joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x4ca0e7]
shl eax, 2
mov dword [0x4ca0eb], eax
push edi
push ecx
xor eax, eax
mov edi, 0x4d6f18
mov ecx, 0x4f24cc
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push 0
call fcn.004bd46f
pop ecx
push 0x4ca0b0
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x4ca0ef], eax
push 0
jmp fcn.004c88f4

Function at 0x401108
Capabilities:
Read .ini file

Disassembly:
push str.mirc.ini
push 0x3e7
push 0x4d832f
push 0x4ca111
push 0x4ca10b
push 0x4ca104
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x4ca119
push 0x4d832f
call fcn.004bcfe4
add esp, 8
test eax, eax
je 0x401163
mov dword [0x4ca0f8], 1
push 0
push 0x84
push 0x111
mov eax, dword [0x4d429c]
push eax
call sub.USER32.dll_PostMessageA
ret
call fcn.00477c9c
ret

Function at 0x40747c
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4d832f
mov esi, 0x4d7a8c
mov edi, 0x4ca4e4
mov ebp, 0x4d7aa0
push 0x7f02
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
mov dword [0x4d7a90], eax
push str.mirc.ini
push 0x3e7
push ebx
lea eax, [edi + 0x36]
push eax
lea edx, [edi + 0x2d]
push edx
lea ecx, [edi + 0x26]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [ebx], 0
je 0x4074f3
push str.mirc.ini
push ebx
lea eax, [edi + 0x42]
push eax
lea edx, [edi + 0x3a]
push edx
call fcn.0045cffc
push str.mirc.ini
push 0
lea ecx, [edi + 0x4d]
push ecx
lea eax, [edi + 0x46]
push eax
call fcn.0045cffc
call fcn.00406ffc
xor edx, edx
mov dword [ebp], edx
mov ecx, dword [ebp]
inc dword [ebp]
push ecx
lea eax, [edi + 0x56]
push eax
push 0x4d7a94
call sub.USER32.dll_wsprintfA
add esp, 0xc
push str.mirc.ini
push 0x3e7
push ebx
lea edx, [edi + 0x63]
push edx
push 0x4d7a94
lea ecx, [edi + 0x5b]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [ebx], 0
je 0x407556
push 0x4d7f48
push ebx
call fcn.0040b1d4
push 1
push ebx
call fcn.0040abec
test eax, eax
je 0x4074fd
push ebx
call fcn.004072b0
jmp 0x4074fd
cmp dword [0x4ca4d8], 0
jne 0x40757e
push 0x4e23ec
lea eax, [edi + 0x67]
push eax
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0xc
push ebx
call fcn.004072b0
push 0
call fcn.00407638
xor edx, edx
mov dword [ebp], edx
mov ecx, dword [0x4ca4d8]
mov dword [esi], ecx
jmp 0x4075bb
mov edx, dword [ebp]
cmp edx, dword [0x4ca4dc]
jne 0x4075a4
mov dword [eax + 0x130], 1
jmp 0x4075ae
mov eax, dword [esi]
xor ecx, ecx
mov dword [eax + 0x130], ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x14c]
mov dword [esi], edx
inc dword [ebp]
mov eax, dword [esi]
test eax, eax
jne 0x40758d
mov edx, dword [0x4d7a90]
push edx
call sub.USER32.dll_SetCursor
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4082cc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push str.mirc.ini
push 0x3e7
push 0x4d832f
push str.MS_Sans_Serif_8
mov eax, dword [ebp + 0xc]
push eax
push 0x4ca5d1
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x2c
push 0x4d832f
call fcn.004bce0c
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x408334
mov byte [ebx], 0
inc ebx
cmp byte [ebx], 0
je 0x408325
push ebx
call fcn.004c4ccc
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x408354
mov dword [ebp - 8], 8
jmp 0x408354
push esi
push edi
mov esi, 0x4ca5e9
mov edi, 0x4d832f
mov eax, edi
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
pop esi
mov dword [ebp - 8], 8
cmp dword [ebp + 0x14], 0
je 0x408376
push 0xffffffffffffffff
lea edx, [ebp - 8]
push edx
push 0x4d832f
push esi
call fcn.0044a200
test eax, eax
jne 0x408376
mov eax, edi
jmp 0x40844b
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
xor eax, eax
cmp dword [ebp - 8], 0x64
jle 0x408391
sub dword [ebp - 8], 0x64
add eax, 0x64
cmp dword [ebp - 8], 0x64
jg 0x408384
cmp dword [ebp - 8], 0
jle 0x4083a1
mov edx, dword [ebp - 8]
mov ecx, edx
neg edx
mov dword [ebp - 8], edx
push 0x4d832f
push 0
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.dll_CreateFontA
mov ebx, eax
test ebx, ebx
je 0x4083e8
test edi, edi
je 0x4083d6
push edi
call sub.GDI32.dll_DeleteObject
push 0
push ebx
push 0x30
push 0x258
push esi
call sub.USER32.dll_SendDlgItemMessageA
jmp 0x4083ea
mov ebx, edi
cmp dword [ebp + 0x14], 0
je 0x408423
mov eax, dword [ebp - 4]
push eax
push 0x4d832f
push 0x4ca5f8
push 0x4d7f48
call sub.USER32.dll_wsprintfA
add esp, 0x10
push str.mirc.ini
push 0x4d7f48
mov edx, dword [ebp + 0xc]
push edx
push 0x4ca5ff
call fcn.0045cffc
push 1
push 0
push 0x258
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_InvalidateRect
push 0x258
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_UpdateWindow
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0x10
Function at 0x409250
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x4ca684
push 0
call fcn.004b5b1c
mov esi, eax
mov dword [ebx], esi
test esi, esi
je 0x4093ad
mov esi, str._mdi
mov edi, 0x4ca688
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edx, dword [ebx]
add edx, 4
mov esi, edx
mov edi, 0x4ca688
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx]
mov edx, dword [0x4d42a0]
mov dword [eax], edx
mov byte [eax + 0x4cc], 9
mov dword [eax + 0x53c], 2
mov byte [eax + 0x4e5], 1
xor ecx, ecx
mov dword [eax + 0x544], ecx
xor edx, edx
mov dword [eax + 0x528], edx
xor ecx, ecx
mov dword [eax + 0x524], ecx
xor edx, edx
mov dword [eax + 0x540], edx
push str.mirc.ini
push 0x180
push 0x4e24ec
push 0x4ca6a4
add eax, 4
push eax
push 0x4ca698
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x4e24ec], 0
je 0x40938b
push 0x2c
push 0x4e24ec
call fcn.004bd108
add esp, 8
mov esi, eax
test esi, esi
je 0x409355
mov byte [esi], 0
inc esi
cmp byte [esi], 0
je 0x409355
push esi
call fcn.004c4ccc
pop ecx
mov edx, dword [ebx]
mov dword [edx + 0x53c], eax
mov edx, dword [ebx]
mov eax, dword [edx + 0x53c]
test eax, eax
jl 0x40934d
cmp eax, 4
jle 0x409355
xor ecx, ecx
mov dword [edx + 0x53c], ecx
push 0x4d832f
push 0x4e24ec
call fcn.0040b1d4
push 0x4e24ec
mov eax, dword [ebx]
mov edx, dword [eax]
push edx
call fcn.0040a350
test eax, eax
je 0x40938b
mov ecx, dword [ebx]
push ecx
call fcn.00438fc8
mov eax, dword [ebx]
mov edx, dword [eax]
push edx
call sub.USER32.dll_UpdateWindow
jmp 0x4093ad
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x544], edx
xor ecx, ecx
mov dword [eax + 0x528], ecx
xor edx, edx
mov dword [eax + 0x524], edx
xor ecx, ecx
mov dword [eax + 0x540], ecx
pop edi
pop esi
pop ebx
ret
Function at 0x4093b4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, 0x4d8b2c
mov eax, dword [0x4ca684]
test eax, eax
je 0x4093d3
cmp eax, ebx
je 0x4095f8
push ebx
call fcn.004b5f30
test eax, eax
je 0x4095f8
cmp byte [ebx + 0x4cc], 1
jne 0x409412
push str.mirc.ini
push 0x3e7
push 0x4e4b90
push 0x4ca6be
push 0x4ca6b4
push 0x4ca6a8
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x4094ab
cmp byte [ebx + 0x4cc], 2
jne 0x4095f8
cmp byte [ebx + 0x4cd], 3
jne 0x40944d
push str.mirc.ini
push 0x3e7
push 0x4e4b90
push 0x4ca6d5
push 0x4ca6ce
push 0x4ca6c2
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x4094ab
cmp byte [ebx + 0x4cd], 4
jne 0x40947b
push str.mirc.ini
push 0x3e7
push 0x4e4b90
push 0x4ca6ec
push 0x4ca6e5
push 0x4ca6d9
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x4094ab
cmp byte [ebx + 0x4cd], 1
jne 0x4095f8
push str.mirc.ini
push 0x3e7
push 0x4e4b90
push 0x4ca704
push 0x4ca6fc
push 0x4ca6f0
call sub.KERNEL32.dll_GetPrivateProfileStringA
xor edx, edx
mov dword [0x4d8b30], edx
push 0x2c
push 0x4e4b90
call fcn.004bd108
add esp, 8
mov ebx, eax
mov dword [0x4d8b28], ebx
test ebx, ebx
je 0x409504
mov byte [ebx], 0
inc dword [0x4d8b28]
mov ebx, dword [0x4d8b28]
cmp byte [ebx], 0
je 0x409504
push ebx
call fcn.004c4ccc
pop ecx
mov dword [0x4d8b30], eax
mov eax, dword [0x4d8b30]
test eax, eax
jl 0x4094fc
cmp eax, 5
jle 0x409504
xor edx, edx
mov dword [0x4d8b30], edx
mov ebx, dword [0x4d4294]
test ebx, ebx
je 0x4095f8
push 0
mov eax, dword [ebx]
push eax
call sub.USER32.dll_GetSystemMenu
mov esi, eax
mov dword [edi], esi
test esi, esi
je 0x4095ea
push 0
push 0x64
push 0x4e4f77
push 0xac
push esi
call sub.USER32.dll_GetMenuStringA
test eax, eax
jle 0x4095ea
cmp byte [0x4e4b90], 0
je 0x4095c1
cmp dword [ebx + 0x540], 0
jne 0x40956a
push 0
push 0xac
mov eax, dword [edi]
push eax
call sub.USER32.dll_CheckMenuItem
jmp 0x4095ea
push 0x4e4f77
push 0x4e4b90
call fcn.0040b1d4
mov edx, dword [ebx + 0x540]
push edx
push 0x4e4b90
call fcn.004bcfe4
add esp, 8
test eax, eax
jne 0x4095b0
mov ecx, dword [ebx + 0x53c]
cmp ecx, dword [0x4d8b30]
jne 0x4095b0
push 8
push 0xac
mov eax, dword [edi]
push eax
call sub.USER32.dll_CheckMenuItem
jmp 0x4095ea
push 0
push 0xac
mov edx, dword [edi]
push edx
call sub.USER32.dll_CheckMenuItem
jmp 0x4095ea
cmp dword [ebx + 0x540], 0
jne 0x4095db
push 8
push 0xac
mov ecx, dword [edi]
push ecx
call sub.USER32.dll_CheckMenuItem
jmp 0x4095ea
push 0
push 0xac
mov eax, dword [edi]
push eax
call sub.USER32.dll_CheckMenuItem
mov ebx, dword [ebx + 0x744]
test ebx, ebx
jne 0x409512
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x40aa6c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, 0x4d8ce8
test ebx, ebx
je 0x40aa83
cmp byte [ebx], 0
jne 0x40aa8d
mov eax, 1
jmp 0x40abe3
push 0x2e
push ebx
call fcn.004bce0c
add esp, 8
mov esi, eax
mov dword [edi], esi
test esi, esi
je 0x40aaa3
mov byte [esi], 0
push 0x4d8cc4
push ebx
call fcn.004c28e8
add esp, 8
test eax, eax
jne 0x40aaed
movsx eax, word [0x4d8cc8]
sub eax, 0x1000
je 0x40aada
sub eax, 0x1000
je 0x40aada
sub eax, 0x1000
je 0x40aada
sub eax, 0xc000
je 0x40aada
jmp 0x40aaed
mov eax, dword [edi]
test eax, eax
je 0x40aae3
mov byte [eax], 0x2e
mov eax, 1
jmp 0x40abe3
push 0xa
push 0x4d8cf0
push ebx
call sub.KERNEL32.dll_QueryDosDeviceA
test eax, eax
je 0x40ab11
mov eax, dword [edi]
test eax, eax
je 0x40ab07
mov byte [eax], 0x2e
mov eax, 1
jmp 0x40abe3
push 0x100
push 0
push 0
push ebx
call fcn.004c2208
add esp, 0x10
mov esi, eax
mov dword [0x4d8cec], esi
test esi, esi
jge 0x40ab3f
mov eax, dword [edi]
test eax, eax
je 0x40ab38
mov byte [eax], 0x2e
xor eax, eax
jmp 0x40abe3
mov edx, dword [0x4d8cec]
push edx
call fcn.004c0980
pop ecx
test eax, eax
je 0x40ab6d
mov eax, dword [edi]
test eax, eax
je 0x40ab59
mov byte [eax], 0x2e
mov edx, dword [0x4d8cec]
push edx
call fcn.004bfe44
pop ecx
mov eax, 1
jmp 0x40abe3
push 0x4d8cc4
mov edx, dword [0x4d8cec]
push edx
call fcn.004c22a0
add esp, 8
test eax, eax
jne 0x40abcb
movsx ecx, word [0x4d8cc8]
sub ecx, 0x1000
je 0x40abae
sub ecx, 0x1000
je 0x40abae
sub ecx, 0x1000
je 0x40abae
sub ecx, 0xc000
je 0x40abae
jmp 0x40abcb
mov eax, dword [edi]
test eax, eax
je 0x40abb7
mov byte [eax], 0x2e
mov edx, dword [0x4d8cec]
push edx
call fcn.004bfe44
pop ecx
mov eax, 1
jmp 0x40abe3
mov eax, dword [edi]
test eax, eax
je 0x40abd4
mov byte [eax], 0x2e
mov edx, dword [0x4d8cec]
push edx
call fcn.004bfe44
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x40ae30
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp byte [0x4e6c8c], 0
jne 0x40ae5e
push str._H_B_mIRc
mov eax, dword [0x4d429c]
push eax
call sub.USER32.dll_SetWindowTextA
push 7
call fcn.004b0d5c
jmp 0x40aedd
push 0x4e6c8c
push str._H_B_mIRc
push 0x4ca8a7
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0xf
push ebx
call fcn.004a6178
mov edx, dword [0x4d429c]
push edx
call sub.USER32.dll_GetWindowTextLengthA
mov edi, eax
push ebx
call fcn.004bceac
pop ecx
cmp edi, eax
jne 0x40aeca
push 0x3b5
push esi
mov eax, dword [0x4d429c]
push eax
call sub.USER32.dll_GetWindowTextA
mov eax, ebx
mov edx, esi
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x40aeca
test cl, cl
je 0x40aec8
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x40aeca
add eax, 2
add edx, 2
test cl, cl
jne 0x40aeac
je 0x40aedd
push ebx
mov eax, dword [0x4d429c]
push eax
call sub.USER32.dll_SetWindowTextA
push 7
call fcn.004b0d5c
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x40b0b4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push 0x8000
call sub.KERNEL32.dll_SetErrorMode
push 5
push 0x4e23ec
push 0
push ebx
push 0x4ca8d6
mov eax, dword [0x4d429c]
push eax
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x40b0ef
mov eax, 1
jmp 0x40b188
push 0
push 0x4000
push ebx
call fcn.004c2208
add esp, 0xc
mov esi, eax
mov dword [0x4d8d48], esi
test esi, esi
jl 0x40b15b
push 0x4d8d24
push esi
call fcn.004c22a0
add esp, 8
cmp dword [0x4d8d36], 0xe678
jle 0x40b13a
push ebx
push str.write.exe__s
push 0x4e24ec
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x40b14d
push ebx
push 0x4ca8ea
push 0x4e24ec
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov eax, dword [0x4d8d48]
push eax
call fcn.004bfe44
pop ecx
jmp 0x40b16e
push ebx
push str.notepad.exe__s
push 0x4e24ec
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0xa
push 0x4e24ec
call sub.KERNEL32.dll_WinExec
cmp eax, 0x20
jae 0x40b183
xor eax, eax
jmp 0x40b188
mov eax, 1
pop esi
pop ebx
pop ebp
ret 4

Function at 0x40b25c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [0x4d429c]
push eax
call sub.USER32.dll_OpenClipboard
test eax, eax
je 0x40b30b
call sub.USER32.dll_EmptyClipboard
test eax, eax
jne 0x40b28b
call sub.USER32.dll_CloseClipboard
jmp 0x40b30b
push esi
call fcn.004bceac
pop ecx
mov edi, eax
add edi, 2
mov dword [0x4d8d54], edi
push edi
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov ebx, eax
mov dword [0x4d8d50], ebx
test ebx, ebx
je 0x40b30b
push ebx
call sub.KERNEL32.dll_GlobalLock
mov edi, eax
mov dword [0x4d8d4c], edi
test edi, edi
jne 0x40b2d0
mov eax, dword [0x4d8d50]
push eax
call sub.KERNEL32.dll_GlobalFree
jmp 0x40b30b
mov edx, dword [0x4d8d4c]
push esi
mov edi, esi
mov esi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov eax, dword [0x4d8d50]
push eax
push 1
call sub.USER32.dll_SetClipboardData
call sub.USER32.dll_CloseClipboard
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x40bda0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], eax
push 2
mov edx, dword [ebp + 0x10]
push edx
mov ebx, dword [0x4d4298]
push ebx
call sub.KERNEL32.dll_FindResourceA
push eax
push ebx
call sub.KERNEL32.dll_LoadResource
test eax, eax
je 0x40bef9
push eax
call sub.KERNEL32.dll_LockResource
mov ebx, eax
test ebx, ebx
je 0x40bef9
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x40bdf3
mov esi, eax
jmp 0x40bdfe
mov cx, word [ebx + 0xe]
mov esi, 1
shl esi, cl
test esi, esi
je 0x40bef9
lea eax, [esi - 1]
shl eax, 2
add eax, 8
push eax
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40bef9
mov edx, dword [ebp - 0xc]
push edx
call sub.KERNEL32.dll_GlobalLock
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov word [ecx + 2], si
mov eax, dword [ebp - 4]
mov word [eax], 0x300
lea edx, [ebx + 0x28]
xor edi, edi
mov eax, dword [ebp - 4]
add eax, 4
add edx, 2
cmp esi, edi
jle 0x40be70
mov cl, byte [edx]
mov byte [eax], cl
mov cl, byte [edx - 1]
mov byte [eax + 1], cl
mov cl, byte [edx - 2]
mov byte [eax + 2], cl
mov byte [eax + 3], 0
inc edi
add eax, 4
add edx, 4
cmp esi, edi
jg 0x40be51
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.dll_CreatePalette
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_GlobalUnlock
mov edx, dword [ebp - 0xc]
push edx
call sub.KERNEL32.dll_GlobalFree
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], 0
je 0x40bef9
mov eax, dword [0x4d429c]
push eax
call sub.USER32.dll_GetDC
mov edi, eax
test edi, edi
je 0x40bef9
push 0
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
push edx
push edi
call sub.GDI32.dll_SelectPalette
mov dword [ebp - 8], eax
push edi
call sub.GDI32.dll_RealizePalette
movzx ecx, word [ebx]
add ecx, ebx
shl esi, 2
movzx eax, si
add ecx, eax
mov esi, ecx
push 0
push ebx
push esi
push 4
push ebx
push edi
call sub.GDI32.dll_CreateDIBitmap
mov edx, dword [ebp + 8]
mov dword [edx], eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push edi
call sub.GDI32.dll_SelectPalette
push edi
mov eax, dword [0x4d429c]
push eax
call sub.USER32.dll_ReleaseDC
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c854
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004b7934
mov esi, eax
test esi, esi
je 0x40c99a
mov eax, dword [esi + 0x4b4]
test eax, eax
je 0x40c937
mov ebx, eax
test ebx, ebx
je 0x40c88e
cmp dword [ebx + 0x18], 1
je 0x40c88e
mov ebx, dword [ebx + 0x2c]
test ebx, ebx
jne 0x40c881
test ebx, ebx
je 0x40c903
cmp dword [ebx + 0x2c], 0
je 0x40c903
mov eax, dword [ebx + 0x2c]
cmp dword [eax], 0
je 0x40c903
xor edx, edx
mov dword [ebx + 0x18], edx
mov ebx, dword [ebx + 0x2c]
mov dword [ebx + 0x18], 1
mov ecx, dword [ebx]
push ecx
push 0
push 0xc
mov eax, dword [esi + 0x518]
push eax
call sub.USER32.dll_SendMessageA
mov edx, dword [ebx]
push edx
call fcn.004bceac
pop ecx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.004bceac
pop ecx
push eax
push 0xb1
push 0x427
mov eax, dword [esi]
push eax
call sub.USER32.dll_SendDlgItemMessageA
push 0
push 0
push 0xb7
push 0x427
mov edx, dword [esi]
push edx
call sub.USER32.dll_SendDlgItemMessageA
jmp 0x40c99a
mov eax, dword [esi + 0x4b4]
cmp ebx, dword [eax + 0x30]
jne 0x40c937
mov ebx, eax
test ebx, ebx
je 0x40c920
xor eax, eax
mov dword [ebx + 0x18], eax
mov ebx, dword [ebx + 0x2c]
test ebx, ebx
jne 0x40c914
push 0x4ca9dc
push 0
push 0xc
mov edx, dword [esi + 0x518]
push edx
call sub.USER32.dll_SendMessageA
jmp 0x40c99a
push 0x4e4f77
push 0x3e6
push 0xd
mov ecx, dword [esi + 0x518]
push ecx
call sub.USER32.dll_SendMessageA
push 0x4ca9e0
push 0x4e4f77
call fcn.004bd134
add esp, 8
test eax, eax
je 0x40c968
mov byte [eax], 0
cmp byte [0x4e4f77], 0
je 0x40c97e
push 0x4e4f77
push edi
call fcn.0040c60c
jmp 0x40c985
push 0
call sub.USER32.dll_MessageBeep
push 0x4ca9e4
push 0
push 0xc
mov eax, dword [esi + 0x518]
push eax
call sub.USER32.dll_SendMessageA
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x40c9a4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.004b7934
mov ebx, eax
test ebx, ebx
je 0x40ca24
mov eax, dword [ebx + 0x4b4]
test eax, eax
je 0x40c9cf
cmp dword [eax + 0x18], 0
jne 0x40ca24
mov eax, dword [eax + 0x2c]
test eax, eax
jne 0x40c9c2
push 0x4e4f77
push 0x3e6
push 0xd
mov edx, dword [ebx + 0x518]
push edx
call sub.USER32.dll_SendMessageA
push 0x4ca9e8
push 0x4e4f77
call fcn.004bd134
add esp, 8
test eax, eax
je 0x40ca00
mov byte [eax], 0
cmp byte [0x4e4f77], 0
je 0x40ca24
push 0x4e4f77
push esi
call fcn.0040c60c
mov ecx, dword [ebx + 0x4b4]
mov eax, dword [ecx + 0x30]
mov dword [eax + 0x18], 1
pop esi
pop ebx
pop ebp
ret 4
Function at 0x40e488
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4e2a53
push 0
push 0
push 0x184
push 0x10a
mov eax, dword [ebp + 8]
push eax
call sub.USER32.dll_SendDlgItemMessageA
xor esi, esi
push esi
push 0x4caac8
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push str.mirc.ini
push 0x3e7
push 0x4e266c
push 0x4caad7
push edi
push 0x4caacd
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x4e266c], 0
je 0x40e595
push 0x20
push 0x4e266c
call fcn.004bce0c
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x40e551
mov byte [ebx], 0
push esi
push edi
mov esi, edi
mov edi, 0x4e266c
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov byte [ebx], 0x20
jmp 0x40e52d
inc ebx
cmp byte [ebx], 0x20
je 0x40e52c
cmp byte [ebx], 0
je 0x40e579
push 0x4caadb
push edi
call fcn.004bcdd0
add esp, 8
push ebx
push edi
call fcn.004bcdd0
add esp, 8
jmp 0x40e579
push esi
push edi
mov esi, edi
mov edi, 0x4e266c
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push edi
push 0
push 0x180
push 0x10a
mov eax, dword [ebp + 8]
push eax
call sub.USER32.dll_SendDlgItemMessageA
inc esi
jmp 0x40e4ac
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x40e6d4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x4e266c
push 0x20
push esi
call fcn.004bce0c
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e6fd
mov eax, dword [ebp - 4]
mov byte [eax], 0
xor ebx, ebx
push ebx
push 0x4caaf7
push 0x4e2a53
call sub.USER32.dll_wsprintfA
add esp, 0xc
push str.mirc.ini
push 0x3e7
push edi
push 0x4cab06
push 0x4e2a53
push 0x4caafc
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [edi], 0
je 0x40e759
push 0x20
push edi
call fcn.004bce0c
add esp, 8
test eax, eax
je 0x40e748
mov byte [eax], 0
push esi
push edi
call fcn.004bcfe4
add esp, 8
test eax, eax
je 0x40e759
inc ebx
jmp 0x40e6ff
cmp dword [ebp - 4], 0
je 0x40e765
mov eax, dword [ebp - 4]
mov byte [eax], 0x20
test ebx, ebx
jl 0x40e791
push ebx
push 0x4cab0a
push 0x4e2a53
call sub.USER32.dll_wsprintfA
add esp, 0xc
push str.mirc.ini
push esi
push 0x4e2a53
push 0x4cab0f
call fcn.0045cffc
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x40f254
Capabilities:
Read .ini file

Disassembly:
push esi
push edi
push str.mirc.ini
push 0x100
push 0x4d9fb0
push 0x4cabfa
push 0x4cabf6
push 0x4cabe8
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x4d9fb0
push 0x4e23ec
push 0x4cac08
push 0x4d832f
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 1
push 0x4d832f
call fcn.0040abec
test eax, eax
jne 0x40f2b9
mov esi, 0x4cac0e
mov edi, 0x4d9fb0
mov eax, edi
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.0040f1bc
call fcn.0040f128
pop edi
pop esi
ret