joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50cb40
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x522b90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040a960
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x50cba2
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040c650
mov eax, dword [ebp - 0x18]
jmp 0x50cc90
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x50cc77
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x50cc77
lea eax, [ebp - 0x14]
push eax
call fcn.0050cab0
add esp, 4
lea ecx, [ebp - 0x14]
call fcn.004084c0
movzx ecx, al
test ecx, ecx
je 0x50cc05
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040c650
mov eax, dword [ebp - 0x1c]
jmp 0x50cc90
lea ecx, [ebp - 0x14]
call fcn.00423af0
push eax
call fcn.0050cb40
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x50cc3a
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040c650
mov eax, dword [ebp - 0x20]
jmp 0x50cc90
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x50cc77
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x50cc77
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040c650
mov eax, dword [ebp - 0x24]
jmp 0x50cc90
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040c650
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x512370
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x523ab2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov dword [ebp - 0x48], ecx
push 0
push 0
lea ecx, [ebp - 0x24]
call fcn.0051d4c0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x24]
call fcn.0051d050
movzx eax, al
test eax, eax
jne 0x5123cb
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0051d540
jmp 0x5125aa
push 0x534014
lea ecx, [ebp - 0x24]
call fcn.0051d000
movzx ecx, al
test ecx, ecx
je 0x51244c
push 0x534014
lea ecx, [ebp - 0x24]
call fcn.0051cfa0
push eax
lea ecx, [ebp - 0x28]
call fcn.0040a960
mov byte [ebp - 4], 1
lea edx, [ebp - 0x28]
push edx
call fcn.00511fb0
add esp, 4
test eax, eax
je 0x512440
push 0x534014
lea ecx, [ebp - 0x30]
call fcn.0040a960
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x48]
add ecx, 8
call fcn.0042e930
mov ecx, eax
call fcn.00408510
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.0040c650
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0040c650
push 0x534020
lea ecx, [ebp - 0x24]
call fcn.0051d000
movzx edx, al
test edx, edx
je 0x5124cd
push 0x534020
lea ecx, [ebp - 0x24]
call fcn.0051cfa0
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040a960
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2c]
push eax
call fcn.00511fb0
add esp, 4
test eax, eax
je 0x5124c1
push 0x534020
lea ecx, [ebp - 0x34]
call fcn.0040a960
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [ebp - 0x48]
add ecx, 8
call fcn.0042e930
mov ecx, eax
call fcn.00408510
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x34]
call fcn.0040c650
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.0040c650
push 0x53402c
lea ecx, [ebp - 0x24]
call fcn.0051d000
movzx eax, al
test eax, eax
je 0x512534
push 0x53402c
lea ecx, [ebp - 0x24]
call fcn.0051cfa0
push eax
lea ecx, [ebp - 0x38]
call fcn.0040a960
mov byte [ebp - 4], 5
push 0x53402c
lea ecx, [ebp - 0x3c]
call fcn.0040a960
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x3c]
push edx
mov ecx, dword [ebp - 0x48]
call fcn.005120d0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3c]
call fcn.0040c650
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.0040c650
push 0x534038
lea ecx, [ebp - 0x24]
call fcn.0051d000
movzx eax, al
test eax, eax
je 0x51259b
push 0x534038
lea ecx, [ebp - 0x24]
call fcn.0051cfa0
push eax
lea ecx, [ebp - 0x40]
call fcn.0040a960
mov byte [ebp - 4], 7
push 0x534038
lea ecx, [ebp - 0x44]
call fcn.0040a960
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
mov ecx, dword [ebp - 0x48]
call fcn.005120d0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x44]
call fcn.0040c650
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.0040c650
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0051d540
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x512870
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52454f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp dword [eax], 0
je 0x5128a0
mov eax, 1
jmp 0x5129f6
cmp dword [ebp + 8], 0
jne 0x512910
push 0x400000
lea ecx, [ebp - 0x14]
push ecx
call fcn.0051f4c0
add esp, 8
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.00408510
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040c650
push str.install.dat
push 0x104
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.0040a680
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.0040c000
jmp 0x51291f
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.0040ae00
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.00423af0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x51293c
xor eax, eax
jmp 0x5129f6
lea ecx, [ebp - 0x10]
call fcn.0040c630
mov dword [ebp - 4], 1
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.00423af0
push eax
mov ecx, dword [ebp - 0x24]
call fcn.00511f50
test eax, eax
jne 0x512982
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040c650
mov eax, dword [ebp - 0x18]
jmp 0x5129f6
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x24
call fcn.0042e910
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x24]
call fcn.00512740
test eax, eax
jne 0x5129bc
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040c650
mov eax, dword [ebp - 0x1c]
jmp 0x5129f6
mov ecx, dword [ebp - 0x24]
call fcn.00512110
mov ecx, dword [ebp - 0x24]
call fcn.00511e60
mov ecx, dword [ebp - 0x24]
call fcn.00512370
mov edx, dword [ebp - 0x24]
mov dword [edx], 1
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040c650
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x519590
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov ecx, dword [ebp + 8]
call fcn.0045c3b0
mov ecx, eax
call fcn.004079f0
cmp eax, 0x104
jb 0x5195b6
xor al, al
jmp 0x51974e
movzx eax, byte [ebp + 0xc]
test eax, eax
jne 0x51966c
lea ecx, [ebp - 0x260]
call fcn.005087e0
lea ecx, [ebp - 0x260]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005194b0
add esp, 8
movzx eax, al
test eax, eax
je 0x51962a
movzx ecx, byte [ebp - 0x258]
test ecx, ecx
je 0x51962a
mov ecx, dword [ebp + 8]
call fcn.0045c3b0
mov ecx, eax
call fcn.0040b6d0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x261], al
lea ecx, [ebp - 0x260]
call fcn.005087d0
mov al, byte [ebp - 0x261]
jmp 0x51974e
mov ecx, dword [ebp + 8]
call fcn.0045c3b0
mov ecx, eax
call fcn.0040b6d0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x519661
mov byte [ebp - 0x262], 1
lea ecx, [ebp - 0x260]
call fcn.005087d0
mov al, byte [ebp - 0x262]
jmp 0x51974e
lea ecx, [ebp - 0x260]
call fcn.005087d0
mov word [ebp - 0x230], 0
push 0x208
push 0
lea edx, [ebp - 0x22e]
push edx
call fcn.004b3d60
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.0045c3b0
mov ecx, eax
call fcn.0040b6d0
push eax
push 0x105
lea eax, [ebp - 0x230]
push eax
call fcn.004b61ce
add esp, 0xc
mov dword [ebp - 0x20], 0
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov word [ebp - 4], cx
mov dword [ebp - 0x1c], 3
lea edx, [ebp - 0x230]
mov dword [ebp - 0x18], edx
mov word [ebp - 0x10], 0x414
movzx eax, byte [ebp + 0xc]
test eax, eax
jne 0x5196fa
movzx ecx, word [ebp - 0x10]
or ecx, 0x1080
mov word [ebp - 0x10], cx
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0xe], 0
je 0x519714
xor al, al
jmp 0x51974e
cmp dword [ebp - 0x234], 0
je 0x51973e
cmp dword [ebp - 0x234], 2
je 0x51973e
cmp dword [ebp - 0x234], 0x402
je 0x51973e
mov dword [ebp - 0x268], 0
jmp 0x519748
mov dword [ebp - 0x268], 1
mov al, byte [ebp - 0x268]
mov esp, ebp
pop ebp
ret
Function at 0x51a9b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.004084c0
movzx eax, al
test eax, eax
je 0x51a9d3
mov eax, 0x13a
jmp 0x51aa89
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.00423af0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x51a9f3
mov eax, 0x13b
jmp 0x51aa89
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
push edx
mov ecx, dword [ebp - 4]
add ecx, 0xc
call fcn.00423af0
push eax
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.00423af0
push eax
call fcn.004da230
add esp, 0xc
test eax, eax
je 0x51aa22
xor eax, eax
jmp 0x51aa89
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0xc
call fcn.00423af0
push eax
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.00423af0
push eax
call fcn.004da550
add esp, 0xc
test eax, eax
je 0x51aa51
xor eax, eax
jmp 0x51aa89
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
push eax
push 0
mov ecx, dword [ebp - 4]
add ecx, 0xc
call fcn.00423af0
push eax
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.00423af0
push eax
call fcn.004da7b0
add esp, 0x14
test eax, eax
je 0x51aa84
xor eax, eax
jmp 0x51aa89
mov eax, 0x139
mov esp, ebp
pop ebp
ret 4
Function at 0x51d630
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x524c25
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
mov dword [ebp - 0x70], ecx
call fcn.004d2a40
mov ecx, eax
call fcn.004d1d30
test eax, eax
jne 0x51d665
xor eax, eax
jmp 0x51d829
mov dword [ebp - 0x28], 0
call fcn.0040c570
mov dword [ebp - 0x48], eax
push 0x52feec
mov ecx, dword [ebp + 8]
call fcn.00510780
push eax
lea ecx, [ebp - 0x64]
call fcn.00407930
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.004079f0
push eax
lea ecx, [ebp - 0x64]
call fcn.00407b00
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x70]
call fcn.00519cf0
mov byte [ebp - 4], 1
push 0x52fef0
mov ecx, dword [ebp + 8]
call fcn.00510780
push eax
lea ecx, [ebp - 0x44]
call fcn.00407930
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.004079f0
push eax
lea ecx, [ebp - 0x44]
call fcn.00407b00
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x70]
call fcn.00519cf0
mov byte [ebp - 4], 3
call fcn.004d2a40
mov ecx, eax
call fcn.004d1df0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x898
jne 0x51d72d
push 0x52fef8
push 0x52ff0c
lea ecx, [ebp - 0x18]
call fcn.0040f110
push 0x52ff1c
push 0x52ff30
lea ecx, [ebp - 0x1c]
call fcn.0040f110
jmp 0x51d75a
cmp dword [ebp - 0x24], 0x8fc
jne 0x51d75a
push 0x52ff40
push 0x52ff54
lea ecx, [ebp - 0x18]
call fcn.0040f110
push 0x52ff64
push 0x52ff78
lea ecx, [ebp - 0x1c]
call fcn.0040f110
lea ecx, [ebp - 0x10]
call fcn.0040c630
mov byte [ebp - 4], 4
push 0x104
lea ecx, [ebp - 0x10]
call fcn.0040a680
push eax
push 1
push 0
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0040c000
lea edx, [ebp - 0x10]
push edx
call fcn.004db330
add esp, 4
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040ea80
lea ecx, [ebp - 0x10]
push ecx
call fcn.004db330
add esp, 4
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x10]
call fcn.0040ea80
lea ecx, [ebp - 0x10]
call fcn.00419a00
push eax
push 0x52ff88
mov ecx, dword [ebp - 0x70]
add ecx, 4
call fcn.00423af0
push eax
call fcn.004db8b0
add esp, 0xc
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
call fcn.0040c650
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.0040c650
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x44]
call fcn.00407a30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0040c650
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.00407a30
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x40d5c8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040804b
mov dword [ebp - 0x14], eax
cmp dword [0x430980], esi
jne 0x40d6bb
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d648
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d79b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d79b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d79b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x430980], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x430984], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x430988], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x430990], eax
test eax, eax
je 0x40d6b8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43098c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d6e0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d6d3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d6f5
push 4
pop eax
jmp 0x40d79d
cmp dword [ebp - 0x14], esi
je 0x40d6f5
push dword [0x430980]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d6da
mov eax, dword [0x43098c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d753
cmp dword [0x430990], edi
je 0x40d753
push eax
call ebx
push dword [0x430990]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d753
test eax, eax
je 0x40d753
call ecx
test eax, eax
je 0x40d748
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d748
test byte [ebp - 8], 1
jne 0x40d753
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d783
mov eax, dword [0x430984]
cmp eax, edi
je 0x40d780
push eax
call ebx
test eax, eax
je 0x40d780
call eax
mov esi, eax
test esi, esi
je 0x40d780
mov eax, dword [0x430988]
cmp eax, edi
je 0x40d780
push eax
call ebx
test eax, eax
je 0x40d780
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x430980]
call ebx
test eax, eax
je 0x40d79b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d79d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040434c
mov esp, ebp
pop ebp
ret
Function at 0x4b1cb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x90000]
push edi
or ebp, 0xffffffff
jmp 0x4b1cd2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b1cd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b1cc8
mov eax, 1
add ebx, ebx
jne 0x4b1ceb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b1cfc
jne 0x4b1d1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b1d1b
dec eax
add ebx, ebx
jne 0x4b1d08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b1ce0
add ebx, ebx
jne 0x4b1d17
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b1d6d
xor ecx, ecx
sub eax, 3
jb 0x4b1d33
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b1da2
sar eax, 1
mov ebp, eax
jmp 0x4b1d3e
add ebx, ebx
jne 0x4b1d3e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b1d0c
inc ecx
add ebx, ebx
jne 0x4b1d4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b1d0c
add ebx, ebx
jne 0x4b1d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b1d4e
jne 0x4b1d6a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b1d4e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b1d8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b1d7e
jmp 0x4b1cce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b1d8c
add edi, ecx
jmp 0x4b1cce
pop esi
mov edi, esi
mov ecx, 0x651
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b1daa
cmp byte [edi], 9
jne 0x4b1daa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b1daf
lea edi, [esi + 0xaf000]
mov eax, dword [edi]
or eax, eax
je 0x4b1e1e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1156f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1157cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b1ddc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1157d4]
or eax, eax
je 0x4b1e18
mov dword [ebx], eax
add ebx, 4
jmp 0x4b1df9
call dword [esi + 0x1157d0]
mov ebp, dword [esi + 0x1157d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b1e52
sub esp, 0xffffff80
jmp 0x401a9f

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10002dd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
push esi
push edi
xorps xmm0, xmm0
mov dword [esp + 0x38], 0
lea eax, [esp + 0x38]
movlpd qword [esp + 0x40], xmm0
mov esi, ecx
movlpd qword [esp + 0x4c], xmm0
push eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x40], 0x10002b60
mov dword [esp + 0x4c], esi
mov dword [esp + 0x60], str.GraphWindowClass
mov dword [esp + 0x58], 6
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
push esi
push 0
push 0
push 0x190
push 0x258
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Quadratic_Equation_Graph
push str.GraphWindowClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x100dbc38], eax
test eax, eax
je 0x10002ec9
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x100dbc38]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x10]
push 0
push 0
xorps xmm0, xmm0
mov dword [esp + 0x30], 0
push 0
push eax
movaps xmmword [esp + 0x20], xmm0
movq qword [esp + 0x30], xmm0
call esi
test eax, eax
je 0x10002ec9
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x10]
push eax
call edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call esi
test eax, eax
jne 0x10002ea6
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100052b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
mov dword [esp + 0x38], 0
xorps xmm0, xmm0
mov dword [esp + 0x3c], 0x10002980
lea eax, [esp + 0x38]
movlpd qword [esp + 0x40], xmm0
push eax
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
mov dword [esp + 0x4c], esi
mov dword [esp + 0x60], str.UltraFlagClass
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
push esi
push 0
push 0
push 0x12c
push 0x190
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Kiss_to_h3r_p33zy_a__
push str.UltraFlagClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x100dbc48], eax
test eax, eax
je 0x100053a7
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x100dbc48]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x10]
push 0
push 0
xorps xmm0, xmm0
mov dword [esp + 0x30], 0
push 0
push eax
movaps xmmword [esp + 0x20], xmm0
movq qword [esp + 0x30], xmm0
call esi
test eax, eax
je 0x100053a7
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x10]
push eax
call edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call esi
test eax, eax
jne 0x10005384
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100053b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
mov dword [esp + 0x38], 0
xorps xmm0, xmm0
mov dword [esp + 0x3c], 0x10003fc0
lea eax, [esp + 0x38]
movlpd qword [esp + 0x40], xmm0
push eax
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
mov dword [esp + 0x4c], esi
mov dword [esp + 0x60], str.PianoWindowClass
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
push esi
push 0
push 0
push 0xfa
push 0x1a4
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Piano
push str.PianoWindowClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x100dbc3c], eax
test eax, eax
je 0x100054a7
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x100dbc3c]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x10]
push 0
push 0
xorps xmm0, xmm0
mov dword [esp + 0x30], 0
push 0
push eax
movaps xmmword [esp + 0x20], xmm0
movq qword [esp + 0x30], xmm0
call esi
test eax, eax
je 0x100054a7
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x10]
push eax
call edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call esi
test eax, eax
jne 0x10005484
pop edi
pop esi
mov esp, ebp
pop ebp
ret