joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002bdf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x10093307
push ecx
push ecx
push esi
mov esi, dword [esp + 0x10]
push edi
xor edi, edi
mov eax, dword [esi]
test eax, eax
je 0x10093360
cmp eax, dword [sym.CoreFoundation.dll___CFConstantStringClassReferencePtr]
je 0x10093360
mov ecx, dword [0x10189b6c]
cmp ecx, 0x400
jae 0x10093336
mov ecx, dword [ecx*4 + 0x10187378]
jmp 0x10093338
mov ecx, edi
cmp eax, ecx
je 0x10093360
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push str.appendCharacters:length:
call dword [0x1018cc4c]
pop ecx
push eax
push esi
call dword [0x1018cc54]
add esp, 0x10
jmp 0x100934b6
mov dl, byte [esi + 4]
mov al, dl
mov cl, dl
and al, 5
and cl, 0x60
push ebx
cmp al, 4
je 0x1009337f
test cl, cl
jne 0x1009337a
mov ebx, dword [esi + 8]
jmp 0x1009338b
mov ebx, dword [esi + 0xc]
jmp 0x1009338b
lea eax, [esi + 8]
test cl, cl
je 0x10093388
mov eax, dword [eax]
movzx ebx, byte [eax]
test dl, 0x10
je 0x100933e3
push 1
mov dword [esp + 0x14], edi
lea eax, [esp + 0x10]
mov edi, dword [esp + 0x24]
push edi
push 1
push eax
push esi
mov dword [esp + 0x20], ebx
call fcn.1008fb3a
mov al, byte [esi + 4]
add esp, 0x14
test al, 0x60
jne 0x100933c7
push 8
pop ecx
and al, 5
push 0xc
cmp al, 4
pop edx
cmovne ecx, edx
add ecx, esi
jmp 0x100933ca
mov ecx, dword [esi + 8]
lea eax, [edi + edi]
push eax
push dword [esp + 0x20]
lea eax, [ecx + ebx*2]
push eax
call fcn.101331a9
add esp, 0xc
jmp 0x100934b5
mov edx, dword [esp + 0x1c]
mov ecx, edi
push ebp
mov ebp, dword [esp + 0x24]
mov byte [esp + 0x1c], 1
mov dword [esp + 0x10], 0x80
cmp ecx, ebp
jge 0x10093415
movzx eax, word [edx + ecx*2]
cmp ax, word [esp + 0x10]
inc ecx
setb byte [esp + 0x1c]
cmp ax, word [esp + 0x10]
jb 0x100933fb
mov al, byte [esp + 0x1c]
xor al, 1
mov dword [esp + 0x10], ebx
movzx eax, al
push eax
push ebp
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], edi
push eax
push esi
call fcn.1008fb3a
mov ah, byte [esi + 4]
add esp, 0x14
mov al, ah
and al, 0x60
cmp byte [esp + 0x1c], 0
jne 0x1009347a
test al, al
jne 0x1009345d
push 8
pop ecx
and ah, 5
push 0xc
cmp ah, 4
pop edx
cmovne ecx, edx
add ecx, esi
jmp 0x10093460
mov ecx, dword [esi + 8]
lea eax, [ebp*2]
push eax
push dword [esp + 0x24]
lea eax, [ecx + ebx*2]
push eax
call fcn.101331a9
add esp, 0xc
jmp 0x100934b4
test al, al
jne 0x10093491
push 8
pop edx
mov al, ah
and al, 5
push 0xc
cmp al, 4
pop ecx
cmovne edx, ecx
add edx, esi
jmp 0x10093494
mov edx, dword [esi + 8]
movzx ecx, ah
shr ecx, 2
and ecx, 1
add ecx, edx
add ecx, ebx
test ebp, ebp
jle 0x100934b4
mov eax, dword [esp + 0x20]
mov al, byte [eax + edi*2]
mov byte [ecx + edi], al
inc edi
cmp edi, ebp
jl 0x100934a5
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret
Function at 0x10002e3c
Capabilities:
Read file on windows

Disassembly:
jmp 0x100bdd54
sub esp, 0x148
mov eax, dword [0x101844f8]
xor eax, esp
mov dword [esp + 0x144], eax
mov eax, dword [esp + 0x158]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x16c]
push edi
mov edi, dword [esp + 0x15c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x4c]
push 0x106
push eax
push edi
call sym.CoreFoundation.dll_CFStringGetFileSystemRepresentation
add esp, 0xc
test al, al
jne 0x100bddbd
test esi, esi
je 0x100bde62
push edi
push 0xffffffffffffffff
push dword [sym.CoreFoundation.dll_kCFErrorDomainCocoa]
jmp 0x100bde58
push 0x1b6
lea eax, [esp + 0x50]
push 0x8080
push eax
call sym.CoreFoundation.dll__NS_open
mov ebx, eax
add esp, 0xc
test ebx, ebx
jns 0x100bdded
test esi, esi
je 0x100bde62
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push edi
push dword [eax]
jmp 0x100bde52
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64i32]
pop ecx
pop ecx
test eax, eax
jns 0x100bde17
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push ebx
mov ebp, dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
pop ecx
test esi, esi
je 0x100bde62
push edi
push ebp
jmp 0x100bde52
mov eax, dword [esp + 0x22]
mov ecx, 0x8000
and eax, 0xf000
cmp ax, cx
je 0x100bde3b
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
pop ecx
test esi, esi
je 0x100bde62
push edi
push 0xd
jmp 0x100bde52
mov eax, dword [esp + 0x30]
test eax, eax
jns 0x100bde69
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
pop ecx
test esi, esi
je 0x100bde62
push edi
push 0xc
push dword [sym.CoreFoundation.dll_kCFErrorDomainPOSIX]
call fcn.100bdbc2
add esp, 0xc
mov dword [esi], eax
xor al, al
jmp 0x100bdefb
jne 0x100bde7a
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
mov ebp, eax
xor esi, esi
jmp 0x100bdee5
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
mov ebp, eax
lea eax, [esp + 0x14]
push 0
push eax
push dword [esp + 0x38]
push ebp
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100bdee1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
test esi, esi
je 0x100bdec3
push edi
push eax
push dword [sym.CoreFoundation.dll_kCFErrorDomainPOSIX]
call fcn.100bdbc2
add esp, 0xc
mov dword [esi], eax
push ebp
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
pop ecx
pop ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
jmp 0x100bde62
mov esi, dword [esp + 0x14]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
mov eax, dword [esp + 0x14]
pop ecx
mov dword [eax], ebp
mov eax, dword [esp + 0x18]
mov dword [eax], esi
mov al, 1
mov ecx, dword [esp + 0x154]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000234c
add esp, 0x148
ret
Function at 0x10003260
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x1008052f
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
lea ebp, [esi + 0xc]
push ebp
call sym.CoreFoundation.dll___CFSpinLock
mov bl, byte [esi + 4]
pop ecx
test bl, 0x10
je 0x100806f3
cmp dword [esi + 0x28], 0
jle 0x100806f3
mov ecx, dword [esp + 0x14]
movzx eax, bl
and bl, 3
and eax, 0xf
and ecx, eax
or byte [esi + 9], cl
push 0x10189aec
mov dword [esp + 0x18], ecx
call sym.CoreFoundation.dll___CFSpinLock
pop ecx
mov ecx, 0x10000
cmp bl, 2
je 0x1008058d
cmp dword [esi + 0x18], 1
je 0x10080590
cmp dword [esi + 0x18], 5
je 0x10080590
or dword [esi + 8], ecx
mov eax, dword [esp + 0x14]
push edi
test al, 8
jne 0x100805aa
test al, 4
je 0x10080647
test dword [esi + 8], ecx
jne 0x10080647
mov ebp, dword [esi + 0x14]
mov ecx, dword [0x10189afc]
mov dword [esp + 0x14], ecx
cmp ebp, 0xffffffff
je 0x10080644
push ecx
call sym.CoreFoundation.dll_CFDataGetMutableBytePtr
push dword [esp + 0x18]
mov edi, eax
call sym.CoreFoundation.dll_CFDataGetLength
pop ecx
pop ecx
test eax, eax
jle 0x10080640
push edi
push ebp
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x10080640
mov edx, dword [edi]
xor ecx, ecx
test edx, edx
je 0x10080621
lea eax, [edi + 4]
cmp dword [eax], ebp
je 0x100805fb
inc ecx
add eax, 4
cmp ecx, edx
jb 0x100805ed
jmp 0x10080621
lea eax, [edx - 1]
cmp ecx, eax
jae 0x1008061c
lea ebp, [edi + 4]
lea ebp, [ebp + ecx*4]
mov eax, dword [ebp + 4]
inc ecx
mov dword [ebp], eax
lea ebp, [ebp + 4]
mov edx, dword [edi]
lea eax, [edx - 1]
cmp ecx, eax
jb 0x10080609
lea eax, [edx - 1]
mov dword [edi], eax
mov eax, dword [0x10179100]
cmp eax, 0xffffffff
je 0x10080640
push 0
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1c], 0x78
push ecx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [esp + 0x18]
lea ebp, [esi + 0xc]
test bl, bl
je 0x100806e7
test al, bl
je 0x100806e7
mov edi, dword [esi + 0x14]
mov ebx, dword [0x10189b00]
mov byte [0x101790fc], 1
cmp edi, 0xffffffff
je 0x100806e7
push ebx
call sym.CoreFoundation.dll_CFDataGetMutableBytePtr
push ebx
mov esi, eax
call sym.CoreFoundation.dll_CFDataGetLength
pop ecx
pop ecx
test eax, eax
jle 0x100806e7
push esi
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x100806e7
mov edx, dword [esi]
xor ecx, ecx
test edx, edx
je 0x100806c8
lea eax, [esi + 4]
cmp dword [eax], edi
je 0x100806a4
inc ecx
add eax, 4
cmp ecx, edx
jb 0x10080696
jmp 0x100806c8
lea eax, [edx - 1]
cmp ecx, eax
jae 0x100806c3
lea edi, [ecx + 1]
lea edi, [esi + edi*4]
mov eax, dword [edi + 4]
inc ecx
mov dword [edi], eax
lea edi, [edi + 4]
mov edx, dword [esi]
lea eax, [edx - 1]
cmp ecx, eax
jb 0x100806b1
lea eax, [edx - 1]
mov dword [esi], eax
mov eax, dword [0x10179100]
cmp eax, 0xffffffff
je 0x100806e7
push 0
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1c], 0x73
push ecx
push eax
call dword [sym.imp.WS2_32.dll_send]
push 0x10189aec
call sym.CoreFoundation.dll___CFSpinUnlock
pop ecx
pop edi
push ebp
call sym.CoreFoundation.dll___CFSpinUnlock
pop ecx
pop esi
pop ebp
pop ebx
ret
Function at 0x1001f508
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x20]
mov ebp, 0x1013b514
push edi
xor edi, edi
test ebx, ebx
js 0x1001f55e
push edi
push esi
push ebx
call sym.CoreFoundation.dll__NS_lseek
add esp, 0xc
cmp eax, esi
jne 0x1001f55e
mov esi, 0x200
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x1001f64a
push esi
push edi
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
cmp eax, esi
jl 0x1001f63e
mov esi, edi
jmp 0x1001f57c
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x1001f64a
lea eax, [esi + 0x200]
cmp dword [esp + 0x20], eax
jl 0x1001f64a
add esi, ecx
test esi, esi
je 0x1001f63e
xor eax, eax
mov dword [esp + 0x10], eax
cmp eax, 4
jae 0x1001f63e
movsx eax, byte [esi + 0x40]
cdq
sub eax, edx
mov byte [esp + 0x18], 1
mov ebx, eax
sar ebx, 1
cmp bl, 5
jne 0x1001f5df
push 4
push esi
push str.Book
call fcn.1001bc12
add esp, 0xc
test al, al
jne 0x1001f5f8
movsx eax, bl
cmp bl, 0xd
jne 0x1001f602
dec eax
push eax
push esi
push str.WordDocument
call fcn.1001bc12
add esp, 0xc
test al, al
je 0x1001f622
mov ebp, 0x1013b540
jmp 0x1001f627
cmp bl, 9
jne 0x1001f5bc
push 8
push esi
push str.Workbook
call fcn.1001bc12
add esp, 0xc
test al, al
je 0x1001f5ff
mov ebp, 0x1013b520
jmp 0x1001f627
push 9
pop eax
dec eax
cmp bl, 0x14
jne 0x1001f622
push eax
push esi
push str.PowerPoint_Document
call fcn.1001bc12
add esp, 0xc
test al, al
je 0x1001f622
mov ebp, 0x1013b55c
jmp 0x1001f627
mov byte [esp + 0x18], 0
mov eax, dword [esp + 0x10]
sub esi, 0xffffff80
inc eax
cmp byte [esp + 0x18], 0
mov dword [esp + 0x10], eax
je 0x1001f58a
test edi, edi
je 0x1001f64a
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
Function at 0x1004931d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x101844f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push esi
push esi
mov ebx, eax
push 0x5a
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
test edi, edi
je 0x10049371
lea eax, [edi + edi]
call fcn.1000333c
mov esi, esp
push edi
push esi
push 0x5a
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
dec eax
push eax
push esi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFStringCreateWithCharacters
add esp, 0xc
mov esi, eax
mov eax, esi
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000234c
leave
ret

Function at 0x1004939f
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x101844f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push esi
push esi
movzx ebx, ax
push 0x59
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
test edi, edi
je 0x100493f4
lea eax, [edi + edi]
call fcn.1000333c
mov esi, esp
push edi
push esi
push 0x59
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
dec eax
push eax
push esi
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFStringCreateWithCharacters
add esp, 0xc
mov esi, eax
mov eax, esi
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000234c
leave
ret
Function at 0x1004ce9c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov eax, dword [0x101844f8]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
mov ebx, dword [esp + 0x74]
push ebp
mov ebp, dword [0x1018cc4c]
push esi
push edi
push str.copyKeyList
mov dword [esp + 0x18], ebx
call ebp
push eax
push ebx
mov ebx, dword [0x1018cc54]
call ebx
add esp, 0xc
lea edi, [esp + 0x18]
mov esi, eax
xor eax, eax
push 8
pop ecx
rep stosd dword es:[edi], eax
push 0x10
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
push str.countByEnumeratingWithState:objects:count:
call ebp
pop ecx
push eax
push esi
call ebx
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x1004cf6c
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx]
mov dword [esp + 0x10], ecx
xor edi, edi
mov eax, dword [esp + 0x20]
cmp ecx, dword [eax]
je 0x1004cf1a
push esi
call dword [0x1018cc30]
pop ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + edi*4]
inc edi
push eax
push 0
push str.setValue:forKey:
call ebp
pop ecx
push eax
push dword [esp + 0x20]
call dword [0x1018cc54]
add esp, 0x10
mov ecx, dword [esp + 0x10]
cmp edi, ebx
jb 0x1004cf0a
push 0x10
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
push str.countByEnumeratingWithState:objects:count:
call ebp
pop ecx
push eax
push esi
call dword [0x1018cc54]
mov ecx, dword [esp + 0x24]
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x1004cf08
test esi, esi
je 0x1004cf77
push esi
call sym.CoreFoundation.dll_CFRelease
pop ecx
mov ecx, dword [esp + 0x78]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000234c
add esp, 0x6c
ret
Function at 0x1006811b
Capabilities:
Set thread local storage value

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
push dword [0x10178ed4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x10068183
cmp esi, 0x1000
je 0x10068183
inc dword [esi]
push ebp
push edi
push 0x46
lea edi, [esi + 4]
pop ebp
mov ecx, dword [edi]
test ecx, ecx
je 0x1006815a
mov eax, dword [edi + 0x118]
test eax, eax
je 0x1006815a
and dword [edi], 0
push ecx
call eax
pop ecx
add edi, 4
sub ebp, 1
jne 0x10068143
cmp dword [esi], 3
pop edi
pop ebp
jne 0x10068183
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [esp], 0x1000
push dword [0x10178ed4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
ret
Function at 0x1006c103
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x68
mov eax, dword [0x101844f8]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
mov ebx, dword [esp + 0x70]
push ebp
push esi
mov esi, dword [esp + 0x7c]
push edi
push esi
call sym.CoreFoundation.dll_CFDataGetBytePtr
push esi
mov edi, eax
call sym.CoreFoundation.dll_CFDataGetLength
pop ecx
pop ecx
push 8
pop ecx
cmp dword [esp + 0x84], ecx
mov dword [esp + 0x1c], eax
cmovle ecx, dword [esp + 0x84]
xor esi, esi
xor ebp, ebp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 3
test eax, eax
jle 0x1006c224
mov eax, ecx
push 0x4c
shl eax, 3
pop edx
sub edx, eax
mov dword [esp + 0x18], edx
mov eax, ebp
cdq
idiv dword [esp + 0x14]
sub edx, 0
je 0x1006c1d2
sub edx, 1
je 0x1006c1b4
sub edx, 1
jne 0x1006c1e3
movzx ecx, byte [edi]
movzx eax, byte [edi - 1]
shl eax, 2
shr ecx, 6
or ecx, eax
and ecx, 0x3f
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, dword [esp + 0x10]
mov byte [esp + esi + 0x20], al
movzx eax, byte [edi]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esp + esi + 0x21], al
add esi, 2
jmp 0x1006c1e3
movzx ecx, byte [edi]
movzx eax, byte [edi - 1]
shr ecx, 4
shl eax, 4
or ecx, eax
and ecx, 0x3f
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, dword [esp + 0x10]
jmp 0x1006c1de
movzx eax, byte [edi]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esp + esi + 0x20], al
inc esi
cmp esi, dword [esp + 0x18]
jl 0x1006c214
mov byte [esp + esi + 0x20], 0xa
inc esi
cmp esi, 0x52
jae 0x1006c2ab
push ebx
push ecx
mov byte [esp + esi + 0x28], 0
call fcn.1006cf1a
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.1006d4a0
add esp, 0x10
xor esi, esi
mov ecx, dword [esp + 0x10]
inc ebp
inc edi
cmp ebp, dword [esp + 0x1c]
jl 0x1006c169
mov eax, ebp
push 3
cdq
pop ebp
idiv ebp
sub edx, 1
je 0x1006c252
sub edx, 1
jne 0x1006c26f
movzx eax, byte [edi - 1]
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esp + esi + 0x20], al
mov byte [esp + esi + 0x21], 0x3d
add esi, 2
jmp 0x1006c26f
movzx eax, byte [edi - 1]
and eax, ebp
shl eax, 4
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esp + esi + 0x20], al
mov word [esp + esi + 0x21], 0x3d3d
add esi, 3
test esi, esi
jle 0x1006c298
mov byte [esp + esi + 0x20], 0xa
inc esi
cmp esi, 0x52
jae 0x1006c2ab
push ebx
push ecx
mov byte [esp + esi + 0x28], 0
call fcn.1006cf1a
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.1006d4a0
add esp, 0x10
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000234c
add esp, 0x68
ret
call fcn.10001e29
int3
Function at 0x10070555
Capabilities:
Parse credit card information

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, 0xf00
push edi
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x10070683
mov edx, dword [esi + 4]
mov edi, dword [esi + 8]
cmp edx, edi
jae 0x10070668
mov ebx, edx
mov al, byte [edx]
mov ecx, ebx
cmp al, 9
jl 0x1007059d
cmp al, 0xa
jle 0x10070591
cmp al, 0xd
je 0x10070591
cmp al, 0x20
jne 0x1007059d
inc edx
mov dword [esi + 4], edx
mov ebx, edx
mov ecx, edx
cmp edx, edi
jb 0x1007057d
movsx ax, byte [ecx]
movzx ebx, ax
cmp ebx, 0x25
jne 0x100705e6
lea eax, [ecx + 1]
mov dword [esi + 4], eax
jmp 0x100705bb
cmp byte [eax], 0x3b
lea ecx, [eax + 1]
je 0x100705e1
mov eax, ecx
cmp eax, edi
jb 0x100705b1
push esi
call fcn.1006dd47
pop ecx
push eax
push str.Encountered_unexpected_EOF_while_parsing_percent_escape_sequence_begun_on_line__d
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push ebp
call fcn.10001bae
add esp, 0xc
mov dword [esi + 0xc], eax
jmp 0x1007065d
mov dword [esi + 4], ecx
jmp 0x1007065d
cmp ebx, 0x3c
jne 0x100706a8
inc ecx
mov dword [esi + 4], ecx
cmp ecx, edi
jae 0x1007066c
movsx ax, byte [ecx]
movzx ebx, ax
cmp ebx, 0x3f
jne 0x10070611
lea eax, [ecx + 1]
push esi
mov dword [esi + 4], eax
call fcn.100707fe
jmp 0x10070634
cmp ebx, 0x21
jne 0x10070688
lea eax, [ecx + 2]
cmp eax, edi
jae 0x10070637
cmp byte [ecx + 1], 0x2d
jne 0x10070637
cmp byte [eax], 0x2d
jne 0x10070637
lea eax, [ecx + 3]
push esi
mov dword [esi + 4], eax
call fcn.10070795
pop ecx
jmp 0x1007065d
lea eax, [ecx + 1]
mov dword [esi + 4], eax
cmp eax, edi
jae 0x10070654
mov ecx, eax
cmp byte [ecx], 0x3e
je 0x10070654
lea eax, [ecx + 1]
mov dword [esi + 4], eax
mov ecx, eax
cmp eax, edi
jb 0x10070643
cmp byte [eax], 0x3e
jne 0x1007066c
inc eax
mov dword [esi + 4], eax
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1007056d
test eax, eax
jne 0x10070683
push str.Encountered_unexpected_EOF_while_parsing_inline_DTD
call sym.CoreFoundation.dll___CFStringMakeConstantString
push eax
push ebp
call fcn.10001bae
add esp, 0xc
mov dword [esi + 0xc], eax
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call fcn.1006dd47
pop ecx
push eax
push ebx
push str.Encountered_unexpected_character__c_on_line__d_while_parsing_inline_DTD
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push ebp
call fcn.10001bae
add esp, 0x10
jmp 0x10070680
cmp ebx, 0x5d
jne 0x10070688
lea eax, [ecx + 1]
mov dword [esi + 4], eax
jmp 0x10070683
Function at 0x1007ce27
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x28
mov eax, dword [0x101844f8]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
push 0x10
pop ebp
push 2
xor edi, edi
mov dword [esp + 0x14], ebp
lea esi, [esp + 0x18]
xor ebx, ebx
pop ecx
push 0
push ecx
push ecx
call dword [sym.imp.WS2_32.dll_socket]
push ebp
push 0
push esi
mov dword [ebx + 0x10179100], eax
call fcn.101331af
add esp, 0xc
push 2
pop eax
push 0x7f000001
mov word [esi], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esi + 4], eax
test edi, edi
js 0x1007cea7
push ebp
push esi
push dword [ebx + 0x10179100]
call dword [sym.imp.WS2_32.dll_bind]
mov edi, eax
test edi, edi
js 0x1007cea7
lea eax, [esp + 0x10]
push eax
push esi
push dword [ebx + 0x10179100]
call dword [sym.imp.WS2_32.dll_getsockname]
mov edi, eax
cmp dword [esp + 0x10], ebp
push 0xffffffffffffffff
pop eax
cmovne edi, eax
add ebx, 4
add esi, ebp
push 2
pop ecx
cmp ebx, 8
jb 0x1007ce4b
test edi, edi
js 0x1007cef0
mov esi, dword [sym.imp.WS2_32.dll_connect]
lea eax, [esp + 0x24]
push ebp
push eax
push dword [0x10179100]
call esi
mov edi, eax
test edi, edi
js 0x1007cef0
push ebp
lea eax, [esp + 0x18]
push eax
push dword [0x10179104]
call esi
mov edi, eax
test edi, edi
jns 0x1007cf13
push dword [0x10179100]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push dword [0x10179104]
call esi
or eax, 0xffffffff
mov dword [0x10179100], eax
mov dword [0x10179104], eax
mov ecx, dword [esp + 0x34]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000234c
add esp, 0x28
ret