joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b04f8
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
cmp dword [0x556164], 0
je 0x4b051d
lea eax, [ebp - 4]
push eax
push str.SoftwaremIRC
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyA
mov ebx, eax
jmp 0x4b0532
lea eax, [ebp - 4]
push eax
push 0x5557a9
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
mov ebx, eax
test ebx, ebx
je 0x4b053a
xor eax, eax
jmp 0x4b055c
push dword [ebp + 8]
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegDeleteKeyA
mov ebx, eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
je 0x4b0557
xor eax, eax
jmp 0x4b055c
mov eax, 1
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x4b2e98
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0x555a5d
push esi
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x4b2ec5
mov esi, 0x555a6c
mov edi, 0x57a469
mov eax, edi
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4b2f22
push 0x555a74
push esi
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x4b2ee8
mov esi, str.messages
mov edi, 0x57a469
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4b2f22
push 0x20
push esi
call fcn.00539518
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x4b2efd
mov ebx, esi
jmp 0x4b2efe
inc ebx
mov esi, 0x57a469
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp + 0xc], 0
jne 0x4b2f2f
mov eax, 0x57a469
jmp 0x4b2f91
push str.mirc.ini
push 0x3e7
push 0x57c4a0
push 0x555a97
push 0x57a469
push 0x555a8e
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov ebx, 0x57c4a0
jmp 0x4b2f5a
inc ebx
cmp byte [ebx], 0x20
je 0x4b2f59
cmp byte [ebx], 0
jne 0x4b2f68
xor eax, eax
jmp 0x4b2f91
mov esi, 0x57a469
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, 0x57a469
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4b7561
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, 0x579826
mov ebp, 0x555d48
cmp byte [0x54c6c4], 0
jne 0x4b7588
push edi
lea esi, [ebp + 0x12a]
mov edi, 0x54c6c4
mov eax, edi
movsd dword es:[edi], dword [esi]
pop edi
push edi
lea esi, [ebp + 0x12f]
mov edi, 0x54c6c4
mov eax, edi
movsd dword es:[edi], dword [esi]
pop edi
call fcn.004b8c17
call sub.USER32.dll_CreatePopupMenu
mov ebx, eax
mov dword [0x555c44], ebx
test ebx, ebx
je 0x4b769d
xor esi, esi
push esi
lea eax, [ebp + 0x134]
push eax
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x54c538
push 0x3e7
push 0x57943f
lea edx, [ebp + 0x145]
push edx
push edi
lea ecx, [ebp + 0x139]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x57943f], 0
je 0x4b768d
xor ebx, ebx
push edi
push 4
push 0x57943f
call fcn.00423afd
push 2
call fcn.00447ae4
test eax, eax
je 0x4b7653
lea eax, [ebp + 0x149]
push eax
push 0x54c6c4
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x4b762e
mov ebx, 1
jmp 0x4b7658
push 0x54c6c4
push edi
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x4b7647
mov ebx, 1
jmp 0x4b7658
cmp byte [edi], 0
jne 0x4b7658
mov ebx, 1
jmp 0x4b7658
mov ebx, 1
test ebx, ebx
je 0x4b7683
push edi
push 1
push 0x57943f
call fcn.00423afd
cmp byte [edi], 0
je 0x4b7683
push edi
lea eax, [esi + 0x514]
push eax
push 0
push dword [0x555c44]
call sub.USER32.dll_AppendMenuA
inc esi
cmp esi, 0x14
jl 0x4b75b4
test esi, esi
jne 0x4b769d
call fcn.004b8c17
push 0
call fcn.0041c2be
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b7ebe
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, 0x555c3c
call fcn.004b8c17
push 2
push dword [ebp]
call sub.USER32.dll_GetMenuItemID
cmp eax, 0x7c
jne 0x4b7ef5
cmp dword [0x55a3c0], 0
je 0x4b7f1c
push 0x400
push 2
push dword [ebp]
call sub.USER32.dll_DeleteMenu
jmp 0x4b7f1c
cmp dword [0x55a3c0], 0
jne 0x4b7f1c
push 0
push 0xefc
call fcn.0041c35b
push eax
push 0x7c
push 0x400
push 2
push dword [ebp]
call sub.USER32.dll_InsertMenuA
push 3
push dword [ebp]
call sub.USER32.dll_GetSubMenu
mov ebx, eax
test ebx, ebx
jne 0x4b7f38
push 4
push dword [ebp]
call sub.USER32.dll_GetSubMenu
mov ebx, eax
test ebx, ebx
je 0x4b7fc0
push 3
push ebx
call sub.USER32.dll_GetMenuItemID
cmp eax, 0x7f
jne 0x4b7f72
cmp dword [0x55a3c0], 0
je 0x4b7fab
push 0x400
push 2
push ebx
call sub.USER32.dll_DeleteMenu
push 0x400
push 2
push ebx
call sub.USER32.dll_DeleteMenu
jmp 0x4b7fab
cmp dword [0x55a3c0], 0
jne 0x4b7fab
push 0x555ef4
push 0
push 0x800
push 2
push ebx
call sub.USER32.dll_InsertMenuA
push 0
push 0xefc
call fcn.0041c35b
push eax
push 0x7f
push 0x400
push 3
push ebx
call sub.USER32.dll_InsertMenuA
cmp dword [0x556148], 0
je 0x4b7fc0
push 8
push 0x7f
push dword [ebp]
call sub.USER32.dll_CheckMenuItem
push dword [ebp]
call sub.USER32.dll_GetMenuItemCount
mov ebx, eax
dec ebx
test ebx, ebx
jle 0x4b7ff0
push ebx
push dword [ebp]
call sub.USER32.dll_GetMenuItemID
cmp eax, 0x7d
je 0x4b7ff0
push 0x400
push ebx
push dword [ebp]
call sub.USER32.dll_DeleteMenu
dec ebx
test ebx, ebx
jg 0x4b7fcf
cmp dword [0x55b3c0], 0
je 0x4b809a
push 0x555ef8
push 0
push 0x800
push dword [ebp]
call sub.USER32.dll_AppendMenuA
mov ebx, 1
mov edi, 0x320
mov esi, dword [0x55b3c0]
test esi, esi
je 0x4b809a
push 0x3c
push 0x57c4a0
push dword [esi]
call sub.USER32.dll_GetWindowTextA
push 0x57c4a0
call fcn.005395b8
pop ecx
cmp eax, 0x32
jbe 0x4b8054
push esi
push edi
mov esi, 0x555efc
mov edi, 0x57c4d2
mov eax, edi
movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0x57c4a0
push ebx
push 0x555f01
push 0x57c887
call sub.USER32.dll_wsprintfA
add esp, 0x10
inc ebx
mov edx, dword [0x55b3d4]
cmp edx, dword [esi]
jne 0x4b807e
mov eax, 8
jmp 0x4b8080
xor eax, eax
push 0x57c887
push edi
push eax
push dword [ebp]
call sub.USER32.dll_AppendMenuA
inc edi
mov esi, dword [esi + 0x9d8]
test esi, esi
jne 0x4b8025
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b809f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov edx, dword [ebp + 8]
cmp edx, 0x320
jl 0x4b8174
cmp edx, 0x352
jg 0x4b8174
mov eax, 0x320
mov ebx, dword [0x55b3c0]
test ebx, ebx
je 0x4b8174
cmp edx, eax
jne 0x4b8165
push 4
push dword [ebx]
call sub.USER32.dll_ShowWindow
push dword [ebx]
call sub.USER32.dll_BringWindowToTop
push dword [ebx]
call sub.USER32.dll_UpdateWindow
push dword [ebx]
call sub.USER32.dll_SetActiveWindow
push dword [ebx]
call sub.USER32.dll_SetForegroundWindow
push dword [ebx]
call sub.USER32.dll_SetFocus
cmp dword [0x556148], 0
je 0x4b8122
push 0
push 0x7c
push 0x111
push dword [0x55b3c8]
call sub.USER32.dll_PostMessageA
cmp dword [0x556140], 0
je 0x4b8141
push 0
push 0x7a
push 0x111
push dword [0x55b3c8]
call sub.USER32.dll_PostMessageA
jmp 0x4b815e
cmp dword [0x556144], 0
je 0x4b815e
push 0
push 0x7b
push 0x111
push dword [0x55b3c8]
call sub.USER32.dll_PostMessageA
mov eax, 1
jmp 0x4b8176
inc eax
mov ebx, dword [ebx + 0x9d8]
test ebx, ebx
jne 0x4b80d1
xor eax, eax
pop ebx
pop ebp
ret 4
Function at 0x4bbfd5
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dword [ebp - 8], ecx
xor esi, esi
jmp 0x4bc07a
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp - 0xc]
mov cl, byte [ecx + ebx]
test cl, cl
je 0x4bc00f
test esi, esi
jne 0x4bc00f
mov ebx, dword [ebp + 8]
mov edi, dword [ebp - 0xc]
inc dword [ebp - 0xc]
jmp 0x4bc019
mov esi, 1
mov dword [ebp - 4], edx
xor ecx, ecx
test esi, esi
je 0x4bc021
test edx, edx
je 0x4bc031
and ecx, 0xff
shl dword [ebp - 8], 8
add edx, 8
or dword [ebp - 8], ecx
cmp edx, 6
jl 0x4bc07a
sub edx, 6
mov ecx, edx
mov ebx, dword [ebp - 8]
shr ebx, cl
mov ecx, ebx
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ebx, dword [ebp + 0x10]
mov byte [ebx + eax], cl
inc eax
cmp eax, 0x3c
jl 0x4bc060
mov edx, dword [ebp + 0x10]
mov byte [edx + eax], 0
jmp 0x4bc0cb
cmp eax, dword [ebp + 0x14]
jl 0x4bc06f
mov eax, 0xffffffff
mov dword [ebp - 0xc], eax
jmp 0x4bc0cb
test esi, esi
je 0x4bc075
xor edx, edx
cmp edx, 6
jge 0x4bc036
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0xc]
jg 0x4bc09a
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp - 0xc]
cmp byte [ecx + ebx], 0
jne 0x4bbff3
test edx, edx
jne 0x4bbff3
cmp dword [ebp - 4], 2
jne 0x4bc0b2
mov edx, dword [ebp + 0x10]
mov byte [edx + eax], 0x3d
inc eax
mov ecx, dword [ebp + 0x10]
mov byte [ecx + eax], 0x3d
inc eax
jmp 0x4bc0c0
cmp dword [ebp - 4], 4
jne 0x4bc0c0
mov edx, dword [ebp + 0x10]
mov byte [edx + eax], 0x3d
inc eax
test eax, eax
je 0x4bc0cb
mov ecx, dword [ebp + 0x10]
mov byte [ecx + eax], 0
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [edx], ecx
mov edx, dword [ebp + 0x1c]
mov dword [edx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4bc586
Capabilities:
Get file version info

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
xor eax, eax
mov dword [esp + 4], eax
xor edx, edx
mov dword [esp + 8], edx
mov ebp, 1
push 0x553318
push str._slang32.dll
push 0x57c4a0
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x57c4a0
call sub.KERNEL32.dll_LoadLibraryA
mov ebx, eax
mov dword [0x556198], ebx
test ebx, ebx
je 0x4bc681
push esp
push 0x57c4a0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x4bc681
push esi
push 0x42
call sub.KERNEL32.dll_GlobalAlloc
mov ebx, eax
test ebx, ebx
je 0x4bc681
push ebx
call sub.KERNEL32.dll_GlobalLock
mov edi, eax
test edi, edi
je 0x4bc665
push edi
push esi
push dword [esp + 8]
push 0x57c4a0
call sub.VERSION.dll_GetFileVersionInfoA
push str.StringFileInfo040904E4FILEVERSION
push 0x57c4a0
call sub.USER32.dll_wsprintfA
add esp, 8
lea eax, [esp + 8]
push eax
lea edx, [esp + 8]
push edx
push 0x57c4a0
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4bc65f
cmp dword [esp + 8], 0
je 0x4bc65f
cmp dword [esp + 4], 0
je 0x4bc65f
push dword [esp + 4]
push 0x556135
call sub.KERNEL32.dll_lstrcmpA
test eax, eax
jne 0x4bc65f
xor ebp, ebp
push ebx
call sub.KERNEL32.dll_GlobalUnlock
push ebx
call sub.KERNEL32.dll_GlobalFree
test ebp, ebp
je 0x4bc681
push dword [0x556198]
call sub.KERNEL32.dll_FreeLibrary
xor eax, eax
mov dword [0x556198], eax
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4bcf69
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebx
push 0
push 0x3e8
push 0x78
push dword [0x55b3c8]
call sub.USER32.dll_SetTimer
cmp byte [0x55781c], 0
je 0x4bcfc7
cmp dword [0x557880], 0
jne 0x4bcfc7
push 0x55781c
call sub.WSOCK32.dll_inet_addr
mov ebx, eax
mov dword [0x557880], ebx
cmp ebx, 0xffffffff
jne 0x4bcfb7
mov byte [0x55781c], 0
xor eax, eax
mov dword [0x557880], eax
jmp 0x4bcfc7
push dword [0x557880]
call sub.WSOCK32.dll_htonl
mov dword [0x557880], eax
push str.COMSPEC
call fcn.00546528
pop ecx
mov dword [0x54bde0], eax
mov eax, dword [0x54bde0]
test eax, eax
je 0x4bcffa
push str.4DOS.COM
push eax
call fcn.0053977c
add esp, 8
test eax, eax
je 0x4bcffa
xor edx, edx
mov dword [0x54bde0], edx
call fcn.004b087d
push 0x57c887
push 0x57c4a0
call fcn.0041cf41
cmp dword [0x553520], 0
je 0x4bd02e
call fcn.00498a7b
call fcn.00498c7b
xor ecx, ecx
mov dword [0x553520], ecx
call fcn.0049b375
call fcn.0046dc64
call fcn.00458988
call fcn.004e7b80
mov ebx, dword [0x556198]
test ebx, ebx
je 0x4bd054
push 0x46
push ebx
call sub.USER32.dll_LoadAcceleratorsA
mov dword [0x55617c], eax
cmp dword [0x55617c], 0
jne 0x4bd06f
push 0x46
push dword [0x55b3c4]
call sub.USER32.dll_LoadAcceleratorsA
mov dword [0x55617c], eax
mov ebx, dword [0x556198]
test ebx, ebx
je 0x4bd086
push 0x47
push ebx
call sub.USER32.dll_LoadAcceleratorsA
mov dword [0x556180], eax
cmp dword [0x556180], 0
jne 0x4bd0a1
push 0x47
push dword [0x55b3c4]
call sub.USER32.dll_LoadAcceleratorsA
mov dword [0x556180], eax
push 0
push dword [0x55b3c8]
call sub.USER32.dll_GetWindowThreadProcessId
push eax
push dword [0x55b3c4]
push sym.mirc32.exe_KeyboardProc
push 2
call sub.USER32.dll_SetWindowsHookExA
mov dword [0x555504], eax
push str.MSWHEEL_ROLLMSG
call sub.USER32.dll_RegisterWindowMessageA
mov dword [0x5561a0], eax
call fcn.004f2bcf
cmp dword [0x55b564], 0
jne 0x4bd170
xor eax, eax
mov dword [0x54a53c], eax
push 0
push 0
push 0x448
push dword [0x55b3c8]
call sub.USER32.dll_PostMessageA
cmp dword [0x551f64], 0
je 0x4bd11f
push 0
push 0
push 0x429
push dword [0x55b3c8]
call sub.USER32.dll_PostMessageA
cmp dword [0x551594], 0
je 0x4bd13c
push 0
push 0
push 0x42d
push dword [0x55b3c8]
call sub.USER32.dll_PostMessageA
cmp dword [0x556f68], 0
je 0x4bd159
push 0
push 0
push 0x433
push dword [0x55b3c8]
call sub.USER32.dll_PostMessageA
call fcn.0040e784
push 0x7f00
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
pop ebx
ret
Function at 0x4c3d06
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, 0x556468
cmp dword [0x55646c], 0
jne 0x4c3d36
cmp dword [0x55647c], 0
jne 0x4c3d27
cmp dword [esi], 0
je 0x4c3d2c
call fcn.004c3e3d
mov eax, 1
jmp 0x4c3e37
call fcn.004c3c01
mov ebp, eax
mov eax, dword [esi]
test eax, eax
je 0x4c3da4
mov ebx, eax
mov esi, ebp
xor edi, edi
jmp 0x4c3d68
push dword [esi]
push dword [ebx]
call fcn.0053977c
add esp, 8
test eax, eax
je 0x4c3d62
mov edi, 1
jmp 0x4c3d70
mov ebx, dword [ebx + 0x34]
mov esi, dword [esi + 0x34]
test ebx, ebx
je 0x4c3d70
test esi, esi
jne 0x4c3d4b
push ebp
call fcn.004b12ac
test edi, edi
jne 0x4c3d8b
xor eax, eax
mov dword [0x556470], eax
mov eax, 1
jmp 0x4c3e37
mov dword [0x556470], 1
call fcn.004c3e3d
mov eax, 1
jmp 0x4c3e37
xor edx, edx
mov dword [0x556470], edx
xor ecx, ecx
mov dword [0x55647c], ecx
xor eax, eax
mov dword [0x556480], eax
mov eax, ebp
mov dword [esi], eax
test eax, eax
jne 0x4c3dca
mov eax, 1
jmp 0x4c3e37
push 0
push 0
push 1
push 0
call sub.KERNEL32.dll_CreateEventA
mov ebx, eax
mov dword [0x556480], ebx
test ebx, ebx
jne 0x4c3df2
push dword [esi]
call fcn.004b12ac
xor eax, eax
mov dword [esi], eax
xor eax, eax
jmp 0x4c3e37
push esp
push 0
push 0
push 0x4c3ae5
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov ebx, eax
mov dword [0x55647c], ebx
test ebx, ebx
jne 0x4c3e32
push dword [0x556480]
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
mov dword [0x556480], eax
push dword [esi]
call fcn.004b12ac
xor edx, edx
mov dword [esi], edx
xor eax, eax
jmp 0x4c3e37
mov eax, 1
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4c4e75
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
or eax, 0xffffffff
mov dword [0x556f8c], eax
mov dword [0x556f88], eax
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [0x556f88], eax
cmp eax, 0xffffffff
jne 0x4c4e9f
push 0
call fcn.004c4df5
ret
mov dx, word [0x556f84]
push edx
push dword [0x556f88]
call fcn.004e3568
test eax, eax
jne 0x4c4ebe
push 0
call fcn.004c4df5
ret
push 5
push dword [0x556f88]
call sub.WSOCK32.dll_listen
test eax, eax
je 0x4c4ed7
push 0
call fcn.004c4df5
ret
push 8
push 0x434
push dword [0x55b3c8]
push dword [0x556f88]
call sub.WSOCK32.dll_WSAAsyncSelect
ret
Function at 0x4c770d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push dword [ebp + 8]
call fcn.00516145
mov ebx, eax
test ebx, ebx
je 0x4c772c
cmp byte [ebx + 0x64c], 1
je 0x4c7736
mov eax, dword [0x557168]
jmp 0x4c77d7
push str.mirc.ini
push 0x3e7
push 0x57c4a0
push 0x557190
lea edx, [ebx + 4]
push edx
push 0x557186
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x57c4a0], 0
jne 0x4c7765
xor eax, eax
jmp 0x4c77d7
push 0x2c
push 0x57c4a0
call fcn.00539518
add esp, 8
test eax, eax
jne 0x4c777c
xor eax, eax
jmp 0x4c77d7
inc eax
cmp byte [eax], 0
jne 0x4c7786
xor eax, eax
jmp 0x4c77d7
push eax
call fcn.00542dbc
pop ecx
mov esi, eax
test esi, esi
jge 0x4c7795
xor esi, esi
lea eax, [ebp - 0x10]
push eax
push dword [ebx]
call sub.USER32.dll_GetClientRect
mov eax, dword [ebx + 0x760]
test eax, eax
je 0x4c77c9
push eax
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x4c77c9
lea edx, [ebp - 0x20]
push edx
push dword [ebx + 0x760]
call sub.USER32.dll_GetClientRect
mov ecx, dword [ebp - 0x18]
sub dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
add eax, 0xfffffffe
cmp esi, eax
jl 0x4c77d5
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c77df
Capabilities:
Hide graphical window
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00516145
mov ebx, eax
test ebx, ebx
je 0x4c77fc
cmp byte [ebx + 0x64c], 1
je 0x4c7808
push 0
call fcn.0041c2be
jmp 0x4c7a19
push 0x45d2ef
push 0x28a
push dword [ebp + 8]
call fcn.0045a0bc
mov esi, eax
test esi, esi
jle 0x4c7a19
push ebx
call fcn.00514157
test eax, eax
je 0x4c7a19
test esi, 0x20
je 0x4c78a6
push dword [ebp + 8]
call fcn.004c770d
mov edi, eax
test edi, edi
je 0x4c789e
push str.mirc.ini
push 0x3e7
push 0x57c4a0
push 0x55719e
lea edi, [ebx + 4]
push edi
push 0x557194
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x57c4a0], 0
je 0x4c789e
push 0x2c
push 0x57c4a0
call fcn.00539518
add esp, 8
test eax, eax
je 0x4c789e
mov byte [eax], 0
push str.mirc.ini
push 0x57c4a0
push edi
push 0x5571a2
call fcn.00498684
push 1
push ebx
call fcn.005144b4
test esi, 1
je 0x4c78b2
xor edi, edi
jmp 0x4c78eb
test esi, 2
je 0x4c78c1
mov edi, 1
jmp 0x4c78eb
test esi, 4
je 0x4c78d0
mov edi, 2
jmp 0x4c78eb
push str.mirc.ini
push 0
lea eax, [ebx + 4]
push eax
push 0x5571ac
call fcn.00498684
mov edi, dword [0x557168]
test esi, 0x10
je 0x4c7914
test esi, 8
je 0x4c790e
push str.mirc.ini
push 0
push 0
push 0x5571b6
call fcn.00498684
mov dword [0x557168], edi
mov eax, edi
mov byte [ebx + 0x667], al
cmp edi, 2
jne 0x4c793d
push 0
push dword [ebx + 0x75c]
call sub.USER32.dll_ShowWindow
push 0
push dword [ebx + 0x75c]
call sub.USER32.dll_EnableWindow
jmp 0x4c7957
push 1
push dword [ebx + 0x75c]
call sub.USER32.dll_EnableWindow
push 8
push dword [ebx + 0x75c]
call sub.USER32.dll_ShowWindow
push 0
push dword [ebx]
call fcn.00516816
mov edi, esi
and edi, 0x10
test edi, edi
je 0x4c7974
mov eax, dword [ebx + 0x654]
mov dword [0x55716c], eax
call fcn.0049b375
test esi, 8
jne 0x4c7a19
test edi, edi
jne 0x4c7a19
push dword [ebp + 8]
call fcn.004c770d
mov edi, eax
cmp byte [ebx + 0x667], 0
jne 0x4c79b3
push edi
mov esi, 0x5571c0
mov edi, 0x57c4a0
mov eax, edi
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
jmp 0x4c79dd
cmp byte [ebx + 0x667], 1
jne 0x4c79ce
push edi
mov esi, 0x5571c7
mov edi, 0x57c4a0
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
jmp 0x4c79dd
push edi
mov esi, 0x5571cd
mov edi, 0x57c4a0
mov eax, edi
movsd dword es:[edi], dword [esi]
pop edi
test edi, edi
je 0x4c7a01
push edi
push 0x5571d2
push 0x57c4a0
call fcn.005395b8
pop ecx
add eax, 0x57c4a0
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push str.mirc.ini
push 0x57c4a0
add ebx, 4
push ebx
push 0x5571d7
call fcn.00498684
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4c7a20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, 0x57c4a0
push dword [ebp + 8]
call fcn.00516145
test eax, eax
je 0x4c7a3e
cmp byte [eax + 0x64c], 1
je 0x4c7a48
mov eax, dword [0x557168]
jmp 0x4c7aca
push str.mirc.ini
push 0x3e7
push ebx
push 0x5571eb
add eax, 4
push eax
push 0x5571e1
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [ebx], 0
je 0x4c7ac5
push 0x2c
push ebx
call fcn.00539518
add esp, 8
test eax, eax
je 0x4c7a7d
mov byte [eax], 0
push 0x5571ef
push ebx
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x4c7a93
xor eax, eax
jmp 0x4c7aca
push 0x5571f6
push ebx
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x4c7aac
mov eax, 1
jmp 0x4c7aca
push 0x5571fc
push ebx
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x4c7ac5
mov eax, 2
jmp 0x4c7aca
mov eax, dword [0x557168]
pop ebx
pop ebp
ret 4

Function at 0x4c86c9
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, str.Notify_List___d__d_
mov edi, 0x57dae4
mov ebp, 0x57da00
xor eax, eax
mov dword [0x57da10], eax
push dword [0x57da10]
lea edx, [esi + 0x1d]
push edx
push 0x57da04
call sub.USER32.dll_wsprintfA
add esp, 0xc
push str.mirc.ini
push 0x3e7
push edi
lea ecx, [esi + 0x2a]
push ecx
push 0x57da04
lea eax, [esi + 0x22]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [edi], 0
je 0x4c8795
lea edx, [esi + 0x2e]
push edx
push edi
call fcn.005398cc
add esp, 8
mov ebx, eax
mov dword [ebp], ebx
test ebx, ebx
je 0x4c8746
mov byte [ebx], 0
add dword [ebp], 5
mov eax, dword [ebp]
cmp byte [eax], 0
jne 0x4c8746
xor edx, edx
mov dword [ebp], edx
lea ecx, [esi + 0x35]
push ecx
push edi
call fcn.005398cc
add esp, 8
mov ebx, eax
mov dword [0x57d9fc], ebx
test ebx, ebx
je 0x4c877b
mov byte [ebx], 0
add dword [0x57d9fc], 5
mov eax, dword [0x57d9fc]
cmp byte [eax], 0
jne 0x4c877b
xor edx, edx
mov dword [0x57d9fc], edx
push dword [ebp]
push dword [0x57d9fc]
push edi
call fcn.004c8409
inc dword [0x57da10]
jmp 0x4c86e3
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e8453
Capabilities:
Query or enumerate registry value

Disassembly:
add esp, 0xfffffff8
cmp byte [0x581618], 0
je 0x4e8485
push 0x581618
call fcn.00541e38
pop ecx
push 1
push 0x581618
call fcn.0041c947
test eax, eax
jne 0x4e852c
mov byte [0x581618], 0
lea eax, [esp + 4]
push eax
push str.http_shellopen
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x4e84d4
mov dword [esp], 0x419
push esp
push 0x57a469
push 0x558ea8
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegQueryValueA
test eax, eax
jne 0x4e84cb
push 0x581618
push 0x57a469
call fcn.004e83d1
push dword [esp + 4]
call sub.ADVAPI32.dll_RegCloseKey
cmp byte [0x581618], 0
jne 0x4e852c
lea edx, [esp + 4]
push edx
push str.htmlfile_shellopen
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x4e852c
mov dword [esp], 0x419
push esp
push 0x57a469
push 0x558ec6
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegQueryValueA
test eax, eax
jne 0x4e8523
push 0x581618
push 0x57a469
call fcn.004e83d1
push dword [esp + 4]
call sub.ADVAPI32.dll_RegCloseKey
pop ecx
pop edx
ret

Function at 0x4e8627
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, dword [ebp + 8]
cmp byte [ebx], 0
je 0x4e864d
push ebx
call fcn.00541e38
pop ecx
push 1
push ebx
call fcn.0041c947
test eax, eax
jne 0x4e86c3
mov byte [ebx], 0
xor esi, esi
test esi, esi
jne 0x4e8668
lea eax, [ebp - 8]
push eax
push str.mailto_shellopen
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
jmp 0x4e867b
lea edx, [ebp - 8]
push edx
push str..sta_shellopen
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x4e86b3
mov dword [ebp - 4], 0x419
lea ecx, [ebp - 4]
push ecx
push 0x57a469
push str.command
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegQueryValueA
test eax, eax
jne 0x4e86ab
push ebx
push 0x57a469
call fcn.004e83d1
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegCloseKey
cmp byte [ebx], 0
jne 0x4e86c3
test esi, esi
jne 0x4e86c3
mov esi, 1
jmp 0x4e864f
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4