joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ea258
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [eax + 1], 0
jne 0x4ea33e
mov dl, byte [eax]
cmp dl, 0x2a
jne 0x4ea27f
mov eax, 1
jmp 0x4ea4c2
cmp dl, 0x40
jne 0x4ea29a
cmp byte [esi], 0x40
jne 0x4ea293
mov eax, 1
jmp 0x4ea4c2
xor eax, eax
jmp 0x4ea4c2
cmp dl, 0x23
jne 0x4ea2ba
push esi
call fcn.004df174
test al, al
je 0x4ea2b3
mov eax, 1
jmp 0x4ea4c2
xor eax, eax
jmp 0x4ea4c2
cmp byte [eax], 0x3f
jne 0x4ea2e6
cmp byte [esi], 0x40
jne 0x4ea2cb
xor eax, eax
jmp 0x4ea4c2
push esi
call fcn.004df174
test al, al
jne 0x4ea2df
mov eax, 1
jmp 0x4ea4c2
xor eax, eax
jmp 0x4ea4c2
cmp byte [eax], 0x3d
jne 0x4ea312
cmp byte [esi], 0x40
jne 0x4ea2f7
xor eax, eax
jmp 0x4ea4c2
push esi
call fcn.004df174
test al, al
jne 0x4ea30b
mov eax, 1
jmp 0x4ea4c2
xor eax, eax
jmp 0x4ea4c2
cmp byte [eax], 0x21
jne 0x4ea33e
cmp byte [esi], 0x40
jne 0x4ea323
xor eax, eax
jmp 0x4ea4c2
push esi
call fcn.004df174
test al, al
jne 0x4ea337
mov eax, 1
jmp 0x4ea4c2
xor eax, eax
jmp 0x4ea4c2
mov ebx, eax
cmp byte [ebx], 0x24
jne 0x4ea36e
cmp byte [ebx + 1], 0x28
jne 0x4ea36e
push dword [ebp + 0x10]
push 0x582774
push ebx
call fcn.004ea18c
test eax, eax
je 0x4ea367
mov ebx, 0x582774
jmp 0x4ea4b7
xor eax, eax
jmp 0x4ea4c2
cmp byte [ebx], 0x25
jne 0x4ea4b7
push 0x2c
push ebx
call fcn.00539518
add esp, 8
test eax, eax
jne 0x4ea4b7
push 0
push 0x582774
push ebx
call fcn.00511dfc
test eax, eax
je 0x4ea3a5
mov ebx, 0x582774
jmp 0x4ea4b7
xor eax, eax
jmp 0x4ea4c2
inc ebx
cmp byte [ebx], 0x20
je 0x4ea3ae
cmp byte [ebx], 0
jne 0x4ea3c0
xor eax, eax
jmp 0x4ea4c2
push 0x2c
push ebx
call fcn.00539518
add esp, 8
mov edi, eax
test edi, edi
je 0x4ea3d4
mov byte [edi], 0
push 0x20
push ebx
call fcn.00539518
add esp, 8
test eax, eax
je 0x4ea3e6
mov byte [eax], 0
cmp byte [ebx], 0x24
jne 0x4ea40e
cmp byte [ebx + 1], 0x28
jne 0x4ea40e
push dword [ebp + 0x10]
push 0x58238d
push ebx
call fcn.004ea18c
test eax, eax
je 0x4ea40a
mov ebx, 0x58238d
jmp 0x4ea42d
xor ebx, ebx
jmp 0x4ea42d
cmp byte [ebx], 0x25
jne 0x4ea42d
push 0
push 0x58238d
push ebx
call fcn.00511dfc
test eax, eax
je 0x4ea42b
mov ebx, 0x58238d
jmp 0x4ea42d
xor ebx, ebx
test ebx, ebx
je 0x4ea4b0
cmp byte [ebx], 0
je 0x4ea4b0
cmp byte [ebx + 1], 0
jne 0x4ea49b
cmp byte [ebx], 0x2a
jne 0x4ea448
mov eax, 1
jmp 0x4ea4c2
cmp byte [ebx], 0x23
jne 0x4ea45e
push esi
call fcn.004df174
test al, al
je 0x4ea45e
mov eax, 1
jmp 0x4ea4c2
cmp byte [ebx], 0x3f
jne 0x4ea474
push esi
call fcn.004df174
test al, al
jne 0x4ea474
mov eax, 1
jmp 0x4ea4c2
cmp byte [ebx], 0x3d
jne 0x4ea48a
push esi
call fcn.004df174
test al, al
jne 0x4ea48a
mov eax, 1
jmp 0x4ea4c2
cmp byte [ebx], 0x40
jne 0x4ea49b
cmp byte [esi], 0x40
jne 0x4ea49b
mov eax, 1
jmp 0x4ea4c2
push ebx
push esi
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x4ea4b0
mov eax, 1
jmp 0x4ea4c2
test edi, edi
je 0x4ea4c0
lea ebx, [edi + 1]
cmp byte [ebx], 0
jne 0x4ea3af
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4f3205
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, 0x5595ec
push 1
push dword [ebx]
call sub.USER32.dll_ShowWindow
push 3
push 0
push 0
push 0
push 0
push 0
push dword [ebx]
call sub.USER32.dll_SetWindowPos
push dword [ebx]
call sub.USER32.dll_SetActiveWindow
push dword [ebx]
call sub.USER32.dll_UpdateWindow
push dword [ebp + 8]
push 0x68
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call fcn.00504ba8
push 0x12c
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SetFocus
pop ebx
pop ebp
ret 4

Function at 0x4f3292
Capabilities:
Open clipboard
Read clipboard data
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
mov dword [0x5841a0], eax
cmp dword [0x556164], 0
je 0x4f340d
cmp dword [0x556188], 0
je 0x4f340d
push dword [0x55b3c8]
call sub.USER32.dll_OpenClipboard
test eax, eax
je 0x4f340d
push 1
call sub.USER32.dll_GetClipboardData
mov ebx, eax
mov dword [0x5841a8], ebx
test ebx, ebx
je 0x4f340d
push ebx
call sub.KERNEL32.dll_GlobalLock
mov esi, eax
mov dword [0x5841a4], esi
test esi, esi
jne 0x4f3305
push dword [0x5841a8]
call sub.KERNEL32.dll_GlobalUnlock
jmp 0x4f340d
push dword [0x5841a4]
call fcn.005395b8
pop ecx
add eax, 0xa
push eax
call fcn.00545a4c
pop ecx
mov ebx, eax
mov dword [0x5841a0], ebx
test ebx, ebx
jne 0x4f3337
push dword [0x5841a8]
call sub.KERNEL32.dll_GlobalUnlock
jmp 0x4f340d
mov eax, dword [0x5841a0]
mov edx, dword [0x5841a4]
mov esi, eax
mov edi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [0x5841a8]
call sub.KERNEL32.dll_GlobalUnlock
push dword [0x5841a0]
call fcn.005395b8
pop ecx
add eax, 5
push eax
push 0x2042
call sub.KERNEL32.dll_GlobalAlloc
mov ebx, eax
mov dword [0x5841a8], ebx
test ebx, ebx
je 0x4f340d
push ebx
call sub.KERNEL32.dll_GlobalLock
mov dword [0x5841a4], eax
cmp dword [0x5841a4], 0
je 0x4f33b1
call sub.USER32.dll_EmptyClipboard
test eax, eax
jne 0x4f33c9
push dword [0x5841a8]
call sub.KERNEL32.dll_GlobalUnlock
push dword [0x5841a8]
call sub.KERNEL32.dll_GlobalFree
jmp 0x4f340d
mov eax, dword [0x5841a4]
mov edx, dword [0x5841a0]
mov esi, eax
mov edi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [0x5841a8]
push 1
call sub.USER32.dll_SetClipboardData
push dword [0x5841a8]
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.dll_CloseClipboard
mov eax, dword [0x5841a0]
test eax, eax
je 0x4f3422
push eax
call fcn.00545938
pop ecx
push 0
push 0
push 0x302
push 0x12c
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4f4a88
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
cmp dword [0x54f350], 0
jne 0x4f4aa8
mov eax, dword [esi + 0x348]
jmp 0x4f4bf5
xor ecx, ecx
mov eax, dword [0x559644]
test eax, eax
je 0x4f4ace
mov edx, dword [eax + 0x33c]
cmp edx, 1
je 0x4f4ac3
cmp edx, 2
jne 0x4f4ac4
inc ecx
mov eax, dword [eax + 0x3b4]
test eax, eax
jne 0x4f4ab3
test ecx, ecx
jg 0x4f4ad7
mov ecx, 1
mov eax, dword [0x54f350]
cdq
idiv ecx
mov ebx, eax
cmp ebx, 0x200
jae 0x4f4aee
mov ebx, pe_nt_image_headers32
cmp dword [esi + 0x3ac], 0
jg 0x4f4b07
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0x3ac], eax
jmp 0x4f4be1
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [esi + 0x3ac]
cmp eax, 0x64
ja 0x4f4b1e
xor eax, eax
jmp 0x4f4bf5
cmp eax, 0x3e8
jae 0x4f4b4f
mov dword [ebp - 0xc], eax
xor edx, edx
mov dword [ebp - 8], edx
fild qword [ebp - 0xc]
fdivr dword [0x4f4c00]
mov ecx, dword [esi + 0x3a8]
mov dword [ebp - 0x14], ecx
xor eax, eax
mov dword [ebp - 0x10], eax
fild qword [ebp - 0x14]
fmulp st(1)
fstp dword [ebp - 4]
wait
jmp 0x4f4b79
mov edx, dword [esi + 0x3a8]
mov dword [ebp - 0xc], edx
xor ecx, ecx
mov dword [ebp - 8], ecx
fild qword [ebp - 0xc]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
fild qword [ebp - 0x14]
fld xword [0x4f4c04]
fmulp st(1)
fdivp st(1)
fstp dword [ebp - 4]
wait
xor edi, edi
fld dword [ebp - 4]
call fcn.00542680
cmp ebx, eax
ja 0x4f4ba8
fld dword [ebp - 4]
call fcn.00542680
mov ecx, eax
sub ecx, ebx
mov eax, ebx
push ecx
mov ecx, 0xb
xor edx, edx
div ecx
pop ecx
cmp ecx, eax
jb 0x4f4bca
xor eax, eax
jmp 0x4f4bf5
fld dword [ebp - 4]
call fcn.00542680
mov ecx, ebx
sub ecx, eax
mov eax, ebx
push ecx
mov ecx, 0xb
xor edx, edx
div ecx
pop ecx
cmp ecx, eax
jb 0x4f4bca
mov edi, 1
test edi, edi
jne 0x4f4be1
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0x3ac], eax
xor eax, eax
mov dword [esi + 0x3a8], eax
mov eax, dword [esi + 0x348]
cmp ebx, eax
jbe 0x4f4bed
mov ebx, eax
test ebx, ebx
ja 0x4f4bf3
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4f5768
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x33c], 1
push 0
call fcn.00548d28
pop ecx
mov dword [ebx + 0x394], eax
lea eax, [ebx + 0xcc]
push eax
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4f57fe
cmp dword [0x5515fc], 0
je 0x4f57bb
cmp dword [0x5515f8], 0
je 0x4f57bb
cmp dword [0x5515f4], 0
jne 0x4f57fe
cmp dword [ebx + 0x374], 0
je 0x4f57e4
push 8
push 0
lea edx, [ebx + 0xcc]
push edx
lea ecx, [ebx + 4]
push ecx
push dword [ebx]
call fcn.0045f440
mov eax, 1
jmp 0x4f5966
push ebx
push 0
push 0x138d
call fcn.0041c35b
push eax
call fcn.004f4d9e
xor eax, eax
jmp 0x4f5966
cmp dword [0x5515fc], 0
je 0x4f5865
cmp dword [0x5515f8], 0
je 0x4f5865
push 0
push 0x138e
call fcn.0041c35b
push eax
push 1
push 0
push 1
push 1
push ebx
call fcn.0050bb88
cmp dword [ebx + 0x340], 0
jne 0x4f583f
call fcn.004f493d
mov dword [ebx + 0x340], eax
push dword [ebx + 0x340]
push 0
mov dx, word [ebx + 0x350]
push edx
add ebx, 0xcc
push ebx
call fcn.00475cf6
mov eax, 1
jmp 0x4f5966
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov word [ebp - 0x12], 4
mov word [ebp - 0x14], 2
lea esi, [ebp - 0x1c]
push 0x10
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.00539438
add esp, 0xc
mov word [ebp - 0x2c], 2
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
push dword [ecx]
lea eax, [ebp - 0x28]
push eax
call fcn.005393c8
add esp, 0xc
mov dx, word [ebx + 0x350]
push edx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x2a], ax
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax]
mov dword [ebp - 0x28], edx
push 0
push 2
push 0
mov cx, word [0x54f356]
push ecx
mov ax, word [0x54f354]
push eax
call fcn.004e3612
mov esi, eax
mov dword [ebx + 0x3b0], esi
cmp esi, 0xffffffff
jne 0x4f5909
push ebx
push 0
push 0x138f
call fcn.0041c35b
push eax
call fcn.004f4d9e
xor eax, eax
jmp 0x4f5966
push dword [ebx + 0x3b0]
call fcn.0051b512
push 0x10
push 0x414
push dword [0x55b3c8]
push dword [ebx + 0x3b0]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x2c]
push edx
push dword [ebx + 0x3b0]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x4f5964
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4f5964
push ebx
push 0
push 0x1390
call fcn.0041c35b
push eax
call fcn.004f4d9e
xor eax, eax
jmp 0x4f5966
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4f65aa
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4f65bf
xor eax, eax
jmp 0x4f67e2
cmp dword [ebx + 0x33c], 2
je 0x4f65cf
xor eax, eax
jmp 0x4f67e2
cmp dword [0x55965c], 0
jne 0x4f65f6
cmp dword [0x559650], 0
jne 0x4f65f6
mov edx, dword [ebx + 0x34c]
cmp edx, dword [ebx + 0x354]
jae 0x4f65f6
xor eax, eax
jmp 0x4f67e2
push 0
call fcn.00548d28
pop ecx
mov dword [ebx + 0x394], eax
mov esi, dword [ebx + 0x348]
cmp dword [ebx + 0x3a4], 0
je 0x4f6660
push ebx
call fcn.004f4a88
mov esi, eax
test esi, esi
jne 0x4f6660
mov dword [ebx + 0x378], 1
cmp dword [0x55964c], 0
jne 0x4f664b
push 0
push 0x32
push 0x80
push dword [0x55b3c8]
call sub.USER32.dll_SetTimer
mov dword [0x55964c], eax
cmp dword [0x55964c], 0
je 0x4f665b
xor eax, eax
jmp 0x4f67e2
mov esi, pe_nt_image_headers32
push dword [ebx + 0x338]
call fcn.0053ec20
pop ecx
mov dword [ebp - 4], eax
push esi
push 0x5856a7
push dword [ebx + 0x338]
call fcn.0053d998
add esp, 0xc
mov esi, eax
test esi, esi
jge 0x4f66a3
push ebx
push 0
push 0x1397
call fcn.0041c35b
push eax
call fcn.004f4d9e
xor eax, eax
jmp 0x4f67e2
test esi, esi
jne 0x4f66ae
xor eax, eax
jmp 0x4f67e2
push 0
push esi
push 0x5856a7
push dword [ebx + 0x3b0]
call sub.WSOCK32.dll_send
mov edi, eax
cmp edi, 0xffffffff
jne 0x4f6708
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4f66ee
push 0
push dword [ebp - 4]
push dword [ebx + 0x338]
call fcn.0053d8f4
add esp, 0xc
xor eax, eax
jmp 0x4f67e2
push ebx
push 0
push 0x139a
call fcn.0041c35b
push eax
call fcn.004f4d9e
xor eax, eax
jmp 0x4f67e2
cmp esi, edi
jle 0x4f6724
push 0
mov edx, dword [ebp - 4]
add edx, edi
push edx
push dword [ebx + 0x338]
call fcn.0053d8f4
add esp, 0xc
mov esi, edi
mov eax, esi
add dword [ebx + 0x354], eax
add dword [ebx + 0x3a8], eax
push ebx
call fcn.004f6362
mov edx, dword [ebx + 0x354]
sub edx, dword [ebx + 0x34c]
mov ecx, dword [ebx + 0x348]
add ecx, ecx
lea ecx, [ecx + ecx*4]
cmp edx, ecx
setb al
and eax, 1
cmp dword [0x55965c], 0
jne 0x4f676d
cmp dword [0x559650], 0
je 0x4f67e0
test eax, eax
je 0x4f67e0
call sub.USER32.dll_GetCapture
test eax, eax
jne 0x4f678c
push 0
push 0
push 0
push 0
push 0x5850a4
call sub.USER32.dll_PeekMessageA
test eax, eax
je 0x4f67c5
mov dword [ebx + 0x378], 1
cmp dword [0x55964c], 0
jne 0x4f67b8
push 0
push 0x32
push 0x80
push dword [0x55b3c8]
call sub.USER32.dll_SetTimer
mov dword [0x55964c], eax
cmp dword [0x55964c], 0
je 0x4f67c5
xor eax, eax
jmp 0x4f67e2
cmp dword [0x55964c], 0
je 0x4f65b4
mov dword [ebx + 0x378], 1
xor eax, eax
jmp 0x4f67e2
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x4f67ea
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4f67fd
xor eax, eax
jmp 0x4f698e
cmp dword [ebx + 0x33c], 2
je 0x4f680d
xor eax, eax
jmp 0x4f698e
push 0
call fcn.00548d28
pop ecx
mov dword [ebx + 0x394], eax
push 0
push 4
lea edx, [ebp - 4]
push edx
push dword [ebx + 0x3b0]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x4f6860
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4f6846
xor eax, eax
jmp 0x4f698e
push ebx
push 0
push 0x139a
call fcn.0041c35b
push eax
call fcn.004f4d9e
xor eax, eax
jmp 0x4f698e
test eax, eax
jg 0x4f6873
push 0
push ebx
call fcn.004f6a19
xor eax, eax
jmp 0x4f698e
push dword [ebp - 4]
call sub.WSOCK32.dll_ntohl
cmp eax, dword [ebx + 0x34c]
ja 0x4f6892
push 0
push ebx
call fcn.004f6a19
xor eax, eax
jmp 0x4f698e
mov edx, eax
mov dword [ebx + 0x34c], edx
mov eax, dword [ebx + 0x360]
cmp edx, eax
jb 0x4f68b9
mov dword [ebx + 0x34c], eax
push 0
push ebx
call fcn.004f6a19
xor eax, eax
jmp 0x4f698e
push ebx
call fcn.004f6362
mov eax, dword [ebx + 0x354]
cmp eax, dword [ebx + 0x360]
jae 0x4f698c
sub eax, dword [ebx + 0x34c]
mov edx, dword [ebx + 0x348]
add edx, edx
lea edx, [edx + edx*4]
cmp eax, edx
setb cl
and ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebx + 0x34c]
cmp eax, dword [ebx + 0x354]
jae 0x4f690e
cmp dword [0x559650], 0
je 0x4f698c
cmp dword [ebp - 4], 0
je 0x4f698c
call sub.USER32.dll_GetCapture
test eax, eax
jne 0x4f692d
push 0
push 0
push 0
push 0
push 0x5850c0
call sub.USER32.dll_PeekMessageA
test eax, eax
je 0x4f6966
mov dword [ebx + 0x378], 1
cmp dword [0x55964c], 0
jne 0x4f6959
push 0
push 0x32
push 0x80
push dword [0x55b3c8]
call sub.USER32.dll_SetTimer
mov dword [0x55964c], eax
cmp dword [0x55964c], 0
je 0x4f6966
xor eax, eax
jmp 0x4f698e
cmp dword [0x55964c], 0
je 0x4f6982
mov dword [ebx + 0x378], 1
call fcn.004f653e
xor eax, eax
jmp 0x4f698e
push ebx
call fcn.004f65aa
xor eax, eax
jmp 0x4f698e
xor eax, eax
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x4f9247
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
cmp dword [0x559980], 0
je 0x4f9262
push eax
call sub.USER32.dll_GetParent
mov ebx, eax
jmp 0x4f9264
mov ebx, eax
push 0x461
push ebx
call sub.USER32.dll_GetDlgItem
mov esi, eax
call sub.USER32.dll_GetFocus
cmp esi, eax
jne 0x4f927e
xor eax, eax
jmp 0x4f92f8
push 0x569f83
push 0x3e7
push 0xd
push 0x480
push ebx
call sub.USER32.dll_SendDlgItemMessageA
cmp byte [0x569f83], 0
je 0x4f92c4
push 0x2a
push 0x569f83
call fcn.00539518
add esp, 8
test eax, eax
jne 0x4f92c4
push 0x3f
push 0x569f83
call fcn.00539518
add esp, 8
test eax, eax
je 0x4f92c8
xor eax, eax
jmp 0x4f92f8
push 0x12
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4f92f6
mov eax, dword [0x588243]
test eax, eax
je 0x4f92f6
cmp byte [eax], 0
je 0x4f92f6
push 0
push 0x57c4a0
push eax
call fcn.004fda12
mov eax, 1
jmp 0x4f92f8
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4fad3c
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x65]
push eax
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4fad63
mov eax, 3
jmp 0x4fae3f
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov word [ebp - 0x12], 4
mov word [ebp - 0x14], 2
lea esi, [ebp - 0x1c]
push 0x10
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.00539438
add esp, 0xc
mov word [ebp - 0x2c], 2
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
push dword [ecx]
lea eax, [ebp - 0x28]
push eax
call fcn.005393c8
add esp, 0xc
mov dx, word [ebx + 0xca]
push edx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x2a], ax
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax]
mov dword [ebp - 0x28], edx
push 0
push 2
push 0
mov cx, word [0x54f356]
push ecx
mov ax, word [0x54f354]
push eax
call fcn.004e3612
mov esi, eax
mov dword [ebx + 0x120], esi
cmp esi, 0xffffffff
jne 0x4fadf7
mov eax, 1
jmp 0x4fae3f
push esi
call fcn.0051b512
push 0x10
push 0x439
push dword [0x55b3c8]
push dword [ebx + 0x120]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x2c]
push edx
push dword [ebx + 0x120]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x4fae3d
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4fae3d
mov eax, 2
jmp 0x4fae3f
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4fbe88
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov esi, dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004f9c26
mov ebx, eax
test ebx, ebx
je 0x4fc11d
cmp dword [ebx + 0xe4], 2
jne 0x4fc11d
mov eax, esi
shr eax, 0x10
and ax, 0xffff
test ax, ax
je 0x4fbf14
movzx edx, ax
mov dword [ebx + 0x11c], edx
cmp dword [0x558a48], 0
je 0x4fbefb
cmp dword [ebx + 0xf0], 0
je 0x4fbeec
push 3
push 0x42
push ebx
push 0x559d5c
call fcn.004f9ce3
jmp 0x4fbefb
push 3
push 0x3d
push ebx
push 0x559d66
call fcn.004f9ce3
push ebx
call fcn.004f9bb3
test eax, eax
je 0x4fc11d
push ebx
call fcn.004f9ad5
jmp 0x4fc11d
cmp dword [ebx + 0xdc], 0
je 0x4fc11d
cmp dword [ebx + 0xf0], 0
je 0x4fbfba
lea eax, [ebp - 8]
mov dword [ebp - 0xc], eax
lea edx, [ebx + 0xf8]
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov word [ebp - 0xe], 4
mov word [ebp - 0x10], 2
lea esi, [ebp - 0x18]
push 0x10
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.00539438
add esp, 0xc
mov word [ebp - 0x28], 2
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
push dword [ecx]
lea eax, [ebp - 0x24]
push eax
call fcn.005393c8
add esp, 0xc
mov dx, word [ebx + 0xfc]
push edx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x26], ax
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax]
mov dword [ebp - 0x24], edx
push 0x10
lea ecx, [ebp - 0x28]
push ecx
push 0
push dword [ebx + 0xe0]
push dword [ebx + 0xdc]
push dword [ebx + 0x120]
call sub.WSOCK32.dll_sendto
mov esi, eax
jmp 0x4fbfd5
push 0
push dword [ebx + 0xe0]
push dword [ebx + 0xdc]
push dword [ebx + 0x120]
call sub.WSOCK32.dll_send
mov esi, eax
test esi, esi
jge 0x4fc053
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4fc002
push 0x23
push 0x438
push dword [0x55b3c8]
push dword [ebx + 0x120]
call sub.WSOCK32.dll_WSAAsyncSelect
jmp 0x4fc11d
mov dword [ebx + 0x11c], eax
cmp dword [0x558a48], 0
je 0x4fc03a
cmp dword [ebx + 0xf0], 0
je 0x4fc02b
push 3
push 0x42
push ebx
push 0x559d71
call fcn.004f9ce3
jmp 0x4fc03a
push 3
push 0x3d
push ebx
push 0x559d7b
call fcn.004f9ce3
push ebx
call fcn.004f9bb3
test eax, eax
je 0x4fc11d
push ebx
call fcn.004f9ad5
jmp 0x4fc11d
push 0
call fcn.00548d28
pop ecx
mov dword [ebx + 0x114], eax
test esi, esi
jle 0x4fc0b5
add dword [ebx + 0x108], esi
cmp esi, dword [ebx + 0xe0]
jge 0x4fc0b5
sub dword [ebx + 0xe0], esi
push dword [ebx + 0xe0]
mov eax, dword [ebx + 0xdc]
add esi, eax
push esi
push eax
call fcn.005393ec
add esp, 0xc
mov edx, dword [ebx + 0xe0]
add edx, 5
push edx
push dword [ebx + 0xdc]
call fcn.00545f18
add esp, 8
test eax, eax
je 0x4fc11d
mov dword [ebx + 0xdc], eax
jmp 0x4fc11d
push dword [ebx + 0xdc]
call fcn.00545938
pop ecx
xor ecx, ecx
mov dword [ebx + 0xdc], ecx
xor eax, eax
mov dword [ebx + 0xe0], eax
cmp dword [ebx + 0xf0], 0
je 0x4fc0eb
cmp dword [ebx + 0xf4], 0
jne 0x4fc0eb
push ebx
call fcn.004f9ad5
jmp 0x4fc11d
cmp dword [0x558a48], 0
je 0x4fc11d
cmp dword [ebx + 0xf0], 0
je 0x4fc10e
push 0
push 0x42
push ebx
push str.UDPWRITE
call fcn.004f9ce3
jmp 0x4fc11d
push 0
push 0x3d
push ebx
push str.SOCKWRITE
call fcn.004f9ce3
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ffc95
Capabilities:
Hide graphical window
Read .ini file

Disassembly:
push ebx
call fcn.004ffc0f
test eax, eax
je 0x4ffd8d
push 0
push dword [0x55b3c4]
push 0
push dword [0x55b3c8]
push 0
push 0
push 0
push 0
push 0x42000000
push 0x55a440
push str.mIRCSB32
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
mov dword [0x55a3ec], ebx
test ebx, ebx
je 0x4ffd8d
mov dword [0x55a2a4], ebx
push str.mirc.ini
push 0x3e7
push 0x5899e8
push 0x55a45b
push str.switchbar
push 0x55a444
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x5899e8], 0
jne 0x4ffd44
push 0x553318
push str._ssblogo.bmp
push 0x5899e8
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push 0x5899e8
call fcn.0053c978
add esp, 8
test eax, eax
je 0x4ffd44
mov byte [0x5899e8], 0
cmp byte [0x5899e8], 0
je 0x4ffd68
push 0x5899e8
call fcn.0041cb6c
push 0
push 0x5899e8
push 0x55a2a4
call fcn.0041fbe3
cmp dword [0x55a3c0], 0
je 0x4ffd80
push 5
push dword [0x55a3ec]
call sub.USER32.dll_ShowWindow
pop ebx
ret
push 0
push dword [0x55a3ec]
call sub.USER32.dll_ShowWindow
pop ebx
ret