joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6aff5918
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x1cd834ca
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10002200
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10002219
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10002254
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x10002250
lea ebx, [ebx]
cmp esi, eax
jae 0x10002254
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10002240
cmp esi, eax
jb 0x1000225a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x10003520
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
push esi
push edi
mov esi, ecx
cmp eax, 0x204
ja 0x10003684
je case.0x10003662.8
cmp eax, 0x100
je 0x10003650
cmp eax, 0x201
jne 0x10003690
test esi, esi
je 0x10003690
cmp dword [esi + 0x20], 0
je 0x10003690
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.1005d626
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
sub dword [esp + 0x20], 0x24
push ecx
add eax, 0x24
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x2c], eax
call fcn.100021c0
test eax, eax
je 0x10003602
movzx edi, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edi, 0x10
mov ecx, esi
or edi, eax
call fcn.10002540
mov ecx, dword [eax + 0x20]
push edi
push 2
push 0xa1
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
push ebx
mov ecx, esi
call fcn.1005c797
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x18], eax
add eax, 0x24
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x20]
call fcn.100021c0
test eax, eax
je 0x10003690
mov ecx, esi
call fcn.10002540
mov ecx, dword [eax + 0x20]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
push ebx
mov ecx, esi
call fcn.1005c797
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 8]
add eax, 0xfffffff8
cmp eax, 0x73
ja case.0x10003662.10
movzx edx, byte [eax + 0x100036ac]
jmp dword [edx*4 + 0x100036a4]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x10003690
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
sub eax, 0x206
je case.0x10003662.8
sub eax, 4
je case.0x10003662.8
push ebx
mov ecx, esi
call fcn.1005c797
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10005aa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100ad378
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push edi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.10060e04
mov ecx, eax
call fcn.1005d626
cmp dword [esi + 0xa4], 0
je 0x10005b14
lea ecx, [esi + 0xa0]
call fcn.1005d930
mov dword [esp + 0xc], 0
mov dword [esp + 8], vtable.CBitmap.0
mov dword [esp + 0x38], 0
test edi, edi
jne 0x10005b34
xor eax, eax
jmp 0x10005b37
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esi + 0xa0]
call fcn.1005d8c7
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x10]
push eax
mov eax, dword [edi + 4]
push ecx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [esp + 0xc]
call fcn.1005db99
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0xa4]
push ecx
push edx
call fcn.1005dc28
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
mov edi, dword [edi + 4]
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x10]
push 0xcc0020
push edx
mov edx, dword [esp + 0x28]
push edx
push edi
push eax
mov eax, dword [esi + 0xa4]
push ecx
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
lea ecx, [esp + 8]
mov byte [esi + 0x9c], 1
call fcn.1005dbf1
mov ecx, dword [esi + 0x20]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 8]
mov dword [esp + 8], vtable.CBitmap.0
call fcn.10002760
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x34
ret
Function at 0x1000b2c0
Capabilities:
Create thread

Disassembly:
sub esp, 0x1c
cmp dword [edi + 0x3c], 0
push ebx
lea ebx, [edi + 0x3c]
push ebp
mov ebp, dword [esp + 0x28]
je 0x1000b2dd
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x1c
ret 0xc
mov ecx, eax
push esi
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x1000b2e3
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [edi + 4]
call fcn.1000cac0
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000b300
sub eax, edx
sar eax, 1
push eax
lea esi, [edi + 0x20]
mov eax, ebp
call fcn.1000cac0
mov eax, dword [esp + 0x30]
push 0
push 0
push edi
push 0x1000ad70
push 0
push 0
mov dword [edi + 0x6c], eax
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx], eax
mov eax, dword [esp + 0x34]
mov dword [edi + 0x64], eax
test eax, eax
je 0x1000b3a5
mov esi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0x4ff
push 0xffffffffffffffff
push 0
push ebx
push 1
call esi
test eax, eax
je 0x1000b392
mov ebp, dword [sym.imp.USER32.dll_PeekMessageW]
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
call ebp
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0x4ff
push 0xffffffffffffffff
push 0
push ebx
push 1
call esi
test eax, eax
jne 0x1000b366
mov eax, dword [ebx]
test eax, eax
je 0x1000b3a5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx], 0
mov eax, dword [edi + 0x5c]
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc

Function at 0x1000c8e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x100ac39b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.1009ccd3
push 4
mov dword [esp + 0x20], 0
call fcn.1005c16c
mov edi, eax
add esp, 4
test edi, edi
je 0x1000c95e
call fcn.1009d11f
mov dword [edi], eax
call fcn.1009cf4c
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.1009ce70
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x1000c953
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.1009ce98
jmp 0x1000c960
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x10011020
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x210
mov eax, dword [0x100e18d0]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, edx
push esi
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10011040
sub eax, esi
sar eax, 1
jne 0x10011069
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.1007fe37
add esp, 0x210
ret
push 0x104
lea eax, [esp + 0xc]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10011083
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, edi
call fcn.10002a80
mov ecx, dword [esp + 0x210]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1007fe37
add esp, 0x210
ret

Function at 0x10011d80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100b03b0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov dword [esp + 0x1c], 1
mov eax, dword [esp + 0x2c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x10], esp
mov esi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x24], 2
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [esi], eax
add esp, 4
lea eax, [esp + 0x10]
push eax
mov byte [esp + 0x28], 1
call fcn.10011320
mov ecx, dword [esp + 0x24]
mov byte [esp + 0x1c], 3
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
push edx
add ecx, 0x24
push eax
call fcn.10003ce0
mov byte [esp + 0x1c], 1
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10011e31
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1c], 0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10011e56
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10011e7e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret 0xc
Function at 0x10012e60
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x100ad276
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x100e18d0]
xor eax, esp
mov dword [esp + 0x244], eax
push ebx
push esi
push edi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x25c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x26c]
lea edi, [eax + 0xa0]
mov esi, ecx
call fcn.10013ef0
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x56]
push ecx
mov word [esp + 0x58], ax
call fcn.10083840
push 0x104
lea edx, [esp + 0x5c]
push 0
push edx
call fcn.10083840
add esp, 0x18
push esi
push 0x104
lea eax, [esp + 0x54]
push eax
push 0
push str.DefaultSubKey
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x4c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10012f00
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x50]
mov esi, edi
call fcn.1000cac0
push 0x100c06a4
mov ebx, 1
xor eax, eax
mov edx, edi
call fcn.100149a0
push edi
mov ecx, eax
xor edx, edx
lea esi, [esp + 0x34]
call fcn.10013f90
push 0xffffffffffffffff
push 0
mov ecx, edi
mov dword [esp + 0x26c], 0
call fcn.1000ca10
mov dword [esp + 0x264], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x10012f71
mov ecx, dword [esp + 0x34]
push ecx
call fcn.1005c1a6
add esp, 4
push 0x100c064c
mov esi, edi
lea ebx, [esp + 0x18]
call fcn.10012d50
add esp, 4
push 0xffffffffffffffff
push 0
mov ecx, edi
mov dword [esp + 0x26c], 1
call fcn.1000ca10
cmp dword [esp + 0x2c], 8
jb 0x10012fae
mov edx, dword [esp + 0x18]
push edx
call fcn.1005c1a6
add esp, 4
cmp dword [edi + 0x18], 8
jb 0x10012fb9
mov eax, dword [edi + 4]
jmp 0x10012fbc
lea eax, [edi + 4]
mov ecx, dword [esp + 0x25c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.1007fe37
add esp, 0x258
ret 4
Function at 0x1001da00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100ac866
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x1c]
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.10002b60
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x18], 0
mov eax, dword [edi + 4]
sub eax, 0x10
push eax
call fcn.10002b60
add eax, 0x10
mov dword [esi + 4], eax
mov byte [esp + 0x1c], 1
mov eax, dword [edi + 8]
sub eax, 0x10
push eax
call fcn.10002b60
add eax, 0x10
mov dword [esi + 8], eax
mov byte [esp + 0x20], 2
mov eax, dword [edi + 0xc]
sub eax, 0x10
push eax
call fcn.10002b60
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [esp + 0x24], 3
mov eax, dword [edi + 0x10]
sub eax, 0x10
push eax
call fcn.10002b60
add eax, 0x10
mov dword [esi + 0x10], eax
mov byte [esp + 0x28], 4
mov eax, dword [edi + 0x14]
sub eax, 0x10
push eax
call fcn.10002b60
add eax, 0x10
mov dword [esi + 0x14], eax
mov byte [esp + 0x2c], 5
mov eax, dword [edi + 0x18]
sub eax, 0x10
push eax
call fcn.10002b60
add eax, 0x10
mov dword [esi + 0x18], eax
mov byte [esp + 0x30], 6
mov eax, dword [edi + 0x1c]
sub eax, 0x10
push eax
call fcn.10002b60
add eax, 0x10
mov dword [esi + 0x1c], eax
mov byte [esp + 0x34], 7
mov eax, dword [edi + 0x20]
sub eax, 0x10
push eax
call fcn.10002b60
add eax, 0x10
mov dword [esi + 0x20], eax
mov byte [esp + 0x38], 8
mov eax, dword [edi + 0x24]
sub eax, 0x10
push eax
call fcn.10002b60
add eax, 0x10
mov dword [esi + 0x24], eax
mov byte [esp + 0x3c], 9
mov eax, dword [edi + 0x28]
sub eax, 0x10
push eax
call fcn.10002b60
add eax, 0x10
mov dword [esi + 0x28], eax
mov byte [esp + 0x40], 0xa
mov edi, dword [edi + 0x2c]
sub edi, 0x10
push edi
call fcn.10002b60
add esp, 0x30
add eax, 0x10
mov dword [esi + 0x2c], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x100215b0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100ae5c8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x100e18d0]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
push eax
push edi
mov dword [esp + 0x14], ebx
call fcn.10074ee6
push 0x40
lea ecx, [esp + 0x18]
push ebx
push ecx
mov dword [esp + 0x18], vtable.CMD5Checksum.0
mov dword [esp + 0x1c], ebx
call fcn.10083840
add esp, 0xc
mov dword [esp + 0x58], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x5c], 0x67452301
mov dword [esp + 0x60], 0xefcdab89
mov dword [esp + 0x64], 0x98badcfe
mov dword [esp + 0x68], 0x10325476
mov eax, dword [ebp + 8]
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x84], ebx
call fcn.100220c0
push esi
lea ecx, [esp + 0x10]
call fcn.10021ea0
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.1007fe37
mov esp, ebp
pop ebp
ret 4
Function at 0x10021e50
Capabilities:
Hash data with md5

Disassembly:
push 0x40
lea eax, [esi + 8]
push 0
push eax
mov dword [esi], vtable.CMD5Checksum.0
mov dword [esi + 4], 0
call fcn.10083840
add esp, 0xc
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x50], 0x67452301
mov dword [esi + 0x54], 0xefcdab89
mov dword [esi + 0x58], 0x98badcfe
mov dword [esi + 0x5c], 0x10325476
mov eax, esi
ret

Function at 0x10028e80
Capabilities:
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x100afaf1
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x100e18d0]
xor eax, esp
mov dword [esp + 0x6c], eax
push edi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
push 0x40
lea eax, [esp + 0x20]
mov dword [esp + 0x84], 1
push edi
push eax
mov dword [esp + 0x20], vtable.CMD5Checksum.0
mov dword [esp + 0x24], edi
call fcn.10083840
add esp, 0xc
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x64], 0x67452301
mov dword [esp + 0x68], 0xefcdab89
mov dword [esp + 0x6c], 0x98badcfe
mov dword [esp + 0x70], 0x10325476
mov byte [esp + 0x80], 2
call fcn.1005e14e
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x10028f2a
push 0x80004005
call fcn.10002b30
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x88]
push ecx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x10], esp
mov edi, esp
push eax
mov dword [esp + 0x18], 1
call fcn.10002b60
add eax, 0x10
add esp, 4
lea ecx, [esp + 0x10]
mov dword [edi], eax
call fcn.10021680
mov byte [esp + 0x84], 3
mov edx, dword [eax]
push edx
push str.https:__www.gravatar.com_avatar__s_dmps_d
push esi
call fcn.10002730
mov byte [esp + 0x90], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10028fb1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x80], 0
mov eax, dword [esp + 0x88]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10028fdc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.1007fe37
add esp, 0x7c
ret
Function at 0x1002bcb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100af964
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
push 0xfb0
push esi
call fcn.10043120
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.CMyAccountGADlg.0
call fcn.1005e14e
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x1002bd09
push 0x80004005
call fcn.10002b30
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x108], eax
push 0x100e6a88
mov dword [esi + method.ATL::CImage.virtual_0], vtable.ATL::CImage.0
mov dword [esi + 0x110], ebx
mov dword [esi + 0x114], ebx
mov dword [esi + 0x118], ebx
mov dword [esi + 0x11c], ebx
mov dword [esi + 0x120], ebx
mov dword [esi + 0x124], ebx
mov byte [esi + 0x128], bl
mov byte [esi + 0x129], bl
mov dword [esi + 0x12c], 0xffffffff
mov dword [esi + 0x130], ebx
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [0x100e6aa0]
push 0x100e6a88
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [esp + 0x1c], 2
lea edi, [esi + 0x13c]
call fcn.1005e14e
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x1002bdb2
push 0x80004005
call fcn.10002b30
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x1c], 3
call fcn.1005e14e
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x1002bddf
push 0x80004005
call fcn.10002b30
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x140], eax
lea ecx, [esi + 0x148]
push ecx
mov byte [esp + 0x20], 4
call fcn.100362d0
lea edx, [esi + 0x6c0]
push edx
mov byte [esp + 0x20], 5
call fcn.100362d0
lea eax, [esi + 0xc38]
push eax
mov byte [esp + 0x20], 6
call fcn.1003d220
lea ecx, [esi + 0xd30]
push ecx
mov byte [esp + 0x20], 7
call fcn.1003d220
lea edx, [esi + 0xe28]
push edx
mov byte [esp + 0x20], 8
call fcn.1003d220
lea eax, [esi + 0xf20]
push eax
mov byte [esp + 0x20], 9
call fcn.10047c20
lea ebp, [esi + 0x1058]
mov ecx, ebp
mov byte [esp + 0x1c], 0xa
call fcn.1005f9bd
mov dword [ebp], vtable.CStatic.0
push ebx
push 0xffffffffffffffff
push str.Window_Caption_Color
push str.My_Account_GA_Dlg
push str.Register
mov byte [esp + 0x30], 0xb
call sub.SkinsManager.dll_GetSkinsColor
add esp, 0x14
push 0x1b
push str.Glarysoft_File_Recovery_Pro
mov ecx, edi
mov dword [esi + 0xf0], eax
mov dword [esi + 0xf4], 0xffffff
mov dword [esi + 0xfc], 0x274ffe
mov dword [esi + 0xf8], 0x72553b
mov dword [esi + 0x100], ebx
call fcn.10002a80
mov dword [esi + 0x104], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x1002c6c0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b8
mov eax, dword [0x100e18d0]
xor eax, esp
mov dword [esp + 0x2b4], eax
push 0x2b4
lea eax, [esp + 4]
push 0
push eax
call fcn.10083840
mov edx, dword [esp + 0x2c8]
add esp, 0xc
push 0x710
push 0x2b4
lea ecx, [esp + 8]
push ecx
push 0x80
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp]
test eax, eax
je 0x1002c762
push 0
push eax
mov eax, dword [esi + 0x20]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x2bc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1002c746
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x2b4]
xor ecx, esp
call fcn.1007fe37
add esp, 0x2b8
ret 4
mov eax, dword [esp + 0x2bc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1002c785
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x2b4]
xor ecx, esp
xor eax, eax
call fcn.1007fe37
add esp, 0x2b8
ret 4
Function at 0x10030130
Capabilities:
Check if file exists

Disassembly:
push ecx
push ebx
test esi, esi
je 0x1003017d
mov eax, esi
lea edx, [eax + 2]
jmp 0x10030140
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10030140
sub eax, edx
sar eax, 1
je 0x1003017d
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1003017d
mov eax, edi
call fcn.10030190
push esi
lea ebx, [edi + 0x8ba0]
push ebx
call fcn.10006a40
call fcn.100424a0
mov eax, 1
pop ebx
pop ecx
ret
xor eax, eax
pop ebx
pop ecx
ret