joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48507e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
cmp esi, 0x110
je 0x4850a5
cmp esi, 0x10
je 0x4850a5
cmp esi, 0x111
jne 0x48525d
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
call fcn.0045f8bd
mov byte [ebp - 4], al
test edi, edi
je 0x4850bc
lea eax, [edi + 4]
jmp 0x4850be
xor eax, eax
mov dword [ebp - 8], eax
sub esi, 0x10
je 0x48524d
sub esi, 0x100
je 0x4851b6
dec esi
jne 0x48525d
mov ebx, dword [ebp + 0x10]
and ebx, 0xffff
cmp ebx, 2
jne 0x485105
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [edi + 0x127c]
call fcn.00430ea5
jmp 0x48525d
xor esi, esi
inc esi
cmp ebx, esi
je 0x485156
cmp ebx, 0xf5
je 0x485156
cmp ebx, 0xfa
jne 0x48525d
mov ecx, edi
call fcn.0045f8bd
test al, al
je 0x4851af
push ebx
lea ecx, [ebp - 0xc]
call fcn.00484aba
movzx ecx, al
push ecx
push 0xfb
push dword [ebp + 8]
mov byte [edi + 0x47], al
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x4851af
lea ecx, [ebp - 0xc]
call fcn.00484dd3
cmp byte [edi + 0x4c], 0
je 0x485179
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [edi + 0x127c]
call fcn.00430ea5
cmp ebx, 0xf5
jne 0x48518b
lea ecx, [edi + 4]
mov eax, dword [ecx]
push 0
call dword [eax + 0x24]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ebx, ax
lea ecx, [edi + 4]
mov al, byte [edi + 0x3d]
mov edx, dword [ecx]
shr ebx, 0x1f
and bl, 1
push esi
xor al, bl
push esi
movzx eax, al
push eax
call dword [edx + 0x1c]
mov eax, esi
jmp 0x48525f
push ebx
mov ecx, edi
call fcn.00481901
lea ecx, [ebp - 0xc]
call fcn.00484f64
mov ecx, edi
call fcn.0045f8bd
test al, al
je 0x485248
movzx eax, byte [edi + 0x47]
lea ecx, [ebp - 0xc]
push eax
mov esi, 0xfb
push esi
call fcn.00484a91
movzx eax, byte [edi + 0x47]
push eax
push esi
push dword [ebp - 0xc]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
call esi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 1
push 3
push 0xc5
push 0xfb
push dword [ebp - 0xc]
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lea esi, [edi + 0x744]
push eax
push eax
push eax
push eax
push 0x7d8
mov ecx, esi
call fcn.004108a6
push eax
push 0x7da
mov ecx, esi
call fcn.004108a6
push eax
push 0xfb
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor eax, eax
inc eax
jmp 0x48525f
push 0
push 2
push 0x111
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4853b3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
cmp esi, 0x110
je 0x4853da
cmp esi, 0x10
je 0x4853da
cmp esi, 0x111
jne 0x485567
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
call fcn.0045f8bd
mov byte [ebp - 4], al
test edi, edi
je 0x4853f1
lea eax, [edi + 4]
jmp 0x4853f3
xor eax, eax
mov dword [ebp - 8], eax
sub esi, 0x10
je 0x485557
sub esi, 0x100
je 0x4854b7
dec esi
jne 0x485567
mov esi, dword [ebp + 0x10]
and esi, 0xffff
cmp esi, 2
jne 0x48545a
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x4d3406
push str.Replacements
lea ecx, [edi + 0xa7c]
call fcn.0045194d
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x34]
push esi
push ebx
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [edi + 0x127c]
call fcn.00430ea5
jmp 0x485567
cmp esi, 0xfa
jne 0x485498
mov ecx, edi
call fcn.0045f8bd
test al, al
je 0x485490
push esi
lea ecx, [ebp - 0xc]
call fcn.00484aba
mov byte [edi + 0x47], al
movzx eax, al
push eax
push 0xfb
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
inc eax
jmp 0x485569
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
mov ecx, edi
shr eax, 0x1f
and eax, 0xffffff01
push eax
push esi
call fcn.0048528a
jmp 0x485569
push ebx
mov ecx, edi
call fcn.00481901
lea ecx, [ebp - 0xc]
call fcn.00484f64
mov ecx, edi
call fcn.0045f8bd
test al, al
je 0x48551e
movzx eax, byte [edi + 0x47]
push eax
push 0xfb
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
lea esi, [edi + 0x744]
push eax
push eax
push eax
push eax
push 0x7d8
mov ecx, esi
call fcn.004108a6
push eax
push 0x7da
mov ecx, esi
call fcn.004108a6
push eax
push 0xfb
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemInt]
cmp dword [edi + 0x18], 0
je 0x485490
push 1
push str.find.replacewith.focus
lea ecx, [edi + 0xa7c]
call fcn.00452214
test eax, eax
je 0x485490
push 0xe7
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x485567
push 0
push 2
push 0x111
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x486149
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4beed9
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x4fc504]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov eax, dword [0x4fc504]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, ecx
push 1
call fcn.0045f4d0
mov edi, dword [esi + 0x1278]
lea eax, [esi + 8]
test edi, edi
je 0x4861b5
push eax
push 0xde
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.00484a42
push edi
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x4862a4
cmp dword [eax + 0x14], 0x10
jb 0x4861bd
mov eax, dword [eax]
or ebx, 0xffffffff
lea edi, [esi + 0xa7c]
push ebx
push ebx
push eax
push str.find.what
mov ecx, edi
call fcn.0045194d
push str.find.in.directory
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
call fcn.00451b02
and dword [esp + 0x70], 0
cmp dword [esp + 0x28], 0
je 0x486212
cmp dword [esp + 0x2c], 0x10
mov eax, dword [esp + 0x18]
jae 0x486201
lea eax, [esp + 0x18]
push ebx
push ebx
push eax
push str.find.directory
mov ecx, edi
call fcn.0045194d
jmp 0x48626b
lea eax, [esp + 0x30]
push eax
lea ecx, [esi + 0x254]
call fcn.0042eae9
lea eax, [esp + 0x48]
mov byte [esp + 0x70], 1
push eax
lea ecx, [esp + 0x34]
call fcn.0042e93d
mov byte [esp + 0x70], 2
cmp dword [eax + 0x14], 0x10
jb 0x486242
mov eax, dword [eax]
push ebx
push ebx
push eax
push str.find.directory
mov ecx, edi
call fcn.0045194d
push 0
push 1
lea ecx, [esp + 0x50]
call fcn.0040177c
push 0
push 1
lea ecx, [esp + 0x38]
call fcn.0040f05a
push esi
push 0x486127
push dword [esi + 0x73c]
push str.Grep
push dword [0x50740c]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 4
push eax
mov dword [esi + 0x1278], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.0040177c
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.004906a0
mov esp, ebp
pop ebp
ret

Function at 0x48981a
Capabilities:
Get graphical window text

Disassembly:
push 0x48
mov eax, 0x4bf101
call fcn.004b6a29
mov ebx, ecx
mov edi, dword [ebp + 8]
and dword [ebp - 0x54], 0
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [ebp - 0x50]
lea esi, [eax + 1]
push esi
call fcn.0042faa8
and dword [ebp - 4], 0
xor eax, eax
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
push esi
mov byte [ebp - 4], 1
push dword [ebp - 0x50]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x48988a
push dword [ebp - 0x50]
lea ecx, [ebp - 0x44]
call fcn.0042f8f2
push eax
lea ecx, [ebp - 0x2c]
call fcn.0046a19c
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.0040f05a
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x489896
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x44]
call fcn.0042f8f2
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 2
mov ecx, ebx
call fcn.00430d1e
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.0040f05a
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040f05a
lea ecx, [ebp - 0x50]
call fcn.004028f1
mov eax, ebx
call fcn.004b69d8
ret
Function at 0x489a15
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4fc504]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
push 1
push eax
lea eax, [ebp - 0x1c]
mov ecx, dword [edi + 8]
push eax
mov edx, dword [ecx]
call dword [edx]
cmp dword [ebp - 8], 8
mov edx, dword [ebp - 0x1c]
jae 0x489a4a
lea edx, [ebp - 0x1c]
mov ecx, dword [edi + 0xc]
call fcn.004896fb
mov esi, dword [ebp - 0x1c]
add eax, 4
xor ecx, ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 8], 8
mov dword [ebx], ecx
mov eax, dword [edi + 4]
mov dword [ebp - 0x24], eax
jae 0x489a6e
lea esi, [ebp - 0x1c]
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0
push dword [ebp - 0x24]
push 0x15
push dword [ebp - 0x20]
push 2
push 2
push 0x44000002
push esi
push 0x4edfb0
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push esi
mov dword [ebx], eax
push dword [edi + 0xc]
push 0x30
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push 1
lea ecx, [ebp - 0x1c]
call fcn.0040f05a
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004906a0
mov esp, ebp
pop ebp
ret 8
Function at 0x489ed5
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1f4c
call fcn.004a2e90
mov eax, dword [0x4fc504]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp byte [edi + 0x34], 0
jne 0x489efc
xor al, al
jmp 0x489ffb
push ebx
mov ebx, dword [ebp + 8]
push esi
cmp ebx, 9
je 0x48a05b
cmp ebx, 0x12
je 0x48a044
cmp ebx, 0x1b
je 0x48a03d
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jns 0x489ff7
push 5
push dword [edi + 4]
mov edi, dword [sym.imp.USER32.dll_GetWindow]
jmp 0x489feb
push 0x7d0
lea eax, [ebp - 0x1f44]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [ebp - 0x1f44]
push str.Button
push eax
call fcn.00496071
pop ecx
pop ecx
test eax, eax
je 0x489f7e
lea eax, [ebp - 0x1f44]
push 0x4edfb0
push eax
call fcn.00496071
pop ecx
pop ecx
test eax, eax
jne 0x489fe8
push 0x7d0
lea eax, [ebp - 0xfa4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x1f4c], edx
cmp word [ebp - 0xfa4], cx
je 0x489fe8
lea eax, [ebp - 0xfa4]
cmp word [eax], 0x26
jne 0x489fc9
movzx eax, word [ebp + ecx - 0xfa2]
push eax
call fcn.00494115
pop ecx
cmp eax, ebx
je 0x48a00c
mov edx, dword [ebp - 0x1f4c]
inc edx
lea eax, [ebp - 0xfa4]
xor edi, edi
mov dword [ebp - 0x1f4c], edx
lea ecx, [edx + edx]
add eax, ecx
cmp word [eax], di
mov edi, dword [sym.imp.USER32.dll_GetWindow]
jne 0x489faa
push 2
push esi
call edi
mov esi, eax
test esi, esi
jne 0x489f3d
xor al, al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004906a0
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x1f44]
push str.Button
push eax
call fcn.00496071
pop ecx
pop ecx
test eax, eax
jne 0x48a036
push eax
push eax
push 0xf5
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x48a0b6
push 2
push esi
call edi
jmp 0x48a0af
mov eax, dword [edi]
call dword [eax + 0xc]
jmp 0x48a0b6
push 0
push 0x30002
push 0x128
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x489ff7
mov esi, dword [edi + 4]
mov ebx, dword [sym.imp.USER32.dll_GetFocus]
call ebx
push eax
push esi
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x489ff7
push 0
push 0x30002
push 0x128
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov esi, dword [edi + 4]
cwde
shr eax, 0x1f
not al
and al, 1
push 0
pop eax
sete al
push eax
call ebx
push eax
push esi
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
test eax, eax
je 0x48a0b6
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov al, 1
jmp 0x489ff9
Function at 0x48a958
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
call fcn.00489e1e
mov esi, dword [esi + 4]
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push edi
push esi
push 0x15
push 0x64
push 2
push 2
push 0x44000000
push 0x4d8a44
push 0x4edfb0
push edi
mov edi, dword [sym.imp.USER32.dll_CreateWindowExW]
call edi
mov esi, dword [ebp - 4]
push 4
push eax
mov dword [esi + 0x38], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0xc]
push 0x30
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [esi + 4]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0
push esi
push 0x15
push 0x64
push 2
push 2
push 0x54000000
push 0x4d8a44
push str.msctls_progress32
push 0
call edi
mov esi, dword [ebp - 4]
pop edi
mov dword [esi + 0x3c], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48b421
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp byte [edi + 0x34], 0
je 0x48b48f
push dword [ebp + 8]
call fcn.00489ed5
test al, al
je 0x48b43d
mov al, 1
jmp 0x48b491
cmp dword [ebp + 8], 0xd
jne 0x48b48f
push esi
mov esi, dword [edi + 4]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
push esi
call dword [sym.imp.USER32.dll_IsChild]
pop esi
test eax, eax
je 0x48b48f
cmp dword [edi + 0x5c], 0
jne 0x48b47d
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
mov ecx, edi
shr eax, 0x1f
and al, 1
movzx eax, al
push eax
push 0
call fcn.0048b496
jmp 0x48b439
mov eax, dword [edi + 0x38]
cmp byte [eax + 0x48], 0
je 0x48b439
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
jmp 0x48b439
xor al, al
pop edi
pop ebp
ret 4

Function at 0x48b496
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bed5d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4fc504]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
mov eax, dword [0x4fc504]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push dword [esi + 0x44]
lea ecx, [esp + 0xc]
call fcn.0048981a
pop ecx
mov edx, eax
and dword [esp + 0x30], 0
cmp dword [edx + 0x14], 0x10
jb 0x48b4e9
mov edx, dword [edx]
mov ecx, dword [esi + 0x38]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
or dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 8]
push 0
push 1
call fcn.0040177c
cmp byte [ebp + 8], 0
je 0x48b514
mov ecx, dword [esi + 0x38]
push 0
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, dword [esi + 0x38]
push 1
push 1
mov al, byte [ecx + 0x39]
xor al, byte [ebp + 0xc]
mov edx, dword [ecx]
movzx eax, al
push eax
call dword [edx + 0x1c]
mov eax, dword [esi + 0x38]
cmp byte [eax + 0x48], 0
je 0x48b53a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004906a0
mov esp, ebp
pop ebp
ret 8
Function at 0x48b85f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x10], ebx
call fcn.0048ab7d
push str.Find:
lea eax, [esp + 0x18]
mov dword [ebx + 0x30], 0x17
push eax
mov ecx, ebx
call fcn.00489a15
mov esi, dword [ebx + 4]
xor edi, edi
push edi
push edi
mov eax, dword [eax]
mov dword [ebx + 0x40], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0xde
push esi
push 0x50
push 0x12c
push 2
push 0x32
push 0x44010042
push 0x4d8a44
push str.ComboBox
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push edi
lea esi, [ebx + 0x44]
mov dword [esi], eax
push dword [ebx + 0xc]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0x30
push eax
call ebx
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 4
push dword [esi]
call edi
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.00430ecc
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
add eax, 3
push str.Replace:
mov ecx, esi
mov dword [esi + 0x30], eax
lea eax, [esp + 0x18]
push eax
call fcn.00489a15
push 0
push 0
mov eax, dword [eax]
mov dword [esi + 0x68], eax
mov esi, dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0xe7
push esi
push 0x50
push 0x12c
push 2
push 0x32
push 0x40010042
push 0x4d8a44
push str.ComboBox
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, dword [esp + 0x10]
push 0
mov dword [esi + 0x6c], eax
push dword [esi + 0xc]
push 0x30
push eax
call ebx
push 4
push dword [esi + 0x6c]
call edi
xor ebx, ebx
lea eax, [esp + 0x14]
push ebx
xor edi, edi
mov ecx, esi
inc edi
push edi
push str.Find_Next
push eax
call fcn.00489b42
push ebx
push 0xec
push str.Replace
mov eax, dword [eax]
mov ecx, esi
mov dword [esi + 0x60], eax
lea eax, [esp + 0x20]
push eax
call fcn.00489b42
push ebx
push 0xed
push str.Replace_All
mov eax, dword [eax]
mov ecx, esi
mov dword [esi + 0x70], eax
lea eax, [esp + 0x20]
push eax
call fcn.00489b42
push ebx
push 0xee
push str.In_Selection
mov eax, dword [eax]
mov ecx, esi
mov dword [esi + 0x64], eax
lea eax, [esp + 0x20]
push eax
call fcn.00489b42
push edi
mov ecx, esi
mov eax, dword [eax]
mov dword [esi + 0x74], eax
lea eax, [esp + 0x18]
push dword [0x505228]
push dword [0x505220]
push eax
call fcn.00489b42
push edi
mov ecx, esi
mov eax, dword [eax]
mov dword [esi + 0x48], eax
lea eax, [esp + 0x18]
push dword [0x505240]
push dword [0x505238]
push eax
call fcn.00489b42
push edi
mov ecx, esi
mov eax, dword [eax]
mov dword [esi + 0x50], eax
lea eax, [esp + 0x18]
push dword [0x505234]
push dword [0x50522c]
push eax
call fcn.00489b42
push edi
mov ecx, esi
mov eax, dword [eax]
mov dword [esi + 0x4c], eax
lea eax, [esp + 0x18]
push dword [0x50524c]
push dword [0x505244]
push eax
call fcn.00489b42
push edi
mov eax, dword [eax]
mov dword [esi + 0x54], eax
push dword [0x505258]
push dword [0x505250]
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.00489b42
pop edi
mov eax, dword [eax]
mov dword [esi + 0x58], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48d165
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov dl, byte [ebp + 8]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov eax, dword [esi]
mov byte [eax + 0x7c1], dl
test dl, dl
je 0x48d1ae
lea eax, [esi + 0xc]
cmp dword [eax + 0x14], 8
jb 0x48d188
mov eax, dword [eax]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 8], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
je 0x48d1aa
call esi
cmp eax, 5
jne 0x48d1b7
mov bl, 1
jmp 0x48d1b7
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test bl, bl
pop esi
sete al
pop ebx
pop ebp
ret 4

Function at 0x48d8fd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x48da7d
cmp dword [esi], 0
jne 0x48d926
push eax
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
jmp 0x48da75
cmp dword [esi], 3
jne 0x48d94f
xor ebx, ebx
inc ebx
cmp byte [esi + 0x10], 0
je 0x48d945
push eax
push ebx
push 3
push 0x4d588d
call fcn.00495039
add esp, 0x10
push dword [esi + 4]
mov byte [esi + 0x10], 0
push ebx
jmp 0x48d91b
mov edi, dword [ebp + 0xc]
push 2
pop ecx
cmp edi, dword [esi + 0xc]
jbe 0x48d984
push dword [esi + 8]
mov dword [esi + 0xc], edi
call fcn.0049075e
xor ecx, ecx
lea eax, [edi + 1]
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004907d4
pop ecx
pop ecx
push 2
mov dword [esi + 8], eax
pop ecx
xor ebx, ebx
inc ebx
cmp byte [esi + 0x10], 0
je 0x48d9b1
mov eax, dword [esi]
cmp eax, ebx
je 0x48d997
cmp eax, ecx
jne 0x48d9ad
push dword [esi + 4]
imul eax, eax, 3
push ebx
push ecx
add eax, 0x4d5884
push eax
call fcn.00495039
add esp, 0x10
mov byte [esi + 0x10], 0
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
add eax, edi
mov dword [ebp - 4], eax
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
call fcn.0048daa5
mov edi, dword [esi + 8]
jmp 0x48da5e
cmp dword [ebp - 0x14], 0
jne 0x48da56
mov eax, dword [ebp - 0x10]
cmp eax, 0x10000
jl 0x48da3b
add eax, 0xffff0000
mov ecx, eax
sar ecx, 0xa
add ecx, 0xd800
cmp dword [esi], ebx
jne 0x48da0d
movzx edx, cl
shl edx, 8
sar ecx, 8
add edx, ecx
jmp 0x48da0f
mov edx, ecx
mov word [edi], dx
and eax, 0x3ff
push 2
pop edx
add edi, edx
add eax, 0xdc00
cmp dword [esi], ebx
jne 0x48da32
movzx ecx, al
shl ecx, 8
sar eax, 8
add ecx, eax
jmp 0x48da34
mov ecx, eax
mov word [edi], cx
add edi, edx
jmp 0x48da56
cmp dword [esi], ebx
jne 0x48da4c
movzx ecx, al
shl ecx, 8
sar eax, 8
add ecx, eax
jmp 0x48da4e
mov ecx, eax
push 2
pop eax
mov word [edi], cx
add edi, eax
lea ecx, [ebp - 0x18]
call fcn.0048daa5
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jbe 0x48d9dc
push dword [esi + 4]
sub edi, dword [esi + 8]
push ebx
push edi
push dword [esi + 8]
call fcn.00495039
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b2aea
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4fc504]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0049ca7f
mov dword [ebp - 0x14], eax
cmp dword [0x5071a0], esi
jne 0x4b2bdd
push 0x800
push esi
push 0x4d0b24
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4b2b6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4b2cbd
push esi
push esi
push 0x4d0b24
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4b2cbd
push 0x4d0b3c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b2cbd
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x5071a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x5071a4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x4d0b6c
push edi
mov dword [0x5071a8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5071b0], eax
test eax, eax
je 0x4b2bda
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5071ac], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4b2c02
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4b2bf5
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4b2c17
push 4
pop eax
jmp 0x4b2cbf
cmp dword [ebp - 0x14], esi
je 0x4b2c17
push dword [0x5071a0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4b2bfc
mov eax, dword [0x5071ac]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4b2c75
cmp dword [0x5071b0], edi
je 0x4b2c75
push eax
call ebx
push dword [0x5071b0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4b2c75
test eax, eax
je 0x4b2c75
call ecx
test eax, eax
je 0x4b2c6a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4b2c6a
test byte [ebp - 8], 1
jne 0x4b2c75
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4b2ca5
mov eax, dword [0x5071a4]
cmp eax, edi
je 0x4b2ca2
push eax
call ebx
test eax, eax
je 0x4b2ca2
call eax
mov esi, eax
test esi, esi
je 0x4b2ca2
mov eax, dword [0x5071a8]
cmp eax, edi
je 0x4b2ca2
push eax
call ebx
test eax, eax
je 0x4b2ca2
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x5071a0]
call ebx
test eax, eax
je 0x4b2cbd
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4b2cbf
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004906a0
mov esp, ebp
pop ebp
ret