joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5198f0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
call fcn.00536900
test eax, eax
jne 0x519905
mov eax, 1
pop esi
ret 0x10
mov eax, dword [esp + 0x10]
sub eax, 0
push ebx
push ebp
push edi
je 0x519ab4
dec eax
jne 0x519b19
mov ebx, dword [esp + 0x14]
cmp ebx, 0xd
je 0x519aa4
cmp ebx, 0xa
je 0x519aa4
movzx eax, bl
push eax
call fcn.00563ff7
add esp, 4
test eax, eax
je 0x51994f
push ebx
call fcn.00563f22
add esp, 4
mov dword [esp + 0x14], eax
mov ecx, dword [esi + 0x86c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x19f
push ecx
call ebp
mov edi, eax
cmp edi, 0xffffffff
je 0x519b19
inc edi
cmp edi, eax
mov dword [esp + 0x1c], eax
je 0x519a9b
mov bl, 0x20
cmp dword [esi + 0x700], 4
jne 0x5199ce
mov eax, dword [esi + 0x86c]
lea edx, [esp + 0x20]
push edx
push edi
push 0x189
push eax
call ebp
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x5199e7
cmp eax, 0xffffffff
je 0x5199e7
cmp byte [ecx], bl
jne 0x5199b9
nop
inc ecx
mov dword [esp + 0x20], ecx
cmp byte [ecx], bl
je 0x5199b0
mov edx, dword [esi + 0xbb4]
call fcn.004f8240
test al, al
je case.0x519a0a.2
inc dword [esp + 0x20]
jmp case.0x519a0a.2
mov ecx, dword [esi + 0x86c]
push 0x59b078
push edi
push 0x189
push ecx
call ebp
cmp eax, 0xffffffff
jne 0x5199ee
xor edi, edi
jmp 0x519a77
mov eax, dword [esi + 0x700]
dec eax
cmp eax, 8
mov ecx, 0x59b078
mov dword [esp + 0x20], ecx
ja case.0x519a0a.2
movzx edx, byte [eax + 0x519b34]
jmp dword [edx*4 + 0x519b28]
mov edx, dword [esi + 0xbb4]
mov ecx, 0x59b078
call fcn.004f8280
jmp 0x5199c4
cmp byte [0x59b078], bl
jne case.0x519a0a.2
jmp 0x519a30
inc ecx
mov dword [esp + 0x20], ecx
cmp byte [ecx], bl
je 0x519a30
mov eax, dword [esp + 0x20]
mov al, byte [eax]
test al, al
je 0x519a76
movzx ecx, al
push ecx
call fcn.00563ff7
add esp, 4
test eax, eax
je 0x519a69
mov edx, dword [esp + 0x20]
movzx eax, byte [edx]
push eax
call fcn.00563f22
mov ecx, dword [esp + 0x24]
add esp, 4
mov byte [ecx], al
mov edx, dword [esp + 0x20]
movzx eax, byte [edx]
cmp eax, dword [esp + 0x14]
je 0x519a8a
inc edi
cmp edi, dword [esp + 0x1c]
jne 0x519981
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0x10
mov ecx, dword [esi]
push 1
push 1
push edi
mov edx, 0x8098
call fcn.0041d650
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0x10
mov ecx, dword [esi]
call fcn.0042ded0
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0x10
mov eax, dword [esp + 0x14]
cmp eax, 1
jne 0x519ae4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
jns 0x519b19
mov ecx, dword [esp + 0x20]
push 0xffffffffffffffff
push 0
mov edx, 1
call fcn.004742f0
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0x10
cmp eax, 9
jne 0x519afe
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
js 0x519b19
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0x10
cmp eax, 0xd
je 0x519b08
cmp eax, 0xa
jne 0x519b19
mov edx, dword [esp + 0x20]
mov ecx, dword [esi]
push 3
call fcn.00474ef0
test eax, eax
jne 0x519a9b
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
ret 0x10
Function at 0x51b8e0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
push ebx
lea eax, [esp + 4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [0x59f690]
lea ecx, [esp + 4]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
push 1
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
jns 0x51b91f
mov eax, dword [0x59f7c8]
test eax, eax
jne 0x51b91f
xor eax, eax
pop ebx
add esp, 0x18
ret
push esi
mov esi, dword [0x5a1af8]
test esi, esi
push edi
je 0x51b994
mov edi, dword [sym.imp.USER32.dll_PtInRect]
mov eax, dword [esi + 0xa18]
test eax, eax
je 0x51b986
mov ecx, esi
call fcn.0051ab00
test eax, eax
je 0x51b986
lea eax, [esi + 0xa24]
mov ecx, eax
mov edx, dword [ecx]
mov dword [esp + 0x14], edx
mov eax, dword [ecx + 4]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x1c], eax
mov ecx, dword [ecx + 0xc]
add ecx, 2
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x10]
inc eax
push ecx
mov dword [esp + 0x20], eax
push edx
lea eax, [esp + 0x1c]
push eax
call edi
test eax, eax
jne 0x51b992
mov esi, dword [esi + 0xd84]
test esi, esi
jne 0x51b931
jmp 0x51b994
mov ebx, esi
cmp dword [0x59f7c8], ebx
je 0x51b9f6
test ebx, ebx
mov dword [0x59f7c8], ebx
je 0x51b9c7
mov eax, dword [0x59f7bc]
test eax, eax
jne 0x51b9c7
mov ecx, dword [0x59f690]
push 0
push 0x32
push 0x7d
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x59f7bc], eax
mov edi, dword [0x598b74]
mov edx, dword [0x5a1b00]
push 0
push 0
push 0x8042
inc edi
push edx
mov dword [0x598b74], edi
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x18
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x51cbe0
Capabilities:
Capture screenshot

Disassembly:
mov eax, dword [ecx + 0x700]
test eax, eax
jne 0x51cd03
mov eax, dword [ecx + 0xa40]
test eax, eax
push esi
jne 0x51cc6f
mov eax, dword [0x5a1af8]
test eax, eax
mov esi, 1
je 0x51cc67
cmp eax, ecx
je case.0x51cc40.5
mov edx, dword [eax + 0xbb4]
cmp edx, dword [ecx + 0xbb4]
jne case.0x51cc40.5
mov edx, dword [eax + 0xa20]
test edx, edx
jne case.0x51cc40.5
mov edx, dword [eax + 0xbbc]
test edx, edx
jne case.0x51cc40.5
mov edx, dword [eax + 0x700]
dec edx
cmp edx, 8
ja case.0x51cc40.5
movzx edx, byte [edx + 0x51cd0c]
jmp dword [edx*4 + 0x51cd04]
mov edx, dword [eax + 0xa18]
test edx, edx
je case.0x51cc40.5
mov edx, dword [eax + 0xa40]
test edx, edx
je case.0x51cc40.5
xor esi, esi
mov eax, dword [eax + 0xd84]
test eax, eax
jne 0x51cc07
mov dword [ecx + 0xa40], esi
jmp 0x51cc79
mov dword [ecx + 0xa40], 0
mov eax, dword [0x5a1af8]
test eax, eax
je 0x51cce2
cmp eax, ecx
je case.0x51ccbb.5
mov edx, dword [eax + 0xbb4]
cmp edx, dword [ecx + 0xbb4]
jne case.0x51ccbb.5
mov edx, dword [eax + 0xa20]
test edx, edx
jne case.0x51ccbb.5
mov edx, dword [eax + 0xbbc]
test edx, edx
jne case.0x51ccbb.5
mov edx, dword [eax + 0x700]
dec edx
cmp edx, 8
ja case.0x51ccbb.5
movzx edx, byte [edx + 0x51cd20]
jmp dword [edx*4 + 0x51cd18]
mov edx, dword [eax + 0xa40]
test edx, edx
je case.0x51ccbb.5
mov edx, dword [ecx + 0xa40]
mov dword [eax + 0xa18], edx
mov eax, dword [eax + 0xd84]
test eax, eax
jne 0x51cc82
mov eax, dword [ecx + 0xa40]
test eax, eax
pop esi
je 0x51ccf7
mov dword [ecx + 0x708], 0
call fcn.0053af20
xor ecx, ecx
jmp fcn.0051c6d0
ret
Function at 0x51d980
Capabilities:
Hide graphical window

Disassembly:
call fcn.0051d900
test eax, eax
je 0x51d9c5
mov eax, dword [0x5a1afc]
mov ecx, dword [0x5a1b00]
push 0
push eax
push 0x80b5
push ecx
push 0
push 0
push 0
push 0
push 0x42000000
push 0x574b10
push str.mIRC_SwitchBar
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [0x59f690], eax
jne 0x51d9c8
xor eax, eax
ret
push 0x598350
push 0x180
push 0x5a04b0
push 0x574b10
mov edx, str.switchbar
mov ecx, 0x5754c0
mov dword [0x59f6a8], eax
call fcn.004ac570
mov al, byte [0x5a04b0]
test al, al
je 0x51da14
mov ecx, 0x5a04b0
call fcn.0041cbe0
push 0
mov edx, 0x5a04b0
mov ecx, 0x59f6a8
call fcn.00420d10
mov eax, dword [0x589bd0]
test eax, eax
je 0x51da32
mov edx, dword [0x59f690]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x59f690]
ret
mov eax, dword [0x59f690]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x59f690]
ret
Function at 0x51e2e0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xc
push esi
call fcn.005366c0
mov esi, eax
test esi, esi
jne 0x51e2f6
xor eax, eax
pop esi
add esp, 0xc
ret
mov ecx, dword [esi + 0xbb4]
call fcn.004dbea0
test eax, eax
je 0x51e2ef
push edi
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, eax
cmp edi, dword [esi + 0x864]
je 0x51e326
cmp edi, dword [esi + 0x868]
je 0x51e326
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
mov edx, dword [esi + 0x894]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, edi
call fcn.004743d0
mov eax, dword [esp + 8]
test eax, eax
mov dword [esp + 0x10], eax
jge 0x51e359
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0
lea edx, [esp + 0xc]
push edx
mov edx, dword [esi + 0x894]
mov ecx, edi
call fcn.00474230
mov eax, dword [esp + 0xc]
test eax, eax
jle 0x51e31e
push 0x5994c8
push 0x3e6
push 0xd
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
mov dword [esp + 0xc], eax
jle 0x51e31e
push 5
push 0x57bb74
push 0x5994c8
mov byte [eax + 0x5994c8], 0
call fcn.00572b89
add esp, 0xc
test eax, eax
jne 0x51e3b8
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0xc]
jg 0x51e31e
dec eax
jns 0x51e3cb
xor eax, eax
mov dl, byte [eax + 0x5994c8]
xor ecx, ecx
cmp dl, 0x20
setne cl
pop edi
pop esi
mov eax, ecx
add esp, 0xc
ret
Function at 0x524720
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x10
cmp edx, 0x1b
push esi
mov esi, ecx
jne 0x524738
mov eax, dword [0x5a1094]
test eax, eax
jne 0x52480d
movzx eax, dx
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x52475e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x524765
xor eax, eax
pop esi
add esp, 0x10
ret
mov cl, byte [esi + 0xe]
mov edx, 1
push ebx
mov ebx, dword [esi + 4]
shl edx, cl
push ebp
mov ebp, dword [esi + 8]
push 0
lea eax, [esi + edx*4 + 0x28]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_GetDC]
test eax, eax
mov dword [esp + 0xc], eax
je 0x524807
push edi
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x5247f9
mov ecx, dword [esp + 0x10]
push ebp
push ebx
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test eax, eax
mov dword [esp + 0x14], eax
je 0x5247f2
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x18]
push 0xcc0020
push 0
push esi
push edx
push ebp
push ebx
push 0
push 0
push ebp
push ebx
push 0
push 0
push edi
mov dword [esp + 0x50], eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
mov eax, dword [esp + 0x1c]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [esp + 0x10]
push ecx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
Function at 0x526d00
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, dword [0x589bd0]
xor ecx, ecx
mov dl, 4
mov ebx, 8
push ebp
lea eax, [ecx + ecx*2]
shl eax, 2
cmp ecx, 0x21
lea ebp, [ecx + 0x3e8]
mov dword [eax + 0x5a0db0], ecx
mov dword [eax + 0x5a0db4], ebp
mov byte [eax + 0x5a0db8], dl
mov byte [eax + 0x5a0db9], 0
ja case.0x526d43.2
movzx ebp, byte [ecx + 0x526f04]
jmp dword [ebp*4 + 0x526ef4]
test esi, esi
je case.0x526d43.0
mov byte [eax + 0x5a0db8], bl
jmp case.0x526d43.0
mov dword [eax + 0x5a0db0], 0xffffffff
mov byte [eax + 0x5a0db9], 1
inc ecx
cmp ecx, 0x22
jl 0x526d12
call fcn.00526c80
test eax, eax
pop ebp
je 0x526db0
mov eax, dword [0x5a1afc]
mov ecx, dword [0x5a1b00]
push 0
push eax
push 0
push ecx
push 0
push 0
push 0
push 0
push 0x42000000
push 0x574b10
push str.mIRC_Toolbar
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [0x5a0f50], eax
jne 0x526db5
pop esi
xor eax, eax
pop ebx
ret
movzx edx, word [0x5a1afc]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
or edx, 0x1b0000
push edx
push 0x22
push 0x413
push eax
mov dword [0x5a0f78], eax
mov dword [0x5a1090], eax
call esi
mov eax, dword [0x5a0f50]
push 0x5a0db0
push 0x22
push 0x414
push eax
call esi
call fcn.005255a0
mov eax, dword [0x5a0f50]
test eax, eax
je 0x526e64
mov eax, dword [0x59ca60]
test eax, eax
jne 0x526e1c
mov eax, dword [0x59ca5c]
test eax, eax
jne 0x526e1c
mov eax, dword [0x59ca64]
test eax, eax
mov edx, ebx
je 0x526e21
mov edx, 9
mov ecx, ebx
call fcn.00525540
test eax, eax
je 0x526e33
mov ecx, ebx
call fcn.005254f0
mov eax, dword [0x5a0f50]
test eax, eax
je 0x526e64
mov ebx, dword [0x59676c]
xor edx, edx
test ebx, ebx
setne dl
mov ecx, 0xe
add edx, 0xe
call fcn.00525540
test eax, eax
je 0x526e64
mov ecx, 0xe
call fcn.005254f0
call fcn.00525690
mov eax, dword [0x5a0f50]
test eax, eax
je 0x526ec8
mov edx, 0x18
mov ecx, edx
call fcn.00525540
test eax, eax
je 0x526e8c
mov ecx, 0x18
call fcn.005254f0
mov eax, dword [0x5a0f50]
test eax, eax
mov dword [0x5a11bc], 0
je 0x526ec8
mov edx, 0x1a
mov ecx, edx
call fcn.00525540
test eax, eax
je 0x526eb9
mov ecx, 0x1a
call fcn.005254f0
mov eax, dword [0x5a0f50]
mov dword [0x5a11c0], 0
mov ecx, dword [0x589c08]
test ecx, ecx
je 0x526ee3
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5a0f50]
pop esi
pop ebx
ret
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5a0f50]
pop esi
pop ebx
ret
Function at 0x527db0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call fcn.0050d160
test eax, eax
je 0x527e8c
mov eax, dword [esi + 0x3a4]
push ebx
xor edx, edx
test eax, eax
push edi
je 0x527e4c
mov ecx, 0x15be
call fcn.0041c9e0
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push eax
mov eax, dword [esi]
push 0
push 0xc
push 0x79
push eax
call edi
mov eax, dword [esi + 0x344]
test eax, eax
je 0x527e1c
mov ecx, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x78
push ecx
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov edx, dword [esi]
push 0
push 0x77
push edx
call edi
push eax
call ebx
pop edi
pop ebx
pop esi
ret
xor edx, edx
mov ecx, 0x15bf
call fcn.0041c9e0
push eax
mov eax, dword [esi]
push 0
push 0xc
push 0x77
push eax
call edi
mov ecx, dword [esi]
push 5
push 0x77
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop ebx
pop esi
ret
mov ecx, 0x15bd
call fcn.0041c9e0
mov edx, dword [esi]
push eax
push 0
push 0xc
push 0x79
push edx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x78
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi]
push 0
push 0x77
push ecx
call edi
push eax
call ebx
pop edi
pop ebx
pop esi
ret

Function at 0x527e90
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call fcn.0048a760
test eax, eax
je 0x527f5e
mov eax, dword [esi + 0x488]
push ebx
xor edx, edx
test eax, eax
push edi
je 0x527f1e
mov ecx, 0x15be
call fcn.0041c9e0
push eax
mov eax, dword [esi]
push 0
push 0xc
push 0x79
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov ecx, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push 0x78
push ecx
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov edx, dword [esi]
push 5
push 0x77
push edx
call edi
push eax
call ebx
mov eax, dword [esi + 0x448]
test eax, eax
je 0x527f0a
mov eax, dword [esi]
push 1
push 0x77
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop ebx
pop esi
ret
mov ecx, dword [esi]
push 0
push 0x77
push ecx
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop ebx
pop esi
ret
mov ecx, 0x15bd
call fcn.0041c9e0
mov edx, dword [esi]
push eax
push 0
push 0xc
push 0x79
push edx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x78
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi]
push 0
push 0x77
push ecx
call edi
push eax
call ebx
pop edi
pop ebx
pop esi
ret
Function at 0x52bba0
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call edi
xor esi, esi
mov si, ax
push 0x11
and esi, 0x8000
sub esi, 0x8000
neg esi
sbb esi, esi
inc esi
call edi
test ah, ah
jns 0x52bbef
mov eax, dword [0x5988d0]
test eax, eax
je 0x52bbda
mov dword [0x5988dc], eax
jmp 0x52bbef
mov eax, dword [0x5a1b00]
push 1
push 0
push 0x8043
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [0x5a13f8]
test eax, eax
jne 0x52bc0e
mov eax, dword [0x5a13f4]
test eax, eax
je 0x52bc0a
test esi, esi
je 0x52bc0e
pop edi
xor eax, eax
pop esi
ret
test esi, esi
je 0x52bc05
mov ecx, 1
call fcn.0052b760
test eax, eax
je 0x52bc05
mov eax, dword [0x5a13f4]
test eax, eax
push 6
je 0x52bc61
test esi, esi
je 0x52bc40
mov ecx, dword [0x5a1b00]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, 1
pop esi
ret
mov edx, dword [0x5a1b00]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push edx
call esi
mov eax, dword [0x5a1b00]
push 0
push eax
call esi
pop edi
mov eax, 1
pop esi
ret
test esi, esi
je 0x52bc87
mov ecx, dword [0x5a1b00]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push ecx
call esi
mov edx, dword [0x5a1b00]
push 0
push edx
call esi
pop edi
mov eax, 1
pop esi
ret
mov eax, dword [0x5a1b00]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, 1
pop esi
ret

Function at 0x52bd50
Capabilities:
Find taskbar

Disassembly:
mov eax, dword [0x5a1524]
test eax, eax
jne 0x52be4c
movzx eax, cl
sub eax, 3
mov dword [0x5a1524], 1
je 0x52bd88
sub eax, 2
jne 0x52be42
call fcn.0052aeb0
mov dword [0x5a1524], 0
ret
mov eax, dword [0x5a1518]
test eax, eax
jne 0x52be42
push ebx
push ebp
push esi
push edi
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x52be07
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push 2
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_IsIconic]
mov ebp, dword [sym.imp.USER32.dll_IsWindowVisible]
mov esi, eax
test esi, esi
je 0x52bde8
cmp esi, dword [0x5a1b00]
je 0x52bdf0
push esi
call ebx
test eax, eax
jne 0x52bddd
push esi
call ebp
test eax, eax
jne 0x52bde8
push 2
push esi
call edi
mov esi, eax
test esi, esi
jne 0x52bdc7
cmp esi, dword [0x5a1b00]
jne 0x52be07
push esi
call ebx
test eax, eax
jne 0x52be07
push esi
call ebp
test eax, eax
je 0x52be07
call fcn.0052bba0
test eax, eax
jne 0x52be3e
mov eax, dword [0x5988dc]
test eax, eax
je 0x52be34
mov eax, dword [0x5a1b00]
push 0
push 0
push 0x8043
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
pop ebx
mov dword [0x5a1524], 0
ret
mov ecx, 1
call fcn.0052bac0
pop edi
pop esi
pop ebp
pop ebx
mov dword [0x5a1524], 0
ret
Function at 0x52d710
Capabilities:
Enumerate network shares

Disassembly:
sub esp, 0x1c
movzx eax, byte [edx]
push eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
call fcn.005640f7
add esp, 4
cmp al, 0x41
mov byte [esp + 3], al
jb 0x52d883
cmp al, 0x5a
ja 0x52d883
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 1
push 1
call sub.MPR.dll_WNetOpenEnumA
test eax, eax
jne 0x52d883
push ebx
push ebp
mov ebx, 0x640
push ebx
mov dword [esp + 0x1c], eax
call fcn.005635a3
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x52d86f
push esi
push edi
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
push ebp
lea eax, [esp + 0x1c]
push eax
push ecx
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], ebx
call sub.MPR.dll_WNetEnumResourceA
cmp eax, 0xea
jne 0x52d7b9
mov eax, dword [esp + 0x18]
push eax
push ebp
mov ebx, eax
call fcn.00564c59
add esp, 8
test eax, eax
je 0x52d860
mov ebp, eax
jmp 0x52d775
test eax, eax
jne 0x52d860
mov eax, dword [esp + 0x14]
xor esi, esi
test eax, eax
jle 0x52d775
lea edi, [ebp + 0x10]
mov edi, edi
mov eax, dword [edi]
test eax, eax
je 0x52d7eb
movzx edx, byte [eax]
push edx
call fcn.005640f7
movzx ecx, byte [esp + 0x17]
add esp, 4
cmp ecx, eax
je 0x52d7fc
mov eax, dword [esp + 0x14]
inc esi
add edi, 0x20
cmp esi, eax
jl 0x52d7d0
jmp 0x52d775
mov edi, dword [esp + 0x24]
shl esi, 5
mov esi, dword [esi + ebp + 0x14]
mov ecx, edi
lea esp, [esp]
mov al, byte [esi]
inc esi
mov byte [ecx], al
inc ecx
test al, al
jne 0x52d810
mov eax, dword [esp + 0x28]
cmp byte [eax + 1], 0x3a
jne 0x52d858
mov cl, byte [eax + 2]
add eax, 2
cmp cl, 0x5c
jne 0x52d858
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x52d831
sub eax, edx
dec edi
jmp 0x52d840
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x52d840
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x20], 1
test ebp, ebp
pop edi
pop esi
je 0x52d86f
push ebp
call fcn.005635b5
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call sub.MPR.dll_WNetCloseEnum
mov eax, dword [esp + 0x18]
pop ebp
pop ebx
add esp, 0x1c
ret
xor eax, eax
add esp, 0x1c
ret

Function at 0x52d890
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebx
push edi
lea eax, [esp + 8]
push eax
push 0x2001f
push 0
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x52d8c2
pop edi
mov eax, 0x3f3
pop ebx
add esp, 0x10c
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea esp, [esp]
mov edx, dword [esp + 0xc]
push 0x105
lea ecx, [esp + 0x14]
push ecx
push 0
push edx
call esi
test eax, eax
jne 0x52d8f8
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
call fcn.0052d890
test eax, eax
je 0x52d8d0
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop esi
pop edi
pop ebx
add esp, 0x10c
ret
Function at 0x52d920
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
push edi
lea eax, [esp + 0xc]
push eax
mov edi, ecx
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x20006
push 0
push 0x575c80
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallmIRC
push reloc.WSOCK32.dll_bind
mov esi, edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x52d95f
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x52d964
sub eax, edx
mov edx, dword [esp + 8]
inc eax
push eax
push esi
push 1
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
add esp, 8
ret
Function at 0x52df00
Capabilities:
Get common file path

Disassembly:
sub esp, 0x55c
push esi
lea eax, [esp + 0xc]
push eax
mov esi, ecx
mov ecx, dword [0x5a1b00]
push 0
push ecx
mov dword [esp + 0x10], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x52e090
mov eax, dword [esp + 0xc]
test eax, eax
je 0x52e090
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jl 0x52e090
lea ecx, [esp + 0x10]
call fcn.0041f4e0
lea eax, [esp + 0x10]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x52df60
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
sub eax, edx
lea eax, [esp + eax + 0x14]
push str._s.lnk
push eax
call esi
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 0x57c6c4
push 1
push 0
push 0x57c6d4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x52e090
mov eax, dword [esp + 4]
mov edx, dword [eax]
lea ecx, [esp + 8]
push ecx
push 0x57c724
push eax
call dword [edx]
test eax, eax
jge 0x52dfc9
mov eax, dword [esp + 4]
mov edx, dword [eax]
push eax
call dword [edx + 8]
pop esi
add esp, 0x55c
ret
push 0x104
lea eax, [esp + 0x35c]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 8]
mov edx, dword [eax]
push 0
lea ecx, [esp + 0x35c]
push ecx
push eax
call dword [edx + 0x14]
test eax, eax
jge 0x52e01b
mov eax, dword [esp + 8]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop esi
add esp, 0x55c
ret
mov eax, dword [esp + 4]
mov edx, dword [eax]
push 0
lea ecx, [esp + 0x21c]
push ecx
push 0x104
lea ecx, [esp + 0x120]
push ecx
push eax
call dword [edx + 0xc]
test eax, eax
mov eax, dword [esp + 8]
mov edx, dword [eax]
push eax
jl 0x52e006
call dword [edx + 8]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x5994c8
push 0x598248
push 0x574904
push 0x5990e0
call esi
lea edx, [esp + 0x124]
push edx
push 0x5990e0
call fcn.00572b46
add esp, 0x18
test eax, eax
jne 0x52e090
lea eax, [esp + 0x10]
push eax
call fcn.00565467
add esp, 4
pop esi
add esp, 0x55c
ret