joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493dcc
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov ebp, 0x4d7f48
push 0
call fcn.004c92e8
pop ecx
mov esi, eax
mov ebx, eax
mov byte [0x4e8908], 0
cmp dword [0x4e5360], 0
je 0x493e0d
mov edi, 0x80000001
push 0x4d2534
lea eax, [esp + 0xc]
push eax
call sub.USER32.dll_wsprintfA
add esp, 8
jmp 0x493e23
mov edi, 0x80000000
push esi
push edi
mov esi, 0x4d2543
lea edi, [esp + 0x10]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
push esp
lea edx, [esp + 0xc]
push edx
push edi
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x493f7f
mov dword [esp + 4], 0x3e7
lea ecx, [esp + 4]
push ecx
push ebp
push 0x4d2549
mov eax, dword [esp + 0xc]
push eax
call sub.ADVAPI32.dll_RegQueryValueA
test eax, eax
jne 0x493f04
mov dword [esp + 4], 0x3e7
lea edx, [esp + 4]
push edx
push 0x4d832f
push 0x4d254f
mov ecx, dword [esp + 0xc]
push ecx
call sub.ADVAPI32.dll_RegQueryValueA
test eax, eax
jne 0x493ee6
push 2
push 0x4d832f
call fcn.0043e668
push 0x4d832f
push ebp
call fcn.00493cfc
test eax, eax
je 0x493ee6
mov eax, dword [esp]
push eax
call sub.ADVAPI32.dll_RegCloseKey
push 0
push 0x85
mov edx, dword [0x4e4a90]
push edx
call sub.USER32.dll_DeleteMenu
mov esi, 0x4e8908
mov edi, ebp
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, 1
jmp 0x493fcd
push 0x4d2555
mov edx, dword [esp + 4]
push edx
call sub.ADVAPI32.dll_RegDeleteKeyA
push 0x4d255b
mov ecx, dword [esp + 4]
push ecx
call sub.ADVAPI32.dll_RegDeleteKeyA
mov dword [esp + 4], 0x3e7
lea eax, [esp + 4]
push eax
push ebp
push 0x4d2561
mov edx, dword [esp + 0xc]
push edx
call sub.ADVAPI32.dll_RegQueryValueA
test eax, eax
jne 0x493f76
push 2
push ebp
call fcn.0043e668
push 0x2c
push ebp
call fcn.004bce0c
add esp, 8
test eax, eax
je 0x493f76
mov byte [eax], 0
inc eax
cmp byte [eax], 0
je 0x493f76
push ebp
call fcn.004c4ccc
pop ecx
mov ebx, eax
cmp esi, ebx
jl 0x493f74
cmp ebx, esi
jg 0x493f70
push esi
push ebx
call fcn.00493d7c
cmp eax, 7
jl 0x493f76
mov dword [0x4d2530], 0x442
mov ebx, esi
jmp 0x493f76
mov ebx, esi
jmp 0x493f76
mov ebx, esi
mov eax, dword [esp]
push eax
call sub.ADVAPI32.dll_RegCloseKey
push esp
lea edx, [esp + 0xc]
push edx
push edi
call sub.ADVAPI32.dll_RegCreateKeyA
test eax, eax
jne 0x493fcb
push esi
push ebx
push str._ld__ld
push ebp
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 1
push ebp
call fcn.0043e484
push ebp
call fcn.004bceac
pop ecx
inc eax
push eax
push ebp
push 1
push str.date
mov ecx, dword [esp + 0x10]
push ecx
call sub.ADVAPI32.dll_RegSetValueA
mov eax, dword [esp]
push eax
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x493fd8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp dword [0x4e5360], 0
je 0x494008
mov ebx, 0x80000001
push str.SoftwaremIRC
lea eax, [ebp - 0x18]
push eax
call sub.USER32.dll_wsprintfA
add esp, 8
jmp 0x49401d
mov ebx, 0x80000000
push esi
push edi
mov esi, 0x4d2585
lea edi, [ebp - 0x18]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 0x18]
push ecx
push ebx
call sub.ADVAPI32.dll_RegCreateKeyA
test eax, eax
jne 0x494074
push edi
call fcn.004bceac
pop ecx
inc eax
push eax
push edi
push 1
push str.name
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegSetValueA
push 1
push esi
call fcn.0043e484
push esi
call fcn.004bceac
pop ecx
inc eax
push eax
push esi
push 1
push str.code
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.dll_RegSetValueA
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.dll_RegCloseKey
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x494080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
cmp byte [0x4e8808], 0
je 0x4940b5
push 0x4e8808
call fcn.004c408c
pop ecx
push 1
push 0x4e8808
call fcn.0040abec
test eax, eax
jne 0x494222
mov byte [0x4e8808], 0
lea eax, [esp + 4]
push eax
push str.http_shellopen
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x494165
mov dword [esp], 0x419
push esp
push 0x4e3d41
push 0x4d25a8
mov edx, dword [esp + 0x10]
push edx
call sub.ADVAPI32.dll_RegQueryValueA
test eax, eax
jne 0x49415b
mov ebx, 0x4e3d41
cmp byte [ebx], 0x22
jne 0x4940fc
inc ebx
push 0x22
push ebx
call fcn.004bce0c
add esp, 8
test eax, eax
je 0x49410e
mov byte [eax], 0
push 0x20
push ebx
call fcn.004bd108
add esp, 8
test eax, eax
je 0x494120
mov byte [eax], 0
push 1
push ebx
call fcn.0040abec
test eax, eax
je 0x49415b
mov esi, 0x4e8808
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x4e8808
call fcn.004c408c
pop ecx
mov eax, dword [esp + 4]
push eax
call sub.ADVAPI32.dll_RegCloseKey
cmp byte [0x4e8808], 0
jne 0x494222
lea edx, [esp + 4]
push edx
push str.htmlfile_shellopen
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x494222
mov dword [esp], 0x419
push esp
push 0x4e3d41
push 0x4d25c6
mov ecx, dword [esp + 0x10]
push ecx
call sub.ADVAPI32.dll_RegQueryValueA
test eax, eax
jne 0x494218
mov ebx, 0x4e3d41
cmp byte [ebx], 0x22
jne 0x4941b9
inc ebx
push 0x22
push ebx
call fcn.004bce0c
add esp, 8
test eax, eax
je 0x4941cb
mov byte [eax], 0
push 0x20
push ebx
call fcn.004bd108
add esp, 8
test eax, eax
je 0x4941dd
mov byte [eax], 0
push 1
push ebx
call fcn.0040abec
test eax, eax
je 0x494218
mov esi, 0x4e8808
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x4e8808
call fcn.004c408c
pop ecx
mov eax, dword [esp + 4]
push eax
call sub.ADVAPI32.dll_RegCloseKey
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x49431c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
cmp byte [ebx], 0
je 0x494347
push ebx
call fcn.004c408c
pop ecx
push 1
push ebx
call fcn.0040abec
test eax, eax
jne 0x494438
mov byte [ebx], 0
xor esi, esi
test esi, esi
jne 0x494362
lea eax, [ebp - 8]
push eax
push str.mailto_shellopen
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
jmp 0x494375
lea edx, [ebp - 8]
push edx
push str..sta_shellopen
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x494425
mov dword [ebp - 4], 0x419
lea ecx, [ebp - 4]
push ecx
push 0x4e3d41
push str.command
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_RegQueryValueA
test eax, eax
jne 0x49441c
mov edi, 0x4e3d41
cmp byte [edi], 0x22
jne 0x4943aa
inc edi
push 0x22
push edi
call fcn.004bce0c
add esp, 8
test eax, eax
je 0x4943bc
mov byte [eax], 0
push esi
push edi
mov esi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push ebx
call fcn.004c408c
pop ecx
push 0x5c
push ebx
call fcn.004bd108
add esp, 8
mov edi, eax
test edi, edi
je 0x49441c
push 0x2e
push edi
call fcn.004bce0c
add esp, 8
mov edi, eax
test edi, edi
je 0x49441c
push 0x20
push edi
call fcn.004bce0c
add esp, 8
mov edi, eax
test edi, edi
je 0x49441c
mov byte [edi], 0
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_RegCloseKey
cmp byte [ebx], 0
jne 0x494438
test esi, esi
jne 0x494438
mov esi, 1
jmp 0x494349
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4961f4
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ebx, 0x4e89b0
cmp byte [eax + 1], 0
jne 0x49629b
mov dl, byte [eax]
cmp dl, 0x2a
jne 0x496220
mov eax, 1
jmp 0x496404
cmp dl, 0x23
jne 0x496240
push esi
call fcn.0046421c
test al, al
je 0x496239
mov eax, 1
jmp 0x496404
xor eax, eax
jmp 0x496404
cmp byte [eax], 0x3f
jne 0x496260
push esi
call fcn.0046421c
test al, al
jne 0x496259
mov eax, 1
jmp 0x496404
xor eax, eax
jmp 0x496404
cmp byte [eax], 0x3d
jne 0x496280
push esi
call fcn.0046421c
test al, al
jne 0x496279
mov eax, 1
jmp 0x496404
xor eax, eax
jmp 0x496404
cmp byte [eax], 0x40
jne 0x49629b
cmp byte [esi], 0x40
jne 0x496294
mov eax, 1
jmp 0x496404
xor eax, eax
jmp 0x496404
mov dword [ebx], eax
mov edi, dword [ebx]
cmp byte [edi], 0x25
jne 0x4963f7
push 0x2c
push edi
call fcn.004bce0c
add esp, 8
test eax, eax
jne 0x4963f7
push 0x4e973c
mov eax, dword [ebx]
push eax
call fcn.004b53a4
test eax, eax
je 0x4962d7
mov dword [ebx], 0x4e973c
jmp 0x4963f7
xor eax, eax
jmp 0x496404
inc dword [ebx]
mov edx, dword [ebx]
cmp byte [edx], 0x20
je 0x4962e0
mov ecx, dword [ebx]
cmp byte [ecx], 0
jne 0x4962f7
xor eax, eax
jmp 0x496404
push 0x2c
mov edx, dword [ebx]
push edx
call fcn.004bce0c
add esp, 8
mov edi, eax
mov dword [0x4e89b4], edi
test edi, edi
je 0x496313
mov byte [edi], 0
push 0x20
mov eax, dword [ebx]
push eax
call fcn.004bce0c
add esp, 8
mov edi, eax
mov dword [0x4e89b8], edi
test edi, edi
je 0x49632f
mov byte [edi], 0
mov eax, dword [ebx]
cmp byte [eax], 0x25
jne 0x496351
push 0x4e9b23
push eax
call fcn.004b53a4
test eax, eax
je 0x49634d
mov dword [ebx], 0x4e9b23
jmp 0x496351
xor edx, edx
mov dword [ebx], edx
mov eax, dword [ebx]
test eax, eax
je 0x4963eb
cmp byte [eax], 0
je 0x4963eb
cmp byte [eax + 1], 0
jne 0x4963d4
cmp byte [eax], 0x2a
jne 0x496379
mov eax, 1
jmp 0x496404
mov edx, dword [ebx]
cmp byte [edx], 0x23
jne 0x496391
push esi
call fcn.0046421c
test al, al
je 0x496391
mov eax, 1
jmp 0x496404
mov edx, dword [ebx]
cmp byte [edx], 0x3f
jne 0x4963a9
push esi
call fcn.0046421c
test al, al
jne 0x4963a9
mov eax, 1
jmp 0x496404
mov edx, dword [ebx]
cmp byte [edx], 0x3d
jne 0x4963c1
push esi
call fcn.0046421c
test al, al
jne 0x4963c1
mov eax, 1
jmp 0x496404
mov edx, dword [ebx]
cmp byte [edx], 0x40
jne 0x4963d4
cmp byte [esi], 0x40
jne 0x4963d4
mov eax, 1
jmp 0x496404
mov edx, dword [ebx]
push edx
push esi
call fcn.004bcfe4
add esp, 8
test eax, eax
jne 0x4963eb
mov eax, 1
jmp 0x496404
mov eax, dword [0x4e89b4]
test eax, eax
je 0x496402
inc eax
mov dword [ebx], eax
mov edx, dword [ebx]
cmp byte [edx], 0
jne 0x4962e2
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x49f0cc
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x3fc], 1
push 0
call fcn.004c92e8
pop ecx
mov dword [ebx + 0x438], eax
lea eax, [ebx + 0xcc]
push eax
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x49f163
cmp dword [0x4cdf84], 0
je 0x49f11f
cmp dword [0x4cdf80], 0
je 0x49f11f
cmp dword [0x4cdf7c], 0
jne 0x49f163
cmp dword [ebx + 0x428], 0
je 0x49f149
push 8
push 0
lea edx, [ebx + 0xcc]
push edx
lea ecx, [ebx + 4]
push ecx
mov eax, dword [ebx]
push eax
call fcn.00437f98
mov eax, 1
jmp 0x49f2b4
push ebx
push 0
push 0x138e
call fcn.0040a8fc
push eax
call fcn.0049e97c
xor eax, eax
jmp 0x49f2b4
cmp dword [0x4cdf84], 0
je 0x49f1cb
cmp dword [0x4cdf80], 0
je 0x49f1cb
push 0
push 0x138f
call fcn.0040a8fc
push eax
push 1
push 0
push 1
push 1
push ebx
call fcn.004aebb8
cmp dword [ebx + 0x400], 0
jne 0x49f1a4
call fcn.0049e744
mov dword [ebx + 0x400], eax
mov edx, dword [ebx + 0x400]
push edx
push 0
mov cx, word [ebx + 0x40c]
push ecx
add ebx, 0xcc
push ebx
call fcn.00448738
mov eax, 1
jmp 0x49f2b4
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov word [ebp - 0x12], 4
mov word [ebp - 0x14], 2
lea esi, [ebp - 0x1c]
push 0x10
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.004bcd2c
add esp, 0xc
mov word [ebp - 0x2c], 2
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
push eax
lea edx, [ebp - 0x28]
push edx
call fcn.004bccbc
add esp, 0xc
mov cx, word [ebx + 0x40c]
push ecx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x2a], ax
mov eax, dword [esi + 0xc]
mov edx, dword [eax]
mov ecx, dword [edx]
mov dword [ebp - 0x28], ecx
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [ebx + 0x43c], eax
cmp eax, 0xffffffff
jne 0x49f25f
push ebx
push 0
push 0x1390
call fcn.0040a8fc
push eax
call fcn.0049e97c
xor eax, eax
jmp 0x49f2b4
push 0x10
push 0x414
mov edx, dword [0x4d429c]
push edx
mov ecx, dword [ebx + 0x43c]
push ecx
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [ebx + 0x43c]
push edx
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x49f2b2
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x49f2b2
push ebx
push 0
push 0x1391
call fcn.0040a8fc
push eax
call fcn.0049e97c
xor eax, eax
jmp 0x49f2b4
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49fe0c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x49fe21
xor eax, eax
jmp 0x49ffec
cmp dword [ebx + 0x3fc], 2
je 0x49fe31
xor eax, eax
jmp 0x49ffec
cmp dword [0x4d2d0c], 0
jne 0x49fe4f
mov edx, dword [ebx + 0x408]
cmp edx, dword [ebx + 0x410]
jae 0x49fe4f
xor eax, eax
jmp 0x49ffec
push 0
call fcn.004c92e8
pop ecx
mov dword [ebx + 0x438], eax
mov edx, dword [ebx + 0x3f8]
push edx
call fcn.004c1390
pop ecx
mov dword [ebp - 4], eax
mov ecx, dword [ebx + 0x404]
push ecx
push 0x4eb8f1
mov eax, dword [ebx + 0x3f8]
push eax
call fcn.004c0cd4
add esp, 0xc
mov esi, eax
test esi, esi
jge 0x49fea8
push ebx
push 0
push 0x1398
call fcn.0040a8fc
push eax
call fcn.0049e97c
xor eax, eax
jmp 0x49ffec
test esi, esi
jne 0x49feb3
xor eax, eax
jmp 0x49ffec
push 0
push esi
push 0x4eb8f1
mov edx, dword [ebx + 0x43c]
push edx
call sub.WSOCK32.dll_send
mov edi, eax
test edi, edi
jge 0x49ff30
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x49fee0
cmp eax, 0x2734
jne 0x49ff16
push 0
mov eax, dword [ebp - 4]
push eax
mov edx, dword [ebx + 0x3f8]
push edx
call fcn.004c0c38
add esp, 0xc
push 0x23
push 0x417
mov ecx, dword [0x4d429c]
push ecx
mov eax, dword [ebx + 0x43c]
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
xor eax, eax
jmp 0x49ffec
push ebx
push 0
push 0x139b
call fcn.0040a8fc
push eax
call fcn.0049e97c
xor eax, eax
jmp 0x49ffec
cmp esi, edi
jle 0x49ff4d
push 0
mov edx, dword [ebp - 4]
add edx, edi
push edx
mov ecx, dword [ebx + 0x3f8]
push ecx
call fcn.004c0c38
add esp, 0xc
mov esi, edi
add dword [ebx + 0x410], esi
push ebx
call fcn.0049fc84
mov eax, dword [0x4d2d14]
test eax, eax
je 0x49ffea
mov edx, dword [ebx + 0x410]
sub edx, dword [ebx + 0x408]
cmp eax, edx
jbe 0x49ffea
inc dword [ebx + 0x42c]
cmp dword [ebx + 0x42c], 0x14
jge 0x49ffa2
push 2
mov ecx, dword [ebx + 0x43c]
push ecx
push 0x417
mov eax, dword [0x4d429c]
push eax
call sub.USER32.dll_PostMessageA
xor eax, eax
jmp 0x49ffec
cmp dword [0x4d2d08], 0
jne 0x49ffe6
push 0
push 1
push 0x80
mov edx, dword [0x4d429c]
push edx
call sub.USER32.dll_SetTimer
mov esi, eax
mov dword [0x4d2d08], esi
test esi, esi
jne 0x49ffe6
push 2
mov eax, dword [ebx + 0x43c]
push eax
push 0x417
mov edx, dword [0x4d429c]
push edx
call sub.USER32.dll_PostMessageA
xor eax, eax
jmp 0x49ffec
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x49fff4
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4a0008
xor eax, eax
jmp 0x4a0190
cmp dword [ebx + 0x3fc], 2
je 0x4a0018
xor eax, eax
jmp 0x4a0190
push 0
call fcn.004c92e8
pop ecx
mov dword [ebx + 0x438], eax
push 0
push 4
lea edx, [ebp - 4]
push edx
mov ecx, dword [ebx + 0x43c]
push ecx
call sub.WSOCK32.dll_recv
cmp eax, 4
je 0x4a00a2
test eax, eax
jne 0x4a0050
push ebx
call fcn.004a01e4
xor eax, eax
jmp 0x4a0190
test eax, eax
jge 0x4a00a2
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4a0067
cmp eax, 0x2734
jne 0x4a0088
push 0x23
push 0x417
mov edx, dword [0x4d429c]
push edx
mov ecx, dword [ebx + 0x43c]
push ecx
call sub.WSOCK32.dll_WSAAsyncSelect
xor eax, eax
jmp 0x4a0190
push ebx
push 0
push 0x139b
call fcn.0040a8fc
push eax
call fcn.0049e97c
xor eax, eax
jmp 0x4a0190
mov edx, dword [ebp - 4]
push edx
call sub.WSOCK32.dll_ntohl
mov dword [ebx + 0x408], eax
push ebx
call fcn.0049fc84
mov eax, dword [ebx + 0x418]
cmp eax, dword [ebx + 0x408]
ja 0x4a00d8
mov dword [ebx + 0x408], eax
push ebx
call fcn.004a01e4
xor eax, eax
jmp 0x4a0190
mov edx, dword [ebx + 0x410]
cmp edx, dword [ebx + 0x418]
jae 0x4a018e
mov ecx, dword [ebx + 0x408]
cmp ecx, dword [ebx + 0x410]
jae 0x4a0119
cmp dword [0x4d2d0c], 0
je 0x4a018e
mov eax, dword [ebx + 0x410]
sub eax, dword [ebx + 0x404]
cmp eax, dword [ebx + 0x408]
ja 0x4a018e
inc dword [ebx + 0x42c]
cmp dword [ebx + 0x42c], 0x14
jge 0x4a0146
push 2
mov edx, dword [ebx + 0x43c]
push edx
push 0x417
mov ecx, dword [0x4d429c]
push ecx
call sub.USER32.dll_PostMessageA
xor eax, eax
jmp 0x4a0190
cmp dword [0x4d2d08], 0
jne 0x4a018a
push 0
push 1
push 0x80
mov edx, dword [0x4d429c]
push edx
call sub.USER32.dll_SetTimer
mov esi, eax
mov dword [0x4d2d08], esi
test esi, esi
jne 0x4a018a
push 2
mov eax, dword [ebx + 0x43c]
push eax
push 0x417
mov edx, dword [0x4d429c]
push edx
call sub.USER32.dll_PostMessageA
xor eax, eax
jmp 0x4a0190
xor eax, eax
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x4a0588
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, 0x4d2ea0
mov ebp, 0x4e2a53
xor ebx, ebx
push str.mirc.ini
push 0x3e7
push ebp
lea eax, [esi + 0xe]
push eax
lea edx, [esi + 9]
push edx
push esi
call sub.KERNEL32.dll_GetPrivateProfileStringA
test eax, eax
jbe 0x4a05ba
lea edi, [esi + 0x12]
jmp 0x4a05e1
push str.mirc.ini
push 0x3e7
push ebp
lea eax, [esi + 0x23]
push eax
lea edx, [esi + 0x1f]
push edx
lea ecx, [esi + 0x16]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
test eax, eax
jbe 0x4a05df
lea edi, [esi + 0x27]
jmp 0x4a05e1
xor edi, edi
test edi, edi
je 0x4a0677
push 0x4ec8f4
push 0
push 0
lea eax, [esi + 0x2a]
push eax
call fcn.0045cffc
push ebx
push edi
lea edx, [esi + 0x33]
push edx
push ebp
call sub.USER32.dll_wsprintfA
add esp, 0x10
push str.mirc.ini
push 0x3e7
push 0x4e266c
lea ecx, [esi + 0x42]
push ecx
push ebp
lea eax, [esi + 0x39]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x4e266c], 0
je 0x4a0655
push ebx
lea edx, [esi + 0x46]
push edx
push ebp
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x4ec8f4
push 0x4e266c
push ebp
lea ecx, [esi + 0x4b]
push ecx
call fcn.0045cffc
inc ebx
jmp 0x4a05fb
push 0x4ec8f4
push 0
push 0
push 0
call fcn.0045cffc
push str.mirc.ini
push 0
push 0
lea eax, [esi + 0x54]
push eax
call fcn.0045cffc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a3768
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x65]
push eax
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4a378f
mov eax, 3
jmp 0x4a3854
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov word [ebp - 0x12], 4
mov word [ebp - 0x14], 2
lea esi, [ebp - 0x1c]
push 0x10
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.004bcd2c
add esp, 0xc
mov word [ebp - 0x2c], 2
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
push eax
lea edx, [ebp - 0x28]
push edx
call fcn.004bccbc
add esp, 0xc
mov cx, word [ebx + 0xca]
push ecx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x2a], ax
mov eax, dword [esi + 0xc]
mov edx, dword [eax]
mov ecx, dword [edx]
mov dword [ebp - 0x28], ecx
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov esi, eax
mov dword [ebx + 0x114], esi
cmp esi, 0xffffffff
jne 0x4a3815
mov eax, 1
jmp 0x4a3854
push 0x10
push 0x439
mov edx, dword [0x4d429c]
push edx
push esi
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea ecx, [ebp - 0x2c]
push ecx
mov eax, dword [ebx + 0x114]
push eax
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x4a3852
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4a3852
mov eax, 2
jmp 0x4a3854
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a6af4
Capabilities:
Hide graphical window
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
call fcn.004a6a6c
test eax, eax
je 0x4a6bb3
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0
mov edx, dword [ebp + 8]
push edx
push 0
push 0
push 0
push 0
push 0x42000000
push 0x4d37b8
push str.mIRCSB32
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
mov dword [0x4d3794], ebx
test ebx, ebx
je 0x4a6bb3
mov dword [0x4d365c], ebx
push str.mirc.ini
push 0x3e7
push 0x4e4b90
push 0x4d37d3
push str.switchbar
push 0x4d37bc
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x4e4b90], 0
je 0x4a6b8d
push 0x4e266c
push 0x4e4b90
call fcn.0040b1d4
push 0
push 0x4e4b90
push 0x4d365c
call fcn.0040c160
cmp dword [0x4d3774], 0
je 0x4a6ba5
push 5
mov eax, dword [0x4d3794]
push eax
call sub.USER32.dll_ShowWindow
jmp 0x4a6bb3
push 0
mov edx, dword [0x4d3794]
push edx
call sub.USER32.dll_ShowWindow
pop ebx
pop ebp
ret 8