joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53c780
Capabilities:
Hide graphical window

Disassembly:
call fcn.0053c710
test eax, eax
je 0x53c7c5
mov eax, dword [0x5f92e8]
mov ecx, dword [0x5f92ec]
push 0
push eax
push 0x80b5
push ecx
push 0
push 0
push 0
push 0
push 0x42000000
push 0x5a4bec
push str.mIRC_SwitchBar
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [0x5f6bf8], eax
jne 0x53c7c8
xor eax, eax
ret
push 0x5ee150
push 0x180
push 0x5f7648
push 0x5a4bec
mov edx, str.switchbar
mov ecx, 0x5a55e8
mov dword [0x5f6c08], eax
call fcn.004bcce0
mov al, byte [0x5f7648]
test al, al
je 0x53c814
mov ecx, 0x5f7648
call fcn.0041f3a0
push 0
mov edx, 0x5f7648
mov ecx, 0x5f6c08
call fcn.00423fd0
mov eax, dword [0x5bfdbc]
test eax, eax
je 0x53c832
mov edx, dword [0x5f6bf8]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5f6bf8]
ret
mov eax, dword [0x5f6bf8]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5f6bf8]
ret
Function at 0x53cf40
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x3ec
push esi
call fcn.00561000
mov esi, eax
test esi, esi
je 0x53cf61
mov ecx, dword [esi + 0xbe8]
call fcn.004f0af0
test eax, eax
jne 0x53cf70
xor ecx, ecx
call fcn.0041f0a0
pop esi
add esp, 0x3ec
ret
push ebx
push ebp
push edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebx, eax
cmp ebx, dword [esi + 0x884]
je 0x53cf8f
cmp ebx, dword [esi + 0x888]
jne 0x53d178
mov edx, dword [esi + 0x8b4]
push 0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call fcn.0047e0e0
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x53cfbf
mov ecx, dword [esi + 0xbe8]
mov eax, dword [ecx + 0x21c8]
test eax, eax
je 0x53d139
mov edx, dword [esi + 0xbe8]
mov ecx, dword [edx + 0x21bc]
mov eax, ecx
test eax, eax
je 0x53d139
mov ebp, 1
lea ebx, [ebx]
cmp dword [eax + 0x1c], ebp
je 0x53d080
mov eax, dword [eax + 0x40]
test eax, eax
jne 0x53cfe0
mov edi, dword [ecx + 0x44]
test edi, edi
je 0x53d139
mov edx, 0x3e7
lea ecx, [esp + 0x14]
mov dword [edi + 0x1c], ebp
call fcn.00420e60
mov eax, dword [edi]
push eax
lea ecx, [esp + 0x18]
push str._msg__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esi]
add esp, 0xc
push 0
push 0
lea edx, [esp + 0x1c]
call fcn.0053ce40
mov ecx, esi
mov edi, eax
call fcn.005612a0
test eax, eax
je 0x53d17f
test edi, edi
je 0x53d069
lea edx, [esp + 0x14]
push edx
push 0
push 0xc
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x7d000
push 0x7d000
mov edx, ebp
mov ecx, ebx
call fcn.0047e370
mov eax, dword [esi + 0xbe8]
pop edi
mov dword [eax + 0x21c8], ebp
pop ebp
pop ebx
pop esi
add esp, 0x3ec
ret
mov edi, dword [eax + 0x44]
mov dword [eax + 0x1c], 0
mov eax, dword [esi + 0xbe8]
mov ecx, dword [eax + 0x21bc]
cmp edi, dword [ecx + 0x44]
jne 0x53cff3
mov ecx, dword [esi + 0x71c]
mov eax, 2
cmp ecx, eax
jne 0x53d0cd
cmp dword [esi + 0x720], eax
jne 0x53d0cd
mov edx, dword [str._msg]
mov ax, word [0x5ad2ac]
mov dword [esp + 0x14], edx
mov word [esp + 0x18], ax
jmp 0x53d0db
mov edx, 0x3e7
lea ecx, [esp + 0x14]
call fcn.00420e60
mov ecx, dword [esi]
push 0
push 0
lea edx, [esp + 0x1c]
call fcn.0053ce40
mov ecx, esi
mov edi, eax
call fcn.005612a0
test eax, eax
je 0x53d17f
test edi, edi
je 0x53d122
lea ecx, [esp + 0x14]
push ecx
push 0
push 0xc
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x7d000
push 0x7d000
mov edx, ebp
mov ecx, ebx
call fcn.0047e370
mov edx, dword [esi + 0xbe8]
pop edi
mov dword [edx + 0x21c8], ebp
pop ebp
pop ebx
pop esi
add esp, 0x3ec
ret
mov edx, 0x3e7
lea ecx, [esp + 0x14]
call fcn.00420e60
lea ecx, [esp + 0x14]
push ecx
push 0x3e6
push 0xd
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esi]
push 0
push 0
lea edx, [esp + 0x1c]
call fcn.0053ce40
test eax, eax
je 0x53d17f
mov ecx, esi
call fcn.005612a0
test eax, eax
je 0x53d17f
xor ecx, ecx
call fcn.0041f0a0
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x3ec
ret
Function at 0x53d230
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x3f4
push esi
call fcn.00561000
mov esi, eax
test esi, esi
jne 0x53d24c
xor eax, eax
pop esi
add esp, 0x3f4
ret
mov ecx, dword [esi + 0xbe8]
call fcn.004f0af0
test eax, eax
je 0x53d242
push edi
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, eax
cmp edi, dword [esi + 0x884]
je 0x53d27f
cmp edi, dword [esi + 0x888]
je 0x53d27f
pop edi
xor eax, eax
pop esi
add esp, 0x3f4
ret
mov edx, dword [esi + 0x8b4]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
call fcn.0047e430
mov eax, dword [esp + 0xc]
test eax, eax
mov dword [esp + 0x10], eax
jge 0x53d2b2
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
push 0
lea edx, [esp + 0xc]
push edx
mov edx, dword [esi + 0x8b4]
mov ecx, edi
call fcn.0047e0e0
mov eax, dword [esp + 8]
test eax, eax
jle 0x53d274
mov edx, 0x3e7
lea ecx, [esp + 0x14]
call fcn.00420e60
lea eax, [esp + 0x14]
push eax
push 0x3e6
push 0xd
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
mov dword [esp + 8], eax
jle 0x53d274
push 5
lea ecx, [esp + 0x18]
push str._msg
push ecx
mov byte [esp + eax + 0x20], 0
call fcn.005a2a05
add esp, 0xc
test eax, eax
jne 0x53d326
pop edi
mov eax, 1
pop esi
add esp, 0x3f4
ret
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 8]
jg 0x53d274
dec eax
jns 0x53d339
xor eax, eax
mov cl, byte [esp + eax + 0x14]
xor edx, edx
cmp cl, 0x20
setne dl
pop edi
pop esi
mov eax, edx
add esp, 0x3f4
ret
Function at 0x543730
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0xc
cmp edx, 0x20
push ebx
push esi
push edi
mov esi, ecx
jne 0x543826
mov eax, dword [0x5f811c]
test eax, eax
jne 0x543847
push 2
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x543845
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x543845
mov cl, byte [esi + 0xe]
mov ebx, dword [esi + 4]
mov eax, 1
shl eax, cl
push ebp
mov ebp, dword [esi + 8]
push 0
lea ecx, [esi + eax*4 + 0x28]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_GetDC]
test eax, eax
mov dword [esp + 0x20], eax
je 0x543818
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x54380b
mov edx, dword [esp + 0x20]
push ebp
push ebx
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test eax, eax
mov dword [esp + 0x10], eax
je 0x543804
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
push eax
push ebp
push ebx
push 0
push 0
push ebp
push ebx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_StretchDIBits]
mov ecx, dword [esp + 0x18]
push ecx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [esp + 0x20]
push edx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
mov edi, dword [esp + 0x1c]
mov esi, dword [edi + 0x1c]
xor eax, eax
test esi, esi
jle 0x543845
lea ecx, [edi + 0x24]
cmp dword [ecx], edx
je 0x543850
inc eax
add ecx, 0x4a8
cmp eax, esi
jl 0x543836
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
imul eax, eax, 0x4a8
mov eax, dword [eax + edi + 0x1b4]
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x5451d0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [0x5f7ff4]
sub esp, 0x10
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ecx
push 0x419
push eax
call esi
cmp eax, 0xffffffff
je 0x545228
mov edx, dword [0x5f7ff4]
lea ecx, [esp + 4]
push ecx
push eax
push 0x41d
push edx
call esi
test eax, eax
je 0x545228
mov ecx, dword [0x5f7ff4]
push 1
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [0x5f7ff4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
pop esi
add esp, 0x10
ret
Function at 0x548b70
Capabilities:
Hide graphical window

Disassembly:
call fcn.00548af0
test eax, eax
je 0x548bd4
mov eax, dword [0x5f92e8]
mov ecx, dword [0x5f92ec]
push 0
push eax
push 0
push ecx
push 0
push 0
push 0
push 0
push 0x42000000
push 0x5a4bec
push str.mIRC_Toolbar
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [0x5f7ff4], eax
je 0x548bd4
xor ecx, ecx
call fcn.00545e00
test eax, eax
jne 0x548bd7
mov edx, dword [0x5f7ff4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x5f7ff4], 0
xor eax, eax
ret
mov eax, dword [0x5bfdfc]
test eax, eax
je 0x548bf4
mov eax, dword [0x5f7ff4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5f7ff4]
ret
mov ecx, dword [0x5f7ff4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5f7ff4]
ret
Function at 0x549a20
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call fcn.005261b0
test eax, eax
je 0x549afc
mov eax, dword [esi + 0x3a4]
push ebx
xor edx, edx
test eax, eax
push edi
je 0x549abc
mov ecx, 0x15be
call fcn.0041f1a0
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push eax
mov eax, dword [esi]
push 0
push 0xc
push 0x79
push eax
call edi
mov eax, dword [esi + 0x344]
test eax, eax
je 0x549a8c
mov ecx, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x78
push ecx
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov edx, dword [esi]
push 0
push 0x77
push edx
call edi
push eax
call ebx
pop edi
pop ebx
pop esi
ret
xor edx, edx
mov ecx, 0x15bf
call fcn.0041f1a0
push eax
mov eax, dword [esi]
push 0
push 0xc
push 0x77
push eax
call edi
mov ecx, dword [esi]
push 5
push 0x77
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop ebx
pop esi
ret
mov ecx, 0x15bd
call fcn.0041f1a0
mov edx, dword [esi]
push eax
push 0
push 0xc
push 0x79
push edx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x78
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi]
push 0
push 0x77
push ecx
call edi
push eax
call ebx
pop edi
pop ebx
pop esi
ret

Function at 0x549b00
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call fcn.00491bd0
test eax, eax
je 0x549bce
mov eax, dword [esi + 0x488]
push ebx
xor edx, edx
test eax, eax
push edi
je 0x549b8e
mov ecx, 0x15be
call fcn.0041f1a0
push eax
mov eax, dword [esi]
push 0
push 0xc
push 0x79
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov ecx, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push 0x78
push ecx
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov edx, dword [esi]
push 5
push 0x77
push edx
call edi
push eax
call ebx
mov eax, dword [esi + 0x448]
test eax, eax
je 0x549b7a
mov eax, dword [esi]
push 1
push 0x77
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop ebx
pop esi
ret
mov ecx, dword [esi]
push 0
push 0x77
push ecx
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop ebx
pop esi
ret
mov ecx, 0x15bd
call fcn.0041f1a0
mov edx, dword [esi]
push eax
push 0
push 0xc
push 0x79
push edx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x78
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi]
push 0
push 0x77
push ecx
call edi
push eax
call ebx
pop edi
pop ebx
pop esi
ret
Function at 0x54da60
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
mov eax, dword [0x5f92ec]
push esi
push edi
push 0x80
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov dword [0x5f8b70], 0
call edi
xor esi, esi
mov si, ax
push 0x11
and esi, 0x8000
sub esi, 0x8000
neg esi
sbb esi, esi
inc esi
call edi
test ah, ah
jns 0x54dadb
mov eax, dword [0x5ee6e8]
test eax, eax
je 0x54dabd
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov eax, 1
pop esi
ret
mov ecx, dword [0x5f92ec]
push 1
push 0
push 0x8043
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x54db7f
mov eax, dword [0x5f8a50]
test eax, eax
jne 0x54dafa
mov eax, dword [0x5f8a4c]
test eax, eax
je 0x54daf6
test esi, esi
je 0x54dafa
pop edi
xor eax, eax
pop esi
ret
test esi, esi
je 0x54daf1
mov ecx, 1
call fcn.0054d610
test eax, eax
je 0x54daf1
mov eax, dword [0x5f8a4c]
test eax, eax
push 6
je 0x54db4d
test esi, esi
je 0x54db2c
mov edx, dword [0x5f92ec]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, 1
pop esi
ret
mov eax, dword [0x5f92ec]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
mov ecx, dword [0x5f92ec]
push 0
push ecx
call esi
pop edi
mov eax, 1
pop esi
ret
test esi, esi
je 0x54db72
mov edx, dword [0x5f92ec]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push edx
call esi
mov eax, dword [0x5f92ec]
push 0
push eax
call esi
pop edi
mov eax, 1
pop esi
ret
mov ecx, dword [0x5f92ec]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, 1
pop esi
ret

Function at 0x54db90
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
mov eax, dword [0x5f8a50]
test eax, eax
je 0x54dbb1
mov eax, dword [0x5f8a48]
test eax, eax
mov ecx, 5
jne 0x54dbac
mov ecx, 1
call fcn.0054d610
mov eax, dword [0x5f8a4c]
test eax, eax
je 0x54dc20
mov eax, dword [0x5f92ec]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x54dc02
mov ecx, dword [0x5f92ec]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x54dc02
mov eax, dword [0x5f8a48]
test eax, eax
je 0x54dc76
mov eax, dword [0x5f8a50]
test eax, eax
jne 0x54dbfb
mov ecx, 2
call fcn.0054d610
xor ecx, ecx
jmp fcn.0054d980
mov ecx, 1
call fcn.0054d610
test eax, eax
je 0x54dc68
mov edx, dword [0x5f92ec]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
ret
mov eax, dword [0x5f8a48]
test eax, eax
je 0x54dc76
mov ecx, dword [0x5f92ec]
push ecx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x54dc5e
mov edx, dword [0x5f92ec]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x54dc5e
mov eax, dword [0x5f8a50]
test eax, eax
jne 0x54dc76
mov ecx, 2
jmp fcn.0054d610
mov ecx, 2
call fcn.0054d610
mov eax, dword [0x5f92ec]
push 7
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x54dd30
Capabilities:
Find taskbar

Disassembly:
mov eax, dword [0x5c2330]
sub esp, 0x10
test eax, eax
jne 0x54de9f
mov eax, dword [0x5ee6e8]
test eax, eax
je 0x54dd54
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
add esp, 0x10
ret
mov eax, dword [0x5f8b7c]
test eax, eax
jne 0x54de9f
movzx eax, cl
sub eax, 3
mov dword [0x5f8b7c], 1
je 0x54dd8f
sub eax, 2
jne 0x54de95
call fcn.0054cd60
mov dword [0x5f8b7c], 0
add esp, 0x10
ret
mov eax, dword [0x5f8b70]
test eax, eax
jne 0x54de95
push ebx
push ebp
push esi
push edi
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x54de64
push 2
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
je 0x54de3d
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
mov ebp, dword [sym.imp.USER32.dll_WindowFromPoint]
cmp esi, dword [0x5f92ec]
je 0x54de45
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x54de2e
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x54de2e
lea eax, [esp + 0x10]
push eax
push esi
call ebx
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
sub eax, edi
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x1c]
sar ecx, 1
add ecx, edi
mov edi, dword [esp + 0x14]
sub eax, edi
cdq
sub eax, edx
sar eax, 1
add eax, edi
push eax
push ecx
call ebp
cmp eax, esi
je 0x54de3d
push eax
push esi
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
jne 0x54de3d
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x54ddd0
cmp esi, dword [0x5f92ec]
jne 0x54de64
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x54de64
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x54de64
call fcn.0054da60
test eax, eax
jne 0x54de91
mov eax, dword [0x5ee6e0]
test eax, eax
je 0x54de87
mov ecx, dword [0x5f92ec]
push 0
push 0
push 0x8043
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x54de91
mov ecx, 1
call fcn.0054d980
pop edi
pop esi
pop ebp
pop ebx
mov dword [0x5f8b7c], 0
add esp, 0x10
ret
Function at 0x552f60
Capabilities:
Enumerate network shares

Disassembly:
sub esp, 0x1c
movzx eax, byte [edx]
push eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
call fcn.00592262
add esp, 4
cmp al, 0x41
mov byte [esp + 3], al
jb 0x5530d3
cmp al, 0x5a
ja 0x5530d3
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 1
push 1
call sub.MPR.dll_WNetOpenEnumA
test eax, eax
jne 0x5530d3
push ebx
push ebp
mov ebx, 0x640
push ebx
mov dword [esp + 0x1c], eax
call fcn.00591118
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x5530bf
push esi
push edi
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
push ebp
lea eax, [esp + 0x1c]
push eax
push ecx
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], ebx
call sub.MPR.dll_WNetEnumResourceA
cmp eax, 0xea
jne 0x553009
mov eax, dword [esp + 0x18]
push eax
push ebp
mov ebx, eax
call fcn.00593194
add esp, 8
test eax, eax
je 0x5530b0
mov ebp, eax
jmp 0x552fc5
test eax, eax
jne 0x5530b0
mov eax, dword [esp + 0x14]
xor esi, esi
test eax, eax
jle 0x552fc5
lea edi, [ebp + 0x10]
mov edi, edi
mov eax, dword [edi]
test eax, eax
je 0x55303b
movzx edx, byte [eax]
push edx
call fcn.00592262
movzx ecx, byte [esp + 0x17]
add esp, 4
cmp ecx, eax
je 0x55304c
mov eax, dword [esp + 0x14]
inc esi
add edi, 0x20
cmp esi, eax
jl 0x553020
jmp 0x552fc5
mov edi, dword [esp + 0x24]
shl esi, 5
mov esi, dword [esi + ebp + 0x14]
mov ecx, edi
lea esp, [esp]
mov al, byte [esi]
inc esi
mov byte [ecx], al
inc ecx
test al, al
jne 0x553060
mov eax, dword [esp + 0x28]
cmp byte [eax + 1], 0x3a
jne 0x5530a8
mov cl, byte [eax + 2]
add eax, 2
cmp cl, 0x5c
jne 0x5530a8
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x553081
sub eax, edx
dec edi
jmp 0x553090
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x553090
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x20], 1
test ebp, ebp
pop edi
pop esi
je 0x5530bf
push ebp
call fcn.0059112a
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call sub.MPR.dll_WNetCloseEnum
mov eax, dword [esp + 0x18]
pop ebp
pop ebx
add esp, 0x1c
ret
xor eax, eax
add esp, 0x1c
ret

Function at 0x5530e0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebx
push edi
lea eax, [esp + 8]
push eax
push 0x2001f
push 0
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x553112
pop edi
mov eax, 0x3f3
pop ebx
add esp, 0x10c
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea esp, [esp]
mov edx, dword [esp + 0xc]
push 0x105
lea ecx, [esp + 0x14]
push ecx
push 0
push edx
call esi
test eax, eax
jne 0x553148
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
call fcn.005530e0
test eax, eax
je 0x553120
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop esi
pop edi
pop ebx
add esp, 0x10c
ret
Function at 0x553170
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
push edi
lea eax, [esp + 0xc]
push eax
mov edi, ecx
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x20006
push 0
push 0x5a5eb4
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallmIRC
push reloc.WSOCK32.dll_bind
mov esi, edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x5531af
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5531b4
sub eax, edx
mov edx, dword [esp + 8]
inc eax
push eax
push esi
push 1
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
add esp, 8
ret
Function at 0x553750
Capabilities:
Get common file path

Disassembly:
sub esp, 0x660
push esi
lea eax, [esp + 0xc]
push eax
push 0
push 0
mov esi, ecx
mov dword [esp + 0x10], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x5538ee
mov eax, dword [esp + 0xc]
test eax, eax
je 0x5538ee
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jl 0x5538ee
lea ecx, [esp + 0x10]
call fcn.00422770
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5537a8
sub eax, edx
push esi
lea edx, [esp + eax + 0x14]
push str._s.lnk
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x5adfd8
push 1
push 0
push 0x5adfe8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x5538ee
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push 0x5ae098
push eax
call dword [ecx]
test eax, eax
jge 0x55380f
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop esi
add esp, 0x660
ret
push 0x104
lea edx, [esp + 0x460]
push edx
push 0xffffffffffffffff
lea eax, [esp + 0x1c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push 0
lea edx, [esp + 0x460]
push edx
push eax
call dword [ecx + 0x14]
test eax, eax
jge 0x553861
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 4]
mov edx, dword [eax]
push eax
call dword [edx + 8]
pop esi
add esp, 0x660
ret
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push 0
lea edx, [esp + 0x320]
push edx
push 0x104
lea edx, [esp + 0x224]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push eax
jl 0x55384c
call dword [ecx + 8]
mov eax, dword [esp + 4]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov edx, 0x104
lea ecx, [esp + 0x114]
call fcn.00420e60
mov ecx, dword [0x5f92e8]
push 0x180
lea eax, [esp + 0x118]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x218]
push edx
lea eax, [esp + 0x118]
push eax
call fcn.005a299c
add esp, 8
test eax, eax
jne 0x5538ee
lea ecx, [esp + 0x10]
push ecx
call fcn.00593f0c
add esp, 4
pop esi
add esp, 0x660
ret
Function at 0x553900
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path

Disassembly:
sub esp, 0x474
mov eax, dword [0x5f92e8]
push esi
push 0xa
push 0x30
push eax
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x553a26
mov ecx, dword [0x5f92e8]
push ebx
push ebp
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [0x5f92e8]
push esi
push edx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x553a24
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x553a24
push edi
mov edx, 0x3e7
lea ecx, [esp + 0x9c]
call fcn.00420e60
lea eax, [esp + 0x9c]
push eax
push 0x180
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x9c]
dec edi
jmp 0x553990
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x553990
mov ecx, dword [str.miunst_.exe]
mov edx, dword [0x5ad79c]
mov eax, dword [0x5ad7a0]
mov dword [edi], ecx
push 0x1001
mov dword [edi + 4], edx
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0xa4]
push edx
mov dword [edi + 8], eax
mov byte [esp + 0x20], 0x88
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov esi, eax
cmp esi, 0xffffffff
pop edi
je 0x553a24
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lwrite]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
lea eax, [esp + 0x98]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5539f0
mov ecx, dword [esp + 0xc]
push ecx
sub eax, edx
lea edx, [esp + eax + 0x9c]
push 0x5a5918
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea eax, [esp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop ebp
pop ebx
pop esi
add esp, 0x474
ret