joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463d00
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push edi
mov edi, dword [esp + 0xc]
push edi
push 1
lea eax, [esp + 0x14]
push 2
push eax
call ebx
add esp, 0x10
test eax, eax
jne 0x463d22
pop edi
pop ebx
ret
lea ecx, [esp + 0xc]
push ecx
call fcn.00463d90
mov ax, word [esp + 0x10]
add esp, 4
cmp ax, 0xfa
jle 0x463d3f
pop edi
xor eax, eax
pop ebx
ret
movsx edx, ax
inc edx
push esi
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x463d83
movsx eax, word [esp + 0x10]
push edi
push 1
push eax
push esi
call ebx
add esp, 0x10
cmp eax, 1
jne 0x463d77
movsx ecx, word [esp + 0x10]
mov eax, esi
mov byte [ecx + esi], 0
pop esi
pop edi
pop ebx
ret
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x463db0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x10c]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fopen]
push esi
push edi
push 0x4c5ec0
push ebx
call ebp
mov esi, eax
add esp, 8
test esi, esi
je 0x464003
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea eax, [esp + 0x1c]
push 4
push eax
call edi
add esp, 0x10
test eax, eax
je 0x463ff9
mov eax, dword [esp + 0x14]
cmp eax, 0x51535741
jne 0x463f43
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
push 0x4c5228
push ebx
call ebp
mov esi, eax
add esp, 0xc
test esi, esi
je 0x463ff9
push esi
lea ecx, [esp + 0x1c]
push 0xfa
push ecx
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
test eax, eax
je 0x463ff9
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.MSVCRT.dll__strlwr]
mov ebp, dword [sym.imp.MSVCRT.dll_strstr]
lea eax, [esp + 0x1c]
push str.version
push eax
call ebp
add esp, 0xc
test eax, eax
je 0x463ff9
mov edi, dword [sym.imp.MSVCRT.dll_atoi]
lea ebx, [eax + 8]
push ebx
call edi
add esp, 4
test eax, eax
jle 0x463ff9
push ebx
call edi
mov ecx, dword [esp + 0x128]
lea edx, [esp + 0x1c]
push str.duration
push edx
mov dword [ecx], eax
call ebp
add esp, 0xc
test eax, eax
je 0x463ff9
lea ebx, [eax + 9]
push ebx
call edi
add esp, 4
test eax, eax
jle 0x463ff9
push ebx
call edi
lea eax, [eax + eax*2]
mov ebx, dword [esp + 0x120]
push str.limbs
lea ecx, [eax + eax*4]
mov eax, 0x10624dd3
shl ecx, 1
imul ecx
sar edx, 6
mov eax, edx
lea ecx, [esp + 0x20]
shr eax, 0x1f
add edx, eax
push ecx
mov dword [ebx], edx
call ebp
add esp, 0xc
test eax, eax
je 0x463ff9
lea ebp, [eax + 6]
push ebp
call edi
add esp, 4
test eax, eax
jle 0x463ff9
push ebp
call edi
mov edx, dword [esp + 0x124]
add esp, 4
mov dword [edx], eax
mov ecx, dword [ebx]
cmp ecx, 0x2710
jge 0x463ff9
cmp eax, 0x64
jge 0x463ff9
mov eax, dword [esp + 0x124]
cmp dword [eax], 0
jle 0x463ff9
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
cmp eax, 0x797f7f7f
je 0x463f55
cmp eax, 0x7a7f7f7f
jne 0x463ff9
push esi
push 1
lea ecx, [esp + 0x18]
push 2
push ecx
call edi
add esp, 0x10
cmp eax, 1
jne 0x463ff9
mov ebx, dword [esp + 0x120]
push esi
push eax
push 4
push ebx
call edi
add esp, 0x10
cmp eax, 1
jne 0x463ff9
lea edx, [esp + 0x10]
push edx
call fcn.00463d90
push ebx
call fcn.004636d0
mov eax, dword [esp + 0x12c]
mov edx, dword [esp + 0x124]
add esp, 8
mov dword [eax], 0
mov eax, dword [esp + 0x10]
mov ecx, eax
and ecx, 0xffff
cmp ax, 0x2710
mov dword [edx], ecx
jae 0x463ff9
cmp dword [ebx], 0x64
jge 0x463ff9
push esi
call fcn.00463d00
add esp, 4
test eax, eax
je 0x463ff9
mov edi, dword [sym.imp.MSVCRT.dll_free]
push eax
call edi
push esi
call fcn.00463d00
add esp, 8
test eax, eax
je 0x463ff9
push eax
call edi
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x104
ret
Function at 0x468fa0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc]
push ebp
push esi
push edi
push 0
push 0
push 3
push 0
push 1
push accept
push ecx
mov dword [eax], 0
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x468fd6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push 0
push 0
push 0
push 2
push 0
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
mov edi, eax
call ebx
cmp edi, 0xffffffff
jne 0x469009
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
push edi
mov esi, eax
call ebx
test esi, esi
jne 0x469028
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push ebp
push edx
mov edx, dword [esp + 0x24]
push eax
push ecx
push edx
push esi
call fcn.00469070
add esp, 0x18
test eax, eax
jne 0x469058
push esi
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], esi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x46b5d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4f0150]
mov ecx, dword [0x4f018c]
cmp eax, ecx
je 0x46b634
test eax, eax
mov dword [0x4f018c], eax
je 0x46b5fc
mov eax, dword [0x4f0178]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
jmp 0x46b613
mov edx, dword [0x4f0178]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4f015c]
push 1
push eax
mov ecx, dword [0x4f0190]
mov edx, dword [0x4f0158]
mov eax, dword [0x4f0154]
push ecx
mov ecx, dword [0x4f0180]
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
ret
Function at 0x46b680
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x510ae0]
test eax, eax
je 0x45fb76
push str.search_hide
call fcn.0043bb00
add esp, 4
mov eax, dword [0x4ef2d0]
push 0
push eax
mov dword [0x4ef3d8], 0
call dword [sym.imp.USER32.dll_ShowWindow]
ret
mov eax, dword [0x510ae0]
test eax, eax
je 0x46b696
push str.tab_changed
call fcn.0043bb00
add esp, 4
mov eax, dword [0x4f0178]
push esi
push edi
push 0
push 0
push 0x130b
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
xor esi, esi
mov edi, eax
mov dword [0x4f0184], esi
call fcn.0046cdc0
push 2
call fcn.00426a10
add esp, 4
test eax, eax
je 0x46b6d9
test edi, edi
jne 0x46b6d4
mov dword [0x4f0184], edi
mov esi, 1
push 3
call fcn.00426a10
add esp, 4
test eax, eax
je 0x46b6f6
cmp edi, esi
jne 0x46b6f5
mov dword [0x4f0184], 1
inc esi
push 4
call fcn.00426a10
add esp, 4
test eax, eax
je 0x46b713
cmp edi, esi
jne 0x46b712
mov dword [0x4f0184], 2
inc esi
push 0
call fcn.00426a10
add esp, 4
test eax, eax
je 0x46b730
cmp edi, esi
jne 0x46b72f
mov dword [0x4f0184], 3
inc esi
push 1
call fcn.00426a10
add esp, 4
test eax, eax
je 0x46b74d
cmp edi, esi
jne 0x46b74c
mov dword [0x4f0184], 4
inc esi
push 6
call fcn.00426a10
add esp, 4
test eax, eax
je 0x46b76a
cmp edi, esi
jne 0x46b769
mov dword [0x4f0184], 6
inc esi
push 5
call fcn.00426a10
add esp, 4
test eax, eax
je 0x46b78f
mov eax, dword [0x4f016c]
test eax, eax
je 0x46b78f
cmp edi, esi
jne 0x46b78f
mov dword [0x4f0184], 7
mov eax, dword [0x4f0188]
pop edi
test eax, eax
pop esi
jne 0x46b7bd
call fcn.00487cc0
call fcn.00425e50
call fcn.0047d5b0
call fcn.0046fd00
call fcn.00471630
call fcn.00434140
jmp 0x45fb60
mov eax, dword [0x4f0184]
cmp eax, 7
ja case.0x46b7cb.5
jmp dword [eax*4 + 0x46b8fc]
call fcn.00487cf0
call fcn.00425e50
call fcn.0047d5b0
call fcn.0046fd00
call fcn.00471630
call fcn.00434140
call 0x45fb60
jmp case.0x46b7cb.5
call fcn.00487cc0
call fcn.00425e20
call fcn.0047d5b0
call fcn.0046fd00
call fcn.00471630
call fcn.00434140
call 0x45fb60
jmp case.0x46b7cb.5
call fcn.00487cc0
call fcn.00425e50
call fcn.0047d580
call fcn.0046fd00
call fcn.00471630
call fcn.00434140
call 0x45fb60
jmp case.0x46b7cb.5
call fcn.00487cc0
call fcn.00425e50
call fcn.0047d5b0
call fcn.0046fcd0
call fcn.00471630
call fcn.00434140
call 0x45fb60
jmp case.0x46b7cb.5
call fcn.00487cc0
call fcn.00425e50
call fcn.0047d5b0
call fcn.0046fd00
call fcn.00471600
call fcn.00434140
call 0x45fb60
jmp case.0x46b7cb.5
call fcn.00487cc0
call fcn.00425e50
call fcn.0047d5b0
call fcn.0046fd00
call fcn.00471630
call fcn.00434110
call 0x45fb60
jmp case.0x46b7cb.5
call fcn.00487cc0
call fcn.00425e50
call fcn.0047d5b0
call fcn.0046fd00
call fcn.00471630
call fcn.00434140
call fcn.0045fb30
mov ecx, dword [0x4f0184]
push ecx
call fcn.0046b530
push eax
push str.tabpage
push str.layout
call fcn.0044cf00
add esp, 0x10
ret
Function at 0x46bc10
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x510ae0]
test eax, eax
je 0x46bc26
push str.tab_hide
call fcn.0043bb00
add esp, 4
mov eax, dword [0x4f0188]
test eax, eax
je 0x46bc6f
mov eax, dword [0x4f0180]
push 0
push eax
mov dword [0x4f0188], 0
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00410be0
call fcn.0046b680
push 0
push 0x4d1008
push str.layout
call fcn.0044cf00
push 0x99
call fcn.0043ed20
add esp, 0x10
ret

Function at 0x46d220
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x46d261
mov eax, dword [0x4f01d4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x4f0230]
mov edx, dword [0x4f0220]
mov eax, dword [0x4f01d4]
push 1
push ecx
push edx
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov dword [0x4f01ec], 1
ret
mov ecx, dword [0x4f01d4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x4f01ec], 0
ret
Function at 0x46e070
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ecx
mov eax, dword [0x510b18]
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
test eax, eax
mov dword [esp + 0xc], 1
je 0x46e0a3
mov eax, ebx
and eax, 0xffff
push eax
push edi
push str.tcp_create___x___d_
call fcn.0043bb00
add esp, 0xc
push 0x1c
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x46e0be
pop edi
pop esi
mov eax, 0x190
pop ebx
pop ecx
ret
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x46e100
push esi
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [0x510b18]
add esp, 4
test eax, eax
je 0x46e0f6
call sub.WSOCK32.dll_WSAGetLastError
push eax
push str.socket___failed:__d
call fcn.0043bb00
add esp, 8
pop edi
pop esi
mov eax, 0x1ac
pop ebx
pop ecx
ret
mov ecx, dword [0x4f025c]
test ecx, ecx
jne 0x46e156
lea ecx, [esp + 0xc]
push ecx
push 0x8004667e
push eax
call sub.WSOCK32.dll_ioctlsocket
test eax, eax
je 0x46e156
mov eax, dword [0x510b18]
test eax, eax
je 0x46e13a
call sub.WSOCK32.dll_WSAGetLastError
push eax
push str.ioctlsocket___failed:__d
call fcn.0043bb00
add esp, 8
mov edx, dword [esi]
push edx
call sub.WSOCK32.dll_closesocket
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, 0x1ae
pop edi
pop esi
pop ebx
pop ecx
ret
lea eax, [esi + 4]
lea edx, [esi + 0xc]
xor ecx, ecx
mov dword [esi + 8], edi
mov word [eax], 2
mov word [esi + 6], bx
mov dword [edx], ecx
push 0x10
push eax
mov dword [edx + 4], ecx
mov eax, dword [esi]
push eax
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x46e1bf
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x46e1bf
mov ecx, dword [0x510b18]
test ecx, ecx
je 0x46e1a3
push eax
push str.connect___failed:__d
call fcn.0043bb00
add esp, 8
mov ecx, dword [esi]
push ecx
call sub.WSOCK32.dll_closesocket
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, 0x1ad
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, dword [0x4f025c]
test eax, eax
je 0x46e216
mov eax, dword [esi]
lea edx, [esp + 0xc]
push edx
push 0x8004667e
push eax
call sub.WSOCK32.dll_ioctlsocket
test eax, eax
je 0x46e216
mov eax, dword [0x510b18]
test eax, eax
je 0x46e1fa
call sub.WSOCK32.dll_WSAGetLastError
push eax
push str.ioctlsocket___failed:__d
call fcn.0043bb00
add esp, 8
mov ecx, dword [esi]
push ecx
call sub.WSOCK32.dll_closesocket
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, 0x1ae
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, dword [0x510b18]
test eax, eax
je 0x46e22d
push esi
push str.tcp_create_succeeded:__p
call fcn.0043bb00
add esp, 8
mov dword [esi + 0x14], 0
call fcn.00477370
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x18], eax
pop edi
xor eax, eax
mov dword [edx], esi
pop esi
pop ebx
pop ecx
ret
Function at 0x46e2c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, 0x1000
call fcn.00488d40
mov eax, dword [0x510ae0]
test eax, eax
je 0x46e2e0
push str.tcp_receive
call fcn.0043bb00
add esp, 4
mov eax, dword [esp + 0x100c]
cmp eax, 0x1000
jle 0x46e2f3
mov eax, 0x1000
mov ecx, dword [esp + 0x1004]
push ebx
push esi
push 0
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x10]
push eax
push edx
call sub.WSOCK32.dll_recv
mov ebx, dword [esp + 0x1018]
test eax, eax
mov dword [ebx], eax
jne 0x46e33d
mov eax, dword [0x510b18]
test eax, eax
je 0x46e32f
push str.recv_failed
call fcn.0043bb00
add esp, 4
pop esi
mov eax, 0x1a0
pop ebx
add esp, 0x1000
ret
cmp eax, 0xffffffff
jne 0x46e38c
call sub.WSOCK32.dll_WSAGetLastError
mov esi, eax
cmp esi, 0x2733
je 0x46e37b
cmp esi, 0x2749
je 0x46e37b
mov eax, dword [0x510b18]
test eax, eax
je 0x46e370
push esi
push str.recv_failed:__d
call fcn.0043bb00
add esp, 8
mov eax, esi
pop esi
pop ebx
add esp, 0x1000
ret
mov dword [ebx], 0
pop esi
xor eax, eax
pop ebx
add esp, 0x1000
ret
mov ecx, dword [0x510b18]
test ecx, ecx
je 0x46e3a4
push eax
push str.tcp_receive_received__d_bytes
call fcn.0043bb00
add esp, 8
mov ecx, dword [ebx]
push edi
mov edi, dword [esp + 0x1014]
mov eax, ecx
lea esi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
push ecx
call fcn.00418fb0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x1000
ret

Function at 0x46e3e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x510ae0]
test eax, eax
je 0x46e3f6
push str.tcp_send
call fcn.0043bb00
add esp, 4
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
test ebx, ebx
jne 0x46e40a
pop edi
pop esi
mov eax, 0x193
pop ebx
ret
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx]
push 0
push esi
push eax
push ecx
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
jne 0x46e491
call sub.WSOCK32.dll_WSAGetLastError
mov edi, eax
cmp edi, 0x2733
je 0x46e458
cmp edi, 0x2749
je 0x46e458
mov eax, dword [0x510b18]
test eax, eax
je 0x46e452
push edi
push esi
push str.tcp_send__d_bytes_failed:__d
call fcn.0043bb00
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
call fcn.00477370
sub eax, dword [ebx + 0x18]
cmp eax, 0x4e20
jbe 0x46e488
mov eax, dword [0x510b18]
test eax, eax
je 0x46e47f
push edi
push esi
push str.tcp_send__d_bytes_timed_out:__d
call fcn.0043bb00
add esp, 0xc
pop edi
pop esi
mov eax, 0x192
pop ebx
ret
pop edi
pop esi
mov eax, 0x191
pop ebx
ret
cmp eax, esi
jne 0x46e4c3
mov eax, dword [0x510b18]
test eax, eax
je 0x46e4ac
push esi
push str.tcp_send__d_bytes_succeeded
call fcn.0043bb00
add esp, 8
call fcn.00477370
push esi
mov dword [ebx + 0x18], eax
call fcn.00418fb0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov ecx, dword [0x510b18]
test ecx, ecx
je 0x46e4db
push eax
push str.send_failed___d_
call fcn.0043bb00
add esp, 8
pop edi
pop esi
mov eax, 0x19f
pop ebx
ret
Function at 0x46e4f0
Capabilities:
Get socket status

Disassembly:
mov eax, dword [0x510ae0]
sub esp, 0x10c
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
je 0x46e512
push str.tcp_wait
call fcn.0043bb00
add esp, 4
mov ebp, dword [esp + 0x120]
mov esi, dword [esp + 0x124]
xor edx, edx
cmp ebp, ebx
mov dword [esp + 0x18], edx
jle 0x46e54e
mov ecx, esi
mov edi, ebp
mov eax, dword [ecx]
cmp eax, ebx
je 0x46e548
cmp edx, 0x40
jae 0x46e548
mov eax, dword [eax]
mov dword [esp + edx*4 + 0x1c], eax
mov edx, dword [esp + 0x18]
inc edx
mov dword [esp + 0x18], edx
add ecx, 4
dec edi
jne 0x46e52e
mov eax, dword [esp + 0x128]
cmp eax, ebx
jle 0x46e57b
lea eax, [eax + eax*4]
lea edx, [esp + 0x10]
push edx
push ebx
lea eax, [eax + eax*4]
push ebx
mov dword [esp + 0x1c], ebx
lea ecx, [eax + eax*4]
lea eax, [esp + 0x24]
shl ecx, 3
mov dword [esp + 0x20], ecx
push eax
jmp 0x46e583
push ebx
push ebx
lea ecx, [esp + 0x20]
push ebx
push ecx
push ebx
call sub.WSOCK32.dll_select
cmp eax, ebx
je 0x46e5b5
cmp eax, 0xffffffff
je 0x46e5b5
cmp ebp, ebx
jle 0x46e5b5
mov edi, dword [esi]
test edi, edi
je 0x46e5ad
mov eax, dword [edi]
lea edx, [esp + 0x18]
push edx
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x46e5c2
inc ebx
add esi, 4
cmp ebx, ebp
jl 0x46e596
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret

Function at 0x46e650
Capabilities:
Create tcp socket

Disassembly:
push ecx
mov eax, dword [0x510ae0]
mov dword [esp], 1
test eax, eax
je 0x46e66f
push str.tcp_listen
call fcn.0043bb00
add esp, 4
push esi
push 0x1c
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x46e689
mov eax, 0x190
pop esi
pop ecx
ret
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x46e6ad
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, 0x1ac
pop esi
pop ecx
ret
lea ecx, [esp + 4]
push ecx
push 0x8004667e
push eax
call sub.WSOCK32.dll_ioctlsocket
test eax, eax
je 0x46e6db
mov edx, dword [esi]
push edx
call sub.WSOCK32.dll_closesocket
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, 0x1ae
pop esi
pop ecx
ret
mov eax, dword [esp + 0xc]
push edi
lea edi, [esi + 4]
push eax
mov dword [esi + 8], 0
mov word [edi], 2
call sub.WSOCK32.dll_htons
lea edx, [esi + 0xc]
xor ecx, ecx
mov word [esi + 6], ax
push 0x10
mov dword [edx], ecx
push edi
mov dword [edx + 4], ecx
mov eax, dword [esi]
push eax
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
pop edi
jne 0x46e72e
mov ecx, dword [esi]
push ecx
call sub.WSOCK32.dll_closesocket
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, 0x1d4
pop esi
pop ecx
ret
mov edx, dword [esi]
push 5
push edx
call sub.WSOCK32.dll_listen
cmp eax, 0xffffffff
jne 0x46e74d
mov eax, dword [esi]
push eax
call sub.WSOCK32.dll_closesocket
mov eax, 0x1d5
pop esi
pop ecx
ret
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [ecx], esi
pop esi
pop ecx
ret
Function at 0x46ee50
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x104
mov eax, ecx
and eax, 0xffff
cmp eax, 0x5be
jg 0x46ef66
je 0x46ef0b
add eax, 0xffffff4a
cmp eax, 7
ja case.0x46ee80.185
jmp dword [eax*4 + 0x46ef9c]
push 0xbb
call fcn.00472490
add esp, 4
xor eax, eax
add esp, 0x104
ret
push 0xbd
call fcn.00472490
add esp, 4
xor eax, eax
add esp, 0x104
ret
push 0xbc
call fcn.00472490
add esp, 4
xor eax, eax
add esp, 0x104
ret
push 0xb7
call fcn.00472490
add esp, 4
xor eax, eax
add esp, 0x104
ret
push 0xb8
call fcn.00472490
add esp, 4
xor eax, eax
add esp, 0x104
ret
push 0xb6
call fcn.00472490
add esp, 4
xor eax, eax
add esp, 0x104
ret
shr ecx, 0x10
cmp ecx, 0x300
jne case.0x46ee80.185
mov ecx, dword [0x4f0274]
lea eax, [esp + 4]
push 0x100
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp]
lea eax, [esp + 4]
push edx
push 0x4c4df8
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp eax, 1
jne case.0x46ee80.185
mov ecx, dword [esp]
push ecx
call fcn.0046f0d0
push eax
call fcn.00472150
add esp, 8
xor eax, eax
add esp, 0x104
ret
sub eax, 0x5bf
je 0x46ef83
dec eax
jne case.0x46ee80.185
call fcn.0046efc0
call fcn.0046f060
xor eax, eax
add esp, 0x104
ret
shr ecx, 0x10
cmp ecx, 0x300
jne case.0x46ee80.185
call fcn.0046f060
xor eax, eax
add esp, 0x104
ret

Function at 0x46f060
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x4f0264]
sub esp, 0x104
test eax, eax
je 0x46f080
push 0xffffffffffffffff
call fcn.00472430
add esp, 4
add esp, 0x104
ret
mov ecx, dword [0x4f027c]
lea eax, [esp + 4]
push 0x100
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp]
lea eax, [esp + 4]
push edx
push 0x4c417c
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp eax, 1
jne 0x46f0c1
mov ecx, dword [esp]
push ecx
call fcn.00472430
add esp, 4
add esp, 0x104
ret
Function at 0x46f230
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x510ae0]
sub esp, 0x10
test eax, eax
push ebx
mov ebx, dword [esp + 0x18]
push esi
je 0x46f250
push ebx
push str.telegram_send___s_
call fcn.0043bb00
add esp, 8
mov eax, dword [0x4f0288]
push edi
test eax, eax
jne 0x46f33f
push 0
push 0x46f3b0
call fcn.004109d0
push eax
push 0x26b
call fcn.00410b00
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push str.telegram_x
push str.layout
mov dword [0x4f0288], eax
call fcn.0044cec0
push str.telegram_y
push str.layout
mov edi, eax
call fcn.0044cec0
add esp, 0x10
cmp edi, 0xffffffff
mov esi, eax
je 0x46f33f
cmp esi, 0xffffffff
je 0x46f33f
mov ecx, dword [0x4f0288]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
call fcn.00438ce0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
sub edx, ecx
add edx, edi
cmp edx, eax
jle 0x46f2f2
call fcn.00438ce0
mov edx, dword [esp + 0x14]
mov edi, eax
mov eax, dword [esp + 0xc]
sub eax, edx
add edi, eax
push ebp
call fcn.00438cf0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ebp, ecx
sub ebp, edx
add ebp, esi
cmp ebp, eax
pop ebp
jle 0x46f320
call fcn.00438cf0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, eax
mov eax, edx
sub eax, ecx
add esi, eax
mov eax, dword [esp + 0xc]
sub ecx, edx
mov edx, dword [0x4f0288]
push 1
push ecx
mov ecx, dword [esp + 0x1c]
sub ecx, eax
push ecx
push esi
push edi
push edx
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [0x4f02ac]
mov esi, dword [sym.imp.USER32.dll_SetWindowTextA]
push ebx
push eax
call esi
mov ecx, dword [0x4f0288]
push 1
push ecx
mov dword [0x4f02b8], 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x4f02c0]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
push ebx
call fcn.00425660
add esp, 4
test eax, eax
pop edi
je 0x46f3a7
push eax
call fcn.00425370
add esp, 4
test eax, eax
je 0x46f3a7
push ebx
push ebx
push 0x386
call fcn.004411f0
add esp, 0xc
push eax
mov eax, dword [0x4f02bc]
push eax
call esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x46f560
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x4f02ac]
sub esp, 0x3ec
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x11
push 0x4f028c
push eax
call esi
mov edx, dword [0x4f02c0]
lea ecx, [esp + 4]
push 0x3e9
push ecx
push edx
call esi
lea eax, [esp + 4]
push eax
push 0x4f028c
call fcn.00410420
add esp, 8
test eax, eax
pop esi
je 0x46f5f6
cmp eax, 0x194
je 0x46f5d2
push eax
push 0x3a
call fcn.004411f0
mov ecx, dword [0x4f02bc]
add esp, 8
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
add esp, 0x3ec
ret
push 2
call fcn.004411b0
mov edx, dword [0x4f02bc]
add esp, 4
push eax
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
add esp, 0x3ec
ret
push 0xb1
call fcn.004411b0
add esp, 4
push eax
mov eax, dword [0x4f02bc]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
mov dword [0x4f02b8], eax
add esp, 0x3ec
ret