joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004f867
Capabilities:
Query or enumerate registry value

Disassembly:
imul edx, ecx, 0xa
mov eax, 0x64
mov word [ebp + edx - 0x28], ax
mov ecx, 2
imul edx, ecx, 0xb
mov dword [ebp - 0x284], edx
cmp dword [ebp - 0x284], 0x18
jae 0x1004f7be
jmp 0x1004f7c3
call 0x10077989
xor eax, eax
mov ecx, dword [ebp - 0x284]
mov word [ebp + ecx - 0x28], ax
mov edx, 2
imul eax, edx, 6
mov ecx, 0x65
mov word [ebp + eax - 0x28], cx
mov edx, 2
shl edx, 1
mov eax, 0x63
mov word [ebp + edx - 0x28], ax
mov ecx, 2
shl ecx, 3
mov edx, 0x75
mov word [ebp + ecx - 0x28], dx
mov eax, 2
imul ecx, eax, 9
mov edx, 0x69
mov word [ebp + ecx - 0x28], dx
mov eax, 2
imul ecx, eax, 7
mov edx, 0x47
mov word [ebp + ecx - 0x28], dx
mov eax, 2
imul ecx, eax, 0
enter 0xffffffffffffba00, 0x4d
add byte [eax], al
add byte [esi - 0x77], ah
push esp
or eax, 0x2b8d8
add byte [eax], al
shl eax, 0
mov ecx, 0x61
mov word [ebp + eax - 0x28], cx
mov edx, 2
imul eax, edx, 3
mov ecx, 0x68
mov word [ebp + eax - 0x28], cx
lea edx, [ebp - 0x270]
push edx
lea eax, [ebp - 0x268]
test dword [eax + 0x50fffffd], ebx
lea ecx, [ebp - 0x274]
push ecx
push 0
lea edx, [ebp - 0x28]
push edx
invalid
invalid
mov ch, bh

Function at 0x10051ca0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060eaa
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x1008c070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x80], 0
xor eax, eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
xor ecx, ecx
mov word [ebp - 0x70], cx
push 0x5e
push 0
lea edx, [ebp - 0x6e]
push edx
call 0x1007cc6a
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x10051d1b
push 0x60
lea ecx, [ebp - 0x70]
push ecx
lea edx, [ebp - 0x80]
push edx
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea ecx, [ebp - 0x9a]
call fcn.10052ad6
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.10059590
add esp, 4
add eax, 0x4a
push eax

Function at 0x10051d37
Capabilities:
Modify service

Disassembly:
lea ecx, [ebp - 0x70]
push ecx
call fcn.100595a0
add esp, 4
add eax, 2
push eax
lea ecx, [ebp - 0x98]
call 0x10070e32
mov dword [ebp - 4], 0
mov byte [ebp - 0x99], 0x2d
lea edx, [ebp - 0xac]
push edx
lea ecx, [ebp - 0x98]
call 0x10061f72
mov eax, dword [eax]
mov dword [ebp - 0xa4], eax
lea ecx, [ebp - 0x99]
push ecx
lea edx, [ebp - 0xb0]
push edx
lea ecx, [ebp - 0x98]
call 0x10061f93
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xb4]
push ecx
lea ecx, [ebp - 0x98]
call sym.imp.ADVAPI32.dll_ChangeServiceConfig2W
mov edx, dword [eax]
push edx
invalid

Function at 0x10052340
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1008c070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
add ecx, 4
call fcn.1005707f
test eax, eax
jne 0x1005236b
or eax, 0xffffffff
jmp 0x100a3c9a
push 0
push 0
push 3
add ebp, dword [edx]
Function at 0x10052370
Capabilities:
Get file size
Read file on windows

Disassembly:
add ebp, dword [edx]
push 1
push 0x80000000
mov ecx, dword [ebp - 0x28]
add ecx, 4
call fcn.100570c5
push eax
invalid
invalid
movsb byte es:[edi], byte [esi]

Function at 0x10052389
Capabilities:
Get file size
Read file on windows

Disassembly:
and byte [esi], al
adc byte [ecx + 0x7d83f045], cl
invalid

Function at 0x100523a9
Capabilities:
Read file on windows

Disassembly:
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]

Function at 0x100523b2
Capabilities:
Read file on windows

Disassembly:
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x2c]
push ecx
push 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100523e0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x100a3d0f
mov dword [ebp - 8], 0
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x1005242a
mov edx, dword [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x100a3d59
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], 0
jne 0x10052458
mov eax, dword [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x100a3d87
mov eax, dword [ebp - 0xc]
cdq
mov ecx, eax
mov esi, edx
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x3c]
cdq
add ecx, eax
adc esi, edx
mov dword [ebp - 0x18], ecx
cmc
xchg ebp, eax
in eax, dx
push dword [ebp + 0x22]
mov eax, dword [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x100a3dc5

Function at 0x100537c2
Capabilities:
Enumerate pe sections

Disassembly:
in al, dx
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx ecx, word [edx + 0x14]
dec edx
adc al, 0x8d
push esp
or byte [eax], bl
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0
jmp 0x100537ff
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
movzx ecx, word [eax + 6]
invalid
Function at 0x10053c96
Capabilities:
Enumerate processes

Disassembly:
add byte [eax], al
mov edx, 0xa9
lea ecx, [ebp - 0x318]
call fcn.10023f60
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x280]
cmp ch, 0xff
dec dword [ecx - 0x2837b]
inc edi
inc ebp
cld
add al, 0
add byte [eax], al
mov ecx, dword [ebp - 0x284]
call 0x100709e2
push eax
mov ecx, dword [ebp + 0x10]
call 0x1006fe2b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x318]
call fcn.1001d970
mov byte [ebp - 0x24d], 0
mov dword [ebp - 0x14], 4
add bh, al
inc ebp
call 0x100a6dc4
mov dword [ebp - 0x24c], 0x22c
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0xffffffff
je 0x10054015
lea ecx, [ebp - 0x24c]
push ecx
mov edx, dword [ebp - 0x258]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x10054008

Function at 0x1005406d
Capabilities:
Check if file exists

Disassembly:
cld
add byte [eax], al
add byte [eax], al
mov dword [ebp - 0x84], 0xffffffff
mov dword [ebp - 0x8c], 0
add byte [eax], al
lea ecx, [ebp + 8]
call fcn.10058dae
test eax, eax
je 0x100540a5
lea ecx, [ebp + 8]
call 0x10070dca
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
invalid
test eax, eax
jne 0x100540cb
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x90], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call 0x10070e30
mov eax, dword [ebp - 0x90]
jmp 0x100a7850
call 0x100ac920
mov dword [ebp - 0x5c], 0
push 0x40
push 0
lea ecx, [ebp - 0x58]
push ecx
call 0x1007f054
add esp, 0xc
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x68], 0
add byte [eax], al
add byte [eax], al

Function at 0x10054084
Capabilities:
Check if file exists

Disassembly:
cld
add byte [eax], al
add byte [eax], al
mov dword [ebp - 0x84], 0xffffffff
mov dword [ebp - 0x8c], 0
add byte [eax], al
lea ecx, [ebp + 8]
call fcn.10058dae
test eax, eax
je 0x100540a5
lea ecx, [ebp + 8]
call 0x10070dca
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
invalid
test eax, eax
jne 0x100540cb
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x90], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call 0x10070e30
mov eax, dword [ebp - 0x90]
jmp 0x100a7850
call 0x100ac920
mov dword [ebp - 0x5c], 0
push 0x40
push 0
lea ecx, [ebp - 0x58]
push ecx
call 0x1007f054
add esp, 0xc
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x68], 0
add byte [eax], al
add byte [eax], al
Function at 0x100541b4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
inc esp
add byte [eax], al
add bh, al
inc ebp
rol byte [ecx], 1
add dword [eax], eax
add byte [ebx], dh
shl byte [esi - 0x77], cl
push ebp
aam 0xc7
inc ebp
test byte [eax], al
add byte [eax], al
add bl, ch
or dword [ebx - 0x3f7c7bbb], ecx
add dword [ecx + 0x7d838445], ecx
test byte [edx], dh
jge 0x1005427b
push 4
lea ecx, [ebp - 0x14]
call 0x10054feb
mov ecx, dword [ebp + 0x20]
push ecx
lea ecx, [ebp - 0x14]
call 0x10070427
mov byte [ebp - 4], 2
lea edx, [ebp - 0x78]
push edx
lea eax, [ebp - 0x5c]
push eax
push 0
mov ecx, dword [ebp - 0x68]
push ecx
push 0x480
push 0
push 0
push 0
push 0x104
lea ecx, [ebp - 0x14]
call 0x100705e1
push eax
lea ecx, [ebp + 8]
call 0x10070f5a
push eax
mov edx, dword [ebp - 0x64]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x80], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call 0x10071082
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x80], 0
je 0x1005426a
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x84], eax
mov byte [ebp - 4], 1
cld
add dword [ebp - 0x6f1713b3], ecx
rol dword [ecx], 0
jmp 0x1005427b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call 0x10070406
jmp 0x100a7849
cmp dword [ebp - 0x80], 0
je 0x1005428b
mov dword [ebp - 0x8c], 1
cmp dword [ebp - 0x78], 0
je 0x100542a1
cmp dword [ebp - 0x78], 0xffffffff
je 0x100542a1
mov ecx, dword [ebp - 0x78]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and byte [esi], al
invalid
cmp dword [ebp - 0x74], 0
je 0x100542b7
cmp dword [ebp - 0x74], 0xffffffff
je 0x100542b7
mov edx, dword [ebp - 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]

Function at 0x100554b1
Capabilities:
Check if file exists
Delete registry key

Disassembly:
mov ebp, esp
sub esp, 0x7e4
mov eax, dword [0x1008c070]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x68f], 0
push 4
lea ecx, [ebp - 0x620]
call fcn.100562d7
lea ecx, [ebp - 0x620]
invalid

Function at 0x100554de
Capabilities:
Check if file exists
Delete registry key

Disassembly:
rol dl, 1
add dword [eax], eax
push 4
lea ecx, [ebp - 0x628]
call fcn.100563f0
lea ecx, [ebp - 0x628]
call 0x100718cb
mov edx, 0x7e
lea ecx, [ebp - 0x70c]
call 0x1007896b
mov ecx, eax
call 0x10072342
push eax
lea ecx, [ebp - 0x20c]
push ecx
mov edx, 0x81
lea ecx, [ebp - 0x6f4]
call 0x1007898a
mov ecx, eax
call 0x10072361
push eax
lea edx, [ebp - 0x628]
push edx
call 0x1007215e
add esp, 0x10
lea ecx, [ebp - 0x6f4]
call 0x100723bc
lea ecx, [ebp - 0x70c]
call 0x100723c7
lea eax, [ebp - 0x644]
push eax
lea ecx, [ebp - 0x688]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
add byte [eax], ch
add al, 0
add byte [ebp - 0x62773], cl
invalid
call 0x10071a41
push eax
invalid
xchg ebp, eax
hlt
std

Function at 0x10055543
Capabilities:
Check if file exists
Delete registry key

Disassembly:
pushal
xor eax, dword [edx]
add byte [eax - 0x46], dl
adc al, 0
add byte [eax], al
lea eax, [ebp - 0x68c]
push eax
push 0xf023f
push 0
Function at 0x100555a1
Capabilities:
Check if file exists
Delete registry key

Disassembly:
push esp
stc
invalid
add byte [ebp - 0x68773], cl
call dword [ecx - 0x18]
jo 0x1005555b
add al, byte [eax]
add esp, 0xc
mov dword [ebp - 0x688], 0x44
mov dword [ebp - 0x65c], 1
xor edx, edx
mov word [ebp - 0x658], dx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100556c2

Function at 0x100556d0
Capabilities:
Delete registry key

Disassembly:
mov edx, 0x13
lea ecx, [ebp - 0x724]
call 0x10078a40
mov ecx, eax
call 0x10072417
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x694], eax
lea ecx, [ebp - 0x724]
call 0x10072474
cmp dword [ebp - 0x694], 0
jne 0x10055742
push 0
push 0x200
mov edx, 0x13
lea ecx, [ebp - 0x73c]
call 0x10078a84
mov ecx, eax
call 0x1007245b
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
lea ecx, [ebp - 0x73c]
call 0x100724b2
mov edx, 0x7f
lea ecx, [ebp - 0x784]
call 0x10078ab2
mov ecx, eax
invalid
invalid

Function at 0x1005592f
Capabilities:
Create process on windows

Disassembly:
pushal
xor eax, dword [edx]
add byte [ebx - 0x32cf1738], cl
add dword [eax], eax

Function at 0x10055d65
Capabilities:
Query or enumerate registry value

Disassembly:
sldt word [eax]
lea ecx, [ebp - 0x13c]
push ecx
mov ecx, 0x10090cb0
call 0x10075899
mov ecx, eax
call fcn.1005aac0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x74], esp
push eax
call fcn.1005aeee
invalid
pushal
pushal
invalid

Function at 0x10056fc0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
dec eax
add al, byte [eax]
add byte [ecx + 0x1008c070], ah

Function at 0x10056fc5
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
dec eax
add al, byte [eax]
add byte [ecx + 0x1008c070], ah

Function at 0x10056fc8
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
dec eax
add al, byte [eax]
add byte [ecx + 0x1008c070], ah

Function at 0x10059ded
Capabilities:
Check if file exists

Disassembly:
lea ecx, [ebp - 0x2c]
call 0x1007b2c5
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x28]
fcom dword [edx - 0x18]
and bl, cl
add dword [eax], eax
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [ebp - 0x2c]

Function at 0x10059dfc
Capabilities:
Check if file exists

Disassembly:
lea ecx, [ebp - 0x2c]
call 0x1007b2c5
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x28]
fcom dword [edx - 0x18]
and bl, cl
add dword [eax], eax
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [ebp - 0x2c]

Function at 0x10059e0b
Capabilities:
Check if file exists

Disassembly:
call 0x10076c50
lea ecx, [ebp - 0x28]
call fcn.1005be58
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
adc eax, sym.imp.SHLWAPI.dll_PathFileExistsW

Function at 0x10059e1a
Capabilities:
Check if file exists

Disassembly:
call 0x10076c50
lea ecx, [ebp - 0x28]
call fcn.1005be58
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
adc eax, sym.imp.SHLWAPI.dll_PathFileExistsW
Function at 0x10059e1f
Capabilities:
Check if file exists

Disassembly:
test eax, eax
jne 0x10059ef6
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x34]
call 0x1007b303
push eax
lea ecx, [ebp - 0x1c]
in al, 0x51
lea edx, [ebp - 0x28]
push edx
call 0x10076961
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [ebp - 0x34]
call 0x10076c8e
lea ecx, [ebp - 0x28]
call fcn.1005be96
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10059ef6
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x38]
call 0x1007b341
add byte [eax - 0x73], dl
dec ebp
in al, 0x51
lea edx, [ebp - 0x28]
push edx
call 0x1007699f
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [ebp - 0x38]
call 0x10076ccc
lea ecx, [ebp - 0x28]
call fcn.1005bed4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10059ef6
mov byte [ebp - 0x3d], 0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x28]
invalid
nop
invalid
invalid

Function at 0x10059e29
Capabilities:
Check if file exists

Disassembly:
test eax, eax
jne 0x10059ef6
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x34]
call 0x1007b303
push eax
lea ecx, [ebp - 0x1c]
in al, 0x51
lea edx, [ebp - 0x28]
push edx
call 0x10076961
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [ebp - 0x34]
call 0x10076c8e
lea ecx, [ebp - 0x28]
call fcn.1005be96
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10059ef6
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x38]
call 0x1007b341
add byte [eax - 0x73], dl
dec ebp
in al, 0x51
lea edx, [ebp - 0x28]
push edx
call 0x1007699f
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [ebp - 0x38]
call 0x10076ccc
lea ecx, [ebp - 0x28]
call fcn.1005bed4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10059ef6
mov byte [ebp - 0x3d], 0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x28]
invalid
nop
invalid
invalid

Function at 0x10059e36
Capabilities:
Check if file exists

Disassembly:
test eax, eax
jne 0x10059ef6
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x34]
call 0x1007b303
push eax
lea ecx, [ebp - 0x1c]
in al, 0x51
lea edx, [ebp - 0x28]
push edx
call 0x10076961
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [ebp - 0x34]
call 0x10076c8e
lea ecx, [ebp - 0x28]
call fcn.1005be96
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10059ef6
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x38]
call 0x1007b341
add byte [eax - 0x73], dl
dec ebp
in al, 0x51
lea edx, [ebp - 0x28]
push edx
call 0x1007699f
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [ebp - 0x38]
call 0x10076ccc
lea ecx, [ebp - 0x28]
call fcn.1005bed4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10059ef6
mov byte [ebp - 0x3d], 0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x28]
invalid
nop
invalid
invalid
Function at 0x10059e70
Capabilities:
Check if file exists

Disassembly:
test eax, eax
jne 0x10059ef6
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x34]
call 0x1007b303
push eax
lea ecx, [ebp - 0x1c]
in al, 0x51
lea edx, [ebp - 0x28]
push edx
call 0x10076961
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [ebp - 0x34]
call 0x10076c8e
lea ecx, [ebp - 0x28]
call fcn.1005be96
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10059ef6
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x38]
call 0x1007b341
add byte [eax - 0x73], dl
dec ebp
in al, 0x51
lea edx, [ebp - 0x28]
push edx
call 0x1007699f
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [ebp - 0x38]
call 0x10076ccc
lea ecx, [ebp - 0x28]
call fcn.1005bed4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10059ef6
mov byte [ebp - 0x3d], 0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x28]
invalid
nop
invalid
invalid

Function at 0x10059ff3
Capabilities:
Query or enumerate registry value

Disassembly:
add byte [eax], al
add bh, al
inc ebp
cld
add dword [eax], eax
add byte [eax], al
mov dword [ebp - 0x18], 0x593f7
xchg ebx, eax
add eax, 0xd845c700
add byte [eax], cl
add byte [eax], al
mov dword [ebp - 0x14], 0x800
lea eax, [ebp - 0x14]
push eax
push 0x800
mov ecx, dword [ebp + 0x14]
call 0x100763d5
push eax
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp + 0x10]
call fcn.1005c062
push eax
lea ecx, [ebp + 0xc]
dec ebp
or al, 0xe8
inc eax
and byte [eax], al
add byte [eax - 0x75], dl
push ebp
or byte [edx - 1], dl
adc eax, sym.imp.SHLWAPI.dll_SHGetValueW
mov dword [ebp - 0x24], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x14]
call 0x10076e83
cmp dword [ebp - 0x24], 0
jne 0x1005a052
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x20], 0
mov al, byte [ebp - 0x20]
mov byte [ebp - 0x19], al
loopne 0x10059fe5
inc ebp
out 0xc6, eax
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call 0x100761fb

Function at 0x1005a4fa
Capabilities:
Get common file path

Disassembly:
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
rcr dh, 1
fcos
add byte [eax], al
add byte [eax - 8], ch
clc

Function at 0x1005a84f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x206
push 0
lea ecx, [ebp - 0x22a]

Function at 0x1005a851
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x206
push 0
lea ecx, [ebp - 0x22a]

Function at 0x1005a85c
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
call 0x100857d2
add esp, 0xc
mov dword [ebp - 0x234], 0x208
invalid
pop ebp

Function at 0x1005a871
Capabilities:
Query or enumerate registry value

Disassembly:
add byte [eax], al
add byte [ebp - 0x2a773], cl
invalid

Function at 0x1005a885
Capabilities:
Query or enumerate registry value

Disassembly:
lea edx, [ebp - 0x234]
push edx
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x238]
push ecx
push 0
mov ecx, dword [ebp - 0x270]
call 0x100775d7
push eax
mov edx, dword [ebp - 0x244]
push edx
Function at 0x1005a8e8
Capabilities:
Query or enumerate registry value

Disassembly:
add byte [eax - 0x75], dl
xchg ebp, eax
mov esp, 0x52fffffd
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1005a8c5
mov dword [ebp - 0x254], 1
jmp 0x1005a8cf
mov dword [ebp - 0x254], 0
mov al, byte [ebp - 0x254]
mov byte [ebp - 0x247], al
lea ecx, [ebp - 0x2a8]
call 0x10077656
movzx ecx, byte [ebp - 0x247]
lea edi, [ecx - 0x7a000003]
leave
je 0x1005a959
mov edx, 2
shl edx, 0
mov eax, 0x73
mov word [ebp + edx - 0x18], ax
adc eax, 0x59fc0e8
add byte [eax], al
imul edx, ecx, 0
mov eax, 0x25
adc eax, 0x59fc0e8
add byte [eax], al
imul edx, ecx, 0
mov eax, 0x25
mov word [ebp + edx - 0x18], ax
rcr byte [edi - 0x2efffffb], cl
loope 0x1005a8a6
lea ebp, [eax - 0x7c000003]
mov ebp, 0xfffffda8
push es
jae 0x1005a92d
jmp 0x1005a932
call 0x10082af8
xor edx, edx
mov eax, dword [ebp - 0x258]
mov word [ebp + eax - 0x18], dx
lea ecx, [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x18]
push edx
invalid
test eax, edx

Function at 0x1005a901
Capabilities:
Query or enumerate registry value

Disassembly:
add byte [eax - 0x75], dl
xchg ebp, eax
mov esp, 0x52fffffd
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1005a8c5
mov dword [ebp - 0x254], 1
jmp 0x1005a8cf
mov dword [ebp - 0x254], 0
mov al, byte [ebp - 0x254]
mov byte [ebp - 0x247], al
lea ecx, [ebp - 0x2a8]
call 0x10077656
movzx ecx, byte [ebp - 0x247]
lea edi, [ecx - 0x7a000003]
leave
je 0x1005a959
mov edx, 2
shl edx, 0
mov eax, 0x73
mov word [ebp + edx - 0x18], ax
adc eax, 0x59fc0e8
add byte [eax], al
imul edx, ecx, 0
mov eax, 0x25
adc eax, 0x59fc0e8
add byte [eax], al
imul edx, ecx, 0
mov eax, 0x25
mov word [ebp + edx - 0x18], ax
rcr byte [edi - 0x2efffffb], cl
loope 0x1005a8a6
lea ebp, [eax - 0x7c000003]
mov ebp, 0xfffffda8
push es
jae 0x1005a92d
jmp 0x1005a932
call 0x10082af8
xor edx, edx
mov eax, dword [ebp - 0x258]
mov word [ebp + eax - 0x18], dx
lea ecx, [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x18]
push edx
invalid
test eax, edx

Function at 0x1005a992
Capabilities:
Query or enumerate registry value

Disassembly:
add al, byte ds:[eax]
add byte [edx], ch
lea ecx, [ebp - 0x230]
call 0x1007c99a
movzx ecx, ax
cmp ecx, 0x36
jne 0x1005abab
push 2
lea ecx, [ebp - 0x230]
call 0x1007c9b3
add byte [edi], cl
mov bh, 0xd0
cmp edx, 0x32
je 0x1005a9b4
push 2
lea ecx, [ebp - 0x230]
call 0x1007c9c8
movzx eax, ax
cmp eax, 0x33
jne 0x1005abab
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
mov byte [ebp - 0x245], 0
mov dword [ebp - 0x238], 4
enter 0xfffffffffffffffd, 0xffffffffffffffff
add al, 0
add byte [eax], al
mov dword [ebp - 0x234], 4
mov edx, 0x5e
lea ecx, [ebp - 0x2c0]
call 0x1007dd53
invalid
invalid
invalid