Function at 0x6c136900
Capabilities:
Contain obfuscated stackstrings
Create directory
Get file size
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x48c
mov dword [esp + 0x40], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov esi, dword [esi + 0x10]
sub esp, 8
mov eax, dword [esp + 0x40]
test esi, esi
jne 0x6c136a64
mov ecx, dword [eax + 0xc]
lea ebp, [esp + 0x70]
xor eax, eax
lea esi, [esi]
movzx edx, word [ecx + eax]
mov word [ebp + eax], dx
add eax, 2
test dx, dx
jne 0x6c136948
cmp word [esp + 0x70], 0
mov edx, ebp
je 0x6c136971
lea esi, [esi]
nop
add edx, 2
cmp word [edx], 0
jne 0x6c136968
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [eax + str.index.dat]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x6c136978
mov esi, dword [sym.imp.kernel32.dll_CreateFileW]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0xc0000000
mov dword [esp], ebp
call esi
sub esp, 0x1c
mov edi, eax
cmp eax, 0xffffffff
je 0x6c136a88
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_GetFileSize]
sub esp, 8
mov ebp, eax
cmp eax, 0xffffffff
je 0x6c136dc7
mov esi, 0x1ed80
mov eax, pe_nt_image_headers32
cmp ebx, esi
cmovbe esi, ebx
cmp esi, eax
cmovb esi, eax
lea ecx, [esi + 0x80]
shl ecx, 7
cmp ebp, ecx
jb 0x6c136ae8
mov esi, dword [esp + 0x40]
lea eax, [esp + 0x278]
mov ecx, ebp
mov edx, dword [esi + 0xc]
mov dword [esi + 0x14], ebp
mov dword [esp], eax
mov eax, edi
call fcn.6c133480
mov dword [esi + 0x10], eax
mov dword [esp], edi
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
call edi
mov eax, dword [esi + 0x10]
sub esp, 4
test eax, eax
je 0x6c136d48
mov edx, dword [esp + 0x278]
test edx, edx
jne 0x6c136c00
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReleaseMutex]
mov eax, esi
sub esp, 4
add esp, 0x48c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x40]
mov dword [esp + 4], 0
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
sub esp, 8
test eax, eax
jne 0x6c136dd8
test byte [0x6c145288], 8
jne 0x6c1371b4
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReleaseMutex]
mov eax, dword fs:[0x18]
mov esi, dword [eax + 0x34]
sub esp, 4
add esp, 0x48c
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SetFilePointer]
sub esp, 0x10
cmp eax, 0xffffffff
mov ecx, dword [esp + 0x20]
je 0x6c136d90
mov dword [esp + 0x20], ecx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SetEndOfFile]
sub esp, 4
test eax, eax
mov ecx, dword [esp + 0x20]
je 0x6c136d90
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], ecx
mov edx, dword [eax + 0xc]
mov dword [esp], 0
mov eax, edi
call fcn.6c133480
mov ecx, dword [esp + 0x20]
test eax, eax
mov dword [esp + 0x4c], eax
je 0x6c136d90
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
sub esp, 0x14
test eax, eax
mov ebp, eax
mov ecx, dword [esp + 0x20]
je 0x6c137124
cmp ebx, 0x80
jbe 0x6c136e75
mov eax, dword [eax + 0x1c]
cmp eax, ecx
jb 0x6c1371e8
mov dword [ebp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [ebp + 0x24], esi
mov dword [esp], ebp
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call ebx
sub esp, 4
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x4c]
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], esi
xor esi, esi
jmp 0x6c136d9f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
sub esp, 0x14
mov esi, eax
test eax, eax
je 0x6c136e20
cmp ebp, dword [eax + 0x1c]
jne 0x6c136cf9
mov dword [esp + 8], 0x12
mov dword [esp + 4], str.WINE_URLCache_Ver
mov dword [esp], eax
call sub.ucrtbase.dll_memcmp
test eax, eax
jne 0x6c136c7b
cmp dword [esi + 0x12], 0x30322e30
jne 0x6c136cf9
cmp dword [esi + 0x16], 0x30303231
jne 0x6c136cf9
cmp byte [esi + 0x1a], 0x31
jne 0x6c136cf9
mov ecx, dword [esi + 0x24]
lea eax, [ecx + 0x80]
shl eax, 7
cmp ebp, eax
jne 0x6c136cf9
shr ecx, 3
mov eax, dword [esi + 0x28]
test ecx, ecx
je 0x6c13728c
lea edi, [esi + 0x250]
xor edx, edx
mov dword [esp + 0x20], esi
lea ebp, [edi + ecx]
movzx ebx, byte [edi]
test ebx, ebx
je 0x6c136cbf
nop
mov esi, ebx
and esi, 1
cmp esi, 1
sbb edx, 0xffffffff
shr ebx, 1
jne 0x6c136cb0
add edi, 1
cmp ebp, edi
jne 0x6c136ca8
mov esi, dword [esp + 0x20]
cmp edx, eax
jne 0x6c136cf9
cmp ecx, 0x3daf
jbe 0x6c136cef
jmp 0x6c136e3b
add ecx, 1
cmp ecx, 0x3db0
je 0x6c136e3b
cmp byte [esi + ecx + 0x250], 0
je 0x6c136ce0
test byte [0x6c145288], 4
jne 0x6c136e4c
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
sub esp, 4
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x64
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sym.wininet.dll_FreeUrlCacheSpaceW
sub esp, 0xc
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x6c136a60
lea esi, [esi]
nop
test byte [0x6c145288], 2
je 0x6c136ab8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.Couldnt_create_file_mapping__error_is__ld__n
mov dword [esp + 8], str.cache_container_open_index
mov dword [esp + 4], 0x6c145288
mov dword [esp], 1
mov dword [esp + 0x10], eax
call fcn.6c133fb0
jmp 0x6c136ab8
mov eax, dword fs:[0x18]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
mov esi, dword [eax + 0x34]
mov dword [esp], edi
call ebx
sub esp, 4
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReleaseMutex]
mov eax, esi
sub esp, 4
add esp, 0x48c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
jmp 0x6c136ab8
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0xc0000000
mov dword [esp], ebp
call esi
sub esp, 0x1c
mov edi, eax
cmp eax, 0xffffffff
jne 0x6c1369d4
jmp 0x6c136aab
mov esi, dword [esp + 0x40]
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call edi
mov dword [esi + 0x10], 0
sub esp, 4
jmp 0x6c136d48
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
sub esp, 4
jmp 0x6c136d34
mov dword [esp + 0xc], str.detected_old_or_broken_index.dat_file_n
mov dword [esp + 8], str.cache_container_open_index
mov dword [esp + 4], 0x6c145288
mov dword [esp], 2
call fcn.6c133fb0
jmp 0x6c136d06
mov dword [esp + 8], 0x8000
mov ebx, 0x2072
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.ucrtbase.dll_memset
mov eax, dword [esp + 0x40]
mov word [ebp + 0x10], bx
mov dword [ebp], 0x454e4957
mov dword [ebp + 4], 0x4c525520
mov dword [ebp + 8], 0x68636143
mov dword [ebp + 0xc], 0x65562065
mov dword [ebp + 0x12], 0x30322e30
mov dword [ebp + 0x16], 0x30303231
mov byte [ebp + 0x1a], 0x31
cmp dword [eax + 0x1c], 1
mov dword [ebp + 0x1c], 0x8000
mov dword [ebp + 0x24], pe_nt_image_headers32
mov dword [ebp + 0x30], 0x7ff5400
sete al
mov dword [ebp + 0x34], 0
movzx eax, al
shl eax, 2
mov dword [ebp + 0x48], eax
lea eax, [esp + 0x60]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsCacheContent
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
test eax, eax
je 0x6c13720f
lea eax, [esp + 0x278]
lea esi, [esp + 0x68]
mov dword [esp + 0x48], eax
lea ebx, [esp + 0x64]
mov ecx, ebx
xor edx, edx
mov eax, ebp
call fcn.6c134200
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x48]
mov ecx, dword [eax + 0xc]
xor eax, eax
lea esi, [esi]
nop
movzx edx, word [ecx + eax]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x6c136f50
cmp word [esp + 0x278], 0
mov ecx, dword [esp + 0x48]
je 0x6c136f79
nop
add ecx, 2
cmp word [ecx], 0
jne 0x6c136f70
xor ebx, ebx
mov dword [esp + 0x20], ecx
mov word [ecx + 0x10], bx
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp + 0x48]
sub esp, 4
mov ecx, dword [esp + 0x20]
test esi, esi
je 0x6c137189
lea eax, [ecx + 0x10]
mov dword [esp + 0x5c], edi
xor esi, esi
mov edi, ebp
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x2c], eax
mov dword [esp + 0x58], ebp
mov dword [esp + 0x44], ecx
mov dword [edi + 0x4c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], esi
lea esi, [esi]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
or eax, dword [esp + 0x38]
or edx, dword [esp + 0x3c]
xor eax, dword [esp + 0x68]
xor edx, dword [esp + 0x6c]
mov esi, dword [esp + 0x44]
mov edi, eax
mov ebp, edx
lea esi, [esi]
nop
mov ecx, edi
mov eax, edi
mov dword [esp], edi
shrd ecx, ebp, 0x1e
and eax, 0x3fffffff
mov dword [esp + 4], ebp
and ecx, 0x3fffffff
mov dword [esp + 8], 0x25
add ecx, eax
mov eax, ebp
mov dword [esp + 0xc], 0
shr eax, 0x1c
add ecx, eax
mov eax, 0x38e38e39
mul ecx
shr edx, 1
lea eax, [edx + edx*8]
mov edx, ebp
sub ecx, eax
mov eax, edi
sub eax, ecx
sbb edx, 0
mov dword [esp + 0x20], eax
mov eax, 0x38e38e39
imul ecx, edx, 0x38e38e39
imul edx, dword [esp + 0x20], 0x8e38e38e
add ecx, edx
mul dword [esp + 0x20]
add edx, ecx
shrd eax, edx, 2
shr edx, 2
mov ecx, eax
mov ebx, edx
shld ebx, ecx, 3
shl ecx, 3
add eax, ecx
mov ecx, edi
adc edx, ebx
mov ebx, ebp
shld edx, eax, 2
shl eax, 2
sub ecx, eax
sbb ebx, edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ebx
call fcn.6c144390
mov ecx, dword [esp + 0x20]
mov ebp, edx
mov edi, eax
mov edx, ecx
cmp ecx, 9
lea eax, [edx + 0x37]
jg 0x6c1370c0
lea eax, [edx + 0x30]
mov word [esi], ax
mov eax, dword [esp + 0x2c]
add esi, 2
cmp esi, eax
jne 0x6c137010
mov eax, dword [esp + 0x48]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
sub esp, 8
test eax, eax
jne 0x6c137144
add dword [esp + 0x34], 0x10000
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
mov edx, edi
mov eax, esi
xor edx, 0x1000000
or eax, edx
jne 0x6c136fe8
mov ebp, dword [esp + 0x58]
mov edi, dword [esp + 0x5c]
mov dword [esp], ebp
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
sub esp, 4
mov eax, dword [esp + 0x4c]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], eax
call ebx
sub esp, 4
mov eax, dword fs:[0x18]
mov esi, dword [eax + 0x34]
jmp 0x6c136d9f
mov edi, dword [esp + 0x50]
xor eax, eax
mov esi, dword [esp + 0x54]
mov ebx, dword [esp + 0x44]
lea esi, [esi]
movzx edx, word [ebx + eax*2]
mov byte [edi + eax + 0x50], dl
add eax, 1
cmp eax, 8
jne 0x6c137158
mov eax, dword [esp + 0x58]
add esi, 1
add edi, 0xc
add dword [esp + 0x3c], 0x1000000
cmp esi, dword [eax + 0x48]
jb 0x6c136fc5
mov edi, dword [esp + 0x5c]
mov ebp, eax
mov dword [esp], ebp
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call ebx
mov ecx, 0x8000
sub esp, 4
jmp 0x6c136be6
mov eax, ebp
call fcn.6c133bc0
mov dword [esp + 0xc], str.Could_not_open_or_create_cache_index_file___s__n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.cache_container_open_index
mov dword [esp + 4], 0x6c145288
mov dword [esp], 3
call fcn.6c133fb0
jmp 0x6c136ab8
mov edx, ecx
mov dword [esp + 4], 0
sub edx, eax
add eax, ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.ucrtbase.dll_memset
mov ecx, dword [esp + 0x20]
jmp 0x6c136bb7
lea eax, [esp + 0x278]
mov dword [esp + 0x68], 4
mov dword [esp + 0x48], eax
lea esi, [esp + 0x68]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x60]
lea ebx, [esp + 0x64]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], str.CacheLimit
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x6c137277
cmp dword [esp + 0x278], 4
jne 0x6c137277
mov eax, dword [esp + 0x64]
xor edx, edx
shld edx, eax, 0xa
shl eax, 0xa
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x34], edx
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x6c136f2f
test eax, eax
jne 0x6c136cf9
jmp 0x6c136cef