joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1dd8000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x1dd8131
push esi
call fcn.01ddb145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.01dca080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x1dd8131
push 0
push ebp
call fcn.01dca3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.01dca260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x1dd808b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.01dca2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x1dd8121
push 0x1df0918
push edi
call fcn.01dd93f0
push eax
push ebx
push esi
call fcn.01dd7f60
push 0x1df08f8
push edi
call fcn.01dd93f0
push eax
push ebx
push esi
call fcn.01dd7f60
push 0x1df08d8
push edi
call fcn.01dd93f0
push eax
push ebx
push esi
call fcn.01dd7f60
push 0x1df08c0
push edi
call fcn.01dd93f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.01dd7f60
push 0x1df08a0
push edi
call fcn.01dd93f0
push eax
push ebx
push esi
call fcn.01dd7f60
push 0x1df0888
push edi
call fcn.01dd93f0
push eax
push ebx
push esi
call fcn.01dd7f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1dd91b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.01dd9140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.01dd9140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.01dd9140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.01dd9140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x1dd9bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1dd9c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x1deb87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1dd9c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1dd9c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x3a571de9
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x71d827c1
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x403e59
pop dword [ebp - 0x30]
mov eax, 0x1092b4c5
sub eax, 0x1052766c
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x3575da2b
add dword [ebp - 0x40], 0x18dc6b20
mov dword [ebp - 0x3c], 0xdeffa917
sub dword [ebp - 0x3c], 0xaccc5cd2
mov dword [ebp - 0x38], 0xb0ba828b
add dword [ebp - 0x38], 0x9b91c1a3
mov dword [ebp - 0x34], 0x96ec1d2a
add dword [ebp - 0x34], 0x6913e2d6
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xf35589c1
sub dword [ebp - 0x40], 0x7ee3206b
mov dword [ebp - 0x3c], 0x3078faf8
add dword [ebp - 0x3c], 0x10f3667d
mov dword [ebp - 0x38], 0xb1d6ab12
add dword [ebp - 0x38], 0xb198c15a
mov dword [ebp - 0x34], 0x289e7098
sub dword [ebp - 0x34], 0x289e7098
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x7fda2ca3
sub eax, 0x7f99abcf
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x33c99
push 0
call eax
mov ecx, 0xc62a6e0b
add ecx, 0x39d5ce1e
xor esi, esi
add esi, eax
mov edi, 0x411000
add edi, dword [ebp - 0x30]
mov edx, 0xdc42477a
sub dword [ebp - 0x28], ebx
mov ebx, dword [edi]
mov dword [ebp - 4], 0x417cefae
add ebx, edx
xor dword [ebp - 4], ecx
mov dword [esi], ebx
sub dword [ebp - 0x18], 0x3044f856
add esi, 4
add edi, 0x621cf4fd
add edi, 0x9de30b07
loop 0x403f6c
add eax, 0xfeec40bc
sub eax, 0xfeeb5d45
mov ebx, eax
add eax, 0xd0e34957
sub eax, 0xd0e34952
mov ecx, 0x184fd1e3
sub ecx, 0x180fd1e3
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x403b30
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 8], 0x29c
mov dword [esp + 4], 0x403b1d
mov dword [esp], 0x40205b
call sym._updatecontext_f
mov dword [ebp + 8], 0
mov esp, ebp
pop ebp
jmp sym._xdccsave
Function at 0x405e70
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
mov dword [esp + 8], 0x4dd
mov dword [esp + 4], 0x405de8
mov dword [esp], 0x40205b
call sym._updatecontext_f
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x405ec2
mov dword [esp], esi
mov dword [esp + 4], 0x405df1
call sym._u_respond
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], eax
call sym._atoi
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x405ea5
mov dword [esp], 0x432f14
call sym._irlist_size
cmp dword [ebp - 0x10], eax
jg 0x405ea5
mov eax, dword [ebp - 0x10]
mov dword [esp], 0x432f14
dec eax
mov dword [esp + 4], eax
call sym._irlist_get_nth
mov dword [esp], 0x432f38
mov edi, eax
call sym._irlist_get_head
test eax, eax
mov ebx, eax
je 0x405f30
lea esi, [esi]
cmp dword [ebx + 0x9c], 4
je 0x405f22
cmp dword [ebx + 0x78], edi
je 0x4060a8
mov dword [esp], ebx
call sym._irlist_get_next
test eax, eax
mov ebx, eax
jne 0x405f10
mov dword [esp], 0x432f20
call sym._irlist_get_head
test eax, eax
mov ebx, eax
je 0x405f66
lea esi, [esi]
lea edi, [edi]
cmp dword [ebx], edi
je 0x40605c
mov dword [esp], ebx
call sym._irlist_get_next
test eax, eax
mov ebx, eax
jne 0x405f50
mov dword [esp], 0x432f2c
call sym._irlist_get_head
test eax, eax
mov ebx, eax
je 0x405f96
nop
lea esi, [esi]
cmp dword [ebx], edi
je 0x406010
mov dword [esp], ebx
call sym._irlist_get_next
test eax, eax
mov ebx, eax
jne 0x405f80
mov eax, dword [edi + 4]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], esi
mov dword [esp + 4], 0x405e09
mov dword [esp + 8], eax
call sym._u_respond
mov eax, dword [edi]
mov dword [esp], eax
call sym._mydelete2
mov dword [edi], 0
mov eax, dword [edi + 4]
mov dword [esp], eax
call sym._mydelete2
mov dword [edi + 4], 0
mov eax, dword [edi + 8]
mov dword [esp], eax
call sym._mydelete2
mov dword [edi + 8], 0
mov dword [esp + 4], edi
mov dword [esp], 0x432f14
call sym._irlist_delete
mov dword [ebp + 8], 0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp sym._xdccsave
mov dword [esp + 4], 0x405e30
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym._notice
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym._mydelete2
mov dword [ebx + 4], 0
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym._mydelete2
mov dword [ebx + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x432f2c
call sym._irlist_delete
jmp 0x405f90
mov dword [esp + 4], 0x405e30
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym._notice
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym._mydelete2
mov dword [ebx + 4], 0
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym._mydelete2
mov dword [ebx + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x432f20
call sym._irlist_delete
jmp 0x405f60
mov dword [esp + 8], 0
mov dword [esp + 4], 0x405e55
mov dword [esp], ebx
call sym._t_closeconn
jmp 0x405f22
Function at 0x407700
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
mov dword [esp + 8], 0x703
mov dword [esp + 4], 0x407698
mov dword [esp], 0x40205b
call sym._updatecontext_f
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x407752
mov dword [esp + 4], 0x405bb0
mov dword [esp], esi
call sym._u_respond
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], eax
call sym._atoi
test eax, eax
mov edi, eax
jle 0x407735
mov dword [esp], 0x432f14
call sym._irlist_size
cmp edi, eax
jg 0x407735
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x40777c
cmp byte [eax], 0
jne 0x407786
mov dword [esp + 4], 0x4076a1
jmp 0x40773d
mov dword [esp], 0x432f14
lea eax, [edi - 1]
mov dword [esp + 4], eax
call sym._irlist_get_nth
mov ebx, eax
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 4]
mov dword [esp + 8], edi
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x4076d0
call sym._u_respond
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym._mydelete2
mov dword [ebx + 4], 0
mov eax, dword [esi + 0x1c]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0x716
inc eax
mov dword [esp + 8], 0x40205b
mov dword [esp + 4], 0x407698
mov dword [esp], eax
call sym._mycalloc2
mov dword [ebx + 4], eax
mov eax, dword [esi + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym._strcpy
mov dword [ebp + 8], 0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp sym._xdccsave
Function at 0x407880
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [esp + 8], 0x722
mov dword [esp + 4], 0x407828
mov dword [esp], 0x40205b
call sym._updatecontext_f
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4078d2
mov dword [esp], ebx
mov dword [esp + 4], 0x405bb0
call sym._u_respond
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], eax
call sym._atoi
test eax, eax
mov esi, eax
jle 0x4078b5
mov dword [esp], 0x432f14
call sym._irlist_size
cmp esi, eax
jg 0x4078b5
mov dword [esp], 0x432f14
lea eax, [esi - 1]
mov dword [esp + 4], eax
call sym._irlist_get_nth
mov edi, eax
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x407911
mov eax, 0x403002
mov dword [esp + 0x10], eax
mov eax, dword [edi + 8]
mov dword [esp + 8], esi
mov dword [esp + 4], 0x407850
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call sym._u_respond
mov eax, dword [edi + 8]
mov dword [esp], eax
call sym._mydelete2
mov dword [edi + 8], 0
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x40798b
mov dword [esp + 0xc], 0x735
mov dword [esp + 8], 0x40205b
mov dword [esp + 4], 0x407828
mov dword [esp], 1
call sym._mycalloc2
mov dword [edi + 8], eax
mov byte [eax], 0
mov dword [ebp + 8], 0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp sym._xdccsave
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0x73a
inc eax
mov dword [esp + 8], 0x40205b
mov dword [esp + 4], 0x407828
mov dword [esp], eax
call sym._mycalloc2
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [edi + 8]
mov dword [esp], eax
call sym._strcpy
jmp 0x407973
Function at 0x407ce0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
mov dword [esp + 8], 0x783
mov dword [esp + 4], 0x407c8a
mov dword [esp], 0x40205b
call sym._updatecontext_f
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x407d32
mov dword [esp + 4], 0x405bb0
mov dword [esp], esi
call sym._u_respond
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], eax
call sym._atoi
test eax, eax
mov edi, eax
jle 0x407d15
mov dword [esp], 0x432f14
call sym._irlist_size
cmp edi, eax
jg 0x407d15
mov eax, dword [esi + 0x10]
test eax, eax
je 0x407d5c
cmp byte [eax], 0
jne 0x407d66
mov dword [esp + 4], 0x407c93
jmp 0x407d1d
mov dword [esp], 0x432f14
lea eax, [edi - 1]
mov dword [esp + 4], eax
call sym._irlist_get_nth
mov ebx, eax
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call sym._atoi
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 8], edi
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x407cb0
call sym._u_respond
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call sym._atoi
mov dword [ebx + 0xc], eax
mov ebx, dword [ebp - 0xc]
mov dword [ebp + 8], 0
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp sym._xdccsave
Function at 0x409fc0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [esp + 8], 0x999
mov dword [esp + 4], 0x409ef2
mov dword [esp], 0x40205b
call sym._updatecontext_f
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x40a006
mov dword [esp], eax
call sym._atoi
mov edi, eax
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x40a023
mov dword [esp + 4], 0x409f10
mov dword [esp], ebx
call sym._u_respond
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x40a037
mov dword [esp], eax
call sym._strlen
cmp eax, 3
ja 0x40a041
mov dword [esp + 4], 0x409f50
jmp 0x40a00e
mov dword [esp], 0x432f08
call sym._irlist_get_head
test eax, eax
mov esi, eax
je 0x40a0a7
lea esi, [esi]
lea edi, [edi]
mov eax, dword [esi + 4]
test eax, eax
je 0x40a099
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebx + 0x10]
mov dword [esp + 4], eax
mov eax, dword [esi + 4]
mov dword [esp], eax
call sym._regexec
test eax, eax
je 0x40a1c8
mov dword [esp], esi
call sym._irlist_get_next
test eax, eax
mov esi, eax
jne 0x40a060
mov dword [esp + 0x10], 0x9b7
mov dword [esp + 0xc], 0x40205b
mov dword [esp + 8], 0x409ef2
mov dword [esp + 4], 0x14
mov dword [esp], 0x432f08
call sym._irlist_add2
mov dword [esp + 0xc], 0x9b8
mov esi, eax
mov dword [esp + 8], 0x40205b
mov dword [esp + 4], 0x409ef2
mov dword [esp], 0x10
call sym._mycalloc2
mov dword [esi + 4], eax
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0x9ba
inc eax
mov dword [esp + 8], 0x40205b
mov dword [esp + 4], 0x409ef2
mov dword [esp], eax
call sym._mycalloc2
mov dword [esi], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 4], eax
mov eax, dword [esi]
mov dword [esp], eax
call sym._strcpy
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sym._hostmasktoregex
mov dword [ebp - 0x10], eax
mov dword [esp + 8], 6
mov dword [esp + 4], eax
mov eax, dword [esi + 4]
mov dword [esp], eax
call sym._regcomp
test eax, eax
je 0x40a16b
mov dword [esi + 4], 0
movzx eax, word [esi + 8]
or eax, 2
mov word [esi + 8], ax
mov eax, dword [0x4314b4]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._mydelete2
movzx eax, word [esi + 8]
or eax, 1
mov word [esi + 8], ax
lea eax, [edi + edi*2]
add eax, eax
mov dword [esi + 0xc], eax
mov dword [esp + 0xc], edi
mov eax, dword [ebx + 0x10]
mov dword [esp], ebx
mov dword [esp + 4], 0x409f90
mov dword [esp + 8], eax
call sym._u_respond
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp sym._write_ignorefile
test esi, esi
jne 0x40a189
jmp 0x40a0a7
Function at 0x40a610
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], edi
xor edi, edi
mov dword [esp + 8], 0xa25
mov dword [esp + 4], 0x40a5cc
mov dword [esp], 0x40205b
call sym._updatecontext_f
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x40a760
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x40a750
test esi, esi
jle 0x40a730
mov dword [esp], 0x432f14
call sym._irlist_size
cmp esi, eax
jg 0x40a730
test edi, edi
jle 0x40a730
mov dword [esp], 0x432f14
call sym._irlist_size
cmp edi, eax
jg 0x40a730
cmp edi, esi
je 0x40a730
mov dword [esp], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], 0x40a5d7
call sym._u_respond
mov dword [esp], 0x432f14
lea eax, [esi - 1]
mov dword [esp + 4], eax
call sym._irlist_get_nth
mov dword [esp + 4], eax
mov ebx, eax
mov dword [esp], 0x432f14
call sym._irlist_remove
cmp edi, 1
je 0x40a719
mov dword [esp], 0x432f14
lea eax, [edi - 2]
mov dword [esp + 4], eax
call sym._irlist_get_nth
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], 0x432f14
call sym._irlist_insert_after
mov dword [ebp + 8], 0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp sym._xdccsave
mov dword [esp + 4], ebx
mov dword [esp], 0x432f14
call sym._irlist_insert_head
jmp 0x40a701
mov dword [esp], ebx
mov dword [esp + 4], 0x40a5ef
call sym._u_respond
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], eax
call sym._atoi
mov edi, eax
jmp 0x40a658
mov dword [esp], eax
call sym._atoi
mov esi, eax
jmp 0x40a64d
Function at 0x40b210
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [esp + 8], 0xadf
mov dword [esp + 4], 0x40b10a
mov dword [esp], 0x40205b
call sym._updatecontext_f
mov eax, dword [ebx + 0xc]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x40b2a0
mov dword [esp], eax
call sym._caps
mov ecx, dword [ebx + 0xc]
test ecx, ecx
mov dword [ebp - 0x10], ecx
je 0x40b2a0
cld
mov eax, 4
mov esi, ecx
mov edi, 0x40b115
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40b2c0
mov esi, dword [ebp - 0x10]
mov eax, 8
mov edi, 0x40b119
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40b2c0
mov esi, dword [ebp - 0x10]
mov eax, 7
mov edi, 0x40b121
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40b2c0
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 4], 0x40b130
mov dword [esp], ebx
call sym._u_respond
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
cld
mov esi, dword [ebp - 0x10]
mov edx, 4
mov edi, 0x40b115
mov ecx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40b340
cld
mov esi, dword [ebp - 0x10]
mov eax, 8
mov edi, 0x40b119
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40b315
cld
mov esi, dword [ebp - 0x10]
mov eax, 7
mov edi, 0x40b121
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40b2b0
mov dword [esp + 4], 0x40b155
mov dword [esp], ebx
call sym._u_respond
xor eax, eax
mov dword [0x431764], eax
jmp 0x40b2b0
mov dword [esp + 4], 0x40b170
mov dword [esp], ebx
call sym._u_respond
mov dword [esp + 4], 0x40b1d0
mov dword [esp], ebx
call sym._u_respond
mov eax, 1
jmp 0x40b30e
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp sym._shutdowniroffer
Function at 0x40cde0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x24
mov dword [esp + 8], 0x1d
mov dword [esp + 4], 0x40ccb0
mov dword [esp], 0x40ccc0
call sym._updatecontext_f
cmp dword [0x431498], 0x1fe
je 0x40cea8
mov dword [esp], 0x40ccf0
call sym._writedccchat
mov dword [esp], 0x40cd12
call sym._writedccchat
mov dword [esp + 0xc], 0x40cd17
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sym._ioutput
mov dword [esp], 0x186a0
mov ecx, dword [0x431498]
mov eax, 0xfffffffe
mov edx, ecx
and ecx, 0x1f
shr edx, 5
rol eax, cl
and dword [edx*4 + 0x4314c0], eax
call sym._usleep
mov dword [esp + 4], 2
mov eax, dword [0x431498]
mov dword [esp], eax
call sym._shutdown
mov eax, dword [0x431498]
mov dword [esp], eax
call sym._close
mov eax, 0x1fe
mov dword [0x431498], eax
call sym._highestsock
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call sym._socket
mov dword [0x4314a0], eax
test eax, eax
mov edx, eax
js 0x40d003
mov edi, dword [0x4312ac]
test edi, edi
jne 0x40cfd0
cld
xor eax, eax
mov edi, 0x4314a4
mov ecx, 4
xor edx, edx
rep stosd dword es:[edi], eax
mov dword [0x4314a8], edx
mov eax, dword [0x4314a0]
mov ecx, 2
mov word [0x4314a4], cx
mov dword [esp + 4], 0x4314a4
mov dword [esp], eax
call sym._ir_bind_listen_socket
test eax, eax
js 0x40cfb0
movzx eax, word [0x4314a6]
xchg ah, al
mov dword [esp + 4], 1
movzx edi, ax
mov eax, dword [0x4314a0]
mov dword [esp], eax
call sym._listen
test eax, eax
js 0x40cf73
call sym._highestsock
mov dword [esp + 0xc], edi
mov eax, dword [0x431280]
mov dword [esp + 4], 0x40cd27
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._privmsg_fast
xor eax, eax
add esp, 0x24
pop edi
pop ebp
ret
call sym.___errno
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40cd3e
mov dword [esp], 1
call sym._outerror
mov eax, 0x1fe
mov dword [0x4314a0], eax
mov eax, 1
jmp 0x40cf6d
call sym.___errno
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40cd70
jmp 0x40cf8e
mov dword [ebp - 8], 1
lea eax, [ebp - 8]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 0xffff
mov dword [esp], edx
call sym._setsockopt
jmp 0x40cee1
call sym.___errno
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40cdb0
jmp 0x40cf8e