joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fcf0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
lea ebx, [ebp - 4]
push 0x180
push 0
push 0x4301
mov eax, dword [ebp + 8]
push eax
call fcn.004c2208
add esp, 0x10
mov esi, eax
mov dword [0x4cab84], esi
test esi, esi
jge 0x40fd2c
push 0
call sub.USER32.dll_MessageBeep
jmp 0x40ff13
push 0x7f02
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
mov dword [ebp - 8], eax
push 0x180
push 0x4e4b90
mov eax, dword [0x4d42b0]
push eax
call sub.USER32.dll_GetWindowTextA
push 0
push 0x57c
call fcn.0040a8fc
push eax
push 0x4e4b90
call fcn.004bd134
add esp, 8
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x40fdab
add dword [ebx], 4
mov edx, dword [ebx]
push edx
call fcn.004bceac
pop ecx
push eax
mov ecx, dword [ebx]
push ecx
mov eax, dword [0x4cab84]
push eax
call fcn.004c1d74
add esp, 0xc
push 1
push 0x4cac93
mov edx, dword [0x4cab84]
push edx
call fcn.004c1d74
add esp, 0xc
xor edi, edi
push ebx
push edi
push 0x189
push 0x425
mov eax, dword [0x4d42b0]
push eax
call sub.USER32.dll_SendDlgItemMessageA
inc eax
je 0x40fef3
cmp dword [ebx], 0
je 0x40fef3
mov edx, dword [ebx]
push edi
mov esi, 0x4e4b90
mov edi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov dword [ebx], 0x4e4b90
jmp 0x40fe06
inc dword [ebx]
mov eax, dword [ebx]
cmp byte [eax], 0x20
je 0x40fe04
mov edx, dword [ebx]
cmp byte [edx], 0
je 0x40feed
push 9
mov ecx, dword [ebx]
push ecx
call fcn.004bce0c
add esp, 8
mov esi, eax
test esi, esi
je 0x40feed
mov byte [esi], 0
mov eax, dword [ebx]
push eax
call fcn.004bceac
pop ecx
push eax
mov edx, dword [ebx]
push edx
mov ecx, dword [0x4cab84]
push ecx
call fcn.004c1d74
add esp, 0xc
inc esi
cmp byte [esi], 0
je 0x40fed8
mov dword [ebx], esi
push 9
mov eax, dword [ebx]
push eax
call fcn.004bce0c
add esp, 8
mov esi, eax
test esi, esi
je 0x40fe70
mov byte [esi], 0
push 1
push 0x4cac96
mov eax, dword [0x4cab84]
push eax
call fcn.004c1d74
add esp, 0xc
mov edx, dword [ebx]
push edx
call fcn.004bceac
pop ecx
push eax
mov ecx, dword [ebx]
push ecx
mov eax, dword [0x4cab84]
push eax
call fcn.004c1d74
add esp, 0xc
test esi, esi
je 0x40fed8
inc esi
cmp byte [esi], 0
je 0x40fed8
push 1
push 0x4cac99
mov edx, dword [0x4cab84]
push edx
call fcn.004c1d74
add esp, 0xc
push esi
call fcn.004bceac
pop ecx
push eax
push esi
mov ecx, dword [0x4cab84]
push ecx
call fcn.004c1d74
add esp, 0xc
push 1
push 0x4cac9c
mov eax, dword [0x4cab84]
push eax
call fcn.004c1d74
add esp, 0xc
inc edi
jmp 0x40fdad
mov edx, dword [0x4cab84]
push edx
call fcn.004bfe44
pop ecx
mov dword [0x4cab84], 0xffffffff
mov ecx, dword [ebp - 8]
push ecx
call sub.USER32.dll_SetCursor
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x412910
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x51c], 2
push 0
call fcn.004c92e8
pop ecx
mov dword [ebx + 0x868], eax
cmp dword [ebx + 0x52c], 0
je 0x4129b8
cmp word [ebx + 0x520], 0
jne 0x4129b8
cmp dword [0x4cdf84], 0
je 0x41299b
cmp dword [0x4cdf80], 0
je 0x41299b
mov eax, dword [0x4cb064]
push eax
push 0
push 0x523
call fcn.0040a8fc
push eax
mov edx, dword [ebx]
push edx
call fcn.0048d7dc
call fcn.0041118c
mov esi, eax
mov dword [ebx + 0x528], esi
push esi
push 1
push 0
add ebx, 0x4b8
push ebx
call fcn.00448738
mov eax, 1
jmp 0x412b7d
push 8
push ebx
call fcn.00411508
test eax, eax
je 0x4129b1
mov eax, 1
jmp 0x412b7d
xor eax, eax
jmp 0x412b7d
lea edx, [ebx + 0x4b8]
push edx
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x412a2f
cmp dword [0x4cdf84], 0
je 0x4129e8
cmp dword [0x4cdf80], 0
je 0x4129e8
cmp dword [0x4cdf7c], 0
jne 0x412a2f
cmp dword [ebx + 0x530], 0
je 0x412a15
push 7
push 0
lea ecx, [ebx + 0x4b8]
push ecx
lea eax, [ebx + 0x3f0]
push eax
mov edx, dword [ebx]
push edx
call fcn.00437f98
mov eax, 1
jmp 0x412b7d
push ebx
push 0
push 0x524
call fcn.0040a8fc
push eax
call fcn.0041133c
xor eax, eax
jmp 0x412b7d
cmp dword [0x4cdf84], 0
je 0x412a94
cmp dword [0x4cdf80], 0
je 0x412a94
cmp dword [ebx + 0x530], 0
je 0x412a94
mov edx, dword [0x4cb064]
push edx
push 0
push 0x523
call fcn.0040a8fc
push eax
mov ecx, dword [ebx]
push ecx
call fcn.0048d7dc
call fcn.0041118c
mov esi, eax
mov dword [ebx + 0x528], esi
push esi
push 0
mov ax, word [ebx + 0x520]
push eax
add ebx, 0x4b8
push ebx
call fcn.00448738
mov eax, 1
jmp 0x412b7d
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov word [ebp - 0x12], 4
mov word [ebp - 0x14], 2
lea esi, [ebp - 0x1c]
push 0x10
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.004bcd2c
add esp, 0xc
mov word [ebp - 0x2c], 2
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
push eax
lea edx, [ebp - 0x28]
push edx
call fcn.004bccbc
add esp, 0xc
mov cx, word [ebx + 0x520]
push ecx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x2a], ax
mov eax, dword [esi + 0xc]
mov edx, dword [eax]
mov ecx, dword [edx]
mov dword [ebp - 0x28], ecx
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [ebx + 0x86c], eax
cmp eax, 0xffffffff
jne 0x412b28
push ebx
push 0
push 0x518
call fcn.0040a8fc
push eax
call fcn.0041133c
xor eax, eax
jmp 0x412b7d
push 0x10
push 0x41c
mov edx, dword [0x4d429c]
push edx
mov ecx, dword [ebx + 0x86c]
push ecx
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [ebx + 0x86c]
push edx
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x412b7b
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x412b7b
push ebx
push 0
push 0x525
call fcn.0040a8fc
push eax
call fcn.0041133c
xor eax, eax
jmp 0x412b7d
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x413010
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x413022
xor eax, eax
jmp 0x4130c9
cmp dword [ebx + 0x51c], 3
je 0x41303b
cmp dword [ebx + 0x530], 2
je 0x41303b
xor eax, eax
jmp 0x4130c9
push 0
call fcn.004c92e8
pop ecx
mov dword [ebx + 0x868], eax
push 0
push 0x3e6
push 0x4db431
mov edx, dword [ebx + 0x86c]
push edx
call sub.WSOCK32.dll_recv
test eax, eax
jle 0x413077
mov byte [eax + 0x4db431], 0
push eax
push ebx
call fcn.00412f64
xor eax, eax
jmp 0x4130c9
test eax, eax
jge 0x4130c1
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x41308e
cmp eax, 0x2734
jne 0x4130ac
push 0x23
push 0x41d
mov edx, dword [0x4d429c]
push edx
mov ecx, dword [ebx + 0x86c]
push ecx
call sub.WSOCK32.dll_WSAAsyncSelect
xor eax, eax
jmp 0x4130c9
push ebx
push 0
push 0x527
call fcn.0040a8fc
push eax
call fcn.0041133c
jmp 0x4130c7
push ebx
call fcn.004131e4
xor eax, eax
pop ebx
pop ebp
ret 4

Function at 0x4130d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push edi
call fcn.004bceac
pop ecx
mov esi, eax
push 0
call fcn.004c92e8
pop ecx
mov dword [ebx + 0x868], eax
cmp dword [ebx + 0x86c], 0xffffffff
jne 0x413103
xor eax, eax
jmp 0x413190
push 0
push esi
push edi
mov edx, dword [ebx + 0x86c]
push edx
call sub.WSOCK32.dll_send
cmp esi, eax
je 0x41318b
cmp dword [ebx + 0x53c], 0
jne 0x413187
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x413133
cmp eax, 0x2734
jne 0x413174
push edi
mov esi, 0x4da87c
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push 0x23
push 0x41d
mov eax, dword [0x4d429c]
push eax
mov edx, dword [ebx + 0x86c]
push edx
call sub.WSOCK32.dll_WSAAsyncSelect
xor eax, eax
jmp 0x413190
push ebx
push 0
push 0x528
call fcn.0040a8fc
push eax
call fcn.0041133c
xor eax, eax
jmp 0x413190
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x414084
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
movzx ecx, dx
mov dword [0x4cb01c], ecx
shr edx, 0x10
and dx, 0xffff
movzx edx, dx
mov dword [0x4cb020], edx
xor edx, edx
mov dword [0x4cb024], edx
cmp eax, 7
ja 0x4140d6
test al, 1
je 0x4140be
inc dword [0x4cb024]
test al, 8
je 0x4140c9
add dword [0x4cb024], 2
test al, 4
je 0x41410e
add dword [0x4cb024], 4
jmp 0x41410e
push 1
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4140e8
inc dword [0x4cb024]
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4140fb
add dword [0x4cb024], 2
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x41410e
add dword [0x4cb024], 4
pop ebp
ret 8
Function at 0x4145d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, 0x4cb0b0
xor ebx, ebx
mov esi, 0x4dbb84
jmp 0x414641
push ebx
push edi
push 0x4d832f
call sub.USER32.dll_wsprintfA
add esp, 0xc
push str.mirc.ini
push 0x3e7
push 0x4d7f48
lea eax, [edi + 0xa]
push eax
push 0x4d832f
lea edx, [edi + 5]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x4d7f48], 0
je 0x41463d
push 0xa
lea ecx, [ebp - 4]
push ecx
push 0x4d7f48
call fcn.004c61dc
add esp, 0xc
push eax
mov eax, dword [ebp + 8]
push eax
call sub.GDI32.dll_GetNearestColor
mov dword [esi], eax
inc ebx
add esi, 4
cmp ebx, dword [0x4cb04c]
jl 0x4145e5
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x414f78
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
call fcn.004149fc
push str.mirc.ini
push 0x3e7
push 0x4d7f48
push 0x4cb2a4
push 0x4cb2a0
push 0x4cb297
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x4d7f48], 0
je 0x415029
xor edi, edi
mov ebx, 0x4d7f48
mov ebp, 0x4db850
jmp 0x414fe5
push 0x2c
push ebx
call fcn.004bce0c
add esp, 8
mov esi, eax
test esi, esi
je 0x414fd0
mov byte [esi], 0
inc esi
push ebx
call fcn.004c4ccc
pop ecx
mov dword [ebp], eax
inc edi
add ebp, 0x1c
cmp edi, 0x1e
jge 0x414fee
mov ebx, esi
test ebx, ebx
je 0x414fee
cmp byte [ebx], 0
jne 0x414fbb
cmp edi, 0x18
jne 0x415029
mov eax, dword [0x4dbad4]
mov dword [0x4dbaf0], eax
mov edx, dword [0x4dbab8]
mov dword [0x4dbad4], edx
mov ecx, dword [0x4dba9c]
mov dword [0x4dbab8], ecx
mov eax, dword [0x4dba80]
mov dword [0x4dba9c], eax
mov dword [0x4dba80], 1
call fcn.00414ea4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41678c
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x4cb0a8]
push eax
call sub.USER32.dll_ShowWindow
mov eax, dword [0x4cb0a8]
test eax, eax
je 0x4167a8
push eax
call sub.USER32.dll_DestroyWindow
xor edx, edx
mov dword [0x4cb0a8], edx
ret
Function at 0x425764
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0
je 0x42577f
cmp dword [ebx + 8], 0
jne 0x425792
push 0
push 0
mov eax, dword [ebx]
push eax
push 0
call fcn.0043e834
jmp 0x425939
mov edx, dword [ebx + 4]
push edx
call fcn.004b78d4
mov dword [0x4dc758], eax
cmp dword [0x4dc758], 0
je 0x4257bd
mov ecx, dword [0x4dc758]
mov al, byte [ecx + 0x4cc]
cmp al, 9
je 0x4257d0
cmp al, 0xa
je 0x4257d0
push 7
push 0
mov edx, dword [ebx]
push edx
push 0
call fcn.0043e834
jmp 0x425939
mov eax, dword [ebx + 8]
cmp byte [eax], 0x40
jne 0x4257e4
push eax
call fcn.004bceac
pop ecx
cmp eax, 1
ja 0x4257f7
push 3
push 0
mov edx, dword [ebx]
push edx
push 0
call fcn.0043e834
jmp 0x425939
mov ecx, dword [ebx + 8]
push ecx
call fcn.004b78d4
test eax, eax
je 0x425821
push 6
push 0
push 0
push 0x397
call fcn.0040a8fc
push eax
push 0
call fcn.0043e834
jmp 0x425939
mov eax, dword [0x4dc758]
add eax, 4
mov edx, dword [ebx + 8]
push esi
push edi
mov esi, eax
mov edi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, dword [ebx + 8]
push esi
push edi
mov esi, edi
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
cmp dword [ebx + 0xc], 0
je 0x4258b2
mov byte [esi], 0
push ebx
push esi
push 3
call fcn.00488944
cmp byte [esi], 0
je 0x4258eb
push 0x4cbba7
push edi
call fcn.004bcdd0
add esp, 8
push esi
push edi
call fcn.004bcdd0
add esp, 8
push 0xf
push edi
call fcn.004a6178
jmp 0x4258eb
push 0x100
push esi
mov eax, dword [0x4dc758]
mov edx, dword [eax]
push edx
call sub.USER32.dll_GetWindowTextA
cmp byte [esi], 0
je 0x4258eb
push 0x20
push esi
call fcn.004bce0c
add esp, 8
mov ebx, eax
mov dword [0x4dc75c], ebx
test ebx, ebx
je 0x4258eb
push ebx
push edi
call fcn.004bcdd0
add esp, 8
mov dword [0x4dc75c], edi
mov eax, dword [0x4dc758]
cmp byte [eax + 0x4e7], 0
je 0x425910
mov edx, dword [0x4dc75c]
cmp byte [edx], 0x40
jne 0x425910
inc dword [0x4dc75c]
mov ecx, dword [0x4dc75c]
push ecx
mov eax, dword [eax]
push eax
call sub.USER32.dll_SetWindowTextA
cmp dword [0x4d3774], 0
je 0x425934
mov edx, dword [0x4dc758]
push edx
call fcn.004a78e4
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x427ef8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov esi, 0x4d429c
mov eax, dword [ebx + 4]
test eax, eax
je 0x4280cf
cmp byte [eax], 0x2d
jne 0x4280cf
push 0x6e
push eax
call fcn.004bce0c
add esp, 8
test eax, eax
je 0x427f8f
mov edx, dword [0x4d3dd4]
mov dword [0x4dc828], edx
xor ecx, ecx
mov dword [0x4d3dd4], ecx
mov eax, dword [0x4d3dcc]
mov dword [0x4dc82c], eax
xor edx, edx
mov dword [0x4d3dcc], edx
push 7
mov ecx, dword [esi]
push ecx
call sub.USER32.dll_ShowWindow
cmp dword [0x4d3dd0], 0
je 0x427f72
push 2
call fcn.004b0d5c
push 8
mov eax, dword [esi]
push eax
call sub.USER32.dll_ShowWindow
mov edx, dword [0x4dc828]
mov dword [0x4d3dd4], edx
mov ecx, dword [0x4dc82c]
mov dword [0x4d3dcc], ecx
jmp 0x4280cf
push 0x78
mov eax, dword [ebx + 4]
push eax
call fcn.004bce0c
add esp, 8
test eax, eax
je 0x427fd8
cmp dword [0x4d3dd0], 0
je 0x427fb1
push 2
call fcn.004b0d5c
push 3
mov edx, dword [esi]
push edx
call sub.USER32.dll_ShowWindow
mov ecx, dword [esi]
push ecx
call sub.USER32.dll_SetForegroundWindow
mov eax, dword [esi]
push eax
call sub.USER32.dll_SetActiveWindow
mov edx, dword [esi]
push edx
call sub.USER32.dll_SetFocus
jmp 0x4280cf
push 0x73
mov ecx, dword [ebx + 4]
push ecx
call fcn.004bce0c
add esp, 8
test eax, eax
je 0x428021
cmp dword [0x4d3dd0], 0
je 0x427ffa
push 2
call fcn.004b0d5c
push 8
mov eax, dword [esi]
push eax
call sub.USER32.dll_ShowWindow
mov edx, dword [esi]
push edx
call sub.USER32.dll_SetForegroundWindow
mov ecx, dword [esi]
push ecx
call sub.USER32.dll_SetActiveWindow
mov eax, dword [esi]
push eax
call sub.USER32.dll_SetFocus
jmp 0x4280cf
push 0x72
mov edx, dword [ebx + 4]
push edx
call fcn.004bce0c
add esp, 8
test eax, eax
je 0x428071
cmp dword [0x4d3dd0], 0
je 0x42804d
push 2
call fcn.004b0d5c
push 8
mov ecx, dword [esi]
push ecx
call sub.USER32.dll_ShowWindow
push 9
mov eax, dword [esi]
push eax
call sub.USER32.dll_ShowWindow
mov edx, dword [esi]
push edx
call sub.USER32.dll_SetForegroundWindow
mov ecx, dword [esi]
push ecx
call sub.USER32.dll_SetActiveWindow
mov eax, dword [esi]
push eax
call sub.USER32.dll_SetFocus
jmp 0x4280cf
push 0x74
mov edx, dword [ebx + 4]
push edx
call fcn.004bce0c
add esp, 8
test eax, eax
je 0x4280cf
mov ecx, dword [0x4d3dd4]
mov dword [0x4dc828], ecx
mov dword [0x4d3dd4], 1
cmp dword [0x4d3dcc], 0
je 0x4280b9
push 1
call fcn.004b0d5c
test eax, eax
je 0x4280b9
push 0
mov eax, dword [esi]
push eax
call sub.USER32.dll_ShowWindow
jmp 0x4280c3
push 7
mov edx, dword [esi]
push edx
call sub.USER32.dll_ShowWindow
mov ecx, dword [0x4dc828]
mov dword [0x4d3dd4], ecx
mov eax, 1
pop esi
pop ebx
pop ebp
ret 4
Function at 0x429290
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
cmp dword [esi + 4], 0
jne 0x4292bd
mov byte [0x4e6c8c], 0
push edi
push ebx
call fcn.0040ae30
mov eax, 1
jmp 0x429432
mov edx, dword [esi + 4]
cmp byte [edx], 0x40
jne 0x4293a9
mov ecx, dword [esi + 4]
push ecx
call fcn.004b78d4
mov dword [0x4dc864], eax
cmp dword [0x4dc864], 0
jne 0x4292f3
push 7
push 0
mov eax, dword [esi]
push eax
push 0
call fcn.0043e834
jmp 0x429432
mov edx, dword [esi + 4]
mov dword [0x4dc868], edx
mov ecx, dword [0x4dc864]
cmp byte [ecx + 0x4e7], 0
je 0x429311
inc dword [0x4dc868]
mov eax, dword [0x4dc868]
push eax
push 0x4cbe39
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0xc
push esi
push ebx
push 2
call fcn.00488944
push 0xf
push ebx
call fcn.004a6178
mov edx, dword [0x4dc864]
mov ecx, dword [edx]
push ecx
call sub.USER32.dll_GetWindowTextLengthA
mov esi, eax
push ebx
call fcn.004bceac
pop ecx
cmp esi, eax
jne 0x429390
push 0x3b5
push edi
mov eax, dword [0x4dc864]
mov edx, dword [eax]
push edx
call sub.USER32.dll_GetWindowTextA
mov eax, ebx
mov edx, edi
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x429390
test cl, cl
je 0x429384
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x429390
add eax, 2
add edx, 2
test cl, cl
jne 0x429368
jne 0x429390
mov eax, 1
jmp 0x429432
push ebx
mov edx, dword [0x4dc864]
mov ecx, dword [edx]
push ecx
call sub.USER32.dll_SetWindowTextA
mov eax, 1
jmp 0x429432
push 0x4cbe3e
mov edx, dword [esi + 4]
push edx
call fcn.004bcfe4
add esp, 8
test eax, eax
jne 0x4293ca
mov dword [0x4dc86c], 2
jmp 0x4293d4
mov dword [0x4dc86c], 1
mov ecx, dword [0x4dc86c]
cmp dword [esi + ecx*4], 0
je 0x42941f
mov byte [ebx], 0
push esi
push ebx
mov eax, dword [0x4dc86c]
push eax
call fcn.00488944
mov byte [ebx + 0xfa], 0
push edi
mov esi, 0x4e6c8c
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
jmp 0x429426
mov byte [0x4e6c8c], 0
push edi
push ebx
call fcn.0040ae30
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x43364c
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, 0x4ccb6c
push str.mirc.ini
push 0x3c
push 0x4cca34
lea eax, [ebx + 0x12]
push eax
lea edx, [ebx + 5]
push edx
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push str.mirc.ini
push 0x3e7
push 0x4d7f48
lea ecx, [ebx + 0x2b]
push ecx
lea eax, [ebx + 0x1d]
push eax
lea edx, [ebx + 0x18]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x4d7f48], 0
je 0x4336b6
lea ecx, [ebx + 0x2f]
push ecx
push 0x4d7f48
call fcn.004bcfe4
add esp, 8
test eax, eax
jne 0x4336b6
mov dword [0x4cca84], 1
jmp 0x4336bd
xor eax, eax
mov dword [0x4cca84], eax
mov eax, sym.H_BIRC.exe_DDECallback
mov dword [0x4cca30], eax
push 0
push 0x1c4020
push eax
push 0x4cca2c
call sub.USER32.dll_DdeInitializeA
test eax, eax
jne 0x4336f2
cmp dword [0x4cca84], 0
je 0x4336eb
call fcn.00433708
mov eax, 1
pop ebx
ret
xor edx, edx
mov dword [0x4cca2c], edx
xor ecx, ecx
mov dword [0x4cca30], ecx
xor eax, eax
pop ebx
ret
Function at 0x43d56c
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x4cd080
mov esi, 0x4d832f
mov edi, str.mirc.ini
push edi
push 0x3e7
push esi
lea eax, [ebx + 0xe]
push eax
lea edx, [ebx + 7]
push edx
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x43d5bd
push 0
push 0
push 0x4e266c
push esi
call fcn.0040b1d4
push eax
mov ecx, dword [0x4cd07c]
push ecx
call fcn.0046f388
test eax, eax
je 0x43d5bd
mov dword [0x4cd07c], eax
push edi
push 0x3e7
push esi
lea eax, [ebx + 0x21]
push eax
lea edx, [ebx + 0x19]
push edx
lea ecx, [ebx + 0x12]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x43d5fe
push 1
push 0
push 0x4e266c
push esi
call fcn.0040b1d4
push eax
mov eax, dword [0x4cd07c]
push eax
call fcn.0046f388
test eax, eax
je 0x43d5fe
mov dword [0x4cd07c], eax
push edi
push 0x3e7
push esi
lea edx, [ebx + 0x34]
push edx
lea ecx, [ebx + 0x2c]
push ecx
lea eax, [ebx + 0x25]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x43d640
push 2
push 0
push 0x4e266c
push esi
call fcn.0040b1d4
push eax
mov edx, dword [0x4cd07c]
push edx
call fcn.0046f388
test eax, eax
je 0x43d640
mov dword [0x4cd07c], eax
push edi
push 0x3e7
push esi
lea ecx, [ebx + 0x4b]
push ecx
lea eax, [ebx + 0x3f]
push eax
lea edx, [ebx + 0x38]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x43d682
push 3
push 0
push 0x4e266c
push esi
call fcn.0040b1d4
push eax
mov ecx, dword [0x4cd07c]
push ecx
call fcn.0046f388
test eax, eax
je 0x43d682
mov dword [0x4cd07c], eax
push edi
push 0x3e7
push esi
lea eax, [ebx + 0x5c]
push eax
lea edx, [ebx + 0x56]
push edx
lea ecx, [ebx + 0x4f]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x43d6c3
push 4
push 0
push 0x4e266c
push esi
call fcn.0040b1d4
push eax
mov eax, dword [0x4cd07c]
push eax
call fcn.0046f388
test eax, eax
je 0x43d6c3
mov dword [0x4cd07c], eax
push edi
push 0x3e7
push esi
lea edx, [ebx + 0x72]
push edx
lea ecx, [ebx + 0x67]
push ecx
lea eax, [ebx + 0x60]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x43d705
push 5
push 0
push 0x4e266c
push esi
call fcn.0040b1d4
push eax
mov edx, dword [0x4cd07c]
push edx
call fcn.0046f388
test eax, eax
je 0x43d705
mov dword [0x4cd07c], eax
push edi
push 0x3e7
push esi
lea ecx, [ebx + 0x84]
push ecx
lea eax, [ebx + 0x7d]
push eax
lea edx, [ebx + 0x76]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x43d74a
push 6
push 0
push 0x4e266c
push esi
call fcn.0040b1d4
push eax
mov ecx, dword [0x4cd07c]
push ecx
call fcn.0046f388
test eax, eax
je 0x43d74a
mov dword [0x4cd07c], eax
pop edi
pop esi
pop ebx
ret