joyce8/EMBER2024-capa huggingface dataset:
Function at 0x660e44ce
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
cmp dword [0x66110360], eax
je 0x660e451f
cmp dword [ebp + 8], eax
jne 0x660e44e7
push 3
pop eax
jmp 0x660e4522
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call dword [0x66111cfc]
test eax, eax
je 0x660e4506
push dword [ebp + 8]
call dword [0x66111cf0]
test eax, eax
jne 0x660e450a
push 2
jmp 0x660e44e4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [0x66111d14]
test eax, eax
jne 0x660e4526
or eax, 0xffffffff
leave
ret 4
mov eax, dword [ebp - 4]
test al, 1
je 0x660e4540
test al, 2
je 0x660e453c
and al, 8
neg al
sbb eax, eax
add eax, 6
jmp 0x660e4522
push 4
jmp 0x660e44e4
and al, 8
neg al
sbb eax, eax
add eax, 8
jmp 0x660e4522

Function at 0x660e454b
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
cmp dword [0x66110360], eax
je 0x660e459a
cmp dword [ebp + 8], eax
je 0x660e459a
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call dword [0x66111cfc]
test eax, eax
je 0x660e457e
push dword [ebp + 8]
call dword [0x66111cf0]
test eax, eax
jne 0x660e4585
push 8
pop eax
leave
ret 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [0x66111d14]
test eax, eax
jne 0x660e459f
or eax, 0xffffffff
jmp 0x660e4581
mov eax, dword [ebp - 4]
test al, 1
je 0x660e45b1
and al, 8
neg al
sbb eax, eax
add eax, 0xa
jmp 0x660e4581
and al, 8
neg al
sbb eax, eax
add eax, 8
jmp 0x660e4581

Function at 0x660e45bc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
cmp dword [0x66110360], eax
je 0x660e460b
cmp dword [ebp + 8], eax
je 0x660e460b
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call dword [0x66111cfc]
test eax, eax
je 0x660e45ef
push dword [ebp + 8]
call dword [0x66111cf0]
test eax, eax
jne 0x660e45f6
push 2
pop eax
leave
ret 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [0x66111d14]
test eax, eax
jne 0x660e4610
or eax, 0xffffffff
jmp 0x660e45f2
mov eax, dword [ebp - 4]
and al, 1
neg al
sbb eax, eax
inc eax
inc eax
jmp 0x660e45f2

Function at 0x660e47e9
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x10], 0
lea edi, [eax + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.660253c4
cmp word [eax], 0xa
jne 0x660e4840
mov esi, dword [eax + 8]
push esi
call fcn.66024c30
cmp eax, 0x1b8
jne 0x660e482f
cmp esi, 0x800a01b8
jne 0x660e4831
mov esi, eax
test esi, 0xffff8000
je 0x660e4848
push 6
call fcn.66025592
push eax
call fcn.660e464b
mov esi, eax
mov ecx, edi
call sym.MSVBVM60.DLL___vbaFreeVar
mov ax, si
pop edi
pop esi
leave
ret 4
Function at 0x660e4858
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x10], 0
lea edi, [eax + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.660253c4
cmp word [eax], 0xa
jne 0x660e48af
mov esi, dword [eax + 8]
push esi
call fcn.66024c30
cmp eax, 0x1b8
jne 0x660e489e
cmp esi, 0x800a01b8
jne 0x660e48a0
mov esi, eax
mov ecx, edi
call sym.MSVBVM60.DLL___vbaFreeVar
mov eax, esi
pop edi
pop esi
leave
ret 4
push eax
call fcn.6602499b
jmp 0x660e489e

Function at 0x660e48b7
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x10], 0
lea edi, [eax + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.660253c4
cmp word [eax], 0xa
jne 0x660e4919
push esi
mov esi, dword [eax + 8]
push esi
call fcn.66024c30
cmp eax, 0x1b8
jne 0x660e4900
cmp esi, 0x800a01b8
mov dword [ebp + 8], esi
jne 0x660e4903
mov dword [ebp + 8], eax
fild dword [ebp + 8]
pop esi
fstp dword [ebp + 8]
mov ecx, edi
call sym.MSVBVM60.DLL___vbaFreeVar
fld dword [ebp + 8]
pop edi
leave
ret 4
push eax
call fcn.660e469c
fstp dword [ebp + 8]
jmp 0x660e490a

Function at 0x660e4924
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x18], 0
lea edi, [eax + 0x50]
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.660253c4
cmp word [eax], 0xa
jne 0x660e4986
push esi
mov esi, dword [eax + 8]
push esi
call fcn.66024c30
cmp eax, 0x1b8
jne 0x660e496d
cmp esi, 0x800a01b8
mov dword [ebp + 8], esi
jne 0x660e4970
mov dword [ebp + 8], eax
fild dword [ebp + 8]
pop esi
fstp qword [ebp - 8]
mov ecx, edi
call sym.MSVBVM60.DLL___vbaFreeVar
fld qword [ebp - 8]
pop edi
leave
ret 4
push eax
call fcn.660e46ea
fstp qword [ebp - 8]
jmp 0x660e4977

Function at 0x660e49bd
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x10], 0
lea ebx, [eax + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.660253c4
cmp word [eax], 0xa
jne 0x660e4a22
mov esi, dword [eax + 8]
push esi
call fcn.66024c30
cmp eax, 0x1b8
jne 0x660e4a04
cmp esi, 0x800a01b8
jne 0x660e4a06
mov esi, eax
push esi
call fcn.660e4991
mov ecx, ebx
mov esi, eax
mov edi, edx
call sym.MSVBVM60.DLL___vbaFreeVar
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
push eax
call fcn.660e4738
jmp 0x660e4a0c
Function at 0x660e4bdd
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add eax, 0x50
and word [ebp - 0x18], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.660253c4
mov ebx, eax
cmp word [ebx], 0xa
jne 0x660e4cfb
push edi
push esi
lea eax, [ebp - 0x7c]
push 0x64
push eax
push 0x6601a650
push 0x8dab
call fcn.660df7cd
mov edi, 0x6604fbc0
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [ebx + 8]
push ebx
call fcn.66024c30
cmp eax, 0x1b8
jne 0x660e4c72
cmp ebx, 0x800a01b8
jne 0x660e4c74
mov ebx, eax
lea eax, [ebp - 4]
push eax
call fcn.660106d9
push eax
push ebx
call fcn.660e5a18
test eax, eax
je 0x660e4c8e
push eax
call fcn.66025592
lea eax, [ebp - 0x144]
push 0x64
push eax
lea edi, [ebp - 0x7c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ebp - 0x7c]
push ecx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp - 4]
lea eax, [ebp - 0x144]
push eax
call fcn.660eedac
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
jne 0x660e4ce6
push 0xe
call fcn.66025592
mov dword [ebp - 4], esi
pop esi
pop edi
mov ecx, dword [ebp - 8]
call sym.MSVBVM60.DLL___vbaFreeVar
mov eax, dword [ebp - 4]
pop ebx
leave
ret 4
push ebx
call sym.MSVBVM60.DLL___vbaStrVarCopy
mov dword [ebp - 4], eax
jmp 0x660e4ceb
Function at 0x660e4d06
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [eax + 0x50]
mov eax, dword [ebp + 8]
mov esi, 0xffffbfff
mov cx, word [eax]
movzx edx, cx
and edx, esi
cmp edx, 9
jne 0x660e4d4e
mov eax, dword [eax + 8]
test ch, 0x40
je 0x660e4d3d
mov eax, dword [eax]
push edi
xor ecx, ecx
push 3
push ecx
push ecx
push ecx
push ecx
push eax
call fcn.660df16b
mov eax, edi
mov bx, word [eax]
movzx ecx, bx
and ecx, esi
cmp ecx, 2
jl 0x660e4d6f
cmp ecx, 7
jle 0x660e4d88
cmp ecx, 0xb
je 0x660e4d88
cmp ecx, 0xe
je 0x660e4d88
cmp ecx, 0x11
je 0x660e4d88
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x24]
push ecx
push 5
push eax
push edi
call fcn.66028637
push eax
call fcn.6601d62b
mov eax, edi
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x24]
push ecx
push 8
push eax
push edi
call fcn.66028637
push eax
call fcn.6601d62b
mov eax, dword [edi + 8]
mov dword [ebp - 4], eax
cmp word [eax], 0x2d
je 0x660e4dca
cmp bx, 7
je 0x660e4dca
cmp bx, 0xb
je 0x660e4dca
lea eax, [ebp - 4]
push eax
call fcn.660e5a4e
test eax, eax
je 0x660e4dca
push eax
call fcn.66025592
push 0
call fcn.660da488
movsx ax, byte [eax + 0xe]
push eax
push dword [ebp - 4]
call fcn.660e4df0
mov dword [ebp - 4], eax
and word [edi], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x660e501d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [eax + 0x50]
lea eax, [ebp - 0x20]
push eax
xor esi, esi
push dword [ebp + 0xc]
mov word [ebp - 0x20], si
call fcn.660253c4
mov ecx, eax
mov word [ebp - 0x10], 2
mov dx, word [ecx]
movzx eax, dx
cmp eax, 0x11
ja case.0x660e505d.44
jmp dword [eax*4 + 0x660e5185]
mov word [ebp - 0x10], 1
mov ecx, edi
call sym.MSVBVM60.DLL___vbaFreeVar
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x10]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
leave
ret 8
xor al, al
cmp al, byte [ecx + 8]
sbb eax, eax
neg eax
mov word [ebp - 8], ax
jmp 0x660e506a
mov cx, word [ecx + 8]
cmp cx, si
jl 0x660e513d
xor eax, eax
cmp cx, si
setg al
jmp 0x660e508c
mov ecx, dword [ecx + 8]
cmp ecx, esi
jl 0x660e513d
xor eax, eax
cmp ecx, esi
jmp 0x660e50a4
fld dword [ecx + 8]
fcomp qword [0x66030258]
fnstsw ax
sahf
jb 0x660e513d
fld dword [ecx + 8]
fcomp qword [0x66030258]
fnstsw ax
sahf
jbe case.0x660e505d.32
mov word [ebp - 8], 1
jmp 0x660e506a
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x40]
push eax
push 5
lea eax, [ebp - 0x10]
push ecx
push eax
call fcn.66028637
push eax
call fcn.6601d62b
fld qword [ebp - 8]
fcomp qword [0x66030258]
mov word [ebp - 0x10], 2
fnstsw ax
sahf
jb 0x660e513d
fld qword [ebp - 8]
fcomp qword [0x66030258]
fnstsw ax
sahf
ja 0x660e50d6
mov word [ebp - 8], si
jmp 0x660e506a
fld qword [ecx + 8]
fcomp qword [0x66030258]
fnstsw ax
sahf
jb 0x660e513d
fld qword [ecx + 8]
jmp 0x660e510f
mov eax, dword [ecx + 0xc]
cmp eax, esi
jge 0x660e5147
or word [ebp - 8], 0xffff
jmp 0x660e506a
jne 0x660e50d6
cmp dword [ecx + 8], esi
jne 0x660e50d6
jmp case.0x660e505d.32
mov eax, dword [ecx + 4]
or eax, dword [ecx + 8]
or eax, dword [ecx + 0xc]
je case.0x660e505d.32
mov al, byte [ecx + 3]
and al, 0x80
neg al
sbb eax, eax
and al, 0xfe
inc eax
jmp 0x660e508c
test dh, 0x20
jne case.0x660e505d.41
cmp dx, 0x24
je case.0x660e505d.41
push 0x1ca
call fcn.66025592
push 0xd
jmp 0x660e517c

Function at 0x660e527a
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea esi, [eax + 0x50]
push dword [esp + 0x10]
push esi
call sym.MSVBVM60.DLL___vbaVarDateVar
mov eax, dword [esp + 0xc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret 8
Function at 0x660e52a4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x10], 0
lea esi, [eax + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.660253c4
cmp word [eax], 0xa
jne 0x660e52ed
xor ecx, ecx
cmp dword [eax + 8], ecx
setge cl
dec ecx
mov edi, ecx
mov ecx, esi
call sym.MSVBVM60.DLL___vbaFreeVar
mov ax, di
pop edi
pop esi
leave
ret 4
push eax
call sym.MSVBVM60.DLL___vbaBoolVar
mov edi, eax
jmp 0x660e52dd

Function at 0x660e52f7
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and word [ebp - 0x10], 0
lea edi, [eax + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.660253c4
cmp word [eax], 0xa
jne 0x660e5361
push esi
mov esi, dword [eax + 8]
push esi
call fcn.66024c30
cmp eax, 0x1b8
jne 0x660e5340
cmp esi, 0x800a01b8
mov ebx, esi
jne 0x660e5342
mov ebx, eax
test ebx, 0xffffff00
je 0x660e5351
push 6
call fcn.66025592
pop esi
mov ecx, edi
call sym.MSVBVM60.DLL___vbaFreeVar
mov al, bl
pop edi
pop ebx
leave
ret 4
push eax
call fcn.660e461d
mov bl, al
jmp 0x660e5352

Function at 0x660e57c3
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
push 0xc
pop edi
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp + 8]
add eax, 0x50
mov dword [ebp - 4], eax
mov esi, 0x4000
mov dx, word [ecx]
movzx eax, dx
and ah, 0xbf
dec eax
dec eax
je 0x660e5880
sub eax, 7
jne 0x660e5825
test si, dx
je 0x660e5820
mov eax, dword [ecx + 8]
mov ecx, dword [eax]
push dword [ebp - 4]
push 3
push 0
push 0
push 0
push 0
push ecx
call fcn.660df16b
mov ecx, dword [ebp - 4]
jmp 0x660e57e8
mov ecx, dword [ecx + 8]
jmp 0x660e5808
dec eax
dec eax
je 0x660e5880
sub eax, 6
je 0x660e586c
push ecx
call fcn.6602499b
lea ecx, [ebp - 4]
mov dl, al
dec edi
and dl, 7
dec ecx
movsx dx, dl
dec ecx
add edx, 0x30
shr eax, 3
mov word [ecx], dx
jne 0x660e5837
push 0xc
pop eax
sub eax, edi
push eax
lea eax, [ebp + edi*2 - 0x1c]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
jne 0x660e589b
push 0xe
call fcn.66025592
test si, dx
je 0x660e587b
mov eax, dword [ecx + 8]
mov cl, byte [eax]
movzx eax, cl
jmp 0x660e5834
mov cl, byte [ecx + 8]
jmp 0x660e5876
test si, dx
je 0x660e5895
mov eax, dword [ecx + 8]
mov cx, word [eax]
and ecx, 0xffff
mov eax, ecx
jmp 0x660e5834
mov cx, word [ecx + 8]
jmp 0x660e588b
mov ecx, dword [ebp - 4]
call sym.MSVBVM60.DLL___vbaFreeVar
mov eax, esi
pop edi
pop esi
leave
ret 4
Function at 0x660e617d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
xor esi, esi
push edi
cmp dword [0x6610fd90], esi
je 0x660e62a9
push dword [ebp + 0xc]
call fcn.66026741
mov edi, eax
pop ecx
inc edi
push 1
lea ecx, [ebp - 0x94]
push esi
lea eax, [edi + edi]
push ecx
push eax
push esi
push 0x78
lea ecx, [ebp - 0x10]
call fcn.660daf6c
mov ecx, dword [ebp - 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp ecx, esi
mov dword [ebp - 4], ecx
je 0x660e61db
push esi
lea eax, [edi + edi]
push esi
push eax
push ecx
push edi
push dword [ebp + 0xc]
push esi
push esi
call ebx
cmp dword [ebp - 4], esi
je 0x660e6253
mov eax, dword [ebp + 0x14]
cmp eax, esi
jbe 0x660e62a1
cmp eax, 2
jbe 0x660e61f9
cmp eax, 7
jne 0x660e62a1
mov edi, dword [ebp + 0x1c]
cmp edi, esi
jne 0x660e6218
push esi
push dword [ebp + 0x18]
push eax
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
jmp 0x660e6295
push esi
push esi
shr edi, 1
push esi
push esi
push edi
push dword [ebp + 0x18]
push esi
push esi
call ebx
mov dword [ebp + 0xc], eax
push 1
lea eax, [ebp - 0x10c]
push esi
push eax
lea ecx, [ebp - 0x1c]
push dword [ebp + 0x1c]
push esi
push 0x78
call fcn.660daf6c
mov eax, dword [ebp - 0x18]
cmp eax, esi
mov dword [ebp + 0x1c], eax
jne 0x660e6265
lea ecx, [ebp - 0x1c]
call fcn.66029f67
lea ecx, [ebp - 0x10]
call fcn.66029f67
push 0xe
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x18
push esi
push esi
push dword [ebp + 0xc]
push eax
push edi
push dword [ebp + 0x18]
push esi
push esi
call ebx
push dword [ebp + 0xc]
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.66029f67
lea ecx, [ebp - 0x10]
call fcn.66029f67
mov eax, esi
jmp 0x660e625e
push dword [ebp + 0x1c]
jmp 0x660e6201
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x660e625e

Function at 0x660e6322
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
xor eax, eax
cmp dword [0x6610fd90], eax
je 0x660e6372
cmp dword [ebp + 0xc], eax
push eax
je 0x660e6367
push eax
lea ecx, [ebp - 0x104]
push 0x104
push ecx
push 0xffffffffffffffff
push dword [ebp + 0xc]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x660e6360
push 0xe
pop eax
leave
ret 8
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x660e635c
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x660e635c
Function at 0x660e6380
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
xor esi, esi
push edi
cmp dword [0x6610fd90], esi
je 0x660e6404
push dword [ebp + 0xc]
call fcn.66026741
pop ecx
lea edi, [eax + eax + 2]
push 1
lea eax, [ebp - 0x84]
push esi
push eax
push edi
push esi
push 0x78
lea ecx, [ebp - 0xc]
call fcn.660daf6c
mov ebx, dword [ebp - 8]
cmp ebx, esi
jne 0x660e63d2
lea ecx, [ebp - 0xc]
call fcn.66029f67
push 0xe
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
push esi
push esi
push edi
push ebx
push 0xffffffffffffffff
push dword [ebp + 0xc]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x660e63f6
push 0xe
pop esi
lea ecx, [ebp - 0xc]
call fcn.66029f67
mov eax, esi
jmp 0x660e63cb
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
jmp 0x660e63ea
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x660e63cb

Function at 0x660e6412
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x6610fd90], edi
je 0x660e649c
mov ebx, dword [ebp + 0x14]
push 1
lea eax, [ebp - 0x84]
push edi
lea esi, [ebx + ebx]
push eax
push esi
push edi
push 0x78
lea ecx, [ebp - 0xc]
call fcn.660daf6c
mov eax, dword [ebp - 8]
cmp eax, edi
mov dword [ebp + 0x14], eax
jne 0x660e6462
lea ecx, [ebp - 0xc]
call fcn.66029f67
mov eax, 0x8007000e
pop edi
pop esi
pop ebx
leave
ret 0x10
push esi
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
cmp esi, edi
jne 0x660e6490
push ebx
push dword [ebp + 0x10]
push 0xffffffffffffffff
push dword [ebp + 0x14]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x660e6490
mov esi, 0x8007000e
lea ecx, [ebp - 0xc]
call fcn.66029f67
mov eax, esi
jmp 0x660e645b
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x660e645b
Function at 0x660e8473
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov eax, dword fs:[0]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
and dword [edi + 0x98], 0
test byte [esi + 0x10], 2
jne 0x660e84a7
push 0x14
call fcn.66025592
add edi, 0x78
push edi
call fcn.66018aad
and dword [esi + 0x10], 0xfffffffd
cmp dword [ebp + 8], 0xfffffffe
je 0x660e84cf
cmp dword [ebp + 8], 0xffffffff
jne 0x660e84c9
push dword [esi + 0x18]
push esi
call fcn.66024fe8
pop edi
pop esi
leave
ret 4
push dword [esi + 0x18]
push esi
call fcn.660e84da
jmp 0x660e84c9
Function at 0x660ea0fd
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, 0xffffbfff
mov cx, word [eax]
xor ebx, ebx
movzx edx, cx
and edx, esi
push edi
cmp edx, 8
mov word [ebp - 0x10], bx
jne 0x660ea18a
mov eax, dword [eax + 8]
test ch, 0x40
je 0x660ea12b
mov eax, dword [eax]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov ax, word [edi]
movzx ecx, ax
and ecx, esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp ecx, 8
jne 0x660ea1bf
test ah, 0x40
je 0x660ea1ba
mov eax, dword [edi + 8]
mov edi, dword [eax]
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
cmp word [ebp - 0x10], 0
je 0x660ea17e
test ebx, ebx
jne 0x660ea16a
push dword [0x6610feb0]
call esi
mov ebx, eax
mov ecx, dword [ebp + 0x10]
mov word [ebx + 0x60], 8
mov eax, dword [ebp - 8]
mov dword [ebx + 0x68], eax
mov eax, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
pop edi
pop esi
mov dword [eax], ebx
pop ebx
leave
ret 0x14
lea ecx, [ebp - 0x30]
push ecx
push 8
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.660e58e5
cmp eax, ebx
jge 0x660ea130
cmp eax, 0x800a005e
je 0x660ea1af
lea ecx, [ebp - 0x30]
push ecx
push eax
call fcn.6601d62b
mov eax, dword [ebp + 0x10]
or dword [eax], 0xffffffff
jmp 0x660ea130
mov edi, dword [edi + 8]
jmp 0x660ea150
push dword [0x6610feb0]
call esi
mov ebx, eax
lea eax, [ebp - 0x30]
push eax
push 8
lea eax, [ebx + 0x50]
push edi
push eax
call fcn.660e58e5
mov edi, eax
test edi, edi
jge 0x660ea20c
cmp edi, 0x800a005e
je 0x660ea201
cmp word [ebp - 0x10], 0
je 0x660ea1f7
push dword [ebp - 8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x30]
push eax
push edi
call fcn.6601d62b
mov eax, dword [ebp + 0x14]
or dword [eax], 0xffffffff
jmp 0x660ea155
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebx + 0x58]
mov dword [ecx], eax
jmp 0x660ea155

Function at 0x660ea312
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
movzx eax, word [edi]
and ah, 0xbf
cmp eax, 0x24
jne 0x660ea32f
push 0
push 0x80028ca0
call fcn.6601d62b
push dword [0x6610feb0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea esi, [eax + 0x50]
push esi
push edi
call fcn.66024970
cmp eax, 0xffffffff
je 0x660ea376
push eax
call sym.MSVBVM60.DLL___vbaLenBstr
cmp word [esi], 8
mov edi, dword [esp + 0xc]
mov dword [edi + 8], eax
mov word [edi], 3
jne 0x660ea36f
push dword [esi + 8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
and word [esi], 0
mov eax, edi
pop edi
pop esi
ret 8
mov edi, dword [esp + 0xc]
mov word [edi], 1
jmp 0x660ea36f