joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46fd00
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x510ae0]
test eax, eax
je 0x46fd16
push str.telegram_hide
call fcn.0043bb00
add esp, 4
mov eax, dword [0x4f02a4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x4f02c4], 0
ret

Function at 0x4711f0
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [0x4f0314]
sub esp, 0x400
lea eax, [esp]
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x100
push eax
push ecx
call esi
mov eax, dword [0x4f031c]
lea edx, [esp + 0x104]
push 0x100
push edx
push eax
call esi
lea ecx, [esp + 0x104]
lea edx, [esp + 4]
push ecx
push edx
lea eax, [esp + 0x20c]
push str.teleport__s__s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [esp + 0x214]
push 0
push ecx
call fcn.00418900
add esp, 0x18
pop esi
add esp, 0x400
ret

Function at 0x471630
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x510ae0]
test eax, eax
je 0x471646
push str.teleport_hide
call fcn.0043bb00
add esp, 4
mov eax, dword [0x4f0300]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x4f0338], 0
ret

Function at 0x471f80
Capabilities:
Hide graphical window

Disassembly:
call fcn.00471fb0
mov eax, dword [0x4f8810]
test eax, eax
je 0x471f98
push 0xa
call fcn.00468670
add esp, 4
mov dword [0x4f8810], 0
jmp fcn.0046f100
Function at 0x472490
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x4f8810]
push edi
test eax, eax
je 0x47273b
call fcn.00462a60
call sub.MSVCRT.dll__ftol
add eax, 0x467d
mov ecx, 0x168
cdq
idiv ecx
mov eax, 0xb60b60b7
mov ecx, edx
imul ecx
add edx, ecx
sar edx, 6
movsx ecx, word [0x4f03f2]
mov eax, edx
push ecx
shr eax, 0x1f
add edx, eax
mov edi, edx
movsx edx, word [0x4f03f0]
push edx
call fcn.00472100
add esp, 8
test eax, eax
je 0x47273b
mov ax, word [0x4f03f0]
push esi
push eax
call fcn.004720b0
mov cx, word [0x4f03f2]
push ecx
call fcn.004720b0
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
add esp, 8
push 0x10
call esi
and al, 0xfe
test ax, ax
je 0x472532
push 0x11
call esi
mov si, ax
and si, 0xfffe
neg si
sbb esi, esi
and esi, 0xfffffffc
add esi, 5
jmp 0x472537
mov esi, 0x32
mov edx, dword [esp + 0xc]
lea eax, [edx - 0xb0]
cmp eax, 0xd
ja case.default.0x47254a
jmp dword [eax*4 + 0x472740]
inc edi
and edi, reloc.WSOCK32.dll_closesocket
jns 0x47255f
dec edi
or edi, 0xfffffffc
inc edi
push edi
call fcn.00472780
add esp, 4
jmp case.default.0x47254a
add edi, 2
and edi, reloc.WSOCK32.dll_closesocket
jns 0x47257d
dec edi
or edi, 0xfffffffc
inc edi
push edi
call fcn.00472780
add esp, 4
jmp case.default.0x47254a
add edi, 3
and edi, reloc.WSOCK32.dll_closesocket
jns case.0x47254a.179
dec edi
or edi, 0xfffffffc
inc edi
push edi
call fcn.00472780
add esp, 4
jmp case.default.0x47254a
push 8
call fcn.00468670
mov eax, dword [0x4f8924]
add word [0x4f0408], si
add esp, 4
inc eax
mov dword [0x4f8924], eax
jmp 0x4726fa
push 8
call fcn.00468670
mov eax, dword [0x4f8924]
sub word [0x4f0408], si
add esp, 4
inc eax
mov dword [0x4f8924], eax
jmp 0x4726fa
mov ax, word [0x4f8804]
mov cl, byte [0x4f04c0]
mov word [0x4f0408], ax
mov eax, dword [0x4f8924]
inc eax
mov byte [0x4f03fc], cl
mov dword [0x4f8924], eax
jmp 0x4726fa
cmp byte [0x4f03fc], 0xfe
je case.default.0x47254a
push 9
call fcn.00468670
mov al, byte [0x4f03fc]
add esp, 4
cmp al, 0xc0
add al, 0x40
mov byte [0x4f03fc], al
jmp 0x4726fa
cmp byte [0x4f03fc], 0xfe
je case.default.0x47254a
push 9
call fcn.00468670
mov al, byte [0x4f03fc]
add esp, 4
cmp al, 0x3f
add al, 0xc0
mov byte [0x4f03fc], al
jmp 0x4726fa
mov al, byte [0x4f03fc]
cmp al, 0xfe
je case.default.0x47254a
mov cl, al
and al, 0x3f
shr cl, 6
inc al
cmp al, 0x3f
jb 0x472683
xor al, al
shl cl, 6
add cl, al
mov byte [0x4f03fc], cl
jmp 0x4726fa
mov cl, byte [0x4f03fc]
cmp cl, 0xfe
je case.default.0x47254a
mov al, cl
and al, 0x3f
shr cl, 6
test al, al
jne 0x4726b5
mov al, 0x3e
shl cl, 6
add cl, al
mov byte [0x4f03fc], cl
jmp 0x4726fa
dec al
shl cl, 6
add cl, al
mov byte [0x4f03fc], cl
jmp 0x4726fa
mov dx, word [0x4f0408]
mov al, byte [0x4f03fc]
mov word [0x4f05f4], dx
mov byte [0x4f0410], al
jmp case.default.0x47254a
mov cl, byte [0x4f0410]
mov byte [0x4f03fc], cl
jmp 0x4726fa
mov dx, word [0x4f05f4]
mov word [0x4f0408], dx
mov dword [0x4f8918], 1
call fcn.00472180
movsx eax, word [0x4f0408]
push eax
call fcn.0046f120
mov al, byte [0x4f03fc]
add esp, 4
cmp al, 0xfe
pop esi
jne 0x47272f
push 0xffffffffffffffff
call fcn.0046f180
add esp, 4
pop edi
ret
and eax, 0x3f
push eax
call fcn.0046f180
add esp, 4
pop edi
ret
Function at 0x478150
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
sub esp, 0x400
mov dword [0x4fd1f4], eax
mov dword [0x4fd1f0], ecx
push esi
push edi
push 0x4782b0
push 0xe
call fcn.0040d450
push 0x478410
push 9
call fcn.0040d490
call fcn.00410b10
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.send_dir
mov eax, ecx
mov esi, edi
mov edi, edx
push str.transfer
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0044cf60
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x4781e2
lea ecx, [esp + 8]
push ecx
push str.send_dir
push str.transfer
call fcn.0044cfe0
add esp, 0xc
mov edi, str.Incoming
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__mkdir]
push str.recv_dir
push str.transfer
call fcn.0044cf60
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
pop ebx
mov eax, ecx
mov esi, edi
mov edi, 0x4fad94
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x47829c
lea ecx, [esp + 8]
push ecx
push str.recv_dir
push str.transfer
call fcn.0044cfe0
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4fad94
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x400
ret
Function at 0x478590
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x510ae0]
sub esp, 0x20
test eax, eax
je 0x4785a9
push str.xferdialog_show_send
call fcn.0043bb00
add esp, 4
mov eax, dword [0x4fd1ad]
test eax, eax
jne 0x4785bf
call fcn.00478710
test eax, eax
je 0x478705
mov ecx, dword [0x4fd1a9]
push esi
push edi
mov edi, dword [0x4fd1cd]
xor eax, eax
test edi, edi
setg al
push eax
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [0x4fd1ad]
push 4
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x4fad61]
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 8]
push eax
push ecx
call edi
mov eax, dword [0x4fad59]
mov esi, dword [esp + 8]
lea edx, [esp + 8]
push edx
push eax
call edi
mov edx, dword [0x4fad65]
lea ecx, [esp + 0x18]
push ecx
push edx
call edi
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0xc]
sub esi, ecx
sub eax, edi
push 4
sub esi, 0xa
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x21
call esi
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x28]
sub edi, edx
push 4
sub edi, eax
call esi
sub edi, eax
push edi
push 0x20
call esi
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x28]
mov edx, dword [0x4fd1a1]
sub ecx, edi
sub ecx, eax
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x4fd1a5]
mov esi, dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x4ddbb0
push eax
call esi
mov ecx, dword [0x4fd195]
push 0x4ddbb0
push ecx
call esi
push 0x18
call fcn.004411b0
mov edx, dword [0x4fd199]
add esp, 4
push eax
push edx
call esi
push 0x29b
call fcn.004411b0
add esp, 4
push eax
mov eax, dword [0x4fd1a9]
push eax
call esi
push 0x2a0
call fcn.004411b0
mov ecx, dword [0x4fd19d]
add esp, 4
push eax
push ecx
call esi
push 0x280
call fcn.004411b0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4fbcd8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x20
ret
Function at 0x479190
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x510ae0]
sub esp, 0x20
test eax, eax
je 0x4791a9
push str.xferdialog_show_recv
call fcn.0043bb00
add esp, 4
mov eax, dword [0x4fad65]
push ebx
test eax, eax
jne 0x4791c6
call fcn.00478710
test eax, eax
jne 0x4791c6
mov eax, 0x19d
pop ebx
add esp, 0x20
ret
mov eax, dword [0x4fad61]
push esi
push edi
push 0
push eax
mov dword [0x4fd1e8], 1
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [0x4fad61]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push ecx
call esi
mov edx, dword [0x4fad65]
push 4
push edx
call esi
mov eax, dword [0x4fad59]
push 5
push eax
call esi
mov ecx, dword [0x4fad55]
push 0
push ecx
call esi
mov eax, dword [0x4fad51]
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 0xc]
push edx
push eax
call edi
mov edx, dword [0x4fad59]
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push ecx
push edx
call edi
mov ecx, dword [0x4fad65]
lea eax, [esp + 0x1c]
push eax
push ecx
call edi
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
sub esi, eax
sub edx, edi
push 4
sub esi, 0xa
push edx
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x21
call esi
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
sub edi, ecx
push 4
sub edi, eax
call esi
sub edi, eax
push edi
push 0x20
call esi
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x2c]
mov edx, dword [0x4fad59]
sub ecx, esi
sub ecx, eax
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x4fad94
call fcn.0047a770
mov eax, dword [0x4fad5d]
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextA]
add esp, 4
push 0x4ddbb0
push eax
call ebx
push 0x4ddbb0
mov ecx, dword [0x4fad4d]
push ecx
call ebx
push 0x18
call fcn.004411b0
mov edx, dword [0x4fad51]
add esp, 4
push eax
push edx
call ebx
push 0x280
call fcn.004411b0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push 0xfe
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4f9890
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040d210
push eax
push 0x271
call fcn.004411f0
mov ecx, dword [0x4fad65]
add esp, 0x10
push eax
push ecx
call ebx
mov eax, dword [0x4fad8d]
pop edi
test eax, eax
pop esi
jne 0x479398
call fcn.00477370
push 0x27d
mov dword [0x4fd1ec], eax
mov dword [0x4fad45], 3
call fcn.004411b0
mov edx, dword [0x4fad5d]
add esp, 4
push eax
push edx
call ebx
push 0x4fad8d
push 0x101
call fcn.0040d180
add esp, 4
push eax
call sub.WSOCK32.dll_htons
push eax
push 0x100
call fcn.0040d180
add esp, 4
push eax
call sub.WSOCK32.dll_htonl
push eax
call fcn.0046e070
add esp, 0xc
pop ebx
add esp, 0x20
ret
xor eax, eax
pop ebx
add esp, 0x20
ret
Function at 0x47cb00
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x510ae0]
test eax, eax
je 0x47cb16
push str.unzip:_flush_window
call fcn.0043bb00
add esp, 4
cmp dword [0x500428], 1
jne 0x47cb3f
mov eax, dword [0x50042c]
mov ecx, dword [0x51014c]
mov edx, dword [0x4d8e00]
push eax
push ecx
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
ret
mov ecx, dword [0x500434]
mov eax, dword [0x51014c]
push esi
mov edx, dword [0x500438]
push edi
mov edi, dword [0x5003e4]
mov esi, edi
sub esi, ecx
add eax, esi
cmp eax, edx
jbe 0x47cb81
mov dword [0x500438], eax
inc eax
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_realloc]
lea edi, [eax + esi]
add esp, 8
mov dword [0x500434], eax
mov dword [0x5003e4], edi
mov ecx, dword [0x51014c]
mov esi, dword [0x4d8e00]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x51014c]
mov ecx, dword [0x5003e4]
add ecx, eax
pop edi
mov dword [0x5003e4], ecx
pop esi
ret

Function at 0x47cd50
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1bd
mov dword [0x50043c], eax
call fcn.004411b0
mov ecx, dword [0x50043c]
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextA]
add esp, 4
push eax
push ecx
call ebx
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov esi, 0x4d8ed8
movsx edx, word [esi + 2]
push edx
call fcn.004411b0
mov ecx, dword [0x50043c]
add esp, 4
push eax
movsx eax, word [esi]
push eax
push ecx
call edi
add esi, 4
cmp esi, str.upgrade_available:__d
jb 0x47cd84
mov edx, dword [0x50043c]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x15e
push edx
call esi
mov dword [0x500448], eax
mov eax, dword [0x500440]
test eax, eax
push 0x44
je 0x47ce07
call fcn.004411b0
push eax
push 0x30
call fcn.004411f0
add esp, 0xc
push eax
mov eax, dword [0x500448]
push eax
call ebx
mov ecx, dword [0x50043c]
push 0
push 0x15f
push ecx
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
mov eax, 1
pop ebx
ret
call fcn.004411b0
push eax
push 0x31
call fcn.004411f0
mov edx, dword [0x500448]
add esp, 0xc
push eax
push edx
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x47ce30
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
and eax, 0xffff
sub eax, 2
je 0x47ce7c
sub eax, 0x15d
je 0x47ce4d
dec eax
jne 0x47ce79
jmp 0x47cea0
mov eax, dword [0x500440]
mov dword [0x500450], 0
test eax, eax
mov dword [0x50044c], 1
jne 0x47ce79
mov eax, dword [0x50043c]
push 0
push eax
call dword [sym.imp.USER32.dll_EndDialog]
ret
xor eax, eax
ret
mov ecx, dword [0x50043c]
push 0x197
push ecx
mov dword [0x500450], 0
call dword [sym.imp.USER32.dll_EndDialog]
ret
sub esp, 0x100
mov dword [0x500450], 0
push esi
push edi
call fcn.0047bee0
push eax
call fcn.0046ade0
mov edi, dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
push 0x2e
push esi
call edi
add esp, 0xc
test eax, eax
je 0x47cee0
push 0x2e
push esi
mov byte [eax], 0x5f
call edi
add esp, 8
test eax, eax
jne 0x47ced1
call fcn.0047dd30
push eax
call fcn.0047c110
and eax, 0xffff
push eax
push esi
push str.ebjects.activeworlds.kek
call fcn.00410b10
push eax
lea eax, [esp + 0x1c]
push str.__supgrade___s_upgrade__s__d_kit_d.rtp_aworld.exe
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x20
lea ecx, [esp + 8]
push 5
push ecx
call dword [sym.imp.KERNEL32.DLL_WinExec]
pop edi
cmp eax, 0x20
pop esi
jb 0x47cf4e
call fcn.004709f0
call fcn.00412760
mov edx, dword [0x50043c]
push 0x198
push edx
call dword [sym.imp.USER32.dll_EndDialog]
add esp, 0x100
ret
mov ecx, eax
sub ecx, 2
je 0x47cfa2
sub ecx, 6
je 0x47cf7e
push eax
push 0x34
call fcn.004411f0
add esp, 8
push eax
mov eax, dword [0x500448]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
add esp, 0x100
ret
push 0x35
call fcn.004411b0
mov ecx, dword [0x500448]
add esp, 4
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
add esp, 0x100
ret
push 0x36
call fcn.004411b0
mov edx, dword [0x500448]
add esp, 4
push eax
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
add esp, 0x100
ret
Function at 0x47d080
Capabilities:
Copy file

Disassembly:
mov eax, dword [0x510ae0]
sub esp, 0x200
test eax, eax
je 0x47d09c
push str.upgrade_init
call fcn.0043bb00
add esp, 4
mov eax, dword [esp + 0x204]
push ebx
push ebp
mov dword [0x500444], eax
call fcn.00410b10
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
lea ecx, [esp + 0xc]
push str._supgrade.new
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
call fcn.0042eab0
add esp, 0x10
test eax, eax
je 0x47d1aa
push esi
push edi
call fcn.00410b10
push eax
lea eax, [esp + 0x114]
push str._supgrade.exe
push eax
call ebp
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
add esp, 0xc
push 0
push str.Upgrade
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
test eax, eax
je 0x47d11b
push 0
call edi
push 0
push str.Upgrade
call esi
test eax, eax
jne 0x47d10a
mov ebx, dword [sym.imp.KERNEL32.DLL_CopyFileA]
xor esi, esi
lea ecx, [esp + 0x110]
push 0
lea edx, [esp + 0x14]
push ecx
push edx
call ebx
test eax, eax
jne 0x47d145
push 0x3e8
call edi
inc esi
cmp esi, 0x1e
jl 0x47d123
lea eax, [esp + 0x10]
push eax
call fcn.0042eb70
call fcn.00410b10
push eax
lea ecx, [esp + 0x18]
push str._spatchw32.new
push ecx
call ebp
lea edx, [esp + 0x20]
push edx
call fcn.0042eab0
add esp, 0x14
test eax, eax
pop edi
pop esi
je 0x47d1aa
call fcn.00410b10
push eax
lea eax, [esp + 0x10c]
push str._spatchw32.dll
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x108]
lea edx, [esp + 8]
push 0
push ecx
push edx
call ebx
lea eax, [esp + 8]
push eax
call fcn.0042eb70
add esp, 4
pop ebp
pop ebx
add esp, 0x200
ret

Function at 0x47d5b0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x510ae0]
test eax, eax
je 0x47d5c6
push str.users_hide
call fcn.0043bb00
add esp, 4
mov eax, dword [0x500460]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x50047c], 0
ret

Function at 0x47e3a0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x5004a4]
push 0
push eax
mov dword [0x5004bc], 0
call dword [sym.imp.USER32.dll_ShowWindow]
jmp fcn.00410be0
Function at 0x47e3f0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x3f8
push ebx
push esi
mov esi, dword [esp + 0x404]
push edi
test esi, esi
je 0x47e5ad
cmp byte [esi], 0
je 0x47e5ad
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x3e8
jae 0x47e5ad
mov ebx, dword [esp + 0x410]
test ebx, ebx
je 0x47e44a
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x3e8
jae 0x47e5ad
push 6
push str.local:
push esi
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x47e4da
call fcn.00410b10
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
mov edx, 0x3da
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, esi
sub edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jae 0x47e5ad
push 0x4c794c
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x47e5ad
add esi, 6
push esi
call fcn.00410b10
push eax
lea eax, [esp + 0x24]
push str._sdefaultweb_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, dword [esp + 0x41c]
push ebx
lea edx, [esp + 0x30]
push ecx
push edx
call fcn.0047e3f0
add esp, 0x1c
pop edi
pop esi
pop ebx
add esp, 0x3f8
ret
mov edx, dword [0x5004bc]
test edx, edx
jne 0x47e572
mov eax, dword [0x50049c]
push 0x47e5c0
push eax
mov eax, dword [0x5004b8]
push eax
push 0xfffffffffffffffa
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push eax
call fcn.004a6b4e
mov dword [0x5004bc], eax
call fcn.00410be0
mov edx, dword [0x50049c]
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
sub eax, edi
mov edi, dword [esp + 0xc]
mov edx, dword [0x50049c]
and eax, 0xffff
sub ecx, edi
shl eax, 0x10
and ecx, 0xffff
or eax, ecx
push eax
push 0
push 5
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x5004a4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x5004bc]
test edx, edx
je 0x47e5ad
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x47e59a
mov ecx, dword [esp + 0x40c]
push ebx
push ecx
push esi
push edx
call fcn.004a6c3a
pop edi
pop esi
pop ebx
add esp, 0x3f8
ret
test edx, edx
je 0x47e5ad
mov eax, dword [esp + 0x40c]
push eax
push esi
push edx
call fcn.004a6c0d
pop edi
pop esi
pop ebx
add esp, 0x3f8
ret
Function at 0x482020
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x510ae0]
test eax, eax
je 0x482036
push str.web_toggle
call fcn.0043bb00
add esp, 4
mov eax, dword [0x505b2c]
push esi
test eax, eax
je 0x4820a0
mov eax, dword [0x505b00]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
mov ecx, dword [0x505adc]
push 0
push ecx
call esi
mov edx, dword [0x505ae0]
push 0
push edx
call esi
mov eax, dword [0x505af0]
push 0
push eax
call esi
mov eax, dword [0x505b18]
test eax, eax
je 0x482082
push eax
call fcn.00469890
add esp, 4
mov dword [0x505b18], 0
call fcn.00482550
mov dword [0x505b2c], 0
jmp 0x482182
mov eax, dword [0x505b20]
test eax, eax
jne 0x4820f8
mov ecx, dword [0x505b00]
mov edx, dword [0x505afc]
mov eax, dword [0x505ae8]
push 0x482210
push ecx
push edx
push eax
call fcn.004a6b4e
mov dword [0x505b20], eax
call fcn.004821b0
mov eax, dword [0x505b20]
test eax, eax
jne 0x4820f8
mov eax, dword [esp + 8]
test eax, eax
jne 0x4821ac
push 0x56
call fcn.004411b0
push eax
call fcn.00442110
add esp, 8
pop esi
ret
or eax, 0xffffffff
mov dword [0x505b04], eax
mov dword [0x505b08], eax
call fcn.00415260
test eax, eax
jne 0x48211d
push 0x1a
call fcn.004695e0
add esp, 4
mov dword [0x505b18], eax
mov ecx, dword [0x505b00]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push ecx
call esi
mov edx, dword [0x505adc]
push 5
push edx
call esi
mov eax, dword [0x505ae0]
push 5
push eax
call esi
mov ecx, dword [0x505af0]
push 5
push ecx
call esi
mov dword [0x505b28], 0
mov dword [0x505b2c], 1
call fcn.004824a0
mov eax, dword [0x505b1c]
test eax, eax
je 0x482182
mov edx, dword [0x505b20]
push 0x4ddbb0
push eax
push edx
call fcn.004a6c0d
mov ecx, dword [0x505b2c]
xor eax, eax
test ecx, ecx
setne al
push eax
push 0x4da8e0
push str.show
call fcn.0044cf00
add esp, 0xc
call fcn.00410be0
call fcn.00410bc0
pop esi
ret