A1 80 5A 58 00 3D FF 00 00 00 7F 24 FF 35 90 5A 58 00 FF 15 40 12 57 00 FF 35 9D 5A 58 00 50 FF
15 44 12 57 00 85 C0 74 27 A3 80 5A 58 00 90 90 87 EE FF D0 87 EE C3 90 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 8B C5 C3 90 90 90 90 90 90 90

0053C230     E8 CB970400       CALL mirc.00585A00


00585A18   68 9D5A5800         PUSH mirc.00585A9D                           ; ASCII "outgoing"



0012F107                 4E 4F 54 49 43 45 20 41 55 54 48       NOTICE AUTH
0012F117  20 3A 2A 2A 2A 20 4C 6F 6F 6B 69 6E 67 20 75 70   :*** Looking up
0012F127  20 79 6F 75 72 20 68 6F 73 74 6E 61 6D 65 0D 0A   your hostname..




0053C968     E8 63910400       CALL mirc.00585AD0
0053C96D     90                NOP
0053C96E     90                NOP
0053C96F     90                NOP
0053C970  |> 8A4404 14         MOV AL,[BYTE SS:ESP+EAX+14]



outgoing:
005859FF   90                  NOP
00585A00   A1 1B5B5800         MOV EAX,[DWORD DS:585B1B]
00585A05   3D FF000000         CMP EAX,0FF
00585A0A   7F 24               JG SHORT mirc.00585A30
00585A0C   68 905A5800         PUSH mirc.00585A90                           ; ASCII "FiSH.DLL"
00585A11   90                  NOP
00585A12   FF15 40125700       CALL [DWORD DS:<&KERNEL32.LoadLibraryA>]     ; KERNEL32.LoadLibraryA
00585A18   68 9D5A5800         PUSH mirc.00585A9D                           ; ASCII "outgoing"
00585A1D   90                  NOP
00585A1E   50                  PUSH EAX
00585A1F   FF15 44125700       CALL [DWORD DS:<&KERNEL32.GetProcAddress>]   ; KERNEL32.GetProcAddress
00585A25   85C0                TEST EAX,EAX
00585A27   74 27               JE SHORT mirc.00585A50
00585A29   A3 1B5B5800         MOV [DWORD DS:585B1B],EAX
00585A2E   90                  NOP
00585A2F   90                  NOP
00585A30   87EE                XCHG ESI,EBP
00585A32   FFD0                CALL EAX
00585A34   87EE                XCHG ESI,EBP
00585A36   C3                  RETN
00585A37   90                  NOP



incoming:
00585ACF   90                  NOP
00585AD0   A1 175B5800         MOV EAX,[DWORD DS:585B17]
00585AD5   3D FF000000         CMP EAX,0FF
00585ADA   7F 23               JG SHORT mirc.00585AFF
00585ADC   68 905A5800         PUSH mirc.00585A90                           ; ASCII "FiSH.DLL"
00585AE1   FF15 40125700       CALL [DWORD DS:<&KERNEL32.LoadLibraryA>]     ; KERNEL32.LoadLibraryA
00585AE7   68 A65A5800         PUSH mirc.00585AA6                           ; ASCII "incoming"
00585AEC   50                  PUSH EAX
00585AED   FF15 44125700       CALL [DWORD DS:<&KERNEL32.GetProcAddress>]   ; KERNEL32.GetProcAddress
00585AF3   85C0                TEST EAX,EAX
00585AF5   74 14               JE SHORT mirc.00585B0B
00585AF7   A3 175B5800         MOV [DWORD DS:585B17],EAX
00585AFC   90                  NOP
00585AFD   90                  NOP
00585AFE   90                  NOP
00585AFF   8D4C24 18           LEA ECX,[DWORD SS:ESP+18]
00585B03   87F5                XCHG EBP,ESI
00585B05   FFD0                CALL EAX
00585B07   87F5                XCHG EBP,ESI
00585B09   33C0                XOR EAX,EAX
00585B0B   C3                  RETN
00585B0C   90                  NOP





0053C935 53                                push    ebx
0053C936 68 E6 03 00 00                    push    3E6h
0053C93B 8D 44 24 1C                       lea     eax, [esp+404h+var_3E8]
0053C93F 50                                push    eax
0053C940 51                                push    ecx
0053C941 FF 15 08 17 57 00                 call    ds:WSOCK32_16   ; recv
