joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dc1ce
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x404], 1
push 0
call fcn.00526bc8
pop ecx
mov dword [ebx + 0x450], eax
lea eax, [ebx + 0xcc]
push eax
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4dc264
cmp dword [0x52e370], 0
je 0x4dc221
cmp dword [0x52e36c], 0
je 0x4dc221
cmp dword [0x52e368], 0
jne 0x4dc264
cmp dword [ebx + 0x440], 0
je 0x4dc24a
push 8
push 0
lea edx, [ebx + 0xcc]
push edx
lea ecx, [ebx + 4]
push ecx
push dword [ebx]
call fcn.004531f8
mov eax, 1
jmp 0x4dc3cc
push ebx
push 0
push 0x138e
call fcn.00415c87
push eax
call fcn.004db839
xor eax, eax
jmp 0x4dc3cc
cmp dword [0x52e370], 0
je 0x4dc2cb
cmp dword [0x52e36c], 0
je 0x4dc2cb
push 0
push 0x138f
call fcn.00415c87
push eax
push 1
push 0
push 1
push 1
push ebx
call fcn.004ef802
cmp dword [ebx + 0x408], 0
jne 0x4dc2a5
call fcn.004db480
mov dword [ebx + 0x408], eax
push dword [ebx + 0x408]
push 0
mov dx, word [ebx + 0x414]
push edx
add ebx, 0xcc
push ebx
call fcn.00466a52
mov eax, 1
jmp 0x4dc3cc
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov word [ebp - 0x12], 4
mov word [ebp - 0x14], 2
lea esi, [ebp - 0x1c]
push 0x10
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.0051825c
add esp, 0xc
mov word [ebp - 0x2c], 2
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
push dword [ecx]
lea eax, [ebp - 0x28]
push eax
call fcn.005181ec
add esp, 0xc
mov dx, word [ebx + 0x414]
push edx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x2a], ax
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax]
mov dword [ebp - 0x28], edx
push 0
push 2
push 0
mov cx, word [0x52c432]
push ecx
mov ax, word [0x52c430]
push eax
call fcn.004cb44e
mov esi, eax
mov dword [ebx + 0x46c], esi
cmp esi, 0xffffffff
jne 0x4dc36f
push ebx
push 0
push 0x1390
call fcn.00415c87
push eax
call fcn.004db839
xor eax, eax
jmp 0x4dc3cc
push dword [ebx + 0x46c]
call fcn.004fe692
push 0x10
push 0x414
push dword [0x537420]
push dword [ebx + 0x46c]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x2c]
push edx
push dword [ebx + 0x46c]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x4dc3ca
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4dc3ca
push ebx
push 0
push 0x1391
call fcn.00415c87
push eax
call fcn.004db839
xor eax, eax
jmp 0x4dc3cc
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4dcfe3
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4dcff8
xor eax, eax
jmp 0x4dd24a
cmp dword [ebx + 0x404], 2
je 0x4dd008
xor eax, eax
jmp 0x4dd24a
cmp dword [0x5357c4], 0
jne 0x4dd02f
cmp dword [0x5357b8], 0
jne 0x4dd02f
mov edx, dword [ebx + 0x410]
cmp edx, dword [ebx + 0x418]
jae 0x4dd02f
xor eax, eax
jmp 0x4dd24a
push 0
call fcn.00526bc8
pop ecx
mov dword [ebx + 0x450], eax
mov esi, dword [ebx + 0x40c]
cmp dword [ebx + 0x460], 0
jbe 0x4dd0aa
push ebx
call fcn.004db5cb
mov esi, eax
test esi, esi
jne 0x4dd0aa
mov dword [ebx + 0x444], 1
cmp dword [0x5357b4], 0
jne 0x4dd0a3
push 0
push 0x32
push 0x80
push dword [0x537420]
call sub.USER32.dll_SetTimer
mov esi, eax
mov dword [0x5357b4], esi
test esi, esi
jne 0x4dd0a3
push 0x23
push 0x417
push dword [0x537420]
push dword [ebx + 0x46c]
call sub.WSOCK32.dll_WSAAsyncSelect
xor eax, eax
jmp 0x4dd24a
push dword [ebx + 0x400]
call fcn.0051d808
pop ecx
mov dword [ebp - 4], eax
push esi
push 0x55df4f
push dword [ebx + 0x400]
call fcn.0051c6d4
add esp, 0xc
mov esi, eax
test esi, esi
jge 0x4dd0ed
push ebx
push 0
push 0x1398
call fcn.00415c87
push eax
call fcn.004db839
xor eax, eax
jmp 0x4dd24a
test esi, esi
jne 0x4dd0f8
xor eax, eax
jmp 0x4dd24a
push 0
push esi
push 0x55df4f
push dword [ebx + 0x46c]
call sub.WSOCK32.dll_send
mov edi, eax
cmp edi, 0xffffffff
jne 0x4dd152
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4dd138
push 0
push dword [ebp - 4]
push dword [ebx + 0x400]
call fcn.0051c638
add esp, 0xc
xor eax, eax
jmp 0x4dd24a
push ebx
push 0
push 0x139b
call fcn.00415c87
push eax
call fcn.004db839
xor eax, eax
jmp 0x4dd24a
cmp esi, edi
jle 0x4dd16e
push 0
mov edx, dword [ebp - 4]
add edx, edi
push edx
push dword [ebx + 0x400]
call fcn.0051c638
add esp, 0xc
mov esi, edi
mov eax, esi
add dword [ebx + 0x418], eax
add dword [ebx + 0x464], eax
push ebx
call fcn.004dcd9b
mov edx, dword [ebx + 0x418]
sub edx, dword [ebx + 0x410]
mov ecx, dword [ebx + 0x40c]
add ecx, ecx
lea ecx, [ecx + ecx*4]
cmp edx, ecx
setb al
and eax, 1
cmp dword [0x5357c4], 0
jne 0x4dd1bf
cmp dword [0x5357b8], 0
je 0x4dd248
test eax, eax
je 0x4dd248
call sub.USER32.dll_GetCapture
test eax, eax
jne 0x4dd1de
push 0
push 0
push 0
push 0
push 0x55d94c
call sub.USER32.dll_PeekMessageA
test eax, eax
je 0x4dd22d
mov dword [ebx + 0x444], 1
cmp dword [0x5357b4], 0
jne 0x4dd229
push 0
push 0x32
push 0x80
push dword [0x537420]
call sub.USER32.dll_SetTimer
mov esi, eax
mov dword [0x5357b4], esi
test esi, esi
jne 0x4dd229
push 0x23
push 0x417
push dword [0x537420]
push dword [ebx + 0x46c]
call sub.WSOCK32.dll_WSAAsyncSelect
xor eax, eax
jmp 0x4dd24a
cmp dword [0x5357b4], 0
je 0x4dcfed
mov dword [ebx + 0x444], 1
xor eax, eax
jmp 0x4dd24a
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x4dd252
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4dd266
xor eax, eax
jmp 0x4dd40b
cmp dword [ebx + 0x404], 2
je 0x4dd276
xor eax, eax
jmp 0x4dd40b
push 0
call fcn.00526bc8
pop ecx
mov dword [ebx + 0x450], eax
push 0
push 4
lea edx, [ebp - 4]
push edx
push dword [ebx + 0x46c]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x4dd2c9
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4dd2af
xor eax, eax
jmp 0x4dd40b
push ebx
push 0
push 0x139b
call fcn.00415c87
push eax
call fcn.004db839
xor eax, eax
jmp 0x4dd40b
test eax, eax
jg 0x4dd2da
push ebx
call fcn.004dd497
xor eax, eax
jmp 0x4dd40b
push dword [ebp - 4]
call sub.WSOCK32.dll_ntohl
cmp eax, dword [ebx + 0x410]
ja 0x4dd2f7
push ebx
call fcn.004dd497
xor eax, eax
jmp 0x4dd40b
mov edx, eax
mov dword [ebx + 0x410], edx
mov eax, dword [ebx + 0x424]
cmp edx, eax
jb 0x4dd31c
mov dword [ebx + 0x410], eax
push ebx
call fcn.004dd497
xor eax, eax
jmp 0x4dd40b
push ebx
call fcn.004dcd9b
mov eax, dword [ebx + 0x418]
cmp eax, dword [ebx + 0x424]
jae 0x4dd409
sub eax, dword [ebx + 0x410]
mov edx, dword [ebx + 0x40c]
add edx, edx
lea edx, [edx + edx*4]
cmp eax, edx
setb cl
and ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebx + 0x410]
cmp eax, dword [ebx + 0x418]
jae 0x4dd375
cmp dword [0x5357b8], 0
je 0x4dd409
cmp dword [ebp - 4], 0
je 0x4dd409
call sub.USER32.dll_GetCapture
test eax, eax
jne 0x4dd394
push 0
push 0
push 0
push 0
push 0x55d968
call sub.USER32.dll_PeekMessageA
test eax, eax
je 0x4dd3e3
mov dword [ebx + 0x444], 1
cmp dword [0x5357b4], 0
jne 0x4dd3df
push 0
push 0x32
push 0x80
push dword [0x537420]
call sub.USER32.dll_SetTimer
mov esi, eax
mov dword [0x5357b4], esi
test esi, esi
jne 0x4dd3df
push 0x23
push 0x417
push dword [0x537420]
push dword [ebx + 0x46c]
call sub.WSOCK32.dll_WSAAsyncSelect
xor eax, eax
jmp 0x4dd40b
cmp dword [0x5357b4], 0
je 0x4dd3ff
mov dword [ebx + 0x444], 1
call fcn.004dcf77
xor eax, eax
jmp 0x4dd40b
push ebx
call fcn.004dcfe3
xor eax, eax
jmp 0x4dd40b
xor eax, eax
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x4dfcdb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
cmp dword [0x535af0], 0
je 0x4dfcf6
push eax
call sub.USER32.dll_GetParent
mov ebx, eax
jmp 0x4dfcf8
mov ebx, eax
push 0x461
push ebx
call sub.USER32.dll_GetDlgItem
mov esi, eax
call sub.USER32.dll_GetFocus
cmp esi, eax
jne 0x4dfd12
xor eax, eax
jmp 0x4dfd8c
push 0x543bd3
push 0x3e7
push 0xd
push 0x480
push ebx
call sub.USER32.dll_SendDlgItemMessageA
cmp byte [0x543bd3], 0
je 0x4dfd58
push 0x2a
push 0x543bd3
call fcn.0051833c
add esp, 8
test eax, eax
jne 0x4dfd58
push 0x3f
push 0x543bd3
call fcn.0051833c
add esp, 8
test eax, eax
je 0x4dfd5c
xor eax, eax
jmp 0x4dfd8c
push 0x12
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4dfd8a
mov eax, dword [0x560aeb]
test eax, eax
je 0x4dfd8a
cmp byte [eax], 0
je 0x4dfd8a
push 0
push 0x555704
push eax
call fcn.004e4326
mov eax, 1
jmp 0x4dfd8c
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4e17da
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x65]
push eax
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4e1801
mov eax, 3
jmp 0x4e18dd
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov word [ebp - 0x12], 4
mov word [ebp - 0x14], 2
lea esi, [ebp - 0x1c]
push 0x10
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.0051825c
add esp, 0xc
mov word [ebp - 0x2c], 2
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
push dword [ecx]
lea eax, [ebp - 0x28]
push eax
call fcn.005181ec
add esp, 0xc
mov dx, word [ebx + 0xca]
push edx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x2a], ax
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax]
mov dword [ebp - 0x28], edx
push 0
push 2
push 0
mov cx, word [0x52c432]
push ecx
mov ax, word [0x52c430]
push eax
call fcn.004cb44e
mov esi, eax
mov dword [ebx + 0x120], esi
cmp esi, 0xffffffff
jne 0x4e1895
mov eax, 1
jmp 0x4e18dd
push esi
call fcn.004fe692
push 0x10
push 0x439
push dword [0x537420]
push dword [ebx + 0x120]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x2c]
push edx
push dword [ebx + 0x120]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x4e18db
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4e18db
mov eax, 2
jmp 0x4e18dd
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4e2915
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov esi, dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004e06c6
mov ebx, eax
test ebx, ebx
je 0x4e2baa
cmp dword [ebx + 0xe4], 2
jne 0x4e2baa
mov eax, esi
shr eax, 0x10
and ax, 0xffff
test ax, ax
je 0x4e29a1
movzx edx, ax
mov dword [ebx + 0x11c], edx
cmp dword [0x534d3c], 0
je 0x4e2988
cmp dword [ebx + 0xf0], 0
je 0x4e2979
push 3
push 0x41
push ebx
push 0x535ecc
call fcn.004e0781
jmp 0x4e2988
push 3
push 0x3c
push ebx
push 0x535ed6
call fcn.004e0781
push ebx
call fcn.004e0653
test eax, eax
je 0x4e2baa
push ebx
call fcn.004e0575
jmp 0x4e2baa
cmp dword [ebx + 0xdc], 0
je 0x4e2baa
cmp dword [ebx + 0xf0], 0
je 0x4e2a47
lea eax, [ebp - 8]
mov dword [ebp - 0xc], eax
lea edx, [ebx + 0xf8]
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov word [ebp - 0xe], 4
mov word [ebp - 0x10], 2
lea esi, [ebp - 0x18]
push 0x10
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.0051825c
add esp, 0xc
mov word [ebp - 0x28], 2
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
push dword [ecx]
lea eax, [ebp - 0x24]
push eax
call fcn.005181ec
add esp, 0xc
mov dx, word [ebx + 0xfc]
push edx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x26], ax
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax]
mov dword [ebp - 0x24], edx
push 0x10
lea ecx, [ebp - 0x28]
push ecx
push 0
push dword [ebx + 0xe0]
push dword [ebx + 0xdc]
push dword [ebx + 0x120]
call sub.WSOCK32.dll_sendto
mov esi, eax
jmp 0x4e2a62
push 0
push dword [ebx + 0xe0]
push dword [ebx + 0xdc]
push dword [ebx + 0x120]
call sub.WSOCK32.dll_send
mov esi, eax
test esi, esi
jge 0x4e2ae0
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4e2a8f
push 0x23
push 0x438
push dword [0x537420]
push dword [ebx + 0x120]
call sub.WSOCK32.dll_WSAAsyncSelect
jmp 0x4e2baa
mov dword [ebx + 0x11c], eax
cmp dword [0x534d3c], 0
je 0x4e2ac7
cmp dword [ebx + 0xf0], 0
je 0x4e2ab8
push 3
push 0x41
push ebx
push 0x535ee1
call fcn.004e0781
jmp 0x4e2ac7
push 3
push 0x3c
push ebx
push 0x535eeb
call fcn.004e0781
push ebx
call fcn.004e0653
test eax, eax
je 0x4e2baa
push ebx
call fcn.004e0575
jmp 0x4e2baa
push 0
call fcn.00526bc8
pop ecx
mov dword [ebx + 0x114], eax
test esi, esi
jle 0x4e2b42
add dword [ebx + 0x108], esi
cmp esi, dword [ebx + 0xe0]
jge 0x4e2b42
sub dword [ebx + 0xe0], esi
push dword [ebx + 0xe0]
mov eax, dword [ebx + 0xdc]
add esi, eax
push esi
push eax
call fcn.00518210
add esp, 0xc
mov edx, dword [ebx + 0xe0]
add edx, 5
push edx
push dword [ebx + 0xdc]
call fcn.0052480c
add esp, 8
test eax, eax
je 0x4e2baa
mov dword [ebx + 0xdc], eax
jmp 0x4e2baa
push dword [ebx + 0xdc]
call fcn.00524270
pop ecx
xor ecx, ecx
mov dword [ebx + 0xdc], ecx
xor eax, eax
mov dword [ebx + 0xe0], eax
cmp dword [ebx + 0xf0], 0
je 0x4e2b78
cmp dword [ebx + 0xf4], 0
jne 0x4e2b78
push ebx
call fcn.004e0575
jmp 0x4e2baa
cmp dword [0x534d3c], 0
je 0x4e2baa
cmp dword [ebx + 0xf0], 0
je 0x4e2b9b
push 0
push 0x41
push ebx
push str.UDPWRITE
call fcn.004e0781
jmp 0x4e2baa
push 0
push 0x3c
push ebx
push str.SOCKWRITE
call fcn.004e0781
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4e5fba
Capabilities:
Hide graphical window
Read .ini file

Disassembly:
push ebx
call fcn.004e5f34
test eax, eax
je 0x4e60b2
push 0
push dword [0x53741c]
push 0
push dword [0x537420]
push 0
push 0
push 0
push 0
push 0x42000000
push 0x536484
push str.mIRCSB32
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
mov dword [0x536438], ebx
test ebx, ebx
je 0x4e60b2
mov dword [0x5362f8], ebx
push 0x52ffb0
push 0x3e7
push 0x562228
push 0x53649f
push str.switchbar
push 0x536488
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x562228], 0
jne 0x4e6069
push 0x52feac
push str._ssblogo.bmp
push 0x562228
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push 0x562228
call fcn.0051b794
add esp, 8
test eax, eax
je 0x4e6069
mov byte [0x562228], 0
cmp byte [0x562228], 0
je 0x4e608d
push 0x562228
call fcn.00416498
push 0
push 0x562228
push 0x5362f8
call fcn.00418347
cmp dword [0x536414], 0
je 0x4e60a5
push 5
push dword [0x536438]
call sub.USER32.dll_ShowWindow
pop ebx
ret
push 0
push dword [0x536438]
call sub.USER32.dll_ShowWindow
pop ebx
ret
Function at 0x4e7ba8
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x537424
push esi
call fcn.004f7e1e
test eax, eax
jne 0x4e7c05
push 6
push esi
call sub.USER32.dll_ShowWindow
cmp dword [0x537478], 0
je 0x4e7be5
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jl 0x4e7be5
push 0
push esi
call sub.USER32.dll_ShowWindow
cmp esi, dword [0x53742c]
jne 0x4e7bf4
xor eax, eax
mov dword [0x53742c], eax
push esi
call fcn.004f9c59
push eax
call fcn.004e6fbd
jmp 0x4e7d52
cmp dword [ebp + 0xc], 0
je 0x4e7cf4
push 5
push dword [edi]
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x4e7c69
push ebx
call fcn.004f7e1e
test eax, eax
je 0x4e7c5b
push ebx
call sub.USER32.dll_IsIconic
test eax, eax
je 0x4e7c5b
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x4e7c5b
push ebx
call fcn.004e6c6a
test eax, eax
je 0x4e7c5b
push 0
push ebx
call sub.USER32.dll_ShowWindow
push 5
push dword [edi]
call sub.USER32.dll_GetWindow
mov ebx, eax
jmp 0x4e7c1a
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x4e7c1e
push 5
push dword [edi]
call sub.USER32.dll_GetWindow
mov ebx, eax
cmp esi, ebx
jne 0x4e7cf4
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x4e7c9e
push ebx
call sub.USER32.dll_IsWindowVisible
test eax, eax
jne 0x4e7c9e
push 2
push ebx
call sub.USER32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x4e7c86
test ebx, ebx
je 0x4e7cc8
cmp esi, ebx
je 0x4e7cc8
push 5
push ebx
call sub.USER32.dll_ShowWindow
push ebx
call sub.USER32.dll_UpdateWindow
push ebx
call sub.USER32.dll_BringWindowToTop
push ebx
call fcn.004f9c59
push eax
call fcn.004e6fbd
jmp 0x4e7cf4
push dword [0x537430]
call fcn.004f7e1e
test eax, eax
je 0x4e7cf4
push dword [0x537430]
call sub.USER32.dll_SetFocus
mov ebx, dword [0x537430]
push ebx
call fcn.004f9c59
push eax
call fcn.004e6fbd
push 0
push esi
call sub.USER32.dll_ShowWindow
push dword [edi]
call sub.USER32.dll_UpdateWindow
push esi
call sub.USER32.dll_UpdateWindow
push 0
push 0
push 0xb
push dword [edi]
call sub.USER32.dll_SendMessageA
push 7
push esi
call sub.USER32.dll_ShowWindow
push 0
push esi
call sub.USER32.dll_ShowWindow
push 0
push 1
push 0xb
push dword [edi]
call sub.USER32.dll_SendMessageA
push dword [edi]
call sub.USER32.dll_UpdateWindow
push esi
call sub.USER32.dll_UpdateWindow
push esi
call fcn.004e7a87
push esi
call fcn.004f9c59
push eax
call fcn.004e6fbd
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4e8392
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, 0x562634
mov esi, 0x56262c
test edi, edi
je 0x4e8409
mov eax, dword [0x536514]
mov dword [ebx], eax
jmp 0x4e83fc
push edi
push dword [eax]
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4e83f5
mov eax, dword [ebx]
cmp dword [eax + 0x18], 0
je 0x4e83d9
cmp dword [eax + 0x30], 0
je 0x4e83d9
mov edx, dword [eax + 0x30]
mov dword [edx + 0x18], 1
push dword [ebx]
push dword [0x536514]
call fcn.0049dd87
mov dword [0x536514], eax
mov eax, 1
jmp 0x4e859e
mov edx, dword [ebx]
mov ecx, dword [edx + 0x30]
mov dword [ebx], ecx
mov eax, dword [ebx]
test eax, eax
jne 0x4e83b2
xor eax, eax
jmp 0x4e859e
push dword [ebp + 8]
call fcn.004f9c59
mov edi, eax
mov dword [0x562628], edi
test edi, edi
jne 0x4e8424
xor eax, eax
jmp 0x4e859e
mov edx, dword [edi + 0x744]
mov dword [0x562638], edx
mov edi, dword [0x562638]
test edi, edi
je 0x4e8443
call sub.USER32.dll_GetFocus
cmp edi, eax
je 0x4e844a
xor eax, eax
jmp 0x4e859e
push 0
push 0
push 0xe
push dword [0x562638]
call sub.USER32.dll_SendMessageA
mov dword [0x56263c], eax
cmp dword [0x56263c], 0
jle 0x4e8483
cmp dword [0x536518], 0
jne 0x4e8483
push 0
call fcn.00415bea
mov eax, 1
jmp 0x4e859e
push 0x555aeb
push 0x3e6
push 0xd
push dword [0x562638]
call sub.USER32.dll_SendMessageA
mov edi, eax
mov dword [0x56263c], edi
test edi, edi
jg 0x4e84b0
mov eax, 1
jmp 0x4e859e
mov edx, dword [0x56263c]
mov byte [edx + 0x555aeb], 0
mov dword [esi], 0x555aeb
jmp 0x4e84c7
inc dword [esi]
mov ecx, dword [esi]
cmp byte [ecx], 0x20
je 0x4e84c5
mov eax, dword [esi]
cmp byte [eax], 0
jne 0x4e84df
mov eax, 1
jmp 0x4e859e
push 5
push 0x53658c
push eax
call fcn.00518638
add esp, 0xc
test eax, eax
je 0x4e84fd
mov eax, 1
jmp 0x4e859e
add dword [esi], 5
jmp 0x4e8504
inc dword [esi]
mov edx, dword [esi]
cmp byte [edx], 0x20
je 0x4e8502
mov ecx, dword [esi]
cmp byte [ecx], 0
jne 0x4e851c
mov eax, 1
jmp 0x4e859e
push 0x20
push dword [esi]
call fcn.0051833c
add esp, 8
mov edi, eax
mov dword [0x562630], edi
test edi, edi
je 0x4e8537
mov byte [edi], 0
mov eax, dword [0x536514]
mov dword [ebx], eax
jmp 0x4e858c
push dword [esi]
push dword [eax]
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x4e8585
push dword [ebx]
push dword [0x536514]
call fcn.0049dd87
mov dword [0x536514], eax
xor edx, edx
mov dword [0x536518], edx
push 0x536593
push 0
push 0xc
push dword [0x562638]
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x4e859e
mov edx, dword [ebx]
mov ecx, dword [edx + 0x30]
mov dword [ebx], ecx
mov eax, dword [ebx]
test eax, eax
jne 0x4e8540
push 0
call fcn.00415bea
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4ec6e3
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, 0x536700
mov ebx, 0x25
xor edx, edx
mov eax, 0x563210
cmp ebx, edx
jle 0x4ec785
mov dword [eax], edx
lea ecx, [edx + 0xc9]
mov dword [eax + 4], ecx
mov byte [eax + 8], 4
mov byte [eax + 9], 0
mov ecx, edx
cmp ecx, 0x22
ja case.0x4ec720.0
mov cl, byte [ecx + 0x4ec727]
jmp dword [ecx*4 + 0x4ec74a]
mov byte [eax + 8], 8
jmp case.0x4ec720.0
cmp dword [0x536414], 0
je case.0x4ec720.0
mov byte [eax + 8], 8
jmp case.0x4ec720.0
mov dword [eax], 0xffffffff
mov byte [eax + 9], 1
inc edx
add eax, 0xc
cmp ebx, edx
jg 0x4ec700
push 0
call fcn.004edb08
call fcn.004ec56e
test eax, eax
je 0x4ec82c
push 0
push dword [0x53741c]
push 0xc8
push dword [0x537420]
push 0
push 0
push 0
push 0
push 0x42000000
push 0x5369a4
push str.mIRCTB32
push 0
call sub.USER32.dll_CreateWindowExA
mov esi, eax
mov dword [ebp], esi
test esi, esi
je 0x4ec82c
mov dword [0x53673c], esi
mov dword [0x536854], esi
movzx eax, word [0x53741c]
or eax, 0x1c0000
push eax
mov edi, ebx
push edi
push 0x413
push esi
call sub.USER32.dll_SendMessageA
push 0x563210
push edi
push 0x414
push dword [ebp]
call sub.USER32.dll_SendMessageA
cmp dword [0x5366fc], 0
je 0x4ec822
push 5
push dword [ebp]
call sub.USER32.dll_ShowWindow
jmp 0x4ec82c
push 0
push dword [ebp]
call sub.USER32.dll_ShowWindow
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ec922
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp eax, 0x1c
jne 0x4ec947
mov edx, dword [0x536858]
test edx, edx
je 0x4ec947
mov eax, edx
jmp 0x4eca2f
push 2
movzx ecx, ax
push ecx
push ebx
call sub.KERNEL32.dll_FindResourceA
test eax, eax
jne 0x4ec95e
xor eax, eax
jmp 0x4eca2f
push eax
push ebx
call sub.KERNEL32.dll_LoadResource
mov edi, eax
push edi
call sub.KERNEL32.dll_LockResource
mov ebx, eax
test ebx, ebx
jne 0x4ec97a
xor eax, eax
jmp 0x4eca2f
lea edx, [ebx + 0x28]
mov dword [ebp - 0x1c], edx
mov cx, word [ebx + 0xe]
mov eax, 1
shl eax, cl
shl eax, 2
add dword [ebp - 0x1c], eax
mov edx, dword [ebx + 4]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebx + 8]
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
push 0
call sub.USER32.dll_GetDC
mov esi, eax
test esi, esi
je 0x4eca26
push esi
call sub.GDI32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4eca1e
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push esi
call sub.GDI32.dll_CreateCompatibleBitmap
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4eca16
push dword [ebp - 4]
push dword [ebp - 0xc]
call sub.GDI32.dll_SelectObject
mov dword [ebp - 8], eax
push 0xcc0020
push 0
push ebx
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push 0
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push 0
push 0
push dword [ebp - 0xc]
call sub.GDI32.dll_StretchDIBits
push dword [ebp - 8]
push dword [ebp - 0xc]
call sub.GDI32.dll_SelectObject
push dword [ebp - 0xc]
call sub.GDI32.dll_DeleteDC
push esi
push 0
call sub.USER32.dll_ReleaseDC
push edi
call sub.KERNEL32.dll_FreeResource
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8