joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002f7f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, edx
mov eax, ecx
push edi
mov dword [ebp - 0x18], esi
xor edx, edx
mov dword [ebp - 0x10], edx
test esi, esi
je 0x1002f811
cmp eax, esi
jae 0x1002f98f
mov cl, byte [eax]
mov byte [ebp - 3], cl
test cl, cl
je 0x1002f98f
movzx ecx, cl
xor ebx, ebx
shr ecx, 3
mov edx, esi
movsx ecx, byte [ecx + 0x10076754]
test ecx, ecx
mov dword [ebp - 0xc], ecx
sete bl
add ebx, ecx
mov dword [ebp - 0x14], ebx
test esi, esi
jne 0x1002f843
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp - 3]
mov byte [ebp - 4], cl
cmp esi, edx
jae 0x1002f85b
mov bl, byte [esi]
mov byte [ebp - 1], bl
jmp 0x1002f85f
mov byte [ebp - 1], 0
lea esi, [eax + 2]
cmp esi, edx
jae 0x1002f86a
mov ch, byte [esi]
jmp 0x1002f86c
xor ch, ch
lea ebx, [eax + 3]
mov byte [ebp - 3], ch
cmp ebx, edx
jae 0x1002f87a
mov bl, byte [ebx]
jmp 0x1002f87c
xor bl, bl
movzx esi, byte [ebp - 1]
movzx edx, ch
movzx ecx, cl
movzx edi, bl
mov byte [ebp - 2], bl
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx*4 + 0x10076774]
and ebx, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], ebx
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov ebx, dword [ebp - 8]
and ecx, 0x3f
or ebx, ecx
shr edi, 2
mov ecx, dword [ebp - 0xc]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x10076740]
shr ebx, cl
mov esi, ebx
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0xc]
cmp esi, dword [ebx*4 + 0x10076788]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [ebx*4 + 0x1007679c]
mov ebx, dword [ebp - 0x14]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x1002f973
xor edx, edx
mov esi, dword [ebp - 0x18]
cmp byte [ebp - 4], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 1], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
add eax, edx
mov edx, dword [ebp - 0x10]
inc edx
jmp 0x1002f802
add eax, ebx
test esi, esi
je 0x1002f985
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
inc edx
jmp 0x1002f802
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002f9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], ecx
lea eax, [edx - 1]
mov dword [ebp - 0xc], ebx
lea eax, [ebx + eax*2]
mov dword [ebp - 0x1c], eax
cmp ebx, eax
mov eax, dword [ebp + 8]
jae 0x1002fb56
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x1002f9d4
cmp eax, esi
jae 0x1002fb51
mov bl, byte [eax]
mov byte [ebp - 3], bl
test bl, bl
je 0x1002fb51
movzx ecx, bl
mov edx, esi
shr ecx, 3
xor ebx, ebx
movsx ecx, byte [ecx + 0x10076754]
test ecx, ecx
mov dword [ebp - 0x10], ecx
sete bl
add ebx, ecx
mov dword [ebp - 0x18], ebx
test esi, esi
jne 0x1002fa06
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp - 3]
mov byte [ebp - 4], cl
cmp esi, edx
jae 0x1002fa1b
mov bh, byte [esi]
jmp 0x1002fa1d
xor bh, bh
lea esi, [eax + 2]
mov byte [ebp - 3], bh
cmp esi, edx
jae 0x1002fa2b
mov ch, byte [esi]
jmp 0x1002fa2d
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 2], ch
cmp esi, edx
jae 0x1002fa3b
mov bl, byte [esi]
jmp 0x1002fa3d
xor bl, bl
movzx edx, ch
movzx ecx, cl
movzx esi, bh
movzx edi, bl
mov byte [ebp - 1], bl
mov ebx, dword [ebp - 0x10]
mov ebx, dword [ebx*4 + 0x10076774]
and ebx, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], ebx
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov ebx, dword [ebp - 8]
and ecx, 0x3f
or ebx, ecx
shr edi, 2
mov ecx, dword [ebp - 0x10]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x10076740]
shr ebx, cl
mov esi, ebx
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x10]
cmp esi, dword [ebx*4 + 0x10076788]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [ebx*4 + 0x1007679c]
mov ebx, dword [ebp - 0x18]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x1002fb2e
xor edx, edx
mov esi, 0xfffd
cmp byte [ebp - 1], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 4], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
add eax, edx
jmp 0x1002fb34
add eax, ebx
test esi, esi
je 0x1002fb4e
mov ecx, dword [ebp - 0x14]
mov word [ecx], si
add ecx, 2
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
cmp ecx, dword [ebp - 0x1c]
jb 0x1002f9c8
jmp 0x1002fb51
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0xc]
pop edi
pop esi
xor edx, edx
mov word [ecx], dx
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x1002fb64
mov dword [edx], eax
sub ecx, ebx
sar ecx, 1
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002fce0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x1002fcf4
mov dword [ebx], 0
mov edx, 0x100766d0
call fcn.1002feb0
mov esi, eax
test esi, esi
je 0x1002fde2
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x1002fdd8
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1002fdd8
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x1002fdd8
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1002fdd8
mov eax, dword [0x1007f11c]
test eax, eax
je 0x1002fd6c
inc dword [eax + 0x370]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x1002fdd8
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x1002fdbd
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x1007f11c]
add esp, 4
test eax, eax
je 0x1002fdaa
dec dword [eax + 0x370]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x1002fdcf
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002ffb0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10030011
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1002fff4
cmp edi, 2
jb 0x1002fff4
cmp byte [esi], cl
jne 0x1002fff4
cmp byte [esi + 1], cl
jne 0x1002fff4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10059f30]
jmp 0x1002ffc5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10059f30]
test edi, edi
jne 0x1002ffc5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10030040
cmp cl, 0x23
jne 0x10030027
cmp byte [esi], cl
jne 0x10030027
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10059f30]
test cl, cl
jne 0x10030018
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x10031160
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1007f11c]
lea edx, [ebp - 4]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1a6c]
mov esi, 4
mov eax, dword [edi + 0xb8]
add edi, 0xb8
mov dword [ebp - 4], ecx
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10059f30]
sub esi, 1
jne 0x10031192
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [edi]
cmp ecx, esi
jne 0x100311d9
inc ecx
test esi, esi
je 0x100311c7
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x100311cc
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1000dfa0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10032c60
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, edx
mov eax, 0x5e6ea9af
mul dword [ebp + 8]
push edi
shr edx, 0xb
xor edi, edi
imul eax, edx, 0x15b0
mov ecx, 1
mov edx, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 0x10], edi
sub ebx, eax
mov dword [ebp - 4], ebx
test edx, edx
je 0x10032da0
xor edx, edx
mov dword [ebp - 8], edx
cmp ebx, 7
jbe 0x10032d04
mov eax, 7
sub eax, esi
mov dword [ebp - 0x10], eax
nop dword [eax]
movzx eax, byte [esi]
add edx, 8
add ecx, eax
movzx eax, byte [esi + 1]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 2]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 3]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 4]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 5]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 6]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 7]
add edi, ecx
add esi, 8
add ecx, eax
mov eax, dword [ebp - 0x10]
add eax, esi
add edi, ecx
cmp eax, ebx
jb 0x10032cb0
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 4]
xor ebx, ebx
xor edx, edx
cmp dword [ebp - 8], eax
jae 0x10032d65
sub eax, dword [ebp - 8]
cmp eax, 2
jb 0x10032d58
mov eax, dword [ebp - 8]
mov edi, ebx
mov edx, dword [ebp - 4]
sub edx, eax
sub edx, 2
shr edx, 1
inc edx
lea eax, [eax + edx*2]
mov dword [ebp - 8], eax
nop
movzx eax, byte [esi]
add ecx, eax
movzx eax, byte [esi + 1]
add ebx, ecx
add esi, 2
add ecx, eax
add edi, ecx
sub edx, 1
jne 0x10032d30
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jae 0x10032d60
movzx eax, byte [esi]
add ecx, eax
add edi, ecx
inc esi
lea eax, [edx + ebx]
add edi, eax
mov eax, 0x80078071
mov ebx, dword [ebp - 4]
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul eax, edx, 0xffff000f
add edi, eax
sub dword [ebp + 8], ebx
mov ebx, 0x15b0
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], ebx
jne 0x10032c98
shl edi, 0x10
lea eax, [ecx + edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10041480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100414ba
mov eax, dword [0x1007f11c]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x100414ad
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100414eb
mov eax, dword [0x1007f11c]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x100414de
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1004151c
mov eax, dword [0x1007f11c]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x1004150f
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10041569
mov eax, dword [0x1007f11c]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x1004155c
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x1004159a
mov eax, dword [0x1007f11c]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x1004158d
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x100415cb
mov eax, dword [0x1007f11c]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x100415be
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10041340
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x3da73a98
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
mov ecx, 0x129b1972
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4011f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push dword [0x42d66c]
mov esi, ecx
push 0
push dword [esi + 4]
lea eax, [esi + 0xc]
push 0x13a
push 0x1f1
push 0
push 0
push 0x40000000
push 0x4258d0
push eax
push 0x10000
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi], eax
test eax, eax
jne 0x401235
pop esi
pop ebp
ret 4
push 0
push dword [0x42d66c]
push 0
push eax
push 0x14
push 0x1f7
push 0x3a
push 0
push 0x50000010
push 0x4258d0
push str.Static
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, esi
call fcn.00401130
mov ecx, esi
call fcn.004010c0
mov ecx, esi
call fcn.00401560
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
pop esi
pop ebp
ret 4

Function at 0x4016a0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x401802
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x401802
mov eax, dword [ebp + 0x10]
cmp eax, 1
jb 0x401802
push esi
xor esi, esi
test eax, eax
je 0x4017f7
dec eax
push ebx
mov bl, byte [ebp + 0xa]
shr eax, 2
inc eax
push edi
lea edi, [ecx + 2]
mov dword [ebp + 0xc], eax
mov dl, byte [edi - 2]
cmp dl, 0x2b
jne 0x4016ec
mov dl, 0x3e
jmp 0x40171a
cmp dl, 0x2f
jne 0x4016f5
mov dl, 0x3f
jmp 0x40171a
cmp dl, 0x39
jg 0x4016ff
add dl, 4
jmp 0x40171a
cmp dl, 0x3d
je 0x401718
cmp dl, 0x5a
jg 0x40170e
sub dl, 0x41
jmp 0x40171a
cmp dl, 0x7a
jg 0x401718
sub dl, 0x47
jmp 0x40171a
mov dl, 0x40
mov cl, byte [edi - 1]
cmp cl, 0x2b
jne 0x401726
mov cl, 0x3e
jmp 0x401754
cmp cl, 0x2f
jne 0x40172f
mov cl, 0x3f
jmp 0x401754
cmp cl, 0x39
jg 0x401739
add cl, 4
jmp 0x401754
cmp cl, 0x3d
je 0x401752
cmp cl, 0x5a
jg 0x401748
sub cl, 0x41
jmp 0x401754
cmp cl, 0x7a
jg 0x401752
sub cl, 0x47
jmp 0x401754
mov cl, 0x40
mov al, cl
shl dl, 2
shr al, 4
add al, dl
mov edx, dword [ebp + 8]
mov byte [esi + edx], al
inc esi
mov al, byte [edi]
cmp al, 0x3d
je 0x4017ad
mov bl, al
cmp bl, 0x2b
jne 0x401776
mov bl, 0x3e
jmp 0x40179f
cmp bl, 0x2f
jne 0x40177f
mov bl, 0x3f
jmp 0x40179f
cmp bl, 0x39
jg 0x401789
add bl, 4
jmp 0x40179f
cmp bl, 0x5a
jg 0x401793
sub bl, 0x41
jmp 0x40179f
cmp bl, 0x7a
jg 0x40179d
sub bl, 0x47
jmp 0x40179f
mov bl, 0x40
mov al, bl
shl cl, 4
shr al, 2
add al, cl
mov byte [esi + edx], al
inc esi
mov al, byte [edi + 1]
cmp al, 0x3d
je 0x4017e9
cmp al, 0x2b
jne 0x4017bc
mov al, 0x3e
jmp 0x4017de
cmp al, 0x2f
jne 0x4017c4
mov al, 0x3f
jmp 0x4017de
cmp al, 0x39
jg 0x4017cc
add al, 4
jmp 0x4017de
cmp al, 0x5a
jg 0x4017d4
sub al, 0x41
jmp 0x4017de
cmp al, 0x7a
jg 0x4017dc
sub al, 0x47
jmp 0x4017de
mov al, 0x40
mov cl, bl
shl cl, 6
add cl, al
mov byte [esi + edx], cl
inc esi
add edi, 4
dec dword [ebp + 0xc]
jne 0x4016e0
pop edi
pop ebx
mov byte [esi + edx], 0
mov eax, esi
pop esi
pop ebp
ret 0xc
xor eax, eax
pop ebp
ret 0xc
Function at 0x401cf0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
push 0xffffffffffffffeb
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x401d51
mov ecx, dword [eax + 0x1b4]
mov esi, dword [eax + 0x1b8]
mov eax, dword [eax + 0x1bc]
mov dword [ebp - 4], eax
test ecx, ecx
je 0x401d2f
push 0
push ecx
call ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x401d38
push 0
push eax
call ebx
test esi, esi
je 0x401d51
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x4259e0
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [edi]
test eax, eax
jne 0x401d6e
mov ecx, edi
call fcn.00401aa0
push 5
mov ecx, edi
call fcn.00401a30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
push eax
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401d80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x429280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x30
lea eax, [ebp - 0x34]
mov edi, ecx
push 0
push eax
call fcn.00417190
mov eax, dword [0x42d66c]
lea esi, [edi + 0x10]
add esp, 0xc
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], 0x401bf0
mov dword [ebp - 0x20], eax
push 0x7f00
push 0
mov dword [ebp - 0xc], esi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x18], eax
mov eax, dword [0x42d684]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [0x42d66c]
push 0
push dword [edi + 4]
push 0x13a
push 0x1f1
push 0
push 0
push 0x40000000
push 0x4258d0
push esi
push 0x10000
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [edi], eax
test eax, eax
jne 0x401e30
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041092e
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.00401b20
mov ecx, edi
call fcn.004018d0
push 0
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0041092e
mov esp, ebp
pop ebp
ret
Function at 0x402b50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x429280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x402b7b
push 0x425b28
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edi, dword [edi + 4]
test edi, edi
je 0x402baa
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x408
push edi
call esi
inc eax
mov ecx, 0x64
cmp eax, ecx
push 0
cmovg eax, ecx
push eax
push 0x402
push edi
call esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00417190
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrIW]
lea esi, [eax + 2]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARE_fastsee
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x402c53
push esi
call ebx
add eax, eax
push eax
push esi
push 1
push 0
push str.InstallName
push dword [ebp - 0x218]
call edi
push dword [ebp - 0x218]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
jmp 0x402c59
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00405300
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARE_fastsee
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x402cbd
push dword [ebp - 0x218]
call ebx
add eax, eax
push eax
push dword [ebp - 0x218]
push 1
push 0
push str.InstallPath
push dword [ebp - 0x210]
call edi
push dword [ebp - 0x210]
call esi
call fcn.00405180
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARE_fastsee
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x402d21
push dword [ebp - 0x210]
call ebx
add eax, eax
push eax
push dword [ebp - 0x210]
push 1
push 0
push str.StartMenuPath
push dword [ebp - 0x218]
call edi
push dword [ebp - 0x218]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041092e
mov esp, ebp
pop ebp
ret