joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1ee30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1eeff
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0xc], 0xffffffff
jne 0x1ee5f
mov esi, 0x6e
jmp 0x1eee9
mov al, byte [ebx + 0x14]
cmp al, 2
jne 0x1ee6d
mov esi, 1
jmp 0x1eee9
cmp al, 1
jne 0x1eee4
lea eax, [ebp - 4]
mov edx, esi
call fcn.00013cd4
lea eax, [ebp - 4]
mov edx, 0x1ef18
call fcn.00013ed4
lea eax, [ebp - 4]
mov edx, 0x1ef24
call fcn.00013ed4
push 0
push 0
mov eax, dword [ebx + 0x10]
push eax
mov eax, dword [ebx + 0xc]
push eax
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00013ecc
push eax
lea eax, [ebp - 4]
call fcn.0001409c
push eax
mov eax, dword [ebx + 0xc]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x1eedb
xor esi, esi
mov eax, dword [ebp - 8]
add dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 8], eax
jmp 0x1eee9
call sub.kernel32.dll_GetLastError_1
mov esi, eax
jmp 0x1eee9
mov esi, 0x6e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1ef06
lea eax, [ebp - 4]
call fcn.00013c3c
ret

Function at 0x26668
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x267b5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x26789
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x266bf
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x1b38b0], 0
je 0x266b5
mov eax, dword [0x1b38b0]
push eax
call sub.kernel32.dll_UnmapViewOfFile
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x266c9
xor eax, eax
mov dword [0x1b38b0], eax
xor eax, eax
push ebp
push 0x266fc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x1b38d4], 0
je 0x266f2
mov eax, dword [0x1b38d4]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x26706
xor eax, eax
mov dword [0x1b38d4], eax
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.0002b0cc
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x267cc
call fcn.00013f18
mov eax, dword [ebp - 8]
call fcn.00014090
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [0x1b38d4], eax
cmp dword [0x1b38d4], 0
je 0x2677f
push 0
push 0
push 0
push 4
mov eax, dword [0x1b38d4]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [0x1b38b0], eax
cmp dword [0x1b38b0], 0
jne 0x2677f
mov eax, dword [0x1b38d4]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [0x1b38d4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x2679a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x267bc
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00013c60
ret
Function at 0x268ec
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
mov byte [ebp - 1], 0
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
mov edx, dword [0x1b38e0]
call fcn.0002aea4
xor eax, eax
push ebp
push 0x26a3d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
mov eax, dword [0x1b38e0]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
push eax
call sub.kernel32.dll_ReadFile_1
call sub.kernel32.dll_GetLastError_1
mov edx, dword [ebp + 8]
mov dword [edx - 0x24], eax
lea edx, [ebp - 8]
mov eax, 0x1b38b0
mov ecx, 4
call fcn.00012840
add dword [ebp - 8], 0x138
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
cmp eax, dword [0x1b38e0]
jne 0x26a1e
mov eax, dword [0x2ab964]
add eax, 0x107884
add eax, 0x400
mov edx, dword [ebp + 8]
mov dword [edx - 0xc], eax
push 0
mov eax, dword [0x1b38e0]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 4]
mov eax, dword [ebp + 8]
lea edx, [eax - 0xc]
mov eax, dword [ebp - 8]
call fcn.00024c2c
mov edx, dword [ebp + 8]
mov dword [edx - 0x28], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x28], 0
jne 0x26a1e
mov eax, dword [ebp + 8]
add eax, 0xffffffe4
xor ecx, ecx
mov edx, 0x10
call fcn.00012b94
cmp dword [0x2ab960], 7
jne 0x269f1
lea ecx, [ebp - 0x18]
mov edx, dword [0x2ab964]
add edx, 0x107884
mov eax, dword [ebp - 8]
call fcn.0001aae8
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x18]
lea edi, [eax - 0x1c]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov edx, 0x2ab950
mov eax, dword [ebp + 8]
add eax, 0xffffffe4
mov ecx, 0x10
call fcn.0002b004
test al, al
je 0x26a1e
mov byte [ebp - 1], 1
mov eax, 0x1b38bc
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x2c]
call fcn.00014350
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x26a44
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
mov edx, dword [0x1b38e0]
call fcn.0002aecc
ret

Function at 0x299a4
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x29a55
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x29a38
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x1b3998]
add eax, 0xf003f
push eax
push 0
lea eax, [ebp - 0xc]
call fcn.00025330
mov eax, dword [ebp - 0xc]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x29a16
push 0x29a64
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x29a3f
cmp dword [ebp - 8], 0
je 0x29a32
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret
Function at 0x29a8c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x29b6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x29b4d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x1b3998]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x29b2b
mov dword [ebp - 0x10], 4
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x29b78
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x29b2b
cmp dword [ebp - 8], 4
jne 0x29b2b
cmp dword [ebp - 0xc], 1
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x29b54
cmp dword [ebp - 0x14], 0
je 0x29b47
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x14], eax
ret

Function at 0x29ba0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x29c62
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 1
xor eax, eax
push ebp
push 0x29c45
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x1b3998]
add eax, 0xf003f
push eax
push 0
lea eax, [ebp - 0x10]
call fcn.00025330
mov eax, dword [ebp - 0x10]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x29c23
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x29c70
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x29c4c
cmp dword [ebp - 0xc], 0
je 0x29c3f
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret
Function at 0x29c98
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x29d5a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 1
xor eax, eax
push ebp
push 0x29d3d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x1b3998]
add eax, 0xf003f
push eax
push 0
lea eax, [ebp - 0x10]
call fcn.00025330
mov eax, dword [ebp - 0x10]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x29d1b
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x29d68
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x29d44
cmp dword [ebp - 0xc], 0
je 0x29d37
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret
Function at 0x2a894
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
cmp byte [ebx], 0
je 0x2a965
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x2a95e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x1b3998]
add eax, 0xf003f
push eax
push 0
push 0x2a970
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2a93c
xor eax, eax
mov al, byte [ebx + 2]
mov dword [ebp - 0xc], eax
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push 0x2a9a0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
xor eax, eax
mov al, byte [ebx + 4]
mov dword [ebp - 0xc], eax
cmp byte [ebx + 5], 0
jbe 0x2a921
cmp byte [ebx + 4], 0x17
jae 0x2a921
inc dword [ebp - 0xc]
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push 0x2a9b4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2a965
cmp dword [ebp - 8], 0
je 0x2a958
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x2a9c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28], edx
mov edi, eax
xor eax, eax
push ebp
push 0x2ab7b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x2ab5e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x1b3998]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x28]
call fcn.00025330
mov eax, dword [ebp - 0x28]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2ab3c
mov dword [ebp - 0x10], 8
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x2ab8c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2ab3c
cmp dword [ebp - 0x14], 3
jne 0x2ab35
mov esi, dword [ebp - 0x20]
and esi, 0xffffffff
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ebx, eax
and ebx, 0xffffffff
mov eax, esi
call fcn.0001800c
mov byte [ebp - 0x21], al
mov word [ebp - 0xa], bx
mov eax, esi
call fcn.00018010
mov byte [ebp - 0x15], al
mov eax, esi
call fcn.0001800c
call fcn.00018010
mov ebx, eax
mov eax, esi
mov byte [ebp - 0x16], al
cmp word [ebp - 0xa], 0x7da
jb 0x2ab2c
cmp word [ebp - 0xa], 0x83e
ja 0x2ab2c
cmp bl, 1
jb 0x2ab2c
cmp bl, 0xc
ja 0x2ab2c
cmp byte [ebp - 0x21], 1
jb 0x2ab2c
cmp byte [ebp - 0x21], 0x1f
ja 0x2ab2c
cmp byte [ebp - 0x15], 0
jb 0x2ab2c
cmp byte [ebp - 0x15], 0x17
ja 0x2ab2c
cmp byte [ebp - 0x16], 0
jb 0x2ab2c
cmp byte [ebp - 0x16], 0x3b
ja 0x2ab2c
xor ecx, ecx
mov cl, byte [ebp - 0x21]
xor edx, edx
mov dl, bl
mov ax, word [ebp - 0xa]
call fcn.0002cbc4
fstp qword [ebp - 0x30]
wait
push 0
xor edx, edx
mov dl, byte [ebp - 0x16]
xor eax, eax
mov al, byte [ebp - 0x15]
xor ecx, ecx
call fcn.0002cb88
fadd qword [ebp - 0x30]
fstp qword [edi]
wait
jmp 0x2ab3c
mov dword [ebp - 4], 0xd
jmp 0x2ab3c
mov dword [ebp - 4], 0x70c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2ab65
cmp dword [ebp - 8], 0
je 0x2ab58
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret
Function at 0x2abb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
push ebp
push 0x2ad3f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x2ad22
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
push eax
mov eax, dword [0x1b3998]
add eax, 0xf003f
push eax
push 0
lea eax, [ebp - 0x2c]
call fcn.00025330
mov eax, dword [ebp - 0x2c]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2ad00
push dword [ebp + 0xc]
push dword [ebp + 8]
lea ecx, [ebp - 0x22]
lea edx, [ebp - 0x26]
lea eax, [ebp - 0x24]
call fcn.0002cd88
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 6]
push eax
lea ecx, [ebp - 0xa]
lea edx, [ebp - 8]
lea eax, [ebp - 0x1a]
call fcn.0002cb2c
movzx eax, word [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
shld edx, eax, 8
shl eax, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
xor eax, eax
mov al, byte [ebp - 0x26]
xor edx, edx
add eax, dword [ebp - 0x18]
adc edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
shld edx, eax, 8
shl eax, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
xor eax, eax
mov al, byte [ebp - 0x22]
xor edx, edx
add eax, dword [ebp - 0x18]
adc edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
shld edx, eax, 8
shl eax, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
xor eax, eax
mov al, byte [ebp - 0x1a]
xor edx, edx
add eax, dword [ebp - 0x18]
adc edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
shld edx, eax, 8
shl eax, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
xor eax, eax
mov al, byte [ebp - 8]
xor edx, edx
add eax, dword [ebp - 0x18]
adc edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push 8
lea eax, [ebp - 0x18]
push eax
push 3
push 0
push 0x2ad50
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2ad29
cmp dword [ebp - 0x20], 0
je 0x2ad1c
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x20], eax
ret
Function at 0x2ad74
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x2ae69
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x12c
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x2ae4c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x1b3998]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x18]
call fcn.00025330
mov eax, dword [ebp - 0x18]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x2ae2a
mov dword [ebp - 0x14], 4
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x2ae78
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x2ae2a
cmp dword [ebp - 0xc], 4
jne 0x2ae2a
cmp dword [ebp - 0x10], 0xa
jb 0x2ae2a
cmp dword [ebp - 0x10], 0x7080
jbe 0x2ae24
mov dword [ebp - 0x10], 0x7080
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2ae53
cmp dword [ebp - 8], 0
je 0x2ae46
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret

Function at 0x2b1f8
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00014090
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x2b21a
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x2b994
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x2ba91
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
mov word [eax], 0
mov word [edi], 0
mov eax, dword [ebp + 8]
mov word [eax], 0
mov word [esi], 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x2ba87
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0002aea4
xor eax, eax
push ebp
push 0x2ba80
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x2ba67
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x2baa4
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x2ba67
cmp dword [ebp - 0xc], 0x34
jne 0x2ba67
mov eax, dword [ebp - 0x10]
mov ax, word [eax + 0xc]
mov edx, dword [ebp + 8]
mov word [edx], ax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
call fcn.0001800c
mov word [esi], ax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
call fcn.0001800c
mov edx, dword [ebp + 0xc]
mov word [edx], ax
mov eax, dword [ebp - 0x10]
mov ax, word [eax + 8]
mov word [edi], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2ba87
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0002aecc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x2ba9b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x2baa8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x2bd0f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x2bd24
call fcn.00014350
xor eax, eax
push ebp
push 0x2bccd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x2bcab
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.0002aea4
xor eax, eax
push ebp
push 0x2bca4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x2bc7e
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x2bd28
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x2bc6f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
call fcn.0001800c
movzx eax, ax
lea edx, [ebp - 0x120]
call fcn.00012c2c
lea edx, [ebp - 0x120]
lea eax, [ebp - 0xc]
call fcn.00013e70
lea edx, [ebp - 0x120]
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 8]
call fcn.00012c2c
lea edx, [ebp - 0x120]
lea eax, [ebp - 8]
call fcn.00013e70
push dword [ebp - 0xc]
lea edx, [ebp - 0x124]
mov eax, 0x2bd2c
call fcn.00031d88
push dword [ebp - 0x124]
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00013f8c
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
call fcn.0001800c
movzx eax, ax
lea edx, [ebp - 0x120]
call fcn.00012c2c
lea edx, [ebp - 0x120]
lea eax, [ebp - 8]
call fcn.00013e70
push dword [ebp - 0xc]
lea edx, [ebp - 0x128]
mov eax, 0x2bd2c
call fcn.00031d88
push dword [ebp - 0x128]
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00013f8c
lea edx, [ebp - 0x120]
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0xc]
call fcn.00012c2c
lea edx, [ebp - 0x120]
lea eax, [ebp - 8]
call fcn.00013e70
push dword [ebp - 0xc]
lea edx, [ebp - 0x12c]
mov eax, 0x2bd2c
call fcn.00031d88
push dword [ebp - 0x12c]
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00013f8c
jmp 0x2bc8b
lea edx, [ebp - 0xc]
mov eax, 0x2bd30
call fcn.00031d88
jmp 0x2bc8b
lea edx, [ebp - 0xc]
mov eax, 0x2bd68
call fcn.00031d88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2bcb8
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.0002aecc
ret
lea edx, [ebp - 0xc]
mov eax, 0x2bd80
call fcn.00031d88
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.000144c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x2bce4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2bd16
lea eax, [ebp - 0x12c]
mov edx, 3
call fcn.00013c60
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00013c60
ret