joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001b760
Capabilities:
Find taskbar
Log keystrokes via polling
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push esi
push edi
push 0x1b
call ebx
test ax, ax
js 0x1001b914
push 0
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, esi
jne 0x1001b908
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push dword [ebp - 0x10]
lea eax, [ebp - 0x1a4]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerSessionInfo_dStartIsBack
push 0xc8
push eax
call fcn.1000edb0
add esp, 0x10
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push 0
push 0x2001f
push 1
push 0
push 0
lea eax, [ebp - 0x1a4]
push eax
push SHChangeNotifyRegister
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 4], 0
je 0x1001b908
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push str.StartTick
push dword [ebp - 4]
mov dword [ebp - 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push str.StartTick
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x1001b8ff
mov eax, dword [ebp - 0xc]
sub eax, ecx
cmp eax, 0x7530
jae 0x1001b8ff
push eax
push str.StartIsBack_was_started__d_ms_ago
call fcn.10001be0
add esp, 8
xor edi, edi
nop dword [eax]
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xcccccc
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x33
push str.Hold_Escape_key_to_prevent_StartIsBack_from_loading
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, eax
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, eax
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
call dword [sym.imp.GDI32.dll_TextOutW]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1b
call ebx
test ax, ax
js 0x1001b914
inc edi
cmp edi, 0xf
jl 0x1001b880
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c210
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
mov ebx, dword [0x1005d034]
lea eax, [ebp - 4]
push edi
mov edi, dword [0x1005dc18]
push eax
push 0x1005d034
push 0
push 0x10
push str.AppsUseLightTheme
push str.SOFTWAREMicrosoftWindowsCurrentVersionThemesPersonalize
push SHChangeNotifyRegister
mov dword [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
push pe_nt_image_headers32
lea eax, [ebp - 0x120]
mov dword [ebp - 0x124], 0x114
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x118], 0x4777
jb 0x1001c2b2
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
push 0x1005dc18
push 0
push 0x10
push str.SystemUsesLightTheme
push str.SOFTWAREMicrosoftWindowsCurrentVersionThemesPersonalize
push SHChangeNotifyRegister
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0xc
push eax
push 0
xorps xmm0, xmm0
push 0x42
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test byte [ebp - 0xc], 1
je 0x1001c2f1
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
xor ecx, ecx
cmp eax, 0xffffff
sete cl
mov dword [0x1005dc18], ecx
jmp 0x1001c2f7
mov ecx, dword [0x1005dc18]
cmp dword [0x1005d034], ebx
jne 0x1001c30b
cmp ecx, edi
jne 0x1001c30b
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c730
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
je 0x1001c79e
test edx, edx
je 0x1001c79e
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1001c79e
cmp dword [ebp + 0xc], 0
je 0x1001c79e
mov eax, dword [edi + 0x3c]
mov esi, dword [eax + edi + 0x80]
mov eax, dword [esi + edi + 0xc]
add esi, edi
test eax, eax
je 0x1001c77f
mov ebx, edx
add eax, edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1001c77c
mov eax, dword [esi + 0x20]
add esi, 0x14
test eax, eax
jne 0x1001c764
mov ebx, dword [ebp + 8]
cmp dword [esi + 0xc], 0
je 0x1001c79e
mov esi, dword [esi + 0x10]
add esi, edi
mov eax, dword [esi]
test eax, eax
je 0x1001c79e
cmp eax, ebx
je 0x1001c7a9
mov eax, dword [esi + 4]
add esi, 4
test eax, eax
jne 0x1001c790
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call edi
test eax, eax
je 0x1001c79e
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push esi
call edi
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1001c7e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
je 0x1001c882
cmp dword [ebp + 8], 0
je 0x1001c882
cmp dword [ebp + 0xc], 0
je 0x1001c882
mov eax, dword [edi + 0x3c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov esi, dword [eax + edi + 0x80]
mov eax, dword [esi + edi + 0xc]
add esi, edi
test eax, eax
je 0x1001c838
nop dword [eax]
add eax, edi
push 0x1004fd78
push eax
call ebx
test eax, eax
je 0x1001c838
mov eax, dword [esi + 0x20]
add esi, 0x14
test eax, eax
jne 0x1001c820
cmp dword [esi + 0xc], 0
je 0x1001c882
mov eax, dword [esi + 0x10]
mov edx, dword [esi]
add eax, edi
add edx, edi
mov dword [ebp - 4], eax
xor esi, esi
mov dword [ebp - 0xc], edx
cmp dword [eax], esi
je 0x1001c882
mov ecx, dword [ebp - 4]
xor eax, eax
mov eax, dword [eax + edx]
test eax, eax
js 0x1001c874
push dword [ebp + 8]
add eax, 2
add eax, edi
push eax
call ebx
test eax, eax
je 0x1001c88d
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
inc esi
lea eax, [esi*4]
cmp dword [eax + ecx], 0
jne 0x1001c858
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esi, [eax + esi*4]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
test eax, eax
je 0x1001c882
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push esi
call edi
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001c8d0
Capabilities:
Check if file exists
Create directory
Delete directory
Get common file path
Get file attributes
Query or enumerate registry value
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 4
push eax
push 0
push 0x10
push str.SettingsVersion
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
mov esi, ecx
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
cmp dword [ebp - 8], 5
jne 0x1001c919
test esi, esi
je 0x1001ca83
cmp dword [0x1005e0b8], 0
mov eax, str._unpin
mov edx, str._pin
mov ecx, str.StartScreen.exe
push ebx
cmove edx, eax
call fcn.100191c0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x100545e0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
push dword [ebp - 4]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x210]
push eax
call esi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push str.StartApps.AD1405D2_30CF_4877_8468_1EE1C52C759F
push eax
call ebx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push dword [ebp - 4]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x210]
push eax
call esi
push str.Search_
lea eax, [ebp - 0x210]
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x210]
push 0
push eax
call esi
push str.StartApps.AD1405D2_30CF_4877_8468_1EE1C52C759F
lea eax, [ebp - 0x210]
push eax
call ebx
cmp dword [0x1005d06c], 0
jne 0x1001c9f9
cmp dword [0x1005d030], 0
jne 0x1001c9f9
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1001ca04
push 0
lea eax, [ebp - 0x210]
push eax
call esi
push 0
push 2
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1001ca50
push str.Accessories
lea eax, [ebp - 0x210]
push eax
call ebx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001ca50
test al, 1
jne 0x1001ca50
or eax, 1
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 5
push eax
push 4
push str.SettingsVersion
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, dword [ebp - 4]
pop ebx
test eax, eax
je 0x1001ca83
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001cb50
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x1004f5e8
mov ebx, ecx
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov eax, dword [ebp - 4]
test eax, eax
je 0x1001cbcb
push eax
push 0x104
push ebx
call dword [sym.imp.msvcrt.dll_wcscpy_s]
add esp, 0xc
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x100545b4
push 0x104
push ebx
call dword [sym.imp.msvcrt.dll_wcscat_s]
add esp, 0xc
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.Cache
push 0x104
push ebx
call dword [sym.imp.msvcrt.dll_wcscat_s]
add esp, 0xc
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1001cbd7
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [ebp - 4]
pop ebx
test eax, eax
je 0x1001cbe6
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esp, ebp
pop ebp
ret

Function at 0x1001cef0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push 0
push 0x10
push str.NoClose
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x10
push str.NoClose
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
push 2
call dword [sym.imp.SHELL32.dll_SHRestricted]
mov ecx, dword [ebp - 4]
test eax, eax
mov edx, 1
cmovne ecx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001cf70
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
push esi
mov dword [ebp - 4], 0
xor esi, esi
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0x1004ef68]
call eax
add esp, 4
test eax, eax
jns 0x1001cf9e
add esi, 4
cmp esi, 0xc
jb 0x1001cf83
cmp dword [ebp - 4], 0
je 0x1001d0c1
mov dword [ebp - 0x14], 1
call fcn.1001cef0
test eax, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
je 0x1001cfc8
push 0x400787
push eax
call dword [ecx + 8]
jmp 0x1001cfde
push 0x4007d7
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
push str.SoftwareStartIsBackShutdownChoices
push SHChangeNotifyRegister
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SoftwareStartIsBackShutdownChoices
push SHChangeNotifyRegister
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push 0
push 0
push dword [ebp - 8]
call esi
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x10]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
test eax, eax
jne 0x1001d0b1
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
push 0
push edx
push 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x1001d0a8
push edi
nop
mov edx, dword [ebp - 0xc]
test edx, 0x4c0000
jne 0x1001d092
mov eax, dword [ebp - 4]
lea edi, [ebp - 0xdc]
push 0x64
push edi
push 0
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x18]
push 4
lea eax, [ebp - 0xc]
push eax
push 4
mov eax, edi
push eax
push 0
push dword [ebp - 8]
call esi
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
push 0
push edx
push 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x1001d060
pop edi
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
call dword [eax]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100204a0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
push esi
push edi
mov edi, ecx
push str.Start_MinMFU
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
lea esi, [edi + 0xb8]
mov dword [esi], ebx
mov edx, dword [edi + 0xbc]
cmp ebx, edx
push SHChangeNotifyRegister
cmovle eax, edx
mov dword [edi + 0xc0], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
push 4
push esi
push 4
push str.Start_MinMFU
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, dword [edi + 0xbc]
mov dword [ebp + 8], eax
test eax, eax
je 0x10020510
test ebx, ebx
je 0x10020510
mov esi, 0x10000
jmp 0x10020512
xor esi, esi
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x30]
push eax
push str.IdealHeight._d
lea eax, [ebp - 0x2c]
push 0x14
push eax
call fcn.1000edb0
mov eax, dword [ebp + 8]
add esp, 0x10
add eax, ebx
movzx eax, ax
or eax, esi
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x2c]
push eax
push str.SoftwareStartIsBackCache
push SHChangeNotifyRegister
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov ecx, edi
call fcn.1002df40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10023df0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
push esi
mov esi, ecx
push edi
lea eax, [esi + 0xc]
push eax
mov dword [esi], 0x10054f3c
push 0
push 0
push 0x10054f1c
mov dword [esi + 4], 0x10054f2c
mov dword [eax], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 8], 1
call ebx
mov eax, dword [esi + 0x10]
mov edi, dword [sym.imp.ole32.dll_CoTaskMemFree]
test eax, eax
je 0x10023e66
push eax
call edi
lea eax, [esi + 0x10]
mov dword [eax], 0
jmp 0x10023e69
lea eax, [esi + 0x10]
push eax
push 0
push 0
push 0x10054f0c
call ebx
mov ecx, dword [esi + 0x14]
lea eax, [esi + 0x14]
test ecx, ecx
je 0x10023e8b
push ecx
call edi
lea eax, [esi + 0x14]
mov dword [eax], 0
push eax
push 0
push 0
push 0x10054efc
call ebx
mov ecx, dword [esi + 0x18]
lea eax, [esi + 0x18]
test ecx, ecx
je 0x10023ead
push ecx
call edi
lea eax, [esi + 0x18]
mov dword [eax], 0
push eax
push 0
push 0
push 0x10054eec
call ebx
mov ecx, dword [esi + 0x1c]
lea eax, [esi + 0x1c]
test ecx, ecx
je 0x10023ecf
push ecx
call edi
lea eax, [esi + 0x1c]
mov dword [eax], 0
push eax
push 0
push 0
push 0x10054edc
call ebx
mov ecx, dword [esi + 0x20]
lea eax, [esi + 0x20]
test ecx, ecx
je 0x10023ef1
push ecx
call edi
lea eax, [esi + 0x20]
mov dword [eax], 0
push eax
push 0
push 0
push 0x10054ecc
call ebx
lea ecx, [ebp - 4]
mov dword [esi + 0x24], 1
push ecx
lea eax, [esi + 0x24]
mov dword [ebp - 4], 4
push eax
push 0
push 0x10
push str.StartMenuAdminTools
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100256e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi]
test eax, eax
je 0x10025711
push 0
push 0x100256c0
push eax
call dword [sym.imp.COMCTL32.dll_DPA_DestroyCallback]
mov dword [esi], 0
cmp byte [ebp + 8], 0
je 0x10025756
lea ecx, [ebp - 0x208]
call fcn.1001cb50
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push str.appsfolder.dat
lea eax, [ebp - 0x208]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10026bd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov esi, dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
xor edx, edx
mov dword [ebp - 0xc], 4
cmp byte [eax + 2], dl
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
sete dl
push eax
push 0
push 0x10
push str.NativeSearchBox
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
mov dword [ebp - 8], edx
call esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10
push str.NativeSearchBox
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
cmp dword [ebp - 8], 0
je 0x10026ced
lea esi, [edi + 0x40]
push esi
push 0x10055084
push 3
push 0
push 0x10051828
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [esi]
test ecx, ecx
je 0x10026d77
push dword [ebp + 8]
mov eax, dword [ecx]
push dword [edi + 0x10]
push ecx
call dword [eax + 0xc]
mov eax, dword [esi]
push 0xac
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
lea eax, [edi + 0x14]
push eax
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_IUnknown_GetWindow]
push edi
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_IUnknown_SetSite]
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x214]
push 0x104
push eax
push 0x2036
push dword [0x1005dc3c]
call edi
test eax, eax
jne 0x10026cd4
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0x2036
push dword [0x1005dc10]
call edi
mov eax, dword [esi]
lea edx, [ebp - 0x214]
push 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x28
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
test eax, eax
je 0x10026d0f
lea ecx, [edi + 8]
push ecx
push dword [ebp + 8]
mov ecx, eax
push dword [edi + 0x10]
call fcn.10025770
jmp 0x10026d11
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov dword [edi + 0x3c], eax
lea eax, [ebp - 0x214]
push 0x104
push eax
push 0x2036
push dword [0x1005dc3c]
call esi
test eax, eax
jne 0x10026d50
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0x2036
push dword [0x1005dc10]
call esi
mov esi, dword [edi + 0x3c]
add esi, 0x20
mov eax, dword [esi]
test eax, eax
je 0x10026d69
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [esi], 0
push esi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_SHStrDupW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10028590
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0x10055ad8
push 1
push 0
push 0x10051808
mov edi, ecx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x100286f8
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCpyNW]
lea eax, [ebp - 0x21c]
push esi
push 0x104
push dword [edi + 0x50]
push eax
call ebx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [edi + 0x50]
add eax, eax
add esi, eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsFileSpecW]
test eax, eax
jne 0x10028610
cmp word [esi], ax
je 0x10028610
add esi, 2
cmp word [ebp - 0x21c], 0x5c
jne 0x1002866c
cmp word [ebp - 0x21a], 0x5c
je 0x1002866c
push 0x104
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x104
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x21c]
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 4]
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 0x10055ac8
mov edx, dword [ecx]
lea eax, [ebp - 0x21c]
push 0
push 0
push eax
push 7
push 0x100517d0
push ecx
call dword [edx + 0x2c]
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x10]
push edx
push 0x10055ac8
push 0
mov ecx, dword [eax]
push 0
push esi
push 7
push 0x1004f6a8
push eax
call dword [ecx + 0x2c]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
xor eax, eax
test ebx, ebx
push 0x10055ac8
mov edx, dword [ecx]
setne al
push 0
inc eax
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push ecx
call dword [edx + 0x28]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop esi
jmp 0x100286fb
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push 0x10055ab8
push dword [ebp - 8]
mov ecx, 0x100517d0
test ebx, ebx
push 0
mov eax, 0x1004f6a8
cmove eax, ecx
push eax
push 0
push dword [edi + 0x50]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
call dword [0x1005dc64]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret