joyce8/EMBER2024-capa huggingface dataset:
Function at 0x501b3f
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x55b3cc
push esi
call fcn.00514192
test eax, eax
jne 0x501b9c
push 6
push esi
call sub.USER32.dll_ShowWindow
cmp dword [0x55b420], 0
je 0x501b7c
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jl 0x501b7c
push 0
push esi
call sub.USER32.dll_ShowWindow
cmp esi, dword [0x55b3d4]
jne 0x501b8b
xor eax, eax
mov dword [0x55b3d4], eax
push esi
call fcn.00516145
push eax
call fcn.005010e4
jmp 0x501ce9
cmp dword [ebp + 0xc], 0
je 0x501c8b
push 5
push dword [edi]
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x501c00
push ebx
call fcn.00514192
test eax, eax
je 0x501bf2
push ebx
call sub.USER32.dll_IsIconic
test eax, eax
je 0x501bf2
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x501bf2
push ebx
call fcn.00500c1e
test eax, eax
je 0x501bf2
push 0
push ebx
call sub.USER32.dll_ShowWindow
push 5
push dword [edi]
call sub.USER32.dll_GetWindow
mov ebx, eax
jmp 0x501bb1
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x501bb5
push 5
push dword [edi]
call sub.USER32.dll_GetWindow
mov ebx, eax
cmp esi, ebx
jne 0x501c8b
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x501c35
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
jne 0x501c35
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x501c1d
test ebx, ebx
je 0x501c5f
cmp esi, ebx
je 0x501c5f
push 5
push ebx
call sub.USER32.dll_ShowWindow
push ebx
call sub.USER32.dll_UpdateWindow
push ebx
call sub.USER32.dll_BringWindowToTop
push ebx
call fcn.00516145
push eax
call fcn.005010e4
jmp 0x501c8b
push dword [0x55b3d8]
call fcn.00514192
test eax, eax
je 0x501c8b
push dword [0x55b3d8]
call sub.USER32.dll_SetFocus
mov ebx, dword [0x55b3d8]
push ebx
call fcn.00516145
push eax
call fcn.005010e4
push 0
push esi
call sub.USER32.dll_ShowWindow
push dword [edi]
call sub.USER32.dll_UpdateWindow
push esi
call sub.USER32.dll_UpdateWindow
push 0
push 0
push 0xb
push dword [edi]
call sub.USER32.dll_SendMessageA
push 7
push esi
call sub.USER32.dll_ShowWindow
push 0
push esi
call sub.USER32.dll_ShowWindow
push 0
push 1
push 0xb
push dword [edi]
call sub.USER32.dll_SendMessageA
push dword [edi]
call sub.USER32.dll_UpdateWindow
push esi
call sub.USER32.dll_UpdateWindow
push esi
call fcn.00501a1e
push esi
call fcn.00516145
push eax
call fcn.005010e4
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x501cf0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00514157
test eax, eax
je 0x501d89
push dword [ebx]
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x501d1b
push dword [ebx]
call sub.USER32.dll_IsWindowVisible
test eax, eax
jne 0x501d60
push 4
push dword [ebx]
call sub.USER32.dll_ShowWindow
cmp dword [0x556140], 0
je 0x501d43
push 0
push 0x7a
push 0x111
push dword [0x55b3c8]
call sub.USER32.dll_PostMessageA
jmp 0x501d60
cmp dword [0x556144], 0
je 0x501d60
push 0
push 0x7b
push 0x111
push dword [0x55b3c8]
call sub.USER32.dll_PostMessageA
push dword [ebx]
call sub.USER32.dll_BringWindowToTop
push dword [ebx]
call sub.USER32.dll_SetActiveWindow
push dword [ebx]
call sub.USER32.dll_SetForegroundWindow
push dword [ebx]
call sub.USER32.dll_UpdateWindow
push dword [ebx]
call fcn.00501a1e
push ebx
call fcn.005010e4
pop ebx
pop ebp
ret 4
Function at 0x502326
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, 0x589df4
mov esi, 0x589dec
test edi, edi
je 0x50239d
mov eax, dword [0x55a4e8]
mov dword [ebx], eax
jmp 0x502390
push edi
push dword [eax]
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x502389
mov eax, dword [ebx]
cmp dword [eax + 0x1c], 0
je 0x50236d
cmp dword [eax + 0x34], 0
je 0x50236d
mov edx, dword [eax + 0x34]
mov dword [edx + 0x1c], 1
push dword [ebx]
push dword [0x55a4e8]
call fcn.004b103a
mov dword [0x55a4e8], eax
mov eax, 1
jmp 0x502532
mov edx, dword [ebx]
mov ecx, dword [edx + 0x34]
mov dword [ebx], ecx
mov eax, dword [ebx]
test eax, eax
jne 0x502346
xor eax, eax
jmp 0x502532
push dword [ebp + 8]
call fcn.00516145
mov edi, eax
mov dword [0x589de8], edi
test edi, edi
jne 0x5023b8
xor eax, eax
jmp 0x502532
mov edx, dword [edi + 0x758]
mov dword [0x589df8], edx
mov edi, dword [0x589df8]
test edi, edi
je 0x5023d7
call sub.USER32.dll_GetFocus
cmp edi, eax
je 0x5023de
xor eax, eax
jmp 0x502532
push 0
push 0
push 0xe
push dword [0x589df8]
call sub.USER32.dll_SendMessageA
mov dword [0x589dfc], eax
cmp dword [0x589dfc], 0
jle 0x502417
cmp dword [0x55a4ec], 0
jne 0x502417
push 0
call fcn.0041c2be
mov eax, 1
jmp 0x502532
push 0x57c887
push 0x3e6
push 0xd
push dword [0x589df8]
call sub.USER32.dll_SendMessageA
mov edi, eax
mov dword [0x589dfc], edi
test edi, edi
jg 0x502444
mov eax, 1
jmp 0x502532
mov edx, dword [0x589dfc]
mov byte [edx + 0x57c887], 0
mov dword [esi], 0x57c887
jmp 0x50245b
inc dword [esi]
mov ecx, dword [esi]
cmp byte [ecx], 0x20
je 0x502459
mov eax, dword [esi]
cmp byte [eax], 0
jne 0x502473
mov eax, 1
jmp 0x502532
push 5
push 0x55a560
push eax
call fcn.00539814
add esp, 0xc
test eax, eax
je 0x502491
mov eax, 1
jmp 0x502532
add dword [esi], 5
jmp 0x502498
inc dword [esi]
mov edx, dword [esi]
cmp byte [edx], 0x20
je 0x502496
mov ecx, dword [esi]
cmp byte [ecx], 0
jne 0x5024b0
mov eax, 1
jmp 0x502532
push 0x20
push dword [esi]
call fcn.00539518
add esp, 8
mov edi, eax
mov dword [0x589df0], edi
test edi, edi
je 0x5024cb
mov byte [edi], 0
mov eax, dword [0x55a4e8]
mov dword [ebx], eax
jmp 0x502520
push dword [esi]
push dword [eax]
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x502519
push dword [ebx]
push dword [0x55a4e8]
call fcn.004b103a
mov dword [0x55a4e8], eax
xor edx, edx
mov dword [0x55a4ec], edx
push 0x55a567
push 0
push 0xc
push dword [0x589df8]
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x502532
mov edx, dword [ebx]
mov ecx, dword [edx + 0x34]
mov dword [ebx], ecx
mov eax, dword [ebx]
test eax, eax
jne 0x5024d4
push 0
call fcn.0041c2be
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x506a27
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, 0x55a6ec
mov ebx, 0x25
xor edx, edx
mov eax, 0x58a9e0
cmp ebx, edx
jle 0x506ac9
mov dword [eax], edx
lea ecx, [edx + 0xc9]
mov dword [eax + 4], ecx
mov byte [eax + 8], 4
mov byte [eax + 9], 0
mov ecx, edx
cmp ecx, 0x22
ja case.0x506a64.0
mov cl, byte [ecx + 0x506a6b]
jmp dword [ecx*4 + 0x506a8e]
mov byte [eax + 8], 8
jmp case.0x506a64.0
cmp dword [0x55a3c0], 0
je case.0x506a64.0
mov byte [eax + 8], 8
jmp case.0x506a64.0
mov dword [eax], 0xffffffff
mov byte [eax + 9], 1
inc edx
add eax, 0xc
cmp ebx, edx
jg 0x506a44
push 0
call fcn.00507e67
call fcn.005068b2
test eax, eax
je 0x506b70
push 0
push dword [0x55b3c4]
push 0xc8
push dword [0x55b3c8]
push 0
push 0
push 0
push 0
push 0x42000000
push 0x55a990
push str.mIRCTB32
push 0
call sub.USER32.dll_CreateWindowExA
mov esi, eax
mov dword [ebp], esi
test esi, esi
je 0x506b70
mov dword [0x55a728], esi
mov dword [0x55a840], esi
movzx eax, word [0x55b3c4]
or eax, 0x1b0000
push eax
mov edi, ebx
push edi
push 0x413
push esi
call sub.USER32.dll_SendMessageA
push 0x58a9e0
push edi
push 0x414
push dword [ebp]
call sub.USER32.dll_SendMessageA
cmp dword [0x55a6e8], 0
je 0x506b66
push 5
push dword [ebp]
call sub.USER32.dll_ShowWindow
jmp 0x506b70
push 0
push dword [ebp]
call sub.USER32.dll_ShowWindow
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x506c69
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp eax, 0x1b
jne 0x506c8e
mov edx, dword [0x55a844]
test edx, edx
je 0x506c8e
mov eax, edx
jmp 0x506d76
push 2
movzx ecx, ax
push ecx
push ebx
call sub.KERNEL32.dll_FindResourceA
test eax, eax
jne 0x506ca5
xor eax, eax
jmp 0x506d76
push eax
push ebx
call sub.KERNEL32.dll_LoadResource
mov edi, eax
push edi
call sub.KERNEL32.dll_LockResource
mov ebx, eax
test ebx, ebx
jne 0x506cc1
xor eax, eax
jmp 0x506d76
lea edx, [ebx + 0x28]
mov dword [ebp - 0x1c], edx
mov cx, word [ebx + 0xe]
mov eax, 1
shl eax, cl
shl eax, 2
add dword [ebp - 0x1c], eax
mov edx, dword [ebx + 4]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebx + 8]
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
push 0
call sub.USER32.dll_GetDC
mov esi, eax
test esi, esi
je 0x506d6d
push esi
call sub.GDI32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x506d65
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push esi
call sub.GDI32.dll_CreateCompatibleBitmap
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x506d5d
push dword [ebp - 4]
push dword [ebp - 0xc]
call sub.GDI32.dll_SelectObject
mov dword [ebp - 8], eax
push 0xcc0020
push 0
push ebx
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push 0
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push 0
push 0
push dword [ebp - 0xc]
call sub.GDI32.dll_StretchDIBits
push dword [ebp - 8]
push dword [ebp - 0xc]
call sub.GDI32.dll_SelectObject
push dword [ebp - 0xc]
call sub.GDI32.dll_DeleteDC
push esi
push 0
call sub.USER32.dll_ReleaseDC
push edi
call sub.KERNEL32.dll_FreeResource
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x509e8e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.004f498d
test eax, eax
je 0x509f5c
cmp dword [ebx + 0x39c], 0
je 0x509f20
push 0
push 0x15be
call fcn.0041c35b
push eax
push 0
push 0xc
push 0x79
push dword [ebx]
call sub.USER32.dll_SendDlgItemMessageA
cmp dword [ebx + 0x344], 0
je 0x509ef3
push 0
push 0x78
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x77
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
jmp 0x509f5c
push 0
push 0x15bf
call fcn.0041c35b
push eax
push 0
push 0xc
push 0x77
push dword [ebx]
call sub.USER32.dll_SendDlgItemMessageA
push 5
push 0x77
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
jmp 0x509f5c
push 0
push 0x15bd
call fcn.0041c35b
push eax
push 0
push 0xc
push 0x79
push dword [ebx]
call sub.USER32.dll_SendDlgItemMessageA
push 0
push 0x78
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x77
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
pop ebx
pop ebp
ret 4

Function at 0x509f61
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00478a69
test eax, eax
je 0x50a026
cmp dword [ebx + 0x378], 0
je 0x509fea
push 0
push 0x15be
call fcn.0041c35b
push eax
push 0
push 0xc
push 0x79
push dword [ebx]
call sub.USER32.dll_SendDlgItemMessageA
cmp dword [ebx + 0x344], 0
je 0x509fc6
push 5
push 0x78
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x77
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
jmp 0x50a026
push 0
push 0x78
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x77
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
jmp 0x50a026
push 0
push 0x15bd
call fcn.0041c35b
push eax
push 0
push 0xc
push 0x79
push dword [ebx]
call sub.USER32.dll_SendDlgItemMessageA
push 0
push 0x78
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x77
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
pop ebx
pop ebp
ret 4
Function at 0x50cf10
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp dword [0x55adb0], 0
jne 0x50cff1
mov dword [0x55adb0], 1
xor eax, eax
mov al, byte [ebp + 8]
cmp eax, 6
ja case.0x50cf39.0
jmp dword [eax*4 + 0x50cf40]
push 0
push 0x55addc
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x50cfbd
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x50cf98
cmp ebx, dword [0x55b3c8]
je 0x50cf98
push ebx
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x50cf6e
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x50cf6e
cmp ebx, dword [0x55b3c8]
jne 0x50cfbd
push ebx
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x50cfbd
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x50cfbd
call fcn.0050cff6
test eax, eax
jne case.0x50cf39.0
cmp dword [0x5558fc], 0
je 0x50cfdc
push 0
push 0
push 0x443
push dword [0x55b3c8]
call sub.USER32.dll_PostMessageA
jmp case.0x50cf39.0
push 1
call fcn.0050cddb
jmp case.0x50cf39.0
call fcn.0050cabc
xor eax, eax
mov dword [0x55adb0], eax
pop ebx
pop ebp
ret 4

Function at 0x50cff6
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x50d00d
mov word [0x58b150], 1
jmp 0x50d016
mov word [0x58b150], 0
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x50d046
mov eax, dword [0x5558f0]
test eax, eax
je 0x50d032
mov dword [0x5558fc], eax
jmp 0x50d046
push 1
push 0
push 0x443
push dword [0x55b3c8]
call sub.USER32.dll_PostMessageA
cmp dword [0x55ad94], 0
jne 0x50d072
cmp dword [0x55ad90], 0
je 0x50d065
cmp word [0x58b150], 0
je 0x50d072
xor eax, eax
ret
cmp word [0x58b150], 0
jne 0x50d072
xor eax, eax
ret
push 1
call fcn.0050d634
test eax, eax
jne 0x50d080
xor eax, eax
ret
cmp dword [0x55ad90], 0
je 0x50d0be
cmp word [0x58b150], 0
je 0x50d0a2
push 6
push dword [0x55b3c8]
call sub.USER32.dll_ShowWindow
jmp 0x50d0f1
push 6
push dword [0x55b3c8]
call sub.USER32.dll_ShowWindow
push 0
push dword [0x55b3c8]
call sub.USER32.dll_ShowWindow
jmp 0x50d0f1
cmp word [0x58b150], 0
je 0x50d0e4
push 6
push dword [0x55b3c8]
call sub.USER32.dll_ShowWindow
push 0
push dword [0x55b3c8]
call sub.USER32.dll_ShowWindow
jmp 0x50d0f1
push 6
push dword [0x55b3c8]
call sub.USER32.dll_ShowWindow
mov eax, 1
ret
Function at 0x50dab4
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [eax]
push edx
call fcn.00541eac
pop ecx
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0x41
jb 0x50dada
cmp byte [ebp - 0x1d], 0x5a
jbe 0x50dae1
xor eax, eax
jmp 0x50dc1e
lea edx, [ebp - 0x18]
push edx
push 0
push 0
push 1
push 1
call sub.MPR.dll_WNetOpenEnumA
test eax, eax
je 0x50dafd
xor eax, eax
jmp 0x50dc1e
mov dword [ebp - 0x14], 0xffffffff
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 8], 0x640
push dword [ebp - 8]
call fcn.00545a4c
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x50dc04
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0xc]
push edx
push dword [ebp - 4]
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0x18]
call sub.MPR.dll_WNetEnumResourceA
cmp eax, 0xea
jne 0x50db6d
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00545f18
add esp, 8
test eax, eax
je 0x50dc04
mov dword [ebp - 4], eax
jmp 0x50db26
test eax, eax
jne 0x50dc04
xor esi, esi
mov eax, dword [ebp - 4]
lea ebx, [eax + 0x10]
jmp 0x50dbfa
mov edi, dword [ebx]
test edi, edi
je 0x50dbf6
xor eax, eax
mov al, byte [edi]
push eax
call fcn.00541eac
pop ecx
xor edx, edx
mov dl, byte [ebp - 0x1d]
cmp eax, edx
jne 0x50dbf6
mov ecx, dword [ebp + 8]
mov eax, dword [ebx + 4]
mov esi, ecx
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xc]
cmp byte [eax + 1], 0x3a
jne 0x50dbe4
mov edx, dword [ebp + 0xc]
cmp byte [edx + 2], 0x5c
jne 0x50dbe4
mov ecx, dword [ebp + 0xc]
add ecx, 2
push ecx
push dword [ebp + 8]
call fcn.005394dc
add esp, 8
push dword [ebp + 8]
call fcn.00541e38
pop ecx
mov dword [ebp - 0x1c], 1
jmp 0x50dc04
inc esi
add ebx, 0x20
cmp esi, dword [ebp - 0x10]
jl 0x50db7f
jmp 0x50db26
cmp dword [ebp - 4], 0
je 0x50dc13
push dword [ebp - 4]
call fcn.00545938
pop ecx
push dword [ebp - 0x18]
call sub.MPR.dll_WNetCloseEnum
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x50dc82
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp eax, 2
jne 0x50dcc6
push 0x8001
call sub.KERNEL32.dll_SetErrorMode
push 0
push 0x55b026
push 0
push ebx
push 0x55b020
push dword [0x55b3c8]
call sub.SHELL32.dll_ShellExecuteA
push 0
call sub.KERNEL32.dll_SetErrorMode
jmp 0x50de09
dec eax
jne 0x50dcd0
mov esi, 1
jmp 0x50dcd2
xor esi, esi
cmp dword [0x55ae30], 0
je 0x50dce8
cmp dword [0x55ae34], 0
jne 0x50dd6e
cmp dword [0x55ae30], 0
je 0x50dcf5
test esi, esi
je 0x50dd06
push ebx
push str.__s_____0xFFFFFFFF_0x4_________
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x50dd15
push ebx
push str.__s_____0x0_0x4_________
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0xffffffffffffffff
push 2
push 0x55b072
push edi
push str.WWW_OpenURL
call fcn.00458d8c
test eax, eax
je 0x50dd6e
cmp dword [0x55ae34], 0
je 0x50de09
test esi, esi
jne 0x50de09
push 0xffffffffffffffff
push 2
push 0x55b094
push str.0xFFFFFFFF_0x0
push str.WWW_Activate
call fcn.00458d8c
test eax, eax
jne 0x50de09
push 0
call fcn.0041c2be
jmp 0x50de09
call fcn.004e8453
cmp byte [0x581618], 0
jne 0x50ddaa
mov esi, 0x55b098
mov edi, 0x581618
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [0x55797c], 4
push 0
push 0x67
push 0x111
push dword [0x55b3c8]
call sub.USER32.dll_PostMessageA
jmp 0x50de09
push 0x8001
call sub.KERNEL32.dll_SetErrorMode
push 5
push 0x553318
push ebx
push 0x581618
push str.open
push dword [0x55b3c8]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x1f
jae 0x50de02
mov esi, str.unknown
mov edi, 0x581618
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
call fcn.0041c2be
push 0
push 0x51a
push 0x111
push dword [0x55b3c8]
call sub.USER32.dll_PostMessageA
push 0
call sub.KERNEL32.dll_SetErrorMode
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x5143c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov al, byte [ebx + 0x64c]
test al, al
jne 0x5143dc
mov eax, 0x55b5cc
jmp 0x514479
cmp al, 1
jne 0x5143e8
lea eax, [ebx + 4]
jmp 0x514479
cmp al, 2
jne 0x51441f
mov al, byte [ebx + 0x64d]
cmp al, 1
jne 0x5143fb
lea eax, [ebx + 4]
jmp 0x514479
cmp al, 2
jne 0x514406
mov eax, 0x55b5d5
jmp 0x514479
push 0x20
lea esi, [ebx + 4]
push esi
call fcn.00539518
add esp, 8
test eax, eax
jne 0x51441c
mov eax, esi
jmp 0x514479
inc eax
jmp 0x514479
mov al, byte [ebx + 0x64c]
cmp al, 3
jne 0x514440
cmp byte [ebx + 0x64d], 1
jne 0x514439
mov eax, str.odccs
jmp 0x514479
mov eax, str.odccg
jmp 0x514479
cmp al, 4
jne 0x51444b
mov eax, str.olist
jmp 0x514479
cmp al, 5
jne 0x514456
mov eax, str.ofinger
jmp 0x514479
cmp al, 6
jne 0x514461
mov eax, str.ourl
jmp 0x514479
cmp al, 7
jne 0x51446c
mov eax, str.onotify
jmp 0x514479
cmp al, 8
jne 0x514477
mov eax, str.olinks
jmp 0x514479
xor eax, eax
test eax, eax
je 0x5144ac
push str.mirc.ini
push 0x3e7
push 0x57c4a0
push 0x55b61b
push eax
push str.ontop
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x57c4a0], 0
je 0x5144ac
mov eax, 1
jmp 0x5144ae
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x51543e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push 0x55b6cc
push ebx
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x51547d
push str.mirc.ini
push 0x3e7
push 0x57c4a0
push 0x55b6ef
push 0x55b6e5
push 0x55b6dc
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x5154cb
push 0x20
push ebx
call fcn.005398a0
add esp, 8
mov esi, eax
mov dword [0x58c9b0], esi
test esi, esi
je 0x5154a6
inc dword [0x58c9b0]
mov eax, dword [0x58c9b0]
cmp byte [eax], 0
je 0x5154a6
mov ebx, eax
cmp byte [ebx], 0x3d
jne 0x5154ac
inc ebx
push str.mirc.ini
push 0x3e7
push 0x57c4a0
push 0x55b6fd
push ebx
push str.beeping
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x55b702
push 0x57c4a0
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x5154e8
mov eax, 1
jmp 0x5154ea
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4

Function at 0x5155bf
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push 0x55b728
push ebx
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x5155fe
push str.mirc.ini
push 0x3e7
push 0x57c4a0
push 0x55b74c
push 0x55b742
push 0x55b738
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x51564c
push 0x20
push ebx
call fcn.005398a0
add esp, 8
mov esi, eax
mov dword [0x58c9b4], esi
test esi, esi
je 0x515627
inc dword [0x58c9b4]
mov eax, dword [0x58c9b4]
cmp byte [eax], 0
je 0x515627
mov ebx, eax
cmp byte [ebx], 0x3d
jne 0x51562d
inc ebx
push str.mirc.ini
push 0x3e7
push 0x57c4a0
push 0x55b75b
push ebx
push str.flashing
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x55b760
push 0x57c4a0
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x515669
mov eax, 1
jmp 0x51566b
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x51586d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, str.FixedSys
mov al, byte [ebx + 0x64c]
test al, al
jne 0x515890
lea eax, [esi + 0x25a]
jmp 0x515938
cmp al, 1
jne 0x51589c
lea eax, [ebx + 4]
jmp 0x515938
cmp al, 2
jne 0x5158d7
mov al, byte [ebx + 0x64d]
cmp al, 1
jne 0x5158b2
lea eax, [ebx + 4]
jmp 0x515938
cmp al, 2
jne 0x5158be
lea eax, [esi + 0x263]
jmp 0x515938
push 0x20
lea edi, [ebx + 4]
push edi
call fcn.00539518
add esp, 8
test eax, eax
jne 0x5158d4
mov eax, edi
jmp 0x515938
inc eax
jmp 0x515938
mov al, byte [ebx + 0x64c]
cmp al, 3
jne 0x5158fa
cmp byte [ebx + 0x64d], 1
jne 0x5158f2
lea eax, [esi + 0x26d]
jmp 0x515938
lea eax, [esi + 0x274]
jmp 0x515938
cmp al, 4
jne 0x515906
lea eax, [esi + 0x27b]
jmp 0x515938
cmp al, 5
jne 0x515912
lea eax, [esi + 0x282]
jmp 0x515938
cmp al, 6
jne 0x51591e
lea eax, [esi + 0x28b]
jmp 0x515938
cmp al, 7
jne 0x51592a
lea eax, [esi + 0x291]
jmp 0x515938
cmp al, 8
jne 0x515936
lea eax, [esi + 0x29a]
jmp 0x515938
xor eax, eax
mov ebx, 2
test eax, eax
je 0x5159bc
push str.mirc.ini
push 0x3e7
push 0x57c4a0
lea edx, [esi + 0x2ab]
push edx
push eax
lea eax, [esi + 0x2a2]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea ecx, [esi + 0x2af]
push ecx
push 0x57c4a0
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x515980
xor ebx, ebx
jmp 0x5159bc
lea eax, [esi + 0x2b2]
push eax
push 0x57c4a0
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x51599f
mov ebx, 1
jmp 0x5159bc
lea eax, [esi + 0x2b5]
push eax
push 0x57c4a0
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x5159bc
mov ebx, 3
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x515a94
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push str.Message_Window
push ebx
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x515ad3
push str.mirc.ini
push 0x3e7
push 0x57c4a0
push 0x55b866
push 0x55b85c
push 0x55b852
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x515b21
push 0x20
push ebx
call fcn.005398a0
add esp, 8
mov esi, eax
mov dword [0x58c9b8], esi
test esi, esi
je 0x515afc
inc dword [0x58c9b8]
mov eax, dword [0x58c9b8]
cmp byte [eax], 0
je 0x515afc
mov ebx, eax
cmp byte [ebx], 0x3d
jne 0x515b02
inc ebx
push str.mirc.ini
push 0x3e7
push 0x57c4a0
push 0x55b875
push ebx
push str.tracking
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x55b87a
push 0x57c4a0
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x515b3e
mov eax, 1
jmp 0x515b40
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4