mov dword [ebp - 0x238], esi
xor edi, edi
inc edi
push edi
call fcn.37f849f0
mov dword [esp], 0x37f622d0
call fcn.37f89885
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x248], eax
cmp eax, 0x64
jbe 0x37f86ca3
mov dword [ebp - 0x230], edi
mov eax, esi
lea ecx, [ebp - 0x22c]
sub eax, ecx
sar eax, 1
mov dword [ebp - 0x234], eax
mov esi, 0x80
mov edi, 0xc0000000
push dword [ebp - 0x230]
lea eax, [ebp - 0x24]
push 0x37f61e08
push 0xffffffffffffffff
push eax
call fcn.37f85260
add esp, 0x10
cmp dword [ebp - 0x234], 0
jl 0x37f86dd7
push dword [ebp - 0x234]
lea eax, [ebp - 0x244]
push ebx
push eax
call fcn.37f8cff6
add esp, 0xc
mov ecx, eax
call fcn.37f862d8
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x24]
push eax
call fcn.37f9840b
xor eax, eax
push eax
push eax
push esi
push 1
push eax
push 1
push edi
lea eax, [ebp - 0x22c]
push eax
call fcn.37f98066
mov dword [ebp - 0x23c], eax
cmp eax, 0xffffffff
jne 0x37f86ddc
cmp dword [ebp - 0x230], 0x64
jb 0x37f86d48
and dword [ebp - 0x230], 0
inc dword [ebp - 0x230]
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x248]
jne 0x37f86cbf
push eax
push 0x37f61e08
lea eax, [ebp - 0x24]
push 0xffffffffffffffff
push eax
call fcn.37f85260
add esp, 0x10
cmp dword [ebp - 0x234], 0
jl 0x37f86dd7
push dword [ebp - 0x234]
lea eax, [ebp - 0x244]
push ebx
push eax
call fcn.37f8cff6
add esp, 0xc
mov ecx, eax
call fcn.37f862d8
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x24]
push eax
call fcn.37f9840b
push esi
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor ebx, ebx
push ebx
push ebx
push esi
push 2
push ebx
push 1
push edi
lea eax, [ebp - 0x22c]
push eax
call fcn.37f98066
mov dword [ebp - 0x23c], eax
jmp 0x37f86dde
call fcn.37f84fc6
xor ebx, ebx
cmp dword [ebp - 0x230], 0x64
pop edi
pop esi
jb 0x37f86def
mov dword [ebp - 0x230], ebx
mov eax, dword [ebp - 0x230]
inc eax
push eax
push 0x37f622d0
call fcn.37f89434
call fcn.37f84a48
cmp dword [ebp - 0x240], ebx
je 0x37f86e26
push dword [ebp + 0xc]
lea eax, [ebp - 0x22c]
push dword [ebp - 0x240]
push eax
call fcn.37f83b02
add esp, 0xc
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.37facac9
leave
ret
Function at 0x37f86e39
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x37f7d24c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
xor edi, edi
push eax
inc edi
call fcn.37f85dee
pop ecx
pop ecx
test eax, eax
je 0x37f86efe
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x37f61e18
call fcn.37f99814
call fcn.37f84e49
test eax, eax
je 0x37f86efc
call fcn.37f84d54
test eax, eax
jne 0x37f86efc
call fcn.37f864b2
test eax, eax
jne 0x37f86eb3
call fcn.37f85dab
test eax, eax
je 0x37f86efc
push dword [0x37fe5838]
call fcn.37f87a63
pop ecx
test eax, eax
jne 0x37f86efc
call fcn.37f85d6a
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.37f86c14
push 0
lea ecx, [ebp - 0x20c]
push ecx
push edi
push eax
call fcn.37f8615a
mov edi, eax
add esp, 0x18
lea eax, [ebp - 0x414]
test edi, edi
jne 0x37f86eed
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x37f86efc
push esi
push 0x37fe5864
push eax
call fcn.37f83b02
add esp, 0xc
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.37facac9
leave
ret

Function at 0x37f88694
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
jne 0x37f886af
mov eax, 0xa0
jmp 0x37f88786
push edi
mov dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
jmp 0x37f88731
mov eax, dword [esi]
xor edi, edi
cmp eax, ebx
je 0x37f886e0
push eax
call fcn.37f99ddb
mov edi, eax
cmp edi, ebx
jne 0x37f886e0
push ebx
push 0x77626966
call fcn.37f8b30c
mov dword [ebp - 0xc], 8
jmp 0x37f886f7
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x37f886ec
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0xc], eax
cmp edi, ebx
je 0x37f88701
push edi
call fcn.37f8acc0
push dword [ebp - 0xc]
call fcn.37f87bc4
pop ecx
test eax, eax
je 0x37f8876d
push 0x796d7466
push ebx
call fcn.37f8b39e
push dword [ebp + 8]
mov ecx, 0x37fe5b08
call fcn.37f87fa4
lea ecx, [ebp - 4]
mov dword [ebp + 8], ebx
call fcn.37f87d6b
lea ecx, [ebp - 4]
call fcn.37f87d47
movzx eax, word [esi + 0xc]
shr eax, 1
push ebx
and eax, 0x10
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call fcn.37f88002
mov edi, eax
add esp, 0x14
cmp edi, ebx
je 0x37f886b8
lea ecx, [ebp - 4]
call fcn.37f87d6b
mov eax, edi
jmp 0x37f88785
push dword [ebp + 8]
mov ecx, 0x37fe5b08
call fcn.37f87eac
lea ecx, [ebp - 4]
call fcn.37f87d6b
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x37f8878c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
jne 0x37f887a4
xor eax, eax
jmp 0x37f8889a
push esi
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x37f887b4
cmp dword [0x37fe5e00], ebx
je 0x37f887c6
mov dword [ebp - 4], ebx
call fcn.37f87b2b
test eax, eax
je 0x37f887cd
test byte [edi + 0xc], 0x10
jne 0x37f887cd
xor eax, eax
jmp 0x37f88899
lea ecx, [ebp - 0x10]
mov dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
call fcn.37f87d47
movzx eax, word [edi + 0xc]
neg esi
sbb esi, esi
shr eax, 1
and esi, 2
and eax, 0x10
mov dword [ebp - 0xc], esi
or eax, esi
jmp 0x37f8885c
mov eax, dword [edi]
cmp eax, ebx
je 0x37f88801
push eax
call fcn.37f99ddb
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x37f8880d
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp dword [ebp - 4], ebx
je 0x37f8882a
push dword [ebp - 4]
call fcn.37f8acc0
push esi
call fcn.37f87bc4
pop ecx
test eax, eax
je 0x37f8887d
push 0x796d7468
push ebx
call fcn.37f8b39e
push dword [ebp + 8]
mov ecx, 0x37fe5b08
call fcn.37f87fa4
movzx eax, word [edi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0xc]
mov dword [ebp + 8], ebx
push ebx
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push dword [edi + 8]
call fcn.37f88002
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x37f887f2
jmp 0x37f8888a
push dword [ebp + 8]
mov ecx, 0x37fe5b08
call fcn.37f87eac
lea ecx, [ebp - 0x10]
call fcn.37f87d6b
xor eax, eax
cmp esi, ebx
sete al
pop esi
pop edi
pop ebx
leave
ret
Function at 0x37f88c67
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x37f88c7d
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push ecx
push edi
lea ecx, [ebp + 0xc]
push ecx
push 0
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 2
pop ebx
mov esi, eax
cmp dword [ebp - 4], ebx
jae 0x37f88caf
cmp dword [ebp + 0xc], 1
je 0x37f88cad
cmp dword [ebp + 0xc], ebx
jne 0x37f88caf
mov esi, ebx
push esi
call fcn.37f87bc4
pop ecx
test eax, eax
je 0x37f88cd5
push 0x796d746b
push 0
call fcn.37f8b39e
push dword [ebp + 8]
mov ecx, 0x37fe5b08
call fcn.37f87fa4
jmp 0x37f88d35
test esi, esi
jne 0x37f88d28
cmp dword [ebp + 0xc], ebx
je 0x37f88ce4
cmp dword [ebp + 0xc], 1
jne 0x37f88cf0
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
mov word [edi + eax*2 - 2], cx
cmp dword [ebp + 0xc], ebx
je 0x37f88cfa
cmp byte [ebp + 0x1c], bl
jne 0x37f88d13
mov eax, dword [ebp + 0x18]
shr eax, 1
push eax
push edi
call fcn.37f8937d
pop ecx
pop ecx
test eax, eax
jne 0x37f88d13
mov esi, 0xea
jmp 0x37f88d28
movzx eax, byte [ebp + 0x1c]
push eax
push dword [ebp + 0xc]
call fcn.37f87b03
pop ecx
pop ecx
test eax, eax
jne 0x37f88d28
mov esi, ebx
push dword [ebp + 8]
mov ecx, 0x37fe5b08
call fcn.37f87eac
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret