joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479839
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x33c], 2
push 0
call fcn.00548d28
pop ecx
mov dword [ebx + 0x394], eax
cmp dword [ebx + 0x340], 0
je 0x479958
cmp word [ebx + 0x34c], 0
jne 0x479958
cmp dword [0x5515fc], 0
je 0x4798c4
cmp dword [0x5515f8], 0
je 0x4798c4
push 0
push 0xb5c
call fcn.0041c35b
push eax
push 1
push 1
push 1
push 1
push ebx
call fcn.0050c318
push dword [ebx + 0x340]
push 1
push 0
add ebx, 0xcc
push ebx
call fcn.00475cf6
mov eax, 1
jmp 0x479a8d
push 1
push 0
lea edx, [ebx + 0x34c]
push edx
mov cx, word [0x54f356]
push ecx
mov ax, word [0x54f354]
push eax
call fcn.004e3612
mov esi, eax
mov dword [ebx + 0x398], esi
cmp esi, 0xffffffff
jne 0x47990c
push 1
push ebx
push 0
push 0xb5d
call fcn.0041c35b
push eax
call fcn.0047962b
xor eax, eax
jmp 0x479a8d
push 8
push 0x411
push dword [0x55b3c8]
push dword [ebx + 0x398]
call sub.WSOCK32.dll_WSAAsyncSelect
push dword [ebx + 0x340]
push dword [ebx + 0x35c]
mov dx, word [ebx + 0x34c]
push edx
push dword [0x557880]
lea ecx, [ebx + 0x234]
push ecx
add ebx, 4
push ebx
call fcn.004f5c68
mov eax, 1
jmp 0x479a8d
lea edx, [ebx + 0xcc]
push edx
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x479988
push 1
push ebx
push 0
push 0xb5e
call fcn.0041c35b
push eax
call fcn.0047962b
xor eax, eax
jmp 0x479a8d
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov word [ebp - 0x12], 4
mov word [ebp - 0x14], 2
lea esi, [ebp - 0x1c]
push 0x10
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.00539438
add esp, 0xc
mov word [ebp - 0x2c], 2
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
push dword [ecx]
lea eax, [ebp - 0x28]
push eax
call fcn.005393c8
add esp, 0xc
mov dx, word [ebx + 0x34c]
push edx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x2a], ax
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax]
mov dword [ebp - 0x28], edx
push 0
push 2
push 0
mov cx, word [0x54f356]
push ecx
mov ax, word [0x54f354]
push eax
call fcn.004e3612
mov esi, eax
mov dword [ebx + 0x398], esi
cmp esi, 0xffffffff
jne 0x479a2e
push 1
push ebx
push 0
push 0xb5d
call fcn.0041c35b
push eax
call fcn.0047962b
xor eax, eax
jmp 0x479a8d
push dword [ebx + 0x398]
call fcn.0051b512
push 0x10
push 0x40f
push dword [0x55b3c8]
push dword [ebx + 0x398]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x2c]
push edx
push dword [ebx + 0x398]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x479a8b
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x479a8b
push 1
push ebx
push 0
push 0xb5f
call fcn.0041c35b
push eax
call fcn.0047962b
xor eax, eax
jmp 0x479a8d
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47a04a
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x47a05e
xor eax, eax
jmp 0x47a194
push 0
call fcn.00548d28
pop ecx
mov dword [ebx + 0x394], eax
push 0
push 0x2000
push 0x574d36
push dword [ebx + 0x398]
call sub.WSOCK32.dll_recv
mov esi, eax
cmp dword [ebx + 0x33c], 4
je 0x47a095
xor eax, eax
jmp 0x47a194
cmp esi, 0xffffffff
jne 0x47a0c9
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x47a0ad
xor eax, eax
jmp 0x47a194
push 1
push ebx
push 0
push 0xb67
call fcn.0041c35b
push eax
call fcn.0047962b
xor eax, eax
jmp 0x47a194
test esi, esi
jg 0x47a0dc
push 0
push ebx
call fcn.0047a412
xor eax, eax
jmp 0x47a194
mov byte [esi + 0x574d36], 0
mov edi, esi
add dword [ebx + 0x350], edi
cmp dword [ebx + 0x360], 0
jbe 0x47a106
push 2
push 0
push dword [ebx + 0x338]
call fcn.0053d8f4
add esp, 0xc
push edi
push 0x574d36
push dword [ebx + 0x338]
call fcn.0053f614
add esp, 0xc
cmp esi, eax
je 0x47a137
push 1
push ebx
push 0
push 0xb65
call fcn.0041c35b
push eax
call fcn.0047962b
xor eax, eax
jmp 0x47a194
push dword [ebx + 0x350]
call sub.WSOCK32.dll_htonl
mov dword [ebx + 0x354], eax
push ebx
call fcn.0047a28e
push ebx
call fcn.0047a19b
test eax, eax
jne 0x47a15c
xor eax, eax
jmp 0x47a194
push ebx
call fcn.00478a69
test eax, eax
jne 0x47a16a
xor eax, eax
jmp 0x47a194
mov eax, dword [ebx + 0x35c]
test eax, eax
jbe 0x47a06c
cmp eax, dword [ebx + 0x350]
ja 0x47a06c
mov dword [ebx + 0x350], eax
push 0
push ebx
call fcn.0047a412
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x47ac6a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
xor esi, esi
mov eax, 0x576ed0
jmp 0x47ac80
mov byte [eax], dl
inc ebx
inc eax
inc esi
mov dl, byte [ebx]
test dl, dl
jne 0x47ac7b
mov byte [eax], 0
mov ebx, 0x576ed0
test esi, esi
ja 0x47ac96
xor eax, eax
jmp 0x47acb2
push esi
push ebx
call sub.USER32.dll_CharLowerBuffA
xor eax, eax
jmp 0x47acac
and edx, 0xff
xor eax, edx
add eax, eax
inc ebx
mov dl, byte [ebx]
test dl, dl
jne 0x47aca1
pop esi
pop ebx
pop ebp
ret 4

Function at 0x47dd8d
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x551d58
mov esi, 0x579826
mov edi, 0x569b9c
mov ebp, 0x5772fc
push str.mirc.ini
push 0x3e7
push esi
lea eax, [ebx + 0x1b]
push eax
lea edx, [ebx + 0x10]
push edx
lea ecx, [ebx + 0xa]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x47de62
push dword [0x551d44]
push dword [0x551d4c]
mov eax, dword [0x54d2a8]
inc eax
push eax
lea edx, [ebx + 0x1f]
push edx
push edi
call sub.USER32.dll_wsprintfA
add esp, 0x14
cmp dword [0x551d48], 1
jne 0x47de02
lea ecx, [ebx + 0x2d]
push ecx
push edi
call fcn.005394dc
add esp, 8
jmp 0x47de24
cmp dword [0x551d48], 2
jne 0x47de24
push 0
push 5
call fcn.00465acc
push eax
call fcn.0041cb05
push eax
push edi
call fcn.005394dc
add esp, 8
lea eax, [ebx + 0x33]
push eax
push edi
call fcn.005394dc
add esp, 8
push esi
push edi
call fcn.005394dc
add esp, 8
push str.mirc.ini
push edi
lea edx, [ebx + 0x42]
push edx
lea ecx, [ebx + 0x37]
push ecx
call fcn.00498684
push str.mirc.ini
push 0
lea eax, [ebx + 0x4c]
push eax
lea edx, [ebx + 0x46]
push edx
call fcn.00498684
xor ecx, ecx
mov dword [ebp], ecx
push dword [ebp]
lea eax, [ebx + 0x57]
push eax
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
inc dword [ebp]
push str.mirc.ini
push 0x3e7
push esi
lea edx, [ebx + 0x67]
push edx
push edi
lea ecx, [ebx + 0x5c]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
je 0x47dea0
push esi
call fcn.0047d9ac
jmp 0x47de67
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x482298
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, 0x552018
push str.mirc.ini
push 0x3e7
push 0x579826
lea eax, [ebx + 0xf]
push eax
lea edx, [ebx + 7]
push edx
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea ecx, [ebx + 0x13]
push ecx
push 0x579826
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x4822dc
mov dword [0x551f64], 1
jmp 0x4822e3
xor eax, eax
mov dword [0x551f64], eax
push str.mirc.ini
push 0x64
push 0x551f72
lea edx, [ebx + 0x27]
push edx
lea ecx, [ebx + 0x1f]
push ecx
lea eax, [ebx + 0x18]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x551f72], 0
je 0x48231f
push 0x20
push 0x551f72
call fcn.00539518
add esp, 8
test eax, eax
je 0x48231f
mov byte [eax], 0
cmp byte [0x551f72], 0
jne 0x482330
xor edx, edx
mov dword [0x551f64], edx
push str.mirc.ini
push 0x32
push 0x551fd6
lea ecx, [ebx + 0x3a]
push ecx
lea eax, [ebx + 0x32]
push eax
lea edx, [ebx + 0x2b]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push str.mirc.ini
push 0x3e7
push 0x579826
lea ecx, [ebx + 0x4d]
push ecx
lea eax, [ebx + 0x47]
push eax
lea edx, [ebx + 0x40]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x579826], 0
je 0x482389
push 0x579826
call fcn.00542dbc
pop ecx
mov word [0x551f70], ax
jmp 0x482392
mov word [0x551f70], 0x71
cmp word [0x551f70], 0
ja 0x4823a5
mov word [0x551f70], 0x71
pop ebx
ret

Function at 0x4824d6
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
mov esi, 0x552010
cmp dword [esi], 0xffffffff
jne 0x482551
mov dword [0x552014], 0xffffffff
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov ebx, eax
mov dword [esi], ebx
cmp ebx, 0xffffffff
jne 0x48250a
push 0
call fcn.00482456
pop esi
pop ebx
ret
mov ax, word [0x551f70]
push eax
push dword [esi]
call fcn.004e3568
test eax, eax
jne 0x482526
push 0
call fcn.00482456
pop esi
pop ebx
ret
push 5
push dword [esi]
call sub.WSOCK32.dll_listen
test eax, eax
je 0x48253d
push 0
call fcn.00482456
pop esi
pop ebx
ret
push 8
push 0x42a
push dword [0x55b3c8]
push dword [esi]
call sub.WSOCK32.dll_WSAAsyncSelect
pop esi
pop ebx
ret
Function at 0x48269e
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov edx, eax
shr edx, 0x10
test dx, 0xffff
jne 0x4827cf
cmp eax, 0x20
je 0x4827cf
mov eax, dword [0x552014]
cmp eax, 0xffffffff
je 0x4827cf
push 0
push 0x32
push 0x578690
push eax
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
je 0x4827cf
cmp eax, 1
jle 0x4827cf
cmp eax, 0x19
jg 0x4827cf
mov byte [eax + 0x578690], 0
push 0x2c
push 0x578690
call fcn.00539518
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4827cf
mov byte [ebx], 0
inc ebx
cmp byte [ebx], 0
je 0x4827cf
push 0x578690
call fcn.00542dbc
pop ecx
mov esi, eax
push ebx
call fcn.00542dbc
pop ecx
mov ebx, eax
cmp dword [0x551f68], 0
je 0x482790
push 0x551f72
push 0x551fd6
push ebx
push esi
push 0
push 0xc1f
call fcn.0041c35b
push eax
push 0x57a469
call sub.USER32.dll_wsprintfA
add esp, 0x18
push dword [0x54d2ac]
push 0x57a469
push dword [0x55b3d8]
call fcn.004dfd6c
push dword [0x54d29c]
push dword [0x55b3d8]
call fcn.004dfc12
push 0x551f72
push 0x551fd6
push ebx
push esi
push str._d___d_:_USERID_:__s_:__s_r_n
push 0x578690
call sub.USER32.dll_wsprintfA
add esp, 0x18
push 0x22
push 0x42c
push dword [0x55b3c8]
push dword [0x552014]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0
call fcn.004827f7
jmp 0x4827f1
cmp dword [0x54e370], 0
je 0x4827ea
cmp dword [0x551f6c], 0
je 0x4827ea
push 0
call fcn.00482456
jmp 0x4827f1
push 1
call fcn.00482456
pop esi
pop ebx
pop ebp
ret 4
Function at 0x48415d
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ebx, 0x578880
cmp dword [ebp + 0x20], 0
jne 0x484180
mov dword [0x578874], 1
jmp 0x4841ee
cmp dword [edi + 8], 0
jne 0x4841a1
push 1
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push edi
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call fcn.004d58b6
jmp 0x484388
cmp dword [edi + 0x34], 0
jne 0x4841b1
mov eax, 2
jmp 0x484388
mov edx, dword [edi + 0x34]
cmp dword [edx + 0x1c], 1
je 0x4841c4
mov eax, 1
jmp 0x484388
mov edx, dword [edi + 0x34]
cmp dword [edx + 0xc], 0
jne 0x484366
mov ecx, dword [edi + 0x34]
push dword [ecx]
call fcn.00542dbc
pop ecx
mov dword [0x578874], eax
cmp dword [0x578874], 0
jl 0x484366
push dword [0x55b3c8]
call sub.USER32.dll_OpenClipboard
test eax, eax
je 0x484366
push 1
call sub.USER32.dll_GetClipboardData
mov dword [0x578870], eax
cmp dword [0x578870], 0
je 0x484361
push dword [0x578870]
call sub.KERNEL32.dll_GlobalLock
mov dword [0x578884], eax
cmp dword [0x578884], 0
je 0x484361
mov byte [esi], 0
push dword [0x578884]
call fcn.005395b8
pop ecx
mov dword [0x57887c], eax
xor eax, eax
mov dword [0x578878], eax
push 0xa
push dword [0x578884]
call fcn.00539518
add esp, 8
mov dword [ebx], eax
inc dword [0x578878]
mov edx, dword [0x578878]
cmp edx, dword [0x578874]
jne 0x4842bf
cmp dword [ebx], 0
je 0x484282
mov ecx, dword [ebx]
mov byte [ecx], 0
push 0x3b5
push dword [0x578884]
push esi
call fcn.005397c4
add esp, 0xc
mov byte [esi + 0x3b5], 0
mov eax, dword [ebx]
test eax, eax
je 0x4842a6
mov byte [eax], 0xa
push 0xd
push esi
call fcn.00539518
add esp, 8
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x4842e0
mov edx, dword [ebx]
mov byte [edx], 0
jmp 0x4842e0
cmp dword [ebx], 0
je 0x4842e0
inc dword [ebx]
mov ecx, dword [ebx]
cmp byte [ecx], 0xd
jne 0x4842cf
inc dword [ebx]
mov eax, dword [ebx]
cmp byte [eax], 0
je 0x4842e0
mov dword [0x578884], eax
jmp 0x484252
cmp dword [0x578874], 0
jne 0x4842fd
push dword [0x578878]
push 0x5521da
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
cmp dword [edi + 0x10], 0
je 0x484356
push 0x2e
push dword [edi]
call fcn.005398a0
add esp, 8
mov dword [ebx], eax
test eax, eax
je 0x484356
push str..len
push dword [ebx]
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x484353
cmp dword [0x578874], 0
je 0x48433d
push esi
call fcn.005395b8
pop ecx
mov dword [0x57887c], eax
push dword [0x57887c]
push 0x5521e4
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x484356
mov byte [esi], 0
push dword [0x578870]
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_CloseClipboard
cmp dword [ebp + 0x20], 1
jne 0x484383
push dword [edi + 0x34]
mov edx, dword [ebp + 0xc]
push dword [edx]
call fcn.004b103a
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
mov dword [edi + 8], eax
mov eax, 2
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x486bef
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, 0x578a7c
cmp dword [esi + 8], 0
jne 0x486c1e
push 1
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
push dword [edi]
push dword [ebp + 8]
call fcn.004d58b6
jmp 0x486d57
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x486c2f
mov eax, 2
jmp 0x486d57
cmp dword [eax + 0x1c], 1
jne 0x486d52
cmp dword [eax + 0xc], 0
jne 0x486d3a
xor edx, edx
mov dword [0x578a78], edx
mov edx, dword [eax]
cmp byte [edx], 0x3d
jne 0x486d04
mov eax, edx
inc eax
mov dword [0x578a80], eax
cmp byte [eax], 0
je 0x486d13
xor ecx, ecx
mov dword [ebx], ecx
push dword [0x54cbf8]
call fcn.00427805
test eax, eax
je 0x486caf
mov eax, dword [0x54cbf8]
cmp dword [eax + 0x51c], 0
je 0x486caf
push dword [0x578a80]
mov edx, dword [0x54cbf8]
add edx, 0x3f0
push edx
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x486caf
mov ecx, dword [0x54cbf8]
mov dword [ebx], ecx
cmp dword [ebx], 0
jne 0x486cef
mov eax, dword [0x54cbf4]
mov dword [ebx], eax
jmp 0x486cea
mov eax, dword [ebx]
cmp dword [eax + 0x51c], 3
jne 0x486ce0
push dword [0x578a80]
add eax, 0x3f0
push eax
call fcn.0053977c
add esp, 8
test eax, eax
je 0x486cef
mov edx, dword [ebx]
mov ecx, dword [edx + 0x87c]
mov dword [ebx], ecx
cmp dword [ebx], 0
jne 0x486cbd
cmp dword [ebx], 0
je 0x486d13
mov eax, dword [ebx]
push dword [eax]
call fcn.00516145
mov dword [0x578a78], eax
jmp 0x486d13
mov edx, dword [esi + 0x34]
push dword [edx]
call fcn.005160e8
mov dword [0x578a78], eax
mov eax, dword [0x578a78]
test eax, eax
je 0x486d3a
cmp dword [eax + 0x758], 0
je 0x486d3a
push dword [ebp + 0x14]
push 0x1f4
push 0xd
push dword [eax + 0x758]
call sub.USER32.dll_SendMessageA
push dword [esi + 0x34]
push dword [edi]
call fcn.004b103a
mov dword [edi], eax
xor edx, edx
mov dword [esi + 8], edx
mov eax, 2
jmp 0x486d57
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x4988db
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0x18]
mov edi, 0x57943f
push dword [ebp + 0x10]
call fcn.004b12ac
xor eax, eax
mov dword [ebp - 4], eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push 0x553564
push 0x579826
call sub.USER32.dll_wsprintfA
add esp, 0x10
push dword [ebp + 0x14]
push 0x3e7
push edi
push 0x55356a
push 0x579826
push dword [ebp + 8]
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [edi], 0
je 0x498a0b
cmp esi, 1
jne 0x4989b7
push 0x55356e
push edi
call fcn.005398cc
add esp, 8
test eax, eax
jne 0x4989f1
push esi
push edi
mov esi, 0x579826
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x3a
push 0x579826
call fcn.00539518
add esp, 8
test eax, eax
jne 0x49898d
inc ebx
jmp 0x4988f9
mov byte [eax], 0
inc eax
cmp byte [eax], 0
jne 0x49899c
inc ebx
jmp 0x4988f9
push eax
push 0x579826
push 0x579826
push str._sSERVER:_s:_s
push edi
call sub.USER32.dll_wsprintfA
add esp, 0x14
jmp 0x4989f1
cmp esi, 2
jne 0x4989d4
push 0x553586
push edi
call fcn.005398cc
add esp, 8
test eax, eax
jne 0x4989f1
inc ebx
jmp 0x4988f9
cmp esi, 3
jne 0x4989f1
push 0x55358b
push edi
call fcn.005398cc
add esp, 8
test eax, eax
jne 0x4989f1
inc ebx
jmp 0x4988f9
push 0
push 0
push edi
push dword [ebp - 4]
call fcn.004b0c4c
test eax, eax
je 0x498a05
mov dword [ebp - 4], eax
inc ebx
jmp 0x4988f9
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x14
Function at 0x49a0a7
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp byte [ebx], 0
jne 0x49a134
test edi, edi
jne 0x49a10f
push str.mirc.ini
push 0x3dd
push 0x57943f
push 0x5536c5
push 0
push dword [ebp + 0x10]
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x57943f], 0
je 0x49a10f
mov esi, ebx
mov edi, str.mirc.ini
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x49a21c
push esi
push edi
mov edi, esi
mov esi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push ebx
call fcn.0041cb6c
push 0x572713
push 0x572613
push 0x572513
push 0x572510
push ebx
call fcn.0053e8e0
add esp, 0x14
cmp byte [0x572510], 0
jne 0x49a169
cmp byte [0x572513], 0
je 0x49a179
push 1
push ebx
call fcn.0041c947
test eax, eax
jne 0x49a21c
push 0x572713
push 0x572613
push 0x553318
push 0x5536c9
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0x14
push 1
push ebx
call fcn.0041c947
test eax, eax
jne 0x49a21c
test edi, edi
jne 0x49a1f3
push str.mirc.ini
push 0x3dd
push 0x57943f
push 0x5536d1
push 0
push dword [ebp + 0x10]
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x57943f], 0
je 0x49a1f3
mov esi, ebx
mov edi, str.mirc.ini
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x49a21c
push esi
mov edi, esi
mov esi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push ebx
call fcn.0041cb6c
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x49baeb
Capabilities:
Log keystrokes via polling

Disassembly:
add esp, 0xffffffa8
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
push ecx
lea eax, [esp + 0x18]
push eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x14]
push ecx
lea eax, [esp + 0x1c]
push eax
lea edx, [esp + 0x18]
push edx
push 0x554184
push 0
call fcn.004deb61
cmp dword [0x55ad8c], 0
je 0x49bb49
push dword [0x55b3c8]
call sub.USER32.dll_IsWindowVisible
test eax, eax
jne 0x49bb49
mov dword [esp + 0x10], 3
jmp 0x49bb81
push dword [0x55b3c8]
call sub.USER32.dll_IsIconic
test eax, eax
je 0x49bb62
mov dword [esp + 0x10], 1
jmp 0x49bb81
push dword [0x55b3c8]
call sub.USER32.dll_IsZoomed
test eax, eax
je 0x49bb7b
mov dword [esp + 0x10], 2
jmp 0x49bb81
xor ecx, ecx
mov dword [esp + 0x10], ecx
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x49bba8
cmp dword [0x55ad88], 0
je 0x49bba0
mov dword [esp + 0x10], 3
jmp 0x49bba8
mov dword [esp + 0x10], 1
cmp dword [esp + 0x10], 0
jne 0x49bbe4
lea eax, [esp + 0x48]
push eax
push dword [0x55b3c8]
call sub.USER32.dll_GetWindowRect
mov eax, dword [esp + 0x48]
mov dword [esp], eax
mov edx, dword [esp + 0x50]
sub edx, eax
mov dword [esp + 8], edx
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], eax
mov edx, dword [esp + 0x54]
sub edx, eax
mov dword [esp + 0xc], edx
jmp 0x49bc1f
mov dword [esp + 0x1c], 0x2c
lea ecx, [esp + 0x1c]
push ecx
push dword [0x55b3c8]
call sub.USER32.dll_GetWindowPlacement
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov edx, dword [esp + 0x40]
sub edx, eax
mov dword [esp + 8], edx
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov edx, dword [esp + 0x44]
sub edx, eax
mov dword [esp + 0xc], edx
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x14]
push dword [esp + 0x1c]
push dword [esp + 0x18]
push 0x55418a
push 0x579826
call sub.USER32.dll_wsprintfA
add esp, 0x24
push str.mirc.ini
push 0x579826
push 0x5541a9
push 0x5541a0
call fcn.00498684
add esp, 0x58
ret
Function at 0x4afe00
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x55554c
mov esi, 0x5555a8
mov edi, 0x57f8f2
push str.mirc.ini
push 0x3e7
push edi
lea eax, [esi + 0xe]
push eax
lea edx, [esi + 8]
push edx
push esi
call sub.KERNEL32.dll_GetPrivateProfileStringA
push edi
call fcn.00542dbc
pop ecx
mov dword [0x555544], eax
mov eax, dword [0x555544]
test eax, eax
jl 0x4afe45
cmp eax, 0x64
jle 0x4afe4d
xor edx, edx
mov dword [0x555544], edx
push str.mirc.ini
push 0x3e7
push edi
lea ecx, [esi + 0x22]
push ecx
lea eax, [esi + 0x1a]
push eax
lea edx, [esi + 0x12]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov dword [0x553524], edi
push 0
call fcn.00498f25
mov dword [ebx], eax
push 0
call fcn.00498f25
mov dword [ebx + 4], eax
push 0
call fcn.00498f25
mov dword [ebx + 8], eax
push 0
call fcn.00498f25
mov dword [ebx + 0xc], eax
push 0
call fcn.00498f25
mov dword [ebx + 0x10], eax
push 0
call fcn.00498f25
mov dword [ebx + 0x14], eax
push 0
call fcn.00498f25
mov dword [ebx + 0x18], eax
push 0
call fcn.00498f25
mov dword [ebx + 0x1c], eax
push 0
call fcn.00498f25
mov dword [ebx + 0x20], eax
push 0
call fcn.00498f25
mov dword [ebx + 0x24], eax
push str.mirc.ini
push 0x3e7
push edi
lea ecx, [esi + 0x36]
push ecx
lea eax, [esi + 0x2e]
push eax
lea edx, [esi + 0x26]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push edi
call fcn.00542dbc
pop ecx
mov dword [0x555548], eax
mov eax, dword [0x555548]
test eax, eax
jl 0x4aff08
cmp eax, 0x64
jle 0x4aff10
xor edx, edx
mov dword [0x555548], edx
pop edi
pop esi
pop ebx
ret

Function at 0x4b03fc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [0x556164], 0
je 0x4b0425
lea eax, [ebp - 4]
push eax
push 0x555770
push 0x80000001
call sub.ADVAPI32.dll_RegCreateKeyA
mov ebx, eax
jmp 0x4b043a
lea eax, [ebp - 4]
push eax
push 0x55577f
push 0x80000000
call sub.ADVAPI32.dll_RegCreateKeyA
mov ebx, eax
test ebx, ebx
je 0x4b0442
xor eax, eax
jmp 0x4b0470
push esi
call fcn.005395b8
pop ecx
inc eax
push eax
push esi
push 1
push dword [ebp + 8]
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegSetValueA
mov ebx, eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
je 0x4b046b
xor eax, eax
jmp 0x4b0470
mov eax, 1
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4b0477
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov byte [esi], 0
cmp dword [0x556164], 0
je 0x4b04a5
lea eax, [ebp - 8]
push eax
push 0x555785
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyA
mov ebx, eax
jmp 0x4b04ba
lea eax, [ebp - 8]
push eax
push 0x555794
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
mov ebx, eax
test ebx, ebx
je 0x4b04c2
xor eax, eax
jmp 0x4b04f0
mov dword [ebp - 4], 0x3e7
lea edx, [ebp - 4]
push edx
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegQueryValueA
mov ebx, eax
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
je 0x4b04eb
xor eax, eax
jmp 0x4b04f0
mov eax, 1
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8