joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a31b
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp dword [ebp + 8], ebx
push edi
je 0x1001a431
cmp dword [ebp + 0xc], ebx
je 0x1001a431
cmp dword [ebp + 0x10], ebx
je 0x1001a431
cmp dword [ebp + 0x14], ebx
je 0x1001a431
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 0x1003ad00
push 1
push ebx
push 0x1003ab80
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1001a431
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x1001a431
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
test eax, eax
jl 0x1001a428
mov eax, dword [ebp - 4]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
test eax, eax
jl 0x1001a428
cmp dword [ebp + 0x1c], ebx
je 0x1001a3b1
mov eax, dword [ebp - 4]
push dword [ebp + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
test eax, eax
jl 0x1001a428
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 4]
lea edx, [ebp + 8]
mov dword [ebp + 8], ebx
push edx
mov ecx, dword [eax]
push 0x1003c678
push eax
call dword [ecx]
test eax, eax
jl 0x1001a428
cmp dword [ebp + 8], ebx
je 0x1001a428
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.100392b0
mov edi, esp
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 0xc]
mov word [edi], bx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp + 8]
push 1
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
xor ecx, ecx
test eax, eax
mov eax, dword [ebp + 8]
setge cl
mov esi, ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea esp, [ebp - 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001c8b7
Capabilities:
Check if file exists
Delete file

Disassembly:
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1001c8e4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x1001c8e4
call esi
neg eax
sbb eax, eax
pop esi
inc eax
ret
push 1
pop eax
pop esi
ret
Function at 0x1001da21
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ec
and dword [ebp - 4], 0
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push edi
push 0
lea eax, [ebp - 0x7c]
push str.SoftwareFocusInteractiveEmail_IM_d
push eax
mov dword [ebp - 8], 1
call ebx
mov edi, 0x12c
lea eax, [ebp - 0x1ec]
push edi
push eax
lea eax, [ebp - 0x7c]
push str.AppName
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push eax
push esi
call fcn.10020037
add esp, 0x20
test eax, eax
je 0x1001db30
push dword [ebp + 0xc]
lea eax, [ebp - 0x1ec]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1001dab8
push eax
push str.Uninstalled
lea eax, [ebp - 0x7c]
push str.Toolbar
push eax
push esi
call fcn.10020145
push 0
push 0
lea eax, [ebp - 0x7c]
push str.Path
push eax
push esi
call fcn.10020145
add esp, 0x28
jmp 0x1001daf0
lea eax, [ebp - 0x1ec]
push edi
push eax
lea eax, [ebp - 0x7c]
push str.Toolbar
push eax
push esi
call fcn.10020037
add esp, 0x14
test eax, eax
je 0x1001daf0
lea eax, [ebp - 0x1ec]
push str.Uninstalled
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1001daf0
and dword [ebp - 8], 0
inc dword [ebp - 4]
lea eax, [ebp - 0x7c]
push dword [ebp - 4]
push str.SoftwareFocusInteractiveEmail_IM_d
push eax
call ebx
lea eax, [ebp - 0x1ec]
push edi
push eax
lea eax, [ebp - 0x7c]
push str.AppName
push eax
push esi
call fcn.10020037
add esp, 0x20
test eax, eax
jne 0x1001da77
xor ebx, ebx
cmp dword [ebp - 8], ebx
je 0x1001dbd9
jmp 0x1001db32
xor ebx, ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x1eb]
push 0x122
push eax
push dword [ebp + 8]
call fcn.1001dbe6
add esp, 0x10
test eax, eax
je 0x1001dbd9
lea eax, [ebp - 0x1ec]
push str.___d
push eax
mov byte [ebp - 0x1ec], 0x22
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0xbc]
mov dword [ebp - 0xc0], 0x44
push 0x40
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xbc]
push ebx
push eax
call fcn.10013fcd
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc0]
push eax
push ebx
push ebx
push 0x20
push ebx
push ebx
lea eax, [ebp - 0x1ec]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1001dbd9
cmp dword [ebp - 0x14], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x1001dbca
push dword [ebp - 0x14]
call esi
cmp dword [ebp - 0x18], ebx
je 0x1001dbd4
push dword [ebp - 0x18]
call esi
push 1
pop eax
jmp 0x1001dbe1
xor eax, eax
cmp dword [ebp - 8], ebx
sete al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001dc8f
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push dword [ebp + 0xc]
lea eax, [ebp - 0x168]
push 0x168
push eax
push dword [ebp + 8]
call fcn.1001dcf5
add esp, 0x10
test eax, eax
je 0x1001dcf3
lea eax, [ebp - 0x168]
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x168]
push eax
call fcn.1001c8b7
test eax, eax
pop ecx
jne 0x1001dcf3
lea eax, [ebp - 0x168]
push 1
push eax
call fcn.1001cbf4
mov eax, dword [ebp + 0x10]
pop ecx
test eax, eax
pop ecx
je 0x1001dcf3
mov dword [eax], 1
leave
ret
Function at 0x1001ddb4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
lea eax, [ebp - 0x12c]
push 0x11e
push eax
push str.InstallationDirectory
push str.SoftwareMicrosoftMSNMessenger
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10020037
add esp, 0x14
test eax, eax
je 0x1001de93
lea eax, [ebp - 0x12c]
push 0x5c
push eax
call fcn.1001401f
mov ebx, eax
pop ecx
test ebx, ebx
pop ecx
je 0x1001de93
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
inc ebx
push str.riched20.dll
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x12c]
push 0x20
push eax
call edi
lea eax, [ebp - 0x12c]
push eax
call fcn.1001c8b7
test eax, eax
pop ecx
jne 0x1001de53
lea eax, [ebp - 0x12c]
push 1
push eax
call fcn.1001cbf4
mov eax, dword [ebp + 8]
pop ecx
test eax, eax
pop ecx
je 0x1001de53
mov dword [eax], 1
push str.msimg32.dll
push ebx
call esi
lea eax, [ebp - 0x12c]
push 0x20
push eax
call edi
lea eax, [ebp - 0x12c]
push eax
call fcn.1001c8b7
pop ecx
pop edi
test eax, eax
jne 0x1001de93
push 1
lea eax, [ebp - 0x12c]
pop esi
push esi
push eax
call fcn.1001cbf4
mov eax, dword [ebp + 8]
pop ecx
test eax, eax
pop ecx
je 0x1001de93
mov dword [eax], esi
pop esi
pop ebx
leave
ret

Function at 0x1001de97
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
lea eax, [ebp - 0x12c]
push 0x11e
push eax
push 0x10043974
push 0x1003c164
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10020037
add esp, 0x14
test eax, eax
je 0x1001df25
lea eax, [ebp - 0x12c]
push 0x5c
push eax
call fcn.1001401f
pop ecx
test eax, eax
pop ecx
je 0x1001df25
inc eax
push str.msimg32.dll
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x12c]
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x12c]
push eax
call fcn.1001c8b7
test eax, eax
pop ecx
jne 0x1001df25
lea eax, [ebp - 0x12c]
push 1
push eax
call fcn.1001cbf4
mov eax, dword [ebp + 8]
pop ecx
test eax, eax
pop ecx
je 0x1001df25
mov dword [eax], 1
leave
ret

Function at 0x1001df27
Capabilities:
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov esi, 0x12c
sub esi, eax
lea eax, [ebp - 0x12c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x1001dfb3
cmp esi, eax
jbe 0x1001dfb3
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x12c]
push 0x10041064
push eax
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x12c]
push eax
call esi
lea eax, [ebp - 0x12c]
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x12c]
push eax
call fcn.1001c8b7
test eax, eax
pop ecx
jne 0x1001dfb3
push 1
lea eax, [ebp - 0x12c]
pop esi
push esi
push eax
call fcn.1001cbf4
mov eax, dword [ebp + 8]
pop ecx
test eax, eax
pop ecx
je 0x1001dfb3
mov dword [eax], esi
pop esi
leave
ret
Function at 0x1001dfb6
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
push ebx
push esi
push edi
lea eax, [ebp - 0x2c8]
push str.HKUR__
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 8], 1
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ecx, 0x1dd
sub ecx, eax
lea eax, [ebp - 0x2c2]
push ecx
push eax
mov ebx, VariantInit
push 0
push ebx
call edi
test eax, eax
jne 0x1001e0dc
lea eax, [ebp - 0x2c8]
push eax
call esi
push 0x1003c1d8
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
lea eax, [ebp + eax - 0x2c8]
mov dword [ebp - 4], eax
push str._s___s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0xd4]
push 0xc8
push eax
lea eax, [ebp - 0x2c8]
push eax
call fcn.10020306
add esp, 0x1c
test eax, eax
je 0x1001e0b6
cmp byte [ebp - 0xd4], 0
je 0x1001e0b6
lea eax, [ebp - 0xd4]
push eax
call esi
mov ecx, dword [ebp - 0xc]
lea eax, [eax + ecx + 0x33]
cmp eax, 0x1f4
jae 0x1001e0b6
push 1
lea eax, [ebp - 0x2c8]
push 0
push eax
call fcn.100204a6
add esp, 0xc
lea eax, [ebp - 0xd4]
push eax
push 0x1003c1a8
push str._s_s_
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_wsprintfA]
push 1
lea eax, [ebp - 0x2c8]
push 0
push eax
call fcn.100204a6
add esp, 0x1c
mov eax, dword [ebp - 8]
push dword [ebp + 8]
inc dword [ebp - 8]
mov dword [ebp - 4], eax
call esi
mov ecx, 0x1dd
sub ecx, eax
lea eax, [ebp - 0x2c2]
push ecx
push eax
push dword [ebp - 4]
push ebx
jmp 0x1001e003
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001ea05
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x44]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x40]
xor edi, edi
cmp eax, edi
lea ecx, [eax + 1]
mov dword [esi + 0x40], ecx
jne 0x1001eb31
push str.WININET
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
mov dword [esi + 0x3c], eax
je 0x1001eb05
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpOpenRequestA
push eax
call edi
push str.HttpQueryInfoA
mov dword [esi], eax
push dword [esi + 0x3c]
call edi
push str.HttpAddRequestHeadersA
mov dword [esi + 4], eax
push dword [esi + 0x3c]
call edi
push str.HttpSendRequestA
mov dword [esi + 8], eax
push dword [esi + 0x3c]
call edi
push str.InternetCloseHandle
mov dword [esi + 0xc], eax
push dword [esi + 0x3c]
call edi
push str.InternetConnectA
mov dword [esi + 0x10], eax
push dword [esi + 0x3c]
call edi
push str.InternetCrackUrlA
mov dword [esi + 0x14], eax
push dword [esi + 0x3c]
call edi
push str.InternetCreateUrlA
mov dword [esi + 0x18], eax
push dword [esi + 0x3c]
call edi
push str.InternetGetConnectedState
mov dword [esi + 0x1c], eax
push dword [esi + 0x3c]
call edi
push str.InternetGetCookieA
mov dword [esi + 0x20], eax
push dword [esi + 0x3c]
call edi
push str.InternetOpenA
mov dword [esi + 0x24], eax
push dword [esi + 0x3c]
call edi
push str.InternetReadFile
mov dword [esi + 0x28], eax
push dword [esi + 0x3c]
call edi
push str.InternetSetCookieA
mov dword [esi + 0x2c], eax
push dword [esi + 0x3c]
call edi
push str.InternetSetStatusCallback
mov dword [esi + 0x30], eax
push dword [esi + 0x3c]
call edi
push str.InternetQueryDataAvailable
mov dword [esi + 0x34], eax
push dword [esi + 0x3c]
call edi
mov dword [esi + 0x38], eax
jmp 0x1001eb31
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret
Function at 0x1001f791
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x30]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x2c]
xor edi, edi
cmp eax, edi
lea ecx, [eax + 1]
mov dword [esi + 0x2c], ecx
jne 0x1001f86d
push 0x1003c688
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
mov dword [esi + 0x28], eax
je 0x1001f850
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OpenThemeData
push eax
call edi
push str.CloseThemeData
mov dword [esi], eax
push dword [esi + 0x28]
call edi
push str.DrawThemeBackground
mov dword [esi + 4], eax
push dword [esi + 0x28]
call edi
push str.DrawThemeParentBackground
mov dword [esi + 8], eax
push dword [esi + 0x28]
call edi
push str.DrawThemeEdge
mov dword [esi + 0xc], eax
push dword [esi + 0x28]
call edi
push str.DrawThemeIcon
mov dword [esi + 0x10], eax
push dword [esi + 0x28]
call edi
push str.GetThemeBackgroundRegion
mov dword [esi + 0x14], eax
push dword [esi + 0x28]
call edi
push str.GetThemeColor
mov dword [esi + 0x18], eax
push dword [esi + 0x28]
call edi
push str.GetThemePartSize
mov dword [esi + 0x1c], eax
push dword [esi + 0x28]
call edi
push str.IsThemeActive
mov dword [esi + 0x20], eax
push dword [esi + 0x28]
call edi
mov dword [esi + 0x24], eax
jmp 0x1001f86d
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret

Function at 0x1001fdf4
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
test eax, eax
mov dword [esi], eax
je 0x1001fe2c
mov ecx, dword [esp + 0xc]
push 0
neg ecx
sbb ecx, ecx
push 0
and ecx, 0xf001b
push 0
add ecx, 4
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 4], eax
je 0x1001fe2c
push 1
pop eax
jmp 0x1001fe35
mov ecx, esi
call fcn.1001fe39
xor eax, eax
pop esi
ret 8

Function at 0x1001fe64
Capabilities:
Create directory

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1001fe8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1001fe8c
xor eax, eax
ret
push 1
pop eax
ret
Function at 0x10020037
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push ebx
push eax
xor ebx, ebx
push 0x20019
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1002005c
xor eax, eax
jmp 0x100200b9
push esi
lea eax, [ebp + 0xc]
push edi
push eax
lea eax, [ebp - 4]
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
or edi, 0xffffffff
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x100200a7
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x18]
jge 0x100200a7
lea eax, [ebp + 0xc]
inc dword [ebp + 0xc]
push eax
lea eax, [ebp - 4]
push dword [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
mov edi, eax
cmp edi, ebx
je 0x100200a7
mov eax, dword [ebp + 0x14]
mov byte [eax], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, ebx
pop edi
pop esi
sete al
pop ebx
leave
ret

Function at 0x10020145
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x14], edi
jne 0x10020179
lea eax, [ebp + 0xc]
push eax
push 0x2001f
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002019a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x100201bb
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1002019e
xor eax, eax
jmp 0x100201db
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0x14]
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
cmp dword [ebp + 0x18], edi
je 0x100201d0
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
ret

Function at 0x100201df
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10020202
xor eax, eax
leave
ret
lea eax, [ebp + 8]
push esi
push eax
lea eax, [ebp - 4]
push dword [ebp + 0x14]
mov dword [ebp + 8], 4
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret
Function at 0x10020238
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 8]
push esi
push eax
lea eax, [ebp + 0xc]
xor esi, esi
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x10020263
xor eax, eax
jmp 0x1002028a
lea eax, [ebp + 0x14]
push 4
push eax
push 4
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0xc]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
ret

Function at 0x100204a6
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.10020398
add esp, 0x18
test eax, eax
je 0x100205a1
mov eax, dword [ebp - 8]
push ebx
xor ebx, ebx
push esi
cmp dword [ebp + 0xc], ebx
jne 0x10020574
cmp eax, ebx
je 0x100204ef
cmp byte [eax], bl
jne 0x10020574
cmp dword [ebp + 0x10], ebx
je 0x10020511
mov eax, dword [ebp - 4]
push dword [ebp + 8]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], eax
call fcn.1000ace9
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x10020592
lea eax, [ebp + 0x10]
xor esi, esi
push eax
push 0x2001f
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10020592
push edi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0xc]
push ebx
push eax
push ebx
push ebx
push ebx
mov dword [ebp + 0xc], ebx
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x10020556
cmp dword [ebp + 0xc], ebx
jne 0x10020556
push 1
pop edi
jmp 0x10020558
xor edi, edi
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
pop edi
je 0x10020592
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x10020505
cmp eax, ebx
jne 0x1002057d
mov eax, 0x10043974
push ebx
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.10020145
add esp, 0x14
mov esi, eax
push dword [ebp - 0xc]
call fcn.1001ad4f
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret
xor eax, eax
leave
ret
Function at 0x100207e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 8]
push esi
push eax
push dword [ebp + 8]
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x10020852
push edi
push esi
call fcn.1001ad44
mov edi, eax
pop ecx
cmp edi, ebx
je 0x1002084a
push edi
push esi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1002084a
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x10041064
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1002084a
cmp dword [ebp + 8], ebx
je 0x1002084a
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
push 1
mov ecx, dword [eax + 8]
pop ebx
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
push edi
call fcn.1001ad4f
pop ecx
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x10020858
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push esi
lea eax, [ebp - 0xc]
push edi
mov edi, dword [ebp + 0xc]
and dword [ebp + 0xc], 0
push eax
push dword [ebp + 8]
and dword [edi], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x10020924
push ebx
push esi
call fcn.1001ad44
mov ebx, eax
pop ecx
test ebx, ebx
je 0x1002091c
push ebx
push esi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1002091c
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1002091c
cmp dword [ebp + 8], 4
jb 0x1002091c
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
lea eax, [ebp - 0x70]
push str.StringFileInfo_04X_04XOriginalFilename
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1002091c
cmp dword [ebp + 8], 0
je 0x1002091c
push dword [ebp + 8]
call fcn.1001ad44
test eax, eax
pop ecx
mov dword [edi], eax
je 0x1002091c
push dword [ebp + 8]
push dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov dword [ebp + 0xc], 1
push ebx
call fcn.1001ad4f
pop ecx
pop ebx
mov eax, dword [ebp + 0xc]
pop edi
pop esi
leave
ret