joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10079cd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
call fcn.01007a9a
cmp eax, edi
mov dword [ebp + 0xc], eax
jl 0x1007a44
mov eax, dword [ebp - 4]
push esi
lea ecx, [ebp - 8]
push ecx
push edi
lea ecx, [ebp + 8]
push ecx
push edi
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
xor esi, esi
sub ecx, edi
je 0x1007a2a
dec ecx
dec ecx
je 0x1007a26
lea ecx, [ebp + 0xc]
push ecx
push eax
call fcn.010033a2
test eax, eax
je 0x1007a3e
jmp 0x1007a2d
xor esi, esi
jmp 0x1007a2d
xor esi, esi
inc esi
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x1007a3e
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
cmp dword [ebp + 0xc], edi
pop esi
jge 0x1007a6b
mov eax, dword [section..data]
cmp eax, section..data
je 0x1007a6b
test byte [eax + 0x3c], 2
je 0x1007a6b
push dword [ebp + 0xc]
push 0x1001c78
push 0x2d
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0101083d
lea ecx, [ebp - 4]
call fcn.0100357f
mov eax, dword [ebp + 0xc]
pop edi
leave
ret 0x14

Function at 0x1007df4
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01007a9a
mov dword [ebp + 0xc], eax
test eax, eax
jl 0x1007e33
mov eax, dword [ebp - 4]
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
call fcn.010033a2
cmp dword [ebp + 0xc], 0
jge 0x1007e5a
mov eax, dword [section..data]
cmp eax, section..data
je 0x1007e5a
test byte [eax + 0x3c], 2
je 0x1007e5a
push dword [ebp + 0xc]
push 0x1001c78
push 0x1e
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0101083d
lea ecx, [ebp - 4]
call fcn.0100357f
mov eax, dword [ebp + 0xc]
leave
ret 0xc
Function at 0x1007e96
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], 0x80000001
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
jne 0x1007eb7
mov dword [ebp - 0xc], edi
lea eax, [ebp - 8]
push eax
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01007a9a
mov esi, eax
cmp esi, edi
mov dword [ebp + 0xc], esi
jl 0x1007f76
mov dword [ebp + 8], edi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
call fcn.010033a2
test eax, eax
je 0x1007f6f
cmp dword [ebp - 4], edi
jne 0x1007f2d
cmp dword [ebp + 8], edi
jbe 0x1007f68
push dword [ebp + 8]
call fcn.01003185
lea ecx, [ebp - 4]
mov esi, eax
call fcn.01004dbf
cmp esi, edi
je 0x1007f23
mov dword [ebp - 4], esi
jmp 0x1007ed8
mov dword [ebp - 4], edi
mov esi, 0x8007000e
jmp 0x1007f72
cmp dword [ebp - 0x10], 0xb
je 0x1007f3a
mov esi, 0x8007000d
jmp 0x1007f76
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.0100757b
mov esi, eax
cmp esi, edi
jl 0x1007f76
cmp dword [ebp + 0xc], edi
je 0x1007f5a
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x1007f72
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x1007f72
mov esi, 0x8000ffff
jmp 0x1007f76
mov esi, dword [ebp + 0xc]
cmp esi, edi
jge 0x1007f9b
mov eax, dword [section..data]
cmp eax, section..data
je 0x1007f9b
test byte [eax + 0x3c], 2
je 0x1007f9b
push esi
push 0x1001c78
push 0x22
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0101083d
lea ecx, [ebp - 4]
call fcn.01004dbf
lea ecx, [ebp - 0xc]
call fcn.0100357f
lea ecx, [ebp - 8]
call fcn.0100357f
pop edi
mov eax, esi
pop esi
leave
ret 0x14

Function at 0x1007fc0
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 8], 0x80000001
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
jne 0x1007fe1
mov dword [ebp - 0xc], esi
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01007a9a
mov edi, eax
cmp edi, esi
jl 0x1008026
mov eax, dword [ebp - 4]
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0x1c]
lea ecx, [ebp + 0x14]
push ecx
push 0xb
push esi
push dword [ebp + 0x10]
mov dword [ebp - 8], esi
push eax
mov dword [ebp + 8], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call fcn.010033a2
mov edi, dword [ebp + 8]
cmp edi, esi
jge 0x100804b
mov eax, dword [section..data]
cmp eax, section..data
je 0x100804b
test byte [eax + 0x3c], 2
je 0x100804b
push edi
push 0x1001c78
push 0x24
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0101083d
lea ecx, [ebp - 8]
call fcn.01004dbf
lea ecx, [ebp - 0xc]
call fcn.0100357f
lea ecx, [ebp - 4]
call fcn.0100357f
mov eax, edi
pop edi
pop esi
leave
ret 0x18
Function at 0x1008070
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], 0x80000001
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
jne 0x1008091
mov dword [ebp - 0xc], edi
lea eax, [ebp - 8]
push eax
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01007a9a
mov esi, eax
cmp esi, edi
mov dword [ebp + 0xc], esi
jl 0x1008150
mov dword [ebp + 8], edi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
call fcn.010033a2
test eax, eax
je 0x1008149
cmp dword [ebp - 4], edi
jne 0x1008107
cmp dword [ebp + 8], edi
jbe 0x1008142
push dword [ebp + 8]
call fcn.01003185
lea ecx, [ebp - 4]
mov esi, eax
call fcn.01004dbf
cmp esi, edi
je 0x10080fd
mov dword [ebp - 4], esi
jmp 0x10080b2
mov dword [ebp - 4], edi
mov esi, 0x8007000e
jmp 0x100814c
cmp dword [ebp - 0x10], 4
je 0x1008114
mov esi, 0x8007000d
jmp 0x1008150
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.01007524
mov esi, eax
cmp esi, edi
jl 0x1008150
cmp dword [ebp + 0xc], edi
je 0x1008134
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x100814c
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x100814c
mov esi, 0x8000ffff
jmp 0x1008150
mov esi, dword [ebp + 0xc]
cmp esi, edi
jge 0x1008175
mov eax, dword [section..data]
cmp eax, section..data
je 0x1008175
test byte [eax + 0x3c], 2
je 0x1008175
push esi
push 0x1001c78
push 0x22
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0101083d
lea ecx, [ebp - 4]
call fcn.01004dbf
lea ecx, [ebp - 0xc]
call fcn.0100357f
lea ecx, [ebp - 8]
call fcn.0100357f
pop edi
mov eax, esi
pop esi
leave
ret 0x14

Function at 0x100819a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 8], 0x80000001
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
jne 0x10081bb
mov dword [ebp - 0xc], esi
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01007a9a
mov edi, eax
cmp edi, esi
jl 0x1008200
mov eax, dword [ebp - 4]
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0x18]
lea ecx, [ebp + 0x14]
push ecx
push 4
push esi
push dword [ebp + 0x10]
mov dword [ebp - 8], esi
push eax
mov dword [ebp + 8], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call fcn.010033a2
mov edi, dword [ebp + 8]
cmp edi, esi
jge 0x1008225
mov eax, dword [section..data]
cmp eax, section..data
je 0x1008225
test byte [eax + 0x3c], 2
je 0x1008225
push edi
push 0x1001c78
push 0x24
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0101083d
lea ecx, [ebp - 8]
call fcn.01004dbf
lea ecx, [ebp - 0xc]
call fcn.0100357f
lea ecx, [ebp - 4]
call fcn.0100357f
mov eax, edi
pop edi
pop esi
leave
ret 0x14
Function at 0x1008ab5
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
cmp dword [ebp + 0x10], edi
jne 0x1008ad5
mov ebx, 0x80070057
jmp 0x1008b5b
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.01008a0f
mov ebx, eax
cmp ebx, edi
jl 0x1008b5b
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push dword [ebp - 4]
push 0x100855c
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp - 8]
mov esi, eax
call fcn.01004a80
cmp esi, edi
jne 0x1008b3b
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], edi
call fcn.01008470
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100328c
mov ebx, eax
jmp 0x1008b56
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], esi
cmp eax, edi
je 0x1008b4a
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
mov eax, dword [ebp + 0x24]
cmp eax, edi
je 0x1008b56
mov dword [ebp - 8], edi
mov dword [eax], esi
cmp ebx, edi
pop esi
jge 0x1008b80
mov eax, dword [section..data]
cmp eax, section..data
je 0x1008b80
test byte [eax + 0x3c], 2
je 0x1008b80
push ebx
push 0x1001d4c
push 0xc
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0101083d
mov ecx, dword [ebp - 4]
cmp ecx, edi
je 0x1008b8c
call fcn.01008470
lea ecx, [ebp - 8]
call fcn.01004a80
pop edi
mov eax, ebx
pop ebx
leave
ret 0x20

Function at 0x10096ed
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push esi
push 4
pop esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
call fcn.010033a2
test eax, eax
je 0x100975b
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp + 0x14]
lea ecx, [ebp + 0xc]
push ecx
push 0
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
call fcn.010033a2
test eax, eax
je 0x100975b
cmp dword [ebp + 0xc], esi
mov esi, 0x80070057
jne 0x100975e
mov esi, dword [ebp - 4]
test esi, esi
jge 0x1009787
mov eax, dword [section..data]
cmp eax, section..data
je 0x1009787
test byte [eax + 0x3c], 2
je 0x1009787
push esi
push 0x1001cb8
push 0xa
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0101083d
lea ecx, [ebp - 8]
call fcn.0100357f
mov eax, esi
pop esi
leave
ret 0x10
Function at 0x100c9b4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push esi
mov esi, dword [ebp + 0x18]
mov eax, dword [esi]
mov dword [ebp + 0x18], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
call fcn.010033a2
test eax, eax
je 0x100ca29
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp + 0x18]
push ecx
push dword [ebp + 0x14]
lea ecx, [ebp + 0xc]
push ecx
push 0
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
call fcn.010033a2
test eax, eax
je 0x100ca29
mov eax, dword [ebp + 0x18]
cmp eax, dword [esi]
jbe 0x100ca27
mov esi, 0x80070057
jmp 0x100ca30
mov dword [esi], eax
mov esi, dword [ebp - 4]
test esi, esi
jge 0x100ca55
mov eax, dword [section..data]
cmp eax, section..data
je 0x100ca55
test byte [eax + 0x3c], 2
je 0x100ca55
push esi
push 0x1002bd8
push 0xb
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0101083d
lea ecx, [ebp - 8]
call fcn.0100357f
mov eax, esi
pop esi
leave
ret 0x14

Function at 0x100cc9d
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10160e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
mov dword [ebp - 0x14], ebx
cmp esi, ebx
jne 0x100cce0
mov dword [ebp - 0x10], 0x80070057
jmp 0x100cd32
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x100cd15
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100328c
mov dword [ebp - 0x10], eax
jmp 0x100cd2d
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x100cd04
mov eax, dword [ebp - 0x18]
mov dword [esi], eax
cmp dword [ebp - 0x10], ebx
jge 0x100cd59
mov eax, dword [section..data]
cmp eax, section..data
je 0x100cd59
test byte [eax + 0x3c], 2
je 0x100cd59
push dword [ebp - 0x10]
push 0x1002c38
push 0x12
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0101083d
lea ecx, [ebp - 0x14]
call fcn.0100bdf1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01013a7d
leave
ret 8
Function at 0x100ce6a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 1
xor edi, edi
push edi
push 0x1002e58
push 0x80000002
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100cec6
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push 0x1002e3c
push eax
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100cec6
cmp dword [ebp - 0xc], 4
jne 0x100cec6
cmp dword [ebp - 0x10], edi
je 0x100cec6
inc edi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
mov dword [eax], edi
call fcn.0100357f
xor eax, eax
pop edi
leave
ret 4

Function at 0x100e123
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10160e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x210], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
mov dword [ebp - 0x218], eax
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
push ebx
call esi
mov dword [ebp - 0x214], eax
test eax, eax
jne 0x100e17e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100328c
mov edi, eax
jmp 0x100e1e2
cmp eax, edi
ja 0x100e196
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
call fcn.01003a91
jmp 0x100e17a
lea ecx, [ebp - 0x210]
push ecx
push eax
push 0
call fcn.0100d4a9
mov edi, eax
test edi, edi
jl 0x100e1e6
push dword [ebp - 0x214]
push dword [ebp - 0x210]
push ebx
call esi
test eax, eax
je 0x100e16e
cmp eax, dword [ebp - 0x214]
je 0x100e1cd
mov edi, 0x8007007a
jmp 0x100e1e6
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 0x218]
and dword [ebp - 0x210], 0
mov dword [ecx], eax
test edi, edi
jge 0x100e20b
mov eax, dword [section..data]
cmp eax, section..data
je 0x100e20b
test byte [eax + 0x3c], 2
je 0x100e20b
push edi
push 0x1002e2c
push 0x13
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0101083d
lea ecx, [ebp - 0x210]
call fcn.0100359b
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01013a7d
leave
ret 8
Function at 0x100f29a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], 0x80000001
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
jne 0x100f2bb
mov dword [ebp - 0xc], edi
lea eax, [ebp - 8]
push eax
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0100c80c
mov esi, eax
cmp esi, edi
mov dword [ebp + 0xc], esi
jl 0x100f37a
mov dword [ebp + 8], edi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
call fcn.010033a2
test eax, eax
je 0x100f373
cmp dword [ebp - 4], edi
jne 0x100f331
cmp dword [ebp + 8], edi
jbe 0x100f36c
push dword [ebp + 8]
call fcn.01003185
lea ecx, [ebp - 4]
mov esi, eax
call fcn.01004dbf
cmp esi, edi
je 0x100f327
mov dword [ebp - 4], esi
jmp 0x100f2dc
mov dword [ebp - 4], edi
mov esi, 0x8007000e
jmp 0x100f376
cmp dword [ebp - 0x10], 2
je 0x100f33e
mov esi, 0x8007000d
jmp 0x100f37a
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.0100e65b
mov esi, eax
cmp esi, edi
jl 0x100f37a
cmp dword [ebp + 0xc], edi
je 0x100f35e
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x100f376
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x100f376
mov esi, 0x8000ffff
jmp 0x100f37a
mov esi, dword [ebp + 0xc]
cmp esi, edi
jge 0x100f39f
mov eax, dword [section..data]
cmp eax, section..data
je 0x100f39f
test byte [eax + 0x3c], 2
je 0x100f39f
push esi
push 0x1002d40
push 0x22
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0101083d
lea ecx, [ebp - 4]
call fcn.01004dbf
lea ecx, [ebp - 0xc]
call fcn.0100357f
lea ecx, [ebp - 8]
call fcn.0100357f
pop edi
mov eax, esi
pop esi
leave
ret 0x14
Function at 0x100f3c4
Capabilities:
Change the wallpaper

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x10160e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
xor esi, esi
lea eax, [ebp - 0x218]
inc edi
push eax
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
call fcn.0100ef29
test eax, eax
jge 0x100f40e
mov dword [ebp - 0x218], esi
cmp dword [ebp - 0x218], esi
jne 0x100f537
push ebx
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
call dword [sym.imp.USER32.dll_SetSysColors]
mov ebx, 0xc0002006
test eax, eax
jne 0x100f488
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100328c
mov edi, eax
lea eax, [ebp - 0x214]
push eax
push 0x2bc
call fcn.01003c21
cmp eax, esi
mov dword [ebp - 0x210], eax
jl 0x100f50c
mov eax, dword [ebp - 0x214]
push esi
push esi
push eax
push esi
push esi
push edi
push ebx
push 1
call fcn.01004f9a
cmp edi, esi
mov dword [ebp - 0x210], edi
jl 0x100f50c
mov edi, dword [sym.imp.USER32.dll_SystemParametersInfoW]
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x104
push 0x73
call edi
test eax, eax
je 0x100f4b1
push 3
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x14
call edi
push 3
push 0x1002030
push esi
push 0x14
call edi
test eax, eax
jne 0x100f504
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100328c
mov edi, eax
lea eax, [ebp - 0x214]
push eax
push 0x2bc
call fcn.01003c21
cmp eax, esi
mov dword [ebp - 0x210], eax
jl 0x100f50c
mov eax, dword [ebp - 0x214]
push esi
push esi
push eax
push esi
push esi
push edi
push ebx
push 1
call fcn.01004f9a
mov dword [ebp - 0x210], edi
cmp dword [ebp - 0x210], esi
jge 0x100f536
mov eax, dword [section..data]
cmp eax, section..data
je 0x100f536
test byte [eax + 0x3c], 2
je 0x100f536
push dword [ebp - 0x210]
push 0x1002d6c
push 0x2c
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0101083d
pop ebx
lea ecx, [ebp - 0x214]
call fcn.0100359b
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
xor ecx, ebp
pop esi
call fcn.01013a7d
leave
ret
Function at 0x10117fd
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x10160e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x408], eax
mov esi, 0x200
push esi
lea eax, [ebp - 0x404]
push eax
call edi
test eax, eax
jne 0x1011845
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100328c
jmp 0x10118ab
push 0x10016d0
push esi
lea eax, [ebp - 0x404]
push eax
call fcn.01010a6c
mov ebx, eax
test ebx, ebx
jl 0x10118b1
lea eax, [ebp - 0x404]
push 0
push eax
call dword [sym.imp.msvcrt.dll__waccess_s]
pop ecx
pop ecx
cmp eax, 2
jne 0x1011899
push esi
lea eax, [ebp - 0x404]
push eax
call edi
test eax, eax
je 0x1011837
push 0x10016bc
push esi
lea eax, [ebp - 0x404]
push eax
call fcn.01010a6c
mov ebx, eax
test ebx, ebx
jl 0x10118b1
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push eax
call fcn.01003a91
mov ebx, eax
test ebx, ebx
jge 0x10118d6
mov eax, dword [section..data]
cmp eax, section..data
je 0x10118d6
test byte [eax + 0x3c], 2
je 0x10118d6
push ebx
push 0x1002d54
push 0x22
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0101083d
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01013a7d
leave
ret 4
Function at 0x1013a63
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1014348
call fcn.01013d64
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1016880
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x101381a
cmp eax, esi
jne 0x101380d
xor esi, esi
inc esi
mov ebx, esi
jmp 0x101381d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10137f4
xor esi, esi
inc esi
mov eax, dword [0x101687c]
cmp eax, esi
jne 0x1013830
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x101385f
mov eax, dword [0x101687c]
test eax, eax
jne 0x1013859
mov dword [0x101687c], esi
push 0x10013a0
push 0x1001394
call fcn.01013759
pop ecx
pop ecx
test eax, eax
je 0x101385f
jmp 0x1013987
mov dword [0x101654c], esi
mov eax, dword [0x101687c]
cmp eax, esi
jne 0x1013883
push 0x1001390
push 0x1001300
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x101687c], 2
test ebx, ebx
jne 0x101388f
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x101688c], 0
je 0x10138b3
push 0x101688c
call fcn.01013cd9
pop ecx
test eax, eax
je 0x10138b3
push 0
push 2
push 0
call dword [0x101688c]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x101390f
test al, al
je 0x10138cd
cmp dword [ebp - 0x1c], 0
jne 0x101390f
mov al, byte [esi]
test al, al
je 0x10138dd
cmp al, 0x20
ja 0x10138dd
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10138cd
test byte [ebp - 0x3c], 1
je 0x10138e9
movzx eax, word [ebp - 0x38]
jmp 0x10138ec
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1016548], eax
cmp dword [0x101653c], 0
jne 0x1013963
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x101391e
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x1013931
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x10138ba
cmp dword [0x101654c], 0
jne 0x1013972
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1016548]
jmp 0x1013993
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01013da9
ret
call fcn.01013eb1
jmp 0x10137ba