joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b7a40
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x410
push ebx
push esi
push edi
mov esi, dword [esp + 0x420]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x216]
mov word [esp + 0x214], 0
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
stosw word es:[edi], ax
push 0x4de3ac
lea eax, [esp + 0x21c]
push 0x103
push eax
call ebx
push esi
lea ecx, [esp + 0x228]
push 0x104
push ecx
call fcn.004b7980
add esp, 0x1c
lea edx, [esp + 0x214]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x4b7b68
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.004964b0
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.004c5370
lea edx, [esp + 0x1c]
push 0x104
push edx
call fcn.004964b0
add esp, 0x18
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4b7b4b
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
lea edx, [esi + eax*2]
lea eax, [esp + 0xc]
push edx
push 0x4de3ac
push 0x103
push eax
call ebx
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.004a9c80
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x410
ret
push 0x104
push esi
call fcn.004a9c80
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x410
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x410
ret
Function at 0x4b7b80
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push esi
lea eax, [esp + 4]
push edi
push eax
mov dword [esp + 0xc], 0
call fcn.004a9d50
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 4
test eax, eax
jne 0x4b7c09
push 0
push 6
push 0x692ea8
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4b7cc6
push 1
push 0x692ea8
call fcn.004c5370
mov eax, dword [esp + 0x220]
add esp, 8
test eax, eax
je 0x4b7cf9
mov ecx, dword [esp + 0x21c]
push 0x692ea8
dec ecx
push 0x4de3ac
push ecx
push eax
call esi
add esp, 0x10
mov eax, 0x692ea8
pop edi
pop esi
add esp, 0x20c
ret
cmp eax, 3
jne 0x4b7cb8
push 1
push 0x104
push 0x692ea8
call fcn.004b7880
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], 0
add esp, 0xc
lea edx, [esp + 0xc]
rep stosd dword es:[edi], eax
push 0x692ea8
push 0x4de3ac
push 0x103
push edx
stosw word es:[edi], ax
call esi
push 0x692ea8
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0x14
test eax, eax
jne 0x4b7cc6
push eax
push 6
push 0x692ea8
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4b7cc6
push 1
push 0x692ea8
call fcn.004c5370
mov eax, dword [esp + 0x220]
add esp, 8
test eax, eax
je 0x4b7cf9
mov ecx, dword [esp + 0x21c]
push 0x692ea8
dec ecx
push 0x4de3ac
push ecx
push eax
call esi
add esp, 0x10
mov eax, 0x692ea8
pop edi
pop esi
add esp, 0x20c
ret
mov ecx, 0x82
xor eax, eax
mov edi, 0x692ea8
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x218]
test eax, eax
je 0x4b7cea
mov edx, dword [esp + 0x21c]
push 0x692ea8
dec edx
push 0x4de3ac
push edx
push eax
call esi
add esp, 0x10
push 1
push 0x692ea8
call fcn.004c5370
add esp, 8
pop edi
mov eax, 0x692ea8
pop esi
add esp, 0x20c
ret
Function at 0x4b7d10
Capabilities:
Check if file exists
Create thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4cd71b
push eax
mov dword fs:[0], esp
sub esp, 0x424
push ebx
push ebp
push esi
mov esi, dword [esp + 0x440]
xor ebp, ebp
push edi
cmp esi, ebp
mov ebx, ecx
jne 0x4b7d46
or eax, 0xffffffff
jmp 0x4b7f48
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, 1
cmp eax, ecx
jne 0x4b7d5e
mov dword [ebx + 0x62794], ecx
jmp 0x4b7d64
mov dword [ebx + 0x62794], ebp
mov eax, dword [ebx + 0x6278c]
cmp eax, ebp
je 0x4b7d96
push 0xffffffffffffffff
push eax
mov dword [ebx + 0x62790], ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebx + 0x6278c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x6278c], ebp
mov dword [ebx + 0x62790], ebp
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x26]
mov word [esp + 0x24], bp
rep stosd dword es:[edi], eax
push esi
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x4de3ac
lea ecx, [esp + 0x2c]
push 0x103
push ecx
stosw word es:[edi], ax
call esi
lea edx, [esp + 0x34]
push ebp
push edx
call fcn.004c5370
lea edi, [ebx + 0x3d0]
push ebp
push edi
call fcn.004c5370
add esp, 0x20
lea eax, [esp + 0x24]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x4b7dfb
cmp dword [ebx + 0x14], 2
jne 0x4b7dfb
or eax, 0xffffffff
jmp 0x4b7f48
push 1
mov ecx, ebx
call fcn.004ad030
mov eax, dword [ebx + 0x62780]
cmp eax, ebp
je 0x4b7e1d
push eax
call fcn.00495c27
add esp, 4
mov dword [ebx + 0x62780], ebp
mov ecx, ebx
mov dword [ebx + 0x62784], ebp
mov dword [ebx + 0x62788], ebp
call fcn.004ab900
mov ecx, dword [esp + 0x444]
mov dword [ebx + 0x14], 2
push ecx
push 0x4de3ac
push 0x104
push edi
call esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x23e]
mov word [esp + 0x23c], bp
rep stosd dword es:[edi], eax
push ebp
push ebp
stosw word es:[edi], ax
call fcn.004b7b80
add esp, 0x18
lea edx, [esp + 0x22c]
push eax
push 0x4de3ac
push 0x104
push edx
call esi
add esp, 0x10
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [ebx + 0x62774]
mov edx, dword [ebx + 0x62778]
mov dword [esp + 0x10], eax
mov eax, edx
cmp eax, edx
mov dword [esp + 0x43c], ebp
je 0x4b7ed5
mov edi, dword [esp + 0x10]
mov ecx, 0x83
mov esi, eax
add eax, 0x20c
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x10]
add edi, 0x20c
cmp eax, edx
mov dword [esp + 0x10], edi
jne 0x4b7eb1
mov ecx, dword [ebx + 0x62778]
mov edx, dword [esp + 0x10]
push ebp
push ebp
push 1
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x30], ecx
push ebp
push eax
lea ecx, [esp + 0x244]
push 2
push ecx
mov ecx, ebx
mov dword [ebx + 0x62778], edx
call fcn.004b8a00
lea edx, [esp + 0x14]
mov ecx, ebx
push edx
call fcn.004b8240
mov ecx, ebx
call fcn.004b9d50
push ebp
push ebp
push ebx
push 0x4b7860
push ebp
push ebp
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov dword [ebx + 0x6278c], eax
mov eax, dword [esp + 0x2c]
add esp, 0x18
cmp eax, ebp
je 0x4b7f43
push eax
call fcn.00495c27
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x434]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x430
ret 4
Function at 0x4b9b80
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x62768]
test eax, eax
jne 0x4b9bb0
lea eax, [esi + 0x6276c]
push eax
push 0
push 0
push 0x4b9a80
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x62768], eax
mov eax, dword [esi + 0x62768]
pop esi
neg eax
sbb eax, eax
and eax, 2
dec eax
ret
Function at 0x4be950
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x208
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov dword [esi + 0x490], 1
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4bea5b
mov eax, dword [esp + 0x210]
test eax, eax
je 0x4bea5b
push ebx
push ebp
push edi
push 4
mov ecx, esi
call fcn.004bea70
mov edx, dword [0x5cbdcc]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
push 0x103
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
push 0xea81
push edx
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [esi + 0xc]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
lea eax, [esp + 0x10]
push eax
push 1
push ecx
call edi
mov ebp, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
call ebp
mov edx, dword [esi + 0xc]
push 1
push 1
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [esi + 0xc]
push 0
push 2
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi + 0xc]
push 0
push 0x41b
push ecx
call edi
push eax
call ebx
mov edx, dword [esi + 0xc]
push 0
push 0x41c
push edx
call edi
push eax
call ebx
mov eax, dword [esi + 0xc]
push 0
push 0x41a
push eax
call edi
push eax
call ebx
mov ecx, dword [esi + 0xc]
push 0
push 0x3ec
push ecx
call edi
push eax
call ebx
mov edx, dword [esp + 0x21c]
mov eax, dword [esi + 0xc]
push edx
push 0x419
push eax
call edi
push eax
call ebp
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x208
ret 4

Function at 0x4beaf0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x4c02c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push edi
push 1
mov esi, ecx
push 4
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 0
call ebx
add esp, 0x10
cmp eax, 1
je 0x4c0306
or eax, 0xffffffff
lea esp, [ebp - 0x254]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
push 1
lea ecx, [esi + 0x18]
push 4
push ecx
call ebx
add esp, 0x10
cmp eax, 1
je 0x4c032b
or eax, 0xffffffff
lea esp, [ebp - 0x254]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ebx, [esi + 0x1c]
mov ecx, 0x19
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov edx, dword [ebp + 8]
mov ecx, 0xc
lea edi, [ebp - 0x3f]
mov byte [ebp - 0x40], al
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push edx
push 0x32
lea eax, [ebp - 0x40]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
lea ecx, [ebp - 0x40]
add esp, 0x10
test ecx, ecx
mov dword [ebp - 4], eax
jne 0x4c036a
xor edi, edi
jmp 0x4c03a0
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.00495c50
mov edi, esp
push esi
push edi
lea eax, [ebp - 0x40]
push 0xffffffffffffffff
push eax
push 0
push 0
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [ebp - 0xc]
push edi
push 0x4de3ac
push 0x31
push ebx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
add esi, 0x288
push str.1.0.0.3
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
call esi
test eax, eax
jl 0x4c0459
lea ecx, [ebp + 8]
xor edi, edi
push ecx
mov dword [ebp + 8], edi
call fcn.004a9d50
mov eax, dword [ebp + 8]
add esp, 4
cmp eax, 2
jne 0x4c043b
mov word [ebp - 0x248], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x246]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x248]
push 0x103
push edx
stosw word es:[edi], ax
call fcn.004a1c10
mov ecx, eax
call fcn.004a7e80
lea eax, [ebp - 0x248]
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x4c0459
or eax, 0xffffffff
lea esp, [ebp - 0x254]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x4f04e0
push ebx
call esi
test eax, eax
je 0x4c0459
or eax, 0xffffffff
lea esp, [ebp - 0x254]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x254]
sub eax, 0x32
neg eax
pop edi
pop esi
sbb eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c0480
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
cmp eax, ecx
jle 0x4c04a6
mov ecx, 0x64
mov edi, dword [esi + 0x14]
add edi, ecx
mov edx, edi
mov dword [esi + 0x14], edi
cmp eax, edx
jg 0x4c0498
mov edi, dword [esi + 0x14]
lea eax, [edi + edi*4]
lea eax, [eax + eax*4]
shl eax, 7
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
xor ebx, ebx
add esp, 4
or ebp, 0xffffffff
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x4c0575
dec edi
cmp edi, ebx
jl 0x4c0571
inc edi
lea edx, [eax + 0x48]
mov dword [esp + 0x10], edi
mov ecx, 0x28b
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, 0x30e
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, 0x30e
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [edx - 0x2c]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
lea eax, [edx - 0x1c]
add edx, 0xc80
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x10]
mov dword [edx - 0xcc8], ebp
mov dword [edx - 0xcc4], ebp
mov dword [edx - 0xcc0], ebx
mov dword [edx - 0xcb4], ebx
mov dword [edx - 0xcbc], 1
mov dword [edx - 0xcb8], ebx
mov dword [edx - 0xc84], ebp
mov dword [edx - 0xc88], ebp
mov dword [edx - 0xc8c], ebp
mov dword [edx - 0xcb0], ebx
dec eax
mov dword [esp + 0x10], eax
jne 0x4c04dd
mov eax, dword [esp + 0x14]
mov edi, eax
jmp 0x4c0577
xor edi, edi
cmp edi, ebx
mov dword [esi + 0x10], edi
jne 0x4c058a
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [esi + 0x14]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
xor eax, eax
shl ecx, 7
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x18]
cmp eax, 0x2710
jge 0x4c05db
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 0x10]
push ecx
push eax
push 0xc80
push edx
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esi + 0x18]
add esp, 0x10
cmp eax, ecx
je 0x4c0611
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 0x10]
push eax
push 0x2710
push 0xc80
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 0x2710
je 0x4c060a
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov dword [esi + 0x18], 0x2710
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 4
Function at 0x4c18d0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
push 0x4e89fc
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov ebx, eax
add esp, 8
test ebx, ebx
mov edi, 3
jne 0x4c18fb
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push ebx
call esi
push ebx
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push ebx
mov ebp, eax
call esi
add esp, 0x1c
test ebp, ebp
jle 0x4c19a5
lea edi, [ebp + 2]
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x4c1942
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
ret 4
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebx
and ecx, 3
push 1
push ebp
push esi
rep stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_fread]
xor eax, eax
add esp, 0x10
mov ah, byte [esi + 1]
mov al, byte [esi]
mov edi, eax
cmp di, 0xbbef
jne 0x4c197a
cmp byte [esi + 2], 0xbf
je 0x4c1988
push ebp
push esi
call fcn.004c1870
add esp, 8
test eax, eax
je 0x4c198f
mov edi, 2
jmp 0x4c199b
xor ecx, ecx
cmp di, 0xfeff
sete cl
mov edi, ecx
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4c19c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x21c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x22c]
push edi
xor ebp, ebp
push esi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], ebp
call fcn.004c1730
mov ebx, eax
test esi, esi
mov dword [esp + 0x20], ebx
je 0x4c1b7a
mov ax, word [0x4f04e0]
mov ecx, 0x81
mov word [esp + 0x24], ax
xor eax, eax
lea edi, [esp + 0x26]
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
push ecx
push 0x4de3ac
push 0x103
push edx
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x4e89fc
push esi
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x4c1b7a
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push ebp
push esi
call edi
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push esi
mov ebp, eax
call edi
lea edi, [ebp + 1]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, eax
add esp, 0x20
test edx, edx
mov dword [esp + 0x14], edx
je 0x4c1b5f
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor edi, edi
cmp ebx, 1
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
jne 0x4c1ac2
push esi
push 1
lea eax, [esp + 0x1b]
push 1
push eax
call ebx
mov al, byte [esp + 0x23]
add esp, 0x10
cmp al, 0x3c
je 0x4c1ac2
push esi
push 1
lea ecx, [esp + 0x1b]
push 1
push ecx
call ebx
mov al, byte [esp + 0x23]
add esp, 0x10
inc edi
cmp al, 0x3c
jne 0x4c1aaa
push 0
push edi
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
mov eax, dword [esp + 0x20]
mov edx, ebp
push esi
sub edx, edi
push 1
push edx
push eax
call ebx
lea ecx, [ebp + ebp*2]
lea edx, [ecx + ecx + 2]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 0x20
test ebx, ebx
je 0x4c1b52
lea ebp, [ebp + ebp*2]
xor eax, eax
mov edi, ebx
push ebp
lea ecx, [ebp + 1]
push ebx
mov edx, ecx
push 0xffffffffffffffff
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
cmp dword [esp + 0x2c], 1
jne 0x4c1b24
mov eax, dword [esp + 0x20]
push eax
push 0
push 0xfde9
jmp 0x4c1b2d
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [esp + 0x234]
mov ecx, dword [esp + 0x1c]
push edx
push ebx
call fcn.004c1100
push ebx
mov dword [esp + 0x1c], eax
call fcn.00495c27
add esp, 4
mov eax, dword [esp + 0x14]
push eax
call fcn.00495c27
add esp, 4
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret 8
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret 8
Function at 0x4c2750
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
push esi
mov esi, ecx
push edi
push 0
push 0x3eb
mov eax, dword [esi + 0x68]
push eax
call ebx
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
mov ecx, dword [esi + 0x68]
push 0
push 0x3ef
push ecx
call ebx
push eax
call edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea edx, [esp + 0x10]
push 0x103
stosw word es:[edi], ax
mov eax, dword [0x5cbdcc]
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push edx
push 0xea81
push eax
call edi
mov edx, dword [esi + 0x68]
lea ecx, [esp + 0x10]
push ecx
push 2
push edx
call ebx
mov ebp, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
call ebp
mov eax, dword [esi + 0x74]
push 0x103
test eax, eax
je 0x4c27f0
mov ecx, dword [0x5cbdcc]
lea eax, [esp + 0x14]
push eax
push 0xea82
push ecx
jmp 0x4c2800
mov eax, dword [0x5cbdcc]
lea edx, [esp + 0x14]
push edx
push 0xea8e
push eax
call edi
mov edx, dword [esi + 0x68]
lea ecx, [esp + 0x10]
push ecx
push 0x419
push edx
call ebx
push eax
call ebp
mov dword [esi + 0x60], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret

Function at 0x4c2830
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push esi
mov esi, ecx
push edi
push 0
mov eax, dword [esi + 0x68]
push 0x423
push eax
call ebx
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
mov ecx, dword [esi + 0x68]
push 0
push 0x424
push ecx
call ebx
push eax
call edi
mov edx, dword [esi + 0x68]
push 0
push 0x410
push edx
call ebx
push eax
call edi
mov eax, dword [esi + 0x68]
push 0
push 0x40f
push eax
call ebx
push eax
call edi
mov ecx, dword [esi + 0x68]
push 0
push 0x411
push ecx
call ebx
push eax
call edi
mov edx, dword [esi + 0x68]
push 0
push 0x412
push edx
call ebx
push eax
call edi
mov eax, dword [esi + 0x68]
push 0
push 1
push eax
call ebx
push eax
call edi
mov ecx, dword [esi + 0x68]
push 0
push 0x420
push ecx
call ebx
push eax
call edi
mov edx, dword [esi + 0x68]
push 0
push 0x3ee
push edx
call ebx
push eax
call edi
mov eax, dword [esi + 0x68]
push 5
push 0x3eb
push eax
mov dword [esi + 0x78], 0
call ebx
push eax
call edi
mov ecx, dword [esi + 0x68]
push 5
push 0x3ef
push ecx
call ebx
push eax
call edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x74]
push 0x103
test eax, eax
je 0x4c292f
mov eax, dword [0x5cbdcc]
lea edx, [esp + 0x10]
push edx
push 0xea8b
push eax
jmp 0x4c2940
mov edx, dword [0x5cbdcc]
lea ecx, [esp + 0x10]
push ecx
push 0xea8c
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [esi + 0x68]
lea eax, [esp + 0xc]
push eax
push 0x419
push ecx
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x4c2970
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x208
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x74]
test eax, eax
je 0x4c29b8
mov eax, dword [esi + 0x68]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x423
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi + 0x68]
push 0
push 0x424
push ecx
call edi
push eax
call ebx
pop edi
pop esi
pop ebx
add esp, 0x208
ret
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
push ebp
lea edx, [esp + 0x10]
push 0x103
stosw word es:[edi], ax
mov eax, dword [0x5cbdcc]
push edx
push 0xea85
push eax
call ebx
mov edx, dword [esi + 0x68]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [esp + 0x10]
push ecx
push 0x419
push edx
call edi
mov ebp, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
call ebp
mov ecx, dword [0x5cbdcc]
lea eax, [esp + 0x10]
push 0x103
push eax
push 0xea86
push ecx
call ebx
mov eax, dword [esi + 0x68]
lea edx, [esp + 0x10]
push edx
push eax
call ebp
mov edx, dword [0x5cbdcc]
lea ecx, [esp + 0x10]
push 0x103
push ecx
push 0xea87
push edx
call ebx
mov ecx, dword [esi + 0x68]
lea eax, [esp + 0x10]
push eax
push 1
push ecx
call edi
push eax
call ebp
mov edx, dword [esi + 0x68]
push 0
push 0x411
push edx
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov eax, dword [esi + 0x68]
push 0
push 0x412
push eax
call edi
push eax
call ebx
mov ecx, dword [esi + 0x68]
push 0
push 0x420
push ecx
call edi
push eax
call ebx
mov edx, dword [esi + 0x68]
push 0
push 0x3ee
push edx
call edi
push eax
call ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x208
ret

Function at 0x4c2f90
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x208
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x5c]
cmp eax, 2
je 0x4c2fdd
test eax, eax
je 0x4c2fdd
mov eax, dword [esi + 0x68]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x411
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi + 0x68]
push 0
push 0x412
push ecx
call edi
push eax
call ebx
pop edi
pop esi
pop ebx
add esp, 0x208
ret
mov edx, dword [esi + 0x68]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push 0x411
push edx
call ebx
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
mov eax, dword [esi + 0x68]
push 5
push 0x412
push eax
call ebx
push eax
call edi
cmp dword [esi + 0x5c], 2
jne 0x4c302f
mov ecx, dword [esi + 0x68]
push 0
push 0x412
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
lea edx, [esp + 0xc]
push edx
stosw word es:[edi], ax
call fcn.004c53d0
mov ecx, dword [esi + 0x68]
add esp, 4
lea eax, [esp + 0xc]
push eax
push 0x411
push ecx
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x4c3080
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [ecx + 0x5c]
test eax, eax
je 0x4c30ab
cmp eax, 1
jne 0x4c30a6
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push str.bookmarks.dat
push ecx
push edx
call fcn.00496500
add esp, 0xc
ret 8
cmp eax, 2
jne 0x4c30cc
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
dec eax
push eax
mov eax, dword [ecx + 0x68]
push edx
push 0x411
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
ret 8