joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10049340
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10184508]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push esi
push esi
mov ebx, eax
push 0x5a
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
test edi, edi
je 0x10049394
lea eax, [edi + edi]
call fcn.10003341
mov esi, esp
push edi
push esi
push 0x5a
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
dec eax
push eax
push esi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFStringCreateWithCharacters
add esp, 0xc
mov esi, eax
mov eax, esi
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000234c
leave
ret

Function at 0x100493c2
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10184508]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push esi
push esi
movzx ebx, ax
push 0x59
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
test edi, edi
je 0x10049417
lea eax, [edi + edi]
call fcn.10003341
mov esi, esp
push edi
push esi
push 0x59
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
dec eax
push eax
push esi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFStringCreateWithCharacters
add esp, 0xc
mov esi, eax
mov eax, esi
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000234c
leave
ret
Function at 0x1004cebf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov eax, dword [0x10184508]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
mov ebx, dword [esp + 0x74]
push ebp
mov ebp, dword [sym.imp.objc.dll_sel_registerName]
push esi
push edi
push str.copyKeyList
mov dword [esp + 0x18], ebx
call ebp
push eax
push ebx
mov ebx, dword [sym.imp.objc.dll_objc_msgSend]
call ebx
add esp, 0xc
lea edi, [esp + 0x18]
mov esi, eax
xor eax, eax
push 8
pop ecx
rep stosd dword es:[edi], eax
push 0x10
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
push str.countByEnumeratingWithState:objects:count:
call ebp
pop ecx
push eax
push esi
call ebx
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x1004cf8f
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx]
mov dword [esp + 0x10], ecx
xor edi, edi
mov eax, dword [esp + 0x20]
cmp ecx, dword [eax]
je 0x1004cf3d
push esi
call dword [sym.imp.objc.dll_objc_enumerationMutation]
pop ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + edi*4]
inc edi
push eax
push 0
push str.setValue:forKey:
call ebp
pop ecx
push eax
push dword [esp + 0x20]
call dword [sym.imp.objc.dll_objc_msgSend]
add esp, 0x10
mov ecx, dword [esp + 0x10]
cmp edi, ebx
jb 0x1004cf2d
push 0x10
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
push str.countByEnumeratingWithState:objects:count:
call ebp
pop ecx
push eax
push esi
call dword [sym.imp.objc.dll_objc_msgSend]
mov ecx, dword [esp + 0x24]
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x1004cf2b
test esi, esi
je 0x1004cf9a
push esi
call sym.CoreFoundation.dll_CFRelease
pop ecx
mov ecx, dword [esp + 0x78]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000234c
add esp, 0x6c
ret
Function at 0x10068129
Capabilities:
Set thread local storage value

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
push dword [0x10178ed4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x10068191
cmp esi, 0x1000
je 0x10068191
inc dword [esi]
push ebp
push edi
push 0x46
lea edi, [esi + 4]
pop ebp
mov ecx, dword [edi]
test ecx, ecx
je 0x10068168
mov eax, dword [edi + 0x118]
test eax, eax
je 0x10068168
and dword [edi], 0
push ecx
call eax
pop ecx
add edi, 4
sub ebp, 1
jne 0x10068151
cmp dword [esi], 3
pop edi
pop ebp
jne 0x10068191
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [esp], 0x1000
push dword [0x10178ed4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
ret
Function at 0x1006c111
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x68
mov eax, dword [0x10184508]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
mov ebx, dword [esp + 0x70]
push ebp
push esi
mov esi, dword [esp + 0x7c]
push edi
push esi
call sym.CoreFoundation.dll_CFDataGetBytePtr
push esi
mov edi, eax
call sym.CoreFoundation.dll_CFDataGetLength
pop ecx
pop ecx
push 8
pop ecx
cmp dword [esp + 0x84], ecx
mov dword [esp + 0x1c], eax
cmovle ecx, dword [esp + 0x84]
xor esi, esi
xor ebp, ebp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 3
test eax, eax
jle 0x1006c232
mov eax, ecx
push 0x4c
shl eax, 3
pop edx
sub edx, eax
mov dword [esp + 0x18], edx
mov eax, ebp
cdq
idiv dword [esp + 0x14]
sub edx, 0
je 0x1006c1e0
sub edx, 1
je 0x1006c1c2
sub edx, 1
jne 0x1006c1f1
movzx ecx, byte [edi]
movzx eax, byte [edi - 1]
shl eax, 2
shr ecx, 6
or ecx, eax
and ecx, 0x3f
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, dword [esp + 0x10]
mov byte [esp + esi + 0x20], al
movzx eax, byte [edi]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esp + esi + 0x21], al
add esi, 2
jmp 0x1006c1f1
movzx ecx, byte [edi]
movzx eax, byte [edi - 1]
shr ecx, 4
shl eax, 4
or ecx, eax
and ecx, 0x3f
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, dword [esp + 0x10]
jmp 0x1006c1ec
movzx eax, byte [edi]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esp + esi + 0x20], al
inc esi
cmp esi, dword [esp + 0x18]
jl 0x1006c222
mov byte [esp + esi + 0x20], 0xa
inc esi
cmp esi, 0x52
jae 0x1006c2b9
push ebx
push ecx
mov byte [esp + esi + 0x28], 0
call fcn.1006cf28
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.1006d4ae
add esp, 0x10
xor esi, esi
mov ecx, dword [esp + 0x10]
inc ebp
inc edi
cmp ebp, dword [esp + 0x1c]
jl 0x1006c177
mov eax, ebp
push 3
cdq
pop ebp
idiv ebp
sub edx, 1
je 0x1006c260
sub edx, 1
jne 0x1006c27d
movzx eax, byte [edi - 1]
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esp + esi + 0x20], al
mov byte [esp + esi + 0x21], 0x3d
add esi, 2
jmp 0x1006c27d
movzx eax, byte [edi - 1]
and eax, ebp
shl eax, 4
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esp + esi + 0x20], al
mov word [esp + esi + 0x21], 0x3d3d
add esi, 3
test esi, esi
jle 0x1006c2a6
mov byte [esp + esi + 0x20], 0xa
inc esi
cmp esi, 0x52
jae 0x1006c2b9
push ebx
push ecx
mov byte [esp + esi + 0x28], 0
call fcn.1006cf28
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.1006d4ae
add esp, 0x10
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000234c
add esp, 0x68
ret
call fcn.10001e29
int3
Function at 0x10070563
Capabilities:
Parse credit card information

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, 0xf00
push edi
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x10070691
mov edx, dword [esi + 4]
mov edi, dword [esi + 8]
cmp edx, edi
jae 0x10070676
mov ebx, edx
mov al, byte [edx]
mov ecx, ebx
cmp al, 9
jl 0x100705ab
cmp al, 0xa
jle 0x1007059f
cmp al, 0xd
je 0x1007059f
cmp al, 0x20
jne 0x100705ab
inc edx
mov dword [esi + 4], edx
mov ebx, edx
mov ecx, edx
cmp edx, edi
jb 0x1007058b
movsx ax, byte [ecx]
movzx ebx, ax
cmp ebx, 0x25
jne 0x100705f4
lea eax, [ecx + 1]
mov dword [esi + 4], eax
jmp 0x100705c9
cmp byte [eax], 0x3b
lea ecx, [eax + 1]
je 0x100705ef
mov eax, ecx
cmp eax, edi
jb 0x100705bf
push esi
call fcn.1006dd55
pop ecx
push eax
push str.Encountered_unexpected_EOF_while_parsing_percent_escape_sequence_begun_on_line__d
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push ebp
call fcn.10001bae
add esp, 0xc
mov dword [esi + 0xc], eax
jmp 0x1007066b
mov dword [esi + 4], ecx
jmp 0x1007066b
cmp ebx, 0x3c
jne 0x100706b6
inc ecx
mov dword [esi + 4], ecx
cmp ecx, edi
jae 0x1007067a
movsx ax, byte [ecx]
movzx ebx, ax
cmp ebx, 0x3f
jne 0x1007061f
lea eax, [ecx + 1]
push esi
mov dword [esi + 4], eax
call fcn.1007080c
jmp 0x10070642
cmp ebx, 0x21
jne 0x10070696
lea eax, [ecx + 2]
cmp eax, edi
jae 0x10070645
cmp byte [ecx + 1], 0x2d
jne 0x10070645
cmp byte [eax], 0x2d
jne 0x10070645
lea eax, [ecx + 3]
push esi
mov dword [esi + 4], eax
call fcn.100707a3
pop ecx
jmp 0x1007066b
lea eax, [ecx + 1]
mov dword [esi + 4], eax
cmp eax, edi
jae 0x10070662
mov ecx, eax
cmp byte [ecx], 0x3e
je 0x10070662
lea eax, [ecx + 1]
mov dword [esi + 4], eax
mov ecx, eax
cmp eax, edi
jb 0x10070651
cmp byte [eax], 0x3e
jne 0x1007067a
inc eax
mov dword [esi + 4], eax
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1007057b
test eax, eax
jne 0x10070691
push str.Encountered_unexpected_EOF_while_parsing_inline_DTD
call sym.CoreFoundation.dll___CFStringMakeConstantString
push eax
push ebp
call fcn.10001bae
add esp, 0xc
mov dword [esi + 0xc], eax
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call fcn.1006dd55
pop ecx
push eax
push ebx
push str.Encountered_unexpected_character__c_on_line__d_while_parsing_inline_DTD
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push ebp
call fcn.10001bae
add esp, 0x10
jmp 0x1007068e
cmp ebx, 0x5d
jne 0x10070696
lea eax, [ecx + 1]
mov dword [esi + 4], eax
jmp 0x10070691
Function at 0x1007ce35
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x28
mov eax, dword [0x10184508]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
push 0x10
pop ebp
push 2
xor edi, edi
mov dword [esp + 0x14], ebp
lea esi, [esp + 0x18]
xor ebx, ebx
pop ecx
push 0
push ecx
push ecx
call dword [sym.imp.WS2_32.dll_socket]
push ebp
push 0
push esi
mov dword [ebx + 0x10179100], eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 2
pop eax
push 0x7f000001
mov word [esi], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esi + 4], eax
test edi, edi
js 0x1007ceb5
push ebp
push esi
push dword [ebx + 0x10179100]
call dword [sym.imp.WS2_32.dll_bind]
mov edi, eax
test edi, edi
js 0x1007ceb5
lea eax, [esp + 0x10]
push eax
push esi
push dword [ebx + 0x10179100]
call dword [sym.imp.WS2_32.dll_getsockname]
mov edi, eax
cmp dword [esp + 0x10], ebp
push 0xffffffffffffffff
pop eax
cmovne edi, eax
add ebx, 4
add esi, ebp
push 2
pop ecx
cmp ebx, 8
jb 0x1007ce59
test edi, edi
js 0x1007cefe
mov esi, dword [sym.imp.WS2_32.dll_connect]
lea eax, [esp + 0x24]
push ebp
push eax
push dword [0x10179100]
call esi
mov edi, eax
test edi, edi
js 0x1007cefe
push ebp
lea eax, [esp + 0x18]
push eax
push dword [0x10179104]
call esi
mov edi, eax
test edi, edi
jns 0x1007cf21
push dword [0x10179100]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push dword [0x10179104]
call esi
or eax, 0xffffffff
mov dword [0x10179100], eax
mov dword [0x10179104], eax
mov ecx, dword [esp + 0x34]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000234c
add esp, 0x28
ret
Function at 0x1007e464
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ecx
push edi
xor edi, edi
push edi
push edi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFArrayCreateMutable
push edi
push edi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
mov dword [0x10189b04], eax
call sym.CoreFoundation.dll_CFArrayCreateMutable
push edi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
mov dword [0x10189b08], eax
call sym.CoreFoundation.dll_CFDataCreateMutable
push edi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
mov dword [0x10189b0c], eax
call sym.CoreFoundation.dll_CFDataCreateMutable
push edi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
mov dword [0x10189b10], eax
call sym.CoreFoundation.dll_CFDataCreateMutable
add esp, 0x30
mov dword [0x10189b14], eax
call fcn.1007e601
call fcn.1007ce35
test eax, eax
jns 0x1007e4eb
push str._Could_not_create_wakeup_socket_pair_for_CFSocket___
call sym.CoreFoundation.dll___CFStringMakeConstantString
push eax
push 4
call sym.CoreFoundation.dll_CFLog
add esp, 0xc
jmp 0x1007e5ab
push ebx
push ebp
push esi
mov esi, dword [sym.imp.WS2_32.dll_ioctlsocket]
lea eax, [esp + 0x10]
push eax
mov ebx, 0x8004667e
mov dword [esp + 0x14], 1
push ebx
push dword [0x10179100]
call esi
lea eax, [esp + 0x10]
push eax
push ebx
push dword [0x10179104]
call esi
mov ebp, dword [0x10179104]
mov ebx, dword [0x10189b10]
mov dword [esp + 0x14], ebx
cmp ebp, 0xffffffff
je 0x1007e5a8
push ebx
call sym.CoreFoundation.dll_CFDataGetMutableBytePtr
push ebx
mov esi, eax
call sym.CoreFoundation.dll_CFDataGetLength
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x1007e562
push esi
push ebp
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x1007e5a8
test ebx, ebx
jle 0x1007e562
mov eax, dword [esi]
lea eax, [eax*4 + 8]
jmp 0x1007e567
mov eax, 0x1004
cmp eax, ebx
jle 0x1007e583
mov esi, dword [esp + 0x14]
sub eax, ebx
push eax
push esi
call sym.CoreFoundation.dll_CFDataIncreaseLength
push esi
call sym.CoreFoundation.dll_CFDataGetMutableBytePtr
add esp, 0xc
mov esi, eax
cmp edi, dword [esi]
jae 0x1007e598
lea eax, [esi + 4]
cmp dword [eax], ebp
je 0x1007e596
inc edi
add eax, 4
cmp edi, dword [esi]
jb 0x1007e58a
cmp edi, dword [esi]
jne 0x1007e5a8
cmp dword [esi], 0x400
jae 0x1007e5a8
mov dword [esi + edi*4 + 4], ebp
inc dword [esi]
pop esi
pop ebp
pop ebx
pop edi
pop ecx
pop ecx
ret

Function at 0x1007e601
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x10184508]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10189b1c], 0
jne 0x1007e666
lea eax, [ebp - 0x194]
mov byte [0x10189b1c], 1
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1007e64b
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x1007e64b
shr eax, 8
cmp al, 2
je 0x1007e666
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str._Could_not_initialize_WinSock_subsystem___
call sym.CoreFoundation.dll___CFStringMakeConstantString
push eax
push 4
call sym.CoreFoundation.dll_CFLog
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000234c
leave
ret
Function at 0x100b30c4
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x10184508]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, 0x30c
call fcn.10003341
mov edi, dword [ebp + 0x10]
mov eax, esp
mov dword [ebp - 8], eax
cmp edi, 0x104
jg 0x100b30f4
mov esi, esp
jmp 0x100b3101
imul eax, edi, 3
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x100b31c5
mov ecx, esi
mov edx, ebx
test edi, edi
jle 0x100b318c
mov ebx, dword [ebp + 0xc]
mov al, byte [edx + ebx]
test al, al
je 0x100b318a
cmp al, 0x3f
ja 0x100b3139
cmp al, 0x3e
jae 0x100b315f
cmp al, 0x22
jb 0x100b314d
cmp al, 0x23
jbe 0x100b315f
cmp al, 0x25
je 0x100b315f
cmp al, 0x3a
jbe 0x100b314d
cmp al, 0x3c
jmp 0x100b314b
cmp al, 0x5b
jb 0x100b314d
cmp al, 0x5e
jbe 0x100b315f
cmp al, 0x60
je 0x100b315f
cmp al, 0x7a
jbe 0x100b314d
cmp al, 0x7d
jbe 0x100b315f
cmp al, 0x20
jbe 0x100b315f
cmp al, 0x7f
jae 0x100b315f
cmp byte [ebp + 0x14], 0
je 0x100b3182
cmp al, 0x2f
jne 0x100b3182
mov byte [ecx], 0x25
movzx eax, byte [edx + ebx]
shr eax, 4
mov al, byte [eax + str.0123456789ABCDEF]
mov byte [ecx + 1], al
add ecx, 2
movzx eax, byte [edx + ebx]
and eax, 0xf
mov al, byte [eax + str.0123456789ABCDEF]
inc edx
mov byte [ecx], al
inc ecx
cmp edx, edi
jl 0x100b3116
xor ebx, ebx
cmp edx, edi
je 0x100b31a1
jge 0x100b319f
cmp byte [edx + esi], 0
jne 0x100b319d
inc edx
cmp edx, edi
jl 0x100b3192
cmp edx, edi
jne 0x100b31b8
push ebx
push 0x8000100
sub ecx, esi
push ecx
push esi
push dword [ebp + 8]
call sym.CoreFoundation.dll_CFStringCreateWithBytes
mov ebx, eax
add esp, 0x14
cmp esi, dword [ebp - 8]
je 0x100b31c5
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov eax, ebx
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000234c
leave
ret
Function at 0x100bdf9e
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
test ebx, ebx
je 0x100bdfda
push ebx
call sym.CoreFoundation.dll_CFGetTypeID
pop ecx
mov esi, eax
call sym.CoreFoundation.dll_CFStringGetTypeID
cmp esi, eax
jne 0x100bdfd2
push 0
push ebx
call fcn.100019c4
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x100bdfee
push ebx
call sym.CoreFoundation.dll_CFCopyDescription
jmp 0x100bdfeb
push 0x1014a808
call sym.CoreFoundation.dll___CFStringMakeConstantString
push eax
call sym.CoreFoundation.dll_CFRetain
pop ecx
pop ecx
mov edi, eax
push edi
call sym.CoreFoundation.dll_CFStringGetLength
push edi
call sym.CoreFoundation.dll_CFStringGetCharactersPtr
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x100be046
push edi
call sym.CoreFoundation.dll_CFStringGetLength
mov esi, eax
mov dword [esp], 0x100
push esi
call sym.CoreFoundation.dll_CFStringGetMaximumSizeForEncoding
lea eax, [eax*4 + 8]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
push ebx
push esi
push 0
push edi
call sym.CoreFoundation.dll_CFStringGetCharacters
add esp, 0x1c
mov byte [ebp - 4], 1
push 0xa
pop eax
mov word [ebx + esi*2], ax
xor eax, eax
mov word [ebx + esi*2 + 2], ax
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [ebp - 4], 0
je 0x100be05b
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test edi, edi
je 0x100be066
push edi
call sym.CoreFoundation.dll_CFRelease
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100bfe07
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x10184508]
xor eax, ebp
mov dword [ebp + 0x194], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x74]
push 0x208
push ebx
push eax
mov esi, ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x74]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, eax
test edi, edi
je 0x100bff37
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x100bff37
cmp edi, 0x104
je 0x100bff37
push edi
lea eax, [ebp - 0x74]
push eax
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFStringCreateWithCharacters
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100bfeb1
push ebx
push 2
push esi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFURLCreateWithFileSystemPath
mov edi, eax
add esp, 0x10
test edi, edi
je 0x100bfeb1
push esi
call sym.CoreFoundation.dll_CFRelease
push edi
call sym.CoreFoundation.dll_CFURLCopyLastPathComponent
pop ecx
pop ecx
mov esi, eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x100bff37
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x100bff37
push edi
push ebx
push 0
lea eax, [ebp - 0x74]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100bff2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100bff2f
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x1014c410
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100bff2f
mov ecx, dword [ebp - 0x78]
mov ax, word [ecx + 0xa]
mov word [0x1018a75c], ax
mov ax, word [ecx + 8]
mov word [0x1018a760], ax
mov ax, word [ecx + 0xe]
mov word [0x1018a764], ax
mov ax, word [ecx + 0xc]
mov word [0x1018a768], ax
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
cmp dword [0x1018a758], 0
jne 0x100bff57
test esi, esi
jne 0x100bff51
push 0x10138aa2
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
mov esi, eax
mov dword [0x1018a758], esi
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000234c
add ebp, 0x198
leave
ret
Function at 0x1012b17f
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [sym.imp.objc.dll_objc_msgSend]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x3c]
mov dword [esp + 0x10], ebx
jmp 0x1012b19c
mov ebx, dword [esp + 0x10]
mov esi, dword [sym.imp.objc.dll_sel_registerName]
lea eax, [esp + 0x1c]
push 0xf0000000
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov eax, dword [0x10182ad4]
add eax, edi
push eax
push 8
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test ebx, ebx
je 0x1012b1ee
mov eax, dword [0x10182aec]
push edi
movsd xmm0, qword [eax + edi]
addsd xmm0, qword [0x10157680]
movsd qword [eax + edi], xmm0
call fcn.1012af71
pop ecx
mov eax, dword [0x10182acc]
push dword [esp + 0x38]
push dword [eax + edi]
push str.initWithNumberOfVertices:numberOfEdges:
call esi
pop ecx
push eax
push str.alloc
call esi
pop ecx
push eax
push str.__NSSKGraph
call dword [sym.imp.objc.dll_objc_getClass]
pop ecx
push eax
call ebp
pop ecx
pop ecx
push eax
call ebp
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x38], 0
jbe 0x1012b295
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
sub eax, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edx
push dword [eax + ecx]
mov eax, dword [0x10182ad8]
push dword [eax + edi]
lea eax, [esp + 0x2c]
push eax
mov eax, dword [0x10182ad4]
add eax, edi
push eax
push dword [ecx]
call fcn.1012b6c8
add esp, 0x14
push dword [esp + 0x28]
push dword [esp + 0x28]
push str.addEdgeWithH1:withH2:
call esi
pop ecx
push eax
push ebx
call ebp
mov ecx, dword [esp + 0x24]
add esp, 0x10
mov eax, dword [esp + 0x20]
add ecx, 4
sub dword [esp + 0x18], 1
mov dword [esp + 0x14], ecx
jne 0x1012b246
push str.isAcyclic
call esi
push eax
push ebx
call ebp
push str.isEmpty
mov esi, eax
call dword [sym.imp.objc.dll_sel_registerName]
push eax
push ebx
call ebp
add esp, 0x18
test al, al
jne 0x1012b2eb
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [esp], str.release
call dword [sym.imp.objc.dll_sel_registerName]
push eax
push ebx
call ebp
mov eax, dword [esp + 0x1c]
add esp, 0xc
xor esi, esi
xor ebx, ebx
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x3e8
jl 0x1012b198
test esi, esi
je 0x1012b2ff
mov ecx, dword [esp + 0x44]
mov al, 1
mov dword [ecx], esi
mov ecx, dword [esp + 0x40]
mov dword [ecx], ebx
jmp 0x1012b301
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret