joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10053f40
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x100b20c0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x2c], 4
mov eax, dword [esp + 0x44]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x10], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x34], 5
mov edi, esp
mov dword [esp + 0x18], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.http:__myaccount.glarysoft.com_openapi.php_lr_expire_time
call fcn.10002440
push edi
mov ecx, esi
call fcn.10051af0
mov byte [esp + 0x34], 6
mov eax, dword [esp + 0x48]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x3c], 7
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
mov dword [esp + 0x28], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x40], 8
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
mov dword [esp + 0x30], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x44], 9
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
mov dword [esp + 0x38], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov ecx, esi
mov byte [esp + 0x44], 4
call fcn.100538e0
mov esi, eax
mov byte [esp + 0x2c], 3
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10054057
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c], 2
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1005407c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c], 1
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100540a1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c], 0
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100540c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100540ee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 0x14
Function at 0x10054110
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x100b4018
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
push ecx
mov dword [esp + 0x30], 0
mov ecx, esp
mov dword [esp + 0x14], esp
push str.http:__myaccount.glarysoft.com_openapi.php_lr_set_license
call fcn.10002440
mov byte [esp + 0x30], 1
mov eax, dword [esi + 0x22c]
push ecx
sub eax, 0x10
mov dword [esp + 0x1c], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x38], 2
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x3c], 3
mov eax, dword [esi + 0xc]
sub eax, 0x10
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x40], 4
mov eax, dword [esi + 8]
sub eax, 0x10
mov dword [esp + 0x34], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov ecx, esi
mov byte [esp + 0x40], 0
call fcn.10053f40
mov esi, eax
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100541fe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 4
Function at 0x10054650
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x100b20c0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x2c], 4
mov eax, dword [esp + 0x44]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x10], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x34], 5
mov edi, esp
mov dword [esp + 0x18], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.http:__myaccount.glarysoft.com_openapi.php_lr_expire_time
call fcn.10002440
push edi
mov ecx, esi
call fcn.10051af0
mov byte [esp + 0x34], 6
mov eax, dword [esp + 0x48]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x3c], 7
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
mov dword [esp + 0x28], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x40], 8
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
mov dword [esp + 0x30], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x44], 9
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
mov dword [esp + 0x38], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov ecx, esi
mov byte [esp + 0x44], 4
call fcn.10054220
mov esi, eax
mov byte [esp + 0x2c], 3
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10054767
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c], 2
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1005478c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c], 1
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100547b1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c], 0
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100547d6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100547fe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 0x14
Function at 0x10054d20
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x100b2048
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
push ecx
mov dword [esp + 0x30], 2
mov ecx, esp
mov dword [esp + 0x14], esp
push str.http:__myaccount.glarysoft.com_openapi.php_lr_tsou
call fcn.10002440
push ecx
mov byte [esp + 0x34], 3
mov edi, esp
mov dword [esp + 0x1c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.http:__myaccount.glarysoft.com_openapi.php_lr_expire_time
call fcn.10002440
push edi
mov ecx, esi
call fcn.10051af0
mov byte [esp + 0x34], 4
mov eax, dword [esp + 0x44]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x3c], 5
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x40], 6
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
mov dword [esp + 0x34], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov ecx, esi
mov byte [esp + 0x40], 2
call fcn.10054820
mov esi, eax
mov byte [esp + 0x2c], 1
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10054e13
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c], 0
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10054e38
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10054e60
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 0xc
Function at 0x10056120
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x100ad559
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
xor edi, edi
mov dword [esp + 0x28], edi
push 0x100bec10
mov ecx, ebx
mov dword [esp + 0x18], edi
call fcn.10002440
push edi
mov dword [esp + 0x2c], edi
push ebp
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0x34
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
je 0x100561f7
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1005c19b
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100561ee
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x100c0044
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100561ee
mov eax, dword [esp + 0x1c]
movzx edx, word [eax + 0xc]
movzx ecx, word [eax + 0xe]
push edx
movzx edx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push edx
push eax
push str._d._d._d._d
push ebx
call fcn.10002730
add esp, 0x18
push edi
call fcn.1005c1a6
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x100566b0
Capabilities:
Get hostname

Disassembly:
push 0xffffffffffffffff
push 0x100ad4d9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x18], ebp
call fcn.1005e14e
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x100566ff
push 0x80004005
call fcn.10002b30
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], ebp
mov edi, dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push ecx
push ebp
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], ebp
call edi
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1005c19b
mov esi, eax
add esp, 4
lea eax, [esp + 0x14]
push eax
push esi
call edi
test eax, eax
je 0x1005677b
cmp esi, ebp
jne 0x1005675e
xor eax, eax
jmp 0x10056772
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x10056763
sub eax, edx
sar eax, 1
push eax
push esi
mov ecx, ebx
call fcn.10002a80
push esi
call fcn.1005c1a6
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x100567a0
Capabilities:
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x100ad4d9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x18], ebp
call fcn.1005e14e
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x100567ef
push 0x80004005
call fcn.10002b30
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], ebp
mov edi, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push ecx
push ebp
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], ebp
call edi
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1005c19b
mov esi, eax
add esp, 4
lea eax, [esp + 0x14]
push eax
push esi
call edi
test eax, eax
je 0x1005686b
cmp esi, ebp
jne 0x1005684e
xor eax, eax
jmp 0x10056862
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x10056853
sub eax, edx
sar eax, 1
push eax
push esi
mov ecx, ebx
call fcn.10002a80
push esi
call fcn.1005c1a6
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x1005a2d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100b3160
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
push ecx
mov dword [esp + 0x28], 0
mov eax, esp
mov dword [esp + 0x10], esp
push eax
call fcn.10059780
mov byte [esp + 0x28], 1
mov eax, dword [esi + 0x16c]
push ecx
sub eax, 0x10
mov dword [esp + 0x18], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x30], 2
mov eax, dword [esi + 8]
sub eax, 0x10
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x34], 3
mov eax, dword [esi + 0x22c]
sub eax, 0x10
mov dword [esp + 0x28], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
add esp, 4
add esi, 0x4c
mov byte [esp + 0x34], 0
call fcn.1004ca10
mov eax, dword [esp + 0x2c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
add esp, 4
mov ecx, esi
mov dword [edi], eax
call fcn.1004e900
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1005a3c4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 4

Function at 0x1005cfa5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x1005cfc9
cmp dword [edi + 0x54], 0
jne 0x1005cfc9
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.100707c9
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.1005cf66
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10063c83
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x10063cca
call fcn.100707c9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10063cca
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x10063ce6
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.100637fb
mov esi, eax
test edi, edi
je 0x10063ce4
test ebx, ebx
je 0x10063ce4
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100644e3
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x100a9771
call fcn.10083634
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x10064508
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1006454e
lea ecx, [ebp - 0x10]
call fcn.10002680
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1005c20a
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.10002bd0
mov eax, esi
call fcn.1008370c
ret 8

Function at 0x1006dd10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x1006dd58
call fcn.100707c9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1006dd58
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x1006dd9b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x1006dd84
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x1006dd84
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x1006dd98
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1007269b
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x100726c6
call fcn.100707c9
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
jne 0x100726e9
push eax
push dword [esi + 4]
call fcn.10072621
push esi
push eax
mov ecx, 0x100e5a54
call fcn.100722a8
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x10072fe8
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x100aa538
call fcn.10083634
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x20]
mov edi, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
call fcn.10072fa8
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.10002680
push dword [esi + 8]
mov edi, dword [edi + 8]
push dword [ebp + 0x10]
mov byte [ebp - 4], 1
push 3
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi + 4], eax
test eax, eax
jne 0x1007304f
push eax
push dword [esi + 8]
call fcn.10072621
push dword [esi + 0xc]
mov ecx, 0x100e5a54
push eax
call fcn.100722a8
mov eax, esi
call fcn.1008370c
ret 0x1c

Function at 0x1007fe37
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100e18d0]
jne 0x1007fe41
repz ret
jmp fcn.10087019

Function at 0x100970ad
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100892ae
and dword [ebp - 4], 0
cmp dword [0x100e6848], 0
mov ebx, eax
jne 0x1009715e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1009720f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1009720f
push eax
call fcn.1008923c
mov dword [esp], 0x100bc858
push edi
mov dword [0x100e6848], eax
call esi
push eax
call fcn.1008923c
mov dword [esp], 0x100bc844
push edi
mov dword [0x100e684c], eax
call esi
push eax
call fcn.1008923c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100e6850], eax
call esi
push eax
call fcn.1008923c
pop ecx
mov dword [0x100e6858], eax
test eax, eax
je 0x1009715e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1008923c
pop ecx
mov dword [0x100e6854], eax
mov eax, dword [0x100e6854]
cmp eax, ebx
je 0x100971b6
cmp dword [0x100e6858], ebx
je 0x100971b6
push eax
call fcn.100892b7
push dword [0x100e6858]
mov esi, eax
call fcn.100892b7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100971b6
test edi, edi
je 0x100971b6
call esi
test eax, eax
je 0x100971ad
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100971ad
test byte [ebp - 0xc], 1
jne 0x100971b6
or dword [ebp + 0x10], 0x200000
jmp 0x100971ef
mov eax, dword [0x100e684c]
cmp eax, ebx
je 0x100971ef
push eax
call fcn.100892b7
pop ecx
test eax, eax
je 0x100971ef
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100971ef
mov eax, dword [0x100e6850]
cmp eax, ebx
je 0x100971ef
push eax
call fcn.100892b7
pop ecx
test eax, eax
je 0x100971ef
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100e6848]
call fcn.100892b7
pop ecx
test eax, eax
je 0x1009720f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10097211
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret