joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44dfec
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x570570
mov ebx, dword [esi + 0xfd4]
test ebx, ebx
je 0x44e0f3
mov eax, dword [ebx + 0x10]
cmp eax, dword [esi + 0xfdc]
je 0x44e0e8
push dword [ebx + 0xc]
call sub.USER32.dll_GetDlgCtrlID
mov dword [edi], eax
push dword [edi]
push esi
call fcn.0044da4e
test eax, eax
jne 0x44e03c
push dword [edi]
push esi
call fcn.0044cd1b
test eax, eax
je 0x44e07e
lea edx, [ebp - 0x10]
push edx
push dword [ebx + 0xc]
call sub.USER32.dll_GetWindowRect
sub dword [ebp - 0x10], 2
sub dword [ebp - 0xc], 2
add dword [ebp - 8], 2
add dword [ebp - 4], 2
push 2
lea ecx, [ebp - 0x10]
push ecx
push dword [esi + 0xc8]
push 0
call sub.USER32.dll_MapWindowPoints
push 1
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0xc8]
call sub.USER32.dll_InvalidateRect
jmp 0x44e088
push 0
push dword [ebx + 0xc]
call sub.USER32.dll_ShowWindow
push 0
push 0
push 0xc1
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
test eax, eax
jg 0x44e0e8
push 0x58a108
push 0x3e7
push 0xd
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
push 0x26
push 0x58a108
call fcn.00539518
add esp, 8
mov dword [0x57056c], eax
cmp dword [0x57056c], 0
je 0x44e0e8
mov edx, dword [0x57056c]
mov byte [edx], 1
push 0x58a108
push 0
push 0xc
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
mov ebx, dword [ebx + 0x34]
test ebx, ebx
jne 0x44e00b
push dword [esi + 0xc8]
call sub.USER32.dll_UpdateWindow
mov ebx, dword [esi + 0xfd4]
test ebx, ebx
je 0x44e1b8
mov eax, dword [ebx + 0x10]
cmp eax, dword [esi + 0xfdc]
jne 0x44e1ad
push dword [ebx + 0xc]
call sub.USER32.dll_GetDlgCtrlID
mov dword [edi], eax
cmp dword [ebx + 0x1c], 0
je 0x44e14d
push dword [edi]
push esi
call fcn.0044da4e
test eax, eax
jne 0x44e14d
push dword [edi]
push esi
call fcn.0044cd1b
test eax, eax
jne 0x44e14d
push 4
push dword [ebx + 0xc]
call sub.USER32.dll_ShowWindow
push 0
push 0
push 0xc1
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
test eax, eax
jg 0x44e1ad
push 0x58a108
push 0x3e7
push 0xd
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
push 1
push 0x58a108
call fcn.00539518
add esp, 8
mov dword [0x57056c], eax
cmp dword [0x57056c], 0
je 0x44e1ad
mov edx, dword [0x57056c]
mov byte [edx], 0x26
push 0x58a108
push 0
push 0xc
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
mov ebx, dword [ebx + 0x34]
test ebx, ebx
jne 0x44e10c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x458988
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
mov ebx, 0x54f990
mov esi, 0x569b9c
push str.mirc.ini
push 0x3e7
push esi
lea eax, [ebx + 0x13]
push eax
lea edx, [ebx + 5]
push edx
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x4589cf
lea ecx, [ebx + 0x17]
push ecx
push esi
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x4589cf
mov dword [0x54f8a8], 1
jmp 0x4589d6
xor eax, eax
mov dword [0x54f8a8], eax
push str.mirc.ini
push 0x3c
push 0x54f858
lea edx, [ebx + 0x2d]
push edx
lea ecx, [ebx + 0x20]
push ecx
lea eax, [ebx + 0x1b]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
push str.mirc.ini
push 0x3e7
push esi
lea edx, [ebx + 0x43]
push edx
lea ecx, [ebx + 0x38]
push ecx
lea eax, [ebx + 0x33]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x458a31
lea edx, [ebx + 0x48]
push edx
push esi
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x458a31
mov dword [0x54f8ac], 1
jmp 0x458a39
xor ecx, ecx
mov dword [0x54f8ac], ecx
mov eax, sym.mirc32.exe_DDECallback
mov dword [0x54f854], eax
push 0
push 0x1c4020
push eax
push 0x54f850
call sub.USER32.dll_DdeInitializeA
test eax, eax
jne 0x458a6f
cmp dword [0x54f8a8], 0
je 0x458a67
call fcn.00458a84
mov eax, 1
pop esi
pop ebx
ret
xor edx, edx
mov dword [0x54f850], edx
xor ecx, ecx
mov dword [0x54f854], ecx
xor eax, eax
pop esi
pop ebx
ret
Function at 0x45db20
Capabilities:
Create process on windows

Disassembly:
push esi
push edi
cmp dword [0x54fcdc], 0
jne 0x45dcd3
push 0
call fcn.0050cddb
cmp byte [0x5714c7], 0
je 0x45db56
push 0x45dcd6
push 0x249
push dword [0x55b3c8]
call fcn.0045a0bc
jmp 0x45db78
cmp byte [0x571463], 0
je 0x45db76
push 0x45dcd6
push 0x24a
push dword [0x55b3c8]
call fcn.0045a0bc
jmp 0x45db78
xor eax, eax
cmp eax, 1
jne 0x45dbf9
cmp byte [0x571463], 0
je 0x45dba7
movzx edx, word [0x57152c]
push edx
push 0x571463
push str._server__s__u
push 0x57c4a0
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x45dbb5
mov esi, str._server
mov edi, 0x57c4a0
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
push 0
push 0
push 0
push 0x57c4a0
push dword [0x55b3d8]
call fcn.0049bc6c
mov esi, 0x56fa50
mov edi, 0x5714c7
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x45dccb
cmp eax, 2
jne 0x45dc3f
cmp byte [0x5714c7], 0
je 0x45dccb
push 0x5714c7
push 0x54fe55
push 0x57c4a0
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push 0
push 0
push 0
push 0x57c4a0
push dword [0x55b3d8]
call fcn.0049bc6c
jmp 0x45dccb
cmp eax, 3
jne 0x45dccb
push 0x104
push 0x57c4a0
push dword [0x55b3c4]
call sub.KERNEL32.dll_GetModuleFileNameA
cmp byte [0x571463], 0
je 0x45dc92
movzx eax, word [0x57152c]
push eax
push 0x571463
push str.__s_s:_u
push 0x57c4a0
call fcn.005395b8
pop ecx
add eax, 0x57c4a0
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
cmp byte [0x5714c7], 0
je 0x45dcbf
push 0x5714c7
push str.__j_s
push 0x57c4a0
call fcn.005395b8
pop ecx
add eax, 0x57c4a0
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 5
push 0x57c4a0
call sub.KERNEL32.dll_WinExec
xor edx, edx
mov dword [0x54fcdc], edx
pop edi
pop esi
ret
Function at 0x465b6e
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x550024
mov esi, 0x569f83
mov edi, str.mirc.ini
mov ebp, 0x550020
push edi
push 0x3e7
push esi
lea eax, [ebx + 0x12]
push eax
lea edx, [ebx + 0xb]
push edx
lea ecx, [ebx + 4]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x465bbd
push 0
push 0
push esi
call fcn.0041cb6c
push eax
push dword [ebp]
call fcn.004b0c4c
test eax, eax
je 0x465bbd
mov dword [ebp], eax
push edi
push 0x3e7
push esi
lea eax, [ebx + 0x25]
push eax
lea edx, [ebx + 0x1d]
push edx
lea ecx, [ebx + 0x16]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x465bf4
push 1
push 0
push esi
call fcn.0041cb6c
push eax
push dword [ebp]
call fcn.004b0c4c
test eax, eax
je 0x465bf4
mov dword [ebp], eax
push edi
push 0x3e7
push esi
lea eax, [ebx + 0x38]
push eax
lea edx, [ebx + 0x30]
push edx
lea ecx, [ebx + 0x29]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x465c2b
push 2
push 0
push esi
call fcn.0041cb6c
push eax
push dword [ebp]
call fcn.004b0c4c
test eax, eax
je 0x465c2b
mov dword [ebp], eax
push edi
push 0x3e7
push esi
lea eax, [ebx + 0x4f]
push eax
lea edx, [ebx + 0x43]
push edx
lea ecx, [ebx + 0x3c]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x465c62
push 3
push 0
push esi
call fcn.0041cb6c
push eax
push dword [ebp]
call fcn.004b0c4c
test eax, eax
je 0x465c62
mov dword [ebp], eax
push edi
push 0x3e7
push esi
lea eax, [ebx + 0x60]
push eax
lea edx, [ebx + 0x5a]
push edx
lea ecx, [ebx + 0x53]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x465c99
push 4
push 0
push esi
call fcn.0041cb6c
push eax
push dword [ebp]
call fcn.004b0c4c
test eax, eax
je 0x465c99
mov dword [ebp], eax
push edi
push 0x3e7
push esi
lea eax, [ebx + 0x76]
push eax
lea edx, [ebx + 0x6b]
push edx
lea ecx, [ebx + 0x64]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x465cd0
push 5
push 0
push esi
call fcn.0041cb6c
push eax
push dword [ebp]
call fcn.004b0c4c
test eax, eax
je 0x465cd0
mov dword [ebp], eax
push edi
push 0x3e7
push esi
lea eax, [ebx + 0x88]
push eax
lea edx, [ebx + 0x81]
push edx
lea ecx, [ebx + 0x7a]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x465d0d
push 6
push 0
push esi
call fcn.0041cb6c
push eax
push dword [ebp]
call fcn.004b0c4c
test eax, eax
je 0x465d0d
mov dword [ebp], eax
push edi
push 0x3e7
push esi
lea eax, [ebx + 0x9c]
push eax
lea edx, [ebx + 0x93]
push edx
lea ecx, [ebx + 0x8c]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x465d4d
push 7
push 0
push esi
call fcn.0041cb6c
push eax
push dword [ebp]
call fcn.004b0c4c
test eax, eax
je 0x465d4d
mov dword [ebp], eax
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46f899
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test ebx, ebx
je 0x46f8ae
cmp byte [ebx], 0
jne 0x46f8b8
mov eax, 1
jmp 0x46f938
push 0
push 0
push 0x56c5a4
call fcn.00539438
add esp, 0xc
push esi
mov esi, 0x56c5a4
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
cmp dword [0x54affc], 0
je 0x46f90b
cmp dword [esi + 0x53c], 0
je 0x46f90b
push 0x56c5a4
call fcn.0040c5d0
push 0x56c5a4
call fcn.005395b8
pop ecx
mov ebx, eax
push 0
push ebx
push 0x56c5a4
push dword [esi + 0x878]
call sub.WSOCK32.dll_send
cmp ebx, eax
je 0x46f933
xor eax, eax
jmp 0x46f938
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x474935
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov eax, dword [ebp + 8]
cmp eax, dword [0x551544]
je 0x47494e
xor eax, eax
jmp 0x474a4c
mov edx, dword [ebp + 0xc]
shr edx, 0x10
test dx, 0xffff
je 0x474974
push 0
push 0x9c7
call fcn.0041c35b
push eax
call fcn.004744e8
xor eax, eax
jmp 0x474a4c
xor edx, edx
mov dword [0x551544], edx
push 0
push 2
push 0
mov cx, word [0x54f356]
push ecx
mov ax, word [0x54f354]
push eax
call fcn.004e3612
mov ebx, eax
mov dword [0x551540], ebx
cmp ebx, 0xffffffff
jne 0x4749bc
push 0
push 0x9c8
call fcn.0041c35b
push eax
call fcn.004744e8
xor eax, eax
jmp 0x474a4c
push 0x10
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00539438
add esp, 0xc
mov word [ebp - 0x10], 2
push 0x4f
call sub.WSOCK32.dll_htons
mov word [ebp - 0xe], ax
mov eax, dword [0x573994]
cmp eax, 0xffffffff
je 0x4749ec
mov dword [ebp - 0xc], eax
jmp 0x4749fb
mov eax, 0x573490
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx]
mov dword [ebp - 0xc], eax
push 0x10
push 0x423
push dword [0x55b3c8]
push dword [0x551540]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x10]
push edx
push dword [0x551540]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x474a4a
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x474a4a
push 0
push 0x9c9
call fcn.0041c35b
push eax
call fcn.004744e8
xor eax, eax
jmp 0x474a4c
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x474a53
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, 0x573890
mov eax, dword [ebp + 8]
shr eax, 0x10
test ax, 0xffff
je 0x474a82
push 0
push 0x9c9
call fcn.0041c35b
push eax
call fcn.004744e8
xor eax, eax
jmp 0x474b81
cmp byte [0x551474], 0
je 0x474ad9
push 0x5514d8
push 0x551474
push 0
push 0x9ca
call fcn.0041c35b
push eax
push esi
call sub.USER32.dll_wsprintfA
add esp, 0x10
push dword [0x54d2a0]
push esi
push dword [0x55b3ec]
call fcn.004dfd6c
push 0x551474
push 0x551576
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov byte [0x551474], 0
jmp 0x474b19
push 0x5514d8
push 0
push 0x9cb
call fcn.0041c35b
push eax
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push dword [0x54d2a0]
push esi
push dword [0x55b3ec]
call fcn.004dfd6c
push 0x5514d8
push str.__s_n
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push dword [0x54d29c]
push dword [0x55b3ec]
call fcn.004dfc12
mov byte [0x573998], 0
xor edx, edx
mov dword [0x55154c], edx
push 0x21
push 0x424
push dword [0x55b3c8]
push dword [0x551540]
call sub.WSOCK32.dll_WSAAsyncSelect
push esi
call fcn.005395b8
pop ecx
mov ebx, eax
push 0
push ebx
push esi
push dword [0x551540]
call sub.WSOCK32.dll_send
cmp ebx, eax
je 0x474b7f
push 0
push 0x9cc
call fcn.0041c35b
push eax
call fcn.004744e8
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x474dff
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
or eax, 0xffffffff
mov dword [0x551590], eax
mov dword [0x55158c], eax
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [0x55158c], eax
cmp eax, 0xffffffff
jne 0x474e29
push 0
call fcn.00474d68
ret
push 0x4f
push dword [0x55158c]
call fcn.004e3568
test eax, eax
jne 0x474e42
push 0
call fcn.00474d68
ret
push 5
push dword [0x55158c]
call sub.WSOCK32.dll_listen
test eax, eax
je 0x474e5b
push 0
call fcn.00474d68
ret
push 8
push 0x42e
push dword [0x55b3c8]
push dword [0x55158c]
call sub.WSOCK32.dll_WSAAsyncSelect
ret
Function at 0x47530d
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ebx, 0x573bac
mov esi, 0x55159c
mov edi, 0x5515a0
mov edx, eax
shr edx, 0x10
test dx, 0xffff
jne 0x475348
cmp eax, 0x20
je 0x475348
cmp dword [0x551590], 0xffffffff
je 0x475348
cmp dword [0x55158c], 0xffffffff
jne 0x475354
push 2
call fcn.00474d68
jmp 0x47547c
cmp byte [ebx], 0
jne 0x47542d
push dword [esi]
push 0x3e7
push ebx
call fcn.0053cb40
add esp, 0xc
test eax, eax
je 0x475475
push ebx
call fcn.00498878
test eax, eax
jne 0x475475
call fcn.00474f15
test eax, eax
je 0x475354
push 0xa
push ebx
call fcn.00539518
add esp, 8
test eax, eax
jne 0x4753a8
lea eax, [edi + 0x41]
push eax
push ebx
call fcn.005394dc
add esp, 8
lea ecx, [edi + 0x44]
push ecx
push ebx
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x47542d
push dword [esi]
call fcn.0053d550
pop ecx
mov dword [0x573aa0], eax
mov dword [0x573aa4], 1
jmp 0x4753f7
push ebx
call fcn.00498878
test eax, eax
jne 0x47540b
lea eax, [edi + 0x47]
push eax
push ebx
call fcn.0053977c
add esp, 8
test eax, eax
je 0x4753f7
xor edx, edx
mov dword [0x573aa4], edx
jmp 0x47540b
push dword [esi]
push 0x3e7
push ebx
call fcn.0053cb40
add esp, 0xc
test eax, eax
jne 0x4753d2
push 0
push dword [0x573aa0]
push dword [esi]
call fcn.0053d4dc
add esp, 0xc
cmp dword [0x573aa4], 0
jne 0x475475
mov byte [ebx], 0xa
mov byte [ebx + 1], 0
push 0
push ebx
call fcn.005395b8
pop ecx
push eax
push ebx
push dword [0x551590]
call sub.WSOCK32.dll_send
test eax, eax
jge 0x47546d
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x475475
push 0x22
push 0x430
push dword [0x55b3c8]
push dword [0x551590]
call sub.WSOCK32.dll_WSAAsyncSelect
jmp 0x47547c
mov byte [ebx], 0
jmp 0x475354
push 2
call fcn.00474d68
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x475484
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x551600
mov esi, 0x569b9c
mov edi, str.mirc.ini
push edi
push 0x3e7
push esi
lea eax, [ebx + 0x10]
push eax
lea edx, [ebx + 7]
push edx
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0x79
jne 0x4754bc
mov dword [0x5515fc], 1
jmp 0x4754c4
xor ecx, ecx
mov dword [0x5515fc], ecx
push edi
push 0x64
push 0x5740a0
lea eax, [ebx + 0x25]
push eax
lea edx, [ebx + 0x1b]
push edx
lea ecx, [ebx + 0x14]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x5740a0
call fcn.004ff072
push edi
push 0x3e7
push esi
lea eax, [ebx + 0x36]
push eax
lea edx, [ebx + 0x30]
push edx
lea ecx, [ebx + 0x29]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x475513
push esi
call fcn.00542dbc
pop ecx
mov word [0x5515f0], ax
jmp 0x47551c
mov word [0x5515f0], 0x438
cmp word [0x5515f0], 0
ja 0x47552f
mov word [0x5515f0], 0x438
push edi
push 0x64
push 0x574104
lea eax, [ebx + 0x49]
push eax
lea edx, [ebx + 0x41]
push edx
lea ecx, [ebx + 0x3a]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x574104
call fcn.004ff072
push edi
push 0x64
push 0x574168
lea eax, [ebx + 0x5e]
push eax
lea edx, [ebx + 0x54]
push edx
lea ecx, [ebx + 0x4d]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x574168], 0
je 0x4755b5
push edi
push 0
lea eax, [ebx + 0x69]
push eax
lea edx, [ebx + 0x62]
push edx
call fcn.00498684
push 0x574168
push 0x579058
call sub.USER32.dll_wsprintfA
add esp, 8
push 0x579058
call fcn.00466d0b
push edi
push 0x579058
lea ecx, [ebx + 0x7a]
push ecx
lea eax, [ebx + 0x73]
push eax
call fcn.00498684
jmp 0x4755e1
push edi
push 0x64
push 0x574168
lea edx, [ebx + 0x8d]
push edx
lea ecx, [ebx + 0x87]
push ecx
lea eax, [ebx + 0x80]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x574168
call fcn.00466d33
push edi
push 0x3e7
push esi
lea edx, [ebx + 0xa0]
push edx
lea ecx, [ebx + 0x98]
push ecx
lea eax, [ebx + 0x91]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea edx, [ebx + 0xa4]
push edx
push esi
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x475622
mov dword [0x5515f4], 1
jmp 0x475649
lea ecx, [ebx + 0xa7]
push ecx
push esi
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x475642
mov dword [0x5515f4], 2
jmp 0x475649
xor eax, eax
mov dword [0x5515f4], eax
push edi
push 0x3e7
push esi
lea edx, [ebx + 0xbb]
push edx
lea ecx, [ebx + 0xb5]
push ecx
lea eax, [ebx + 0xae]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0x79
jne 0x47567b
mov dword [0x5515f8], 1
jmp 0x475683
xor edx, edx
mov dword [0x5515f8], edx
pop edi
pop esi
pop ebx
ret
Function at 0x475e8f
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test ebx, ebx
jne 0x475ec4
mov ebx, dword [0x5515ec]
jmp 0x475eaf
mov ebx, dword [ebx + 0x80]
test ebx, ebx
je 0x475eb9
cmp dword [ebx + 0x6c], 0
jne 0x475ea9
test ebx, ebx
jne 0x475ec4
xor eax, eax
jmp 0x475fa6
cmp byte [esi], 0
je 0x475ed4
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x475ee6
push 1
push dword [ebx + 0x70]
push ebx
call fcn.004759d0
xor eax, eax
jmp 0x475fa6
mov dword [ebx + 0x6c], 1
mov dword [ebx + 0x74], 0xb4
push 0x10
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.00539438
add esp, 0xc
mov word [ebp - 0x10], 2
mov cx, word [0x5515f0]
push ecx
call sub.WSOCK32.dll_htons
mov word [ebp - 0xe], ax
push esi
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 0xc], eax
push 0
push 2
push 0
mov ax, word [0x54f356]
push eax
mov dx, word [0x54f354]
push edx
call fcn.004e3612
mov esi, eax
mov dword [ebx + 0x7c], esi
cmp esi, 0xffffffff
jne 0x475f57
push 2
push dword [ebx + 0x70]
push ebx
call fcn.004759d0
xor eax, eax
jmp 0x475fa6
push dword [ebx + 0x7c]
call fcn.0051b512
push 0x10
push 0x431
push dword [0x55b3c8]
push dword [ebx + 0x7c]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x10]
push edx
push dword [ebx + 0x7c]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x475fa1
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x475fa1
push 3
push dword [ebx + 0x70]
push ebx
call fcn.004759d0
xor eax, eax
jmp 0x475fa6
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x478061
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
sub eax, 6
je 0x478124
sub eax, 0x10a
je 0x478087
dec eax
je 0x478136
jmp 0x478155
cmp dword [0x5518f0], 1
jne 0x4780a3
push str.channel_font
push 0
push 0xc
push 0x65
push ebx
call sub.USER32.dll_SendDlgItemMessageA
jmp 0x4780df
cmp dword [0x5518f0], 2
jne 0x4780bf
push str.query_chat_font
push 0
push 0xc
push 0x65
push ebx
call sub.USER32.dll_SendDlgItemMessageA
jmp 0x4780df
push 0
push 0x66
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x65
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
cmp dword [0x5518f0], 0
jl 0x4780f0
xor edx, edx
mov dword [0x5518f0], edx
cmp dword [0x5518f0], 0
jge 0x478103
push 0x1e
push ebx
call fcn.00421234
jmp 0x47810b
push 7
push ebx
call fcn.00421234
push 0
push 2
push ebx
call sub.USER32.dll_GetDlgItem
push eax
push ebx
call sub.USER32.dll_GetNextDlgTabItem
push eax
call sub.USER32.dll_SetFocus
jmp 0x478155
cmp dword [ebp + 0x10], 0
je 0x478155
mov dword [0x555508], 0x3d4
jmp 0x478155
mov cx, word [ebp + 0x10]
dec cx
jne 0x478155
push 0x66
push ebx
call sub.USER32.dll_IsDlgButtonChecked
test eax, eax
je 0x478155
mov dword [0x5518f0], 1
cmp dword [ebp + 0x14], 0
jne 0x47815f
xor eax, eax
jmp 0x478161
xor eax, eax
pop ebx
pop ebp
ret 0x10
Function at 0x478b39
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, 0x574d36
mov edi, 0x551b54
mov dword [0x54fc08], ebx
push 0x45b853
push 0xfa
push dword [0x55b3c8]
call fcn.0045a0bc
xor edx, edx
mov dword [0x54fc08], edx
test eax, eax
jg 0x478bb9
cmp dword [ebx + 0x36c], 0
je 0x478baa
imul eax, dword [0x557490], 0x64
add eax, 0x5573c8
push eax
push edi
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push esi
call fcn.005395b8
pop ecx
push eax
push esi
push dword [ebx + 0x398]
call sub.WSOCK32.dll_send
push 0
push ebx
call fcn.0047896f
xor eax, eax
jmp 0x478cd6
cmp eax, 2
jne 0x478cd6
cmp dword [ebx + 0x36c], 0
je 0x478c17
imul edx, dword [0x557490], 0x64
add edx, 0x5573c8
push edx
lea ecx, [edi + 9]
push ecx
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push esi
call fcn.005395b8
pop ecx
push eax
push esi
push dword [ebx + 0x398]
call sub.WSOCK32.dll_send
lea eax, [ebx + 0x68]
push eax
lea edx, [ebx + 4]
push edx
lea ecx, [edi + 0x12]
push ecx
push 0x571040
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x478c30
lea eax, [ebx + 0x68]
push eax
lea edx, [ebx + 4]
push edx
lea ecx, [edi + 0x1e]
push ecx
push 0x571040
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 2
push 0x571040
call fcn.004b4e5c
push esi
push edi
lea eax, [edi + 0x25]
mov edi, esi
mov esi, eax
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 1
push 0x1e
push esi
push 0x571040
push 1
push dword [0x55b3d8]
call fcn.004981c9
push 0
push ebx
call fcn.0047896f
mov ebx, dword [0x551b48]
test ebx, ebx
je 0x478cd4
cmp dword [ebx + 0x36c], 0
je 0x478c94
lea eax, [ebx + 0x68]
push eax
lea edx, [ebx + 4]
push edx
lea ecx, [edi + 0x2b]
push ecx
push esi
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x478ca9
lea eax, [ebx + 0x68]
push eax
lea edx, [ebx + 4]
push edx
lea ecx, [edi + 0x37]
push ecx
push esi
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0
push esi
push 0x571040
call fcn.00513930
test eax, eax
je 0x478cca
push 0
push ebx
call fcn.0047896f
mov ebx, dword [0x551b48]
jmp 0x478c70
mov ebx, dword [ebx + 0x39c]
test ebx, ebx
jne 0x478c74
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4