joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41deec
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
mov ebx, 0x54c094
mov esi, 0x56bbdc
push str.mirc.ini
push 0x180
push esi
lea eax, [ebx + 0xe]
push eax
lea edx, [ebx + 8]
push edx
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x41df33
lea ecx, [ebx + 0x13]
push ecx
push esi
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x41df33
mov dword [0x54bf7c], 1
jmp 0x41df3a
xor eax, eax
mov dword [0x54bf7c], eax
push str.mirc.ini
push 0x180
push esi
lea edx, [ebx + 0x25]
push edx
lea ecx, [ebx + 0x1f]
push ecx
lea eax, [ebx + 0x17]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
push esi
call fcn.00542dbc
pop ecx
mov dword [0x54bf80], eax
mov eax, dword [0x54bf80]
cmp eax, 1
jl 0x41df71
cmp eax, 0x14
jle 0x41df7b
mov dword [0x54bf80], 3
push str.mirc.ini
push 0x180
push esi
lea edx, [ebx + 0x38]
push edx
lea ecx, [ebx + 0x30]
push ecx
lea eax, [ebx + 0x28]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
push esi
call fcn.00542dbc
pop ecx
mov dword [0x54bf84], eax
mov eax, dword [0x54bf84]
test eax, eax
jl 0x41dfb1
cmp eax, 0xf
jle 0x41dfbb
mov dword [0x54bf84], 4
push str.mirc.ini
push 0x180
push esi
lea edx, [ebx + 0x4b]
push edx
lea ecx, [ebx + 0x43]
push ecx
lea eax, [ebx + 0x3b]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
push esi
call fcn.00542dbc
pop ecx
mov dword [0x54bf88], eax
mov eax, dword [0x54bf88]
test eax, eax
jl 0x41dfef
dec eax
jle 0x41dff7
xor edx, edx
mov dword [0x54bf88], edx
push str.mirc.ini
push 0x104
push 0x54bf90
lea ecx, [ebx + 0x5f]
push ecx
lea eax, [ebx + 0x56]
push eax
lea edx, [ebx + 0x4e]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x54bf90
call fcn.0041cb6c
push 1
push 0x54bf90
call fcn.0041c947
test eax, eax
jne 0x41e038
mov byte [0x54bf90], 0
call fcn.0041e139
pop esi
pop ebx
ret
Function at 0x41efbd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x20]
mov esi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0xc]
cmp dword [ebp + 0x18], 0xffffffff
je 0x41f159
cmp dword [ebp + 0x14], 0
je 0x41f047
cmp dword [ebp + 0x10], 0
jne 0x41f047
push 5
push 0x84
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
lea eax, [ebp - 0x1c]
push eax
push 0x84
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_GetWindowRect
push 2
lea edx, [ebp - 0x1c]
push edx
push dword [ebp + 8]
push 0
call sub.USER32.dll_MapWindowPoints
mov eax, dword [ebp - 0x1c]
mov esi, eax
add esi, 0xfffffffb
mov edx, dword [ebp - 0x18]
mov edi, edx
add edi, 0xfffffff6
mov ecx, dword [ebp - 0x14]
sub ecx, eax
add ecx, 0xa
mov dword [ebp + 0x24], ecx
mov eax, dword [ebp - 0x10]
sub eax, edx
add eax, 0x13
mov dword [ebp + 0x28], eax
push 0x10
call sub.USER32.dll_GetSysColor
push eax
push 1
push 0
call sub.GDI32.dll_CreatePen
mov dword [ebp - 4], eax
push dword [ebp - 4]
push ebx
call sub.GDI32.dll_SelectObject
mov dword [ebp - 0xc], eax
push 0
lea edx, [edi - 1]
push edx
lea eax, [esi - 1]
push eax
push ebx
call sub.GDI32.dll_MoveToEx
lea edx, [edi - 1]
push edx
mov ecx, dword [ebp + 0x24]
add ecx, esi
push ecx
push ebx
call sub.GDI32.dll_LineTo
mov eax, dword [ebp + 0x28]
add eax, edi
push eax
mov edx, dword [ebp + 0x24]
add edx, esi
push edx
push ebx
call sub.GDI32.dll_LineTo
mov ecx, dword [ebp + 0x28]
add ecx, edi
push ecx
lea eax, [esi - 1]
push eax
push ebx
call sub.GDI32.dll_LineTo
lea edx, [edi - 1]
push edx
lea ecx, [esi - 1]
push ecx
push ebx
call sub.GDI32.dll_LineTo
push dword [ebp - 0xc]
push ebx
call sub.GDI32.dll_SelectObject
push dword [ebp - 4]
call sub.GDI32.dll_DeleteObject
push 0x14
call sub.USER32.dll_GetSysColor
push eax
push 1
push 0
call sub.GDI32.dll_CreatePen
mov dword [ebp - 8], eax
push dword [ebp - 8]
push ebx
call sub.GDI32.dll_SelectObject
mov dword [ebp - 0xc], eax
push 0
lea eax, [edi - 1]
push eax
mov edx, dword [ebp + 0x24]
add edx, esi
inc edx
push edx
push ebx
call sub.GDI32.dll_MoveToEx
mov ecx, dword [ebp + 0x28]
add ecx, edi
inc ecx
push ecx
mov eax, dword [ebp + 0x24]
add eax, esi
inc eax
push eax
push ebx
call sub.GDI32.dll_LineTo
mov edx, dword [ebp + 0x28]
add edx, edi
inc edx
push edx
lea ecx, [esi - 1]
push ecx
push ebx
call sub.GDI32.dll_LineTo
cmp dword [ebp + 0x10], 0
jne 0x41f148
push 0
mov eax, dword [ebp + 0x28]
add eax, edi
push eax
push esi
push ebx
call sub.GDI32.dll_MoveToEx
push edi
push esi
push ebx
call sub.GDI32.dll_LineTo
push edi
add esi, dword [ebp + 0x24]
push esi
push ebx
call sub.GDI32.dll_LineTo
push dword [ebp - 0xc]
push ebx
call sub.GDI32.dll_SelectObject
push dword [ebp - 8]
call sub.GDI32.dll_DeleteObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
Function at 0x41f77b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], eax
push 2
push dword [ebp + 0x10]
mov ebx, dword [0x55b3c4]
push ebx
call sub.KERNEL32.dll_FindResourceA
push eax
push ebx
call sub.KERNEL32.dll_LoadResource
test eax, eax
je 0x41f92e
push eax
call sub.KERNEL32.dll_LockResource
mov ebx, eax
test ebx, ebx
je 0x41f92e
push dword [0x55b3c8]
call sub.USER32.dll_GetDC
mov edi, eax
test edi, edi
je 0x41f92e
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x41f7e2
mov esi, eax
jmp 0x41f7ed
mov cx, word [ebx + 0xe]
mov esi, 1
shl esi, cl
test esi, esi
jle 0x41f8bc
cmp esi, 0x100
jg 0x41f8bc
lea eax, [esi - 1]
shl eax, 2
add eax, 8
push eax
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41f8bc
push dword [ebp - 4]
call sub.KERNEL32.dll_GlobalLock
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41f899
mov edx, dword [ebp - 8]
mov word [edx + 2], si
mov ecx, dword [ebp - 8]
mov word [ecx], 0x300
lea edx, [ebx + 0x28]
xor eax, eax
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
lea eax, [ecx + 4]
add edx, 2
mov dword [ebp - 0x14], edx
cmp esi, dword [ebp - 0x10]
jle 0x41f884
mov ecx, dword [ebp - 0x14]
mov dl, byte [ecx]
mov byte [eax], dl
mov ecx, dword [ebp - 0x14]
mov dl, byte [ecx - 1]
mov byte [eax + 1], dl
mov ecx, dword [ebp - 0x14]
mov dl, byte [ecx - 2]
mov byte [eax + 2], dl
mov byte [eax + 3], 0
inc dword [ebp - 0x10]
add eax, 4
add dword [ebp - 0x14], 4
cmp esi, dword [ebp - 0x10]
jg 0x41f858
push dword [ebp - 8]
call sub.GDI32.dll_CreatePalette
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push dword [ebp - 4]
call sub.KERNEL32.dll_GlobalUnlock
push dword [ebp - 4]
call sub.KERNEL32.dll_GlobalFree
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x41f8bc
push 0
push eax
push edi
call sub.GDI32.dll_SelectPalette
mov dword [ebp - 0xc], eax
push edi
call sub.GDI32.dll_RealizePalette
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0
jne 0x41f8ee
push 0xf
call sub.GDI32.dll_GetStockObject
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x41f8ee
push 0
mov edx, dword [ebp + 0xc]
push dword [edx]
push edi
call sub.GDI32.dll_SelectPalette
mov dword [ebp - 0xc], eax
push edi
call sub.GDI32.dll_RealizePalette
movzx ecx, word [ebx]
add ecx, ebx
shl esi, 2
movzx eax, si
add ecx, eax
mov esi, ecx
push 0
push ebx
push esi
push 4
push ebx
push edi
call sub.GDI32.dll_CreateDIBitmap
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], 0
je 0x41f922
push 0
push dword [ebp - 0xc]
push edi
call sub.GDI32.dll_SelectPalette
push edi
push dword [0x55b3c8]
call sub.USER32.dll_ReleaseDC
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41fdd1
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0
jne 0x41fdea
xor eax, eax
jmp 0x41ff99
mov eax, dword [ebx + 0xc]
cmp eax, dword [ebp + 0xc]
jle 0x41fdf5
mov dword [ebp + 0xc], eax
mov edx, dword [ebx + 0x10]
cmp edx, dword [ebp + 0x10]
jle 0x41fe00
mov dword [ebp + 0x10], edx
cmp ebx, 0x55a840
jne 0x41fe0e
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0xc], 1
jl 0x41fe53
cmp dword [ebp + 0x10], 1
jl 0x41fe53
lea ecx, [ebp - 0x30]
push ecx
push 0x18
push dword [ebx + 4]
call sub.GDI32.dll_GetObjectA
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp + 0xc]
jne 0x41fe42
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp + 0x10]
jne 0x41fe42
mov eax, 1
jmp 0x41ff99
push dword [0x55b3c8]
call sub.USER32.dll_GetDC
mov edi, eax
test edi, edi
jne 0x41fe89
mov eax, dword [ebx + 4]
test eax, eax
je 0x41fe60
push eax
call sub.GDI32.dll_DeleteObject
xor edx, edx
mov dword [ebx + 4], edx
mov eax, dword [ebx + 8]
test eax, eax
je 0x41fe72
push eax
call sub.GDI32.dll_DeleteObject
xor edx, edx
mov dword [ebx + 8], edx
mov byte [ebx + 0x14], 0
push 0
call fcn.0041c2be
xor eax, eax
jmp 0x41ff99
push edi
call sub.GDI32.dll_CreateCompatibleDC
mov esi, eax
test esi, esi
jne 0x41fea3
push edi
push dword [0x55b3c8]
call sub.USER32.dll_ReleaseDC
jmp 0x41fe53
push edi
call sub.GDI32.dll_CreateCompatibleDC
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41fec6
push esi
call sub.GDI32.dll_DeleteDC
push edi
push dword [0x55b3c8]
call sub.USER32.dll_ReleaseDC
jmp 0x41fe53
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call sub.GDI32.dll_CreateCompatibleBitmap
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x41fefa
push dword [ebp - 0x10]
call sub.GDI32.dll_DeleteDC
push esi
call sub.GDI32.dll_DeleteDC
push edi
push dword [0x55b3c8]
call sub.USER32.dll_ReleaseDC
jmp 0x41fe53
push dword [ebp - 0xc]
push esi
call sub.GDI32.dll_SelectObject
mov dword [ebp - 4], eax
push dword [ebx + 4]
push dword [ebp - 0x10]
call sub.GDI32.dll_SelectObject
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor edx, edx
mov dword [ebp - 0x14], edx
push 0xcc0020
push 0
push 0
push dword [ebp - 0x10]
push dword [ebx + 0x10]
push dword [ebx + 0xc]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push esi
call sub.GDI32.dll_BitBlt
mov ecx, dword [ebx + 0xc]
add dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jl 0x41ff1e
mov edx, dword [ebx + 0x10]
add dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp + 0x10]
jl 0x41ff19
push dword [ebp - 4]
push esi
call sub.GDI32.dll_SelectObject
push dword [ebp - 8]
push dword [ebp - 0x10]
call sub.GDI32.dll_SelectObject
push dword [ebp - 0x10]
call sub.GDI32.dll_DeleteDC
push esi
call sub.GDI32.dll_DeleteDC
push edi
push dword [0x55b3c8]
call sub.USER32.dll_ReleaseDC
push dword [ebx + 4]
call sub.GDI32.dll_DeleteObject
mov eax, dword [ebp - 0xc]
mov dword [ebx + 4], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4207a1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00516145
mov esi, eax
test esi, esi
je 0x4208ea
mov eax, dword [esi + 0x61c]
test eax, eax
je 0x420889
mov ebx, eax
test ebx, ebx
je 0x4207db
cmp dword [ebx + 0x1c], 1
je 0x4207db
mov ebx, dword [ebx + 0x34]
test ebx, ebx
jne 0x4207ce
test ebx, ebx
je 0x420856
cmp dword [ebx + 0x34], 0
je 0x420856
mov eax, dword [ebx + 0x34]
cmp dword [eax], 0
je 0x420856
xor edx, edx
mov dword [ebx + 0x1c], edx
mov ebx, dword [ebx + 0x34]
mov dword [ebx + 0x1c], 1
push dword [ebx]
push 0
push 0xc
push dword [esi + 0x758]
call sub.USER32.dll_SendMessageA
push dword [ebx]
call fcn.005395b8
pop ecx
push eax
push dword [ebx]
call fcn.005395b8
pop ecx
push eax
push 0xb1
push 0x427
push dword [esi]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
push 0x427
push dword [esi]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SendMessageA
jmp 0x4208ea
mov eax, dword [esi + 0x61c]
cmp ebx, dword [eax + 0x38]
jne 0x420889
mov ebx, eax
test ebx, ebx
je 0x420873
xor eax, eax
mov dword [ebx + 0x1c], eax
mov ebx, dword [ebx + 0x34]
test ebx, ebx
jne 0x420867
push 0x54c34e
push 0
push 0xc
push dword [esi + 0x758]
call sub.USER32.dll_SendMessageA
jmp 0x4208ea
push 0x57c887
push 0x3e6
push 0xd
push dword [esi + 0x758]
call sub.USER32.dll_SendMessageA
push 0x54c352
push 0x57c887
call fcn.005398cc
add esp, 8
test eax, eax
je 0x4208b9
mov byte [eax], 0
cmp byte [0x57c887], 0
je 0x4208cf
push 0x57c887
push edi
call fcn.00420553
jmp 0x4208d6
push 0
call fcn.0041c2be
push 0x54c356
push 0
push 0xc
push dword [esi + 0x758]
call sub.USER32.dll_SendMessageA
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4208f1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00516145
mov ebx, eax
test ebx, ebx
je 0x420970
mov eax, dword [ebx + 0x61c]
test eax, eax
je 0x42091c
cmp dword [eax + 0x1c], 0
jne 0x420970
mov eax, dword [eax + 0x34]
test eax, eax
jne 0x42090f
push 0x57c887
push 0x3e6
push 0xd
push dword [ebx + 0x758]
call sub.USER32.dll_SendMessageA
push 0x54c35a
push 0x57c887
call fcn.005398cc
add esp, 8
test eax, eax
je 0x42094c
mov byte [eax], 0
cmp byte [0x57c887], 0
je 0x420970
push 0x57c887
push esi
call fcn.00420553
mov edx, dword [ebx + 0x61c]
mov ecx, dword [edx + 0x38]
mov dword [ecx + 0x1c], 1
pop esi
pop ebx
pop ebp
ret 4
Function at 0x423570
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, 0x57943f
xor ebp, ebp
push ebp
push 0x54c738
lea eax, [esp + 8]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x54c538
push 0x3e7
push edi
push 0x54c747
lea edx, [esp + 0x10]
push edx
push 0x54c73d
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [edi], 0
je 0x423672
push 0x20
push edi
call fcn.00539518
add esp, 8
mov esi, eax
test esi, esi
je 0x4235dd
mov byte [esi], 0
inc esi
jmp 0x4235d1
inc esi
cmp byte [esi], 0x20
je 0x4235d0
cmp byte [esi], 0
jne 0x4235dd
xor esi, esi
test esi, esi
jne 0x4235eb
mov esi, 0x54c74b
jmp 0x4235eb
mov byte [ebx], 0x20
push 0x2c
push edi
call fcn.00539518
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4235e8
jmp 0x423601
mov byte [ebx], 0x27
push 0x22
push esi
call fcn.00539518
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4235fe
cmp byte [esi], 0
je 0x42362d
push esi
push edi
push 0x54c74f
push 0x579826
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x423640
push edi
push 0x54c758
push 0x579826
call sub.USER32.dll_wsprintfA
add esp, 0xc
push ebp
push 0x54c75c
lea edx, [esp + 8]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x54c538
push 0x579826
lea ecx, [esp + 8]
push ecx
push 0x54c761
call fcn.00498684
inc ebp
jmp 0x42357e
push 0x54c538
push 0
push 0
push 0x54c76d
call fcn.00498684
push 0x54c538
push 0
push 0
push 0
call fcn.00498684
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42369d
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, 0x54c738
mov ebp, 0x57943f
push 0x54c538
push 0x3e7
push ebp
lea eax, [edi + 0x4d]
push eax
lea edx, [edi + 0x49]
push edx
lea ecx, [edi + 0x3f]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [ebp], 0
je 0x4236d5
call fcn.00423570
xor ebx, ebx
xor esi, esi
push esi
lea eax, [edi + 0x51]
push eax
lea edx, [esp + 8]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x54c538
push 0x3e7
push ebp
lea ecx, [edi + 0x62]
push ecx
lea eax, [esp + 0x10]
push eax
lea edx, [edi + 0x56]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [ebp], 0
je 0x42372d
mov ecx, dword [0x54c6bc]
inc dword [0x54c6bc]
push ecx
push 0
push ebp
push ebx
call fcn.004b0c4c
test eax, eax
je 0x42372d
mov ebx, eax
inc esi
jmp 0x4236d9
mov eax, ebx
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x423daf
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, 0x579826
push 0x20
push dword [ebp + 8]
call fcn.00539518
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x423dde
mov byte [ebx], 0
inc ebx
jmp 0x423dd7
inc ebx
cmp byte [ebx], 0x20
je 0x423dd6
jmp 0x423de8
mov ebx, 0x54c7c3
jmp 0x423de8
mov byte [esi], 0x27
push 0x22
push ebx
call fcn.00539518
add esp, 8
mov esi, eax
test eax, eax
jne 0x423de5
push 2
call fcn.00447ae4
test eax, eax
je 0x423e3a
cmp byte [ebx], 0
je 0x423e22
push 0x557624
push ebx
push dword [ebp + 8]
push str._s___s____s
push edi
call sub.USER32.dll_wsprintfA
add esp, 0x14
jmp 0x423e6b
push 0x557624
push dword [ebp + 8]
push str._s____s
push edi
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x423e6b
cmp byte [ebx], 0
je 0x423e53
push ebx
push dword [ebp + 8]
push 0x54c7dd
push edi
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x423e6b
push dword [ebp + 8]
push 0x54c7e6
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x423e6b
mov byte [edi + ebx - 1], 0
push edi
call fcn.005395b8
pop ecx
mov ebx, eax
dec eax
jl 0x423e7e
cmp byte [edi + ebx - 1], 0x2c
je 0x423e66
xor ebx, ebx
push ebx
push 0x54c7ea
lea eax, [ebp - 0xc]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x54c538
push 0x3e7
push 0x57943f
push 0x54c7fb
lea edx, [ebp - 0xc]
push edx
push 0x54c7ef
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x57943f], 0
je 0x423ed2
push edi
push 0x569b9c
call fcn.0053977c
add esp, 8
test eax, eax
je 0x423ed2
inc ebx
jmp 0x423e80
test ebx, ebx
jl 0x423efc
push ebx
push 0x54c7ff
lea ecx, [ebp - 0xc]
push ecx
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x54c538
push edi
lea eax, [ebp - 0xc]
push eax
push 0x54c804
call fcn.00498684
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x425494
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, 0x54c8f0
push str.mirc.ini
push 0x32
push 0x56c4bc
lea eax, [ebx + 0x14]
push eax
lea edx, [ebx + 0xe]
push edx
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x56c4bc], 0
je 0x425512
push 0
push 0x56c4bc
call fcn.00466f3d
push str.mirc.ini
push 0
lea ecx, [ebx + 0x26]
push ecx
lea eax, [ebx + 0x18]
push eax
call fcn.00498684
push 0x56c4bc
push 0x569b9c
call sub.USER32.dll_wsprintfA
add esp, 8
push 0x569b9c
call fcn.00466d0b
push str.mirc.ini
push 0x569b9c
lea edx, [ebx + 0x3a]
push edx
lea ecx, [ebx + 0x2c]
push ecx
call fcn.00498684
pop ebx
ret
push str.mirc.ini
push 0x32
push 0x56c4bc
lea eax, [ebx + 0x54]
push eax
lea edx, [ebx + 0x4e]
push edx
lea ecx, [ebx + 0x40]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x56c4bc
call fcn.00466d33
pop ebx
ret
Function at 0x4255ac
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
mov ebx, 0x54c8f0
mov esi, 0x56c3b8
push str.mirc.ini
push 0x104
push esi
lea eax, [ebx + 0x94]
push eax
lea edx, [ebx + 0x8e]
push edx
lea ecx, [ebx + 0x80]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x42563b
push 0
push esi
call fcn.00466f3d
push str.mirc.ini
push 0
lea eax, [ebx + 0xa6]
push eax
lea edx, [ebx + 0x98]
push edx
call fcn.00498684
push esi
push 0x569b9c
call sub.USER32.dll_wsprintfA
add esp, 8
push 0x569b9c
call fcn.00466d0b
push str.mirc.ini
push 0x569b9c
lea ecx, [ebx + 0xba]
push ecx
lea eax, [ebx + 0xac]
push eax
call fcn.00498684
jmp 0x425666
push str.mirc.ini
push 0x104
push esi
lea edx, [ebx + 0xd6]
push edx
lea ecx, [ebx + 0xcf]
push ecx
lea eax, [ebx + 0xc1]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
push esi
call fcn.00466d33
push esi
call fcn.004fefbe
pop esi
pop ebx
ret

Function at 0x42575c
Capabilities:
Read .ini file

Disassembly:
push esi
push edi
mov byte [0x56c2b4], 0
push str.mirc.ini
push 0x104
push 0x56c1b0
push 0x54ca06
push 0x54ca02
push 0x54c9f4
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x56c1b0
push 0x553318
push 0x54ca14
push 0x569f83
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 1
push 0x569f83
call fcn.0041c947
test eax, eax
jne 0x4257c8
mov esi, 0x54ca1a
mov edi, 0x56c1b0
mov eax, edi
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.004255ac
call fcn.00425494
pop edi
pop esi
ret
Function at 0x426137
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
lea ebx, [ebp - 4]
push 0x180
push 0
push 0x4301
push dword [ebp + 8]
call fcn.0053fb14
add esp, 0x10
mov esi, eax
mov dword [0x54c8e4], esi
test esi, esi
jge 0x426172
push 0
call fcn.0041c2be
jmp 0x426347
push 0x7f02
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
mov dword [ebp - 8], eax
push 0x180
push 0x57c4a0
push dword [0x55b3dc]
call sub.USER32.dll_GetWindowTextA
push 0
push 0x57c
call fcn.0041c35b
push eax
push 0x57c4a0
call fcn.005398cc
add esp, 8
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x4261ee
add dword [ebx], 4
push dword [ebx]
call fcn.005395b8
pop ecx
push eax
push dword [ebx]
push dword [0x54c8e4]
call fcn.0053f614
add esp, 0xc
push 1
push 0x54ca88
push dword [0x54c8e4]
call fcn.0053f614
add esp, 0xc
xor edi, edi
push ebx
push edi
push 0x189
push 0x425
push dword [0x55b3dc]
call sub.USER32.dll_SendDlgItemMessageA
inc eax
je 0x426329
cmp dword [ebx], 0
je 0x426329
mov eax, dword [ebx]
push edi
mov esi, 0x57c4a0
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov dword [ebx], 0x57c4a0
jmp 0x426249
inc dword [ebx]
mov eax, dword [ebx]
cmp byte [eax], 0x20
je 0x426247
mov edx, dword [ebx]
cmp byte [edx], 0
je 0x426323
push 9
push dword [ebx]
call fcn.00539518
add esp, 8
mov esi, eax
test esi, esi
je 0x426323
mov byte [esi], 0
push dword [ebx]
call fcn.005395b8
pop ecx
push eax
push dword [ebx]
push dword [0x54c8e4]
call fcn.0053f614
add esp, 0xc
inc esi
cmp byte [esi], 0
je 0x42630e
mov dword [ebx], esi
push 9
push dword [ebx]
call fcn.00539518
add esp, 8
mov esi, eax
test esi, esi
je 0x4262aa
mov byte [esi], 0
push 1
push 0x54ca8b
push dword [0x54c8e4]
call fcn.0053f614
add esp, 0xc
push dword [ebx]
call fcn.005395b8
pop ecx
push eax
push dword [ebx]
push dword [0x54c8e4]
call fcn.0053f614
add esp, 0xc
test esi, esi
je 0x42630e
inc esi
cmp byte [esi], 0
je 0x42630e
push 1
push 0x54ca8e
push dword [0x54c8e4]
call fcn.0053f614
add esp, 0xc
push esi
call fcn.005395b8
pop ecx
push eax
push esi
push dword [0x54c8e4]
call fcn.0053f614
add esp, 0xc
push 1
push 0x54ca91
push dword [0x54c8e4]
call fcn.0053f614
add esp, 0xc
inc edi
jmp 0x4261f0
push dword [0x54c8e4]
call fcn.0053ca08
pop ecx
mov dword [0x54c8e4], 0xffffffff
push dword [ebp - 8]
call sub.USER32.dll_SetCursor
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4298fd
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov esi, 0x56c524
test ebx, ebx
jne 0x429915
xor eax, eax
jmp 0x429a4d
cmp dword [ebx + 0x51c], 3
je 0x42992e
cmp dword [ebx + 0x530], 2
je 0x42992e
xor eax, eax
jmp 0x429a4d
cmp dword [0x55bb4c], 0x14
jl 0x429999
mov dword [0x55bb4c], 0xa
push 2
push 0
push 0
push 0
push esi
call sub.USER32.dll_PeekMessageA
test eax, eax
je 0x429988
mov eax, dword [esi + 4]
cmp eax, 0x41d
je 0x429988
cmp eax, 0x12
je 0x429988
push 3
push 0
push 0
push 0
push esi
call sub.USER32.dll_PeekMessageA
test eax, eax
je 0x429988
mov ecx, esi
mov edx, 6
push dword [ecx + edx*4]
dec edx
jns 0x42997b
call fcn.004bd172
jmp 0x429941
push ebx
call fcn.00427805
test eax, eax
jne 0x429999
xor eax, eax
jmp 0x429a4d
push 0
call fcn.00548d28
pop ecx
mov dword [ebx + 0x874], eax
push 0
push 0x3b5
push 0x56d159
push dword [ebx + 0x878]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x429a1d
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4299eb
push 0x23
push 0x41d
push dword [0x55b3c8]
push dword [ebx + 0x878]
call sub.WSOCK32.dll_WSAAsyncSelect
xor eax, eax
jmp 0x429a4d
push ebx
push 0
push 0x527
call fcn.0041c35b
push eax
call fcn.0042793c
cmp dword [0x558a48], 0
je 0x429a19
push ebx
call fcn.00427805
test eax, eax
je 0x429a19
push ebx
push dword [ebx]
call fcn.00519f29
xor eax, eax
jmp 0x429a4d
test eax, eax
jle 0x429a45
mov byte [eax + 0x56d159], 0
mov dword [0x55bb50], 1
push eax
push ebx
call fcn.00429854
xor edx, edx
mov dword [0x55bb50], edx
xor eax, eax
jmp 0x429a4d
push ebx
call fcn.00429bcc
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4