joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd261b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00d26140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00d26140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00d26140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00d26140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xd26230
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x218]
push ebp
mov ebp, dword [esp + 0x218]
push esi
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xd262d6
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea ecx, [esp + 0x14]
push 0x104
push ecx
push eax
push edx
call edi
mov esi, eax
test esi, esi
jne 0xd262ae
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.00d26230
mov esi, eax
add esp, 8
test esi, esi
jne 0xd262ae
lea edx, [esp + 0x14]
push 0x104
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call edi
mov esi, eax
test esi, esi
je 0xd2627e
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
pop edi
je 0xd262ce
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret

Function at 0xd26bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xd26c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xd3887c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xd26c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xd26c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40105f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
nop
mov eax, 0x40d01e
push eax
mov eax, dword [ebp + 8]
push eax
call sub.msvcrt.dll_fopen
add esp, 8
mov dword [ebp - 4], eax
mov eax, 0
push eax
mov eax, 0x3c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.msvcrt.dll_fseek
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
mov eax, 1
push eax
mov eax, 2
push eax
lea eax, [ebp - 6]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
mov eax, 0
push eax
movzx eax, word [ebp - 6]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.msvcrt.dll_fseek
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
mov eax, 1
push eax
mov eax, 0xf8
push eax
lea eax, [ebp - 0x100]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
movzx eax, word [ebp - 0xe8]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
cmp eax, 0x10b
jne 0x401132
movzx eax, word [ebp - 0xa4]
cmp eax, 3
jne 0x401127
mov eax, 0xd
mov dword [ebp - 0x104], eax
jmp 0x401132
mov eax, 0x20
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
cmp eax, 0xa71
jne 0x40115f
movzx eax, word [ebp - 0xa4]
cmp eax, 3
jne 0x40115f
mov eax, 0xd
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
cmp eax, 0x20b
jne 0x40117c
mov eax, 0x40
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 4]
push eax
call sub.msvcrt.dll_fclose
add esp, 4
mov eax, dword [ebp - 0x104]
leave
ret

Function at 0x40147d
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ecx, 0xffffffff
cmp ecx, eax
mov eax, 0
setne al
leave
ret
Function at 0x40b4d4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
nop
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0x184
push eax
mov eax, dword [0x4105c0]
push eax
call sub.user32.dll_SendMessageA
mov eax, 0xe
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
add eax, ecx
mov ecx, 0
push ecx
push eax
mov eax, dword [0x4104b0]
push eax
call sub.msvcrt.dll_fseek
add esp, 0xc
mov eax, dword [0x4104b0]
push eax
mov eax, 1
push eax
mov eax, 1
push eax
lea eax, [ebp - 9]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
movzx eax, byte [ebp - 9]
push eax
mov eax, 0x40e727
push eax
lea eax, [ebp - 0xd1]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0xc
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0x184
push eax
mov eax, dword [0x4105d4]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [0x4104b0]
push eax
mov eax, 1
push eax
mov eax, 1
push eax
lea eax, [ebp - 0xdc]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
mov eax, 1
mov dword [ebp - 0xe0], eax
movzx eax, byte [ebp - 9]
inc eax
mov ecx, dword [ebp - 0xe0]
cmp ecx, eax
jge 0x40b65e
jmp 0x40b5cf
mov eax, dword [ebp - 0xe0]
mov ecx, eax
inc eax
mov dword [ebp - 0xe0], eax
jmp 0x40b5a6
mov eax, dword [0x4104b0]
push eax
mov eax, 1
push eax
mov eax, 4
push eax
lea eax, [ebp - 0xe4]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
mov eax, dword [0x4104b0]
push eax
mov eax, 1
push eax
mov eax, 4
push eax
lea eax, [ebp - 0xe8]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
mov eax, dword [ebp - 0xe4]
push eax
mov eax, 0x40e72b
push eax
lea eax, [ebp - 0xd1]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0xc
mov eax, dword [ebp - 0xe4]
dec eax
shl eax, 4
mov ecx, str.RT_CURSOR
add ecx, eax
push ecx
mov eax, 0
push eax
mov eax, 0x180
push eax
mov eax, dword [0x4105c0]
push eax
call sub.user32.dll_SendMessageA
jmp 0x40b5be
leave
ret

Function at 0x40b660
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
nop
mov eax, 0x40e72f
push eax
mov eax, 0x40d040
push eax
call sub.msvcrt.dll_fopen
add esp, 8
mov dword [ebp - 4], eax
mov eax, 0
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.msvcrt.dll_fseek
add esp, 0xc
mov eax, 1
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
cmp eax, 6
jge 0x40b723
jmp 0x40b6c7
mov eax, dword [ebp - 0xd0]
mov ecx, eax
inc eax
mov dword [ebp - 0xd0], eax
jmp 0x40b6a2
mov eax, dword [ebp - 4]
push eax
mov eax, 1
push eax
mov eax, 4
push eax
lea eax, [ebp - 0xd4]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
mov eax, dword [ebp - 0xd4]
push eax
mov eax, 0x40e732
push eax
lea eax, [ebp - 0xcc]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0xc
lea eax, [ebp - 0xcc]
push eax
mov eax, 0
push eax
mov eax, 0x180
push eax
mov eax, dword [0x4105c0]
push eax
call sub.user32.dll_SendMessageA
jmp 0x40b6b6
mov eax, dword [ebp - 4]
push eax
call sub.msvcrt.dll_fclose
add esp, 4
leave
ret
Function at 0x40bf30
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
nop
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_GetStartupInfoA
mov eax, dword [ebp - 0x18]
and eax, 1
cmp eax, 0
je 0x40bf5e
movzx eax, word [ebp - 0x14]
mov dword [ebp - 0x50], eax
jmp 0x40bf66
mov eax, 0xa
mov dword [ebp - 0x50], eax
mov eax, 0
mov dword [ebp - 0x48], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x40bf95
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x4c]
push eax
call sub.msvcrt.dll_strstr
add esp, 8
mov dword [ebp - 0x48], eax
mov eax, 0
mov ecx, dword [ebp - 0x48]
cmp eax, ecx
jne 0x40bfbb
mov eax, 0x40e860
push eax
call sub.msvcrt.dll__strdup
add esp, 4
mov dword [ebp - 0x48], eax
jmp 0x40bfe4
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
cmp eax, ecx
jbe 0x40bfe4
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x40bfe4
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
mov dword [ebp - 0x48], eax
mov eax, 0x30000
push eax
mov eax, 0x10000
push eax
call sub.msvcrt.dll__controlfp
add esp, 8
mov eax, 0
push eax
call sub.kernel32.dll_GetModuleHandleA
mov ecx, dword [ebp - 0x50]
push ecx
mov ecx, dword [ebp - 0x48]
push ecx
mov ecx, 0
push ecx
push eax
call fcn.004024f4
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x55e11f]
shl eax, 2
mov dword [0x55e123], eax
push edi
push ecx
xor eax, eax
mov edi, 0x579334
mov ecx, 0x58d39c
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push 0
call fcn.0054ecff
pop ecx
push 0x55e0e8
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x55e127], eax
push 0
jmp fcn.0055b468

Function at 0x406e83
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
lea eax, [ebp + 0x18]
push eax
call fcn.00412c20
test eax, eax
jne 0x406ea4
xor eax, eax
jmp 0x406fdc
push 0x180
push dword [ebp + 8]
call sub.KERNEL32.dll_GetWindowsDirectoryA
test eax, eax
jne 0x406ebc
xor eax, eax
jmp 0x406fdc
push str.msagentchars_
push dword [ebp + 8]
call fcn.0054e1b0
add esp, 8
push 2
push dword [ebp + 8]
call fcn.0042cbc2
test eax, eax
jne 0x406ee1
xor eax, eax
jmp 0x406fdc
xor edi, edi
xor eax, eax
mov dword [ebp - 4], eax
mov byte [ebx], 0
push dword [ebp + 0x18]
call fcn.0051d2df
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x3e7
push 0
push 0
push 0
lea edx, [edi + 1]
push edx
push ebx
push str..acs
push dword [ebp + 8]
call fcn.0048508c
cmp byte [ebx], 0
je 0x406fc8
test eax, eax
jle 0x406fc8
inc edi
push 0x588ce3
push 0x588be3
push 0x588ae3
push 0x588ae0
push ebx
call fcn.0050e5fc
add esp, 0x14
push esi
push edi
mov esi, ebx
mov edi, 0x588be3
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x588ce3
push ebx
call fcn.0054e1b0
add esp, 8
test esi, esi
jle 0x406eeb
cmp dword [ebp + 0x10], 0
je 0x406fbf
cmp esi, 0x270f
jne 0x406fbf
push dword [ebp + 0x10]
push ebx
call fcn.0054e450
add esp, 8
test eax, eax
jne 0x406fc0
mov dword [ebp - 4], 1
xor esi, esi
jmp 0x406fc0
dec esi
test esi, esi
jg 0x406eeb
cmp esi, 0x270f
jne 0x406fda
cmp dword [ebp - 4], 0
jne 0x406fda
xor eax, eax
jmp 0x406fdc
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x14
Function at 0x40b76d
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0051fafa
mov ebx, eax
test ebx, ebx
je 0x40b958
push esi
call sub.USER32.dll_IsZoomed
test eax, eax
je 0x40b79b
mov dword [ebx + 0x724], 1
jmp 0x40b7a3
xor eax, eax
mov dword [ebx + 0x724], eax
push esi
call fcn.0051fe9d
test eax, eax
je 0x40b7b6
cmp dword [0x55f2c4], 0
jne 0x40b81e
push 7
push esi
call sub.USER32.dll_ShowWindow
push esi
call fcn.0051fe9d
test eax, eax
jne 0x40b7f1
cmp dword [0x56f060], 0
je 0x40b7f1
push 0x10
call sub.USER32.dll_GetKeyState
movsx edx, ax
and edx, 0x8000
cmp edx, 0x8000
je 0x40b7f1
push 0
push esi
call sub.USER32.dll_ShowWindow
cmp esi, dword [0x56f024]
jne 0x40b801
xor ecx, ecx
mov dword [0x56f024], ecx
push dword [ebx]
call fcn.00522388
call fcn.005224a9
push esi
call fcn.0051fafa
push eax
call fcn.004172e2
jmp 0x40b958
push esi
call fcn.00416d48
test eax, eax
jne 0x40b842
cmp dword [ebx + 0x6bc], 3
je 0x40b7b6
push 0
push 0
push 0x10
push esi
call sub.USER32.dll_PostMessageA
jmp 0x40b958
test byte [ebp + 0xc], 1
je 0x40b8e5
call fcn.00501da8
test eax, eax
jne 0x40b8e5
call fcn.0040b95e
push 5
push dword [0x56f01c]
call sub.USER32.dll_GetWindow
mov ebx, eax
cmp esi, ebx
jne 0x40b8e5
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x40b897
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
jne 0x40b897
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x40b87f
test ebx, ebx
je 0x40b8c1
cmp esi, ebx
je 0x40b8c1
push 5
push ebx
call sub.USER32.dll_ShowWindow
push ebx
call sub.USER32.dll_UpdateWindow
push ebx
call sub.USER32.dll_BringWindowToTop
push ebx
call fcn.0051fafa
push eax
call fcn.004172e2
jmp 0x40b8e5
push esi
call fcn.0041275f
mov ebx, eax
push ebx
call fcn.0051fe9d
test eax, eax
je 0x40b8e5
push ebx
call sub.USER32.dll_SetFocus
push ebx
call fcn.0051fafa
push eax
call fcn.004172e2
push 0
push esi
call sub.USER32.dll_ShowWindow
push dword [0x56f01c]
call sub.USER32.dll_UpdateWindow
push esi
call sub.USER32.dll_UpdateWindow
push 0
push 0
push 0xb
push dword [0x56f01c]
call sub.USER32.dll_SendMessageA
push 7
push esi
call sub.USER32.dll_ShowWindow
push 0
push esi
call sub.USER32.dll_ShowWindow
push 0
push 1
push 0xb
push dword [0x56f01c]
call sub.USER32.dll_SendMessageA
push dword [0x56f01c]
call sub.USER32.dll_UpdateWindow
push esi
call sub.USER32.dll_UpdateWindow
push esi
call fcn.00522388
call fcn.0040b95e
call fcn.005224a9
push 0
call fcn.004172e2
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40b95e
Capabilities:
Hide graphical window

Disassembly:
push ebx
cmp dword [0x55f2c4], 0
je 0x40b9b1
mov ebx, dword [0x56f010]
test ebx, ebx
je 0x40b9b1
push dword [ebx]
call fcn.0051fe9d
test eax, eax
je 0x40b9a7
push dword [ebx]
call sub.USER32.dll_IsIconic
test eax, eax
je 0x40b9a7
push dword [ebx]
call fcn.00416d48
test eax, eax
je 0x40b9a7
push dword [ebx]
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x40b9a7
push 0
push dword [ebx]
call sub.USER32.dll_ShowWindow
mov ebx, dword [ebx + 0xd3c]
test ebx, ebx
jne 0x40b972
pop ebx
ret
Function at 0x40ec9f
Capabilities:
Get file version info

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, 0x579f7a
xor eax, eax
mov dword [esp + 4], eax
xor edx, edx
mov dword [esp + 8], edx
mov edi, 1
push 0x581f80
push str._slang.dll
push ebp
call sub.USER32.dll_wsprintfA
add esp, 0xc
push ebp
call sub.KERNEL32.dll_LoadLibraryA
mov ebx, eax
mov dword [0x55eff4], ebx
test ebx, ebx
je 0x40ed6d
push esp
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x40ed6d
push esi
call fcn.00559d70
pop ecx
mov ebx, eax
test ebx, ebx
je 0x40ed6d
push ebx
push esi
push dword [esp + 8]
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
push str.StringFileInfo040904E4FILEVERSION
push ebp
call sub.USER32.dll_wsprintfA
add esp, 8
lea eax, [esp + 8]
push eax
lea edx, [esp + 8]
push edx
push ebp
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40ed50
cmp dword [esp + 8], 0
je 0x40ed50
cmp dword [esp + 4], 0
je 0x40ed50
push dword [esp + 4]
push 0x579f71
call sub.KERNEL32.dll_lstrcmpA
test eax, eax
jne 0x40ed50
xor edi, edi
push ebx
call fcn.00559c5c
pop ecx
test edi, edi
je 0x40ed6d
push dword [0x55eff4]
call sub.KERNEL32.dll_FreeLibrary
xor eax, eax
mov dword [0x55eff4], eax
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40f398
Capabilities:
Log keystrokes via application hook
Set global application hook

Disassembly:
push ebx
push esi
push edi
mov esi, 0x55f25c
push 0
push 0x3e8
push 0x78
push dword [0x56f018]
call sub.USER32.dll_SetTimer
push dword [esi]
call fcn.0041261f
test eax, eax
je 0x40f421
mov eax, dword [esi]
cmp byte [eax + 0x4b0], 0
je 0x40f421
mov edx, dword [esi]
cmp dword [edx + 0x514], 0
jne 0x40f421
mov ecx, dword [esi]
add ecx, 0x4b0
push ecx
call sub.WSOCK32.dll_inet_addr
mov ebx, eax
mov edi, dword [esi]
mov dword [edi + 0x514], ebx
cmp ebx, 0xffffffff
jne 0x40f40c
push 0x64
add edi, 0x4b0
push edi
call fcn.0042e6b1
mov eax, dword [esi]
xor edx, edx
mov dword [eax + 0x514], edx
jmp 0x40f421
mov ecx, dword [esi]
push dword [ecx + 0x514]
call sub.WSOCK32.dll_htonl
mov edx, dword [esi]
mov dword [edx + 0x514], eax
call fcn.004c6628
call fcn.0042d118
call fcn.00468f44
call fcn.004f6634
mov ebx, dword [0x55eff4]
test ebx, ebx
je 0x40f44c
push 0x46
push ebx
call sub.USER32.dll_LoadAcceleratorsA
mov dword [0x55efd0], eax
cmp dword [0x55efd0], 0
jne 0x40f467
push 0x46
push dword [0x56f014]
call sub.USER32.dll_LoadAcceleratorsA
mov dword [0x55efd0], eax
mov ebx, dword [0x55eff4]
test ebx, ebx
je 0x40f47e
push 0x47
push ebx
call sub.USER32.dll_LoadAcceleratorsA
mov dword [0x55efd4], eax
cmp dword [0x55efd4], 0
jne 0x40f499
push 0x47
push dword [0x56f014]
call sub.USER32.dll_LoadAcceleratorsA
mov dword [0x55efd4], eax
push 0
push dword [0x56f018]
call sub.USER32.dll_GetWindowThreadProcessId
push eax
push dword [0x56f014]
push 0x492851
push 2
call sub.USER32.dll_SetWindowsHookExA
mov dword [0x566720], eax
push 0
push dword [0x56f018]
call sub.USER32.dll_GetWindowThreadProcessId
push eax
push dword [0x56f014]
push 0x493a97
push 3
call sub.USER32.dll_SetWindowsHookExA
mov dword [0x566730], eax
push str.MSWHEEL_ROLLMSG
call sub.USER32.dll_RegisterWindowMessageA
mov dword [0x55f004], eax
push str.TaskbarCreated
call sub.USER32.dll_RegisterWindowMessageA
mov dword [0x55f008], eax
call fcn.005017db
cmp dword [0x55efcc], 0
jne 0x40f59c
xor eax, eax
mov dword [0x55e4b4], eax
push 0
push 0
push 0x8047
push dword [0x56f018]
call sub.USER32.dll_PostMessageA
cmp dword [0x56687c], 0
je 0x40f54b
push 0
push 0
push 0x8029
push dword [0x56f018]
call sub.USER32.dll_PostMessageA
cmp dword [0x565d50], 0
je 0x40f568
push 0
push 0
push 0x802d
push dword [0x56f018]
call sub.USER32.dll_PostMessageA
cmp dword [0x56ba8c], 0
je 0x40f585
push 0
push 0
push 0x8033
push dword [0x56f018]
call sub.USER32.dll_PostMessageA
call fcn.0041db38
push 0x7f00
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
pop edi
pop esi
pop ebx
ret
Function at 0x414f0a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe60
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x414f24
cmp byte [ebx], 0
jne 0x414f28
xor eax, eax
jmp 0x414fa7
push 1
push ebx
call fcn.0042cbc2
test eax, eax
jne 0x414f38
xor eax, eax
jmp 0x414fa7
test esi, esi
jne 0x414f51
push ebx
call sub.KERNEL32.dll_DeleteFileA
test eax, eax
je 0x414f4d
mov eax, 1
jmp 0x414fa7
xor eax, eax
jmp 0x414fa7
push ebx
push 0x180
lea edx, [ebp - 0x1a0]
push edx
call fcn.0042e5e3
push 0x1e
push 0
lea ecx, [ebp - 0x20]
push ecx
call fcn.0054e10c
add esp, 0xc
mov dword [ebp - 0x1c], 3
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x18], eax
mov word [ebp - 0x10], 0x40
dec esi
jne 0x414f91
or word [ebp - 0x10], 0x14
lea edx, [ebp - 0x20]
push edx
call sub.SHELL32.dll_SHFileOperationA
test eax, eax
jne 0x414fa5
mov eax, 1
jmp 0x414fa7
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41598f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
push esp
call sub.USER32.dll_GetCursorPos
push esp
push dword [0x55f2f0]
call sub.USER32.dll_ScreenToClient
xor esi, esi
push 1
call sub.USER32.dll_GetKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0x8000
jne 0x4159cf
cmp dword [0x55f428], 0
jne 0x4159cf
xor eax, eax
jmp 0x415a85
mov ebx, dword [0x56f010]
test ebx, ebx
je 0x415a2c
cmp dword [ebx + 0x9d0], 0
je 0x415a22
push ebx
call fcn.00416aef
test eax, eax
je 0x415a22
push esi
lea esi, [ebx + 0x9dc]
lea edi, [esp + 0xc]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop esi
inc dword [esp + 0x10]
add dword [esp + 0x14], 2
push dword [esp + 4]
push dword [esp + 4]
lea edx, [esp + 0x10]
push edx
call sub.USER32.dll_PtInRect
test eax, eax
je 0x415a22
mov esi, ebx
jmp 0x415a2c
mov ebx, dword [ebx + 0xd3c]
test ebx, ebx
jne 0x4159d9
cmp esi, dword [0x55f428]
je 0x415a83
mov dword [0x55f428], esi
cmp dword [0x55f428], 0
je 0x415a62
cmp dword [0x55f41c], 0
jne 0x415a62
push 0
push 0x32
push 0x7d
push dword [0x55f2f0]
call sub.USER32.dll_SetTimer
mov dword [0x55f41c], eax
inc dword [0x55ef5c]
push 0
push 0
push 0x8042
push dword [0x56f018]
call sub.USER32.dll_PostMessageA
mov eax, 1
jmp 0x415a85
xor eax, eax
add esp, 0x18
pop edi
pop esi
pop ebx
ret

Function at 0x415c45
Capabilities:
Hide graphical window

Disassembly:
push ebx
call fcn.00415bd5
test eax, eax
jne 0x415c53
xor eax, eax
pop ebx
ret
push 0
push dword [0x56f014]
push 0x80b5
push dword [0x56f018]
push 0
push 0
push 0
push 0
push 0x42000000
push 0x55f478
push str.mIRC_SwitchBar
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
mov dword [0x55f2f0], ebx
test ebx, ebx
jne 0x415c94
xor eax, eax
pop ebx
ret
mov dword [0x55f304], ebx
push 0x581e7c
push 0x180
push 0x57ab57
push 0x55f493
push 0x55f488
push 0x55f47c
call fcn.004ac8c9
cmp byte [0x57ab57], 0
je 0x415ce1
push 0x57ab57
call fcn.0042cd58
push 0
push 0x57ab57
push 0x55f304
call fcn.0042fd74
cmp dword [0x55f2c4], 0
je 0x415cf9
push 5
push dword [0x55f2f0]
call sub.USER32.dll_ShowWindow
jmp 0x415d06
push 0
push dword [0x55f2f0]
call sub.USER32.dll_ShowWindow
mov eax, dword [0x55f2f0]
pop ebx
ret
Function at 0x4183a5
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, 0x55f520
mov ebx, 0x25
xor edx, edx
mov eax, 0x57b344
cmp ebx, edx
jle 0x418447
mov dword [eax], edx
lea ecx, [edx + 0xc9]
mov dword [eax + 4], ecx
mov byte [eax + 8], 4
mov byte [eax + 9], 0
mov ecx, edx
cmp ecx, 0x22
ja case.0x4183e2.0
mov cl, byte [ecx + 0x4183e9]
jmp dword [ecx*4 + 0x41840c]
mov byte [eax + 8], 8
jmp case.0x4183e2.0
cmp dword [0x55f2c4], 0
je case.0x4183e2.0
mov byte [eax + 8], 8
jmp case.0x4183e2.0
mov dword [eax], 0xffffffff
mov byte [eax + 9], 1
inc edx
add eax, 0xc
cmp ebx, edx
jg 0x4183c2
call fcn.00418256
test eax, eax
jne 0x418457
xor eax, eax
jmp 0x418514
push 0
push dword [0x56f014]
push 0xc8
push dword [0x56f018]
push 0
push 0
push 0
push 0
push 0x42000000
push 0x55f7d0
push str.mIRC_Toolbar
push 0
call sub.USER32.dll_CreateWindowExA
mov esi, eax
mov dword [ebp], esi
test esi, esi
jne 0x418495
xor eax, eax
jmp 0x418514
mov dword [0x55f558], esi
mov dword [0x55f670], esi
movzx edx, word [0x56f014]
or edx, 0x1b0000
push edx
mov edi, ebx
push edi
push 0x413
push esi
call sub.USER32.dll_SendMessageA
push 0x57b344
push edi
push 0x414
push dword [ebp]
call sub.USER32.dll_SendMessageA
call fcn.0041a18d
call fcn.0041a1bb
call fcn.0041a211
call fcn.0041a243
push 0
call fcn.0041a292
push 0
call fcn.0041a2db
cmp dword [0x55f518], 0
je 0x418507
push 5
push dword [ebp]
call sub.USER32.dll_ShowWindow
jmp 0x418511
push 0
push dword [ebp]
call sub.USER32.dll_ShowWindow
mov eax, dword [ebp]
pop ebp
pop edi
pop esi
pop ebx
ret