joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c7a5
Capabilities:
Delete file
Read clipboard data

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x1006d144]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 0x54
mov eax, 0x10050e2b
call fcn.1003b883
xor eax, eax
push 0x206
push eax
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push eax
call fcn.1003c230
add esp, 0xc
push 0
lea eax, [ebp + 0x1c]
push eax
call fcn.10001fa7
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0x1c]
push eax
call edi
push str..jpg
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
push 2
call esi
test eax, eax
jne 0x1002c828
push 2
call fcn.1002bc04
pop ecx
push eax
call esi
test eax, eax
je 0x1002c98f
push eax
lea ebx, [ebp + 0x1c]
call fcn.1002bc53
pop ecx
test al, al
je 0x1002c98f
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x28]
call fcn.1000f4c2
push 0x100577b0
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], ebx
call fcn.10004b06
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 1
call fcn.1000ab51
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
mov byte [ebp - 4], 2
call fcn.1000f672
push str.cl_type
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.10010909
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1000f8d5
push ebx
push 1
lea ecx, [ebp - 0x44]
call fcn.1000585c
push ebx
push 1
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], bl
call fcn.10005a6e
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.__image__
call fcn.1000f5bb
push str.cl_content
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.10010909
mov ecx, eax
mov byte [ebp - 4], bl
call fcn.1000f8d5
push ebx
lea ecx, [ebp]
mov dword [ebp + 0x18], 0xf
call fcn.10006629
lea eax, [ebp]
push eax
lea ebx, [ebp - 0x44]
mov byte [ebp - 4], 5
call fcn.1002c665
sub esp, 0x14
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
mov byte [ebp - 4], 6
call fcn.1000f672
push str.cl_procname
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 7
call fcn.10010909
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.1000f8d5
xor esi, esi
mov byte [ebp - 4], 5
push esi
push 1
mov ecx, ebx
call fcn.1000585c
sub esp, 0x18
lea eax, [ebp]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.1000f672
push str.cl_hash4k
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 8
call fcn.10010909
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.1000f8d5
push esi
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
push str.t_clipboard_log
call fcn.10019818
push esi
push 1
lea ecx, [ebp]
call fcn.1000585c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000f850
lea eax, [ebp + 0x1c]
push eax
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.1003b874
add ebp, 0x228
leave
ret
Function at 0x1002d14b
Capabilities:
Open clipboard

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x1006d144]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x24
mov eax, 0x10050f71
call fcn.1003b883
push 0x10057818
mov edi, ecx
call fcn.1001e134
pop ecx
test eax, eax
je 0x1002d2a6
cmp dword [ebp + 0x214], 1
jne 0x1002d1e2
xor esi, esi
cmp dword [0x1007003c], esi
je 0x1002d2a6
call fcn.10002d84
sub eax, dword [0x10070040]
sbb edx, dword [0x10070044]
mov dword [ebp - 0x10], edx
jne 0x1002d1bc
cmp eax, 0xbb8
jbe 0x1002d2a6
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1002d1d7
call fcn.1002ce5e
call fcn.1002c7a5
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x1007003c], esi
jmp 0x1002d2a6
cmp dword [ebp + 0x214], 2
jne 0x1002d2a6
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1002d2a6
cmp edi, dword [0x1007004c]
je 0x1002d2a6
lea eax, [ebp - 0x10]
push eax
xor esi, esi
push edi
mov dword [0x1007004c], edi
mov dword [ebp - 0x10], esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0x10], esi
je 0x1002d297
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push esi
push eax
call fcn.1003c230
add esp, 0xc
push 0x104
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call fcn.10003668
test eax, eax
je 0x1002d2a6
lea eax, [ebp]
push eax
mov ecx, 0x10070050
call fcn.10005a4a
push esi
push esi
push dword [ebp - 0x10]
lea eax, [ebp - 0x30]
push eax
call fcn.1000af3e
add esp, 0x10
push 0xffffffffffffffff
push esi
push eax
mov ecx, 0x1007006c
mov dword [ebp - 4], esi
call fcn.10005735
push esi
push 1
lea ecx, [ebp - 0x30]
call fcn.1000585c
jmp 0x1002d2a6
push 0x10057810
mov ecx, 0x10070050
call fcn.10005a4a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1003b874
add ebp, 0x20c
leave
ret
Function at 0x1002dbfa
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x1006d144]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x24
mov eax, 0x10050fa9
call fcn.1003b883
xor ebx, ebx
cmp esi, ebx
jne 0x1002dc51
push 0x10057c74
call fcn.1001e134
pop ecx
test eax, eax
jne 0x1002dca8
push 0x10
push 0x1005ecb8
push 0x10057c5c
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1002de3a
cmp esi, 1
jne 0x1002dc73
push 0x10057c34
call fcn.1001e134
pop ecx
test eax, eax
jne 0x1002dca8
push 0x10
push 0x1005ecb8
push 0x10057c1c
jmp 0x1002dc3f
cmp esi, 2
jne 0x1002dd21
push str.DocwmManual
call fcn.1001e134
pop ecx
test eax, eax
jne 0x1002dc99
push 0x10
push 0x1005ecb8
push 0x10057bec
jmp 0x1002dc3f
push str.DocwmManualAdd
call fcn.1001e134
pop ecx
test eax, eax
je 0x1002dc8b
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
call fcn.1003c230
add esp, 0xc
cmp esi, ebx
je 0x1002dcd0
mov dword [ebp - 0x14], 0x10057bc0
cmp esi, 1
jne 0x1002dcd7
mov dword [ebp - 0x14], 0x10057bac
push 0x104
lea eax, [ebp]
push eax
push str.wfchost.exe
push dword [0x10070324]
call fcn.10002306
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1002dd5d
push dword [ebp - 0x14]
push str.gb0R_
push 0x10
push 0x1005ecb8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call fcn.10002497
add esp, 0x14
jmp 0x1002de3a
cmp esi, 3
jne 0x1002dca8
push str.DocwmManual
call fcn.1001e134
pop ecx
test eax, eax
je 0x1002dc8b
push str.DocwmManualRemove
call fcn.1001e134
pop ecx
test eax, eax
jne 0x1002dca8
push 0x10
push 0x1005ecb8
push 0x10057b60
jmp 0x1002dc3f
cmp esi, ebx
jne 0x1002dd68
mov eax, str._encrypt
jmp 0x1002ddc7
cmp esi, 1
jne 0x1002dd8a
push 0x10057b20
call fcn.1001e134
pop ecx
test eax, eax
je 0x1002dd83
mov eax, str._decrypt
jmp 0x1002ddc7
mov eax, str._decryptNoReq
jmp 0x1002ddc7
cmp esi, 2
jne 0x1002dd96
mov eax, str._addDocwm
jmp 0x1002ddc7
cmp esi, 3
jne 0x1002ddb8
push str.DocwmManualRemoveNeedToApprove
call fcn.1001e134
pop ecx
test eax, eax
je 0x1002ddb1
mov eax, str._removeDocwmReq
jmp 0x1002ddc7
mov eax, str._removeDocwm
jmp 0x1002ddc7
mov eax, str._decMailReq
cmp esi, 4
je 0x1002ddc7
mov eax, 0x1005d21c
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x30]
push str.__s___s__shl
push eax
call fcn.100041b8
add esp, 0x10
cmp dword [eax + 0x18], 8
mov dword [ebp - 4], ebx
jb 0x1002ddeb
mov eax, dword [eax + 4]
jmp 0x1002ddee
add eax, 4
push 1
push ebx
push eax
call fcn.10002f06
mov dword [ebp - 0x10], eax
push ebx
push 1
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.10005a6e
cmp dword [ebp - 0x10], ebx
je 0x1002de14
cmp dword [ebp - 0x10], 0xffffffff
jne 0x1002de32
push dword [ebp - 0x14]
push 0x10057a1c
push 0x10
push 0x1005ecb8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call fcn.10002497
add esp, 0x14
lea ecx, [ebp - 0x10]
call fcn.10001336
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1003b874
add ebp, 0x20c
leave
ret
Function at 0x1002de5d
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x1006d144]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 4
mov eax, 0x10050fd9
call fcn.1003b883
mov eax, dword [ebp + 0x234]
mov esi, dword [ebp + 0x230]
mov edi, dword [ebp + 0x238]
mov dword [ebp - 0x10], eax
xor eax, eax
push 0x206
push eax
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push eax
call fcn.1003c230
add esp, 0xc
push 0x104
lea eax, [ebp + 0x1c]
push eax
push esi
push dword [0x10070324]
call fcn.10002306
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1002def1
push dword [ebp - 0x10]
push str.gb0R_
push 0x10
push 0x1005ecb8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call fcn.10002497
add esp, 0x14
jmp 0x1002df58
test edi, edi
jne 0x1002defa
mov edi, 0x1005d21c
push edi
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp]
push str.__s___s
push eax
call fcn.100041b8
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x1002df20
lea eax, [ebp + 4]
push 1
push 0
push eax
call fcn.10002f06
test eax, eax
jne 0x1002df4c
push dword [ebp - 0x10]
push 0x10057c9c
push 0x10
push 0x1005ecb8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call fcn.10002497
add esp, 0x14
push 0
push 1
lea ecx, [ebp]
call fcn.10005a6e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.1003b874
add ebp, 0x228
leave
ret

Function at 0x1002e1fe
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x10051059
call fcn.1003b8b6
xor edi, edi
mov dword [ebp - 4], edi
push 0x18
mov byte [ebp - 4], 1
call fcn.1003b3dd
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
cmp esi, edi
je 0x1002e237
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.1002671e
mov eax, esi
jmp 0x1002e239
xor eax, eax
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push eax
push 0x1002e181
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
mov esi, eax
call fcn.10005ffc
mov eax, esi
jmp 0x1002e273
call fcn.1003b95b
ret
Function at 0x10030b63
Capabilities:
Create thread

Disassembly:
push dword [0x100700e8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10030b8a
push eax
push eax
push eax
push 0x10030a85
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret

Function at 0x10030ec4
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x10030f15
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x10030f26
push 0xd
pop eax
jmp 0x10030f53
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x10030f29
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x100313f1
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1006d144]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.1003c230
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str.actmon32.dll
push dword [0x10070324]
call fcn.10002306
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10031452
inc eax
jmp 0x10031461
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003b874
leave
ret

Function at 0x10031712
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x1006d144]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a4]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.10030e83
mov ebx, eax
cmp ebx, esi
je 0x10031782
lea ecx, [ebp - 0x70]
call fcn.10030e0e
mov eax, ebx
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003b874
add ebp, 0x19c
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1003179a
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x70]
call fcn.10031712
cmp eax, esi
jne 0x100317cc
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], pe_nt_image_headers32
call ebx
test eax, eax
je 0x1003178a
lea ecx, [ebp - 0x70]
call fcn.10030e0e
push dword [ebp - 0x78]
mov ecx, edi
call fcn.10030db3
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.10030e0e
mov eax, esi
jmp 0x10031768
Function at 0x10034b03
Capabilities:
Print debug messages

Disassembly:
push 0x40
mov eax, 0x10051b89
call fcn.1003b8ec
call fcn.1001c6f3
test al, al
jne 0x10034bbc
lea eax, [ebp - 0x2c]
push 1
push eax
call fcn.1002e6b5
pop ecx
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], esi
je 0x10034bb1
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10034b3f
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x4c]
push str._s__i
push eax
call fcn.100041b8
add esp, 0xc
cmp dword [eax + 0x18], 8
mov byte [ebp - 4], 1
jb 0x10034b60
mov eax, dword [eax + 4]
jmp 0x10034b63
add eax, 4
push 1
push esi
push eax
call fcn.10002f06
mov dword [ebp - 0x30], eax
push esi
push 1
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 3
call fcn.10005a6e
cmp dword [ebp - 0x30], esi
je 0x10034b96
cmp dword [ebp - 0x30], 0xffffffff
je 0x10034b96
push str.CFID_POBUS_fixed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x10034ba9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CFID_POBUS_start_failed:__d
call fcn.10022250
pop ecx
pop ecx
lea ecx, [ebp - 0x30]
call fcn.10001336
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.10005a6e
call fcn.1003b96f
ret 0x10
Function at 0x10035797
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebx
push ebp
xor ebp, ebp
inc ebp
cmp dword [esp + 0x10], ebp
jne 0x100358b8
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
mov dword [0x10070324], edi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x104
mov esi, 0x10070118
push esi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [0x10070320], eax
call fcn.1001a978
test eax, eax
je 0x100357ed
push 0x10034f43
push edi
call fcn.10019f88
call fcn.10039d05
mov eax, dword [0x10070320]
cmp eax, ebx
je 0x1003587f
push str.explorer.exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1003587a
call fcn.1001e8f0
call fcn.1002d583
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x1003146d
push ebx
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push ebx
push 0x10034bc4
push ebx
push ebx
call esi
mov dword [0x10070328], eax
mov dword [0x10070110], ebp
call fcn.1003a860
mov ecx, eax
call fcn.1003adab
call fcn.10030b63
call fcn.10038e13
pop edi
pop esi
cmp byte [0x100700ec], bl
jne 0x1003586b
mov ebx, ebp
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
pop ebp
and eax, ebx
pop ebx
ret 0xc
mov eax, dword [0x10070320]
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.360desktop
push eax
mov edi, eax
call esi
test eax, eax
jne 0x100358ab
push str.360FileBrowser
push edi
call esi
test eax, eax
jne 0x100358ab
push str.kdesktopservice
push edi
call esi
test eax, eax
je 0x1003585f
mov dword [0x10070114], ebp
call fcn.1001e8f0
jmp 0x1003585f
xor ebx, ebx
cmp dword [esp + 0x10], ebx
jne 0x10035869
cmp dword [0x10070110], ebx
je 0x1003590b
call fcn.10039d4f
mov eax, dword [0x10070328]
cmp eax, ebx
je 0x100358f0
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [0x10070328]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10070328], ebx
call fcn.1002bca9
call fcn.1003a860
mov ecx, eax
call fcn.1003a88d
call fcn.1002d617
jmp 0x10035869
cmp dword [0x10070114], ebx
je 0x10035869
call fcn.10039d4f
jmp 0x10035869
Function at 0x10035ced
Capabilities:
Delete registry value

Disassembly:
push 0x38
mov eax, 0x10051e28
call fcn.1003b883
cmp dword [ebp + 8], 0
je 0x10035d50
mov dword [ebp + 8], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea eax, [ebp - 0x28]
push 0x1005ebd0
push eax
call fcn.100041b8
add esp, 0xc
and dword [ebp - 4], 0
cmp dword [eax + 0x18], 8
jb 0x10035d2d
mov eax, dword [eax + 4]
jmp 0x10035d30
add eax, 4
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push eax
push str.Softwareprojonepodlp_volatilehookBypass_
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1000469d
add esp, 0x18
lea ecx, [ebp - 0x28]
jmp 0x10035d8a
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea eax, [ebp - 0x44]
push 0x1005ebd0
push eax
call fcn.100041b8
add esp, 0xc
cmp dword [eax + 0x18], 8
jb 0x10035d73
mov eax, dword [eax + 4]
jmp 0x10035d76
add eax, 4
push eax
push str.Softwareprojonepodlp_volatilehookBypass_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea ecx, [ebp - 0x44]
push 0
push 1
call fcn.10005a6e
call fcn.1003b95b
ret
Function at 0x100361fa
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x10070384], ebx
je 0x10036215
cmp dword [0x10070388], ebx
jne 0x1003625e
push str.Comctl32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
cmp edi, ebx
je 0x10036246
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreatePropertySheetPageW
push edi
call esi
push str.DestroyPropertySheetPage
push edi
mov dword [0x10070384], eax
call esi
mov dword [0x10070388], eax
cmp dword [0x10070384], ebx
je 0x10036256
cmp dword [0x10070388], ebx
jne 0x1003625e
xor eax, eax
inc eax
jmp 0x10036367
call fcn.1001e8f0
mov edi, dword [ebp + 8]
lea esi, [edi + 0xc]
mov ecx, esi
call fcn.1001d1b1
cmp dword [0x10070110], ebx
jne 0x10036284
cmp dword [0x10070114], ebx
je 0x1003635f
cmp dword [ebp + 0x10], ebx
je 0x1003635f
push 0x100582a8
call fcn.1001e134
pop ecx
test eax, eax
je 0x1003635f
call fcn.1001e8f0
push dword [ebp + 0x10]
lea eax, [ebp - 0x28]
push eax
call fcn.10039b27
pop ecx
pop ecx
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
call fcn.10005d1f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
jmp 0x1003631a
lea ecx, [ebp - 8]
call fcn.1001489b
cmp dword [eax + 0x18], 8
jb 0x100362e3
mov eax, dword [eax + 4]
jmp 0x100362e6
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10036312
lea ecx, [ebp - 8]
call fcn.1001489b
cmp dword [eax + 0x18], 8
jb 0x10036304
mov eax, dword [eax + 4]
jmp 0x10036307
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x1003633b
lea ecx, [ebp - 8]
call fcn.100148c7
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
call fcn.10005d1f
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
call fcn.10009cf5
test al, al
je 0x100362d0
jmp 0x1003634e
lea ecx, [ebp - 8]
call fcn.1001489b
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.10005943
lea ecx, [ebp - 0x28]
call fcn.10005cb6
push dword [ebp - 0x28]
call fcn.1003b0b3
pop ecx
xor eax, eax
cmp dword [edi + 0x20], ebx
sete al
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x100367b9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
cmp eax, 2
jle 0x100367e8
cmp word [esi + 2], 0x3a
jne 0x100367e8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100367e3
test al, 0x10
je 0x100367e3
xor eax, eax
pop edi
ret
xor eax, eax
inc eax
pop edi
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call edi
neg eax
sbb eax, eax
neg eax
pop edi
ret
Function at 0x10036b03
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
push edi
mov edi, str.Softwareprojonepodlp_volatileoverlayIcon_
mov esi, reloc.OLEAUT32.dll_SysReAllocString
jne 0x10036b36
push dword [ebp + 8]
push edi
push esi
call fcn.10004728
add esp, 0xc
test al, al
je 0x10036b76
push dword [ebp + 8]
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x10036b5c
push 0x64
push dword [ebp + 8]
push edi
push esi
call fcn.100042dd
cmp eax, dword [ebp + 0xc]
je 0x10036b76
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push dword [ebp + 8]
push edi
push esi
call fcn.1000469d
add esp, 0x18
push 0
push dword [ebp + 8]
call fcn.10001606
push eax
push 0x3e8
push 0x100368d4
call fcn.1001aa43
pop edi
pop esi
pop ebp
ret

Function at 0x10037e3a
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.1001e8f0
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x1007038c
call esi
push 0x100703bc
call esi
push 0x100703a4
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
xor ebp, ebp
push ebp
push ebp
push ebp
push 0x10037a53
mov ebx, 0x10000
push ebx
push ebp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
push ebp
push ebp
push ebp
push 0x10037c23
push ebx
push ebp
call esi
push eax
call edi
push ebp
push ebp
push ebp
push 0x10037d7c
push ebx
push ebp
call esi
push eax
call edi
pop edi
pop esi
pop ebp
pop ebx
ret