joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002bc27
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1002bc62
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1002bc49
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1002bc5a
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1002bc64
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1002bc3f
xor eax, eax
pop edi
pop esi
ret

Function at 0x1002c2a0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1002c2be
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1002c2dc
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1002c33a
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1002c321
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1002c32a
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1002c334
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1002c316
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe fcn.1002c2a0
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1002c387
dec eax
je 0x1002c37e
sub eax, 3
je 0x1002c375
mov dword [ebp - 4], 0x40
jmp 0x1002c3a4
mov dword [ebp - 4], 4
jmp 0x1002c38a
mov dword [ebp - 4], 0x20
jmp 0x1002c38a
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1002c3d6
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1002c356
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1002bbe7
and ecx, ebp
cmp dword [0x6a1475ff], 1
push esi
call edi
mov eax, esi
jmp 0x1002c3e2
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002d070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.1002bbe7
fldenv [eax + 0x1b]
jg 0x1002d062
test esp, edx
clc
invalid
Function at 0x1002df40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 0x30]
push eax
push str.IdealHeight._d
lea eax, [ebp - 0x34]
push 0x14
push eax
call fcn.1000edb0
add esp, 0x10
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x18
lea eax, [ebp - 0x34]
push eax
push str.SoftwareStartIsBackCache
push SHChangeNotifyRegister
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov eax, dword [ebp - 4]
mov ecx, edi
movsx ebx, ax
shr eax, 0x10
cwde
mov dword [ebp - 0xc], eax
mov eax, dword [edi]
call dword [eax + 0x9c]
cmp ebx, eax
jge 0x1002dfb9
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x9c]
mov ebx, eax
mov eax, dword [edi]
mov esi, 5
sub esi, dword [edi + 0x48]
mov ecx, edi
imul esi, dword [ebp - 0xc]
add esi, dword [edi + 0x94]
add esi, dword [edi + 0x40]
add esi, dword [edi + 0x3c]
call dword [eax + 0x54]
test eax, eax
je 0x1002dfdf
add esi, dword [edi + 0x48]
mov ecx, dword [edi + 0x4c]
mov eax, dword [edi + 0x20]
imul ecx, ebx
add ecx, esi
cmp ecx, eax
cmovge eax, ecx
mov dword [edi + 0x24], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10030980
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x1005e0dc], 0
push esi
jne 0x10030b2e
cmp byte [0x1005dbdc], 0
mov esi, dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
jne 0x100309d4
push 0x29c
call esi
add esp, 4
test eax, eax
je 0x100309c4
mov ecx, eax
call fcn.10032660
mov dword [0x1005e0e4], eax
mov byte [0x1005dbdc], 1
jmp 0x100309d9
xor eax, eax
mov byte [0x1005dbdc], 1
mov dword [0x1005e0e4], eax
jmp 0x100309d9
mov eax, dword [0x1005e0e4]
push 0x1005de98
mov ecx, eax
call fcn.10032da0
cmp dword [0x1005dc18], 0
mov cl, byte [0x1005dbdc]
je 0x10030a4a
test cl, cl
jne 0x10030a2d
push 0x29c
call esi
add esp, 4
test eax, eax
je 0x10030a1c
mov ecx, eax
call fcn.10032660
mov cl, 1
mov dword [0x1005e0e4], eax
mov byte [0x1005dbdc], cl
jmp 0x10030a32
xor eax, eax
mov cl, 1
mov dword [0x1005e0e4], eax
mov byte [0x1005dbdc], cl
jmp 0x10030a32
mov eax, dword [0x1005e0e4]
cmp byte [eax + 0x249], 0
jne 0x10030a4f
mov dword [0x1005d02c], 2
jmp 0x10030aea
mov eax, dword [0x1005e0e4]
test cl, cl
jne 0x10030a79
push 0x29c
call esi
add esp, 4
test eax, eax
je 0x10030a6a
mov ecx, eax
call fcn.10032660
jmp 0x10030a6c
xor eax, eax
mov cl, 1
mov dword [0x1005e0e4], eax
mov byte [0x1005dbdc], cl
cmp byte [eax + 0x249], 0
jne 0x10030ae0
test cl, cl
jne 0x10030aab
push 0x29c
call esi
add esp, 4
test eax, eax
je 0x10030a9d
mov ecx, eax
call fcn.10032660
jmp 0x10030a9f
xor eax, eax
mov dword [0x1005e0e4], eax
mov byte [0x1005dbdc], 1
mov eax, dword [eax + 0x214]
test eax, eax
je 0x10030ae0
lea ecx, [ebp - 4]
mov dword [ebp - 4], 1
push ecx
push 0xfa1
push 0
push 6
push eax
call dword [sym.imp.UxTheme.dll_GetThemeEnumValue]
cmp dword [ebp - 4], 2
mov dword [0x1005d02c], 1
jne 0x10030aea
mov dword [0x1005d02c], 0
push 4
push 0x1005d02c
push 4
push str.ModernIconsColorized
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0xc4
call esi
add esp, 4
test eax, eax
je 0x10030b27
mov ecx, eax
call fcn.10008020
mov dword [0x1005e0dc], eax
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [0x1005e0dc], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10030c00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0xffffffff
push eax
push 0
push 0x10
push str.StartMenuAlpha
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10
push str.StartMenuAlpha
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
mov eax, dword [ebp - 8]
cmp eax, 0xffffffff
jne 0x10030ce3
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
push eax
push 0
push 0x10
push str.EnableTransparency
push str.SOFTWAREMicrosoftWindowsCurrentVersionThemesPersonalize
push SHChangeNotifyRegister
call esi
cmp dword [ebp - 4], 0
je 0x10030cde
push pe_nt_image_headers32
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], 0x114
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 0x42a7
pop esi
sbb eax, eax
and eax, 9
add eax, 0xc4
mov esp, ebp
pop ebp
ret
mov eax, 0xff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100321d0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ac
push ebx
push esi
push edi
push 0x100530fc
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push 0x10
push edi
call esi
push 0x5c
push edi
mov dword [0x1005e174], eax
call esi
push 7
push edi
mov dword [0x1005e178], eax
call esi
push 0x7f
push edi
mov dword [0x1005e17c], eax
call esi
push 0x64
lea eax, [ebp - 0xd0]
mov dword [ebp - 4], 0
push eax
push 0x64
lea eax, [ebp - 0x198]
mov dword [ebp - 8], 0
push eax
push ebx
call dword [0x1005e17c]
test eax, eax
jne 0x10032337
push pe_nt_image_headers32
push eax
lea eax, [ebp - 0x2a8]
mov dword [ebp - 0x2ac], 0x114
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x2a0], 0x4e20
lea eax, [ebp - 8]
push 0
push 0
push 0
push 0
push 0
push 0
jb 0x100322ae
push eax
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x198]
push eax
push ebx
push 0
push 0
call dword [0x1005e178]
jmp 0x100322d2
push 0
push eax
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x198]
push eax
push ebx
push 0
push 0
call dword [0x1005e178]
test eax, eax
jne 0x10032337
push 0x1c
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x1003232e
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.thmfile
push edi
call esi
push 0x10056334
lea eax, [edi + 0x18]
push eax
call esi
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0
push 0
push 0
push 4
push eax
mov dword [edi + 0xc], eax
call esi
mov ecx, dword [ebp - 8]
push 0
push 0
push 0
push 4
push ecx
mov dword [edi + 8], eax
mov dword [edi + 0x14], ecx
call esi
mov dword [edi + 0x10], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10032340
Capabilities:
Check if file exists
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push esi
xor eax, eax
mov dword [ebp - 4], 0x104
mov word [ebp - 0x20c], ax
mov esi, ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 2
push 0x1005633c
push str.SoftwareStardockWindowBlindsWB5.iniWBLiteFX
push SHChangeNotifyRegister
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x1004fd84
push str.File
push str.XPTaskbar
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1003244d
mov word [ebp - 0x20c], ax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 4], 0x104
push eax
push 0
push 2
push str.Path
push str.SoftwareStardockWindowBlindsWB5.iniInstalled
push SHChangeNotifyRegister
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100324a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1005e3b0]
sub esp, 0xc
push ebx
mov ebx, ecx
push edi
mov edi, edx
test eax, eax
jne 0x10032591
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GdiDrawStream
push 0x10056454
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10032460
push eax
push 0x100530fc
mov dword [0x1005e184], eax
call esi
mov edx, str.gdi32.dll
mov ecx, eax
call fcn.1001c730
mov dword [0x1005e3b0], eax
test eax, eax
jne 0x1003251e
push str.patchedGdiDrawStream
push str.SIB_ASSERTION_FAILED:__s
call fcn.10001be0
mov eax, dword [0x1005e3b0]
or ecx, 0xffffffff
add esp, 8
test eax, eax
cmove eax, ecx
mov dword [0x1005e3b0], eax
mov esi, dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0x10
push str.NoGdiDrawStreamPatch
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
mov dword [ebp - 0xc], 4
call esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x10
push str.NoGdiDrawStreamPatch
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
cmp dword [ebp - 4], 0
pop esi
je 0x1003258c
pop edi
mov dword [0x1005e3b0], 0xffffffff
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1005e3b0]
cmp eax, 1
je 0x1003259e
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 0xfa1
push 0
push edi
push ebx
call dword [sym.imp.UxTheme.dll_GetThemeEnumValue]
cmp dword [ebp - 8], 0
pop edi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10033b30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [edi + 0x214]
test eax, eax
je 0x10033b5e
push ebx
push 0x138a
push 0
push esi
push eax
call dword [sym.imp.UxTheme.dll_GetThemeRect]
cmp byte [edi + 2], 0
jne 0x10033b71
cmp dword [edi + 0x214], 0
jne 0x10033cee
cmp esi, 6
jne 0x10033b7b
lea edi, [esi + 0x71]
jmp 0x10033b9d
cmp esi, 9
jne 0x10033b85
lea edi, [esi + 0x79]
jmp 0x10033b9d
cmp esi, 0xa
jne 0x10033b8f
lea edi, [esi + 0x74]
jmp 0x10033b9d
cmp esi, 0x14
jne 0x10033cee
mov edi, 0x7f
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x208]
push 0x104
push eax
push edi
push dword [0x1005dc3c]
call esi
test eax, eax
jne 0x10033bd1
push 0x104
lea eax, [ebp - 0x208]
push eax
push edi
push dword [0x1005dc10]
call esi
cmp word [ebp - 0x208], 0
je 0x10033c83
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov dword [ebx], eax
lea eax, [ebp - 0x208]
push 0x10056338
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
mov esi, eax
test esi, esi
je 0x10033c19
add esi, 2
cmp word [esi], 0x20
jne 0x10033c19
nop
add esi, 2
cmp word [esi], 0x20
je 0x10033c10
push esi
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
push 0x10056338
push esi
mov dword [ebx + 4], eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
mov esi, eax
test esi, esi
je 0x10033c49
add esi, 2
cmp word [esi], 0x20
jne 0x10033c49
nop
add esi, 2
cmp word [esi], 0x20
je 0x10033c40
push esi
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
push 0x10056338
push esi
mov dword [ebx + 8], eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x10033c79
add eax, 2
cmp word [eax], 0x20
jne 0x10033c79
nop dword [eax]
add eax, 2
cmp word [eax], 0x20
je 0x10033c70
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov dword [ebx + 0xc], eax
cmp edi, 0x77
jne 0x10033c9b
lea eax, [ebp + 0x14]
add ebx, 8
push eax
push ebx
push 0
push 0x10
push 0x10056848
jmp 0x10033ccc
cmp edi, 0x82
jne 0x10033cb6
lea eax, [ebp + 0x14]
add ebx, 8
push eax
push ebx
push 0
push 0x10
push str.StartPane_RightWidth
jmp 0x10033ccc
cmp edi, 0x7e
jne 0x10033cee
lea eax, [ebp + 0x14]
add ebx, 8
push eax
push ebx
push 0
push 0x10
push str.StartPane_JumpListWidth
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
mov dword [ebp + 0x14], 4
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
cmp dword [ebx], 0
jge 0x10033cee
mov dword [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10033d00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
push dword [ebp + 0x14]
mov edi, ecx
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push 0
push esi
push 0
push dword [edi + 0x214]
call dword [sym.imp.UxTheme.dll_GetThemeMargins]
cmp byte [edi + 3], 0
mov dword [ebp + 0x18], eax
je 0x10033e43
cmp esi, 0x12
jne 0x10033dd6
lea ecx, [ebp - 0x20c]
call fcn.10032340
lea eax, [ebp - 0x20c]
push eax
push str.skin_path__ws
call fcn.10001be0
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x20c]
add esp, 8
push eax
push dword [ebx]
push str.SearchX
push str.StartPanel.BottomBar
call edi
mov dword [ebx], eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebx + 8]
push str.SearchY
push str.StartPanel.BottomBar
call edi
mov dword [ebx + 8], eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebx + 4]
push str.SearchRightPad
push str.StartPanel.BottomBar
call edi
mov esi, eax
lea eax, [ebp - 0x20c]
push eax
push 0
push str.ContentRight
push str.StartPanel.BottomBar
call edi
lea ecx, [ebp - 0x20c]
add eax, esi
push ecx
mov dword [ebx + 4], eax
push eax
jmp 0x10033e0f
cmp esi, 0xe
jne 0x10033e43
lea ecx, [ebp - 0x20c]
call fcn.10032340
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x20c]
push eax
push dword [ebx + 8]
push str.SearchY
push str.StartPanel.BottomBar
call edi
mov dword [ebx + 8], eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebx + 4]
push str.PartHeight
push str.StartPanel.BottomBar
call edi
mov esi, eax
lea eax, [ebp - 0x20c]
sub esi, dword [ebx + 8]
push eax
push 0x18
push str.SearchHeight
push str.StartPanel.BottomBar
call edi
mov edi, dword [ebp - 4]
sub esi, eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0xc], esi
mov esi, dword [ebp + 8]
test eax, eax
jne 0x10033e4f
cmp dword [edi + 0x214], eax
jne 0x10033e90
add esi, 0xfffffffe
xor ecx, ecx
cmp esi, 0x24
ja case.0x10033e60.3
movzx eax, byte [esi + 0x10033ea8]
jmp dword [eax*4 + 0x10033e9c]
mov ecx, 8
pop edi
pop esi
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, 4
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10036410
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x990
cmp byte [ecx + 0xd8], 0
je 0x1003643d
push 0
push 0xc8
push dword [ebp + 8]
push str._taskmgr.exe__32423
call dword [sym.imp.SHLWAPI.dll_SHLoadIndirectString]
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ecx + 0xd4]
push esi
push edi
sub eax, 1
je 0x100364e0
sub eax, 1
je 0x1003649e
sub eax, 1
jne 0x1003655f
push str.JumpView_AppCloseDisplayWindowsAction
lea eax, [ebp - 0x190]
push str._windows_ms_resource:__Windows.UI.ShellCommon_JumpViewUI__ws
push eax
call fcn.10036570
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x190]
mov edi, dword [sym.imp.SHLWAPI.dll_SHLoadIndirectString]
add esp, 0xc
push 0
push 0xc8
push esi
push eax
call edi
test eax, eax
jns 0x1003655f
push str.JumpView_AppCloseDisplayWindowsAction
jmp 0x1003651c
push str.JumpView_AppCloseAllWindowsAction
lea eax, [ebp - 0x190]
push str._windows_ms_resource:__Windows.UI.ShellCommon_JumpViewUI__ws
push eax
call fcn.10036570
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x190]
mov edi, dword [sym.imp.SHLWAPI.dll_SHLoadIndirectString]
add esp, 0xc
push 0
push 0xc8
push esi
push eax
call edi
test eax, eax
jns 0x1003655f
push str.JumpView_AppCloseAllWindowsAction
jmp 0x1003651c
push str.JumpView_AppCloseWindowAction
lea eax, [ebp - 0x190]
push str._windows_ms_resource:__Windows.UI.ShellCommon_JumpViewUI__ws
push eax
call fcn.10036570
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x190]
mov edi, dword [sym.imp.SHLWAPI.dll_SHLoadIndirectString]
add esp, 0xc
push 0
push 0xc8
push esi
push eax
call edi
test eax, eax
jns 0x1003655f
push str.JumpView_AppCloseWindowAction
push str._windir_
lea eax, [ebp - 0x190]
push str.__wsSystemAppsShellExperienceHost_cw5n1h2txyewy_resources.pri_ms_resource:__Microsoft.Windows.ShellExperienceHost_JumpViewUI__ws
push eax
call fcn.10036570
add esp, 0x10
lea eax, [ebp - 0x990]
push 0x400
push eax
lea eax, [ebp - 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0xc8
push esi
lea eax, [ebp - 0x990]
push eax
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10036740
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
lea eax, [ebp - 0xe0]
push esi
push edi
push 0x64
mov edi, ecx
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [ebp - 0xe0]
push str.ClockButton
push eax
call esi
test eax, eax
je 0x1003678b
push str.TrayClockWClass
lea eax, [ebp - 0xe0]
push eax
call esi
test eax, eax
jne 0x10036831
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push 0
push 0x10
push str.UseWin32TrayClockExperience
push str.SOFTWAREMicrosoftWindowsCurrentVersionImmersiveShell
push reloc.SHELL32.dll_SHChangeNotifyRegister
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
cmp dword [ebp - 4], 0
je 0x10036831
cmp dword [0x1005e3b4], 0
jne 0x100367eb
push 0x1005e3b4
push 0x100576ec
push 3
push 0
push 0x100576dc
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp dword [0x1005e3b4], 0
je 0x10036831
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [0x1005e3b4]
lea edx, [ebp - 0x18]
push edx
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov esi, dword [sym.imp.USER32.dll_KillTimer]
push 1
push edi
call esi
push 2
push edi
call esi
push edi
push 0x10036840
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_EnumThreadWindows]
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100370f0
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
xor ebx, ebx
mov dword [ebp - 0x124], 0x114
cmp ecx, 0x78
mov eax, 0xfd
push esi
setge bl
add ebx, 0xfb
cmp ecx, 0x90
push edi
cmovge ebx, eax
mov eax, 0xfe
cmp ecx, 0xc0
push pe_nt_image_headers32
cmovge ebx, eax
mov eax, 0xff
cmp ecx, 0x120
push 0
cmovge ebx, eax
cmp ecx, 0x180
cmovge ebx, eax
lea eax, [ebp - 0x120]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x118], 0x4777
jb 0x1003718a
add ebx, 0x1c1
cmp dword [0x1005dc18], 0
je 0x1003719c
add ebx, 0xa
jmp 0x1003719c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp ax, 4
jne 0x1003719c
add ebx, 0x96
mov edi, dword [0x1005dc10]
push str.IMAGE
push ebx
push edi
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test esi, esi
je 0x10037275
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
mov esi, eax
test esi, esi
je 0x10037275
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 0
push eax
push 0x10059110
push 3
push 0
push 0x100590c0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x1003724e
mov eax, dword [ebp - 4]
push 1
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
test eax, eax
jne 0x10037245
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
test eax, eax
jne 0x10037245
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 0x100590e0
call dword [sym.imp.WindowsCodecs.dll_WICConvertBitmapSource]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x10037265
mov ecx, edi
call fcn.1004cbc0
mov ecx, dword [edi]
push edi
mov dword [ebp - 0x10], eax
call dword [ecx + 8]
mov ecx, dword [esi]
push esi
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret