Function at 0x10047ee0
Capabilities:
Delete file
Identify system language via api
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 0x10
push 0x10058088
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
call esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x10
push str.WinLangID
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
push pe_nt_image_headers32
lea eax, [ebp - 0x140]
mov dword [ebp - 0x144], 0x114
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
cmp eax, dword [ebp - 0x138]
jne 0x10047f93
call edi
movzx eax, ax
cmp dword [ebp - 4], eax
je 0x10048068
push str.Purging_StartIsBack_cache_directory
call fcn.10001be0
push 0x208
lea eax, [ebp - 0x34c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
lea ecx, [ebp - 0x34c]
call fcn.1001cb50
lea eax, [ebp - 0x34c]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x28], eax
xorps xmm0, xmm0
mov eax, 0x614
mov dword [ebp - 0x24], 0
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x30]
push eax
movlpd qword [ebp - 0x1e], xmm0
mov dword [ebp - 0x16], 0
mov dword [ebp - 0x2c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0x138]
push 4
push eax
push 4
push 0x10058088
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
call edi
movzx eax, ax
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push str.WinLangID
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 8
lea eax, [ebp - 0x10]
push eax
push 3
push str.StartMenu_Start_Time
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartPage
push SHChangeNotifyRegister
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x100474b0
push 0x10058658
push str.kernelbase.dll
mov dword [0x1005dc48], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x1005dc10]
mov edx, str.API_MS_WIN_CORE_REGISTRY_L1_1_0.DLL
push eax
call fcn.1001c730
test eax, eax
jne 0x100480b8
push str.ChangeImportedAddress_g_hExplorer___API_MS_WIN_CORE_REGISTRY_L1_1_0.DLL___GetProcAddress_GetModuleHandle_L_kernelbase.dll_____RegGetValueW____Explorer_RegGetValue_
push str.SIB_ASSERTION_FAILED:__s
call fcn.10001be0
add esp, 8
mov ecx, dword [0x1005dc0c]
mov edx, 0x10045e70
push 0
call fcn.10024560
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
add esp, 4
push 0
push str.ReBarWindow32
push 0
push dword [0x1005dc0c]
call esi
push 0
push str.MSTaskSwWClass
push 0
push eax
call esi
push 0x100470b0
push 0xfffffffffffffffc
push eax
mov dword [0x1005e0c4], eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push str.MSTaskListWClass
push 0
push dword [0x1005e0c4]
mov dword [0x1005e1ec], eax
call esi
mov ecx, eax
call fcn.10039e00
push 0
push 9
push 0
push 0x10045d40
call dword [sym.imp.SHLWAPI.dll_SHCreateThread]
mov ecx, dword [0x1005dc10]
mov edx, str.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll
push 0x10045cd0
push 0x10058734
call fcn.1001c5e0
mov ecx, dword [0x1005dc10]
mov edx, 0x1004fd78
push 0x10045cd0
push dword [sym.imp.USER32.dll_PeekMessageW]
mov esi, eax
call fcn.1001c730
or eax, esi
jne 0x1004817e
push str.hookedPeekMessage
push str.SIB_ASSERTION_FAILED:__s
call fcn.10001be0
add esp, 8
mov eax, dword [0x1005dc70]
test eax, eax
je 0x1004818b
push 1
call eax
call fcn.10006b10
call fcn.10045c20
call fcn.100401b0
call fcn.1003ff50
call fcn.1000eba0
mov ecx, dword [0x1005dbf8]
mov edx, 0x1004fd78
push 0x100067b0
push dword [sym.imp.USER32.dll_DialogBoxParamW]
call fcn.1001c730
mov ecx, dword [0x1005dc10]
mov edx, str.kernel32.dll
push 0x100475a0
push dword [sym.imp.KERNEL32.dll_MulDiv]
call fcn.1001c730
push 0x100475a0
push 0x10058768
push str.kernelbase.dll
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x1005dc10]
mov edx, str.api_ms_win_core_largeinteger_l1_1_0.dll
push eax
call fcn.1001c730
mov ecx, dword [0x1005dc10]
mov edx, 0x1004fd78
push 0x100476e0
push dword [0x1005dc40]
call fcn.1001c730
mov ecx, dword [0x1005dc10]
mov edx, str.API_MS_WIN_CORE_COM_L1_1_0.DLL
push 0x10047950
push dword [0x1005dc88]
call fcn.1001c730
mov ecx, dword [0x1005dc10]
mov edx, str.API_MS_WIN_CORE_COM_L1_1_1.DLL
push 0x10047950
push dword [0x1005dc88]
mov esi, eax
call fcn.1001c730
pop edi
or eax, esi
pop esi
jne 0x1004826e
push str.patchedCoCreateInstance
push str.SIB_ASSERTION_FAILED:__s
call fcn.10001be0
add esp, 8
mov ecx, dword [0x1005dc10]
mov edx, str.API_MS_WIN_CORE_WINRT_L1_1_0.DLL
push 0x10047d60
push dword [sym.imp.api_ms_win_core_winrt_l1_1_0.dll_RoActivateInstance]
call fcn.1001c730
test eax, eax
jne 0x1004829f
push str.patchedRoActivateInstance
push str.SIB_ASSERTION_FAILED:__s
call fcn.10001be0
add esp, 8
mov ecx, dword [0x1005dc10]
mov edx, str.shell32.dll
push 0x10047e40
push dword [sym.imp.SHELL32.dll_SHGetImageList]
call fcn.1001c730
test eax, eax
jne 0x100482d0
push str.patchedSHGetImageList
push str.SIB_ASSERTION_FAILED:__s
call fcn.10001be0
add esp, 8
mov ecx, dword [0x1005dc10]
mov edx, str.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll
push 0x10047500
push 0x100587f0
call fcn.1001c5e0
push pe_nt_image_headers32
mov dword [0x1005e1f8], eax
lea eax, [ebp - 0x140]
push 0
push eax
mov dword [ebp - 0x144], 0x114
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x138], 0x4777
jb 0x10048343
cmp dword [0x1005e1f8], 0
jne 0x10048343
push str.hookedGetAncestor
push str.SIB_ASSERTION_FAILED:__s
call fcn.10001be0
add esp, 8
mov esp, ebp
pop ebp
ret