joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037280
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x10], 4
cmp dword [0x1005dc18], eax
mov esi, 0xffffff
push edi
cmovne esi, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
mov ebx, ecx
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
push eax
push 0
push 0x10
push str.VoiceActivationOn
push str.SOFTWAREMicrosoftSpeech_OneCorePreferences
push SHChangeNotifyRegister
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
lea eax, [ebp - 8]
push eax
push eax
push ebx
call dword [sym.imp.COMCTL32.dll_ImageList_GetIconSize]
cmp dword [ebp - 0x14], 0
mov ecx, 0xf12e
push 0
mov eax, 0xe1d6
cmovne eax, ecx
mov ecx, dword [ebp - 8]
push esi
movzx eax, ax
mov edx, ecx
push eax
push str.Segoe_MDL2_Assets
call fcn.100166a0
mov esi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x1c], edi
push 0
call esi
push 0
mov dword [ebp - 0xc], eax
call esi
mov ecx, dword [ebp - 8]
mov esi, eax
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x10], esi
lea eax, [ebp - 0x48]
movq qword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x44], xmm0
push eax
push 0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x48], 0x28
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x200001
call dword [sym.imp.GDI32.dll_CreateDIBSection]
push edi
push dword [ebp - 0xc]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, eax
call edi
push ebx
push esi
call edi
mov ecx, dword [ebp - 8]
mov esi, eax
mov dword [ebp - 4], 0x1dc0000
push dword [ebp - 4]
push ecx
push ecx
push 0
push 0
push dword [ebp - 0xc]
push ecx
push ecx
push 0
push 0
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_GdiAlphaBlend]
push esi
push dword [ebp - 0x10]
call edi
push 0
push ebx
push 0
push dword [ebp - 0x18]
call dword [sym.imp.COMCTL32.dll_ImageList_Replace]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push ebx
call esi
push dword [ebp - 0xc]
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push dword [ebp - 0x10]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003eb30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
push edi
mov edi, ecx
setg al
mov byte [edi + 0x4c], al
cmp dword [0x1005d044], 0
jne 0x1003eba7
mov esi, dword [edi + 8]
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfff7ffff
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [edi + 8]
test ebx, ebx
jle 0x1003eb95
push 0x43
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.1003ee40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x44], 0
jne 0x1003ecd7
cmp byte [0x1005e208], 0
jne 0x1003ebf1
push 0x29c
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
test eax, eax
je 0x1003ebe1
mov ecx, eax
call fcn.10032660
mov dword [0x1005e0e8], eax
mov byte [0x1005e208], 1
jmp 0x1003ebf6
xor eax, eax
mov byte [0x1005e208], 1
mov dword [0x1005e0e8], eax
jmp 0x1003ebf6
mov eax, dword [0x1005e0e8]
cmp dword [eax + 0x21c], 0
je 0x1003ec31
cmp dword [eax + 0x228], 0
je 0x1003ec31
mov esi, dword [edi + 0x70]
mov dword [edi + 0x44], ebx
mov eax, dword [esi + 8]
test eax, eax
je 0x1003ec23
push eax
call dword [sym.imp.WINMM.dll_timeKillEvent]
mov dword [esi + 8], 0
push 1
push esi
push 0x1003d880
push 0
push 0xf
jmp 0x1003ec63
push 4
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, dword [edi + 0x70]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x1003ec57
push eax
call dword [sym.imp.WINMM.dll_timeKillEvent]
mov dword [esi + 8], 0
push 1
push esi
push 0x1003d880
push 0
push 0x1e
call dword [sym.imp.WINMM.dll_timeSetEvent]
mov dword [esi + 8], eax
mov esi, dword [edi + 8]
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
test ebx, ebx
jle 0x1003ecc7
push 2
push 0
push 0
push dword [edi + 8]
mov dword [edi + 0x48], 0
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 0x43
push 0
push 0
push 0
push 0
push dword [edi + 0x2c]
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.1003ee40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [edi + 0x48], 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [edi + 0x44], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003ecf0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
mov dword [ebp - 0xc], esi
mov eax, dword [esi + 0x44]
add dword [esi + 0x48], eax
test eax, eax
jle 0x1003ed21
push 0xa
push 7
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, 3
cmp eax, ecx
cmovg ecx, eax
mov dword [ebp - 4], ecx
jmp 0x1003ed31
push 7
push 0xa
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, eax
mov dword [ebp - 4], eax
mov dword [esi + 0x44], ecx
xor ecx, ecx
mov edx, dword [esi + 0x48]
test edx, edx
cmovns ecx, edx
cmp ecx, 0xff
jle 0x1003ed4b
or cl, 0xff
jmp 0x1003ed55
xor ecx, ecx
movzx eax, dl
test edx, edx
cmovns ecx, eax
mov eax, dword [esi + 0x50]
mov edi, 0xff
mov byte [ebp - 8], cl
push ebx
movzx ebx, cl
mov ecx, dword [esi + 0x58]
sub edi, ebx
mov esi, dword [esi + 0x5c]
imul eax, ebx
imul ecx, edi
imul esi, edi
mov edi, dword [ebp - 0xc]
add ecx, eax
mov eax, 0x80808081
imul ecx
add edx, ecx
mov ecx, dword [edi + 0x54]
sar edx, 7
imul ecx, ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x10], eax
mov eax, 0x80808081
pop ebx
add esi, ecx
imul esi
add edx, esi
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp dword [ebp - 4], 0
jle 0x1003edb7
or eax, 0xffffffff
jmp 0x1003edba
mov eax, dword [edi + 0x2c]
push 0x11
push 0
push 0
push ecx
push dword [ebp - 0x10]
push eax
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 2
push dword [ebp - 8]
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov eax, dword [edi + 0x48]
test eax, eax
jle 0x1003edec
cmp eax, 0xff
jl 0x1003ee37
mov esi, dword [edi + 0x70]
mov eax, dword [esi + 8]
test eax, eax
je 0x1003ee04
push eax
call dword [sym.imp.WINMM.dll_timeKillEvent]
mov dword [esi + 8], 0
cmp dword [edi + 0x44], 0
jge 0x1003ee30
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [edi + 8]
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfff7ffff
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [edi + 0x44], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003f610
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1005e3fc], 0
mov dword [ebp - 4], 8
jne 0x1003f64e
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x10
push str.JumpListBorder
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
cmp byte [0x1005e208], 0
jne 0x1003f68e
push 0x29c
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
test eax, eax
je 0x1003f67e
mov ecx, eax
call fcn.10032660
mov dword [0x1005e0e8], eax
mov byte [0x1005e208], 1
jmp 0x1003f693
xor eax, eax
mov byte [0x1005e208], 1
mov dword [0x1005e0e8], eax
jmp 0x1003f693
mov eax, dword [0x1005e0e8]
cmp dword [eax + 0x21c], 0
je 0x1003f6ae
mov ecx, dword [eax + 0x228]
xor eax, eax
test ecx, ecx
cmovne eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
xor ecx, ecx
xor eax, eax
test ecx, ecx
cmovne eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10040020
Capabilities:
Hide graphical window
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push str.TaskbarStartButton
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x100401a3
push 0x68
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
mov edi, eax
add esp, 4
test edi, edi
je 0x100401a3
push 0
push 0x10058424
lea ecx, [edi + 8]
mov dword [edi], 0x10058888
push 0
mov dword [edi + 4], 0x1005887c
lea esi, [edi + 0x54]
mov dword [ecx], 0x10058874
push ebx
mov dword [esi + 4], ecx
call dword [sym.imp.USER32.dll_FindWindowExW]
push 0
push eax
mov dword [esi], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
push 0x10048350
push dword [esi]
call dword [sym.imp.COMCTL32.dll_SetWindowSubclass]
lea eax, [edi + 0x1c]
mov dword [edi + 0xc], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x18], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x40], 0
mov dword [eax], 0
cmp ebx, dword [0x1005dc0c]
jne 0x10040112
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 4
push ecx
push eax
push 0
push 0x10
push str.HideOrb
jmp 0x10040129
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 4
push ecx
push eax
push 0
push 0x10
push str.HideSecondaryOrb
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
mov ebx, dword [sym.imp.ole32.dll_CoCreateInstance]
lea esi, [edi + 0x50]
push esi
push 0x100590a0
push 3
push 0
push 0x1004f9fc
call ebx
test eax, eax
jns 0x1004017d
push esi
push 0x10059090
push 3
push 0
push 0x1004f9fc
call ebx
test eax, eax
jns 0x1004017d
push esi
push 0x10059080
push 3
push 0
push 0x1004f9fc
call ebx
mov ecx, dword [edi + 0x10]
mov edx, 0x10048900
push edi
call fcn.10024560
add esp, 4
mov ecx, edi
call fcn.1004acd0
mov ecx, edi
call fcn.1004a680
mov ecx, edi
call fcn.1004a830
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100415f0
Capabilities:
Create thread
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.10041220
mov bl, al
test bl, bl
je 0x10041610
mov bh, 1
jmp 0x10041666
push str.TaskbarMonitor
push edi
call dword [sym.imp.USER32.dll_GetPropW]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x28
xorps xmm0, xmm0
mov dword [esp + 0x34], 0
push ecx
push eax
movups xmmword [esp + 0x1c], xmm0
movups xmmword [esp + 0x2c], xmm0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x10]
push eax
push 0x10041550
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
sete bh
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
mov edx, 0x10040340
mov ecx, edi
call fcn.100244e0
add esp, 4
test eax, eax
jne 0x100416a4
push 0x74
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov edx, 0x10040340
push esi
mov ecx, edi
call fcn.10024560
add esp, 4
jmp 0x100416a8
mov esi, dword [esp + 0xc]
mov eax, dword [0x1005dc54]
cmp eax, 1
jne 0x10041713
cmp byte [esi + 4], bl
jne 0x100416c0
cmp byte [esi + 5], bh
je 0x10041745
mov eax, dword [esi + 8]
test eax, eax
je 0x100416f1
push 0
push eax
push dword [sym.imp.KERNEL32.dll_ExitThread]
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
push 0
push 0
push esi
push 0x10040ca0
push 0
push 0
mov byte [esi + 4], bl
mov byte [esi + 5], bh
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
mov eax, dword [0x1005dc54]
cmp eax, 3
jne 0x10041745
mov byte [esi + 4], bl
mov ecx, edi
mov byte [esi + 5], bh
test bl, bl
je 0x10041737
push 0
xor edx, edx
call fcn.10041160
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x70]
lea edx, [esi + 0x40]
call fcn.10041160
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10041f80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 0x10
push str.Start_AskCortana
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
mov ebx, edx
mov dword [ebp - 4], 4
mov edi, ecx
call esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10
push str.Start_AskCortana
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
cmp dword [ebp - 8], 0
je 0x10042065
mov eax, dword [0x1005d02c]
mov ecx, 0xffffff
sub eax, 1
je 0x10042006
sub eax, 1
jne 0x10042024
mov ecx, 0x4c4c4c
jmp 0x10042024
push 0
lea eax, [ebp - 0x14]
push eax
call dword [0x1005dc7c]
push 0
push 0
push 4
lea eax, [ebp - 0x14]
push eax
call dword [0x1005dc78]
mov ecx, eax
push 0
push ecx
push 0xe721
call fcn.1004cae0
push eax
mov edx, ebx
mov ecx, ebx
call fcn.100166a0
mov ecx, dword [edi]
add esp, 0x10
mov esi, eax
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
push esi
push edi
call dword [ecx + 0x1c]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x218
push eax
push 0
push 0x16
call dword [sym.imp.SHELL32.dll_SHGetStockIconInfo]
push ebx
push 0
lea eax, [ebp - 0x22c]
push eax
push 0
push dword [ebp - 0x224]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHELL32.dll_SHDefExtractIconW]
mov eax, dword [edi]
lea ecx, [ebp - 0x228]
push ecx
push dword [ebp - 0x22c]
push 0xffffffffffffffff
push edi
call dword [eax + 0x10]
push dword [ebp - 0x22c]
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [ebp - 0x228]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100434e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10014
call fcn.10001ba0
push ebx
mov ebx, ecx
mov byte [ebp - 1], dl
test dl, dl
mov ecx, str._uninstall
push esi
mov eax, str._uninstall_all
cmove eax, ecx
push eax
lea eax, [ebp - 0x10014]
push 0x8000
push eax
call dword [sym.imp.msvcrt.dll_wcscpy_s]
mov eax, dword [ebx]
lea ecx, [ebp - 0x14]
add esp, 0xc
push ecx
push ebx
call dword [eax + 0x1c]
xor esi, esi
cmp dword [ebp - 0x14], esi
jbe 0x100435ed
push edi
mov edi, dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebx]
lea ecx, [ebp - 0xc]
push ecx
push esi
push ebx
mov dword [ebp - 0xc], 0
call dword [eax + 0x20]
test eax, eax
mov eax, dword [ebp - 0xc]
js 0x100435d8
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
mov ecx, dword [eax]
push edx
push 0x10052fe8
push eax
call dword [ecx]
test eax, eax
mov eax, dword [ebp - 0x10]
js 0x100435cb
lea edx, [ebp - 8]
mov dword [ebp - 8], 0
mov ecx, dword [eax]
push edx
push 0x1004f904
push eax
call dword [ecx + 0x44]
test eax, eax
js 0x100435b7
push dword [ebp - 8]
lea eax, [ebp - 0x10014]
push 0x8000
push eax
call dword [sym.imp.msvcrt.dll_wcscat_s]
push 0x10052c1c
lea eax, [ebp - 0x10014]
push 0x8000
push eax
call dword [sym.imp.msvcrt.dll_wcscat_s]
add esp, 0x18
mov eax, dword [ebp - 8]
test eax, eax
je 0x100435c8
push eax
call edi
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100435d5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x100435e2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
inc esi
cmp esi, dword [ebp - 0x14]
jb 0x10043535
pop edi
push 0xa
push 0
xor ecx, ecx
lea eax, [ebp - 0x10014]
cmp byte [ebp - 1], cl
push eax
push str.startscreen.exe
mov eax, 0x10053600
cmove eax, ecx
push eax
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10044a80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push esi
push edi
push str.twinui.pcshell.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x10044770
push 0x10057f1c
mov edx, 0x1004fd78
mov dword [ebp - 4], eax
mov ecx, eax
call fcn.1001c5e0
mov edi, dword [sym.imp.USER32.dll_TrackPopupMenu]
mov edx, 0x1004fd78
mov ecx, dword [0x1005dc00]
mov esi, eax
push 0x10044770
push edi
call fcn.1001c730
or eax, esi
jne 0x10044ae3
push str.patchedTrackPopupMenu
push str.SIB_ASSERTION_FAILED:__s
call fcn.10001be0
add esp, 8
mov ecx, dword [0x1005dc10]
mov edx, 0x1004fd78
push 0x10044660
push dword [sym.imp.USER32.dll_TrackPopupMenuEx]
call fcn.1001c730
test eax, eax
jne 0x10044b14
push str.ChangeImportedAddress_g_hExplorer__user32.dll__TrackPopupMenuEx_Explorer_TrackPopupMenuEx_
push str.SIB_ASSERTION_FAILED:__s
call fcn.10001be0
add esp, 8
push 0x10044770
push edi
push str.explorerframe.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 0x1004fd78
mov ecx, eax
call fcn.1001c730
test eax, eax
jne 0x10044b47
push str.ChangeImportedAddress_GetModuleHandle_L_explorerframe.dll____user32.dll__TrackPopupMenu_TwinUI_TrackPopupMenu_
push str.SIB_ASSERTION_FAILED:__s
call fcn.10001be0
add esp, 8
mov ecx, dword [ebp - 4]
mov edx, str.api_ms_win_rtcore_ntuser_window_l1_1_0.dll
push 0x10044a60
push 0x10058018
call fcn.1001c5e0
mov ecx, dword [0x1005dc00]
mov edx, str.api_ms_win_rtcore_ntuser_window_l1_1_0.dll
push 0x10044a60
push 0x10058018
mov edi, eax
call fcn.1001c5e0
mov esi, dword [sym.imp.USER32.dll_SetCursorPos]
mov edx, str.api_ms_win_rtcore_ntuser_window_l1_1_0.dll
mov ecx, dword [0x1005dc00]
or edi, eax
push 0x10044a60
push esi
call fcn.1001c730
mov ecx, dword [0x1005dc00]
mov edx, 0x1004fd78
push 0x10044a60
push esi
or edi, eax
call fcn.1001c730
push 0x10044a60
push 0x10058018
push str.twinui.pcshell.dll
or edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, str.api_ms_win_rtcore_ntuser_window_l1_1_0.dll
mov ecx, eax
call fcn.1001c5e0
or eax, edi
jne 0x10044be9
push str.patchedSetCursorPos
push str.SIB_ASSERTION_FAILED:__s
call fcn.10001be0
add esp, 8
push pe_nt_image_headers32
lea eax, [ebp - 0x118]
mov dword [ebp - 0x11c], 0x114
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x110], 0x4e20
jae 0x10044c84
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x10057b18
push 3
push 0
push 0x1004eff8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x10044c6a
mov eax, dword [ebp - 4]
mov esi, dword [eax]
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi + 0xc]
mov dword [0x1005e1c8], eax
mov dword [esi + 0xc], 0x10041f30
jmp 0x10044c77
push str.PrelaunchHook_not_applicable
call fcn.10001be0
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x10044c84
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10044ff0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
cmp dword [0x1005dc00], 0
push ebx
mov bl, cl
jne 0x100451e4
cmp dword [0x1005e1e8], 0
jne 0x100451e4
push str.twinui.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1005dc00], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0x10
push 0x10058088
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
mov dword [ebp - 8], 4
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
push pe_nt_image_headers32
lea eax, [ebp - 0x118]
mov dword [ebp - 0x11c], 0x114
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 4]
test eax, eax
je 0x100450a0
cmp dword [ebp - 0x110], eax
je 0x100450a0
mov edx, str._purge
mov ecx, str.StartScreen.exe
call fcn.100191c0
push esi
push edi
call fcn.1001c320
call fcn.10047ee0
call fcn.10044a80
push 0x10053160
push dword [0x1005dbf8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1005e120
push 0x1004ea40
push 0x1004f9dc
call eax
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10045113
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10
push dword [0x1005e120]
call edi
mov ecx, dword [0x1005e120]
mov eax, dword [ecx + 0xc]
mov dword [0x1005e11c], eax
lea eax, [ebp - 4]
push eax
mov dword [ecx + 0xc], 0x1003fdd0
push dword [ebp - 4]
push 0x10
push dword [0x1005e120]
call edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x1004f5f8
push 3
push 0
push 0x1004f880
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x10045165
mov eax, dword [ebp - 4]
mov esi, dword [eax]
lea eax, [ebp - 8]
push eax
push 0x40
push 0x34
push esi
call edi
test eax, eax
je 0x10045165
mov eax, dword [esi + 0x28]
mov dword [0x1005e138], eax
lea eax, [ebp - 8]
push eax
mov dword [esi + 0x28], 0x10004f00
push dword [ebp - 8]
push 0x34
push esi
call edi
mov eax, dword [ebp - 4]
test eax, eax
je 0x10045172
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x1001b2d0
push 0xbb8
push dword [0x1005e348]
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x1005e348], eax
test bl, bl
je 0x100451e2
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0
push 0x574
push dword [0x1005dc0c]
call esi
push 0
push 0
push 0x31a
push dword [0x1005dc0c]
call esi
cmp dword [0x1005e0a8], 0
je 0x100451e2
cmp dword [0x1005e0a0], 0
jne 0x100451e2
push str.TaskbarIcons
push 0
push 0x1a
push dword [0x1005dc0c]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100459b0
Capabilities:
Find taskbar

Disassembly:
cmp dword [0x1005e1e8], 0
jne 0x10045a10
push ebx
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, eax
push 0
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x10045a0f
push edi
push eax
push dword [0x1005dc3c]
push 0x10045970
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
push 0
push 0
push 0
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
pop edi
pop ebx
ret 0x10