joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40db51
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
inc ebx
cmp eax, 0xf
push edi
mov esi, ecx
jne 0x40db80
mov ecx, dword [ebp + 0x18]
lea eax, [esi + 0xbc]
mov dword [eax], ebx
and dword [ecx], 0
cmp dword [eax], 0
je 0x40dbb7
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
cmp eax, 2
jne 0x40dbd8
push dword [esi + 0x10]
mov dword [esi + 0xbc], ebx
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
test edi, edi
je 0x40dbb1
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40dbb1
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
and dword [eax], 0
cmp dword [esi + 0xbc], 0
jne 0x40db77
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407650
jmp 0x40db79
cmp eax, 0x47
jne 0x40dbfd
push dword [ebp + 0x14]
lea edi, [esi + 0xbc]
mov eax, esi
mov dword [edi], ebx
call fcn.0040dc55
mov eax, dword [ebp + 0x18]
and dword [eax], 0
cmp dword [edi], 0
jmp 0x40db75
cmp eax, 0x18
jne 0x40dbb7
push dword [ebp + 0x10]
mov dword [esi + 0xbc], ebx
call fcn.00409c45
xor edi, edi
cmp dword [ebp + 0x10], edi
je 0x40dc35
push dword [esi + 8]
jmp 0x40dc2b
mov ecx, dword [eax + 0x34]
shr ecx, 3
not ecx
test bl, cl
je 0x40dc3f
push dword [eax + 8]
call fcn.004047b2
cmp eax, edi
pop ecx
jne 0x40dc1c
mov eax, dword [ebp + 0x10]
mov ecx, esi
call fcn.0040ab71
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
cmp dword [esi + 0xbc], edi
jne 0x40db77
jmp 0x40dbb7

Function at 0x416b5b
Capabilities:
Print debug messages

Disassembly:
push 0x10
mov eax, 0x4a259a
call fcn.004878f8
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.00405f0e
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x14]
push eax
push str.__02d__02d__02d__03d__n
lea ecx, [ebp + 8]
call fcn.00416bc1
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004012f9
call fcn.004879d0
ret 4
Function at 0x417b19
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp + 0xc]
sub edi, dword [esi + 0x18]
sub eax, dword [esi + 0x14]
mov edx, dword [esi]
push 1
xor ebx, ebx
push edi
push eax
mov ecx, esi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [edx + 0x6c]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0xfc]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x417c52
push eax
call fcn.004047b2
mov ebx, eax
test ebx, ebx
pop ecx
je 0x417c1f
mov eax, dword [ebx + 0x10]
push 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebx]
push 0
mov ecx, ebx
call dword [eax + 0x28]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x34]
test eax, eax
je 0x417b93
lea eax, [ebx + 0x14]
push eax
call fcn.0040d4b7
movzx eax, word [ebp + 0xc]
movzx edi, di
shl edi, 0x10
or edi, eax
push edi
push dword [ebp + 8]
mov ecx, ebx
push 0x202
call fcn.0040453e
mov eax, dword [ebp - 0x10]
cmp dword [esi + 0xfc], eax
jne 0x417be9
mov ecx, dword [ebx + 0x40]
xor eax, eax
cmp ecx, eax
je 0x417bdb
cmp word [ecx], ax
je 0x417bdb
push 1
push eax
push eax
push ecx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x417c1f
cmp dword [ebx + 0x10], eax
je 0x417c1f
mov dword [ebp - 4], 1
jmp 0x417c1f
mov eax, dword [ebx]
push 1
push 0
mov ecx, ebx
call dword [eax + 0x28]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x34]
test eax, eax
je 0x417c08
lea eax, [ebx + 0x14]
push eax
call fcn.0040d4b7
push edi
push dword [ebp + 8]
mov ecx, ebx
push 0x2a3
call fcn.0040453e
mov dword [ebp - 8], 1
xor ecx, ecx
cmp dword [ebp - 4], ecx
mov dword [esi + 0xfc], ecx
je 0x417c30
push 0x67
jmp 0x417c4b
cmp dword [ebp - 8], ecx
je 0x417c52
cmp dword [ebp - 0xc], ecx
je 0x417c52
mov edx, dword [ebp - 0x14]
lea eax, [esi + 0xf8]
cmp edx, dword [eax]
jne 0x417c49
mov dword [eax], ecx
push 0x6a
mov edi, ebx
call fcn.00417865
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x41f899
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
test byte [esi + 0x14], 2
je 0x41f8f2
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
sub eax, ecx
je 0x41f8e3
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
sub edx, eax
je 0x41f8e3
mov edx, dword [esi + 0x10]
push 0x11
push 0
push 0
sub ecx, edx
push ecx
sub eax, edx
push eax
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x41f8f2
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xfd
leave
ret 4

Function at 0x41f8f6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 1
push edi
mov edi, eax
jne 0x41f916
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [edi + 0x14], 0xfd
jmp 0x41f973
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
je 0x41f978
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
je 0x41f978
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x41f973
or byte [edi + 0x14], 4
mov al, byte [edi + 0x14]
test al, 2
jne 0x41f96a
push dword [ebp + 8]
or al, 2
mov byte [edi + 0x14], al
call fcn.0041f98c
push 8
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41f973
cmp dword [edi + 0x18], esi
je 0x41f973
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], esi
jmp 0x41f987
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [edi + 0x14], 0xfd
pop edi
leave
ret 8
Function at 0x420da9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov esi, eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
xor ebx, ebx
lea edi, [esi + 0x300]
cmp dword [edi], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
je 0x420dda
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [edi], ebx
mov ebx, dword [ebp + 0x10]
push 1
push ebx
push dword [ebp + 0xc]
lea ecx, [esi + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x30]
test eax, eax
mov dword [ebp - 4], eax
jne 0x420e1e
push 1
push ebx
push dword [ebp + 0xc]
lea ecx, [esi + 0x10c]
mov eax, dword [ecx]
call dword [eax + 0x30]
test eax, eax
mov dword [ebp - 4], eax
jne 0x420e1e
push 1
push ebx
push dword [ebp + 0xc]
lea ecx, [esi + 0x1f0]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x2ec]
test eax, eax
mov dword [ebp - 0x14], eax
je 0x420f70
push eax
call fcn.004047b2
mov edi, eax
test edi, edi
pop ecx
je 0x420eef
mov eax, dword [edi + 0x10]
push 2
mov dword [ebp - 8], eax
mov eax, dword [edi]
push 0
mov ecx, edi
call dword [eax + 0x28]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x34]
test eax, eax
je 0x420e64
push 1
push edi
call fcn.00404750
movzx eax, word [ebp + 0xc]
movzx ebx, bx
shl ebx, 0x10
or ebx, eax
push ebx
push dword [ebp + 8]
mov ecx, edi
push 0x202
call fcn.0040453e
mov eax, dword [ebp - 4]
cmp dword [esi + 0x2ec], eax
jne 0x420eba
mov ecx, dword [edi + 0x40]
xor eax, eax
cmp ecx, eax
je 0x420eac
cmp word [ecx], ax
je 0x420eac
push 1
push eax
push eax
push ecx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x420eef
cmp dword [edi + 0x10], eax
je 0x420eef
mov dword [ebp - 0xc], 1
jmp 0x420eef
mov eax, dword [edi]
push 1
push 0
mov ecx, edi
call dword [eax + 0x28]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x34]
test eax, eax
je 0x420ed8
push 1
push edi
call fcn.00404750
push ebx
push dword [ebp + 8]
mov ecx, edi
push 0x2a3
call fcn.0040453e
mov dword [ebp - 0x10], 1
xor eax, eax
cmp dword [ebp - 0xc], eax
mov dword [esi + 0x2ec], eax
je 0x420f31
mov eax, dword [esi + 4]
or dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi]
mov ecx, edi
mov dword [ebp - 0x20], 1
call dword [eax + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x24]
push 0x4e
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x420f70
cmp dword [ebp - 0x10], eax
je 0x420f70
mov ecx, dword [ebp - 8]
cmp ecx, eax
je 0x420f70
mov eax, dword [esi + 4]
or dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x28]
push ecx
push 0xffffffffffffffff
push 0x4e
push eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x14]
add esi, 0x2e8
cmp eax, dword [esi]
jne 0x420f70
and dword [esi], 0
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x420f8b
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x120
mov eax, dword [0x4dc0a8]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa8]
push edi
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa8], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
cmp eax, edi
jne 0x420fee
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x114
call esi
cmp eax, edi
je 0x42109c
mov eax, dword [ebp - 0x98]
dec eax
je 0x421088
dec eax
jne 0x42109c
cmp dword [ebp - 0xa4], 6
jne 0x421039
inc eax
cmp dword [ebp - 0xa0], eax
jne 0x421021
xor ecx, ecx
cmp byte [ebp + 0x72], al
setne cl
add ecx, 8
jmp 0x421035
cmp dword [ebp - 0xa0], edi
jne 0x421075
xor ecx, ecx
cmp byte [ebp + 0x72], al
setne cl
lea ecx, [ecx + ecx + 7]
mov edi, ecx
jmp 0x42109c
cmp dword [ebp - 0xa4], 5
jne 0x421068
cmp dword [ebp - 0xa0], 2
jne 0x42104f
push 5
jmp 0x421085
cmp dword [ebp - 0xa0], 1
jne 0x42105c
push 6
jmp 0x421085
cmp dword [ebp - 0xa0], edi
jne 0x42109c
push 3
jmp 0x421085
cmp dword [ebp - 0xa4], 4
ja 0x42109c
push 4
jmp 0x421085
cmp dword [ebp - 0xa0], 2
jne 0x42109c
cmp byte [ebp + 0x72], al
jne 0x42109c
push 0xa
pop edi
jmp 0x42109c
mov eax, dword [ebp - 0x9c]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb edi, edi
inc edi
inc edi
mov ecx, dword [ebp + 0x74]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00486d86
add ebp, 0x78
leave
ret

Function at 0x42163a
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x4dc0a8]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 8
mov eax, 0x4a0089
call fcn.004878f8
mov eax, dword [ebp + 0x41c]
xor edi, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edi
mov eax, dword [0x4e0530]
mov ecx, 0x4e0530
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x10], ebx
push 0x40e
lea eax, [ebp + 2]
push edi
mov dword [ebp - 4], edi
push eax
mov word [ebp], di
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x4216f5
mov edi, dword [sym.imp.MSVCR80.dll_wcslen]
lea eax, [ebp]
push eax
call edi
test eax, eax
pop ecx
jbe 0x4216f5
lea eax, [ebp]
push eax
call edi
pop ecx
lea ecx, [ebp]
mov ebx, eax
push ecx
lea eax, [ebp - 0x10]
call fcn.00404388
lea eax, [ebp - 0x10]
push eax
call fcn.004670b2
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push str._d.tmp
call fcn.00416bc1
mov edi, dword [ebp - 0x10]
add esp, 0xc
add edi, 0xfffffff0
jmp 0x4216f8
lea edi, [ebx - 0x10]
mov eax, edi
call fcn.00401311
add eax, 0x10
mov dword [esi], eax
mov eax, edi
call fcn.004012f9
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.00486d86
add ebp, 0x414
leave
ret
Function at 0x421753
Capabilities:
Copy file

Disassembly:
push 8
mov eax, 0x4a23e1
call fcn.004878f8
mov eax, dword [ebx + 4]
sub eax, 0x10
call fcn.00401311
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.004670b2
lea eax, [ebp - 0x10]
mov dword [esp], str.closepop.dat
push eax
call fcn.00405fe7
push dword [ebp + 8]
lea esi, [ebp - 0x14]
call fcn.0042163a
pop ecx
lea edi, [ebx + 8]
mov byte [ebp - 4], 1
call fcn.00404347
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004012f9
mov edi, dword [edi]
xor esi, esi
cmp dword [edi - 0xc], esi
jne 0x4217c5
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
jmp 0x421813
push esi
push edi
mov edi, dword [ebp - 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x421810
push esi
xor eax, eax
inc eax
push eax
push eax
push esi
push dword [ebp + 8]
mov dword [ebx], eax
push dword [0x4e0cfc]
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
cmp dword [0x4e0da8], esi
je 0x421810
push str.KClosePopSend:_OK
call fcn.00422cfe
call fcn.00422d46
mov esi, eax
call fcn.00422d9a
lea eax, [edi - 0x10]
call fcn.004012f9
xor eax, eax
call fcn.004879d0
ret 4

Function at 0x423475
Capabilities:
Read .ini file

Disassembly:
push 4
mov eax, 0x49d41b
call fcn.004878f8
mov eax, dword [0x4e0530]
mov ecx, 0x4e0530
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [eax]
mov edi, dword [ecx]
push eax
push 0x20
push 0x20
lea esi, [ebp - 0x10]
call fcn.00401923
push eax
push ebx
push str.show
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, dword [ebp - 0x10]
cmp esi, ebx
mov edi, eax
jne 0x4234cb
xor eax, eax
jmp 0x4234d3
push esi
call dword [sym.imp.MSVCR80.dll_wcslen]
pop ecx
lea edx, [ebp - 0x10]
call fcn.00401390
cmp edi, ebx
jbe 0x4234ff
push esi
call dword [sym.imp.MSVCR80.dll__wtoi64]
pop ecx
mov edi, eax
mov ebx, edx
lea eax, [esi - 0x10]
call fcn.004012f9
mov eax, edi
mov edx, ebx
call fcn.004879d0
ret 8
xor edi, edi
jmp 0x4234eb

Function at 0x423503
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49e946
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x4dc0a8]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
lea eax, [esp + 0x24]
push eax
call fcn.0046aa81
pop ecx
and dword [esp + 0x40], 0
push esi
push edi
call fcn.00423475
mov edi, dword [edi]
mov esi, dword [esi]
push edi
push 0
push str.NoShowDays
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42356a
xor eax, eax
jmp 0x423593
test ebx, ebx
je 0x423590
test esi, esi
je 0x423590
mov eax, ebx
lea ecx, [esp + 0x14]
call fcn.0046a994
mov eax, esi
lea ecx, [esp + 0x14]
lea esi, [esp + 0x24]
call fcn.0046ac89
test eax, eax
je 0x423566
xor eax, eax
inc eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4241ca
Capabilities:
Check if file exists

Disassembly:
push 0x10
mov eax, 0x4a3d5e
call fcn.004878f8
xor ebx, ebx
lea ecx, [ebp - 0x14]
call fcn.00467016
and dword [ebp - 4], ebx
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401311
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
call fcn.00423650
mov eax, dword [eax]
cmp eax, 2
jne 0x424212
push str.ksoft_
lea eax, [ebp - 0x10]
push eax
call fcn.00405fe7
push str.rcmdhelper.exe
lea eax, [ebp - 0x10]
push eax
call fcn.00405fe7
mov ebx, dword [ebp - 0x10]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42426d
cmp dword [0x4e0da8], eax
je 0x424250
push str.KCmppFunc::_OpenUrlByRcmdHelper::rcmdhelper.exe_is_not_exsit
push ecx
call fcn.00422cfe
add esp, 4
call fcn.00422d46
mov esi, eax
call fcn.00422d9a
xor esi, esi
lea eax, [ebx - 0x10]
call fcn.004012f9
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, esi
call fcn.004879d0
ret
mov eax, dword [0x4e0530]
mov ecx, 0x4e0530
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp - 0x18]
push str._openurl:1__from:wormhole_pop__url:__s_
call fcn.00401a22
mov edi, dword [ebp - 0x18]
pop ecx
pop ecx
mov edx, edi
mov ecx, ebx
call fcn.00468052
mov esi, eax
neg esi
sbb esi, esi
lea eax, [edi - 0x10]
inc esi
call fcn.004012f9
jmp 0x424252
Function at 0x424459
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
cmp dword [ebp + 0x1c], 0
push ebx
push esi
jne 0x424590
mov eax, dword [ebp + 0xc]
xor ebx, ebx
inc ebx
cmp eax, 0x4e
jne 0x4244a9
mov esi, dword [ebp + 0x14]
cmp dword [esi + 4], 0xffffffff
jne 0x424570
mov eax, edi
mov dword [edi + 0x3cc], ebx
call fcn.004243d7
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [edi + 0x3cc], 0
je 0x424570
mov eax, ebx
jmp 0x424592
cmp eax, 0x110
jne 0x4244c9
lea esi, [edi + 0x3cc]
mov eax, edi
mov dword [esi], ebx
call fcn.0042466f
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
cmp dword [esi], 0
jmp 0x42449c
cmp eax, 0x86
jne 0x4244fa
xor eax, eax
cmp dword [ebp + 0x10], eax
lea esi, [edi + 0x3cc]
mov dword [esi], eax
jne 0x4244f1
push eax
push eax
push 0x401
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov ecx, dword [ebp + 0x18]
mov dword [ecx], ebx
cmp dword [esi], eax
jmp 0x42449c
cmp eax, 2
jne 0x424523
cmp dword [edi + 0x2d8], 0
lea esi, [edi + 0x3cc]
mov dword [esi], ebx
je 0x42451b
lea eax, [edi + 0x2d4]
call fcn.0041532b
mov eax, dword [ebp + 0x18]
and dword [eax], 0
jmp 0x4244c4
cmp eax, 0x201
jne 0x424554
mov ecx, dword [ebp + 0x14]
movsx eax, word [ebp + 0x14]
shr ecx, 0x10
movsx ecx, cx
push ecx
push eax
push dword [ebp + 0x10]
mov eax, edi
mov dword [edi + 0x3cc], ebx
call fcn.00421174
mov eax, dword [ebp + 0x18]
and dword [eax], 0
jmp 0x424495
cmp eax, 0x401
jne 0x424570
push 0
push dword [edi + 4]
lea esi, [edi + 0x3cc]
mov dword [esi], ebx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x42451b
push 0
push dword [ebp + 0x18]
mov ecx, edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041ef3d
test eax, eax
jne 0x4244a2
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x424884
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push 0
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ebx, [edi + 0x3e0]
mov eax, ebx
call fcn.00402171
cmp esi, eax
jge 0x4248d1
mov eax, ebx
call fcn.00402171
cmp esi, eax
jb 0x4248b5
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [ebx + 4]
imul esi, esi, 0xc
push dword [eax + esi]
push 0
push 0x469
push dword [edi + 0x3d0]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
pop ebx
ret
Function at 0x425c90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jne 0x425caf
xor eax, eax
jmp 0x425cff
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 8], eax
je 0x425cab
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x425cab
push ebx
lea ebx, [edi + 1]
push ebx
call fcn.0040413c
test eax, eax
je 0x425ceb
push edi
push dword [ebp - 4]
push eax
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov eax, ebx
call fcn.00425bc3
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
leave
ret

Function at 0x425d03
Capabilities:
Get file size
Read file on windows

Disassembly:
push 8
mov eax, 0x49e894
call fcn.004878f8
mov edi, ecx
mov eax, dword [0x4e0530]
mov esi, 0x4e0530
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 0x14], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x14], ebx
lea eax, [edi + 0xc]
jne 0x425d38
mov eax, edi
lea edi, [ebp - 0x10]
call fcn.00404347
mov edi, dword [ebp - 0x10]
cmp dword [edi - 0xc], ebx
je 0x425e21
mov eax, dword [0x4e0530]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0x14], eax
push dword [ebp + 0x10]
mov byte [ebp - 4], 1
push dword [ebp + 8]
lea eax, [ebp + 0x14]
push edi
push 0x4b1638
call fcn.00401a22
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
je 0x425e16
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebx
je 0x425e0d
mov esi, dword [ebp + 0xc]
push ebx
lea eax, [ebp + 8]
push eax
push edi
lea eax, [edi + 0xa]
push eax
mov dword [ebp + 8], ebx
call fcn.0040413c
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x425e04
cmp dword [ebp + 8], edi
jne 0x425e04
mov eax, edi
call fcn.00425bc3
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.004012f9
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, esi
call fcn.004879d0
ret 0x10
xor eax, eax
mov edx, esi
call fcn.0040411c
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.004012f9
mov esi, dword [ebp - 0x14]
jmp 0x425def
Function at 0x429463
Capabilities:
Check mutex on windows

Disassembly:
push 8
mov eax, 0x4a6b2c
call fcn.004878f8
xor edi, edi
cmp dword [ebx + 4], edi
je 0x4294c0
mov dword [ebp - 0x14], vtable.KEvent.0
mov dword [ebp - 0x10], edi
push edi
push 0x4ae5c8
lea esi, [ebp - 0x14]
mov dword [ebp - 4], edi
call fcn.00429405
push str.KPopCenterImpl_Exist
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4294cb
cmp esi, edi
je 0x4294b8
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea ecx, [ebp - 0x14]
call fcn.004293e8
xor eax, eax
inc eax
call fcn.004879d0
ret 4
push dword [ebp + 8]
push ebx
call fcn.0045abcd
test al, al
je 0x4294b8
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
push ebx
call fcn.0045ace7
cmp eax, 1
je 0x4294b8
push dword [ebp + 8]
call fcn.0045ac74
lea ecx, [ebp - 0x14]
call fcn.004293e8
xor eax, eax
jmp 0x4294c3

Function at 0x42953e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebx]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
je 0x4295cd
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 4]
push edx
push ecx
lea edx, [ebp - 8]
push edx
push ecx
push dword [ebp + 8]
push eax
call edi
cmp dword [ebp - 8], 1
je 0x429575
cmp dword [ebp - 8], 2
jne 0x4295cc
push esi
mov esi, dword [ebp + 0xc]
call fcn.004043f6
mov eax, dword [ebp - 4]
shr eax, 1
inc eax
push eax
call fcn.00401923
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ebx]
call edi
test eax, eax
jne 0x4295b3
mov eax, dword [ebp - 4]
shr eax, 1
and word [esi + eax*2], 0
mov dword [ebp - 0xc], 1
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x4295c4
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
pop ecx
mov edx, esi
call fcn.00401390
pop esi
pop edi
mov eax, dword [ebp - 0xc]
leave
ret 8

Function at 0x42b20a
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x550]
mov eax, dword [ecx]
push 0
mov dword [esi + 0x630], 1
call dword [eax + 0x18]
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x1f4
push 0x7ee
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esp + 0x10]
test eax, eax
pop esi
je 0x42b258
mov ecx, dword [eax]
push str._ret__:_1
push eax
call dword [ecx + 4]
ret 0xc