joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10045300
Capabilities:
Check if file exists

Disassembly:
push ecx
push ebx
test esi, esi
je 0x1004534d
mov eax, esi
lea edx, [eax + 2]
jmp 0x10045310
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10045310
sub eax, edx
sar eax, 1
je 0x1004534d
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1004534d
mov eax, edi
call fcn.10045ef0
push esi
lea ebx, [edi + 0x6180]
push ebx
call fcn.10006a40
call fcn.100424a0
mov eax, 1
pop ebx
pop ecx
ret
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x100488c0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x100ac678
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x24]
cmp dword [ebp + 0x98], 0
jne 0x10048a04
call fcn.100707c9
mov ebx, dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f89
push 0
call ebx
mov dword [ebp + 0x98], eax
test eax, eax
jne 0x10048a04
call fcn.1005e14e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x10048931
push 0x80004005
call fcn.10002b30
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x24], esi
mov dword [esp + 0x1c], 0
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x1004896f
push 0x104
lea ecx, [esp + 0x28]
call fcn.100029d0
mov esi, dword [esp + 0x24]
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.10081cd7
add esp, 8
test eax, eax
jl 0x10048a1a
cmp eax, dword [esi - 8]
jg 0x10048a1a
xor ecx, ecx
mov dword [esi - 0xc], eax
push 0xd
mov word [esi + eax*2], cx
push str.winhlp32.exe
lea ecx, [esp + 0x2c]
call fcn.10003ce0
mov edi, dword [esp + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x100489e0
push 0x6a
push esi
call ebx
test eax, eax
je 0x100489d9
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [ebp + 0x98], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [edi - 0x10]
mov dword [esp + 0x1c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10048a04
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
push 0x80070057
call fcn.10002b30
int3

Function at 0x10048a30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x100e18d0]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x214]
push edi
mov edi, dword [eax]
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push edi
mov dword [esp + 0x14], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea eax, [esp + 8]
mov edx, esi
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10048a73
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x210]
pop edi
xor ecx, esp
xor eax, eax
call fcn.1007fe37
add esp, 0x210
ret
Function at 0x10048ab0
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x100e18d0]
xor eax, ebp
mov dword [ebp + 0x39c], eax
push ebx
push esi
push edi
mov dword [ebp - 0x80], ecx
test ecx, ecx
je 0x10048c8a
cmp word [ecx], 0
je 0x10048c8a
cmp dword [ebp + 0x3a8], 0
mov eax, str.open
je 0x10048af6
mov eax, 0x100c9f78
push 5
push 0
push 0
push ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x7c], eax
cmp eax, 0x20
ja 0x10048c85
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x78]
push eax
push 1
push 0
push str..htm
push SysReAllocStringLen
call ebx
test eax, eax
jne 0x10048c85
lea ecx, [ebp - 0x78]
push ecx
lea esi, [ebp - 0x74]
call fcn.10048a30
add esp, 4
test eax, eax
jne 0x10048c85
mov edi, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10048b50
lea edx, [ebp - 0x78]
push edx
push 1
push 0
lea eax, [ebp - 0x74]
push eax
mov ecx, 0xa
mov esi, str._shellopencommand
push SysReAllocStringLen
rep movsd dword es:[edi], dword [esi]
call ebx
test eax, eax
jne 0x10048c85
lea ecx, [ebp - 0x78]
push ecx
lea esi, [ebp - 0x74]
call fcn.10048a30
add esp, 4
test eax, eax
jne 0x10048c85
mov edx, esi
push 0x100c9fb4
push edx
call fcn.10080676
add esp, 8
test eax, eax
jne 0x10048be3
mov eax, esi
push 0x100c9fc0
push eax
call fcn.10080676
add esp, 8
test eax, eax
jne 0x10048bdc
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10048bc7
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 - 0x76]
jmp 0x10048be8
xor ecx, ecx
mov word [eax], cx
jmp 0x10048be8
xor edx, edx
mov word [eax], dx
mov edi, eax
add edi, 0xfffffffe
lea ecx, [ecx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10048bf0
mov ecx, dword [0x100c064c]
mov dword [edi], ecx
mov ecx, dword [ebp - 0x80]
mov esi, ecx
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x10048c10
sub ecx, esi
add eax, 0xfffffffe
mov edx, ecx
mov edi, eax
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10048c24
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x74]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x10048c60
xor eax, eax
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x7c], eax
jmp 0x10048c8f
lea esi, [eax + eax]
mov eax, esi
call fcn.10085780
mov eax, esp
push 3
push esi
lea ecx, [ebp - 0x74]
push ecx
push eax
call fcn.10012110
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
jmp 0x10048c8f
mov eax, 0x24
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
xor ecx, ebp
call fcn.1007fe37
add ebp, 0x3a0
mov esp, ebp
pop ebp
ret
Function at 0x10048d70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100ad378
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push edi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], vtable.CBitmap.0
lea eax, [esp + 0x10]
mov dword [esp + 0x38], 0
mov ecx, dword [esi + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.10060e04
mov ecx, eax
call fcn.1005d626
cmp dword [esi + 0x124], 0
je 0x10048dfc
lea ecx, [esi + 0x120]
call fcn.1005d930
test edi, edi
jne 0x10048e04
xor eax, eax
jmp 0x10048e07
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esi + 0x120]
call fcn.1005d8c7
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x10]
push eax
mov eax, dword [edi + 4]
push ecx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [esp + 0xc]
call fcn.1005db99
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x124]
push ecx
push edx
call fcn.1005dc28
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
mov edi, dword [edi + 4]
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x10]
push 0xcc0020
push edx
mov edx, dword [esp + 0x28]
push edx
push edi
push eax
mov eax, dword [esi + 0x124]
push ecx
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
lea ecx, [esp + 8]
call fcn.1005dbf1
mov ecx, dword [esi + 0x20]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 8]
mov dword [esp + 8], vtable.CBitmap.0
call fcn.10002760
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x34
ret
Function at 0x10049e10
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10049e20
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x10049e2c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x10049e36
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10049e40
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x10049e4a
or eax, 8
shr ecx, 1
test cl, 1
je 0x10049e54
or eax, 4
shr ecx, 1
test cl, 1
je 0x10049e5e
or eax, 2
test cl, 2
je 0x10049e66
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10049f20
test al, 1
je 0x10049f2d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10049f20
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x10049e14
pop edi
pop ebx
ret
Function at 0x1004a450
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x100ad908
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
push 0x100bec10
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], 0
call fcn.10002440
mov dword [esp + 0x24], 0
mov dword [esp + 0x10], 0x34
test ebp, ebp
je 0x1004a57f
mov eax, ebp
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1004a4b0
sub eax, edx
sar eax, 1
je 0x1004a57f
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x1004a548
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1005c19b
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1004a53f
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x100c0044
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1004a53f
mov eax, dword [esp + 0x14]
movzx edx, word [eax + 0xc]
movzx ecx, word [eax + 0xe]
push edx
movzx edx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push edx
push eax
lea ecx, [esp + 0x40]
push str._d._d._d._d
push ecx
call fcn.10002730
add esp, 0x18
push edi
call fcn.1005c1a6
add esp, 4
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
push eax
call fcn.10002b60
mov esi, dword [esp + 0x30]
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x1004a5ab
mov esi, dword [esp + 0x2c]
push 0x100bec10
mov ecx, esi
call fcn.10002440
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1004a5b7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret 8
Function at 0x1004cbc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100acc11
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x100e18d0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x44], 0
mov esi, 1
mov dword [ebp - 4], esi
call fcn.1005e14e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x1004cc1c
push 0x80004005
call fcn.10002b30
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 0x44], esi
lea esi, [ebp - 0x444]
call fcn.10049e10
mov eax, dword [ebp + 8]
mov ebx, eax
test eax, eax
jne 0x1004cc45
xor edx, edx
jmp 0x1004cc8f
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x1004cc88
lea edi, [eax + eax]
mov eax, edi
call fcn.10085780
mov esi, esp
test esi, esi
je 0x1004cc85
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 3
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, dword [ebp - 0x40]
neg eax
sbb eax, eax
and eax, esi
jmp 0x1004cc8a
mov edi, dword [ebp - 0x40]
xor eax, eax
mov edx, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
or eax, 0xffffffff
test ecx, ecx
je 0x1004ccb6
movzx ebx, byte [edx]
mov esi, eax
and esi, 0xff
xor esi, ebx
shr eax, 8
xor eax, dword [ebp + esi*4 - 0x444]
dec ecx
inc edx
test ecx, ecx
jne 0x1004cc99
push 0x10
lea ecx, [ebp - 0x3c]
not eax
push ecx
push eax
call fcn.10082778
lea edx, [ebp - 0x3c]
push edx
push str._08s
push edi
call fcn.10002730
mov byte [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
add esp, 0x18
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1004ccf9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
lea esp, [ebp - 0x454]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007fe37
mov esp, ebp
pop ebp
ret 4
Function at 0x1004cd20
Capabilities:
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x100af460
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x100e18d0]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 8], esi
push 0x40
lea eax, [esp + 0x18]
mov dword [esp + 0x80], esi
push esi
push eax
mov dword [esp + 0x18], vtable.CMD5Checksum.0
mov dword [esp + 0x1c], esi
call fcn.10083840
mov dword [esp + 0x64], esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x68], 0x67452301
mov dword [esp + 0x6c], 0xefcdab89
mov dword [esp + 0x70], 0x98badcfe
mov dword [esp + 0x74], 0x10325476
mov byte [esp + 0x88], 1
mov eax, dword [esp + 0x90]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0xc], esp
mov esi, esp
push eax
call fcn.10002b60
add eax, 0x10
add esp, 4
mov ecx, edi
mov dword [esi], eax
call fcn.10021680
mov dword [esp + 0x7c], 0xffffffff
mov eax, dword [esp + 0x84]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1004cdf8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.1007fe37
add esp, 0x78
ret 4

Function at 0x1004eff0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100b22a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x2c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x10], esp
mov esi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x28], 1
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x100bec10
call fcn.10002440
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x100bec10
mov byte [esp + 0x30], 2
call fcn.10002440
mov esi, dword [esp + 0x34]
mov byte [esp + 0x2c], 0
call fcn.1004f1a0
mov esi, eax
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1004f098
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 8
Function at 0x1004f0b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100b2270
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov dword [esp + 0x1c], 1
mov eax, dword [esp + 0x2c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0xc], esp
mov esi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x24], 2
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x100bec10
call fcn.10002440
mov byte [esp + 0x24], 3
mov eax, dword [esp + 0x30]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [esi], eax
mov esi, dword [esp + 0x34]
add esp, 4
mov byte [esp + 0x28], 1
call fcn.1004f1a0
mov esi, eax
mov byte [esp + 0x1c], 0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1004f160
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1004f188
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret 0xc
Function at 0x10051d70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100b3db0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x28], 3
mov eax, dword [esp + 0x3c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x10], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x30], 4
mov edi, esp
mov dword [esp + 0x18], esp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.http:__myaccount.glarysoft.com_openapi.php_lr_expire_time
call fcn.10002440
push edi
mov ecx, esi
call fcn.10051af0
mov byte [esp + 0x30], 5
mov eax, dword [esp + 0x40]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x38], 6
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
mov dword [esp + 0x28], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x3c], 7
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
mov dword [esp + 0x30], esp
mov edi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov ecx, esi
mov byte [esp + 0x3c], 3
call fcn.10051f00
mov esi, eax
mov byte [esp + 0x28], 2
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10051e6a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x28], 1
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10051e8f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10051eb4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10051edc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 0x10
Function at 0x10052d80
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x100b1d09
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebp
push esi
push edi
mov eax, dword [0x100e18d0]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x50]
mov dword [esp + 0x10], 0
push 0
lea ecx, [esp + 0x28]
mov dword [esp + 0x48], 4
call fcn.100a01cd
sub esp, 0x18
mov byte [esp + 0x5c], 5
mov eax, dword [esp + 0x78]
mov dword [esp + 0x2c], esp
mov ebp, esp
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x30], esp
mov esi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x64], 6
mov eax, dword [esp + 0x7c]
add eax, 0xfffffff0
mov dword [esp + 0x38], esp
mov esi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x68], 7
mov eax, dword [esp + 0x7c]
add eax, 0xfffffff0
mov dword [esp + 0x40], esp
mov esi, esp
push eax
call fcn.10002b60
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x6c], 8
mov eax, dword [esp + 0x7c]
add eax, 0xfffffff0
mov dword [esp + 0x48], esp
mov esi, esp
push eax
call fcn.10002b60
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov eax, dword [esp + 0x74]
push ebp
push eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x74], 5
call fcn.10052910
lea ecx, [esp + 0x3c]
call fcn.100a05fc
sub esp, 0x18
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x64], esp
push edx
call fcn.100a1eb8
push edi
call fcn.10055230
lea ecx, [esp + 0x24]
mov dword [esp + 0x10], 1
mov byte [esp + 0x44], 4
call fcn.100a05a9
mov byte [esp + 0x44], 3
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10052eb7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x44], 2
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10052edc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x44], 1
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10052f01
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x44], 0
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10052f26
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x38
ret 0x18