joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10132aaf
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x9c
push esi
mov esi, 0x9c
lea eax, [ebp - 0x24]
push esi
push 0
push eax
call fcn.101e2950
add esp, 0xc
mov dword [ebp - 0x24], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x24]
push eax
call esi
test eax, eax
jne 0x10132afa
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x94
push eax
call esi
test eax, eax
jne 0x10132afa
xor eax, eax
jmp 0x10132bbb
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x10132bb6
dec eax
je 0x10132b72
dec eax
jne 0x10132af3
cmp dword [ebp - 0x20], 4
ja 0x10132b1c
mov eax, 0x111
jmp 0x10132bbb
cmp dword [ebp - 0x20], 5
jne 0x10132b4b
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x10132b33
mov eax, 0x112
jmp 0x10132bbb
cmp eax, 1
jne 0x10132b3f
mov eax, 0x113
jmp 0x10132bbb
cmp eax, 2
jne 0x10132b6b
mov eax, 0x114
jmp 0x10132bbb
cmp dword [ebp - 0x20], 6
jne 0x10132b6b
cmp dword [ebp - 0x1c], 0
jne 0x10132b5e
mov eax, 0x120
jmp 0x10132bbb
cmp dword [ebp - 0x1c], 1
jne 0x10132b6b
mov eax, 0x130
jmp 0x10132bbb
mov eax, 0x140
jmp 0x10132bbb
cmp dword [ebp - 0x20], 4
jne 0x10132af3
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x10132b91
cmp byte [ebp - 0xf], 0x43
sete al
add eax, 0x101
jmp 0x10132bbb
cmp eax, 0xa
jne 0x10132ba6
xor eax, eax
cmp byte [ebp - 0xf], 0x41
sete al
add eax, 0x103
jmp 0x10132bbb
cmp eax, 0x5a
jne 0x10132af3
mov eax, 0x105
jmp 0x10132bbb
mov eax, 0x100
pop esi
lea esp, [ebp + 0x78]
pop ebp
ret

Function at 0x10134a61
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push 2
lea ecx, [ebp - 4]
push ecx
push 0x100c
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movzx eax, word [ebp - 4]
sub eax, 0x30
mov esp, ebp
pop ebp
ret

Function at 0x10134ada
Capabilities:
Get geographical location

Disassembly:
push ecx
push ecx
push ebx
push ebp
push edi
mov ebp, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov ebx, eax
lea eax, [esp + 0xc]
push 2
push eax
push 0x21
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movzx ecx, word [esp + 0xc]
lea eax, [esp + 0xc]
push 4
push eax
push 0x1d
sub ecx, 0x30
push ebx
mov dword [edi], ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [esp + 0xc]
pop edi
mov word [ebp], ax
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x10134b24
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov edi, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
and dword [esp + 0x10], 0
mov ebx, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [esp + 0x10]
push 4
push eax
push 0x20000023
push ebx
call ebp
mov eax, dword [esp + 0x10]
push 4
mov dword [esi], eax
lea eax, [esp + 0x14]
push eax
push 0x20001005
push ebx
call ebp
cmp byte [esp + 0x38], 0
mov eax, dword [esp + 0x10]
mov dword [edi], eax
je 0x10134b87
test eax, eax
jne 0x10134b7f
mov dword [edi], 1
jmp 0x10134b87
cmp eax, 1
jne 0x10134b87
and dword [edi], 0
xor eax, eax
push 0xc
mov word [esp + 0x18], ax
lea eax, [esp + 0x18]
push eax
push 0x28
push ebx
call ebp
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x14]
push eax
call fcn.10002746
push 0xc
lea eax, [esp + 0x18]
push eax
push 0x29
push ebx
call ebp
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x14]
push eax
call fcn.10002746
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x101365c3
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 0x80
push 3
or dword [esi + 4], 0xffffffff
or dword [esi + 8], 0xffffffff
push ebx
push 1
push SysReAllocStringLen
push dword [esp + 0x28]
mov byte [esi + 0x14], 1
mov dword [esi + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x10136640
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov cl, byte [esi + 0x14]
xor edx, edx
push ebx
mov dword [esi + 0x10], eax
test cl, cl
mov eax, 0x10000000
cmovne eax, edx
push eax
push ebx
push 4
pop eax
push 2
pop edi
cmovne eax, edi
push eax
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp dword [esi + 4], 0xffffffff
mov dword [esi + 8], eax
je 0x10136648
test eax, eax
jne 0x1013664c
mov ecx, esi
call fcn.10136674
xor eax, eax
pop edi
pop esi
pop ebx
ret 8
test eax, eax
je 0x10136663
cmp byte [esi + 0x14], bl
push ebx
push ebx
push ebx
push 4
pop ecx
cmovne edi, ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
cmp dword [esi + 0xc], ebx
jne 0x1013666f
mov ecx, esi
call fcn.10136674
mov eax, dword [esi + 0xc]
jmp 0x10136642
Function at 0x101367cc
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x10220956
call fcn.10210210
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov byte [esi + 8], bl
mov dword [esi + 0xc], 0x102b8088
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
add eax, ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x24]
push 0x1026af44
mov dword [esi + 0x14], eax
call fcn.10016882
push str.___n
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 1
call fcn.10016882
push 0x1026af1c
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 2
call fcn.10016882
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov byte [esi + 0x30], bl
mov word [esi + 0x33], bx
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10138a13
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x100
push ebx
push ebp
push edi
mov ebp, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
movzx ebx, ax
lea eax, [esp + 0xc]
push 0x100
push eax
push 0x59
push ebx
mov byte [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [esp + 0xc]
mov ecx, edi
push eax
call fcn.1000243e
push 0x100
lea eax, [esp + 0x10]
push eax
push 0x5a
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [esp + 0xc]
mov ecx, ebp
push eax
call fcn.1000243e
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x100
ret
Function at 0x1013c79d
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10221134
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
xor esi, esi
push ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], esi
lea ecx, [edi + 0x18]
call fcn.10002d1e
cmp dword [ebx], 0xf
jne 0x1013c7e0
mov eax, dword [ebx + 8]
jmp 0x1013c7e2
mov eax, esi
mov ecx, dword [eax + 8]
mov eax, dword [edi]
mov dword [esp + 0x18], ecx
mov eax, dword [eax + 0x30]
add ecx, eax
mov al, byte [ecx + 1]
mov byte [esp + 0xc], al
mov al, byte [ecx + 2]
mov byte [esp + 0xd], al
mov al, byte [ecx + 3]
add ecx, 4
mov byte [esp + 0xe], al
push ecx
push dword [edi + 4]
mov al, byte [ecx]
lea ecx, [esp + 0x28]
mov byte [esp + 0x17], al
mov ebx, dword [esp + 0x14]
cmp dword [ebp + 0x10], ebx
cmovb ebx, dword [ebp + 0x10]
mov dword [esp + 0x1c], ebx
call fcn.100511ec
lea ecx, [edi + 0xc]
mov dword [esp + 0x3c], esi
push eax
mov dword [esp + 0x10], ecx
call fcn.10029e64
or dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.10002db8
test ebx, ebx
je 0x1013c86c
mov edi, dword [ebp + 0x14]
mov esi, ebx
mov ebx, dword [esp + 0xc]
push edi
mov ecx, ebx
call fcn.10029e64
add edi, 0x10
dec esi
jne 0x1013c856
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov eax, dword [edi + 0xc]
inc ebx
test eax, eax
je 0x1013c877
mov esi, dword [eax - 4]
sub esi, ebx
mov dword [edi + 0x30], ebx
shl esi, 4
mov ecx, edi
add esi, eax
mov eax, dword [edi]
mov dword [edi + 0x2c], esi
mov eax, dword [eax + 0x30]
add eax, dword [esp + 0x18]
push eax
call fcn.1013b41b
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x18]
push eax
call fcn.10002911
mov ecx, dword [esp + 0x34]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1014d358
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x102216bb
call fcn.10210210
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebx], eax
lea edi, [ebx + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebx + 8], eax
xor eax, eax
mov dword [ebx + 4], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx + 0x18], ecx
mov dword [ebp - 4], ecx
mov dword [ebx + 0x1c], ecx
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x24], ecx
mov dword [ebx + 0x28], ecx
mov word [ebx + 0x2c], cx
mov byte [ebx + 0x2e], cl
mov dword [ebx + 0x30], 0x102b8088
push ecx
lea ecx, [ebx + 0x34]
mov byte [ebp - 4], 1
call fcn.10156e7d
push str.h_smile:richtext
lea ecx, [ebx + 0x30]
mov byte [ebp - 4], 2
call fcn.1000243e
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x1015c1d2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x10222b5f
call fcn.10210210
sub esp, 0x3c
push ebx
push ebp
xor ebx, ebx
mov dword [esp + 0x1c], edx
and dword [esp + 0x30], ebx
xor ebp, ebp
and dword [esp + 0x38], ebx
xor edx, edx
and dword [esp + 0x34], ebx
and dword [esp + 0x3c], ebx
push esi
mov esi, dword [esp + 0x5c]
push edi
mov dword [esp + 0x2c], ecx
xor edi, edi
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edx
mov eax, dword [eax]
test eax, eax
je 0x1015c21e
mov ecx, dword [eax - 4]
jmp 0x1015c220
xor ecx, ecx
cmp edx, ecx
jge 0x1015c374
add edi, eax
cmp dword [edi + 4], 0x10
jne 0x1015c2c9
lea eax, [esp + 0x20]
mov ecx, edi
push eax
call fcn.10002ac2
and dword [esp + 0x54], 0
lea ecx, [esp + 0x14]
push eax
call fcn.10133c42
lea ecx, [esp + 0x20]
mov byte [esp + 0x54], 2
call fcn.100026e7
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
call fcn.1018343c
pop ecx
lea ecx, [esp + 0x14]
push dword [eax]
call fcn.10132f35
lea ecx, [esp + 0x28]
call fcn.10002371
mov edi, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
push 0
push 1
push ecx
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x2c]
lea eax, [esp + 0x14]
push eax
push edi
lea eax, [esp + 0x38]
push eax
lea ecx, [edi + 0x74]
call fcn.1015c00d
mov ecx, dword [eax]
mov dword [esi + 0x74], ecx
lea ecx, [esp + 0x14]
mov eax, dword [eax + 4]
or dword [esp + 0x54], 0xffffffff
mov dword [esi + 0x78], eax
call fcn.10002371
jmp 0x1015c363
lea ecx, [esi + 0x7c]
mov edx, edi
call fcn.10058e23
test al, al
jne 0x1015c363
cmp ebx, 4
jge 0x1015c304
lea ecx, [esi + 0x64]
mov edx, edi
lea ecx, [ecx + ebx*4]
call fcn.1005aa29
test al, al
je 0x1015c304
test ebx, ebx
jne 0x1015c301
mov eax, dword [esi + 0x64]
mov dword [esi + 0x70], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], eax
inc ebx
jmp 0x1015c363
cmp ebp, 2
jg 0x1015c356
mov edx, edi
lea ecx, [esp + 0x38]
call fcn.10057ea1
test al, al
je 0x1015c356
mov eax, ebp
sub eax, 0
je 0x1015c334
dec eax
jne 0x1015c353
lea eax, [esp + 0x38]
push eax
lea ecx, [esi + 0x94]
call fcn.1002b04d
jmp 0x1015c353
lea eax, [esp + 0x38]
push eax
lea ecx, [esi + 0x84]
call fcn.1002b04d
push 0
push 0x32
lea ecx, [esi + 0x94]
call fcn.10052858
inc ebp
jmp 0x1015c363
lea ecx, [esi + 0x80]
mov edx, edi
call fcn.1005747b
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
inc edx
add edi, 0x10
jmp 0x1015c207
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x10162a32
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10223360
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1e0
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x20]
call fcn.1015a79e
and dword [esp + 0x1f4], 0
mov ecx, edi
mov esi, dword [ebp + 8]
mov eax, dword [edi]
push dword [esi]
call dword [eax + 0x1c]
push 1
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], eax
call fcn.1015a7ff
and dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
lea ebx, [edi + 0x30]
mov ecx, edi
push ebx
push esi
call fcn.101627dd
mov edx, dword [esp + 0xc]
dec edx
jmp 0x10162b45
mov eax, dword [ebx]
test eax, eax
je 0x10162ab0
mov ecx, dword [eax - 4]
jmp 0x10162ab2
xor ecx, ecx
push ecx
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], eax
call fcn.101640c1
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test ebx, ebx
je 0x10162ad5
mov eax, esi
jmp 0x10162ada
call fcn.1016014b
mov eax, dword [eax]
mov dword [esp + 0x14], eax
test ebx, ebx
je 0x10162ae8
mov eax, esi
jmp 0x10162aed
call fcn.1016014b
mov ecx, dword [eax]
mov edx, dword [esp + 0x14]
push 0xf
push ecx
mov ecx, dword [ecx + 8]
add edx, 0xc
call fcn.1018466e
pop ecx
push eax
lea ecx, [esp + 0x28]
call fcn.1015a7ff
push ecx
push ecx
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], ebx
lea eax, [esp + 0x28]
mov ecx, dword [edi + 0x6c]
add ecx, 0x74
push eax
call fcn.1015bfa8
test ebx, ebx
jne 0x10162b30
call fcn.1016014b
mov esi, eax
mov ecx, dword [esi]
lea edx, [esp + 0x20]
push edx
push edi
mov eax, dword [ecx]
call dword [eax + 0x68]
mov edx, dword [esp + 0xc]
lea ebx, [edi + 0x30]
dec edx
mov dword [esp + 0xc], edx
jns 0x10162aa5
mov eax, dword [esp + 0x10]
sub esp, 0x10
add eax, 0xc
mov ecx, esp
push eax
call fcn.10003a43
lea ecx, [esp + 0x3c]
call fcn.10085fa2
mov ecx, dword [edi + 0x6c]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x10]
add ecx, 0x74
push eax
call fcn.101608d6
mov ecx, dword [esp + 0xc]
mov esi, dword [eax]
test ecx, ecx
je 0x10162b93
mov edx, dword [ecx]
call dword [edx + 4]
and dword [esp + 0xc], 0
lea ecx, [esp + 0x28]
call fcn.10002371
mov ecx, dword [esp + 0x1ec]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10165b85
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x10223636
call fcn.10210210
push ecx
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
push 1
push esi
push ecx
push ecx
mov edi, ecx
mov edx, esp
mov ecx, dword [esp + 0x44]
sub ecx, eax
mov dword [esp + 0x20], edi
sar ecx, 1
mov dword [edx], eax
xor eax, eax
test ecx, ecx
cmovg eax, ecx
mov ecx, edi
mov dword [edx + 4], eax
call fcn.10017230
xor ebp, ebp
mov ebx, 0x102b8088
mov dword [esp + 0x1c], ebp
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebp
lea ecx, [edi + 0x24]
mov dword [ecx], ebx
push dword [esi]
call fcn.10132f35
mov eax, dword [esp + 0x2c]
lea esi, [edi + 0x34]
mov dword [edi + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], ebp
mov dword [esi], ebx
push ebp
push 1
mov ecx, esi
mov byte [esp + 0x24], 4
call fcn.10132ec5
mov eax, dword [esi]
mov ecx, dword [esp + 0x14]
mov byte [eax + 0xc], 0x41
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
leave
ret 0x14

Function at 0x10165cc3
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x10223670
call fcn.10210210
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov dword [ebp - 0x10], edi
call fcn.101609c9
xor ecx, ecx
mov dword [ebp - 4], ecx
or dword [edi + 0x1c], 0xffffffff
mov eax, dword [0x102af5b0]
mov dword [edi], vtable.bn::block.0
inc eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x18], ecx
mov dword [edi + 0x24], ecx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x30], ecx
mov dword [edi + 0x34], ecx
mov dword [edi + 0x38], ecx
mov dword [0x102af5b0], eax
mov eax, SysReAllocStringLen
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], eax
mov dword [edi + 0x50], ecx
lea eax, [esi + 0xc]
mov byte [ebp - 4], 1
push eax
mov ecx, edi
call fcn.10166adf
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x10167858
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x10223880
call fcn.10210210
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.tool::resource.0
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi], vtable.bn::document.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
push ecx
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 2
call fcn.1004b57a
push ecx
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 3
call fcn.1016ef3d
mov dword [esi + 0x30], edi
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 5
mov eax, dword [eax]
add eax, 0xc
push eax
call fcn.10040c3f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x68], 0x102b807c
mov dword [esi + 0x6c], eax
mov eax, esi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x10170443
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x10224883
call fcn.10210210
push ecx
xor edx, edx
or eax, 0xffffffff
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov byte [ecx + 8], dl
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edx
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x24], eax
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x2c], edx
mov dword [ecx + 0x30], edx
mov dword [ecx + 0x34], edx
mov dword [ecx + 0x38], edx
mov dword [ecx + 0x40], SysReAllocStringLen
mov dword [ecx + 0x44], edx
mov dword [ecx + 0x48], edx
mov dword [ecx + 0x4c], eax
mov dword [ecx + 0x50], eax
mov dword [ecx + 0x54], edx
mov dword [ecx + 0x58], edx
mov dword [ecx + 0x5c], edx
mov dword [ecx + 0x64], eax
mov dword [ecx + 0x60], edx
mov dword [ecx + 0x6c], eax
mov eax, ecx
mov dword [ecx + 0x68], edx
mov dword [ecx + 0x70], edx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
leave
ret
Function at 0x1018cdc8
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor bl, bl
jmp 0x1018ce50
cmp eax, 1
je 0x1018cdfd
cmp eax, 2
je 0x1018cdfd
cmp eax, 3
jne 0x1018cdeb
cmp dword [esi + 0x88], 0x39
je 0x1018cdf7
jmp 0x1018ce50
cmp eax, 4
jne 0x1018ce50
mov ecx, esi
call fcn.1018d555
pop edi
pop esi
mov al, bl
pop ebx
ret
mov eax, dword [esi + 0x88]
cmp eax, 0x3b
jg 0x1018ce31
je 0x1018ce28
test eax, eax
je 0x1018ce50
cmp eax, 0x22
je 0x1018ce1d
cmp eax, 0x36
je 0x1018ce6b
cmp eax, 0x3a
jne 0x1018ce45
mov ecx, esi
call fcn.1018d480
mov bl, al
jmp 0x1018ce50
mov ecx, esi
call fcn.1018ce74
jmp 0x1018ce50
cmp eax, 0x42
jl 0x1018ce45
cmp eax, 0x43
jle 0x1018ce6b
cmp eax, 0x44
je 0x1018ce62
cmp eax, 0x46
je 0x1018ce6b
test bl, bl
jne 0x1018ce50
mov ecx, esi
call fcn.1018d555
lea ecx, [esi + 0x68]
call fcn.1018ee5f
test eax, eax
jne 0x1018cdd1
jmp 0x1018cdf7
mov ecx, esi
call fcn.1018d25b
jmp 0x1018ce50
mov ecx, esi
call fcn.1018d800
jmp 0x1018ce50
Function at 0x1018de2c
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x10226496
call fcn.10210210
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
lea eax, [edi + 0x94]
push eax
call fcn.1003bfb1
mov dword [esp + 0x24], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x18], ebx
push ecx
mov eax, esp
lea ecx, [esp + 0x24]
push 0xb
inc ebx
pop esi
mov byte [esp + 0x3c], bl
mov dword [eax], esi
call fcn.10003bbf
test al, al
jne 0x1018deac
push ebx
push ecx
mov eax, esp
lea ecx, [esp + 0x28]
mov dword [eax], 0x1b
call fcn.10013d30
cmp eax, ebx
jg 0x1018de99
push 0x1026121c
jmp 0x1018de9e
push 0x1026120c
push ecx
mov eax, esp
lea ecx, [esp + 0x28]
mov dword [eax], esi
call fcn.100449cc
cmp byte [esp + 0x44], 0
lea eax, [esp + 0x20]
mov ecx, dword [edi + 0x64]
push eax
push 0x18
je 0x1018ded0
call fcn.10192449
push ecx
mov ecx, dword [edi + 0x64]
call fcn.10191835
jmp 0x1018dfab
call fcn.10192449
mov ecx, dword [edi + 0x64]
push eax
mov ecx, dword [ecx]
mov edx, dword [ecx]
call dword [edx + 0x4c]
mov dword [esp + 0x14], eax
jmp 0x1018df90
jle 0x1018df90
cmp eax, 2
jg 0x1018df90
mov eax, dword [edi + 0x88]
test eax, eax
je 0x1018df90
cmp eax, 0x47
jne 0x1018df90
push 0x64
call fcn.101dbffe
pop ecx
mov dword [esp + 0x1c], eax
mov byte [esp + 0x38], 2
test eax, eax
je 0x1018df31
push 0x47
mov ecx, eax
call fcn.1018c912
mov ebp, eax
jmp 0x1018df33
xor ebp, ebp
lea eax, [esp + 0x44]
mov byte [esp + 0x38], bl
push eax
mov ecx, edi
call fcn.1018e0b5
mov ecx, dword [eax]
lea eax, [ecx + 8]
mov dword [esp + 0x28], eax
mov eax, dword [ecx + 4]
lea ecx, [ebp + 0x54]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
push eax
call fcn.1004c4b7
lea ecx, [esp + 0x44]
call fcn.100026e7
lea eax, [edi + 0x94]
push eax
lea ecx, [ebp + 0xc]
call fcn.1003bfb1
mov esi, dword [esp + 0x14]
mov ecx, esi
mov eax, dword [edi + 0x98]
mov dword [ebp + 0x10], eax
push ebp
mov eax, dword [esi]
call dword [eax + 0x280]
lea ecx, [edi + 0x68]
call fcn.1018ee5f
test eax, eax
jne 0x1018dee9
push ecx
mov ecx, dword [edi + 0x64]
call fcn.10191835
xor bl, bl
lea ecx, [esp + 0x18]
call fcn.1018ed57
lea ecx, [esp + 0x20]
call fcn.1003bf80
mov ecx, dword [esp + 0x30]
mov al, bl
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x1019c348
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
or eax, 0xffffffff
mov esi, 0x100
movzx edx, byte [ecx]
xor edx, eax
shr eax, 8
and edx, 0xff
xor eax, dword [edx*4 + 0x102569a0]
inc ecx
dec esi
jne 0x1019c351
not eax
pop esi
ret
Function at 0x101ab8cb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
test dword [esi + 0x6c], 0x4000
jne 0x101ab8ec
push str.attempt_to_png_read_frame_head___but_no_acTL_present
push esi
call fcn.101b3a00
pop ecx
pop ecx
xor ebx, ebx
cmp dword [esi + 0x27c], ebx
je 0x101aba0e
push ebx
push esi
call fcn.101b5558
push esi
call fcn.101b8755
add esp, 0xc
mov dword [ebp - 8], 0x54414449
and dword [esi + 0x6c], 0xffff7fff
mov byte [ebp - 4], bl
mov dword [ebp - 0x18], 0x54416466
mov byte [ebp - 0x14], bl
mov dword [ebp - 0x10], 0x4c546366
mov byte [ebp - 0xc], bl
push edi
push 4
lea eax, [ebp + 8]
push eax
push esi
call fcn.101b38a3
lea eax, [ebp + 8]
push eax
push esi
call fcn.101b5bdb
push esi
mov edi, eax
call fcn.101b3763
push 4
lea eax, [esi + 0x120]
push eax
push esi
call fcn.101b55ec
mov eax, dword [esi + 0x120]
lea edx, [ebp - 8]
add esp, 0x24
cmp eax, dword [edx]
jne 0x101ab990
test bl, bl
jne 0x101ab97a
cmp dword [esi + 0x27c], 1
jbe 0x101ab987
push str.png_read_frame_head__:_out_of_place_IDAT
push esi
call fcn.101b3a00
pop ecx
pop ecx
push edi
push esi
call fcn.101b5558
jmp 0x101ab9df
lea edx, [ebp - 0x10]
cmp eax, dword [edx]
jne 0x101ab9a8
push edi
push dword [ebp + 0xc]
push esi
call fcn.101b652d
add esp, 0xc
mov bl, 1
jmp 0x101ab930
lea edx, [ebp - 0x18]
cmp eax, dword [edx]
jne 0x101ab9e6
push edi
push esi
call fcn.101b5b8a
pop ecx
pop ecx
test bl, bl
jne 0x101ab9cb
cmp dword [esi + 0x27c], 1
jbe 0x101ab9cb
lea eax, [edi - 4]
push eax
jmp 0x101ab988
test dword [esi + 0x6c], 0x8000
jne 0x101aba00
push str.png_read_frame_head__:_out_of_place_fdAT
push esi
call fcn.101b3a00
pop ecx
pop ecx
jmp 0x101ab930
push str.Skipped__ignored__a_chunk_between_APNG_chunks
push esi
call fcn.101b3afb
push edi
push esi
call fcn.101b5558
add esp, 0x10
jmp 0x101ab930
or dword [esi + 0x6c], 4
lea eax, [edi - 4]
mov dword [esi + 0x110], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret