joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a8378
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x4d42a0
push esi
call fcn.004b5f6c
test eax, eax
jne 0x4a83d5
push 6
push esi
call sub.USER32.dll_ShowWindow
cmp dword [0x4d42f4], 0
je 0x4a83b5
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jl 0x4a83b5
push 0
push esi
call sub.USER32.dll_ShowWindow
cmp esi, dword [0x4d42a8]
jne 0x4a83c4
xor eax, eax
mov dword [0x4d42a8], eax
push esi
call fcn.004b7934
push eax
call fcn.004a78e4
jmp 0x4a852a
cmp dword [ebp + 0xc], 0
je 0x4a84c8
push 5
mov edx, dword [edi]
push edx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x4a843b
push ebx
call fcn.004b5f6c
test eax, eax
je 0x4a842d
push ebx
call sub.USER32.dll_IsIconic
test eax, eax
je 0x4a842d
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x4a842d
push ebx
call fcn.004a7598
test eax, eax
je 0x4a842d
push 0
push ebx
call sub.USER32.dll_ShowWindow
push 5
mov eax, dword [edi]
push eax
call sub.USER32.dll_GetWindow
mov ebx, eax
jmp 0x4a83eb
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x4a83ef
push 5
mov eax, dword [edi]
push eax
call sub.USER32.dll_GetWindow
mov ebx, eax
cmp esi, ebx
jne 0x4a84c8
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x4a8471
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
jne 0x4a8471
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x4a8459
test ebx, ebx
je 0x4a849b
cmp esi, ebx
je 0x4a849b
push 5
push ebx
call sub.USER32.dll_ShowWindow
push ebx
call sub.USER32.dll_UpdateWindow
push ebx
call sub.USER32.dll_BringWindowToTop
push ebx
call fcn.004b7934
push eax
call fcn.004a78e4
jmp 0x4a84c8
mov eax, dword [0x4d42ac]
push eax
call fcn.004b5f6c
test eax, eax
je 0x4a84c8
mov edx, dword [0x4d42ac]
push edx
call sub.USER32.dll_SetFocus
mov ebx, dword [0x4d42ac]
push ebx
call fcn.004b7934
push eax
call fcn.004a78e4
push 0
push esi
call sub.USER32.dll_ShowWindow
mov eax, dword [edi]
push eax
call sub.USER32.dll_UpdateWindow
push esi
call sub.USER32.dll_UpdateWindow
push 0
push 0
push 0xb
mov edx, dword [edi]
push edx
call sub.USER32.dll_SendMessageA
push 7
push esi
call sub.USER32.dll_ShowWindow
push 0
push esi
call sub.USER32.dll_ShowWindow
push 0
push 1
push 0xb
mov ecx, dword [edi]
push ecx
call sub.USER32.dll_SendMessageA
mov eax, dword [edi]
push eax
call sub.USER32.dll_UpdateWindow
push esi
call sub.USER32.dll_UpdateWindow
push esi
call fcn.004a8254
push esi
call fcn.004b7934
push eax
call fcn.004a78e4
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4ad7a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp eax, 0x1c
jne 0x4ad7c5
mov edx, dword [0x4d3adc]
test edx, edx
je 0x4ad7c5
mov eax, edx
jmp 0x4ad8be
push 2
movzx ecx, ax
push ecx
push ebx
call sub.KERNEL32.dll_FindResourceA
test eax, eax
jne 0x4ad7dc
xor eax, eax
jmp 0x4ad8be
push eax
push ebx
call sub.KERNEL32.dll_LoadResource
mov edi, eax
push edi
call sub.KERNEL32.dll_LockResource
mov ebx, eax
test ebx, ebx
jne 0x4ad7f8
xor eax, eax
jmp 0x4ad8be
lea edx, [ebx + 0x28]
mov dword [ebp - 0x1c], edx
mov cx, word [ebx + 0xe]
mov eax, 1
shl eax, cl
shl eax, 2
add dword [ebp - 0x1c], eax
mov edx, dword [ebx + 4]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebx + 8]
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
push 0
call sub.USER32.dll_GetDC
mov esi, eax
test esi, esi
je 0x4ad8b5
push esi
call sub.GDI32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4ad8ad
mov eax, dword [ebp - 0x18]
push eax
mov edx, dword [ebp - 0x10]
push edx
push esi
call sub.GDI32.dll_CreateCompatibleBitmap
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4ad8a4
mov ecx, dword [ebp - 4]
push ecx
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.dll_SelectObject
mov dword [ebp - 8], eax
push 0xcc0020
push 0
push ebx
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x18]
push ecx
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x14]
push ecx
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.dll_StretchDIBits
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
call sub.GDI32.dll_SelectObject
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.dll_DeleteDC
push esi
push 0
call sub.USER32.dll_ReleaseDC
push edi
call sub.KERNEL32.dll_FreeResource
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b07a0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov al, byte [ebp + 8]
cmp eax, 6
ja case.0x4b07b2.0
jmp dword [eax*4 + 0x4b07b9]
push 0
push str.Shell_TrayWnd
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x4b0836
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x4b0811
cmp ebx, dword [0x4d429c]
je 0x4b0811
push ebx
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x4b07e7
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x4b07e7
cmp ebx, dword [0x4d429c]
jne 0x4b0836
push ebx
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x4b0836
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x4b0836
call fcn.004b0864
test eax, eax
jne case.0x4b07b2.0
cmp dword [0x4d3dd0], 0
je 0x4b0846
push 2
call fcn.004b0d5c
push 5
mov eax, dword [0x4d429c]
push eax
call sub.USER32.dll_ShowWindow
call fcn.004b0694
jmp case.0x4b07b2.0
call fcn.004b0354
pop ebx
pop ebp
ret 4

Function at 0x4b0864
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4b087b
mov word [0x4ef1d4], 1
jmp 0x4b0884
mov word [0x4ef1d4], 0
cmp dword [0x4d3dd8], 0
jne 0x4b08b0
cmp dword [0x4d3dd4], 0
je 0x4b08a3
cmp word [0x4ef1d4], 0
je 0x4b08b0
xor eax, eax
ret
cmp word [0x4ef1d4], 0
jne 0x4b08b0
xor eax, eax
ret
push 1
call fcn.004b0d5c
test eax, eax
jne 0x4b08be
xor eax, eax
ret
cmp dword [0x4d3dd4], 0
je 0x4b08f1
cmp word [0x4ef1d4], 0
je 0x4b08e1
push 6
mov edx, dword [0x4d429c]
push edx
call sub.USER32.dll_ShowWindow
jmp 0x4b0918
push 0
mov ecx, dword [0x4d429c]
push ecx
call sub.USER32.dll_ShowWindow
jmp 0x4b0918
cmp word [0x4ef1d4], 0
je 0x4b090a
push 0
mov eax, dword [0x4d429c]
push eax
call sub.USER32.dll_ShowWindow
jmp 0x4b0918
push 6
mov edx, dword [0x4d429c]
push edx
call sub.USER32.dll_ShowWindow
mov eax, 1
ret
Function at 0x4b1190
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, str._urls_
cmp dword [0x4d3e38], 0
jne 0x4b11ba
push ebx
lea eax, [edi + 8]
push eax
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x4b11c8
push ebx
lea edx, [edi + 0x29]
push edx
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0xffffffffffffffff
push 2
lea ecx, [edi + 0x50]
push ecx
push esi
lea eax, [edi + 0x43]
push eax
call fcn.004339d4
test eax, eax
je 0x4b1214
cmp dword [0x4d3e3c], 1
jne 0x4b12ac
push 0xffffffffffffffff
push 2
lea edx, [edi + 0x72]
push edx
lea ecx, [edi + 0x62]
push ecx
lea eax, [edi + 0x54]
push eax
call fcn.004339d4
test eax, eax
jne 0x4b12ac
push 0
call sub.USER32.dll_MessageBeep
jmp 0x4b12ac
call fcn.00494080
cmp byte [0x4e8808], 0
jne 0x4b1251
push edi
lea esi, [edi + 0x76]
mov edi, 0x4e8808
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov dword [0x4d1cbc], 4
push 0
push 0x67
push 0x111
mov edx, dword [0x4d429c]
push edx
call sub.USER32.dll_PostMessageA
jmp 0x4b12ac
push 0x8000
call sub.KERNEL32.dll_SetErrorMode
push 5
push 0x4e23ec
push ebx
push 0x4e8808
lea ecx, [edi + 0x7f]
push ecx
mov eax, dword [0x4d429c]
push eax
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x1f
jae 0x4b12ac
push edi
lea esi, [edi + 0x85]
mov edi, 0x4e8808
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
push 0
call sub.USER32.dll_MessageBeep
push 0
push 0x4ce
push 0x111
mov edx, dword [0x4d429c]
push edx
call sub.USER32.dll_PostMessageA
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4b1a58
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, 0x4ef619
push 0x7f02
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
mov dword [ebp - 4], eax
push 0
push 0
push 0x184
push 0x425
mov eax, dword [0x4d42b4]
push eax
call sub.USER32.dll_SendDlgItemMessageA
push 0
push 0x425
mov edx, dword [0x4d42b4]
push edx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
mov ebx, dword [0x4d3e2c]
test ebx, ebx
je 0x4b1bdf
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x4b1ad6
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebx]
push ecx
call fcn.0040b604
test eax, eax
jne 0x4b1ad6
mov ebx, dword [ebx + 0x2c]
jmp 0x4b1ab1
push esi
mov edi, esi
mov esi, 0x4d40ed
mov eax, edi
movsw word es:[edi], word [esi]
pop esi
mov edx, dword [ebx]
push edx
push esi
call fcn.004bcdd0
add esp, 8
push 0x3a
push esi
call fcn.004bce0c
add esp, 8
test eax, eax
je 0x4b1b01
mov byte [eax], 9
push 0x4d40f0
push esi
call fcn.004bd134
add esp, 8
test eax, eax
je 0x4b1bd4
lea edi, [eax + 4]
mov byte [eax], 9
inc eax
mov byte [eax], 0
push esi
push edi
mov esi, 0x4efa00
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
cmp byte [0x4efa00], 0
je 0x4b1bd4
push str.URL:
push esi
call fcn.004bcdd0
add esp, 8
push 0x4efa00
push esi
call fcn.004bcdd0
add esp, 8
push 0x4efa00
push esi
call fcn.004b12b4
cmp eax, 0xffffffff
jne 0x4b1b9a
push esi
push 0
push 0x180
push 0x425
mov eax, dword [0x4d42b4]
push eax
call sub.USER32.dll_SendDlgItemMessageA
jmp 0x4b1bb2
push esi
push eax
push 0x181
push 0x425
mov edx, dword [0x4d42b4]
push edx
call sub.USER32.dll_SendDlgItemMessageA
cmp eax, 0xffffffff
je 0x4b1bd4
mov ecx, dword [0x4cb07c]
push ecx
push eax
push 0x19a
push 0x425
mov eax, dword [0x4d42b4]
push eax
call sub.USER32.dll_SendDlgItemMessageA
mov ebx, dword [ebx + 0x2c]
test ebx, ebx
jne 0x4b1ab9
push 3
push 0x4d40fb
push 0x425
mov edx, dword [0x4d42b4]
push edx
call fcn.004b747c
push 5
push 0x425
mov ecx, dword [0x4d42b4]
push ecx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0x425
mov eax, dword [0x4d42b4]
push eax
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_UpdateWindow
call fcn.004b1a00
mov edx, dword [ebp - 4]
push edx
call sub.USER32.dll_SetCursor
mov eax, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x4b6120
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov al, byte [ebx + 0x4cc]
test al, al
jne 0x4b613c
mov eax, 0x4d43e0
jmp 0x4b61d9
cmp al, 1
jne 0x4b6148
lea eax, [ebx + 4]
jmp 0x4b61d9
cmp al, 2
jne 0x4b617f
mov al, byte [ebx + 0x4cd]
cmp al, 1
jne 0x4b615b
lea eax, [ebx + 4]
jmp 0x4b61d9
cmp al, 2
jne 0x4b6166
mov eax, 0x4d43e9
jmp 0x4b61d9
push 0x20
lea esi, [ebx + 4]
push esi
call fcn.004bce0c
add esp, 8
test eax, eax
jne 0x4b617c
mov eax, esi
jmp 0x4b61d9
inc eax
jmp 0x4b61d9
mov al, byte [ebx + 0x4cc]
cmp al, 3
jne 0x4b61a0
cmp byte [ebx + 0x4cd], 1
jne 0x4b6199
mov eax, str.odccs
jmp 0x4b61d9
mov eax, str.odccg
jmp 0x4b61d9
cmp al, 4
jne 0x4b61ab
mov eax, str.olist
jmp 0x4b61d9
cmp al, 5
jne 0x4b61b6
mov eax, str.ofinger
jmp 0x4b61d9
cmp al, 6
jne 0x4b61c1
mov eax, str.ourl
jmp 0x4b61d9
cmp al, 7
jne 0x4b61cc
mov eax, str.onotify
jmp 0x4b61d9
cmp al, 8
jne 0x4b61d7
mov eax, str.olinks
jmp 0x4b61d9
xor eax, eax
test eax, eax
je 0x4b620c
push str.mirc.ini
push 0x3e7
push 0x4e4b90
push 0x4d442f
push eax
push str.ontop
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x4e4b90], 0
je 0x4b620c
mov eax, 1
jmp 0x4b620e
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4b67a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push esi
call fcn.004b7934
mov ebx, eax
test ebx, ebx
je 0x4b67be
cmp byte [ebx + 0x4cc], 1
je 0x4b67ca
push 0
call sub.USER32.dll_MessageBeep
jmp 0x4b691b
push 0x4375cc
push 0x50
push esi
call fcn.00434b58
mov esi, eax
test esi, esi
jle 0x4b691b
push ebx
call fcn.004b5f30
test eax, eax
je 0x4b691b
test esi, 1
je 0x4b67fb
xor edi, edi
jmp 0x4b6834
test esi, 2
je 0x4b680a
mov edi, 1
jmp 0x4b6834
test esi, 4
je 0x4b6819
mov edi, 2
jmp 0x4b6834
push str.mirc.ini
push 0
lea eax, [ebx + 4]
push eax
push 0x4d4530
call fcn.0045cffc
mov edi, dword [0x4d4354]
test esi, 0x10
je 0x4b685d
test esi, 8
je 0x4b6857
push str.mirc.ini
push 0
push 0
push 0x4d453a
call fcn.0045cffc
mov dword [0x4d4354], edi
mov eax, edi
mov byte [ebx + 0x4e4], al
cmp edi, 2
jne 0x4b6888
push 0
mov edx, dword [ebx + 0x51c]
push edx
call sub.USER32.dll_ShowWindow
push 0
mov ecx, dword [ebx + 0x51c]
push ecx
call sub.USER32.dll_EnableWindow
jmp 0x4b68a4
push 1
mov eax, dword [ebx + 0x51c]
push eax
call sub.USER32.dll_EnableWindow
push 8
mov edx, dword [ebx + 0x51c]
push edx
call sub.USER32.dll_ShowWindow
push 0
mov ecx, dword [ebx]
push ecx
call fcn.004b7ee4
call fcn.0045f8c8
test esi, 8
jne 0x4b691b
test esi, 0x10
jne 0x4b691b
cmp byte [ebx + 0x4e4], 0
jne 0x4b68dd
mov esi, 0x4d4544
mov edi, 0x4e4b90
mov eax, edi
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4b6903
cmp byte [ebx + 0x4e4], 1
jne 0x4b68f6
mov esi, 0x4d454b
mov edi, 0x4e4b90
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4b6903
mov esi, 0x4d4551
mov edi, 0x4e4b90
mov eax, edi
movsd dword es:[edi], dword [esi]
push str.mirc.ini
push 0x4e4b90
add ebx, 4
push ebx
push 0x4d4556
call fcn.0045cffc
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4b6924
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call fcn.004b7934
test eax, eax
je 0x4b693d
cmp byte [eax + 0x4cc], 1
je 0x4b6947
mov eax, dword [0x4d4354]
jmp 0x4b69cb
push str.mirc.ini
push 0x3e7
push 0x4e4b90
push 0x4d456a
add eax, 4
push eax
push str.nicklist
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x4e4b90], 0
je 0x4b69c6
push str.right
push 0x4e4b90
call fcn.004bcfe4
add esp, 8
test eax, eax
jne 0x4b698c
xor eax, eax
jmp 0x4b69cb
push str.left
push 0x4e4b90
call fcn.004bcfe4
add esp, 8
test eax, eax
jne 0x4b69a9
mov eax, 1
jmp 0x4b69cb
push 0x4d457b
push 0x4e4b90
call fcn.004bcfe4
add esp, 8
test eax, eax
jne 0x4b69c6
mov eax, 2
jmp 0x4b69cb
mov eax, dword [0x4d4354]
pop ebp
ret 4
Function at 0x4b7244
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push 0x4d45bf
push ebx
call fcn.004bcfe4
add esp, 8
test eax, eax
jne 0x4b7283
push str.mirc.ini
push 0x3e7
push 0x4e4b90
push 0x4d45e2
push 0x4d45d8
push 0x4d45cf
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x4b72d1
push 0x20
push ebx
call fcn.004bd108
add esp, 8
mov esi, eax
mov dword [0x4f0d18], esi
test esi, esi
je 0x4b72ac
inc dword [0x4f0d18]
mov eax, dword [0x4f0d18]
cmp byte [eax], 0
je 0x4b72ac
mov ebx, eax
cmp byte [ebx], 0x3d
jne 0x4b72b2
inc ebx
push str.mirc.ini
push 0x3e7
push 0x4e4b90
push 0x4d45f0
push ebx
push str.beeping
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x4d45f5
push 0x4e4b90
call fcn.004bcfe4
add esp, 8
test eax, eax
jne 0x4b72ee
mov eax, 1
jmp 0x4b72f0
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4b73c8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push str.Message_Window
push ebx
call fcn.004bcfe4
add esp, 8
test eax, eax
jne 0x4b7407
push str.mirc.ini
push 0x3e7
push 0x4e4b90
push 0x4d463f
push 0x4d4635
push 0x4d462b
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x4b7455
push 0x20
push ebx
call fcn.004bd108
add esp, 8
mov esi, eax
mov dword [0x4f0d1c], esi
test esi, esi
je 0x4b7430
inc dword [0x4f0d1c]
mov eax, dword [0x4f0d1c]
cmp byte [eax], 0
je 0x4b7430
mov ebx, eax
cmp byte [ebx], 0x3d
jne 0x4b7436
inc ebx
push str.mirc.ini
push 0x3e7
push 0x4e4b90
push 0x4d464e
push ebx
push str.flashing
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x4d4653
push 0x4e4b90
call fcn.004bcfe4
add esp, 8
test eax, eax
jne 0x4b7472
mov eax, 1
jmp 0x4b7474
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4b7840
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov al, byte [ebx + 0x4cc]
test al, al
jne 0x4b7859
mov eax, str.ostatus
jmp 0x4b789d
cmp al, 1
jne 0x4b7862
lea eax, [ebx + 4]
jmp 0x4b789d
cmp al, 2
jne 0x4b7899
mov al, byte [ebx + 0x4cd]
cmp al, 1
jne 0x4b7875
lea eax, [ebx + 4]
jmp 0x4b789d
cmp al, 2
jne 0x4b7880
mov eax, str.omessage
jmp 0x4b789d
push 0x20
lea esi, [ebx + 4]
push esi
call fcn.004bce0c
add esp, 8
test eax, eax
jne 0x4b7896
mov eax, esi
jmp 0x4b789d
inc eax
jmp 0x4b789d
xor eax, eax
jmp 0x4b78cb
push str.mirc.ini
push 0x3e7
push 0x4e4b90
push 0x4d46a2
push eax
push str.timestamp
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x4e4b90], 0
je 0x4b78c9
mov al, 1
jmp 0x4b78cb
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4bb260
Capabilities:
Initialize winsock library

Disassembly:
push ebx
add esp, 0xfffffe70
push esp
push 0x101
call sub.WSOCK32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x4bb29f
push 0x10
push str._H_B_mIRc
push ebx
call fcn.004bb208
push eax
mov eax, dword [0x4d429c]
push eax
call sub.USER32.dll_MessageBoxA
mov dword [0x4d4934], 1
xor eax, eax
jmp 0x4bb2ae
mov dword [0x4d4934], 1
mov eax, 1
add esp, 0x190
pop ebx
ret
Function at 0x4bba30
Capabilities:
Get hostname

Disassembly:
push esi
push edi
mov dword [0x4d4928], 1
mov esi, 0x4e3d41
mov edi, 0x4d1ad6
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x4d1ba8], 0
jne 0x4bba93
cmp byte [0x4d1ad6], 0
je 0x4bba93
push 0
push 0x1774
call fcn.0040a8fc
push eax
push 0x4d1ad6
call fcn.004bcfe4
add esp, 8
test eax, eax
jne 0x4bbad3
push 0x64
push 0x4d1ad6
call sub.WSOCK32.dll_gethostname
test eax, eax
je 0x4bbad3
push 0
push 0x1774
call fcn.0040a8fc
mov edi, eax
mov esi, 0x4d1ad6
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x4d4928], 0
jne 0x4bbae1
xor eax, eax
pop edi
pop esi
ret
cmp dword [0x4d1bac], 0
jne 0x4bbb23
cmp dword [0x4d1ba4], 0
je 0x4bbb23
mov eax, 0x4d1ad6
mov edx, 0x4e3d41
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4bbb1d
test cl, cl
je 0x4bbc6e
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4bbb1d
add eax, 2
add edx, 2
test cl, cl
jne 0x4bbafd
je 0x4bbc6e
push 0
push 0x1774
call fcn.0040a8fc
push eax
push 0x4d1ad6
call fcn.004bcfe4
add esp, 8
test eax, eax
jne 0x4bbbc5
push 0
push 0x1774
call fcn.0040a8fc
mov edi, eax
mov esi, 0x4d1b3a
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov dword [0x4d1ba4], eax
cmp dword [0x4d4908], 0
je 0x4bbbc0
mov dword [0x4d2304], 1
mov edx, dword [0x4cb06c]
push edx
push 0
push 0x1779
call fcn.0040a8fc
push eax
mov ecx, dword [0x4d42ac]
push ecx
call fcn.0048e560
mov dword [0x4d4938], 1
push 1
call fcn.004bb608
xor eax, eax
pop edi
pop esi
ret
cmp dword [0x4d4928], 0
jne 0x4bbbd3
xor eax, eax
pop edi
pop esi
ret
push 0x400
push 0
push 0x4f12c8
call fcn.004bcd2c
add esp, 0xc
push 0x400
push 0x4f12c8
push 0x4d1ad6
push 0x40a
mov edx, dword [0x4d429c]
push edx
call sub.WSOCK32.dll_WSAAsyncGetHostByName
mov dword [0x4d4924], eax
test eax, eax
jne 0x4bbc6e
cmp dword [0x4d490c], 0
je 0x4bbc1e
xor eax, eax
pop edi
pop esi
ret
xor edx, edx
mov dword [0x4d1ba4], edx
cmp dword [0x4d4908], 0
je 0x4bbc69
mov dword [0x4d2304], 1
mov ecx, dword [0x4cb06c]
push ecx
push 0
push 0x177a
call fcn.0040a8fc
push eax
mov eax, dword [0x4d42ac]
push eax
call fcn.0048e560
mov dword [0x4d4938], 2
push 1
call fcn.004bb608
xor eax, eax
pop edi
pop esi
ret
xor eax, eax
pop edi
pop esi
ret
Function at 0x4bbf28
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov eax, dword [ebp + 8]
shr eax, 0x10
test ax, 0xffff
je 0x4bbf7f
cmp dword [0x4d490c], 0
je 0x4bbf4c
xor eax, eax
jmp 0x4bc166
cmp dword [0x4d4908], 0
je 0x4bbf5f
mov dword [0x4d4938], 3
push 0
call fcn.004bb608
push 0
push 0x177b
call fcn.0040a8fc
push eax
call fcn.004bb2b8
xor eax, eax
jmp 0x4bc166
xor edx, edx
mov dword [0x4d4904], edx
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.004bcd2c
add esp, 0xc
mov word [ebp - 0x10], 2
xor eax, eax
mov dword [ebp - 0xc], eax
mov dx, word [0x4d1ad4]
push edx
call sub.WSOCK32.dll_htons
mov word [ebp - 0xe], ax
mov eax, dword [0x4f1ab0]
cmp eax, 0xffffffff
je 0x4bbfc2
mov dword [ebp - 0xc], eax
jmp 0x4bc032
mov ebx, 0x4f0ec8
mov eax, dword [ebx + 0xc]
mov edx, dword [eax]
mov ecx, dword [edx]
mov dword [ebp - 0xc], ecx
cmp dword [0x4d492c], 0
jne 0x4bc032
mov eax, dword [ebx + 0xc]
cmp dword [eax + 4], 0
je 0x4bc032
mov esi, 1
jmp 0x4bc028
mov edx, dword [ebx + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call sub.WSOCK32.dll_inet_ntoa
push eax
push 0x4d496c
push 0x4e3d41
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push 0
push 0x4e3d41
mov eax, dword [0x4d492c]
push eax
call fcn.0046f388
mov dword [0x4d492c], eax
inc esi
mov edx, dword [ebx + 0xc]
mov eax, dword [edx + esi*4]
test eax, eax
jne 0x4bbfea
cmp dword [0x4cdf84], 0
je 0x4bc07b
push 0
call fcn.004483bc
mov edx, dword [ebp - 0xc]
push edx
call sub.WSOCK32.dll_inet_ntoa
push eax
push 0x4d4970
push 0x4e3d41
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push 0
mov cx, word [0x4d1ad4]
push ecx
push 0x4e3d41
call fcn.00448738
xor eax, eax
jmp 0x4bc166
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov ebx, eax
mov dword [0x4d4900], ebx
cmp ebx, 0xffffffff
jne 0x4bc0c8
mov dword [0x4d2304], 1
mov eax, dword [0x4cb064]
push eax
push 0
push 0x177c
call fcn.0040a8fc
push eax
mov edx, dword [0x4d42ac]
push edx
call fcn.0048e560
call fcn.0042b968
xor eax, eax
jmp 0x4bc166
push 0x10
push 0x40d
mov edx, dword [0x4d429c]
push edx
mov ecx, dword [0x4d4900]
push ecx
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea eax, [ebp - 0x10]
push eax
mov edx, dword [0x4d4900]
push edx
call sub.WSOCK32.dll_connect
test eax, eax
je 0x4bc164
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4bc164
cmp dword [0x4d490c], 0
je 0x4bc111
xor eax, eax
jmp 0x4bc166
push eax
call fcn.004bbe68
xor edx, edx
mov dword [0x4d22f4], edx
mov dword [0x4d2304], 1
mov ecx, dword [0x4cb06c]
push ecx
push 0x4e3d41
mov eax, dword [0x4d42ac]
push eax
call fcn.0048e560
cmp dword [0x4d4908], 0
je 0x4bc153
mov dword [0x4d4938], 4
push 0
call fcn.004bb608
push 0x4d4974
call fcn.004bb2b8
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4