joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fed4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
cmp dword [ebx + 4], 0
jne 0x44feff
push 1
mov eax, dword [ebp + 0x1c]
push eax
mov edx, dword [ebp + 0x18]
push edx
push ebx
mov ecx, dword [edi]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00488af4
jmp 0x44ff6e
mov esi, dword [ebx + 0x2c]
test esi, esi
jne 0x44ff0d
mov eax, 2
jmp 0x44ff6e
cmp dword [esi + 0x18], 1
jne 0x44ff69
cmp dword [esi + 8], 0
jne 0x44ff4f
mov edx, dword [esi]
push edx
call fcn.004b78d4
mov dword [0x4e1f78], eax
mov eax, dword [0x4e1f78]
test eax, eax
je 0x44ff4f
cmp dword [eax + 0x518], 0
je 0x44ff4f
mov edx, dword [ebp + 0x14]
push edx
push 0x1f4
push 0xd
mov ecx, dword [eax + 0x518]
push ecx
call sub.USER32.dll_SendMessageA
mov eax, dword [ebx + 0x2c]
push eax
mov edx, dword [edi]
push edx
call fcn.0046f72c
mov dword [edi], eax
xor ecx, ecx
mov dword [ebx + 4], ecx
mov eax, 2
jmp 0x44ff6e
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x45d160
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0x18]
mov edi, 0x4e266c
mov eax, dword [ebp + 0x10]
push eax
call fcn.0046f8e0
xor edx, edx
mov dword [ebp - 4], edx
xor ebx, ebx
push ebx
mov eax, dword [ebp + 0xc]
push eax
push 0x4cf222
push 0x4e2a53
call sub.USER32.dll_wsprintfA
add esp, 0x10
mov edx, dword [ebp + 0x14]
push edx
push 0x3e7
push edi
push 0x4cf228
push 0x4e2a53
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [edi], 0
je 0x45d295
cmp esi, 1
jne 0x45d240
push 0x4cf22c
push edi
call fcn.004bd134
add esp, 8
test eax, eax
jne 0x45d27a
push esi
push edi
mov esi, 0x4e2a53
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x3a
push 0x4e2a53
call fcn.004bce0c
add esp, 8
test eax, eax
jne 0x45d216
inc ebx
jmp 0x45d17f
mov byte [eax], 0
inc eax
cmp byte [eax], 0
jne 0x45d225
inc ebx
jmp 0x45d17f
push eax
push 0x4e2a53
push 0x4e2a53
push str._sSERVER:_s:_s
push edi
call sub.USER32.dll_wsprintfA
add esp, 0x14
jmp 0x45d27a
cmp esi, 2
jne 0x45d25d
push 0x4cf244
push edi
call fcn.004bd134
add esp, 8
test eax, eax
jne 0x45d27a
inc ebx
jmp 0x45d17f
cmp esi, 3
jne 0x45d27a
push 0x4cf249
push edi
call fcn.004bd134
add esp, 8
test eax, eax
jne 0x45d27a
inc ebx
jmp 0x45d17f
push 0
push 0
push edi
mov eax, dword [ebp - 4]
push eax
call fcn.0046f388
test eax, eax
je 0x45d28f
mov dword [ebp - 4], eax
inc ebx
jmp 0x45d17f
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x14
Function at 0x45d310
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x4cf204
mov esi, 0x4e702a
push str.mirc.ini
push 0x100
push esi
lea eax, [ebx + 0x5e]
push eax
lea edx, [ebx + 0x56]
push edx
lea ecx, [ebx + 0x4e]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push str.mirc.ini
push 0x100
lea eax, [esi + 0x100]
push eax
lea edx, [ebx + 0x71]
push edx
lea ecx, [ebx + 0x6a]
push ecx
lea eax, [ebx + 0x62]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
push str.mirc.ini
push 0x100
lea edx, [esi + 0x200]
push edx
lea ecx, [ebx + 0x86]
push ecx
lea eax, [ebx + 0x7d]
push eax
lea edx, [ebx + 0x75]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push str.mirc.ini
push 0x100
lea ecx, [esi + 0x300]
push ecx
lea eax, [ebx + 0x9c]
push eax
lea edx, [ebx + 0x92]
push edx
lea ecx, [ebx + 0x8a]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push str.mirc.ini
push 0x100
lea eax, [esi + 0x400]
push eax
lea edx, [ebx + 0xb0]
push edx
lea ecx, [ebx + 0xa8]
push ecx
lea eax, [ebx + 0xa0]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
jne 0x45d3e9
push esi
mov edi, esi
lea esi, [ebx + 0xb4]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
cmp byte [esi + 0x100], 0
jne 0x45d406
push esi
lea edi, [esi + 0x100]
lea esi, [ebx + 0xbd]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
cmp byte [esi + 0x200], 0
jne 0x45d422
push esi
lea edi, [esi + 0x200]
lea esi, [ebx + 0xc8]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
cmp byte [esi + 0x300], 0
jne 0x45d43f
push esi
lea edi, [esi + 0x300]
lea esi, [ebx + 0xd2]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
cmp byte [esi + 0x400], 0
jne 0x45d473
push esi
lea edi, [esi + 0x100]
add esi, 0x400
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop edi
pop esi
pop ebx
ret
Function at 0x45e860
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
cmp byte [ebx], 0
jne 0x45e8ec
test esi, esi
jne 0x45e8c6
push str.mirc.ini
push 0x3e7
push 0x4e266c
push 0x4cf468
push 0
mov eax, dword [ebp + 0x10]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x4e266c], 0
je 0x45e8c6
mov esi, ebx
mov edi, str.mirc.ini
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x45e9ab
mov eax, dword [ebp + 0xc]
push esi
mov esi, ebx
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push 0x4e266c
push ebx
call fcn.0040b1d4
push 0x4ece7b
push 0x4ecd7b
push 0x4ecc7b
push 0x4ecc78
push ebx
call fcn.004c11fc
add esp, 0x14
cmp byte [0x4ecc78], 0
jne 0x45e926
cmp byte [0x4ecc7b], 0
je 0x45e932
push 1
push ebx
call fcn.0040abec
test eax, eax
jne 0x45e9ab
push 0x4ece7b
push 0x4ecd7b
push 0x4e23ec
push 0x4cf46c
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0x14
push 1
push ebx
call fcn.0040abec
test eax, eax
jne 0x45e9ab
test esi, esi
jne 0x45e9ab
push str.mirc.ini
push 0x3e7
push 0x4e266c
push 0x4cf474
push 0
mov eax, dword [ebp + 0x10]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x4e266c], 0
je 0x45e9ab
mov esi, ebx
mov edi, str.mirc.ini
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x45ff7c
Capabilities:
Log keystrokes via polling

Disassembly:
add esp, 0xffffffa8
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
push ecx
lea eax, [esp + 0x18]
push eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x14]
push ecx
lea eax, [esp + 0x1c]
push eax
lea edx, [esp + 0x18]
push edx
push 0x4cfd73
call fcn.004b6480
cmp dword [0x4d3dd0], 0
je 0x45ffd9
mov ecx, dword [0x4d429c]
push ecx
call sub.USER32.dll_IsWindowVisible
test eax, eax
jne 0x45ffd9
mov dword [esp + 0x10], 3
jmp 0x460012
mov eax, dword [0x4d429c]
push eax
call sub.USER32.dll_IsIconic
test eax, eax
je 0x45fff2
mov dword [esp + 0x10], 1
jmp 0x460012
mov edx, dword [0x4d429c]
push edx
call sub.USER32.dll_IsZoomed
test eax, eax
je 0x46000c
mov dword [esp + 0x10], 2
jmp 0x460012
xor ecx, ecx
mov dword [esp + 0x10], ecx
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x460039
cmp dword [0x4d3dcc], 0
je 0x460031
mov dword [esp + 0x10], 3
jmp 0x460039
mov dword [esp + 0x10], 1
cmp dword [esp + 0x10], 0
jne 0x460076
lea eax, [esp + 0x48]
push eax
mov edx, dword [0x4d429c]
push edx
call sub.USER32.dll_GetWindowRect
mov eax, dword [esp + 0x48]
mov dword [esp], eax
mov edx, dword [esp + 0x50]
sub edx, eax
mov dword [esp + 8], edx
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], eax
mov edx, dword [esp + 0x54]
sub edx, eax
mov dword [esp + 0xc], edx
jmp 0x4600b1
mov dword [esp + 0x1c], 0x2c
lea ecx, [esp + 0x1c]
push ecx
mov eax, dword [0x4d429c]
push eax
call sub.USER32.dll_GetWindowPlacement
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov edx, dword [esp + 0x40]
sub edx, eax
mov dword [esp + 8], edx
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov edx, dword [esp + 0x44]
sub edx, eax
mov dword [esp + 0xc], edx
mov ecx, dword [esp + 0x18]
push ecx
mov eax, dword [esp + 0x18]
push eax
mov edx, dword [esp + 0x18]
push edx
mov ecx, dword [esp + 0x18]
push ecx
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [esp + 0x1c]
push edx
mov ecx, dword [esp + 0x18]
push ecx
push 0x4cfd79
push 0x4e2a53
call sub.USER32.dll_wsprintfA
add esp, 0x24
push str.mirc.ini
push 0x4e2a53
push 0x4cfd98
push 0x4cfd8f
call fcn.0045cffc
add esp, 0x58
ret
Function at 0x46fec8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4e4700
mov edi, 0x4e46f8
mov ebp, 0x4e46f4
cmp dword [0x4d42bc], 0
jne 0x46ff04
push 0
push 0
push 8
push 0x4d0cb8
call fcn.004baa48
mov esi, eax
mov dword [0x4d42bc], esi
test esi, esi
je 0x4700ef
mov eax, dword [0x4d42bc]
push eax
call fcn.004b7934
mov esi, eax
mov dword [ebp], esi
test esi, esi
je 0x4700ef
push 0x7f02
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
mov dword [0x4e4704], eax
push 0x425
mov eax, dword [0x4d42bc]
push eax
call sub.USER32.dll_GetDlgItem
mov esi, eax
mov dword [0x4e4708], esi
push 0
push esi
call sub.USER32.dll_ShowWindow
push 0
mov eax, dword [0x4e4708]
push eax
call sub.USER32.dll_EnableWindow
mov edx, dword [ebp]
mov ecx, dword [edx + 0x4b8]
push ecx
call fcn.0046f8e0
mov eax, dword [ebp]
xor edx, edx
mov dword [eax + 0x4b8], edx
push 0
push 0
push 0x184
mov ecx, dword [eax + 0x51c]
push ecx
call sub.USER32.dll_SendMessageA
push 0x13
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x4d42bc]
push eax
call sub.USER32.dll_SetWindowPos
mov eax, dword [0x4d0c98]
test eax, eax
je 0x470070
mov dword [ebx], eax
jmp 0x47003e
mov edx, dword [esi]
push esi
push edi
mov edi, edx
mov esi, 0x4e3928
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x2c
push 0x4e3928
call fcn.004bce0c
add esp, 8
mov esi, eax
mov dword [edi], esi
test esi, esi
je 0x470037
mov byte [esi], 0
inc dword [edi]
mov eax, dword [edi]
cmp byte [eax], 0
je 0x470037
push 0x2c
mov edx, dword [edi]
push edx
call fcn.004bce0c
add esp, 8
mov esi, eax
mov dword [0x4e46fc], esi
test esi, esi
je 0x470037
mov byte [esi], 0
mov eax, dword [edi]
push eax
push 0x4e3928
call fcn.004bcfe4
add esp, 8
test eax, eax
je 0x470048
mov edx, dword [ebx]
mov ecx, dword [edx + 0x2c]
mov dword [ebx], ecx
mov esi, dword [ebx]
test esi, esi
jne 0x46ffba
cmp dword [ebx], 0
jne 0x47006a
mov eax, dword [0x4d0c98]
mov dword [ebx], eax
jmp 0x47006a
mov edx, dword [ebp]
push edx
push 0
push eax
call fcn.0046fb70
mov ecx, dword [0x4d0c98]
mov dword [ebx], ecx
mov eax, dword [ebx]
test eax, eax
jne 0x470056
mov eax, dword [ebp]
xor edx, edx
mov dword [eax + 0x4c8], edx
push 0
push eax
call fcn.004b7df8
cmp dword [0x4d0c9c], 0
je 0x4700bf
push 2
push 0x4d0cc4
push 0x425
mov ecx, dword [0x4d42bc]
push ecx
call fcn.004b747c
push 1
mov eax, dword [0x4e4708]
push eax
call sub.USER32.dll_EnableWindow
push 5
mov edx, dword [0x4e4708]
push edx
call sub.USER32.dll_ShowWindow
mov ecx, dword [0x4d42bc]
push ecx
call fcn.004b7968
push 0
push 0
push 0x186
mov eax, dword [ebp]
mov edx, dword [eax + 0x51c]
push edx
call sub.USER32.dll_SendMessageA
mov ecx, dword [0x4e4704]
push ecx
call sub.USER32.dll_SetCursor
mov eax, dword [0x4d0c98]
push eax
call fcn.0046f8e0
xor edx, edx
mov dword [0x4d0c98], edx
cmp dword [0x4d0c9c], 0
jne 0x470119
push 0
mov ecx, dword [0x4d42bc]
push ecx
call fcn.004b7ee4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x470ccc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0x4d0df3
push esi
call fcn.004bcfe4
add esp, 8
test eax, eax
jne 0x470cf9
mov esi, 0x4d0e02
mov edi, 0x4e3d41
mov eax, edi
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x470d56
push 0x4d0e0a
push esi
call fcn.004bcfe4
add esp, 8
test eax, eax
jne 0x470d1c
mov esi, str.messages
mov edi, 0x4e3d41
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x470d56
push 0x20
push esi
call fcn.004bce0c
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x470d31
mov ebx, esi
jmp 0x470d32
inc ebx
mov esi, 0x4e3d41
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp + 0xc], 0
jne 0x470d63
mov eax, 0x4e3d41
jmp 0x470d98
push str.mirc.ini
push 0x3e7
push 0x4e4b90
push 0x4d0e2d
push 0x4e3d41
push 0x4d0e24
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x4e4b90], 0
je 0x470d96
mov eax, 0x4e4b90
jmp 0x470d98
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4736cc
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, 0x4e266c
mov edi, 0x4d0fb4
mov ebp, 0x4e2a53
call sub.USER32.dll_CreatePopupMenu
mov ebx, eax
mov dword [0x4d0f2c], ebx
test ebx, ebx
je 0x473760
xor ebx, ebx
push ebx
lea eax, [edi + 0xda]
push eax
push ebp
call sub.USER32.dll_wsprintfA
add esp, 0xc
push str.mirc.ini
push 0x3e7
push esi
lea edx, [edi + 0xe9]
push edx
push ebp
lea ecx, [edi + 0xdf]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x473755
push 0x20
push esi
call fcn.004bce0c
add esp, 8
test eax, eax
je 0x473739
mov byte [eax], 0
push esi
lea eax, [ebx + 0x4c8]
push eax
push 0
mov edx, dword [0x4d0f2c]
push edx
call sub.USER32.dll_AppendMenuA
inc ebx
cmp ebx, 0x14
jl 0x4736f2
test ebx, ebx
jne 0x473760
push 0
call sub.USER32.dll_MessageBeep
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x473af4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, 0x4e4a8c
call fcn.00474788
push 2
mov eax, dword [ebp]
push eax
call sub.USER32.dll_GetMenuItemID
cmp eax, 0x7c
jne 0x473b2d
cmp dword [0x4d3774], 0
je 0x473b55
push 0x400
push 2
mov edx, dword [ebp]
push edx
call sub.USER32.dll_DeleteMenu
jmp 0x473b55
cmp dword [0x4d3774], 0
jne 0x473b55
push 0
push 0xefc
call fcn.0040a8fc
push eax
push 0x7c
push 0x400
push 2
mov ecx, dword [ebp]
push ecx
call sub.USER32.dll_InsertMenuA
push 3
mov eax, dword [ebp]
push eax
call sub.USER32.dll_GetSubMenu
mov ebx, eax
test ebx, ebx
jne 0x473b73
push 4
mov eax, dword [ebp]
push eax
call sub.USER32.dll_GetSubMenu
mov ebx, eax
test ebx, ebx
je 0x473bfc
push 3
push ebx
call sub.USER32.dll_GetMenuItemID
cmp eax, 0x7f
jne 0x473bad
cmp dword [0x4d3774], 0
je 0x473be6
push 0x400
push 2
push ebx
call sub.USER32.dll_DeleteMenu
push 0x400
push 2
push ebx
call sub.USER32.dll_DeleteMenu
jmp 0x473be6
cmp dword [0x4d3774], 0
jne 0x473be6
push 0x4d10be
push 0
push 0x800
push 2
push ebx
call sub.USER32.dll_InsertMenuA
push 0
push 0xefc
call fcn.0040a8fc
push eax
push 0x7f
push 0x400
push 3
push ebx
call sub.USER32.dll_InsertMenuA
cmp dword [0x4d1294], 0
je 0x473bfc
push 8
push 0x7f
mov eax, dword [ebp]
push eax
call sub.USER32.dll_CheckMenuItem
mov edx, dword [ebp]
push edx
call sub.USER32.dll_GetMenuItemCount
mov ebx, eax
dec ebx
test ebx, ebx
jle 0x473c2f
push ebx
mov eax, dword [ebp]
push eax
call sub.USER32.dll_GetMenuItemID
cmp eax, 0x7d
je 0x473c2f
push 0x400
push ebx
mov edx, dword [ebp]
push edx
call sub.USER32.dll_DeleteMenu
dec ebx
test ebx, ebx
jg 0x473c0c
cmp dword [0x4d4294], 0
je 0x473cdc
push 0x4d10c2
push 0
push 0x800
mov ecx, dword [ebp]
push ecx
call sub.USER32.dll_AppendMenuA
mov ebx, 1
mov edi, 0x1f4
mov esi, dword [0x4d4294]
test esi, esi
je 0x473cdc
push 0x3c
push 0x4e4b90
mov eax, dword [esi]
push eax
call sub.USER32.dll_GetWindowTextA
push 0x4e4b90
call fcn.004bceac
pop ecx
cmp eax, 0x32
jbe 0x473c95
push esi
push edi
mov esi, 0x4d10c6
mov edi, 0x4e4bc2
mov eax, edi
movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0x4e4b90
push ebx
push 0x4d10cb
push 0x4e4f77
call sub.USER32.dll_wsprintfA
add esp, 0x10
inc ebx
mov edx, dword [0x4d42a8]
cmp edx, dword [esi]
jne 0x473cbf
mov eax, 8
jmp 0x473cc1
xor eax, eax
push 0x4e4f77
push edi
push eax
mov edx, dword [ebp]
push edx
call sub.USER32.dll_AppendMenuA
inc edi
mov esi, dword [esi + 0x744]
test esi, esi
jne 0x473c65
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x477d88
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebx
cmp byte [0x4d1b3a], 0
je 0x477dd3
cmp dword [0x4d1ba4], 0
jne 0x477dd3
push 0x4d1b3a
call sub.WSOCK32.dll_inet_addr
mov ebx, eax
mov dword [0x4d1ba4], ebx
cmp ebx, 0xffffffff
jne 0x477dc2
mov byte [0x4d1b3a], 0
xor eax, eax
mov dword [0x4d1ba4], eax
jmp 0x477dd3
mov edx, dword [0x4d1ba4]
push edx
call sub.WSOCK32.dll_htonl
mov dword [0x4d1ba4], eax
push 0x4e4f77
push 0x4e4b90
call fcn.0040ae30
call fcn.00493dcc
cmp dword [0x4cf1fc], 0
je 0x477e07
call fcn.0045d514
call fcn.0045d720
xor ecx, ecx
mov dword [0x4cf1fc], ecx
call fcn.0045f8c8
call fcn.004435b0
call fcn.0043364c
push 0x18
mov eax, dword [0x4d4298]
push eax
call sub.USER32.dll_LoadAcceleratorsA
mov dword [0x4d12ac], eax
mov ebx, sym.H_BIRC.exe_KeyboardProc
mov dword [0x4d0c2c], ebx
push 0
mov eax, dword [0x4d429c]
push eax
call sub.USER32.dll_GetWindowThreadProcessId
push eax
mov edx, dword [0x4d4298]
push edx
push ebx
push 2
call sub.USER32.dll_SetWindowsHookExA
mov dword [0x4d0c30], eax
call fcn.0049cc58
cmp dword [0x4ce564], 0
je 0x477e73
push 0
push 0
push 0x429
mov ecx, dword [0x4d429c]
push ecx
call sub.USER32.dll_PostMessageA
cmp dword [0x4cdf24], 0
je 0x477e90
push 0
push 0
push 0x42d
mov eax, dword [0x4d429c]
push eax
call sub.USER32.dll_PostMessageA
cmp dword [0x4d145c], 0
je 0x477eae
push 0
push 0
push 0x433
mov edx, dword [0x4d429c]
push edx
call sub.USER32.dll_PostMessageA
call fcn.00401108
push 0x7f00
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
pop ebx
ret
Function at 0x47cd54
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
add esp, 0xfffffff0
or eax, 0xffffffff
mov dword [0x4d1480], eax
mov dword [0x4d147c], eax
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [0x4d147c], eax
cmp eax, 0xffffffff
jne 0x47cd82
push 0
call fcn.0047ccec
jmp 0x47cdf4
mov word [esp], 2
xor edx, edx
mov dword [esp + 4], edx
mov cx, word [0x4d1478]
push ecx
call sub.WSOCK32.dll_htons
mov word [esp + 2], ax
push 0x10
lea eax, [esp + 4]
push eax
mov edx, dword [0x4d147c]
push edx
call sub.WSOCK32.dll_bind
test eax, eax
je 0x47cdc0
push 0
call fcn.0047ccec
jmp 0x47cdf4
push 5
mov ecx, dword [0x4d147c]
push ecx
call sub.WSOCK32.dll_listen
test eax, eax
je 0x47cddb
push 0
call fcn.0047ccec
jmp 0x47cdf4
push 8
push 0x434
mov eax, dword [0x4d429c]
push eax
mov edx, dword [0x4d147c]
push edx
call sub.WSOCK32.dll_WSAAsyncSelect
add esp, 0x10
ret
Function at 0x47f46c
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, 0x4d15e4
mov edi, 0x4e5e50
mov ebp, 0x4e5dcc
xor eax, eax
mov dword [0x4e5ddc], eax
mov edx, dword [0x4e5ddc]
push edx
lea ecx, [esi + 8]
push ecx
push 0x4e5dd0
call sub.USER32.dll_wsprintfA
add esp, 0xc
push str.mirc.ini
push 0x3e7
push edi
lea eax, [esi + 0x15]
push eax
push 0x4e5dd0
lea edx, [esi + 0xd]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [edi], 0
je 0x47f53a
lea ecx, [esi + 0x19]
push ecx
push edi
call fcn.004bd134
add esp, 8
mov ebx, eax
mov dword [ebp], ebx
test ebx, ebx
je 0x47f4ea
mov byte [ebx], 0
add dword [ebp], 5
mov eax, dword [ebp]
cmp byte [eax], 0
jne 0x47f4ea
xor edx, edx
mov dword [ebp], edx
lea ecx, [esi + 0x20]
push ecx
push edi
call fcn.004bd134
add esp, 8
mov ebx, eax
mov dword [0x4e5dc8], ebx
test ebx, ebx
je 0x47f51f
mov byte [ebx], 0
add dword [0x4e5dc8], 5
mov eax, dword [0x4e5dc8]
cmp byte [eax], 0
jne 0x47f51f
xor edx, edx
mov dword [0x4e5dc8], edx
mov ecx, dword [ebp]
push ecx
mov eax, dword [0x4e5dc8]
push eax
push edi
call fcn.0047f16c
inc dword [0x4e5ddc]
jmp 0x47f486
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4814dc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdac
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x4e752a
push 0
push 0
push 0x184
push 0x12d
push esi
call sub.USER32.dll_SendDlgItemMessageA
push edi
push 0x3e7
push 0xd
push 0x136
push esi
call sub.USER32.dll_SendDlgItemMessageA
push str..log
push edi
call fcn.004bcdd0
add esp, 8
cmp dword [0x4e5360], 0
je 0x481555
lea eax, [ebp - 0x254]
push eax
push edi
call sub.KERNEL32.dll_FindFirstFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x48154e
mov ebx, 1
jmp 0x481646
xor ebx, ebx
jmp 0x481646
push 0
lea eax, [ebp - 0x114]
push eax
push edi
call fcn.004c0100
add esp, 0xc
mov ebx, eax
jmp 0x481646
cmp dword [0x4e5360], 0
je 0x4815cd
test byte [ebp - 0x254], 0x10
je 0x4815a2
lea eax, [ebp - 0x254]
push eax
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x481646
mov ebx, 1
jmp 0x481646
push esi
push edi
mov esi, edi
lea edi, [ebp - 0x228]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x4815fd
push esi
push edi
mov esi, edi
lea edi, [ebp - 0x104]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push edi
call fcn.004c408c
pop ecx
push edi
push 0
push 0x180
push 0x12d
push esi
call sub.USER32.dll_SendDlgItemMessageA
inc eax
je 0x48164e
cmp dword [0x4e5360], 0
je 0x481637
lea eax, [ebp - 0x254]
push eax
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x481646
mov ebx, 1
jmp 0x481646
lea eax, [ebp - 0x114]
push eax
call fcn.004c01c0
pop ecx
mov ebx, eax
test ebx, ebx
je 0x48156e
cmp dword [0x4e5360], 0
je 0x481666
cmp dword [ebp - 4], 0xffffffff
je 0x481666
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_FindClose
push 1
push 0x4d1e18
push 0x12d
push esi
call fcn.004b747c
push 0
push 1
push 0x185
push 0x12d
push esi
call sub.USER32.dll_SendDlgItemMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4