joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10244509
Capabilities:
Packed with generic packer

Disassembly:
push ecx
push 0x3d97d190
pushfd
shr dword [esp + 4], 0x90
push ebx
mov ebx, dword [esp + 8]
add word [esp + ebx - 0x3d8f], 0x6fa8
push 0x62bb262e

Function at 0x102463a0
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [esp + esi - 0x9ac080b]
call fcn.1009c5f2

Function at 0x102463ac
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], 0xa978826
call fcn.1020c818

Function at 0x102463f8
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
dec eax
mov dword [esp], 0x140c1c08
inc ecx
not ah
call fcn.101ad2ab

Function at 0x10249dee
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x1c]
jae fcn.100019eb
rol dword [esp + 0x14], 0x8f
lea eax, [esp + eax + 0x18]
mov word [eax], cx
push 0x1f9c211c
jae 0x101fb467

Function at 0x1024ae3f
Capabilities:
Packed with generic packer

Disassembly:
call fcn.101a9173
insd dword es:[edi], dx
lea esp, [esp]
pop ebp
push edx
sub edx, edi
and eax, 0x322c555f
arpl word [edx + ecx*2], ax
mov ebp, 0xe7ad8118
int 0xff
salc
invalid
call fcn.1022b1f4
mov edx, dword [esp + edx*2 - 0x6dffe8]
jns 0x1020cc43
sub esi, dword [esp + 0x24]
or esi, dword [esp + 0x10]
jns 0x1009fed6
mov eax, 0xda15e2b0
shl eax, 0xf3
dec ecx
mov eax, esi
jne 0x101033f7
jp 0x101f7b55
inc esi
lodsb al, byte [esi]
or bl, byte [edx - 0x80]
adc dword [esi], esi
rcr byte [edx + 0x3fdad4f], 0x92
mov cl, 0x47
loop 0x1010343f
cmp dword [edi], 0xf3176690
rcl esp, cl
ficom word cs:[esi + 7]
dec ebx
inc ecx
invalid
and eax, dword [0x1312f8e8]
add cl, ah
lodsb al, byte [esi]
cmc
aam 0xa9
test ch, bh
mov byte [0xd69dca85], al
lea ebp, [edx - 0x31124d1b]
xchg ebp, eax
xor byte [eax + 0x26], ah
adc bl, cl
push edi
cwde
test edx, eax
push es
iretd
dec ecx
sbb esi, 1
push 0x56269900
push 0xe5b29092
inc cx
mov dword [esi], eax
dec eax
lea esp, [esp + 0x10]
jmp fcn.10144331
lea esp, [esp + 8]
jmp fcn.100aa4cf
jmp 0x101ab209
jne 0x10147b95
xor bl, dl
call fcn.1024049e
push 0xd1178018
mov word [ebp], dx
jmp 0x101d2d48
add dword [esp + 0x14], 0x712c9
mov ecx, ebx
and bx, 0xbb18
cmp ebx, 0xe68bf109
sets bl
setbe bl
add ebx, 0x110c6c92
not cl
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx + ebx + 0x79c5d96d]
jns 0x100e61bd
add dword [esp + ebx + 0x79c5d96d], 0x12ea88
test ebx, 0x31073c96
call fcn.10162596

Function at 0x1024be62
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea ecx, [ecx + esi + 0x41521ed7]
mov byte [esp + 0x3c], 0x30
mov esi, dword [esp + 0x24]
jns 0x101397d6
add dword [esp + 0x18], 0xeff631ae
shr word [esp + 0x1c], 0x3a
setns byte [esp + 0x1c]
push dword [esp + 0x38]
popfd
lea esp, [esp + 0x40]
ret
Function at 0x1024e62a
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
add byte [esp + ecx*8], bh
call fcn.1009e87f
jp fcn.100aecc0
loop 0x100aec23
shr dword [eax], 0x50
pop edi
cmc
inc eax
dec edi
aas
xor byte [ebp - 0x1b], ah
dec esi
sub al, 0x81
sahf
stc
sub al, 0x34
pop es
movsd dword es:[edi], dword [esi]
sbb eax, 0xb222a18f
cmpsd dword [esi], dword es:[edi]
jmp 0x100aed19
inc byte [esp + 3]
mov dword [esp], ecx
call fcn.101ad327
xor edi, 0x3e1b223f
sal word [esp + 9], 0x4f
ja 0x1022330c
seta byte [esp + 0x14]
dec edi
xor dword [esp + 0x14], 0x56888e8c
jne 0x102516ff
call fcn.1018a9fb
adc eax, 0xcccccccc
int3
add byte [eax], al
add byte [eax - 0x7f], ch
sub al, 0x84
retf
neg bx
mov edi, dword [esp + 4]
setb bl
jg 0x10254c1c
cmp byte [edx + esi], bl
out 0x25, eax
jne 0x100d281e
or bh, byte [ecx]
iretd
shl byte [esp], 0xe7
xor edi, 0x25870009
xor ebx, edi
jmp 0x10246aaf
adc cl, ch
pop es
enter 0xfffffffffffffffb, 0x66
movsx ebx, byte [esp + edi + 0x1ca8721d]
movsx bx, byte [esp + edi + 0x1ca8721d]
jne 0x100d286c
push ebx
mov dword [esp], 0x78556a59
call fcn.101af011
std
mov eax, 0x11c3ffcb
mov ecx, 0xdf039942
push esp
test dword [0xd4993e9d], 0x2055f381
salc
loopne 0x1015f44e
retf
jns 0x1015f407
jne 0x1015f3e6
aad 0xdb
pop ss
mov dl, 0xb1
inc ebx
push edi
rcr byte [esi], cl
push ds
cli
dec esi
jg 0x1015f39e
in eax, 0x87
push ebp
xor al, 0xf7
push 0xfffffffffffffff3
imul ebx, ebx, 0xffffffa9
cmp eax, 0x9099eadf
cld
sub edx, dword [esi - 0x7d]
mov eax, 0xb5681b1
fidivr word [ecx + 0x3a77a0b0]
ja 0x1015f443
pop edx
mov cl, 0x62
dec edi
pushal
sti
jo 0x1015f3c3
add ah, cl
int3
or dword [esi + 0x4d74a387], 0x92eee798
inc ebp
sbb ch, cl
cmpsb byte [esi], byte es:[edi]
mov al, dh
inc esp
and al, 0xf3
mov dh, 0x88
wait
xchg edx, eax
out 0xce, al
push 0xffffffffffffff97
xchg esi, eax
inc ebx
push eax
push ss
rol dword [0xc8b3b265], cl
aaa
pushal
imul ebx, dword [ecx - 0x37], 0xf92c2d17
scasb al, byte es:[edi]
xchg byte [edx], ah
pop ebx
ret
mov dword [ebp], edi
call fcn.101324a5
not dword [esp + 5]
sub ebp, 4
push 0x97b9f094
jmp 0x10211b5c
call fcn.101c05b0
sub byte [esp + ebx*2 + 0x5ab608ca], 0x8a
mov edi, 0xce0c8933
mov ecx, dword [esp + ebx + 0x2d5b045f]
xor edi, dword [esp + edi + 0x31f376e9]
jg 0x100aec74
sub ebx, 0x9abfb3b0
jg 0x1015f3a4
not edi
shl word [esp + 0xe], 0xa
ror edi, 3
jmp 0x10153146
cmp bl, byte [esp + 0x1f]
not bx
bswap ebx
mov ebx, dword [esp + ebx + 0x1001ae1]
jg 0x10112e1f
jae 0x1019c58e
add dword [esp + 0x1c], 0x3a94ebf
xor dword [esp + 0x1c], 0xc13c4d0b
add dword [esp + 0x1c], 0x1111efaa
call fcn.10132169

Function at 0x102525f7
Capabilities:
Packed with generic packer

Disassembly:
sbb dword [esp + 3], 0x5f8f849f
xor dl, 0x37
sal byte [esp + 1], 0xe7
sal byte [esp + 3], 0x63
jae 0x101cba76
movsb byte es:[edi], byte [esi]
nop
sbb ecx, dword [ebp + 0x2b873ab1]
sar byte [ecx], 1
invalid
rol dl, 1
mov dword [esp], 0x8007e892
ror byte [esp + 7], 0xc4
push 0x7015de3e
adc dl, 0xbb
ror dword [esp + 8], 9
jae 0x100e9ebf
lea esp, [esp + 0x10]
jmp fcn.100aa4cf
Function at 0x10252907
Capabilities:
Packed with generic packer

Disassembly:
or eax, dword [eax + esi + 4]
mul ebp
push 0x28b6c694
mov dword [esi], edx
call fcn.10147d4b
neg byte [esp + 0x10]
not word [esp + 0x10]
add word [esp + 0x10], 0xfab9
call fcn.101b5aa6

Function at 0x10252de6
Capabilities:
Packed with generic packer

Disassembly:
add dword [esp], 0xc2258
mov dword [esp + 0xc], ebp
push 0x2a3d7d3f
or word [esp], 0x7326
mov edx, ebp
mov edx, dword [esp + 4]
mov edx, dword [edx]
add dword [esp + 0x28], 0xefe7b724

Function at 0x10254cf2
Capabilities:
Authenticate hmac

Disassembly:
not word [esp + ecx*8 - 0x2a8]
jge 0x101c39cf
lea esp, [esp + 0xc]
jmp fcn.10154f3a
and al, 1
mov dword [esp + edi*4 + 0x55244af8], edi
push ebp
jno 0x1020a0ce
sbb edi, ecx
in eax, 0x95
xchg edx, eax
push 0x313b4860
mov cl, 0x81
out 0x4c, al
cmp al, 0x9c
and edi, dword [ecx + 0x20576049]
aam 0x21
scasb al, byte es:[edi]
jns 0x10254cf8
scasb al, byte es:[edi]
jge 0x10254ca8
xor dword [eax - 0x5f], ebx
and cl, byte [ebx + 0x70ca3083]
fldenv [eax + 0xfdaca63]
fimul dword [esi + 0x15]
xor edi, 0xfffffffc
sub dword [ebp + 0x66], esp
dec edi
fisub dword [esi + 0x4d]
cmp ebx, edi
je 0x10254d96
cmc
dec esi
xchg edx, esp
invalid
mov cl, byte [edi - 0x1d491f2d]
imul edx, dword [eax + edi*4 + 0x63], 0x68cb778a
bound edx, qword ds:[edx - 0x4f]
sub esp, dword [edx - 0x254d1719]
out dx, eax
mov ebx, 0x4762317c
invalid

Function at 0x1025802f
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + 0x30], eax
mov ebp, dword [esp + edx*8 + 0x60c330]
call fcn.1013de06

Function at 0x102a4fc3
Capabilities:
Encode data using base64

Disassembly:
push 0xcf30ea88
and esi, 0xff
call fcn.1033aae8
Function at 0x40a420
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x4131f0]
cmp ax, 0xcb
je 0x40a51f
cmp ax, 0xcc
je 0x40a51f
mov edx, dword [0x41a710]
test edx, edx
je 0x40a452
mov eax, dword [0x41a5c0]
call edx
mov ebx, eax
jmp 0x40a457
mov ebx, 0x41a5c4
cmp word [0x41a5b0], 0
jle 0x40a47a
mov eax, 0x41a590
call fcn.0040a690
mov eax, ebx
call fcn.00409ff0
mov eax, ebx
call fcn.0040a070
mov esi, dword [ebx]
jmp 0x40a49d
mov edi, dword [esi + 4]
test byte [esi], 1
jne 0x40a498
mov edx, esi
mov eax, ebx
call fcn.00409490
jmp 0x40a49b
and dword [esi], 0xfffffffe
mov esi, edi
test esi, esi
jne 0x40a480
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x41a5b0], 0
jle 0x40a51f
mov edx, 0x41a4d0
mov eax, ebx
call fcn.004095e0
mov esi, eax
test eax, eax
je 0x40a4f2
mov eax, dword [0x41a564]
mov dword [esi + 0xc], eax
cmp dword [0x41a564], 0
je 0x40a4e7
mov eax, dword [0x41a564]
mov dword [eax + 8], esi
mov eax, dword [ebx + 0x94]
mov dword [0x41a564], eax
sub word [0x41a5b0], 1
cmp word [0x41a5b0], 0
sete bl
mov eax, 0x41a590
call fcn.0040a6a0
test bl, bl
je 0x40a51f
mov eax, 0x41a590
call fcn.0040a680
pop edi
pop esi
pop ebx
ret
Function at 0x40c960
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x22c]
push ebx
push esi
push edi
call sub.kernel32.dll_GetCommandLineA
mov dword [0x413260], eax
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
push 0x105
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
push 0
push 0
push 0
push 0
mov esi, eax
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
movzx eax, word [0x419040]
push eax
call sub.kernel32.dll_WideCharToMultiByte
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x218]
push eax
xor ecx, ecx
xor edx, edx
mov edi, ebx
mov eax, ebx
call fcn.0040c7a0
mov eax, dword [ebp - 0x218]
add eax, 1
mov dword [0x41a240], eax
mov dword [0x41a770], 0
nop dword [eax]
mov eax, dword [0x41a240]
shl eax, 2
add eax, dword [0x41a770]
mov dword [0x41a250], eax
mov eax, dword [0x41a240]
shl eax, 2
add eax, dword [0x41a250]
lea ebx, [eax + 4]
add eax, 4
lea eax, [eax + esi*2]
add eax, 2
mov edx, dword [ebp - 0x214]
lea eax, [eax + edx*2]
mov dword [ebp - 0x228], eax
cmp dword [0x41a770], 0
jne 0x40ca51
mov eax, dword [ebp - 0x228]
mov edx, dword [ebp - 0x22c]
lea eax, [eax + edx + 1]
add eax, dword [ebp - 0x210]
call fcn.00409de0
mov dword [0x41a770], eax
test eax, eax
jne 0x40c9e8
lea eax, [ebp - 0x20c]
lea ecx, [esi + esi]
mov edx, ebx
call fcn.00401de0
mov word [ebx + esi*2], 0
mov eax, dword [0x41a770]
mov edx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0x224]
push eax
lea ecx, [edx + esi*2 + 2]
mov eax, dword [0x41a770]
lea edx, [eax + 4]
mov eax, edi
call fcn.0040c7a0
mov ecx, dword [ebp - 0x228]
mov eax, dword [ebp - 0x22c]
lea eax, [ecx + eax + 1]
add eax, dword [ebp - 0x210]
mov edi, eax
mov esi, dword [ebp - 0x218]
test esi, esi
jl 0x40cb19
mov ebx, 0xffffffff
nop dword [eax]
add ebx, 1
mov edx, dword [0x41a250]
mov eax, dword [ebp - 0x228]
mov dword [edx + ebx*4], eax
push 0
push 0
mov eax, edi
sub eax, dword [ebp - 0x228]
push eax
push dword [ebp - 0x228]
mov eax, dword [0x41a770]
mov eax, dword [eax + ebx*4]
call fcn.00402dd0
push eax
mov eax, dword [0x41a770]
push dword [eax + ebx*4]
push 0
movzx eax, word [0x419040]
push eax
call sub.kernel32.dll_WideCharToMultiByte
add eax, 1
add dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov byte [eax - 1], 0
cmp ebx, esi
jl 0x40cab8
mov edx, dword [0x41a250]
mov eax, dword [0x41a240]
mov dword [edx + eax*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411930
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
xor eax, eax
push fcn.00411920
push ebp
push 0x40d860
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test eax, eax
jle 0x4119a0
lea edx, [ebx - 1]
lea eax, [ebp - 4]
call fcn.00407570
cmp ebx, 1
jle 0x41198a
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor dx, dx
call fcn.004071f0
jmp 0x4119ab
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.00405b70
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00411920
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x411bd0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00411bc0
push ebp
push 0x40d860
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 1
nop dword [eax + eax]
lea eax, [ebx*4 + 0x41ae3c]
xor edx, edx
call fcn.00405b70
mov dword [ebx*4 + 0x41ae5c], 0xffffffff
add ebx, 1
cmp ebx, 7
jle 0x411c00
call sub.kernel32.dll_GetThreadLocale
mov ebx, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push ebx
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x411c88
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
xor cx, cx
mov edx, 0xa
call fcn.004065c0
mov eax, dword [ebp - 0x10]
mov edx, 1
call fcn.0040dfe0
mov esi, eax
sub eax, 3
cmp eax, 3
jae 0x411c88
push 4
push esi
push ebx
mov eax, 0x411a90
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push esi
push ebx
mov eax, 0x411b30
push eax
call sub.kernel32.dll_EnumCalendarInfoA
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00411bc0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4123e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x94]
mov dword [0x41aea0], 0
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x84]
mov dword [0x41ad00], eax
mov eax, dword [ebp - 0x90]
mov dword [0x41ad10], eax
mov eax, dword [ebp - 0x8c]
mov dword [0x41ad20], eax
mov eax, dword [ebp - 0x88]
mov dword [0x41ad30], eax
mov edx, 0x41ad41
lea eax, [ebp - 0x80]
mov ecx, pe_nt_image_headers32
call fcn.00401de0
lea eax, [ebp - 0x80]
call fcn.00402db0
mov byte [0x41ad40], al
mov eax, str.kernel32
push eax
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x41aeb0], eax
test eax, eax
je 0x41247f
mov eax, str.GetDiskFreeSpaceExA
push eax
push dword [0x41aeb0]
call sub.kernel32.dll_GetProcAddress
mov dword [0x41aea0], eax
cmp dword [0x41ad10], 6
jae 0x41249b
mov dword [0x413c30], 0
cmp dword [0x41ad10], 6
jb 0x4124ae
cmp dword [0x41ad20], 1
jb 0x4124ae
mov dword [0x413c40], 2
cmp dword [0x41aeb0], 0
je 0x4124f5
cmp dword [0x41ad10], 6
jb 0x4124d6
mov eax, str.GetTimeZoneInformationForYear
push eax
push dword [0x41aeb0]
call sub.kernel32.dll_GetProcAddress
mov dword [0x413e10], eax
cmp dword [0x41aeb0], 0
je 0x4124f5
mov eax, str.GetFinalPathNameByHandleA
push eax
push dword [0x41aeb0]
call sub.kernel32.dll_GetProcAddress
mov dword [0x413e00], eax
mov esp, ebp
pop ebp
ret
Function at 0xa14000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0xa1400a
jmp 0xa1600f
jmp fcn.007d80b0
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7cf40eb9
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2e6854
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40e87a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
invalid
invalid
Function at 0x1003db4c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3fc
mov eax, dword [0x100c77f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x24]
push esi
push edi
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp + 0x10]
mov edi, edx
mov esi, edi
imul esi, dword [ebp + 0xc]
cmp dword [ebp + 0x18], 0
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3fc], eax
mov dword [ebp - 0x3f8], ecx
jl 0x1003dba2
push 0
push dword [ebp + 0x18]
push eax
call fcn.100693fd
add esp, 0xc
cmp dword [ebp + 0x1c], 0
jne 0x1003dc3f
cmp edi, dword [ebp - 0x3f4]
jne 0x1003dc3f
push dword [ebp - 0x3fc]
push 1
push esi
push dword [ebp - 0x3f0]
call fcn.10069356
add esp, 0x10
test eax, eax
jne 0x1003dd5a
mov edi, dword [ebp - 0x3f8]
test edi, edi
je 0x1003dc37
mov eax, dword [ebp - 0x3f8]
push 8
pop ecx
mov esi, 0x100aed1c
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003dbf4
sub eax, esi
imul ebx, ebx, 0x220
lea ebx, [ebx + 0x100fc248]
mov ecx, ebx
mov edi, eax
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003dc10
sub ecx, esi
add ecx, edi
cmp ecx, 0xff
jae 0x1003dc37
push ebx
push str.Ephemeris_file__s_is_damaged__2_.
push dword [ebp - 0x3f8]
call fcn.100675d6
add esp, 0xc
or eax, 0xffffffff
jmp 0x1003dd5c
push dword [ebp - 0x3fc]
lea eax, [ebp - 0x3ec]
push 1
push esi
push eax
call fcn.10069356
add esp, 0x10
test eax, eax
jne 0x1003dcb2
mov edi, dword [ebp - 0x3f8]
test edi, edi
je 0x1003dc37
mov eax, dword [ebp - 0x3f8]
push 8
pop ecx
mov esi, str.Ephemeris_file_is_damaged__3_.
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003dc78
sub eax, esi
imul ebx, ebx, 0x220
lea ebx, [ebx + 0x100fc248]
mov ecx, ebx
mov edi, eax
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003dc94
sub ecx, esi
add ecx, edi
cmp ecx, 0xff
jae 0x1003dc37
push ebx
push str.Ephemeris_file__s_is_damaged__4_.
jmp 0x1003dc29
cmp edi, dword [ebp - 0x3f4]
je 0x1003dcd5
mov eax, dword [ebp - 0x3f4]
imul eax, dword [ebp + 0xc]
push eax
push 0
push dword [ebp - 0x3f0]
call fcn.1006bdd0
add esp, 0xc
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x1003dd5a
mov ebx, dword [ebp - 0x3f0]
lea ecx, [ebp - 0x3ec]
mov dword [ebp - 0x3f0], eax
lea eax, [edi - 1]
test eax, eax
js 0x1003dd4a
mov edx, edi
sub edx, eax
dec edx
mov dword [ebp - 0x3fc], edx
cmp dword [ebp + 0x1c], 0
mov esi, edx
jne 0x1003dd0a
mov esi, eax
cmp edi, dword [ebp - 0x3f4]
je 0x1003dd34
cmp dword [ebp + 0x20], 0
jne 0x1003dd1e
cmp dword [ebp + 0x1c], 0
je 0x1003dd2a
cmp dword [ebp + 0x20], 1
jne 0x1003dd34
cmp dword [ebp + 0x1c], 0
je 0x1003dd34
mov edx, dword [ebp - 0x3f4]
sub edx, edi
add esi, edx
mov dl, byte [ecx + eax]
mov byte [ebx + esi], dl
mov edx, dword [ebp - 0x3fc]
inc edx
dec eax
mov dword [ebp - 0x3fc], edx
jns 0x1003dd00
add ebx, dword [ebp - 0x3f4]
add ecx, edi
dec dword [ebp - 0x3f0]
jne 0x1003dcee
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10067574
leave
ret
Function at 0x1004772e
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x100fa8ec], 0
jne 0x10047768
xor ecx, ecx
mov eax, ecx
push 8
shl eax, 0x18
pop edx
test eax, eax
jns 0x10047751
add eax, eax
xor eax, 0x4c11db7
jmp 0x10047753
add eax, eax
dec edx
test edx, edx
jg 0x10047744
mov dword [ecx*4 + 0x100fa8e8], eax
inc ecx
cmp ecx, 0x100
jl 0x1004773c
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
cmp dword [ebp + 0xc], 0
jle 0x10047794
push edi
movzx edi, byte [ecx]
mov edx, eax
shr edx, 0x18
xor edx, edi
shl eax, 8
xor eax, dword [edx*4 + 0x100fa8e8]
inc ecx
dec dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0
jg 0x10047775
pop edi
not eax
pop ebp
ret
Function at 0x1005d769
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x100c77f4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x100edcc4], edi
jne 0x1005d83d
cmp dword [0x100c8ba4], edi
je 0x1005d83d
cmp dword [0x100c8d38], edi
je 0x1005d7ca
mov eax, dword [0x100c8cac]
cmp eax, edi
jne 0x1005d7be
push str.Astrolog
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x100c8cac], eax
cmp eax, edi
je 0x1005d7ca
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x100c8a90]
cmp eax, 1
jne 0x1005d7dd
cmp byte [0x100c8b2c], 0x42
jne 0x1005d7ec
cmp eax, 2
je 0x1005d7ec
cmp eax, 4
mov eax, 0x100b4458
jne 0x1005d7f1
mov eax, 0x100863a8
push eax
push dword [0x100c8ba4]
call fcn.100680dc
pop ecx
pop ecx
mov dword [0x100c8ba8], eax
cmp eax, edi
jne 0x1005d83d
cmp dword [0x100c8d38], edi
jne 0x1005d83d
push esi
push dword [0x100c8ba4]
lea eax, [ebp - 0x104]
push str.Couldnt_create_output_file:__s
push eax
call fcn.100675d6
add esp, 0xc
lea esi, [ebp - 0x104]
call fcn.10021388
mov dword [0x100c8ba4], edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10067574
leave
ret

Function at 0x1005d84a
Capabilities:
Change the wallpaper

Disassembly:
mov eax, dword [0x100c8a90]
push ebx
push esi
push edi
cmp eax, 1
jne 0x1005d891
mov ecx, dword [0x100c8ba8]
test ecx, ecx
je 0x1005d8d0
mov al, byte [0x100c8b2c]
cmp al, 0x42
jne 0x1005d873
mov esi, ecx
call fcn.1005d284
jmp 0x1005d8c0
cmp al, 0x41
jne 0x1005d87f
push ecx
call fcn.1005d1ef
jmp 0x1005d8ad
movzx eax, al
push eax
push dword [0x100c8ba4]
call fcn.1005cf35
pop ecx
jmp 0x1005d8ad
cmp eax, 2
jne 0x1005d89d
call fcn.1005dcde
jmp 0x1005d8c0
cmp eax, 3
jne 0x1005d8b0
push dword [0x100c8ba8]
call fcn.1005e37b
pop ecx
jmp 0x1005d8c0
cmp eax, 4
jne 0x1005d8c0
mov edi, dword [0x100c8ba8]
call fcn.1005e3fb
mov eax, dword [0x100c8ba8]
test eax, eax
je 0x1005d8d0
push eax
call fcn.100686d9
pop ecx
cmp dword [0x100c8d38], 0
je 0x1005d8e9
mov eax, dword [0x100c8cac]
test eax, eax
je 0x1005d8e9
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ax, word [0x100c8ccc]
mov ecx, 0x9d24
lea ebx, [ecx - 1]
cmp ax, cx
je 0x1005d942
add ecx, 0xfffffffc
cmp ax, cx
je 0x1005d917
cmp ax, bx
je 0x1005d917
lea ecx, [ebx - 1]
cmp ax, cx
je 0x1005d917
dec ecx
cmp ax, cx
jne 0x1005d991
mov eax, 0x100af584
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
push eax
push str.TileWallpaper
mov edi, str.Desktop
push edi
call esi
mov ax, word [0x100c8ccc]
cmp ax, bx
jne 0x1005d949
mov eax, 0x1008651c
jmp 0x1005d96e
mov eax, 0x10086518
jmp 0x1005d91c
mov ecx, 0x9d22
cmp ax, cx
jne 0x1005d95a
mov eax, 0x10086558
jmp 0x1005d96e
mov ecx, 0x9d21
cmp ax, cx
mov eax, 0x10086568
je 0x1005d96e
mov eax, 0x100af584
push eax
push str.WallpaperStyle
push edi
call esi
push 3
push dword [0x100c8ba4]
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
xor eax, eax
mov word [0x100c8ccc], ax
pop edi
pop esi
pop ebx
ret