joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61248c41
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
cmp eax, 1
jle 0x61248ce8
test al, 4
je 0x61248ce8
push esi
push edi
push 0x3fd
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x147
push eax
mov dword [ebp + 0xc], eax
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x61248ce6
cmp edi, dword [ebx + 0x10]
je 0x61248ce6
push 0
push edi
push 0x150
push dword [ebp + 0xc]
call esi
mov dword [ebx + 0x10], edi
push eax
mov dword [0x61254ab0], eax
call fcn.61245dc5
mov ecx, dword [0x61254ab0]
xor edx, edx
and ecx, 0x3ff
cmp cx, 0xd
sete dl
test eax, eax
mov dword [0x612544e0], eax
mov dword [0x61254708], edx
je 0x61248cdf
cmp cx, 0xd
je 0x61248cdf
mov dword [0x612543cc], 1
jmp 0x61248ce6
and dword [0x612543cc], 0
pop edi
pop esi
xor eax, eax
inc eax
pop ebx
pop ebp
ret 8

Function at 0x6124909b
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x61253ebc]
and dword [ebp - 0x108], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
push 0x40
mov dword [ebp - 4], eax
lea eax, [ebp - 0x84]
push eax
push 0x1f
mov edi, 0x400
push edi
call esi
test eax, eax
je 0x61249167
push 0x40
lea eax, [ebp - 0x104]
push eax
push 0x8000001f
push edi
call esi
test eax, eax
je 0x61249167
cmp word [ebp - 0x84], 0
lea ecx, [ebp - 0x84]
lea eax, [ebp - 0x104]
je 0x61249167
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x61249146
cmp dx, 0x79
jne 0x6124913c
lea esi, [ecx + 2]
cmp word [esi], dx
jne 0x6124913c
cmp word [eax + 2], dx
jne 0x6124913c
cmp word [eax + 4], dx
jne 0x6124913c
lea edx, [eax + 6]
cmp word [edx], 0x79
jne 0x6124913c
mov dword [ebp - 0x108], 1
mov ecx, esi
mov eax, edx
inc ecx
inc ecx
inc eax
inc eax
cmp word [ecx], 0
jne 0x61249103
cmp dword [ebp - 0x108], 0
je 0x61249167
mov cx, word [ecx]
cmp cx, word [eax]
jne 0x61249167
lea eax, [ebp - 0x104]
push eax
push 0x1f
push edi
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.6124ff04
leave
ret
Function at 0x6124a1f2
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x61253ebc]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x460
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x14b
push eax
mov dword [ebp - 0x108], eax
call esi
mov eax, dword [0x61254ab0]
mov edi, 0x40a
cmp ax, di
mov dword [ebp - 0x110], eax
jne 0x6124a24e
mov dword [ebp - 0x110], 0xc0a
movzx eax, word [ebp - 0x110]
push 0x80
lea ecx, [ebp - 0x104]
push ecx
push 0x1013
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
mov ebx, 0x151
je 0x6124a2be
lea eax, [ebp - 0x104]
push eax
push 0
push 0x143
push dword [ebp - 0x108]
call esi
mov dword [ebp - 0x10c], eax
movzx eax, word [ebp - 0x110]
push eax
push dword [ebp - 0x10c]
push ebx
push dword [ebp - 0x108]
call esi
push 0
push dword [ebp - 0x10c]
push 0x14e
push dword [ebp - 0x108]
call esi
cmp word [ebp - 0x110], 0xc0a
jne 0x6124a334
push 0x80
lea eax, [ebp - 0x104]
push eax
push 0x1013
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x6124a329
lea eax, [ebp - 0x104]
push eax
push 0
push 0x143
push dword [ebp - 0x108]
call esi
push edi
push eax
push ebx
push dword [ebp - 0x108]
mov dword [ebp - 0x10c], eax
call esi
cmp dword [0x61254ab0], edi
jne 0x6124a329
push 0
push dword [ebp - 0x10c]
push 0x14e
push dword [ebp - 0x108]
call esi
mov eax, dword [0x61254ab0]
mov dword [ebp - 0x110], eax
xor eax, eax
cmp dword [0x612540a8], eax
mov dword [ebp - 0x114], eax
jle 0x6124a3d3
mov ecx, dword [0x612540b0]
mov edi, dword [ecx + eax*4]
cmp di, word [ebp - 0x110]
jne 0x6124a3ba
push 0x80
lea eax, [ebp - 0x104]
push eax
push 0x1013
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x6124a3ba
lea eax, [ebp - 0x104]
push eax
push 0
push 0x143
push dword [ebp - 0x108]
call esi
push edi
push eax
push ebx
push dword [ebp - 0x108]
mov dword [ebp - 0x10c], eax
call esi
cmp edi, dword [0x61254ab0]
jne 0x6124a3ba
push 0
push dword [ebp - 0x10c]
push 0x14e
push dword [ebp - 0x108]
call esi
mov eax, dword [ebp - 0x114]
inc eax
cmp eax, dword [0x612540a8]
mov dword [ebp - 0x114], eax
jl 0x6124a348
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.6124ff04
leave
ret 4
Function at 0x6124c23c
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x61253ebc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x208], eax
jne 0x6124c266
xor eax, eax
jmp 0x6124c300
push esi
mov esi, 0x80
push esi
lea eax, [ebp - 0x104]
push eax
push 0xe
push dword [0x61254ab0]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x6124c299
cmp word [ebp - 0x104], 0x2e
jne 0x6124c2a0
cmp word [ebp - 0x102], bx
jne 0x6124c2a0
mov word [ebp - 0x104], bx
push edi
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push esi
lea eax, [ebp - 0x204]
push eax
push 8
push dword [0x612543d0]
call edi
push ebx
push ebx
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [ebp - 0x208]
test eax, eax
je 0x6124c2fb
push esi
lea eax, [ebp - 0x204]
push eax
push 9
push dword [0x612543d0]
call edi
push ebx
push ebx
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [ebp - 0x208]
xor eax, eax
pop edi
inc eax
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.6124ff04
leave
ret 0xc

Function at 0x6124c312
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x61253ebc]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
jne 0x6124c334
xor eax, eax
jmp 0x6124c3d2
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
mov edi, 0x80
push edi
lea eax, [ebp - 0x204]
push eax
push 0xe
push dword [0x61254ab0]
call esi
test eax, eax
je 0x6124c36b
cmp word [ebp - 0x204], 0x2e
jne 0x6124c373
cmp word [ebp - 0x202], 0
jne 0x6124c373
and word [ebp - 0x204], 0
push edi
lea eax, [ebp - 0x104]
push eax
push 0x51
push dword [0x61254ab0]
call esi
test eax, eax
je 0x6124c39d
cmp word [ebp - 0x104], 0x2d
jne 0x6124c3a5
cmp word [ebp - 0x102], 0
jne 0x6124c3a5
and word [ebp - 0x104], 0
mov esi, 0x61253e48
push 0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x204]
push eax
push dword [esi]
call ebx
test eax, eax
je 0x6124c3cd
add esi, 4
cmp esi, 0x61253e5c
jl 0x6124c3aa
xor eax, eax
pop edi
inc eax
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.6124ff04
leave
ret 0xc
Function at 0x6124c461
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x61253ebc]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
jne 0x6124c483
xor eax, eax
jmp 0x6124c522
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
mov edi, 0x80
push edi
lea eax, [ebp - 0x204]
push eax
push 0x16
push dword [0x61254ab0]
call esi
test eax, eax
je 0x6124c4ba
cmp word [ebp - 0x204], 0x2e
jne 0x6124c4c2
cmp word [ebp - 0x202], 0
jne 0x6124c4c2
and word [ebp - 0x204], 0
push edi
lea eax, [ebp - 0x104]
push eax
push 0x14
push dword [0x61254ab0]
call esi
test eax, eax
je 0x6124c4ed
cmp word [ebp - 0x104], 0xa4
jne 0x6124c4f5
cmp word [ebp - 0x102], 0
jne 0x6124c4f5
and word [ebp - 0x104], 0
mov esi, 0x61253e5c
lea eax, [ebp - 0x104]
push eax
push 0
lea eax, [ebp - 0x204]
push eax
push dword [esi]
call ebx
test eax, eax
je 0x6124c51d
add esi, 4
cmp esi, 0x61253e6c
jl 0x6124c4fa
xor eax, eax
pop edi
inc eax
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.6124ff04
leave
ret 0xc

Function at 0x6124c534
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x308
mov eax, dword [0x61253ebc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x308], eax
jne 0x6124c55e
xor eax, eax
jmp 0x6124c632
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
mov edi, 0x80
push edi
lea eax, [ebp - 0x304]
push eax
push 0x16
push dword [0x61254ab0]
call esi
test eax, eax
je 0x6124c594
cmp word [ebp - 0x304], 0x2e
jne 0x6124c59b
cmp word [ebp - 0x302], bx
jne 0x6124c59b
mov word [ebp - 0x304], bx
push edi
lea eax, [ebp - 0x204]
push eax
push 0x51
push dword [0x61254ab0]
call esi
test eax, eax
je 0x6124c5c4
cmp word [ebp - 0x204], 0x2d
jne 0x6124c5cb
cmp word [ebp - 0x202], bx
jne 0x6124c5cb
mov word [ebp - 0x204], bx
push edi
lea eax, [ebp - 0x104]
push eax
push 0x14
push dword [0x61254ab0]
call esi
test eax, eax
je 0x6124c5f5
cmp word [ebp - 0x104], 0xa4
jne 0x6124c5fc
cmp word [ebp - 0x102], bx
jne 0x6124c5fc
mov word [ebp - 0x104], bx
mov esi, str.T_aH_a__a0_a__a
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x304]
push eax
push dword [esi]
call dword [ebp - 0x308]
test eax, eax
je 0x6124c62d
add esi, 4
cmp esi, 0x61253eb0
jl 0x6124c601
xor eax, eax
pop edi
inc eax
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.6124ff04
leave
ret 0xc
Function at 0x6124c7d1
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x61253ebc]
and dword [ebp - 0x274], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x264], eax
mov eax, dword [0x612540a0]
test eax, eax
mov dword [ebp - 0x270], 1
mov dword [ebp - 0x260], eax
je 0x6124c98e
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
mov ebx, 0x143
mov edi, 0x151
jmp 0x6124c82c
mov eax, dword [ebp - 0x260]
test byte [eax], 4
je 0x6124c977
and dword [ebp - 0x268], 0
cmp dword [eax + 0x218], 0
jbe 0x6124c977
lea ecx, [eax + 0x21c]
mov dword [ebp - 0x26c], ecx
mov ecx, dword [ebp - 0x26c]
mov ecx, dword [ecx]
cmp cx, 0x40a
mov dword [ebp - 0x278], ecx
je 0x6124c900
cmp cx, 0xc0a
je 0x6124c900
cmp dword [ebp + 0x10], 0
je 0x6124c8ba
push 2
lea eax, [ebp - 0x27c]
push eax
push 0xa0001004
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
mov dword [ebp - 0x270], eax
je 0x6124c952
mov eax, dword [ebp - 0x27c]
mov ecx, dword [ebp - 0x278]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0x270], 0
je 0x6124c958
push 0x12c
lea eax, [ebp - 0x25c]
push eax
push 2
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 0x25c]
push eax
push 0
push ebx
push dword [ebp - 0x264]
call esi
push dword [ebp - 0x278]
push eax
push edi
push dword [ebp - 0x264]
call esi
jmp 0x6124c952
cmp dword [ebp - 0x274], 0
jne 0x6124c958
push 0x12c
lea eax, [ebp - 0x25c]
push eax
push 0x60
push dword [0x612543d0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x6124c952
lea eax, [ebp - 0x25c]
push eax
push 0
push ebx
push dword [ebp - 0x264]
call esi
push 0xc0a
push eax
push edi
push dword [ebp - 0x264]
call esi
mov dword [ebp - 0x274], 1
mov eax, dword [ebp - 0x260]
inc dword [ebp - 0x268]
mov ecx, dword [ebp - 0x268]
add dword [ebp - 0x26c], 4
cmp ecx, dword [eax + 0x218]
jb 0x6124c855
mov eax, dword [eax + 0xa40]
test eax, eax
mov dword [ebp - 0x260], eax
jne 0x6124c826
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.6124ff04
leave
ret 0xc
Function at 0x6124cc92
Capabilities:
Create process on windows
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2b0
mov eax, dword [0x61253ebc]
lea ecx, [ebp - 0x250]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x6124cdc5
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2b0], 0x44
mov dword [ebp - 0x2ac], esi
mov dword [ebp - 0x2a8], esi
mov dword [ebp - 0x2a4], esi
mov dword [ebp - 0x284], esi
mov word [ebp - 0x27e], si
mov dword [ebp - 0x27c], esi
xor ebx, ebx
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x254]
push eax
push esi
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
push dword [ebp - 0x250]
mov dword [ebp - 0x258], 0x20
mov dword [ebp - 0x25c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
je 0x6124cdb0
cmp eax, esi
jne 0x6124cdb6
cmp dword [ebp - 0x254], 1
jne 0x6124cdb0
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x250]
dec ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x2b0]
push eax
push esi
push esi
push 0x200
push esi
push esi
push esi
lea eax, [ebp - 0x24c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x6124cdb0
push 1
push 0xffffffffffffffff
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push dword [ebp - 0x26c]
call edi
push dword [ebp - 0x268]
call edi
inc ebx
jmp 0x6124ccff
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.6124ff04
leave
ret 4
Function at 0x6124cdd6
Capabilities:
Get token privileges
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push 0x28
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x6124cea3
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push edi
mov eax, 0x1000
push eax
push 0x40
mov dword [ebp - 8], eax
call esi
push dword [ebp - 8]
mov edi, eax
push 0x40
call esi
cmp edi, ebx
mov dword [ebp - 0xc], eax
je 0x6124ce93
cmp eax, ebx
je 0x6124ce8c
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push 3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x6124ce8c
mov eax, dword [edi]
cmp eax, ebx
jbe 0x6124ce5c
xor ecx, ecx
cmp eax, ebx
jbe 0x6124ce5c
lea eax, [edi + 0xc]
mov dword [eax], 2
inc ecx
add eax, 0xc
cmp ecx, dword [edi]
jb 0x6124ce4e
mov esi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push edi
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x6124ce8c
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
push ebx
push dword [ebp - 4]
call esi
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0xc], ebx
pop edi
pop esi
je 0x6124cea3
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 4], ebx
pop ebx
je 0x6124ceb2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret

Function at 0x6124cf94
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x61253ebc]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x208], 0x100
je 0x6124cff8
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x6124cfdd
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x208], 0x100
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push ebx
call edi
test eax, eax
je 0x6124cfc5
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.6124ff04
leave
ret 4
Function at 0x6124d00b
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x61253ebc]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp ebx, edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], esi
je 0x6124d0cf
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x6124d0cf
lea eax, [ebp - 0x208]
push eax
push 0x10008
push edi
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x6124d0d4
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push edi
push dword [ebp - 0x208]
mov dword [ebp - 0x20c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, 0x103
je 0x6124d0b2
cmp esi, edi
jne 0x6124d0c1
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x208]
call fcn.6124d00b
mov esi, eax
cmp esi, edi
je 0x6124d061
jmp 0x6124d0c1
push ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x6124d0d4
mov esi, 0x3f2
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.6124ff04
leave
ret 8

Function at 0x6124d0ea
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x61253ebc]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x208], 0x100
je 0x6124d14d
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x6124d132
lea eax, [ebp - 0x204]
push eax
push ebx
call fcn.6124d00b
mov dword [ebp - 0x208], 0x100
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push ebx
call edi
test eax, eax
je 0x6124d11b
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.6124ff04
leave
ret 4
Function at 0x6124d160
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov ecx, dword [ebp + 0xc]
push esi
mov eax, dword [0x61253ebc]
push edi
xor esi, esi
push esi
push esi
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x210]
push ecx
push esi
lea ecx, [ebp - 0x20c]
push ecx
push esi
push esi
push esi
push esi
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
mov dword [ebp - 0x224], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
cmp edi, esi
jne 0x6124d28a
cmp dword [ebp - 0x20c], esi
je 0x6124d28a
push ebx
push dword [ebp - 0x210]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, esi
je 0x6124d289
cmp dword [ebp - 0x20c], esi
mov dword [ebp - 0x208], esi
jbe 0x6124d27a
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x214]
push eax
push ebx
lea eax, [ebp - 0x220]
push eax
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x208]
mov dword [ebp - 0x218], 0x100
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
cmp edi, esi
jne 0x6124d27a
push dword [ebp - 0x214]
lea eax, [ebp - 0x204]
push ebx
push dword [ebp - 0x220]
push esi
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp edi, esi
jne 0x6124d27a
inc dword [ebp - 0x208]
mov eax, dword [ebp - 0x208]
cmp eax, dword [ebp - 0x20c]
jb 0x6124d1ef
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.6124ff04
leave
ret 8
Function at 0x6124d29f
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x61253ebc]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
xor edi, edi
push ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x408], edi
call fcn.6124d160
cmp eax, edi
jne 0x6124d3f3
push esi
push edi
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x404]
push eax
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x204]
push eax
push edi
mov esi, 0x100
push ebx
jmp 0x6124d3c6
cmp ebx, edi
jne 0x6124d3f0
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x410]
push eax
push edi
mov ebx, 0xf003f
push ebx
push edi
lea eax, [ebp - 0x404]
push eax
push edi
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x6124d396
lea eax, [ebp - 0x418]
push eax
push ebx
push edi
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push dword [ebp - 0x410]
mov ebx, eax
cmp ebx, edi
jne 0x6124d3ea
push dword [ebp - 0x418]
call fcn.6124d29f
push dword [ebp - 0x418]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x410]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, edi
jne 0x6124d3f0
inc dword [ebp - 0x408]
push edi
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x404]
push eax
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x408]
push dword [ebp - 0x41c]
mov dword [ebp - 0x40c], esi
mov dword [ebp - 0x414], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
cmp ebx, 0x103
jne 0x6124d308
xor ebx, ebx
jmp 0x6124d3f0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.6124ff04
leave
ret 8

Function at 0x6124d5b5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x61253ebc]
push dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x414]
push 0x61242428
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
and word [ebp - 0x20c], 0
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
push 0x20019
push 0
push 0x61241688
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6124d645
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
mov dword [ebp - 0x41c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20c]
push eax
call fcn.6124b12d
mov ecx, dword [ebp - 4]
call fcn.6124ff04
leave
ret 4