joyce8/EMBER2024-capa huggingface dataset:
Function at 0x669db4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
rol bl, 0
mov edx, dword [esp]
call fcn.00669d8e
mov ah, 0x16
test bl, ah
push ds
cdq
pop es
scasb al, byte es:[edi]
mov ecx, 0x648dfb98
and al, 2
push dword [esp + 4]
ret 8
lea esp, [esp + 1]
jmp 0x669d67
lea esp, [esp + 1]
pop ax
neg eax
jle 0x669d63
jg 0x669d88
lea eax, [ecx*4]
xchg dx, ax
mov al, 0x8c
push ebp
mov dx, si
jmp 0x669e06
mov dl, ah
mov dx, 0x4f0e
setle dl
jmp 0x669e3a
mov edx, esp
lea eax, reloc.mscoree.dll__CorExeMain
mov edx, 0xec9f481d
jmp 0x669e85
lea esp, [esp + 4]
inc bl
rdtsc
mov ax, word [esp]
inc edx
jmp 0x669e63
mov edx, 0xec9f481d
jmp 0x669e85
jae 0x669e24
mov edx, esp
lea eax, reloc.mscoree.dll__CorExeMain
jmp 0x669e49
jmp 0x669ec1
neg bl
mov dx, 0xc5e8
mov dx, 0x6d35
inc eax
jb 0x669e6f
rcr al, 4
rdtsc
lea edx, [edi*4]
xchg dx, ax
jmp 0x669f2e
mov dx, 0xa9ff
jmp 0x66a08b

Function at 0x67529f
Capabilities:
Encode data using xor

Disassembly:
pop di
pop edi
jmp 0x65bbb6
lea edi, reloc.mscoree.dll__CorExeMain
mov edi, 0x52d38b66
pop ebx
push edx
push word [esp + 1]
pop edi
jmp 0x675204
pop ebx
jmp 0x67521e

Function at 0x68f824
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, edi
pushfd
jmp 0x68f8bc
lea esp, [esp + 4]
jmp 0x68f866
lea esp, [esp + 3]
mov dword [esp + 0x1c], ecx
popal
mov edx, dword [esp]
sub esp, 3
xchg byte [esp], dh
jmp 0x68f850
lea edx, [eax + esi]
lea esp, [esp + 3]
jmp 0x68f974
popal
rdtsc
rdtsc
pushal
sub esp, 3
jmp 0x68f82a
inc dword [esi + 4]
jmp 0x65aa08
and eax, 0x3f
cmp edx, ecx
jae 0x65aa08
jmp 0x68f899
shr ecx, 0x1d
lea esp, [esp + 4]
add dword [esi + 4], ecx
cmc
call fcn.0068f907
rcr dword [eax - 0x32], cl
test eax, 0xb53feb58
and eax, 0x2f0cbf4c
cmpsb byte [esi], byte es:[edi]
xor al, 0x53
scasb al, byte es:[edi]
pop ds
push edi
mov esi, 0xf9148d89
lea edx, [ecx + edi*8]
sub esp, 9
lea esp, [esp + 1]
lea esp, [esp + 8]
jmp 0x68f8af
shr eax, 3
bswap edx
mov dh, cl
mov edx, 0xc43aa05
lea edx, [ebx*4]
jmp 0x68f8e1

Function at 0x708cd2
Capabilities:
Check for peb beingdebugged flag
Parse pe header

Disassembly:
call fcn.00708132
mov eax, dword [eax + 8]
push eax
jmp 0x70812d
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x708ae0
push sp
lea esp, [esp + 2]
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
mov eax, dword fs:[0x30]
jmp 0x708b0e
lea esp, [esp]
lea esp, [esp]
mov dword [esp], edi
mov byte [esp + 1], ch
push dword [esp + 1]
mov dword [esp + 0x28], esi
jmp 0x708b80
jmp 0x708c94
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x55c11f]
shl eax, 2
mov dword [0x55c123], eax
push edi
push ecx
xor eax, eax
mov edi, 0x5771e4
mov ecx, 0x58b538
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push 0
call fcn.0054cd43
pop ecx
push 0x55c0e8
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x55c127], eax
push 0
jmp fcn.005594ac

Function at 0x406e83
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
lea eax, [ebp + 0x18]
push eax
call fcn.00412d74
test eax, eax
jne 0x406ea4
xor eax, eax
jmp 0x406fd4
push 0x180
push dword [ebp + 8]
call sub.KERNEL32.dll_GetWindowsDirectoryA
test eax, eax
jne 0x406ebc
xor eax, eax
jmp 0x406fd4
push str.msagentchars_
push dword [ebp + 8]
call fcn.0054c1f4
add esp, 8
push 2
push dword [ebp + 8]
call fcn.0042c9b5
test eax, eax
jne 0x406ee1
xor eax, eax
jmp 0x406fd4
xor edi, edi
xor eax, eax
mov dword [ebp - 4], eax
mov byte [ebx], 0
push dword [ebp + 0x18]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x3e7
push 0
push 0
push 0
lea edx, [edi + 1]
push edx
push ebx
push str..acs
push dword [ebp + 8]
call fcn.0048569c
cmp byte [ebx], 0
je 0x406fc0
test eax, eax
jle 0x406fc0
inc edi
push 0x586e7f
push 0x586d7f
push 0x586c7f
push 0x586c7c
push ebx
call fcn.0050ca44
add esp, 0x14
push esi
push edi
mov esi, ebx
mov edi, 0x586d7f
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x586e7f
push ebx
call fcn.0054c1f4
add esp, 8
test esi, esi
jle 0x406eeb
cmp dword [ebp + 0x10], 0
je 0x406fb7
cmp esi, 0x270f
jne 0x406fb7
push dword [ebp + 0x10]
push ebx
call fcn.0054c494
add esp, 8
test eax, eax
jne 0x406fb8
mov dword [ebp - 4], 1
xor esi, esi
jmp 0x406fb8
dec esi
test esi, esi
jg 0x406eeb
cmp esi, 0x270f
jne 0x406fd2
cmp dword [ebp - 4], 0
jne 0x406fd2
xor eax, eax
jmp 0x406fd4
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x14
Function at 0x40b765
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0051dd0a
mov ebx, eax
test ebx, ebx
je 0x40b950
push esi
call sub.USER32.dll_IsZoomed
test eax, eax
je 0x40b793
mov dword [ebx + 0x724], 1
jmp 0x40b79b
xor eax, eax
mov dword [ebx + 0x724], eax
push esi
call fcn.0051e0ad
test eax, eax
je 0x40b7ae
cmp dword [0x55d2cc], 0
jne 0x40b816
push 7
push esi
call sub.USER32.dll_ShowWindow
push esi
call fcn.0051e0ad
test eax, eax
jne 0x40b7e9
cmp dword [0x56cf30], 0
je 0x40b7e9
push 0x10
call sub.USER32.dll_GetKeyState
movsx edx, ax
and edx, 0x8000
cmp edx, 0x8000
je 0x40b7e9
push 0
push esi
call sub.USER32.dll_ShowWindow
cmp esi, dword [0x56cef4]
jne 0x40b7f9
xor ecx, ecx
mov dword [0x56cef4], ecx
push dword [ebx]
call fcn.00520583
call fcn.005206a4
push esi
call fcn.0051dd0a
push eax
call fcn.00417312
jmp 0x40b950
push esi
call fcn.00416d78
test eax, eax
jne 0x40b83a
cmp dword [ebx + 0x6bc], 3
je 0x40b7ae
push 0
push 0
push 0x10
push esi
call sub.USER32.dll_PostMessageA
jmp 0x40b950
test byte [ebp + 0xc], 1
je 0x40b8dd
call fcn.0050025c
test eax, eax
jne 0x40b8dd
call fcn.0040b956
push 5
push dword [0x56ceec]
call sub.USER32.dll_GetWindow
mov ebx, eax
cmp esi, ebx
jne 0x40b8dd
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x40b88f
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
jne 0x40b88f
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x40b877
test ebx, ebx
je 0x40b8b9
cmp esi, ebx
je 0x40b8b9
push 5
push ebx
call sub.USER32.dll_ShowWindow
push ebx
call sub.USER32.dll_UpdateWindow
push ebx
call sub.USER32.dll_BringWindowToTop
push ebx
call fcn.0051dd0a
push eax
call fcn.00417312
jmp 0x40b8dd
push esi
call fcn.004128b3
mov ebx, eax
push ebx
call fcn.0051e0ad
test eax, eax
je 0x40b8dd
push ebx
call sub.USER32.dll_SetFocus
push ebx
call fcn.0051dd0a
push eax
call fcn.00417312
push 0
push esi
call sub.USER32.dll_ShowWindow
push dword [0x56ceec]
call sub.USER32.dll_UpdateWindow
push esi
call sub.USER32.dll_UpdateWindow
push 0
push 0
push 0xb
push dword [0x56ceec]
call sub.USER32.dll_SendMessageA
push 7
push esi
call sub.USER32.dll_ShowWindow
push 0
push esi
call sub.USER32.dll_ShowWindow
push 0
push 1
push 0xb
push dword [0x56ceec]
call sub.USER32.dll_SendMessageA
push dword [0x56ceec]
call sub.USER32.dll_UpdateWindow
push esi
call sub.USER32.dll_UpdateWindow
push esi
call fcn.00520583
call fcn.0040b956
call fcn.005206a4
push 0
call fcn.00417312
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40b956
Capabilities:
Hide graphical window

Disassembly:
push ebx
cmp dword [0x55d2cc], 0
je 0x40b9a9
mov ebx, dword [0x56cee0]
test ebx, ebx
je 0x40b9a9
push dword [ebx]
call fcn.0051e0ad
test eax, eax
je 0x40b99f
push dword [ebx]
call sub.USER32.dll_IsIconic
test eax, eax
je 0x40b99f
push dword [ebx]
call fcn.00416d78
test eax, eax
je 0x40b99f
push dword [ebx]
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x40b99f
push 0
push dword [ebx]
call sub.USER32.dll_ShowWindow
mov ebx, dword [ebx + 0xd18]
test ebx, ebx
jne 0x40b96a
pop ebx
ret
Function at 0x40ee2b
Capabilities:
Get file version info

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, 0x577e2a
xor eax, eax
mov dword [esp + 4], eax
xor edx, edx
mov dword [esp + 8], edx
mov edi, 1
push 0x57fd38
push str._slang.dll
push ebp
call sub.USER32.dll_wsprintfA
add esp, 0xc
push ebp
call sub.KERNEL32.dll_LoadLibraryA
mov ebx, eax
mov dword [0x55cffc], ebx
test ebx, ebx
je 0x40eef9
push esp
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x40eef9
push esi
call fcn.00557db4
pop ecx
mov ebx, eax
test ebx, ebx
je 0x40eef9
push ebx
push esi
push dword [esp + 8]
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
push str.StringFileInfo040904E4FILEVERSION
push ebp
call sub.USER32.dll_wsprintfA
add esp, 8
lea eax, [esp + 8]
push eax
lea edx, [esp + 8]
push edx
push ebp
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40eedc
cmp dword [esp + 8], 0
je 0x40eedc
cmp dword [esp + 4], 0
je 0x40eedc
push dword [esp + 4]
push 0x577e21
call sub.KERNEL32.dll_lstrcmpA
test eax, eax
jne 0x40eedc
xor edi, edi
push ebx
call fcn.00557ca0
pop ecx
test edi, edi
je 0x40eef9
push dword [0x55cffc]
call sub.KERNEL32.dll_FreeLibrary
xor eax, eax
mov dword [0x55cffc], eax
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40f524
Capabilities:
Log keystrokes via application hook
Set global application hook

Disassembly:
push ebx
push esi
push edi
mov esi, 0x55d264
push 0
push 0x3e8
push 0x78
push dword [0x56cee8]
call sub.USER32.dll_SetTimer
push dword [esi]
call fcn.00412773
test eax, eax
je 0x40f5ad
mov eax, dword [esi]
cmp byte [eax + 0x4ac], 0
je 0x40f5ad
mov edx, dword [esi]
cmp dword [edx + 0x510], 0
jne 0x40f5ad
mov ecx, dword [esi]
add ecx, 0x4ac
push ecx
call sub.WSOCK32.dll_inet_addr
mov ebx, eax
mov edi, dword [esi]
mov dword [edi + 0x510], ebx
cmp ebx, 0xffffffff
jne 0x40f598
push 0x64
add edi, 0x4ac
push edi
call fcn.0042e3f0
mov eax, dword [esi]
xor edx, edx
mov dword [eax + 0x510], edx
jmp 0x40f5ad
mov ecx, dword [esi]
push dword [ecx + 0x510]
call sub.WSOCK32.dll_htonl
mov edx, dword [esi]
mov dword [edx + 0x510], eax
call fcn.004c667f
call fcn.0042cf0e
call fcn.00469870
call fcn.004f4e0c
mov ebx, dword [0x55cffc]
test ebx, ebx
je 0x40f5d8
push 0x46
push ebx
call sub.USER32.dll_LoadAcceleratorsA
mov dword [0x55cfd8], eax
cmp dword [0x55cfd8], 0
jne 0x40f5f3
push 0x46
push dword [0x56cee4]
call sub.USER32.dll_LoadAcceleratorsA
mov dword [0x55cfd8], eax
mov ebx, dword [0x55cffc]
test ebx, ebx
je 0x40f60a
push 0x47
push ebx
call sub.USER32.dll_LoadAcceleratorsA
mov dword [0x55cfdc], eax
cmp dword [0x55cfdc], 0
jne 0x40f625
push 0x47
push dword [0x56cee4]
call sub.USER32.dll_LoadAcceleratorsA
mov dword [0x55cfdc], eax
push 0
push dword [0x56cee8]
call sub.USER32.dll_GetWindowThreadProcessId
push eax
push dword [0x56cee4]
push 0x492ce1
push 2
call sub.USER32.dll_SetWindowsHookExA
mov dword [0x5646a0], eax
push 0
push dword [0x56cee8]
call sub.USER32.dll_GetWindowThreadProcessId
push eax
push dword [0x56cee4]
push 0x493f31
push 3
call sub.USER32.dll_SetWindowsHookExA
mov dword [0x5646b0], eax
push str.MSWHEEL_ROLLMSG
call sub.USER32.dll_RegisterWindowMessageA
mov dword [0x55d00c], eax
push str.TaskbarCreated
call sub.USER32.dll_RegisterWindowMessageA
mov dword [0x55d010], eax
call fcn.004ffc97
cmp dword [0x55cfd4], 0
jne 0x40f728
xor eax, eax
mov dword [0x55c4b4], eax
push 0
push 0
push 0x8047
push dword [0x56cee8]
call sub.USER32.dll_PostMessageA
cmp dword [0x5647f4], 0
je 0x40f6d7
push 0
push 0
push 0x8029
push dword [0x56cee8]
call sub.USER32.dll_PostMessageA
cmp dword [0x563cf4], 0
je 0x40f6f4
push 0
push 0
push 0x802d
push dword [0x56cee8]
call sub.USER32.dll_PostMessageA
cmp dword [0x56997c], 0
je 0x40f711
push 0
push 0
push 0x8033
push dword [0x56cee8]
call sub.USER32.dll_PostMessageA
call fcn.0041db38
push 0x7f00
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
pop edi
pop esi
pop ebx
ret
Function at 0x414f47
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe60
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x414f61
cmp byte [ebx], 0
jne 0x414f65
xor eax, eax
jmp 0x414fe4
push 1
push ebx
call fcn.0042c9b5
test eax, eax
jne 0x414f75
xor eax, eax
jmp 0x414fe4
test esi, esi
jne 0x414f8e
push ebx
call sub.KERNEL32.dll_DeleteFileA
test eax, eax
je 0x414f8a
mov eax, 1
jmp 0x414fe4
xor eax, eax
jmp 0x414fe4
push ebx
push 0x180
lea edx, [ebp - 0x1a0]
push edx
call fcn.0042e322
push 0x1e
push 0
lea ecx, [ebp - 0x20]
push ecx
call fcn.0054c150
add esp, 0xc
mov dword [ebp - 0x1c], 3
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x18], eax
mov word [ebp - 0x10], 0x40
dec esi
jne 0x414fce
or word [ebp - 0x10], 0x14
lea edx, [ebp - 0x20]
push edx
call sub.SHELL32.dll_SHFileOperationA
test eax, eax
jne 0x414fe2
mov eax, 1
jmp 0x414fe4
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4159cb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
push esp
call sub.USER32.dll_GetCursorPos
push esp
push dword [0x55d2f8]
call sub.USER32.dll_ScreenToClient
xor esi, esi
push 1
call sub.USER32.dll_GetKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0x8000
jne 0x415a0b
cmp dword [0x55d430], 0
jne 0x415a0b
xor eax, eax
jmp 0x415ac1
mov ebx, dword [0x56cee0]
test ebx, ebx
je 0x415a68
cmp dword [ebx + 0x9d0], 0
je 0x415a5e
push ebx
call fcn.00416b1f
test eax, eax
je 0x415a5e
push esi
lea esi, [ebx + 0x9dc]
lea edi, [esp + 0xc]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop esi
inc dword [esp + 0x10]
add dword [esp + 0x14], 2
push dword [esp + 4]
push dword [esp + 4]
lea edx, [esp + 0x10]
push edx
call sub.USER32.dll_PtInRect
test eax, eax
je 0x415a5e
mov esi, ebx
jmp 0x415a68
mov ebx, dword [ebx + 0xd18]
test ebx, ebx
jne 0x415a15
cmp esi, dword [0x55d430]
je 0x415abf
mov dword [0x55d430], esi
cmp dword [0x55d430], 0
je 0x415a9e
cmp dword [0x55d424], 0
jne 0x415a9e
push 0
push 0x32
push 0x7d
push dword [0x55d2f8]
call sub.USER32.dll_SetTimer
mov dword [0x55d424], eax
inc dword [0x55cf60]
push 0
push 0
push 0x8042
push dword [0x56cee8]
call sub.USER32.dll_PostMessageA
mov eax, 1
jmp 0x415ac1
xor eax, eax
add esp, 0x18
pop edi
pop esi
pop ebx
ret

Function at 0x415c81
Capabilities:
Hide graphical window

Disassembly:
push ebx
call fcn.00415c11
test eax, eax
jne 0x415c8f
xor eax, eax
pop ebx
ret
push 0
push dword [0x56cee4]
push 0x80b5
push dword [0x56cee8]
push 0
push 0
push 0
push 0
push 0x42000000
push 0x55d480
push str.mIRC_SwitchBar
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
mov dword [0x55d2f8], ebx
test ebx, ebx
jne 0x415cd0
xor eax, eax
pop ebx
ret
mov dword [0x55d30c], ebx
push 0x57fc34
push 0x180
push 0x578a07
push 0x55d49b
push 0x55d490
push 0x55d484
call fcn.004acae5
cmp byte [0x578a07], 0
je 0x415d1d
push 0x578a07
call fcn.0042cb4e
push 0
push 0x578a07
push 0x55d30c
call fcn.0042fcb0
cmp dword [0x55d2cc], 0
je 0x415d35
push 5
push dword [0x55d2f8]
call sub.USER32.dll_ShowWindow
jmp 0x415d42
push 0
push dword [0x55d2f8]
call sub.USER32.dll_ShowWindow
mov eax, dword [0x55d2f8]
pop ebx
ret
Function at 0x4183d5
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, 0x55d528
mov ebx, 0x25
xor edx, edx
mov eax, 0x5791f4
cmp ebx, edx
jle 0x418477
mov dword [eax], edx
lea ecx, [edx + 0xc9]
mov dword [eax + 4], ecx
mov byte [eax + 8], 4
mov byte [eax + 9], 0
mov ecx, edx
cmp ecx, 0x22
ja case.0x418412.0
mov cl, byte [ecx + 0x418419]
jmp dword [ecx*4 + 0x41843c]
mov byte [eax + 8], 8
jmp case.0x418412.0
cmp dword [0x55d2cc], 0
je case.0x418412.0
mov byte [eax + 8], 8
jmp case.0x418412.0
mov dword [eax], 0xffffffff
mov byte [eax + 9], 1
inc edx
add eax, 0xc
cmp ebx, edx
jg 0x4183f2
call fcn.00418286
test eax, eax
jne 0x418487
xor eax, eax
jmp 0x418544
push 0
push dword [0x56cee4]
push 0xc8
push dword [0x56cee8]
push 0
push 0
push 0
push 0
push 0x42000000
push 0x55d7d8
push str.mIRC_Toolbar
push 0
call sub.USER32.dll_CreateWindowExA
mov esi, eax
mov dword [ebp], esi
test esi, esi
jne 0x4184c5
xor eax, eax
jmp 0x418544
mov dword [0x55d560], esi
mov dword [0x55d678], esi
movzx edx, word [0x56cee4]
or edx, 0x1b0000
push edx
mov edi, ebx
push edi
push 0x413
push esi
call sub.USER32.dll_SendMessageA
push 0x5791f4
push edi
push 0x414
push dword [ebp]
call sub.USER32.dll_SendMessageA
call fcn.0041a15b
call fcn.0041a193
call fcn.0041a1f3
call fcn.0041a22f
push 0
call fcn.0041a27e
push 0
call fcn.0041a2d1
cmp dword [0x55d520], 0
je 0x418537
push 5
push dword [ebp]
call sub.USER32.dll_ShowWindow
jmp 0x418541
push 0
push dword [ebp]
call sub.USER32.dll_ShowWindow
mov eax, dword [ebp]
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41863d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp eax, 0x1b
jne 0x418662
mov edx, dword [0x55d67c]
test edx, edx
je 0x418662
mov eax, edx
jmp 0x418739
push 2
movzx ecx, ax
push ecx
push ebx
call sub.KERNEL32.dll_FindResourceA
test eax, eax
jne 0x418679
xor eax, eax
jmp 0x418739
push eax
push ebx
call sub.KERNEL32.dll_LoadResource
push eax
call sub.KERNEL32.dll_LockResource
mov ebx, eax
test ebx, ebx
jne 0x418693
xor eax, eax
jmp 0x418739
lea edx, [ebx + 0x28]
mov dword [ebp - 0x18], edx
mov cx, word [ebx + 0xe]
mov eax, 1
shl eax, cl
shl eax, 2
add dword [ebp - 0x18], eax
mov edx, dword [ebx + 4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebx + 8]
mov dword [ebp - 0x14], eax
xor edi, edi
push 0
call sub.USER32.dll_GetDC
mov esi, eax
test esi, esi
je 0x418737
push esi
call sub.GDI32.dll_CreateCompatibleDC
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41872f
push dword [ebp - 0x14]
push dword [ebp - 0xc]
push esi
call sub.GDI32.dll_CreateCompatibleBitmap
mov edi, eax
test edi, edi
je 0x418727
push edi
push dword [ebp - 8]
call sub.GDI32.dll_SelectObject
mov dword [ebp - 4], eax
push 0xcc0020
push 0
push ebx
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push 0
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push 0
push 0
push dword [ebp - 8]
call sub.GDI32.dll_StretchDIBits
push dword [ebp - 4]
push dword [ebp - 8]
call sub.GDI32.dll_SelectObject
push dword [ebp - 8]
call sub.GDI32.dll_DeleteDC
push esi
push 0
call sub.USER32.dll_ReleaseDC
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41aafc
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp dword [0x55d850], 0
jne 0x41abea
mov dword [0x55d850], 1
xor eax, eax
mov al, byte [ebp + 8]
cmp eax, 6
ja case.0x41ab25.0
jmp dword [eax*4 + 0x41ab2c]
cmp dword [0x55d84c], 0
jne case.0x41ab25.0
push 0
push str.Shell_TrayWnd
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x41abb6
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x41ab91
cmp ebx, dword [0x56cee8]
je 0x41ab91
push ebx
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x41ab67
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x41ab67
cmp ebx, dword [0x56cee8]
jne 0x41abb6
push ebx
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x41abb6
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x41abb6
call fcn.0041abef
test eax, eax
jne case.0x41ab25.0
cmp dword [0x5685ec], 0
je 0x41abd5
push 0
push 0
push 0x8043
push dword [0x56cee8]
call sub.USER32.dll_PostMessageA
jmp case.0x41ab25.0
push 1
call fcn.0041aa4c
jmp case.0x41ab25.0
call fcn.0041a60c
xor eax, eax
mov dword [0x55d850], eax
pop ebx
pop ebp
ret 4

Function at 0x41abef
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebx
push 0x10
call sub.USER32.dll_GetKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0x8000
jne 0x41ac0d
mov ebx, 1
jmp 0x41ac0f
xor ebx, ebx
push 0x11
call sub.USER32.dll_GetKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0x8000
jne 0x41ac49
mov eax, dword [0x5685e0]
test eax, eax
je 0x41ac35
mov dword [0x5685ec], eax
jmp 0x41ac49
push 1
push 0
push 0x8043
push dword [0x56cee8]
call sub.USER32.dll_PostMessageA
cmp dword [0x55d834], 0
jne 0x41ac6b
cmp dword [0x55d830], 0
je 0x41ac63
test ebx, ebx
je 0x41ac6b
xor eax, eax
pop ebx
ret
test ebx, ebx
jne 0x41ac6b
xor eax, eax
pop ebx
ret
push 1
call fcn.0041b199
test eax, eax
jne 0x41ac7a
xor eax, eax
pop ebx
ret
cmp dword [0x55d830], 0
je 0x41acb2
test ebx, ebx
je 0x41ac96
push 6
push dword [0x56cee8]
call sub.USER32.dll_ShowWindow
jmp 0x41acdf
push 6
push dword [0x56cee8]
call sub.USER32.dll_ShowWindow
push 0
push dword [0x56cee8]
call sub.USER32.dll_ShowWindow
jmp 0x41acdf
test ebx, ebx
je 0x41acd2
push 6
push dword [0x56cee8]
call sub.USER32.dll_ShowWindow
push 0
push dword [0x56cee8]
call sub.USER32.dll_ShowWindow
jmp 0x41acdf
push 6
push dword [0x56cee8]
call sub.USER32.dll_ShowWindow
mov eax, 1
pop ebx
ret
Function at 0x41b578
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, 0x105
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push esi
push ebx
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
je 0x41b5ac
mov eax, 0x3f3
jmp 0x41b5e4
push edi
lea edx, [ebp - 0x10c]
push edx
push 0
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegEnumKeyA
test eax, eax
jne 0x41b5d1
lea ecx, [ebp - 0x10c]
push ecx
push dword [ebp - 4]
call fcn.0041b578
test eax, eax
je 0x41b5ac
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
push esi
push ebx
call sub.ADVAPI32.dll_RegDeleteKeyA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41b5ed
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
push edx
push 0
push 0x20006
push 0
push 0x55d8de
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallmIRC
push 0x80000002
call sub.ADVAPI32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
je 0x41b629
xor eax, eax
jmp 0x41b659
push esi
call fcn.0054c2d0
pop ecx
inc eax
push eax
push esi
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegSetValueExA
mov ebx, eax
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
je 0x41b654
xor eax, eax
jmp 0x41b659
mov eax, 1
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8