joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51da0c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x56fcac]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0051d884
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004ec1b0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x51da5b
cmp dword [ebp - 0x1c], 5
jb 0x51da73
jmp 0x51da6f
cmp dword [ebp - 0x10], 1
jne 0x51da73
cmp dword [ebp - 0x1c], 4
ja 0x51da6f
jne 0x51da73
cmp dword [ebp - 0x18], 0
jbe 0x51da73
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x547eb4
call fcn.0051d641
test eax, eax
jge 0x51da94
mov byte [0x572004], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004ead41
add ebp, 0x78
leave
ret
Function at 0x273b1a6a
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push esi
xor esi, esi
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.273b3b1c
lea eax, [ebp - 0x42c]
push 0x400
push eax
push 0xfa2
push esi
call fcn.273be527
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
cmp eax, esi
jne 0x273b1ace
mov edi, 0x273d0580
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x42c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
lea eax, [ebp - 0x42c]
push 0x273d8c3c
push eax
call fcn.273b1c12
pop ecx
cmp eax, esi
pop ecx
jne 0x273b1b52
push 0x273d8c1c
push 0x273d8c18
call fcn.273b1cab
pop ecx
cmp eax, esi
pop ecx
jne 0x273b1b04
mov eax, dword [0x273d8c18]
cmp eax, 3
jae 0x273b1b16
xor eax, eax
mov dword [0x273d8c1c], esi
cmp eax, 3
mov dword [0x273d8c18], eax
jb 0x273b1b41
xor ecx, ecx
cmp eax, 3
jne 0x273b1b21
push 1
jmp 0x273b1b28
cmp eax, 4
jne 0x273b1b29
push 2
pop ecx
push 0x273d8c48
push 9
push esi
push ecx
push 0x273d01c0
call dword [sym.imp.OLEAUT32.dll_RegisterTypeLib]
cmp eax, esi
je 0x273b1b47
mov dword [0x273d8c48], esi
call fcn.273b223a
mov edi, eax
cmp edi, esi
je 0x273b1b60
mov dword [ebp - 8], 0xfa3
mov edi, 0x80004005
jmp 0x273b1b8f
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x273d8ba8
mov dword [0x273d8c14], eax
call esi
push 0x273d8b90
call esi
push 0x273d8bc0
call esi
xor esi, esi
cmp edi, esi
je 0x273b1c0e
cmp dword [ebp - 8], esi
je 0x273b1be3
cmp dword [0x273d8c4c], esi
je 0x273b1be3
lea eax, [ebp - 4]
push eax
call fcn.273bac13
cmp eax, esi
pop ecx
jne 0x273b1be3
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x42c]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp eax, esi
jne 0x273b1bd6
push dword [ebp - 8]
mov ecx, dword [ebp - 4]
push 1
call fcn.273bad66
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [ebp - 4]
cmp ecx, esi
je 0x273b1be3
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [0x273d8c3c]
cmp eax, esi
je 0x273b1bf9
push eax
call fcn.273bd1b4
pop ecx
mov dword [0x273d8c3c], esi
mov eax, dword [0x273d8c48]
cmp eax, esi
je 0x273b1c0e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [0x273d8c48], esi
pop edi
pop esi
leave
ret
Function at 0x273b1cab
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov edi, reloc.OLEAUT32.dll_SysReAllocString
xor ebx, ebx
push str.SYSTEMCurrentControlSetServicesW3SVCParameters
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp eax, ebx
jne 0x273b1d19
lea eax, [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push eax
push ebx
push str.MajorVersion
push dword [ebp - 4]
call esi
cmp eax, ebx
jne 0x273b1d19
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push dword [ebp + 0xc]
push eax
push ebx
push str.MinorVersion
push dword [ebp - 4]
call esi
cmp eax, ebx
je 0x273b1d22
mov dword [ebp - 8], 0x8000ffff
jmp 0x273b1d55
mov esi, dword [ebp + 8]
cmp dword [esi], 3
jae 0x273b1d55
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.SYSTEMCurrentControlSetServicesW3SVCASP
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x273b1d55
mov eax, dword [ebp + 0xc]
mov dword [esi], 3
mov dword [eax], ebx
cmp dword [ebp - 4], ebx
je 0x273b1d63
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x273b1ef1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x320
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push esi
push edi
call fcn.273b2050
mov esi, eax
test esi, esi
jne 0x273b1ff5
call fcn.273b219c
mov esi, eax
test esi, esi
jne 0x273b1ff5
mov esi, str.132096
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push 1
push str.CLSID6B7F1602_D44C_11d0_A7D9_AE3D17000000MiscStatus1
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
jne 0x273b1f62
lea eax, [ebp - 0x110]
push 0x104
push eax
push dword [0x273d8c84]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x273b1f6c
mov esi, 0x8000ffff
jmp 0x273b1ff5
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.273b1c12
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x273b1ff5
push dword [ebp - 4]
lea eax, [ebp - 0x320]
push eax
call fcn.273bf7b0
pop ecx
lea eax, [ebp - 0x320]
pop ecx
push 0x273d458c
push eax
call fcn.273bf770
pop ecx
lea eax, [ebp - 8]
pop ecx
push eax
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.OLEAUT32.dll_LoadRegTypeLib]
mov esi, eax
test esi, esi
jne 0x273b1ff5
push eax
lea eax, [ebp - 0x320]
push eax
push dword [ebp - 8]
call dword [sym.imp.OLEAUT32.dll_QueryPathOfRegTypeLib]
mov esi, eax
test esi, esi
jne 0x273b1ff5
push 5
push str.Both
sub esp, 0x10
mov esi, 0x273d0250
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.273b245f
add esp, 0x18
mov esi, eax
cmp dword [ebp - 4], 0
je 0x273b2004
push dword [ebp - 4]
call fcn.273bd1b4
pop ecx
mov eax, dword [ebp - 8]
test eax, eax
je 0x273b2011
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
je 0x273b201a
call fcn.273b2025
xor eax, eax
pop edi
test esi, esi
sete al
pop esi
leave
ret
Function at 0x273b2050
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push ebx
push edi
push 0x25
xor eax, eax
pop ecx
lea edi, [ebp - 0xa0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa0]
xor ebx, ebx
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0xa0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 2
je 0x273b209a
xor eax, eax
jmp 0x273b2130
lea eax, [ebp - 4]
push esi
push eax
push str.SYSTEMCurrentControlSetServicesEventLogApplicationWebClassRuntime
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
cmp eax, ebx
jne 0x273b2117
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push ebx
call fcn.273be527
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, ebx
jne 0x273b20d9
mov dword [ebp - 8], 0x8000ffff
jmp 0x273b211e
inc eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 2
push ebx
push str.EventMessageFile
push dword [ebp - 4]
call esi
cmp eax, ebx
jne 0x273b2117
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push ebx
push str.TypesSupported
push dword [ebp - 4]
mov dword [ebp - 0xc], 7
call esi
cmp eax, ebx
je 0x273b211e
mov dword [ebp - 8], 0x80004005
cmp dword [ebp - 4], ebx
je 0x273b212c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
pop edi
pop ebx
leave
ret

Function at 0x273b2134
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push esi
push edi
push 0x25
xor eax, eax
pop ecx
lea edi, [ebp - 0x94]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x94]
xor esi, esi
push eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x273b2170
mov esi, 0x8000ffff
jmp 0x273b2196
cmp dword [ebp - 0x84], 2
je 0x273b217d
xor eax, eax
jmp 0x273b2198
push str.SYSTEMCurrentControlSetServicesEventLogApplicationWebClassRuntime
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x273b2196
mov esi, 0x80004005
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x273b219c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
push eax
xor esi, esi
and dword [ebp - 4], esi
push str.SOFTWAREMicrosoftVisual_Basic6.0WebClass
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x273b21e1
lea eax, [ebp - 8]
push 4
push eax
push 4
push esi
push str.LogErrors
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x273b21e6
mov esi, 0x8000ffff
cmp dword [ebp - 4], 0
je 0x273b21f5
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x273b245f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 6
pop ecx
lea eax, [ebp - 0xc]
mov esi, str.CLSID_sInprocServer32
lea edi, [ebp - 0x28]
push eax
lea eax, [ebp + 8]
xor ebx, ebx
push eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
xor edi, edi
call dword [sym.imp.ole32.dll_StringFromCLSID]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x273b252c
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call fcn.273b255b
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
jne 0x273b252c
mov edi, dword [ebp - 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
add esi, 0x19
lea eax, [esi + 1]
push eax
call fcn.273bd18d
mov edi, eax
pop ecx
cmp edi, ebx
jne 0x273b24db
mov dword [ebp - 4], 0x8007000e
jmp 0x273b252c
push dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
push esi
push edi
call fcn.273bf7e0
add esp, 0x10
cmp eax, ebx
je 0x273b2525
lea eax, [ebp - 0x10]
push eax
push 0x20006
push ebx
push edi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x273b2525
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 1
push ebx
push 0x273d46a0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
je 0x273b252c
mov dword [ebp - 4], 0x8000ffff
cmp dword [ebp - 0xc], ebx
je 0x273b253a
push dword [ebp - 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 8], ebx
je 0x273b2548
push dword [ebp - 8]
call fcn.273bd1b4
pop ecx
cmp edi, ebx
je 0x273b2553
push edi
call fcn.273bd1b4
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x273b365a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
cmp word [eax], 0
mov edi, eax
je 0x273b36b0
mov ecx, dword [esp + 0x14]
mov esi, edi
sub esi, ecx
mov ax, word [ecx + esi]
test ax, ax
je 0x273b368c
mov dx, word [ecx]
test dx, dx
je 0x273b368c
movzx ebx, ax
movzx edx, dx
sub ebx, edx
je 0x273b369e
movzx edx, word [ecx]
movzx eax, ax
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x20
jne 0x273b36a2
inc ecx
inc ecx
jmp 0x273b3671
cmp word [ecx], 0
je 0x273b36b6
inc edi
inc edi
cmp word [edi], 0
jne 0x273b3669
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, edi
jmp 0x273b36b2
Function at 0x273b3b1c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push edi
push eax
xor esi, esi
push str.SOFTWAREMicrosoftVisual_Basic6.0WebClass
push reloc.OLEAUT32.dll_SysReAllocString
xor edi, edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
cmp eax, esi
je 0x273b3b57
mov edi, 0x800a232c
jmp 0x273b3b88
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.LogErrors
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, esi
je 0x273b3b7b
push 1
pop edi
jmp 0x273b3b88
xor eax, eax
cmp dword [ebp - 8], esi
setne al
mov dword [0x273d8c4c], eax
cmp dword [ebp - 4], esi
je 0x273b3b96
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x273b3ba4
mov dword [0x273d8c4c], 1
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x273b3baa
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov eax, dword [eax]
push dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov ebx, dword [eax]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
lea edi, [ebx + eax*2]
call fcn.273bf750
pop ecx
mov dword [ebp - 0x1c], eax
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0x14], ecx
jbe 0x273b3d25
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x14], eax
jmp 0x273b3bf1
xor ecx, ecx
mov eax, dword [ebp + 0x14]
mov ax, word [eax]
cmp ax, 0x23
mov dword [ebp - 0x10], eax
je 0x273b3c73
cmp ax, 0x3f
je 0x273b3c73
cmp ax, 0x26
je 0x273b3c73
cmp ax, 0x3d
je 0x273b3c73
cmp ax, 0x25
je 0x273b3c73
cmp ax, 0x20
jbe 0x273b3c73
cmp ax, 0x7a
ja 0x273b3c73
mov ecx, dword [ebp + 0xc]
add ecx, esi
lea ecx, [ecx + ecx + 2]
cmp dword [ebp - 8], ecx
ja 0x273b3c69
mov eax, dword [ebp - 8]
mov ecx, dword [0x273d8c14]
xor edx, edx
div ecx
inc eax
imul eax, ecx
push eax
push ebx
push 0
mov dword [ebp - 8], eax
push dword [0x273d8cd8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebx, eax
test ebx, ebx
je 0x273b3d48
mov eax, dword [ebp + 0xc]
lea edi, [ebx + eax*2]
mov eax, dword [ebp - 0x10]
mov word [edi + esi*2], ax
inc esi
jmp 0x273b3d12
push ecx
push ecx
lea eax, [ebp - 4]
push 3
push eax
lea eax, [ebp - 0x10]
push 1
push eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
mov dword [ebp - 0x18], eax
je 0x273b3d3f
lea ecx, [esi + eax*2]
mov edx, eax
mov eax, dword [ebp - 8]
add edx, ecx
add edx, dword [ebp + 0xc]
shl edx, 1
cmp eax, edx
ja 0x273b3cd4
mov ecx, dword [0x273d8c14]
xor edx, edx
div ecx
inc eax
imul eax, ecx
push eax
push ebx
push 0
mov dword [ebp - 8], eax
push dword [0x273d8cd8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebx, eax
test ebx, ebx
je 0x273b3d48
mov eax, dword [ebp + 0xc]
lea edi, [ebx + eax*2]
mov word [edi + esi*2], 0x25
inc esi
push 0x10
lea eax, [edi + esi*2]
push eax
movzx eax, byte [ebp - 4]
push eax
call fcn.273bfb70
add esp, 0xc
inc esi
inc esi
cmp dword [ebp - 0x18], 1
jle 0x273b3d12
mov word [edi + esi*2], 0x25
inc esi
push 0x10
lea eax, [edi + esi*2]
push eax
movzx eax, byte [ebp - 3]
push eax
call fcn.273bfb70
add esp, 0xc
inc esi
inc esi
inc dword [ebp - 0x14]
add dword [ebp + 0x14], 2
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1c]
jb 0x273b3bef
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
mov dword [ebp - 0xc], 0x8000ffff
jmp 0x273b3d37
mov dword [ebp - 0xc], 0x8007000e
jmp 0x273b3d37
Function at 0x273bd31e
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push ebx
push esi
push edi
xor esi, esi
push dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.273be2ea
test eax, eax
pop ecx
jne 0x273bd34a
push esi
push dword [ebp + 0x10]
call fcn.273bdcf1
pop ecx
pop ecx
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x10]
call fcn.273bd2d3
pop ecx
test eax, eax
pop ecx
je 0x273bd472
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x138]
push 0x273d5114
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x2001f
push esi
push 0x273d8d18
lea eax, [ebp - 0x138]
push esi
push eax
push SysReAllocStringLen
call ebx
cmp eax, esi
jne 0x273bd472
cmp dword [ebp + 0xc], esi
jne 0x273bd3c7
push dword [ebp + 8]
lea eax, [ebp - 0x138]
push 0x273d5120
push eax
call edi
add esp, 0xc
jmp 0x273bd3d7
push dword [ebp + 0xc]
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
lea eax, [ebp - 0x138]
push eax
push 1
push esi
push esi
push dword [ebp - 8]
call edi
cmp eax, esi
jne 0x273bd472
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x2001f
push esi
push 0x273d8d1c
push esi
push 0x273d512c
push dword [ebp - 8]
call ebx
cmp eax, esi
jne 0x273bd472
lea eax, [ebp - 0x138]
push 0x104
push eax
push dword [0x273d8c84]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, esi
je 0x273bd472
inc eax
push eax
lea eax, [ebp - 0x138]
push eax
push 1
push esi
push esi
push dword [ebp - 4]
call edi
cmp eax, esi
jne 0x273bd472
cmp dword [ebp + 0x14], esi
je 0x273bd490
push 0xa
push str.Apartment
push 1
push esi
push 0x273d5148
push dword [ebp - 4]
call edi
cmp eax, esi
je 0x273bd49e
cmp dword [ebp - 8], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x273bd482
push dword [ebp - 8]
call edi
cmp dword [ebp - 4], esi
je 0x273bd48c
push dword [ebp - 4]
call edi
xor eax, eax
jmp 0x273bd4b1
push str.ThreadingModel
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x273bdd8f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
push eax
push dword [ebp + 0x14]
call fcn.273bdcf1
pop ecx
test eax, eax
pop ecx
je 0x273bde44
cmp dword [ebp - 0xc], 0
je 0x273bdefb
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x114]
push ebx
push dword [ebp + 8]
push 0x273d525c
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x114]
mov edi, SysReAllocStringLen
push eax
push edi
call fcn.273bdf5d
pop ecx
test eax, eax
pop ecx
je 0x273bde44
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.273bdfe1
add esp, 0x14
test eax, eax
jne 0x273bde4b
cmp dword [ebp - 8], eax
jne 0x273bdefb
push ebx
lea eax, [ebp - 0x114]
push dword [ebp + 8]
push 0x273d5268
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x114]
push eax
push edi
call fcn.273bdf5d
pop ecx
test eax, eax
pop ecx
jne 0x273bdefb
xor eax, eax
jmp 0x273bdefe
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call fcn.273be0a3
add esp, 0xc
lea eax, [ebp - 0x114]
push ebx
push dword [ebp + 8]
push str._s._sCurVer
push eax
call esi
add esp, 0x10
lea eax, [ebp + 0x14]
push eax
push 0xf003f
lea eax, [ebp - 0x114]
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor ecx, ecx
cmp eax, ecx
je 0x273bdef2
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0x14]
push eax
push ecx
push 0x2001f
push ecx
push 0x273d8d58
lea eax, [ebp - 0x114]
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x273bdefb
push dword [ebp - 4]
lea eax, [ebp - 0x114]
push ebx
push dword [ebp + 8]
push 0x273d5280
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x114]
push eax
push 1
push 0
push 0
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x273bdf5d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
lea eax, [ebp - 4]
push esi
push eax
xor esi, esi
push 0xf003f
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
je 0x273bdf87
xor eax, eax
jmp 0x273bdfde
push esi
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 8], 0x104
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, esi
jne 0x273bdfc0
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.273bdf5d
pop ecx
cmp eax, esi
pop ecx
jne 0x273bdf87
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor ecx, ecx
cmp eax, esi
sete cl
mov eax, ecx
pop esi
leave
ret
Function at 0x273be177
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x18]
xor esi, esi
push eax
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, esi
jne 0x273be1c9
push dword [ebp - 4]
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x18]
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x273be1d0
xor eax, eax
jmp 0x273be297
lea eax, [ebp - 0x24]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x128]
mov dword [ebp - 8], esi
push eax
push esi
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x273be28f
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc]
push eax
push 0xf003f
lea eax, [ebp - 0x128]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
mov dword [ebp - 0x10], eax
jne 0x273be28f
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0x2001f
push esi
push 0x273d8d64
lea eax, [ebp - 0x128]
push esi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
mov dword [ebp - 0x10], eax
jne 0x273be28a
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call fcn.273be177
pop ecx
pop ecx
push dword [ebp - 0xc]
call edi
push dword [ebp - 0x14]
call edi
lea eax, [ebp - 0x24]
inc dword [ebp - 8]
push eax
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call ebx
test eax, eax
je 0x273be1ff
jmp 0x273be28f
push dword [ebp - 0xc]
call edi
xor eax, eax
cmp dword [ebp - 0x10], esi
sete al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x273be29c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
cmp dword [ebp + 0xc], 0
push edi
mov esi, str.HELP
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jne 0x273be2b8
xor eax, eax
jmp 0x273be2e6
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add esi, eax
cmp esi, dword [ebp + 0xc]
jae 0x273be2e4
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, esi
pop edi
pop esi
leave
ret