joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61018ff1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0x610040ec
mov esi, ecx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x61019024
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x610040b8
push 3
mov ebx, eax
call fcn.6101b566
pop ecx
pop ecx
jmp 0x61019096
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x610040a0
push eax
call edi
mov dword [esi + 0x18], eax
test eax, eax
je 0x6101908e
push 0x61004088
push dword [esi + 0xc]
call edi
mov dword [esi + 0x10], eax
test eax, eax
je 0x6101908e
push 0x61004070
push dword [esi + 0xc]
call edi
mov dword [esi + 0x14], eax
test eax, eax
je 0x6101908e
push 0x61004060
push dword [esi + 0xc]
call edi
mov dword [esi + 0x1c], eax
test eax, eax
je 0x6101908e
push 0x61004048
push dword [esi + 0xc]
call edi
mov dword [esi + 0x20], eax
test eax, eax
je 0x6101908e
push 0x61004040
push dword [esi + 0xc]
call edi
mov dword [esi + 0x24], eax
test eax, eax
jne 0x610190a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x610190a8
push 0x61003fb8
push 3
call fcn.6101b566
pop ecx
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x610190eb
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
push 0x20019
mov esi, ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
xor ebx, ebx
mov dword [ebp - 0xc], edi
call fcn.61018fac
test eax, eax
jne 0x61019127
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x610191df
mov ecx, esi
call fcn.61013af5
lea eax, [ebp - 4]
push eax
push 0x20006
push edi
push 0x61004100
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x610191a4
lea eax, [ebp - 8]
push eax
add esi, 8
push esi
call dword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
jne 0x610191a4
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], edi
je 0x6101918f
lea eax, [ebp - 0xc]
push eax
call fcn.610180d6
mov ebx, eax
cmp ebx, edi
je 0x610191a4
mov eax, dword [ebp - 0xc]
add eax, eax
push eax
push ebx
push 7
push edi
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jmp 0x610191a2
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
je 0x610191b3
cmp eax, 2
je 0x610191b3
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x610191b6
xor esi, esi
inc esi
cmp dword [ebp - 4], edi
je 0x610191c4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
je 0x610191cf
push ebx
call fcn.6102b403
pop ecx
cmp dword [ebp - 8], edi
je 0x610191dd
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x61019465
Capabilities:
Delete registry value
Set registry value

Disassembly:
push 0
mov eax, 0x6103f65d
call fcn.6102b2d6
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.61013af5
push 0x20006
mov ecx, esi
call fcn.61018fac
test eax, eax
jne 0x610194a5
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.6100d793
mov eax, esi
call fcn.6102b3c2
ret 8
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 8], ebx
jne 0x610194bd
push dword [ebp + 8]
push dword [esi + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
jmp 0x610194ef
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], ebx
call fcn.610180d6
mov edi, eax
test edi, edi
je 0x610194ef
mov eax, dword [ebp + 0xc]
add eax, eax
push eax
push edi
push 7
push 0
push dword [ebp + 8]
push dword [esi + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov ebx, eax
call fcn.6102b403
pop ecx
mov ecx, esi
call fcn.61013af5
xor eax, eax
test ebx, ebx
sete al
mov esi, eax
jmp 0x6101948f

Function at 0x61019f24
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x6103f6e5
call fcn.6102b2d6
mov edi, ecx
mov dword [ebp - 0x18], edi
xor esi, esi
mov dword [ebp - 4], esi
push 0x20019
call fcn.61018fac
test eax, eax
jne 0x61019f6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.6100d793
xor eax, eax
call fcn.6102b3c2
ret 8
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
push dword [edi + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call edi
cmp eax, esi
je 0x61019fac
cmp eax, 2
je 0x61019fa7
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.6100d793
mov eax, esi
jmp 0x61019f63
xor esi, esi
inc esi
jmp 0x61019f97
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
mov dword [ebp - 0x14], eax
call fcn.6102c0d4
mov ebx, eax
pop ecx
cmp ebx, esi
je 0x61019f8c
push dword [ebp - 0x14]
push esi
push ebx
call fcn.6102bb20
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push ebx
push esi
push esi
push dword [ebp + 8]
push dword [eax + 0x18]
call edi
push ebx
test eax, eax
je 0x61019fee
call fcn.6102b403
pop ecx
jmp 0x61019f8c
mov edi, dword [ebp + 0xc]
mov ecx, edi
call fcn.61019ecc
push ebx
call fcn.6102b403
pop ecx
cmp dword [edi + 8], esi
jne 0x61019fa7
jmp 0x61019f8c
Function at 0x6101a00b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x20019
push esi
mov ebx, ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
call fcn.61018fac
test eax, eax
jne 0x6101a049
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x6101a10c
mov ecx, ebx
call fcn.61013af5
lea eax, [ebp - 8]
push eax
push esi
push edi
push 0x61004100
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6101a0c5
lea eax, [ebp - 0xc]
push eax
add ebx, 8
push ebx
call dword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
jne 0x6101a0c5
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push edi
push edi
push edi
push dword [ebp - 0xc]
push dword [ebp - 8]
call esi
cmp eax, edi
je 0x6101a09c
cmp eax, 2
je 0x6101a0dd
jmp 0x6101a0c5
add dword [ebp - 4], 4
push dword [ebp - 4]
call fcn.6102c0d4
mov ebx, eax
pop ecx
mov dword [ebp - 0x10], ebx
cmp ebx, edi
je 0x6101a0c5
lea eax, [ebp - 4]
push eax
push ebx
push edi
push edi
push dword [ebp - 0xc]
push dword [ebp - 8]
call esi
test eax, eax
je 0x6101a0d4
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x6101a0e0
mov ecx, dword [ebp + 8]
push ebx
call fcn.61019ecc
xor esi, esi
inc esi
cmp dword [ebp - 8], edi
je 0x6101a0ee
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], edi
je 0x6101a0fc
push dword [ebp - 0x10]
call fcn.6102b403
pop ecx
cmp dword [ebp - 0xc], edi
je 0x6101a10a
push dword [ebp - 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x6101bbcc
Capabilities:
Check mutex on windows
Create directory
Get file attributes

Disassembly:
push 0x34
push 0x610437b8
call fcn.6102b510
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x44]
call fcn.6101b8af
cmp eax, ebx
jne 0x6101bd08
push 0x61004560
push ebx
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne 0x6101bc1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea esi, [ebp - 0x44]
call fcn.6101b79c
mov eax, edi
jmp 0x6101bd08
lea esi, [ebp - 0x44]
call fcn.6101b79c
mov dword [ebp - 4], ebx
push 0xffffffffffffffff
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x6101bc4d
cmp eax, 0x80
je 0x6101bc4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
jmp 0x6101bcf0
xor edi, edi
inc edi
mov dword [ebp - 0x24], edi
cmp dword [0x610496f0], ebx
je 0x6101bc63
mov dword [ebp - 0x1c], ebx
jmp 0x6101bcf0
push 0x104
mov esi, 0x610494e8
push esi
call fcn.6101bb09
test eax, eax
je 0x6101bc80
mov dword [ebp - 0x1c], 0x6e
jmp 0x6101bcf0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x6101bc99
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x6101bcf0
mov dword [ebp - 0x1c], ebx
mov dword [0x610496f0], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, 0x800
jne 0x6101bcf0
push ebx
push 0x2000000
push 3
push ebx
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x6101bcf0
mov dword [ebp - 0x28], edi
push ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 2
lea eax, [ebp - 0x28]
push eax
push 0x9c040
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
call fcn.6101bd10
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
call fcn.6102b555
ret
Function at 0x6101c293
Capabilities:
Set registry value

Disassembly:
push 0x10
mov eax, 0x6103f5f4
call fcn.6102b2d6
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.6100dfda
xor esi, esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x14]
push eax
call fcn.61018d43
mov bl, al
neg bl
sbb bl, bl
inc bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.6100d793
test bl, bl
je 0x6101c2d8
push 0x52
pop eax
jmp 0x6101c35c
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], esi
push 0x80000002
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x6101c32a
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.6100dfda
mov dword [ebp - 4], 1
lea eax, [ebp + 8]
push eax
call fcn.6101899e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.6100d793
jmp 0x6101c2d0
cmp dword [ebp - 0x1c], 1
jne 0x6101c351
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 8
lea eax, [ebp - 0x18]
push eax
push 3
push esi
push 0x61004640
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
call fcn.6102b3c2
ret 8
Function at 0x6101ca07
Capabilities:
Delete registry value
Set registry value

Disassembly:
push 0
mov eax, 0x6103f65d
call fcn.6102b2d6
mov esi, ecx
and dword [ebp - 4], 0
call fcn.6101c80a
test eax, eax
jne 0x6101ca3a
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.6100d793
mov eax, esi
call fcn.6102b3c2
ret 8
push 0x61003a98
lea ecx, [ebp + 8]
call fcn.61013bc2
test eax, eax
je 0x6101ca7e
push 0x6100471c
lea ecx, [ebp + 8]
call fcn.61013bc2
test eax, eax
je 0x6101ca7e
push 0x610019dc
lea ecx, [ebp + 8]
call fcn.61013bc2
test eax, eax
je 0x6101ca7e
push 0x610046e8
lea ecx, [ebp + 8]
call fcn.61013bc2
test eax, eax
jne 0x6101ca22
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 8], 0
jne 0x6101ca9e
lea ecx, [ebp + 8]
call fcn.61011da0
push eax
push dword [esi + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor esi, esi
inc esi
jmp 0x6101ca24
and dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
push eax
call fcn.610180d6
mov edi, eax
test edi, edi
je 0x6101ca22
mov eax, dword [ebp + 0xc]
add eax, eax
push eax
push edi
push 7
push 0
lea ecx, [ebp + 8]
call fcn.610192f8
push eax
push dword [esi + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call fcn.6102b403
xor eax, eax
test esi, esi
sete al
pop ecx
mov esi, eax
jmp 0x6101ca24
Function at 0x6101cb43
Capabilities:
Copy file
Set file attributes

Disassembly:
push 4
mov eax, 0x6103f695
call fcn.6102b2d6
mov esi, ecx
mov dword [ebp - 4], 1
xor edi, edi
cmp dword [esi + 0x14], edi
jne 0x6101cb83
mov esi, 0x10a
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.6100d793
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.6100d793
mov eax, esi
jmp 0x6101cc9b
lea ecx, [ebp - 0x10]
call fcn.6100d83e
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], edi
je 0x6101cc74
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], edi
je 0x6101cc74
lea eax, [ebp + 8]
push eax
call fcn.61017809
test al, al
jne 0x6101cbc5
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.6100d793
push 2
pop esi
jmp 0x6101cb64
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
add esi, 8
push esi
call fcn.6101836c
push dword [ebp - 0x10]
call fcn.6103bdbc
mov esi, eax
cmp esi, edi
je 0x6101cbf5
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.6100d793
jmp 0x6101cb64
push edi
push dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x6101cc4c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ebx, eax
cmp ebx, 5
jne 0x6101cc39
push 0x80
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push dword [ebp - 0x10]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x6101cc4c
call esi
mov esi, eax
jmp 0x6101cbe4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.6100d793
mov esi, ebx
jmp 0x6101cb64
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.6100d793
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.6100d793
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.6100d793
xor eax, eax
jmp 0x6101cc9b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.6100d793
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.6100d793
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.6100d793
push 0x57
pop eax
call fcn.6102b3c2
ret 8
Function at 0x6101cdac
Capabilities:
Set registry value

Disassembly:
push 4
mov eax, 0x6103f695
call fcn.6102b2d6
mov esi, ecx
mov dword [ebp - 4], 1
call fcn.6101c80a
test eax, eax
jne 0x6101cde9
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.6100d793
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.6100d793
xor eax, eax
jmp 0x6101cedf
mov edi, 0x610047a4
push edi
lea ecx, [ebp + 8]
call fcn.61013bc2
test eax, eax
jne 0x6101ce3f
lea ecx, [ebp - 0x10]
call fcn.6100d83e
mov byte [ebp - 4], 2
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [esi + 8]
push eax
call fcn.6101836c
lea eax, [ebp - 0x10]
push eax
call fcn.61017809
test al, al
jne 0x6101ce33
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.6100d793
jmp 0x6101cdca
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.6100d793
push edi
lea ecx, [ebp + 8]
call fcn.61013bc2
test eax, eax
je 0x6101ce94
push 0x6100478c
lea ecx, [ebp + 8]
call fcn.61013bc2
test eax, eax
je 0x6101ce94
push 0x61004768
lea ecx, [ebp + 8]
call fcn.61013bc2
test eax, eax
je 0x6101ce94
push 0x61003f90
lea ecx, [ebp + 8]
call fcn.61013bc2
test eax, eax
je 0x6101ce94
push 0x61004744
lea ecx, [ebp + 8]
call fcn.61013bc2
test eax, eax
jne 0x6101cdca
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 0xc]
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp + 0xc]
call fcn.610192f8
push eax
push 1
push 0
lea ecx, [ebp + 8]
call fcn.610192f8
push eax
push dword [esi + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.6100d793
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.6100d793
mov eax, esi
call fcn.6102b3c2
ret 8
Function at 0x6101d028
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x6103f715
call fcn.6102b2d6
mov esi, ecx
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
cmp ecx, ebx
jne 0x6101d04e
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x6101d231
mov edi, dword [ebp + 8]
cmp edi, 1
je 0x6101d155
cmp edi, 2
je 0x6101d155
cmp edi, 3
jne 0x6101d076
add esi, 4
push esi
call fcn.6100de8c
jmp 0x6101d22e
cmp edi, 0xe
jne 0x6101d085
cmp dword [esi + 0x14], ebx
je 0x6101d047
add esi, 8
jmp 0x6101d06b
mov ecx, esi
call fcn.6101c80a
test eax, eax
je 0x6101d047
cmp edi, 0xb
jne 0x6101d09e
mov dword [ebp - 0x10], 0x6100478c
jmp 0x6101d0c6
cmp edi, 0xc
jne 0x6101d0ac
mov dword [ebp - 0x10], 0x61004768
jmp 0x6101d0c6
cmp edi, 0xd
jne 0x6101d0ba
mov dword [ebp - 0x10], 0x61003f90
jmp 0x6101d0c6
cmp edi, 7
jne 0x6101d03f
mov dword [ebp - 0x10], 0x61004744
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 8]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
mov dword [ebp + 8], ebx
push dword [esi + 0x10]
call edi
cmp eax, ebx
jne 0x6101d14f
cmp dword [ebp + 8], 1
jbe 0x6101d14f
add dword [ebp + 8], 4
push dword [ebp + 8]
call fcn.6102c0d4
pop ecx
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x6101d047
push dword [ebp + 8]
push ebx
push eax
call fcn.6102bb20
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x14]
push ebx
push ebx
push dword [ebp - 0x10]
push dword [esi + 0x10]
call edi
push dword [ebp - 0x14]
test eax, eax
je 0x6101d130
call fcn.6102b403
pop ecx
jmp 0x6101d047
mov ecx, dword [ebp + 0xc]
call fcn.6100df53
push dword [ebp - 0x14]
call fcn.6102b403
xor eax, eax
cmp eax, dword [ebp + 8]
pop ecx
sbb eax, eax
neg eax
jmp 0x6101d231
push eax
jmp 0x6101d041
mov ecx, esi
call fcn.6101c80a
test eax, eax
je 0x6101d047
lea ecx, [ebp - 0x10]
call fcn.6100d83e
mov dword [ebp - 4], ebx
push 0x104
lea ecx, [ebp - 0x10]
call fcn.61012308
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx - 0xc]
lea ecx, [ecx + ecx + 2]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
push ebx
push ebx
push 0x610047a4
push dword [esi + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.61011dc1
cmp edi, ebx
je 0x6101d1bf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.6100d793
jmp 0x6101d047
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
jne 0x6101d1d7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.6100d793
mov eax, ebx
jmp 0x6101d231
cmp dword [ebp + 8], 1
jne 0x6101d1ee
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.6100dd8c
xor ebx, ebx
inc ebx
jmp 0x6101d1c7
lea ecx, [ebp - 0x14]
call fcn.6100d83e
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
add esi, 8
push esi
call fcn.6101836c
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
call fcn.6100dd8c
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.6100d793
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.6100d793
xor eax, eax
inc eax
call fcn.6102b3c2
ret 8
Function at 0x6101d23e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
cmp dword [ebp + 8], esi
jne 0x6101d25e
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x6101d2fb
call fcn.6101c80a
test eax, eax
je 0x6101d2fb
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push 0x6100478c
push dword [ebx + 0x10]
mov dword [ebp - 4], esi
call edi
cmp eax, esi
jne 0x6101d2ee
cmp dword [ebp - 4], 1
jbe 0x6101d2ee
add dword [ebp - 4], 4
push dword [ebp - 4]
call fcn.6102c0d4
pop ecx
mov dword [ebp - 8], eax
cmp eax, esi
je 0x6101d2fb
push dword [ebp - 4]
push esi
push eax
call fcn.6102bb20
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push esi
push esi
push 0x6100478c
push dword [ebx + 0x10]
call edi
push dword [ebp - 8]
test eax, eax
je 0x6101d2d2
call fcn.6102b403
pop ecx
jmp 0x6101d2fb
mov ecx, dword [ebp + 8]
call fcn.6100df53
push dword [ebp - 8]
call fcn.6102b403
xor eax, eax
cmp eax, dword [ebp - 4]
pop ecx
sbb eax, eax
neg eax
jmp 0x6101d2f7
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp eax, esi
jne 0x6101d302
xor eax, eax
jmp 0x6101d449
cmp dword [ebp + 0xc], esi
je 0x6101d251
mov ecx, ebx
call fcn.6101c80a
test eax, eax
je 0x6101d2fb
lea eax, [ebp + 8]
push eax
push esi
push esi
push esi
push 0x61004768
push dword [ebx + 0x10]
mov dword [ebp + 8], esi
call edi
cmp eax, esi
jne 0x6101d38f
cmp dword [ebp + 8], 1
jbe 0x6101d38f
add dword [ebp + 8], 4
push dword [ebp + 8]
call fcn.6102c0d4
pop ecx
mov dword [ebp - 8], eax
cmp eax, esi
je 0x6101d2fb
push dword [ebp + 8]
push esi
push eax
call fcn.6102bb20
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp - 8]
push esi
push esi
push 0x61004768
push dword [ebx + 0x10]
call edi
push dword [ebp - 8]
test eax, eax
jne 0x6101d2ca
mov ecx, dword [ebp + 0xc]
call fcn.6100df53
push dword [ebp - 8]
call fcn.6102b403
xor eax, eax
cmp eax, dword [ebp + 8]
pop ecx
sbb eax, eax
neg eax
jmp 0x6101d398
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp eax, esi
je 0x6101d2fb
cmp dword [ebp + 0x10], esi
je 0x6101d251
mov ecx, ebx
call fcn.6101c80a
test eax, eax
je 0x6101d2fb
lea eax, [ebp + 8]
push eax
push esi
push esi
push esi
push 0x61003f90
push dword [ebx + 0x10]
mov dword [ebp + 8], esi
call edi
cmp eax, esi
jne 0x6101d435
cmp dword [ebp + 8], 1
jbe 0x6101d435
add dword [ebp + 8], 4
push dword [ebp + 8]
call fcn.6102c0d4
pop ecx
mov dword [ebp + 0xc], eax
cmp eax, esi
je 0x6101d2fb
push dword [ebp + 8]
push esi
push eax
call fcn.6102bb20
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
push esi
push esi
push 0x61003f90
push dword [ebx + 0x10]
call edi
push dword [ebp + 0xc]
test eax, eax
jne 0x6101d2ca
mov ecx, dword [ebp + 0x10]
call fcn.6100df53
push dword [ebp + 0xc]
call fcn.6102b403
xor eax, eax
cmp eax, dword [ebp + 8]
pop ecx
sbb eax, eax
neg eax
jmp 0x6101d43e
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp eax, esi
je 0x6101d2fb
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x6101da38
Capabilities:
Delete registry value
Set registry value

Disassembly:
push 0x14
mov eax, 0x6103f87d
call fcn.6102b2d6
mov dword [ebp - 4], 1
xor edi, edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], edi
call fcn.6100d83e
mov byte [ebp - 4], 2
push 0x61004820
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], edi
call fcn.6100dfda
mov byte [ebp - 4], 3
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.6101836c
mov bl, al
neg bl
sbb bl, bl
inc bl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.6100d793
test bl, bl
je 0x6101daa3
mov esi, 0x65b
jmp 0x6101db24
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push dword [ebp - 0x14]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, edi
jne 0x6101db24
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 8], edi
jbe 0x6101db02
lea eax, [ebp - 0x1c]
push eax
call fcn.610180d6
mov ebx, eax
cmp ebx, edi
jne 0x6101dae1
push 8
pop esi
jmp 0x6101db19
mov eax, dword [ebp - 0x1c]
add eax, eax
push eax
push ebx
push 7
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, edi
jne 0x6101db19
jmp 0x6101db17
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
cmp esi, edi
jne 0x6101db24
mov ebx, dword [ebp - 0x20]
xor esi, esi
cmp ebx, edi
je 0x6101db24
push ebx
call fcn.6102b403
pop ecx
cmp dword [ebp - 0x10], edi
je 0x6101db32
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.6100d793
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.6100d793
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.6100d793
mov eax, esi
call fcn.6102b3c2
ret 0xc