joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7003f91
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x7003fa0
pop dword [ebp - 0x2c]
mov eax, 0x55328d1c
add eax, 0xb1cdb284
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x5af32c21
sub dword [ebp - 0x3c], 0xca0e6d6
mov dword [ebp - 0x38], 0x927389f4
sub dword [ebp - 0x38], 0x60403daf
mov dword [ebp - 0x34], 0xa2faaba
sub dword [ebp - 0x34], 0xbde3668c
mov dword [ebp - 0x30], 0xf19cbdcb
add dword [ebp - 0x30], 0xe634235
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x54e24c36
add dword [ebp - 0x3c], 0x1f901d20
mov dword [ebp - 0x38], 0x61269868
sub dword [ebp - 0x38], 0x1fba36f3
mov dword [ebp - 0x34], 0xd3e60314
sub dword [ebp - 0x34], 0x707696a8
mov dword [ebp - 0x30], 0xe66e5221
add dword [ebp - 0x30], 0x1991addf
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x9b42fe88
sub eax, 0x9441de54
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ae6d
push 0
call eax
mov ecx, 0x4918
mov edi, eax
mov edx, 0x44ac869a
sub edx, 0x3daaa69a
add edx, dword [ebp - 0x2c]
mov esi, 0xf539fb1d
add esi, 0x40bc9184
add dword [ebp - 0x1c], edi
mov ebx, dword [edx]
mov dword [ebp - 4], 0x169025a3
sub ebx, esi
xor dword [ebp - 0x1c], ecx
mov dword [edi], ebx
xor dword [ebp - 4], esi
add edi, 0xceaabb40
sub edi, 0xceaabb3c
add edx, 0x8741403a
add edx, 0x78bebfca
loop 0x70040b7
add eax, 0xed6b3a1d
sub eax, 0xed6a22ea
mov ebx, eax
add eax, 0x82500192
sub eax, 0x8250018d
mov ecx, 0x9ad048be
add ecx, 0x6c2fb742
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x700c938
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x7010cdd
call fcn.07001ea6
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700cc00
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700d3f5
lea ecx, [ebp - 0x10]
call fcn.0700c8d5
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700c9a5
mov eax, dword [eax + 0x14]
jmp 0x700c9aa
mov eax, 0x70127b2
push 0x701411c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700c9dc
mov ecx, dword [edi + 4]
call fcn.07007826
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07003f91
mov eax, edi
call fcn.07002b7f
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003f91
int3
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x401443
pop dword [ebp - 0x3c]
mov eax, 0x401443
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xb86ffdf7
sub dword [ebp - 0x4c], 0x6a1db8ac
mov dword [ebp - 0x48], 0x994e70c7
sub dword [ebp - 0x48], 0x671b2482
mov dword [ebp - 0x44], 0x88a2da7d
sub dword [ebp - 0x44], 0x3c56964f
mov dword [ebp - 0x40], 0x661c00eb
sub dword [ebp - 0x40], 0x661c00eb
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x75ae5af
add eax, 0xf8e59ac9
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xecee8718
sub dword [ebp - 0x4c], 0x787c1dc2
mov dword [ebp - 0x48], 0x618a10d6
add dword [ebp - 0x48], 0xdfe2509f
mov dword [ebp - 0x44], 0x20386099
add dword [ebp - 0x44], 0x43370bd3
mov dword [ebp - 0x40], 0xae64bd74
add dword [ebp - 0x40], 0x519b428c
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x1e7e9b15
sub eax, 0x1e3e1a99
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b0f1
push 0
call eax
mov ecx, 0x42043593
sub ecx, 0x4203e2d8
xor edx, edx
add edx, eax
mov edi, 0x451400
add edi, dword [ebp - 0x3c]
mov esi, 0xccb4d842
mov dword [ebp - 4], 0xde257d34
mov ebx, dword [edi]
add dword [ebp - 0xc], 0x79079c67
add ebx, esi
xor dword [ebp - 0x2c], eax
mov dword [edx], ebx
add dword [ebp - 0x18], edx
add edx, 4
add edi, 0x73625806
add edi, 0x8c9da7fe
loop 0x401556
add eax, 0x32cb66f8
add eax, 0xcd35d6c7
xor ebx, ebx
add ebx, eax
add eax, 0xdceef421
add eax, 0x23110be4
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x10001fc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x10001fcc
or eax, 0xffffffff
pop ebp
ret
push esi
mov esi, dword [eax + 4]
mov ecx, 0x1388
mov edx, esi
call fcn.100064c0
test eax, eax
jle 0x10002008
mov eax, dword [ebp + 8]
push 0
push 0x80
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x10001ffd
mov eax, 0xfffffff5
jmp 0x1000200a
jns 0x10002006
mov eax, 0xffffd8bb
jmp 0x1000200a
test eax, eax
jns 0x10002028
mov dword [edi], 0
test eax, eax
jns 0x1000202a
neg eax
push eax
call dword [sym.imp.MSVCR100.dll_strerror]
add esp, 4
mov eax, 0xfffffffe
pop esi
pop ebp
ret
mov dword [edi], eax
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10002360
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x1000236c
or eax, 0xffffffff
pop ebp
ret
push esi
mov esi, dword [eax + 4]
mov edx, esi
call fcn.100064c0
test eax, eax
jle 0x1000239e
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0
push eax
push ecx
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x10002395
lea esi, [eax - 0xb]
jmp 0x100023a4
jns 0x1000239e
mov esi, 0xffffd8bb
jmp 0x100023a4
mov esi, eax
test esi, esi
jns 0x100023cb
mov dword [edi], 0
call dword [sym.imp.MSVCR100.dll__errno]
mov edx, dword [eax]
push edx
call dword [sym.imp.MSVCR100.dll_strerror]
xor eax, eax
add esp, 4
cmp esi, 0xfffffff5
setne al
pop esi
lea eax, [eax + eax - 4]
pop ebp
ret
mov dword [edi], esi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10005ae0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push 1
push edx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
pop ebp
ret
Function at 0x100063f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100160a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 6
push 1
push 2
mov dword [ebp - 0x18], 1
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
js 0x1000643a
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x1000644c
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d620
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, 2
mov dword [ebp - 0x14], eax
push str.127.0.0.1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov word [ebp - 0x14], cx
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x6987
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea edx, [ebp - 0x14]
push edx
push esi
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x100064ac
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, 0xfffffedd
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d620
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1000d620
mov esp, ebp
pop ebp
ret

Function at 0x10006590
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100160a0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x100161b8]
push edi
mov dword [ebp - 0x18], 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
test esi, esi
je 0x100065c7
mov eax, dword [ebp + 8]
test eax, eax
je 0x100065c7
add eax, 0x10
mov dword [ebp - 0x18], eax
mov edi, dword [sym.imp.WS2_32.dll_send]
push 0
push 0x10
lea eax, [ebp - 0x18]
push eax
push ebx
call edi
cmp eax, 0x10
je 0x100065f5
call dword [sym.imp.MSVCR100.dll___iob_func]
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000d620
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x1000660a
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1000660a
push 0
push ecx
push esi
push ebx
call edi
add eax, 0x10
cmp eax, dword [ebp - 0x18]
je 0x1000661f
call dword [sym.imp.MSVCR100.dll___iob_func]
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop edi
call fcn.1000d620
mov esp, ebp
pop ebp
ret
Function at 0x10006630
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100160a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100161b8]
push ebx
push esi
push edi
cmp eax, 1
jne 0x10006733
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.libplist2.dll_plist_new_dict]
mov ebx, dword [sym.imp.libplist2.dll_plist_new_string]
push str.com.apple.iTunes
mov esi, eax
call ebx
mov edi, dword [sym.imp.libplist2.dll_plist_dict_set_item]
add esp, 4
push eax
push str.BundleID
push esi
call edi
add esp, 0xc
push str.usbmuxd____
call ebx
add esp, 4
push eax
push str.ClientVersionString
push esi
call edi
add esp, 0xc
push 0
push 1
call dword [sym.imp.libplist2.dll_plist_new_uint]
push eax
push str.ConnType
push esi
call edi
add esp, 0x14
push str.Listen
call ebx
add esp, 4
push eax
push str.MessageType
push esi
call edi
add esp, 0xc
push 0
push 3
call dword [sym.imp.libplist2.dll_plist_new_uint]
push eax
push str.kLibUSBMuxVersion
push esi
call edi
add esp, 0x14
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
push ecx
push esi
call dword [sym.imp.libplist2.dll_plist_to_xml]
add esp, 0xc
push esi
call dword [sym.imp.libplist2.dll_plist_free]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp + 8]
add esp, 4
push edx
mov edx, dword [ebp + 0xc]
mov ecx, 8
call fcn.10006590
mov esi, eax
mov eax, dword [ebp - 0x18]
add esp, 4
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d620
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0
mov edi, 0x10
push edi
lea edx, [ebp - 0x14]
push edx
push esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 3
mov dword [ebp - 8], ecx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, edi
je 0x1000677a
call dword [sym.imp.MSVCR100.dll___iob_func]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d620
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x14], edi
je 0x100067a0
call dword [sym.imp.MSVCR100.dll___iob_func]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d620
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d620
mov esp, ebp
pop ebp
ret
Function at 0x10006ed0
Capabilities:
Send data
Send data on socket

Disassembly:
test eax, eax
jns 0x10006eda
mov eax, 0xffffffea
ret
push esi
push 0
push edi
push ecx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
test esi, esi
jns 0x10006f0e
mov dword [ebx], 0
call dword [sym.imp.MSVCR100.dll___iob_func]
call dword [sym.imp.MSVCR100.dll__errno]
mov edx, dword [eax]
push edx
call dword [sym.imp.MSVCR100.dll_strerror]
add esp, 4
mov eax, esi
pop esi
ret
cmp esi, edi
jae 0x10006f18
call dword [sym.imp.MSVCR100.dll___iob_func]
mov dword [ebx], esi
xor eax, eax
pop esi
ret
Function at 0x10006f20
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100160a0]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x100161b8], 1
mov eax, dword [ebp + 0x10]
push ebx
movzx ecx, cx
push esi
push edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], ecx
jne 0x1000703c
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.libplist2.dll_plist_new_dict]
mov ebx, dword [sym.imp.libplist2.dll_plist_new_string]
push str.com.apple.iTunes
mov esi, eax
call ebx
mov edi, dword [sym.imp.libplist2.dll_plist_dict_set_item]
add esp, 4
push eax
push str.BundleID
push esi
call edi
add esp, 0xc
push str.usbmuxd____
call ebx
add esp, 4
push eax
push str.ClientVersionString
push esi
call edi
mov eax, dword [ebp - 0x2c]
add esp, 0xc
push 0
push eax
call dword [sym.imp.libplist2.dll_plist_new_uint]
push eax
push str.DeviceID
push esi
call edi
add esp, 0x14
push str.Connect
call ebx
add esp, 4
push eax
push str.MessageType
push esi
call edi
mov ecx, dword [ebp - 0x24]
add esp, 0xc
push ecx
call dword [sym.imp.WS2_32.dll_htons]
movzx eax, ax
cdq
push edx
push eax
call dword [sym.imp.libplist2.dll_plist_new_uint]
push eax
push str.PortNumber
push esi
call edi
add esp, 0x14
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.libplist2.dll_plist_to_xml]
add esp, 0xc
push esi
call dword [sym.imp.libplist2.dll_plist_free]
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add esp, 4
push ecx
mov ecx, 8
call fcn.10006590
mov edx, dword [ebp - 0x1c]
add esp, 4
push edx
mov esi, eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000d620
mov esp, ebp
pop ebp
ret
push ecx
mov dword [ebp - 0x28], eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [0x100161b8]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.WS2_32.dll_send]
mov word [ebp - 0x24], ax
xor eax, eax
push eax
mov word [ebp - 0x22], ax
push 0x10
lea eax, [ebp - 0x18]
push eax
push esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 2
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], 0x18
call edi
cmp eax, 0x10
je 0x1000709f
call dword [sym.imp.MSVCR100.dll___iob_func]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000d620
mov esp, ebp
pop ebp
ret
push 0
push 8
lea ecx, [ebp - 0x28]
push ecx
push esi
call edi
add eax, 0x10
cmp eax, dword [ebp - 0x18]
je 0x100070c2
call dword [sym.imp.MSVCR100.dll___iob_func]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d620
mov esp, ebp
pop ebp
ret
Function at 0x100071f0
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x25
call dword [sym.imp.MSVCR100.dll_malloc]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
add esp, 4
push 0xf0000000
push 1
xor ebx, ebx
push ebx
mov edi, eax
push ebx
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x10007233
push 0xf0000008
push 1
push ebx
push ebx
lea ecx, [ebp - 4]
push ecx
call esi
mov dword [ebp - 8], ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
xor esi, esi
mov edi, edi
cmp esi, 8
je 0x1000727f
cmp esi, 0xd
je 0x1000727f
cmp esi, 0x12
je 0x1000727f
cmp esi, 0x17
je 0x1000727f
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push 4
push eax
call ebx
mov eax, dword [ebp - 8]
cdq
xor eax, edx
sub eax, edx
and eax, 0x8000000f
jns 0x10007274
dec eax
or eax, 0xfffffff0
inc eax
mov cl, byte [eax + str.ABCDEF0123456789]
mov byte [esi + edi], cl
jmp 0x10007283
mov byte [esi + edi], 0x2d
inc esi
cmp esi, 0x24
jl 0x10007240
mov edx, dword [ebp - 4]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov byte [edi + 0x24], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100078c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000e228
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100160a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
cmp ecx, eax
jne 0x100078f3
xor al, al
jmp 0x1000793c
xor edx, edx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x2c], dx
lea edx, [ebp - 0x2c]
mov dword [ebp - 4], eax
call fcn.100072b0
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x1000791a
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
sete bl
cmp dword [ebp - 0x18], 8
jb 0x1000793a
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000d620
mov esp, ebp
pop ebp
ret
Function at 0x10007960
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000e148
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100160a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x10016704]
test eax, eax
jne 0x10007ac1
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x2c], ax
mov eax, dword [0x10016738]
mov ecx, eax
mov dword [ebp - 0x18], 7
lea esi, [ecx + 2]
nop
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x100079b0
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [ebp - 0x2c]
call fcn.10007f80
push 0x19
mov eax, str.SystemConfiguration.plist
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.10007e50
mov eax, dword [ebp - 0x2c]
mov ebx, 8
mov dword [ebp - 0x30], 0
cmp dword [ebp - 0x18], ebx
jae 0x100079f3
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10007a4a
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], ebx
jae 0x10007a09
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x30]
push ecx
call fcn.100087f0
mov eax, dword [ebp - 0x30]
add esp, 4
test eax, eax
je 0x10007aaa
push 0x10016704
push str.SystemBUID
push eax
call dword [sym.imp.libplist2.dll_plist_dict_get_item]
add esp, 8
push eax
call dword [sym.imp.libplist2.dll_plist_get_string_val]
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.libplist2.dll_plist_free]
add esp, 0xc
jmp 0x10007aaa
call dword [sym.imp.libplist2.dll_plist_new_dict]
mov dword [ebp - 0x30], eax
call fcn.100071f0
mov esi, eax
push esi
call dword [sym.imp.libplist2.dll_plist_new_string]
push eax
mov eax, dword [ebp - 0x30]
push str.SystemBUID
push eax
call dword [sym.imp.libplist2.dll_plist_dict_set_item]
mov ecx, dword [ebp - 0x2c]
add esp, 0x10
cmp dword [ebp - 0x18], ebx
jae 0x10007a7f
lea ecx, [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
call fcn.10008870
test eax, eax
je 0x10007a97
push esi
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
xor esi, esi
mov ecx, dword [ebp - 0x30]
push ecx
mov dword [0x10016704], esi
call dword [sym.imp.libplist2.dll_plist_free]
add esp, 4
cmp dword [ebp - 0x18], ebx
jb 0x10007abc
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, dword [0x10016704]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000d620
mov esp, ebp
pop ebp
ret
Function at 0x100086f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x100086fc
or eax, 0xffffffff
pop ebp
ret
push esi
push 0x10011d8c
push eax
call dword [sym.imp.MSVCR100.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x10008718
lea eax, [esi - 2]
pop esi
pop ebp
ret
push edi
push 2
push 0
push esi
call dword [sym.imp.MSVCR100.dll_fseek]
push esi
call dword [sym.imp.MSVCR100.dll_ftell]
push esi
mov edi, eax
call dword [sym.imp.MSVCR100.dll_rewind]
add esp, 0x14
test edi, edi
jne 0x10008752
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [ebp + 8]
add esp, 4
mov dword [ebx], edi
mov dword [eax], edi
pop edi
xor eax, eax
pop esi
pop ebp
ret
push edi
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
mov dword [ebx], eax
push esi
test eax, eax
jne 0x10008775
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
pop edi
mov eax, 0xfffffffd
pop esi
pop ebp
ret
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fread]
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
mov ecx, dword [ebp + 8]
add esp, 0x14
mov dword [ecx], edi
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x100087a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x100087ac
or eax, 0xffffffff
pop ebp
ret
push esi
push 0x10012d6c
push eax
call dword [sym.imp.MSVCR100.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x100087e2
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push eax
push 1
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 0x14
xor eax, eax
pop esi
pop ebp
ret
or eax, 0xffffffff
pop esi
pop ebp
ret

Function at 0x10008c40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov ch, 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.100089b4
jne 0x10008c93
repz ret 0x458d
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x10008ca2
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.100089b4
push 0x8d41c1db
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid