joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100199a0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10344e21
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x1040706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.100fcb40
mov ecx, dword [edi + 0x54]
lea esi, [edi + 0x54]
call fcn.101078d0
push eax
push dword [edi + 0x590]
call dword [0x1041c9b4]
lea eax, [ebp - 0x94]
push eax
call fcn.101075d0
add esp, 0xc
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.100fcd90
push eax
push dword [edi + 0x590]
call dword [0x1041c884]
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.100fcb40
lea eax, [ebp - 0x94]
push eax
call fcn.101075d0
add esp, 4
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.100fcd90
push eax
push dword [edi + 0x590]
call dword [0x1041c88c]
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.100fcb40
push str.WkeBrowser
push dword [edi + 0x590]
call dword [0x1041c9b8]
push 1
push dword [edi + 0x590]
call dword [0x1041c9e8]
push 0
push dword [edi + 0x590]
call dword [0x1041c9d8]
push 0
push dword [edi + 0x590]
call dword [0x1041c9d4]
lea eax, [ebp - 0x118]
push eax
call fcn.101075d0
add esp, 0x24
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.100fcd90
push eax
push dword [edi + 0x590]
call dword [0x1041c890]
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x118]
call fcn.100fcb40
mov ecx, dword [esi]
call fcn.10107db0
movzx eax, al
push eax
push dword [edi + 0x590]
call dword [0x1041c9a8]
push 0
push dword [edi + 0x590]
call dword [0x1041c9ec]
push edi
push 0x1001a660
push dword [edi + 0x590]
call dword [0x1041c7cc]
push edi
push 0x1001a6a0
push dword [edi + 0x590]
call dword [0x1041c7c8]
push edi
push 0x1001a740
push dword [edi + 0x590]
call dword [0x1041c7ac]
push edi
push 0x1001a7b0
push dword [edi + 0x590]
call dword [0x1041c7a8]
add esp, 0x40
push edi
push 0x1001a7f0
push dword [edi + 0x590]
call dword [0x1041c7a4]
push edi
push 0x1001a820
push dword [edi + 0x590]
call dword [0x1041c788]
push edi
push 0x1001a860
push dword [edi + 0x590]
call dword [0x1041c79c]
push edi
push 0x1001a990
push dword [edi + 0x590]
call dword [0x1041c798]
push edi
push 0x1001a640
push dword [edi + 0x590]
call dword [0x1041c7c0]
push edi
push 0x1001a700
push dword [edi + 0x590]
call dword [0x1041c7b8]
add esp, 0x48
push edi
push method.CMainDlgVar::BindCefToViewDelegate.virtual_4
push dword [edi + 0x590]
call dword [0x1041c76c]
push edi
push 0x1001a950
push dword [edi + 0x590]
call dword [0x1041c790]
push str.Mozilla_5.0__Windows_NT_6.1__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_69.0.2228.0_Safari_537.36
push dword [edi + 0x590]
call dword [0x1041c9a4]
mov eax, dword [edi + 0x56c]
lea ecx, [edi + 0x56c]
add esp, 0x20
push edi
call dword [eax]
mov ecx, dword [esi]
lea eax, [edi + 0x568]
neg edi
sbb edi, edi
and edi, eax
push edi
call fcn.10106390
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f99ca
mov esp, ebp
pop ebp
ret
Function at 0x10019ff0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10344e71
mov eax, dword fs:[0]
push eax
sub esp, 0x31c
mov eax, dword [0x1040706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1041ca24]
test eax, eax
je 0x1001a032
call eax
test eax, eax
je 0x1001a032
mov al, 1
jmp 0x1001a1a5
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x324]
call fcn.100fc950
lea ecx, [ebp - 0x324]
mov dword [ebp - 4], 0
call fcn.100fdad0
test al, al
je 0x1001a067
push 0x1041cb10
lea ecx, [ebp - 0x324]
call fcn.100fcc50
lea eax, [ebp - 0x324]
push eax
lea ecx, [ebp - 0x2a0]
call fcn.100fc910
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 1
call fcn.100fcd90
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001a11e
push 0x20a
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.101d2900
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x21c]
push 0x5c
push eax
call fcn.101d2713
add esp, 8
test eax, eax
je 0x1001a0db
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x2a0]
call fcn.100fcc80
lea ecx, [ebp - 0x324]
call fcn.100fcd90
push eax
lea ecx, [ebp - 0x2a0]
call fcn.100fcfd0
lea ecx, [ebp - 0x2a0]
call fcn.100fcd90
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001a11e
xor bl, bl
jmp 0x1001a18d
lea ecx, [ebp - 0x2a0]
call fcn.100fcd90
mov dword [str.node.dll], eax
call fcn.10016850
push 2
push 0
push 0x1001a9d0
push str.jsExternal
call dword [0x1041c5f8]
add esp, 0x10
push 0x10019680
sub esp, 0x84
mov ecx, esp
mov dword [ebp - 0x328], esp
push 0xffffffffffffffff
push str.CWkeWebkitUI
call fcn.100fc950
mov byte [ebp - 4], 2
call fcn.1011afe0
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.1011b0b0
mov eax, dword [0x1041ca24]
test eax, eax
je 0x1001a188
call eax
test eax, eax
setne bl
lea ecx, [ebp - 0x2a0]
call fcn.100fcb40
lea ecx, [ebp - 0x324]
call fcn.100fcb40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f99ca
mov esp, ebp
pop ebp
ret
Function at 0x1001e4d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1530
call fcn.100fae50
mov eax, dword [0x1040706c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push 0x110
push ebx
mov dword [ebp - 0x152c], esi
mov eax, dword [esi + 0x210]
mov dword [esi + 0x214], eax
lea eax, [ebp - 0x514]
push eax
call fcn.101d2900
add esp, 0xc
mov dword [ebp - 0x518], 0x114
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x508], 2
jne 0x1001e540
mov ecx, esi
call fcn.1001dd70
jmp 0x1001e677
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov dword [ebp - 0x1528], ebx
push edi
nop dword [eax]
test ebx, ebx
jne 0x1001e670
push 0x100
mov dword [ebp - 0x1530], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0x1001e584
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nERROR:_Could_not_SetPriorityClass__LastError:__d_n
call fcn.1001ea20
add esp, 8
push 0x100c
lea eax, [ebp - 0x1524]
push 0
push eax
call fcn.101d2900
add esp, 0xc
push 0
push 0x4000000
push 0
push 0
push 0
push 0
push str..IDE21201.VXD
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001e5e1
push 0
lea eax, [ebp - 0x1530]
push eax
push 4
lea eax, [ebp - 0x1524]
push eax
push 0
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
lea edi, [ebp - 0x1518]
nop dword [eax]
cmp byte [ebp + esi - 0x1520], 0
je 0x1001e63d
mov eax, esi
shr eax, 1
cmp byte [ebp + eax - 0x1524], 0
je 0x1001e63d
xor eax, eax
mov edx, edi
nop dword [eax]
movzx ecx, word [edx]
lea edx, [edx + 2]
mov dword [ebp + eax*4 - 0x404], ecx
inc eax
cmp eax, 0x100
jl 0x1001e610
lea eax, [ebp - 0x404]
push eax
push ecx
mov ecx, dword [ebp - 0x152c]
call fcn.1001e190
mov ebx, 1
inc esi
add edi, 0x200
cmp esi, 8
jb 0x1001e5f0
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push eax
call esi
mov eax, dword [ebp - 0x1528]
inc eax
mov dword [ebp - 0x1528], eax
cmp eax, 0xa
jl 0x1001e550
mov esi, dword [ebp - 0x152c]
pop edi
mov ecx, dword [esi + 0x214]
mov eax, 0x4bda12f7
sub ecx, dword [esi + 0x210]
imul ecx
mov ecx, dword [ebp - 4]
sar edx, 7
xor ecx, ebp
mov eax, edx
shr eax, 0x1f
pop esi
add eax, edx
pop ebx
call fcn.100f99ca
mov esp, ebp
pop ebp
ret
Function at 0x10026010
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10344690
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1040706c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100f99e9
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.100f5461
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10058a70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
push 0
push 0x14
mov dword [ebx], 0
call fcn.10029f20
mov esi, eax
add esp, 8
test esi, esi
jne 0x10058aa0
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x1040fe4c], 0
mov edi, dword [ebp + 8]
je 0x10058aea
mov eax, dword [0x1040ff3c]
test eax, eax
je 0x10058ac3
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x10058aea
mov eax, dword [ebp - 4]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x1002ce70
push 0
push 0
mov dword [esi + 0xc], edi
call fcn.101e4a49
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x10058af7
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x10058b10
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [ebp - 4]
add esp, 4
mov dword [esi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100658f0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 8]
mov edi, edx
mov ebx, ecx
push edi
push str.sqlite_master
push edi
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push ebx
call fcn.1006a7d0
add esp, 0x18
cmp dword [ebp + 8], 0
jne 0x1006592b
push edi
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push ebx
call fcn.1006a7d0
add esp, 0x10
pop edi
pop ebx
pop ebp
ret

Function at 0x1006a8f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [ecx + 0x14], esi
jle 0x1006a98b
jmp 0x1006a914
mov eax, dword [ebp + 8]
mov edi, esi
xor edi, 1
cmp esi, 2
cmovge edi, esi
test eax, eax
je 0x1006a945
mov ecx, dword [ecx + 0x10]
mov edx, edi
add edx, edx
mov ebx, dword [ecx + edx*8]
sub ebx, dword [ebp + 8]
movzx edx, byte [eax]
movzx ecx, byte [ebx + eax]
cmp edx, ecx
jne 0x1006a96a
test edx, edx
jne 0x1006a97c
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x10]
add edi, edi
push 0
mov edx, ebx
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
call fcn.1002ecb0
add esp, 4
mov eax, dword [eax + 8]
test eax, eax
jne 0x1006a9ef
jmp 0x1006a982
movzx ecx, byte [ecx + 0x103d7358]
movzx edx, byte [edx + 0x103d7358]
sub edx, ecx
jne 0x1006a97f
inc eax
jmp 0x1006a930
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
inc esi
cmp esi, dword [ecx + 0x14]
jl 0x1006a911
mov edx, str.sqlite_master
sub edx, ebx
movzx ecx, byte [ebx]
movzx eax, byte [edx + ebx]
cmp ecx, eax
jne 0x1006a9b7
test ecx, ecx
jne 0x1006a9c9
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + 0x10]
test ebx, ebx
jne 0x1006a9cc
neg eax
sbb eax, eax
jmp 0x1006a9dc
movzx eax, byte [eax + 0x103d7358]
movzx ecx, byte [ecx + 0x103d7358]
sub ecx, eax
jne 0x1006a9ed
inc ebx
jmp 0x1006a992
test eax, eax
je 0x1006a9ed
mov edx, eax
mov ecx, ebx
call fcn.1002d7e0
mov ecx, dword [ebp - 4]
test eax, eax
jne 0x1006a9ed
mov ebx, str.sqlite_temp_master
mov dword [ebp - 8], ebx
jmp 0x1006a901
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006ad20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
mov dword [ebp - 8], edx
push ebx
push edi
xor ebx, ebx
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [eax + 0x14], ebx
jle 0x1006adb6
mov edx, dword [ebp + 8]
push esi
nop dword [eax]
mov eax, dword [eax + 0x10]
mov esi, edi
xor esi, 1
cmp edi, 2
cmovge esi, edi
shl esi, 4
add esi, eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 4], eax
test edx, edx
je 0x1006ad75
mov esi, dword [esi]
mov eax, edx
sub esi, edx
movzx edx, byte [eax]
movzx ecx, byte [esi + eax]
cmp edx, ecx
jne 0x1006ada1
test edx, edx
jne 0x1006adb3
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea ecx, [eax + 0x18]
push 0
call fcn.1002ecb0
add esp, 4
mov ebx, dword [eax + 8]
test ebx, ebx
jne 0x1006ad98
mov eax, dword [ebp - 0xc]
inc edi
mov edx, dword [ebp + 8]
cmp edi, dword [eax + 0x14]
jl 0x1006ad40
pop esi
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, byte [ecx + 0x103d7358]
movzx edx, byte [edx + 0x103d7358]
sub edx, ecx
jne 0x1006ad8c
inc eax
jmp 0x1006ad63
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100a9a40
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
call fcn.10029980
test eax, eax
je 0x100a9a61
mov dword [ebp - 0xc], 0
jmp 0x100a9a7f
push 5
call dword [0x1040fe90]
mov ecx, eax
add esp, 4
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x100a9a7f
push ecx
call dword [0x1040fe98]
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x100a9b30
mov edi, dword [0x1041cca8]
mov ebx, dword [0x1041cca4]
mov esi, dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test edi, edi
jne 0x100a9afc
test ebx, ebx
jne 0x100a9acc
push 0x20
push 0x1041cbf4
call esi
test al, al
je 0x100a9b48
push 0xc
push 0x1041cd00
call esi
test al, al
je 0x100a9b48
mov ebx, dword [0x1041cca4]
mov eax, ebx
mov edx, 0x40
push eax
push 0x1041cd00
push 0x1041cbf4
lea ebx, [eax + 1]
mov ecx, 0x1041cd90
mov dword [0x1041cca4], ebx
call fcn.100a6240
mov eax, dword [ebp - 4]
add esp, 0xc
mov edi, 0x40
cmp edi, eax
mov esi, eax
mov eax, 0x1041cdd0
cmovb esi, edi
sub eax, edi
push esi
push eax
push dword [ebp - 8]
call fcn.101d3050
mov eax, dword [ebp - 4]
sub edi, esi
add dword [ebp - 8], esi
add esp, 0xc
sub eax, esi
mov dword [0x1041cca8], edi
mov dword [ebp - 4], eax
jne 0x100a9a96
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x100a9b41
push eax
call dword [0x1040fea0]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.101e6b16
int3
Function at 0x100b3000
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10345ae1
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x1040706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], 0
mov ecx, edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], 0
push 9
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
push str.WinAssist
mov word [edi], ax
call fcn.10002560
push 1
mov dword [ebp - 4], 0
mov ecx, edi
push 0x103d2860
mov dword [ebp - 0x3c], 1
call fcn.100022e0
push 5
push str.image
mov ecx, edi
call fcn.100022e0
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x100b3093
mov eax, dword [edi]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.100b3170
mov ecx, eax
call fcn.1019e48c
mov esi, eax
cmp edi, esi
je 0x100b30d4
mov ecx, edi
call fcn.100028d0
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x28]
call fcn.100028d0
push edi
call fcn.1019b695
add esp, 4
test eax, eax
jne 0x100b30f7
push 1
push 0x103d2860
mov ecx, edi
call fcn.100022e0
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x100b3101
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100b314c
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x100b3120
mov eax, dword [edi]
lea ecx, [ebp - 0x38]
push ecx
push eax
call fcn.10196d15
add esp, 8
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100b314c
mov esi, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f99ca
mov esp, ebp
pop ebp
ret 4
Function at 0x100b4cf0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x2001f
push 0
push str.Control_PanelDesktop
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jle 0x100b4d24
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x100b4e00
mov eax, dword [ebp + 0xc]
push esi
push edi
cmp eax, 4
ja case.0x100b4d34.4
jmp dword [eax*4 + 0x100b4e08]
mov esi, str.0126
mov edi, 0x103e1098
jmp 0x100b4d66
mov esi, str.0126
jmp 0x100b4d61
mov esi, 0x103e109c
jmp 0x100b4d61
mov esi, 0x103e10a0
jmp 0x100b4d61
mov esi, 0x103e10a4
mov edi, str.0126
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push 1
push 0
push str.WallpaperStyle
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jle 0x100b4d94
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100b4dc2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push 1
push 0
push str.TileWallpaper
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jle 0x100b4dc2
movzx esi, si
or esi, 0x80070000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
js 0x100b4dfc
push 3
push dword [ebp + 8]
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
jne 0x100b4dfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100b4dfe
movzx eax, ax
pop edi
or eax, 0x80070000
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100b4d3b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x2001f
push 0
push str.Control_PanelDesktop
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jle 0x100b4d24
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x100b4e00
mov eax, dword [ebp + 0xc]
push esi
push edi
cmp eax, 4
ja case.0x100b4d34.4
jmp dword [eax*4 + 0x100b4e08]
mov esi, str.0126
mov edi, 0x103e1098
jmp 0x100b4d66
mov esi, str.0126
jmp 0x100b4d61
mov esi, 0x103e109c
jmp 0x100b4d61
mov esi, 0x103e10a0
jmp 0x100b4d61
mov esi, 0x103e10a4
mov edi, str.0126
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push 1
push 0
push str.WallpaperStyle
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jle 0x100b4d94
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100b4dc2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push 1
push 0
push str.TileWallpaper
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jle 0x100b4dc2
movzx esi, si
or esi, 0x80070000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
js 0x100b4dfc
push 3
push dword [ebp + 8]
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
jne 0x100b4dfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100b4dfe
movzx eax, ax
pop edi
or eax, 0x80070000
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100b4d47
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x2001f
push 0
push str.Control_PanelDesktop
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jle 0x100b4d24
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x100b4e00
mov eax, dword [ebp + 0xc]
push esi
push edi
cmp eax, 4
ja case.0x100b4d34.4
jmp dword [eax*4 + 0x100b4e08]
mov esi, str.0126
mov edi, 0x103e1098
jmp 0x100b4d66
mov esi, str.0126
jmp 0x100b4d61
mov esi, 0x103e109c
jmp 0x100b4d61
mov esi, 0x103e10a0
jmp 0x100b4d61
mov esi, 0x103e10a4
mov edi, str.0126
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push 1
push 0
push str.WallpaperStyle
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jle 0x100b4d94
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100b4dc2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push 1
push 0
push str.TileWallpaper
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jle 0x100b4dc2
movzx esi, si
or esi, 0x80070000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
js 0x100b4dfc
push 3
push dword [ebp + 8]
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
jne 0x100b4dfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100b4dfe
movzx eax, ax
pop edi
or eax, 0x80070000
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100b4d4e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x2001f
push 0
push str.Control_PanelDesktop
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jle 0x100b4d24
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x100b4e00
mov eax, dword [ebp + 0xc]
push esi
push edi
cmp eax, 4
ja case.0x100b4d34.4
jmp dword [eax*4 + 0x100b4e08]
mov esi, str.0126
mov edi, 0x103e1098
jmp 0x100b4d66
mov esi, str.0126
jmp 0x100b4d61
mov esi, 0x103e109c
jmp 0x100b4d61
mov esi, 0x103e10a0
jmp 0x100b4d61
mov esi, 0x103e10a4
mov edi, str.0126
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push 1
push 0
push str.WallpaperStyle
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jle 0x100b4d94
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100b4dc2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push 1
push 0
push str.TileWallpaper
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jle 0x100b4dc2
movzx esi, si
or esi, 0x80070000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
js 0x100b4dfc
push 3
push dword [ebp + 8]
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
jne 0x100b4dfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100b4dfe
movzx eax, ax
pop edi
or eax, 0x80070000
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8