joyce8/EMBER2024-capa huggingface dataset:
Function at 0x277b2981
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x27827980]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
xor esi, esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
jne 0x277b29b4
call edi
mov esi, eax
test esi, esi
je 0x277c9b11
mov eax, 1
mov dword [0x27827980], eax
cmp eax, 1
jne 0x277c9b54
test esi, esi
je 0x277c9b23
cmp word [esi], 0
mov eax, esi
je 0x277b29df
add eax, 2
cmp word [eax], 0
jne 0x277b29cd
add eax, 2
cmp word [eax], 0
jne 0x277b29cd
sub eax, esi
push 0
sar eax, 1
inc eax
push 0
mov ebp, eax
push 0
push 0
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x277c9b46
push edi
call fcn.277b19a5
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x277c9b46
push 0
push 0
push edi
push ebx
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x277c9b36
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
call ebp
mov ebx, eax
test ebx, ebx
je 0x277c9b2f
mov eax, 2
jmp 0x277b29af
call edi
mov esi, eax
test esi, esi
jne 0x277b29c5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push ebx
call fcn.277b1a46
add esp, 4
xor ebx, ebx
jmp 0x277b2a31
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x277c9b2f
test ebx, ebx
jne 0x277c9b65
call ebp
mov ebx, eax
test ebx, ebx
je 0x277c9b2f
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x277c9b7d
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x277c9b6d
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x277c9b6d
sub eax, ebx
inc eax
mov esi, eax
push esi
call fcn.277b19a5
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x277c9b9f
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x277b30c7
Capabilities:
Check os version

Disassembly:
cmp dword [0x2782900c], 0
push esi
push 1
pop esi
je 0x277b3117
mov eax, dword [esp + 8]
sub eax, 0
je 0x277c9369
dec eax
je 0x277b314a
dec eax
je 0x277c9361
dec eax
je 0x277c9348
dec eax
je 0x277b3134
dec eax
je 0x277c931c
dec eax
jne 0x277b3146
cmp dword [0x27828f88], 2
jne 0x277b3146
cmp dword [0x27828f7c], 3
jb 0x277b3146
mov eax, esi
pop esi
ret 4
push 0x27828f78
mov dword [0x2782900c], esi
mov dword [0x27828f78], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
jmp 0x277b30d4
cmp dword [0x27828f88], 2
jne 0x277b3146
cmp dword [0x27828f7c], 5
jae 0x277b3111
xor eax, eax
jmp 0x277b3113
xor eax, eax
cmp dword [0x27828f88], 2
sete al
jmp 0x277b3113
cmp dword [0x27828f88], esi
jne 0x277b3146
mov eax, dword [0x27828f7c]
cmp eax, 4
ja 0x277b3111
jne 0x277b3146
cmp dword [0x27828f80], 0xa
jmp 0x277b310f
cmp dword [0x27828f88], 2
jne 0x277b3146
cmp dword [0x27828f7c], 4
jmp 0x277b3144
cmp dword [0x27828f88], esi
jmp 0x277c934f
xor eax, eax
cmp dword [0x27828f88], esi
jmp 0x277b3153
Function at 0x277b3844
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push esi
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cmp eax, 9
mov dword [ebp - 4], eax
jl 0x277ca124
lea eax, [ebp - 0xcc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.277b38b0
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xcc]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x277b38ab
push dword [ebp + 0x10]
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov eax, esi
pop esi
leave
ret
xor eax, eax
jmp 0x277b38ad

Function at 0x277b38b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
cmp byte [ecx], bl
push edi
mov dword [ebp - 4], ebx
mov edx, ecx
je 0x277b38ca
inc edx
cmp byte [edx], bl
jne 0x277b38c5
mov esi, dword [ebp + 0x10]
dec edx
mov edi, esi
cmp edx, ecx
jb 0x277b38dc
mov al, byte [edx]
dec edx
mov byte [edi], al
inc edi
jmp 0x277b38d0
mov byte [edi], bl
cmp byte [esi], bl
mov edx, esi
je 0x277b38e9
inc edx
cmp byte [edx], bl
jne 0x277b38e4
dec edx
cmp byte [ecx], bl
mov dword [ebp + 8], edx
mov edi, ecx
je 0x277b38f8
inc edi
cmp byte [edi], bl
jne 0x277b38f3
dec edi
cmp ecx, edi
jae 0x277b3917
mov edx, esi
sub edx, ecx
mov al, byte [ecx]
xor byte [ecx + edx], al
movsx eax, byte [ecx + edx]
add dword [ebp - 4], eax
inc ecx
cmp ecx, edi
jb 0x277b3901
mov edx, dword [ebp + 8]
xor ebx, ebx
cmp esi, edx
mov ecx, esi
jae 0x277b3923
inc ecx
dec edx
cmp ecx, edx
jb 0x277b391d
mov eax, dword [ebp - 4]
push 0xa
lea edi, [ecx - 1]
xor edx, edx
pop ecx
div ecx
mov eax, dword [ebp + 0xc]
add dl, 0x61
cmp esi, edi
ja 0x277b3951
mov cl, byte [esi]
and cl, 0xf
add cl, dl
mov byte [eax], cl
mov cl, byte [esi]
sar cl, 4
inc eax
add cl, dl
mov byte [eax], cl
inc eax
inc esi
jmp 0x277b3936
pop edi
mov byte [eax], bl
pop esi
pop ebx
leave
ret
Function at 0x277ba090
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
push esi
xor esi, esi
push edi
push esi
push pe_nt_image_headers32
push 3
push esi
push 1
push SysReAllocStringLen
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x277c95d6
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x14]
cmp ecx, esi
je 0x277ba0cc
mov dword [ecx], eax
push esi
push esi
push esi
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
call edi
cmp ebx, 0xffffffff
je 0x277c95d6
push esi
push esi
push esi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push ebx
mov esi, eax
call edi
mov eax, esi
pop edi
pop esi
pop ebx
ret 8
xor eax, eax
jmp 0x277ba100

Function at 0x277ba759
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
je 0x277c916e
cmp dword [esi + 0x14], edi
je 0x277c916e
push esi
call fcn.277b761b
mov ecx, dword [esi + 0x40]
mov edx, dword [ebp + 0xc]
cmp edx, ecx
jge 0x277c9124
mov eax, dword [ebp + 0x10]
cmp eax, 0xffffffff
jne 0x277ba793
lea eax, [ecx - 1]
cmp eax, edi
jl 0x277c912c
cmp eax, ecx
jge 0x277c9133
mov ecx, dword [ebp + 0x14]
cmp edx, edi
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x54], eax
jl 0x277c913b
mov dword [esi + 0x48], edx
mov dword [esi + 0x50], edx
cmp edx, eax
je 0x277c915e
cmp ecx, edi
je 0x277c915e
push edi
push edi
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [esi]
call dword [sym.imp.USER32.dll_UpdateWindow]
test byte [esi + 0xc], 8
jne 0x277c9143
lea eax, [ebp + 8]
push eax
push edi
push esi
push 0x277ba805
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x58], eax
push 1
pop eax
pop edi
pop esi
pop ebp
ret 0x10
lea edx, [ecx - 1]
jmp 0x277ba788
xor eax, eax
jmp 0x277ba79b
lea eax, [ecx - 1]
jmp 0x277ba7a3
mov edx, dword [esi + 0x50]
jmp 0x277ba7ba
push 1
push esi
call fcn.277ba835
push edi
push dword [esi + 0x44]
push 0x2a
push dword [esi]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x277ba7f9
push 1
push edi
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x277ba7fc
xor eax, eax
jmp 0x277ba7ff
Function at 0x277bc7a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x14
lea eax, [esi + 0x60]
push eax
push 0x1046
call fcn.277bc998
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push eax
call edi
lea ebx, [esi + 0x74]
push 0x28
push ebx
push 0x1047
call fcn.277bc998
push eax
call edi
lea eax, [esi + 0x9c]
push 0x14
push eax
push 0x1048
call fcn.277bc998
push eax
call edi
mov eax, ebx
mov cl, byte [eax]
test cl, cl
je 0x277bc804
cmp cl, 0x79
je 0x277bc804
cmp cl, 0x4d
jne 0x277c8633
cmp byte [eax], 0x79
je 0x277c863f
mov dword [esi + 0xb0], 1
and dword [ebp + 0xc], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [esi + 0xb4]
mov ebx, 0x400
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0x2a
push dword [ebp - 4]
add eax, 0x38
push eax
push ebx
call edi
test eax, eax
je 0x277c864b
inc dword [ebp + 0xc]
add dword [ebp - 4], 0x2a
cmp dword [ebp + 0xc], 0xc
jl 0x277bc82f
and dword [ebp + 0xc], 0
lea eax, [esi + 0x2ac]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0xb
push dword [ebp - 4]
add eax, 0x31
push eax
push ebx
call edi
test eax, eax
je 0x277c864b
inc dword [ebp + 0xc]
add dword [ebp - 4], 0xb
cmp dword [ebp + 0xc], 7
jl 0x277bc860
mov eax, dword [ebp + 8]
test byte [eax + 0x695], 2
je 0x277bc970
lea eax, [ebp - 0x54]
push 0x40
push eax
push 0x100d
push ebx
call edi
test eax, eax
jle 0x277bc8b3
movsx eax, byte [ebp - 0x54]
sub eax, 0x30
mov dword [esi + 0x300], eax
push 0xc
lea eax, [esi + 0x304]
lea ecx, [esi + 0xb4]
pop edx
mov dword [eax], ecx
add eax, 4
add ecx, 0x2a
dec edx
jne 0x277bc8c2
push 7
lea eax, [esi + 0x334]
lea ecx, [esi + 0x2ac]
pop edx
mov dword [eax], ecx
add eax, 4
add ecx, 0xb
dec edx
jne 0x277bc8dc
push 0x20
push esi
push 0x1043
call fcn.277bc998
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push eax
call edi
add esi, 0x20
push 0x40
push esi
push 0x1044
call fcn.277bc998
push eax
call edi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x368], 0
je 0x277bc966
mov ax, word [esi + 0x464]
mov word [ebp - 0x14], ax
mov ax, word [esi + 0x466]
mov word [ebp - 0x12], ax
mov ax, word [esi + 0x46a]
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.277bced8
push esi
call fcn.277bd343
lea eax, [esi + 0x3f4]
push eax
push esi
call fcn.277bd406
push esi
call fcn.277bd552
push esi
call fcn.277bd5c9
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
lea eax, [ebp - 0x54]
push 0x40
push eax
push 0x100c
push ebx
call edi
test eax, eax
jle 0x277bc894
movsx eax, byte [ebp - 0x54]
sub eax, 0x30
mov dword [esi + 0x2fc], eax
jmp 0x277bc894
push eax
call dword [sym.imp.USER32.dll_CharNextA]
jmp 0x277bc7f0
and dword [esi + 0xb0], 0
jmp 0x277bc817
xor eax, eax
jmp 0x277bc969
Function at 0x277bdae5
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x2a0], edi
jne 0x277bdb00
pop edi
pop esi
leave
ret
mov eax, dword [esi + 0xa0]
cmp eax, edi
je 0x277bdafc
push ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push edi
push edi
push 0x31
mov dword [ebp - 8], eax
push dword [esi + 0xa0]
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x20], eax
push ecx
push 0x3c
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
xor eax, eax
cmp dword [ebp - 0x4c], 0x2bc
setl al
dec eax
and eax, 0xc8
add eax, 0x320
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
mov dword [ebp - 0x18], eax
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x1c], eax
mov edi, dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
lea eax, [ebp - 0x14]
push eax
push 2
push 0x277c19ee
push dword [ebp - 8]
call edi
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x9c]
push 0x40
push eax
lea eax, [esi + 0x1d4]
push 0
push eax
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x164]
push 0x277c19e8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x164]
push eax
push dword [ebp - 8]
call edi
mov eax, dword [ebp - 0x10]
cmp ebx, eax
jg 0x277c5d63
add eax, 4
and dword [ebp - 4], 0
mov dword [esi + 0x298], eax
lea eax, [ebp - 0xe4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push 0xa
push dword [ebp - 0xc]
add eax, 0x31
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
inc dword [ebp - 4]
add dword [ebp - 0xc], 0xa
cmp dword [ebp - 4], 7
jl 0x277bdc03
push dword [ebp - 0x20]
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_SelectObject]
lea eax, [ebp - 0xe4]
mov dword [ebp - 0xc], 7
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call edi
cmp dword [ebp - 0x10], ebx
jg 0x277c5d6a
add dword [ebp - 4], 0xa
dec dword [ebp - 0xc]
jne 0x277bdc43
push dword [ebp - 0x1c]
lea eax, [ebx + ebx*8 + 0x14]
mov dword [esi + 0x29c], eax
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x18]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 8]
push dword [esi + 0xa0]
call dword [sym.imp.USER32.dll_ReleaseDC]
and dword [esi + 0x2a0], 0
pop ebx
jmp 0x277bdafc
mov eax, ebx
jmp 0x277bdbed
mov ebx, dword [ebp - 0x10]
jmp 0x277bdc62
Function at 0x277c3a6f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 1
lea esi, [ebp - 0x20]
pop ebx
push edi
mov dword [ebp - 0xc], ebx
call fcn.277b89b0
mov eax, dword [edi + 0x18]
test eax, eax
jne 0x277c7eb9
movzx ecx, word [ebp - 0xc]
movzx eax, word [edi + 0x2c]
shl ecx, 0x10
pop edi
pop esi
or eax, ecx
pop ebx
leave
ret 4
test byte [edi + 8], 2
je 0x277c3a95
cmp dword [edi + 0x30], 2
jne 0x277c7eea
push 0
push 0
push 0x188
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [edi + 0x2c], eax
push edi
call fcn.277b8a4a
mov dword [ebp - 0xc], eax
jmp 0x277c3a95
lea ecx, [ebp - 0x20]
push 0x12
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp dword [edi + 0x20], 0x10
je 0x277c7f58
lea eax, [ebp - 2]
push eax
call fcn.277e226b
cmp byte [ebp - 0x20], 0x2d
jne 0x277c7f12
or ebx, 0xffffffff
lea esi, [ebp - 0x1f]
and dword [ebp - 8], 0
mov al, byte [esi]
test al, al
je 0x277c7f4f
cmp al, byte [ebp - 2]
mov byte [ebp + 8], al
jne 0x277c7f33
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
je 0x277c7f4c
mov al, byte [ebp + 8]
add al, 0xd0
cmp al, 9
ja 0x277c3a95
mov ecx, dword [ebp - 8]
movsx eax, al
lea ecx, [ecx + ecx*4]
lea eax, [eax + ecx*2]
mov dword [ebp - 8], eax
inc esi
jmp 0x277c7f16
imul ebx, dword [ebp - 8]
mov dword [edi + 0x2c], ebx
jmp 0x277c7edc
cmp byte [ebp - 0x20], 0x78
je 0x277c7f96
cmp byte [ebp - 0x20], 0x58
je 0x277c7f96
cmp byte [ebp - 0x20], 0x30
jne 0x277c7f79
cmp byte [ebp - 0x1f], 0x78
je 0x277c7f76
cmp byte [ebp - 0x1f], 0x58
jne 0x277c7f79
lea esi, [ebp - 0x1e]
xor ecx, ecx
mov al, byte [esi]
test al, al
je 0x277c7fbb
cmp al, 0x41
jl 0x277c7f9b
cmp al, 0x46
jg 0x277c7f9b
sub al, 0x37
movsx eax, al
shl ecx, 4
add ecx, eax
inc esi
jmp 0x277c7f7b
lea esi, [ebp - 0x1f]
jmp 0x277c7f79
cmp al, 0x61
jl 0x277c7fa7
cmp al, 0x66
jg 0x277c7fa7
sub al, 0x57
jmp 0x277c7f8b
cmp al, 0x30
jl 0x277c3a95
cmp al, 0x39
jg 0x277c3a95
sub al, 0x30
jmp 0x277c7f8b
mov dword [edi + 0x2c], ecx
jmp 0x277c7edc
Function at 0x277d2ba2
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
xor eax, eax
push esi
cmp dword [esp + 0x14], eax
push edi
push eax
je 0x277d2bfa
mov ebx, dword [esp + 0x18]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, 0x9cf
push edi
push ebx
call esi
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebp
push 0
push edi
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
mov edi, 0x8fd
push edi
push ebx
call esi
push eax
call ebp
push 5
push edi
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ebx, dword [esp + 0x18]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, 0x8fd
push edi
push ebx
call esi
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebp
push 0
push edi
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
mov edi, 0x9cf
jmp 0x277d2bdf
Function at 0x277d7737
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push ebx
push esi
push edi
xor esi, esi
push dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.277d86c4
test eax, eax
pop ecx
jne 0x277d7763
push esi
push dword [ebp + 0x10]
call fcn.277d8122
pop ecx
pop ecx
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x10]
call fcn.277d76ec
pop ecx
test eax, eax
pop ecx
je 0x277d787d
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x138]
push 0x27829d3c
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x2001f
push esi
push 0x2782a650
lea eax, [ebp - 0x138]
push esi
push eax
push SysReAllocStringLen
call ebx
cmp eax, esi
jne 0x277d787d
cmp dword [ebp + 0xc], esi
jne 0x277d789e
push dword [ebp + 8]
lea eax, [ebp - 0x138]
push 0x27829d48
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
lea eax, [ebp - 0x138]
push eax
push 1
push esi
push esi
push dword [ebp - 8]
call edi
cmp eax, esi
jne 0x277d787d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x2001f
push esi
push 0x2782a654
push esi
push 0x27829d54
push dword [ebp - 8]
call ebx
cmp eax, esi
jne 0x277d787d
lea eax, [ebp - 0x138]
push 0x104
push eax
push dword [0x278272e8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, esi
je 0x277d787d
inc eax
push eax
lea eax, [ebp - 0x138]
push eax
push 1
push esi
push esi
push dword [ebp - 4]
call edi
cmp eax, esi
jne 0x277d787d
cmp dword [ebp + 0x14], esi
je 0x277d78b3
push 0xa
push str.Apartment
push 1
push esi
push 0x27829d70
push dword [ebp - 4]
call edi
cmp eax, esi
je 0x277d78c1
cmp dword [ebp - 8], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x277d788d
push dword [ebp - 8]
call edi
cmp dword [ebp - 4], esi
je 0x277d7897
push dword [ebp - 4]
call edi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp + 0xc]
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x277d77e2
push str.ThreadingModel
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push 1
pop eax
jmp 0x277d7899
Function at 0x277d81c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
push eax
push dword [ebp + 0x14]
call fcn.277d8122
pop ecx
test eax, eax
pop ecx
je 0x277d8275
cmp dword [ebp - 0xc], 0
je 0x277d832c
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x114]
push ebx
push dword [ebp + 8]
push 0x27829e84
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x114]
mov edi, SysReAllocStringLen
push eax
push edi
call fcn.277d8334
pop ecx
test eax, eax
pop ecx
je 0x277d8275
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.277d83b8
add esp, 0x14
test eax, eax
jne 0x277d827c
cmp dword [ebp - 8], eax
jne 0x277d832c
push ebx
lea eax, [ebp - 0x114]
push dword [ebp + 8]
push 0x27829e90
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x114]
push eax
push edi
call fcn.277d8334
pop ecx
test eax, eax
pop ecx
jne 0x277d832c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call fcn.277d847a
add esp, 0xc
lea eax, [ebp - 0x114]
push ebx
push dword [ebp + 8]
push str._s._sCurVer
push eax
call esi
add esp, 0x10
lea eax, [ebp + 0x14]
push eax
push 0xf003f
lea eax, [ebp - 0x114]
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor ecx, ecx
cmp eax, ecx
je 0x277d8323
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0x14]
push eax
push ecx
push 0x2001f
push ecx
push 0x2782a690
lea eax, [ebp - 0x114]
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x277d832c
push dword [ebp - 4]
lea eax, [ebp - 0x114]
push ebx
push dword [ebp + 8]
push 0x27829ea8
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x114]
push eax
push 1
push 0
push 0
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
jmp 0x277d8277

Function at 0x277d8334
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
lea eax, [ebp - 4]
push esi
push eax
xor esi, esi
push 0xf003f
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
je 0x277d835f
xor eax, eax
pop esi
leave
ret
push esi
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 8], 0x104
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, esi
jne 0x277d8398
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.277d8334
pop ecx
cmp eax, esi
pop ecx
jne 0x277d835f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor ecx, ecx
cmp eax, esi
sete cl
mov eax, ecx
jmp 0x277d835c