joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ce300
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push esi
lea eax, [esp + 4]
push edi
push eax
mov dword [esp + 0xc], 0
call fcn.004c05d0
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 4
test eax, eax
jne 0x4ce389
push 0
push 6
push 0x6b38c8
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4ce446
push 1
push 0x6b38c8
call fcn.004db580
mov eax, dword [esp + 0x220]
add esp, 8
test eax, eax
je 0x4ce479
mov ecx, dword [esp + 0x21c]
push 0x6b38c8
dec ecx
push 0x4f6574
push ecx
push eax
call esi
add esp, 0x10
mov eax, 0x6b38c8
pop edi
pop esi
add esp, 0x20c
ret
cmp eax, 3
jne 0x4ce438
push 1
push 0x104
push 0x6b38c8
call fcn.004cdfd0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], 0
add esp, 0xc
lea edx, [esp + 0xc]
rep stosd dword es:[edi], eax
push 0x6b38c8
push 0x4f6574
push 0x103
push edx
stosw word es:[edi], ax
call esi
push 0x6b38c8
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0x14
test eax, eax
jne 0x4ce446
push eax
push 6
push 0x6b38c8
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4ce446
push 1
push 0x6b38c8
call fcn.004db580
mov eax, dword [esp + 0x220]
add esp, 8
test eax, eax
je 0x4ce479
mov ecx, dword [esp + 0x21c]
push 0x6b38c8
dec ecx
push 0x4f6574
push ecx
push eax
call esi
add esp, 0x10
mov eax, 0x6b38c8
pop edi
pop esi
add esp, 0x20c
ret
mov ecx, 0x82
xor eax, eax
mov edi, 0x6b38c8
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x218]
test eax, eax
je 0x4ce46a
mov edx, dword [esp + 0x21c]
push 0x6b38c8
dec edx
push 0x4f6574
push edx
push eax
call esi
add esp, 0x10
push 1
push 0x6b38c8
call fcn.004db580
add esp, 8
pop edi
mov eax, 0x6b38c8
pop esi
add esp, 0x20c
ret
Function at 0x4ce490
Capabilities:
Check if file exists
Create thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e3efb
push eax
mov dword fs:[0], esp
sub esp, 0x424
push ebx
push ebp
push esi
mov esi, dword [esp + 0x440]
xor ebp, ebp
push edi
cmp esi, ebp
mov ebx, ecx
jne 0x4ce4c6
or eax, 0xffffffff
jmp 0x4ce6c8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, 1
cmp eax, ecx
jne 0x4ce4de
mov dword [ebx + 0x62794], ecx
jmp 0x4ce4e4
mov dword [ebx + 0x62794], ebp
mov eax, dword [ebx + 0x6278c]
cmp eax, ebp
je 0x4ce516
push 0xffffffffffffffff
push eax
mov dword [ebx + 0x62790], ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebx + 0x6278c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x6278c], ebp
mov dword [ebx + 0x62790], ebp
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x26]
mov word [esp + 0x24], bp
rep stosd dword es:[edi], eax
push esi
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x4f6574
lea ecx, [esp + 0x2c]
push 0x103
push ecx
stosw word es:[edi], ax
call esi
lea edx, [esp + 0x34]
push ebp
push edx
call fcn.004db580
lea edi, [ebx + 0x3d0]
push ebp
push edi
call fcn.004db580
add esp, 0x20
lea eax, [esp + 0x24]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x4ce57b
cmp dword [ebx + 0x14], 2
jne 0x4ce57b
or eax, 0xffffffff
jmp 0x4ce6c8
push 1
mov ecx, ebx
call fcn.004c38f0
mov eax, dword [ebx + 0x62780]
cmp eax, ebp
je 0x4ce59d
push eax
call fcn.004ace19
add esp, 4
mov dword [ebx + 0x62780], ebp
mov ecx, ebx
mov dword [ebx + 0x62784], ebp
mov dword [ebx + 0x62788], ebp
call fcn.004c21c0
mov ecx, dword [esp + 0x444]
mov dword [ebx + 0x14], 2
push ecx
push 0x4f6574
push 0x104
push edi
call esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x23e]
mov word [esp + 0x23c], bp
rep stosd dword es:[edi], eax
push ebp
push ebp
stosw word es:[edi], ax
call fcn.004ce300
add esp, 0x18
lea edx, [esp + 0x22c]
push eax
push 0x4f6574
push 0x104
push edx
call esi
add esp, 0x10
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [ebx + 0x62774]
mov edx, dword [ebx + 0x62778]
mov dword [esp + 0x10], eax
mov eax, edx
cmp eax, edx
mov dword [esp + 0x43c], ebp
je 0x4ce655
mov edi, dword [esp + 0x10]
mov ecx, 0x83
mov esi, eax
add eax, 0x20c
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x10]
add edi, 0x20c
cmp eax, edx
mov dword [esp + 0x10], edi
jne 0x4ce631
mov ecx, dword [ebx + 0x62778]
mov edx, dword [esp + 0x10]
push ebp
push ebp
push 1
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x30], ecx
push ebp
push eax
lea ecx, [esp + 0x244]
push 2
push ecx
mov ecx, ebx
mov dword [ebx + 0x62778], edx
call fcn.004cf180
lea edx, [esp + 0x14]
mov ecx, ebx
push edx
call fcn.004ce9c0
mov ecx, ebx
call fcn.004d05b0
push ebp
push ebp
push ebx
push 0x4cdfb0
push ebp
push ebp
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov dword [ebx + 0x6278c], eax
mov eax, dword [esp + 0x2c]
add esp, 0x18
cmp eax, ebp
je 0x4ce6c3
push eax
call fcn.004ace19
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x434]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x430
ret 4
Function at 0x4d03e0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x62768]
test eax, eax
jne 0x4d0410
lea eax, [esi + 0x6276c]
push eax
push 0
push 0
push 0x4d02e0
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x62768], eax
mov eax, dword [esi + 0x62768]
pop esi
neg eax
sbb eax, eax
and eax, 2
dec eax
ret
Function at 0x4d47d0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x208
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov dword [esi + 0x490], 1
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4d48db
mov eax, dword [esp + 0x210]
test eax, eax
je 0x4d48db
push ebx
push ebp
push edi
push 4
mov ecx, esi
call fcn.004d48f0
mov edx, dword [0x5ec57c]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
push 0x103
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
push 0xea81
push edx
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [esi + 0xc]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
lea eax, [esp + 0x10]
push eax
push 1
push ecx
call edi
mov ebp, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
call ebp
mov edx, dword [esi + 0xc]
push 1
push 1
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [esi + 0xc]
push 0
push 2
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi + 0xc]
push 0
push 0x41b
push ecx
call edi
push eax
call ebx
mov edx, dword [esi + 0xc]
push 0
push 0x41c
push edx
call edi
push eax
call ebx
mov eax, dword [esi + 0xc]
push 0
push 0x41a
push eax
call edi
push eax
call ebx
mov ecx, dword [esi + 0xc]
push 0
push 0x3ec
push ecx
call edi
push eax
call ebx
mov edx, dword [esp + 0x21c]
mov eax, dword [esi + 0xc]
push edx
push 0x419
push eax
call edi
push eax
call ebp
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x208
ret 4

Function at 0x4d4970
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x4d5940
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x208
push esi
push edi
mov edi, dword [esp + 0x214]
mov esi, ecx
test edi, edi
je 0x4d59e3
call fcn.004c1070
cmp dword [eax + 0x14], 2
jne 0x4d59e3
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.004c1070
lea eax, [esp + 8]
push 0x103
push eax
call fcn.004ce300
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0xc
test eax, eax
jbe 0x4d59e6
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d59e6
push 0
push str..url
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00470730
push 0
push str..dat
lea ecx, [esp + 0x20]
push 0
push ecx
call fcn.00470730
add esp, 0x20
pop edi
pop esi
add esp, 0x208
ret 4
mov dword [esi + 8], edi
pop edi
pop esi
add esp, 0x208
ret 4
Function at 0x4d6240
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push edi
push 1
mov esi, ecx
push 4
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 0
call ebx
add esp, 0x10
cmp eax, 1
je 0x4d6286
or eax, 0xffffffff
lea esp, [ebp - 0x254]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
push 1
lea ecx, [esi + 0x1c]
push 4
push ecx
call ebx
add esp, 0x10
cmp eax, 1
je 0x4d62ab
or eax, 0xffffffff
lea esp, [ebp - 0x254]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ebx, [esi + 0x20]
mov ecx, 0x19
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov edx, dword [ebp + 8]
mov ecx, 0xc
lea edi, [ebp - 0x3f]
mov byte [ebp - 0x40], al
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push edx
push 0x32
lea eax, [ebp - 0x40]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
lea ecx, [ebp - 0x40]
add esp, 0x10
test ecx, ecx
mov dword [ebp - 4], eax
jne 0x4d62ea
xor edi, edi
jmp 0x4d6320
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.004ace40
mov edi, esp
push esi
push edi
lea eax, [ebp - 0x40]
push 0xffffffffffffffff
push eax
push 0
push 0
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [ebp - 0xc]
push edi
push 0x4f6574
push 0x31
push ebx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
add esi, 0x28c
push str.1.0.0.3
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
call esi
test eax, eax
jl 0x4d63d9
lea ecx, [ebp + 8]
xor edi, edi
push ecx
mov dword [ebp + 8], edi
call fcn.004c05d0
mov eax, dword [ebp + 8]
add esp, 4
cmp eax, 2
jne 0x4d63bb
mov word [ebp - 0x248], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x246]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x248]
push 0x103
push edx
stosw word es:[edi], ax
call fcn.004b8490
mov ecx, eax
call fcn.004be6f0
lea eax, [ebp - 0x248]
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x4d63d9
or eax, 0xffffffff
lea esp, [ebp - 0x254]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x50fce0
push ebx
call esi
test eax, eax
je 0x4d63d9
or eax, 0xffffffff
lea esp, [ebp - 0x254]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x254]
sub eax, 0x32
neg eax
pop edi
pop esi
sbb eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4d6400
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
cmp eax, ecx
jle 0x4d6426
mov ecx, 0x64
mov edi, dword [esi + 0x18]
add edi, ecx
mov edx, edi
mov dword [esi + 0x18], edi
cmp eax, edx
jg 0x4d6418
mov edi, dword [esi + 0x18]
lea eax, [edi + edi*4]
lea eax, [eax + eax*4]
shl eax, 7
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
xor ebx, ebx
add esp, 4
or ebp, 0xffffffff
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x4d64f5
dec edi
cmp edi, ebx
jl 0x4d64f1
inc edi
lea edx, [eax + 0x48]
mov dword [esp + 0x10], edi
mov ecx, 0x28b
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, 0x30e
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, 0x30e
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [edx - 0x2c]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
lea eax, [edx - 0x1c]
add edx, 0xc80
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x10]
mov dword [edx - 0xcc8], ebp
mov dword [edx - 0xcc4], ebp
mov dword [edx - 0xcc0], ebx
mov dword [edx - 0xcb4], ebx
mov dword [edx - 0xcbc], 1
mov dword [edx - 0xcb8], ebx
mov dword [edx - 0xc84], ebp
mov dword [edx - 0xc88], ebp
mov dword [edx - 0xc8c], ebp
mov dword [edx - 0xcb0], ebx
dec eax
mov dword [esp + 0x10], eax
jne 0x4d645d
mov eax, dword [esp + 0x14]
mov edi, eax
jmp 0x4d64f7
xor edi, edi
cmp edi, ebx
mov dword [esi + 0x14], edi
jne 0x4d650a
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [esi + 0x18]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
xor eax, eax
shl ecx, 7
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x1c]
cmp eax, 0x2710
jge 0x4d655b
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 0x14]
push ecx
push eax
push 0xc80
push edx
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esi + 0x1c]
add esp, 0x10
cmp eax, ecx
je 0x4d6591
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 0x14]
push eax
push 0x2710
push 0xc80
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 0x2710
je 0x4d658a
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov dword [esi + 0x1c], 0x2710
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 4
Function at 0x4d7970
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
push 0x5013c4
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov ebx, eax
add esp, 8
test ebx, ebx
mov edi, 3
jne 0x4d799b
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push ebx
call esi
push ebx
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push ebx
mov ebp, eax
call esi
add esp, 0x1c
test ebp, ebp
jle 0x4d7a45
lea edi, [ebp + 2]
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x4d79e2
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
ret 4
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebx
and ecx, 3
push 1
push ebp
push esi
rep stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_fread]
xor eax, eax
add esp, 0x10
mov ah, byte [esi + 1]
mov al, byte [esi]
mov edi, eax
cmp di, 0xbbef
jne 0x4d7a1a
cmp byte [esi + 2], 0xbf
je 0x4d7a28
push ebp
push esi
call fcn.004d7910
add esp, 8
test eax, eax
je 0x4d7a2f
mov edi, 2
jmp 0x4d7a3b
xor ecx, ecx
cmp di, 0xfeff
sete cl
mov edi, ecx
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4d7a60
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x21c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x22c]
push edi
xor ebp, ebp
push esi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], ebp
call fcn.004d77d0
mov ebx, eax
test esi, esi
mov dword [esp + 0x20], ebx
je 0x4d7c1a
mov ax, word [0x50fce0]
mov ecx, 0x81
mov word [esp + 0x24], ax
xor eax, eax
lea edi, [esp + 0x26]
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
push ecx
push 0x4f6574
push 0x103
push edx
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x5013c4
push esi
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x4d7c1a
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push ebp
push esi
call edi
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push esi
mov ebp, eax
call edi
lea edi, [ebp + 1]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, eax
add esp, 0x20
test edx, edx
mov dword [esp + 0x14], edx
je 0x4d7bff
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor edi, edi
cmp ebx, 1
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
jne 0x4d7b62
push esi
push 1
lea eax, [esp + 0x1b]
push 1
push eax
call ebx
mov al, byte [esp + 0x23]
add esp, 0x10
cmp al, 0x3c
je 0x4d7b62
push esi
push 1
lea ecx, [esp + 0x1b]
push 1
push ecx
call ebx
mov al, byte [esp + 0x23]
add esp, 0x10
inc edi
cmp al, 0x3c
jne 0x4d7b4a
push 0
push edi
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
mov eax, dword [esp + 0x20]
mov edx, ebp
push esi
sub edx, edi
push 1
push edx
push eax
call ebx
lea ecx, [ebp + ebp*2]
lea edx, [ecx + ecx + 2]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 0x20
test ebx, ebx
je 0x4d7bf2
lea ebp, [ebp + ebp*2]
xor eax, eax
mov edi, ebx
push ebp
lea ecx, [ebp + 1]
push ebx
mov edx, ecx
push 0xffffffffffffffff
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
cmp dword [esp + 0x2c], 1
jne 0x4d7bc4
mov eax, dword [esp + 0x20]
push eax
push 0
push 0xfde9
jmp 0x4d7bcd
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [esp + 0x234]
mov ecx, dword [esp + 0x1c]
push edx
push ebx
call fcn.004d7090
push ebx
mov dword [esp + 0x1c], eax
call fcn.004ace19
add esp, 4
mov eax, dword [esp + 0x14]
push eax
call fcn.004ace19
add esp, 4
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret 8
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret 8
Function at 0x4d8850
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
push esi
mov esi, ecx
push edi
push 0
push 0x3eb
mov eax, dword [esi + 0x68]
push eax
call ebx
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
mov ecx, dword [esi + 0x68]
push 0
push 0x3ef
push ecx
call ebx
push eax
call edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea edx, [esp + 0x10]
push 0x103
stosw word es:[edi], ax
mov eax, dword [0x5ec57c]
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push edx
push 0xea81
push eax
call edi
mov edx, dword [esi + 0x68]
lea ecx, [esp + 0x10]
push ecx
push 2
push edx
call ebx
mov ebp, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
call ebp
mov eax, dword [esi + 0x74]
push 0x103
test eax, eax
je 0x4d88f0
mov ecx, dword [0x5ec57c]
lea eax, [esp + 0x14]
push eax
push 0xea82
push ecx
jmp 0x4d8900
mov eax, dword [0x5ec57c]
lea edx, [esp + 0x14]
push edx
push 0xea8e
push eax
call edi
mov edx, dword [esi + 0x68]
lea ecx, [esp + 0x10]
push ecx
push 0x419
push edx
call ebx
push eax
call ebp
mov dword [esi + 0x60], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret

Function at 0x4d8930
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push esi
mov esi, ecx
push edi
push 0
mov eax, dword [esi + 0x68]
push 0x423
push eax
call ebx
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
mov ecx, dword [esi + 0x68]
push 0
push 0x424
push ecx
call ebx
push eax
call edi
mov edx, dword [esi + 0x68]
push 0
push 0x410
push edx
call ebx
push eax
call edi
mov eax, dword [esi + 0x68]
push 0
push 0x40f
push eax
call ebx
push eax
call edi
mov ecx, dword [esi + 0x68]
push 0
push 0x411
push ecx
call ebx
push eax
call edi
mov edx, dword [esi + 0x68]
push 0
push 0x412
push edx
call ebx
push eax
call edi
mov eax, dword [esi + 0x68]
push 0
push 1
push eax
call ebx
push eax
call edi
mov ecx, dword [esi + 0x68]
push 0
push 0x420
push ecx
call ebx
push eax
call edi
mov edx, dword [esi + 0x68]
push 0
push 0x3ee
push edx
call ebx
push eax
call edi
mov eax, dword [esi + 0x68]
push 5
push 0x3eb
push eax
mov dword [esi + 0x78], 0
call ebx
push eax
call edi
mov ecx, dword [esi + 0x68]
push 5
push 0x3ef
push ecx
call ebx
push eax
call edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x74]
push 0x103
test eax, eax
je 0x4d8a2f
mov eax, dword [0x5ec57c]
lea edx, [esp + 0x10]
push edx
push 0xea8b
push eax
jmp 0x4d8a40
mov edx, dword [0x5ec57c]
lea ecx, [esp + 0x10]
push ecx
push 0xea8c
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [esi + 0x68]
lea eax, [esp + 0xc]
push eax
push 0x419
push ecx
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x4d8a70
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x208
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x74]
test eax, eax
je 0x4d8ab8
mov eax, dword [esi + 0x68]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x423
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi + 0x68]
push 0
push 0x424
push ecx
call edi
push eax
call ebx
pop edi
pop esi
pop ebx
add esp, 0x208
ret
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
push ebp
lea edx, [esp + 0x10]
push 0x103
stosw word es:[edi], ax
mov eax, dword [0x5ec57c]
push edx
push 0xea85
push eax
call ebx
mov edx, dword [esi + 0x68]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [esp + 0x10]
push ecx
push 0x419
push edx
call edi
mov ebp, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
call ebp
mov ecx, dword [0x5ec57c]
lea eax, [esp + 0x10]
push 0x103
push eax
push 0xea86
push ecx
call ebx
mov eax, dword [esi + 0x68]
lea edx, [esp + 0x10]
push edx
push eax
call ebp
mov edx, dword [0x5ec57c]
lea ecx, [esp + 0x10]
push 0x103
push ecx
push 0xea87
push edx
call ebx
mov ecx, dword [esi + 0x68]
lea eax, [esp + 0x10]
push eax
push 1
push ecx
call edi
push eax
call ebp
mov edx, dword [esi + 0x68]
push 0
push 0x411
push edx
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov eax, dword [esi + 0x68]
push 0
push 0x412
push eax
call edi
push eax
call ebx
mov ecx, dword [esi + 0x68]
push 0
push 0x420
push ecx
call edi
push eax
call ebx
mov edx, dword [esi + 0x68]
push 0
push 0x3ee
push edx
call edi
push eax
call ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x208
ret

Function at 0x4d9080
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x208
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x5c]
cmp eax, 2
je 0x4d90cd
test eax, eax
je 0x4d90cd
mov eax, dword [esi + 0x68]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x411
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi + 0x68]
push 0
push 0x412
push ecx
call edi
push eax
call ebx
pop edi
pop esi
pop ebx
add esp, 0x208
ret
mov edx, dword [esi + 0x68]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push 0x411
push edx
call ebx
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
mov eax, dword [esi + 0x68]
push 5
push 0x412
push eax
call ebx
push eax
call edi
cmp dword [esi + 0x5c], 2
jne 0x4d911f
mov ecx, dword [esi + 0x68]
push 0
push 0x412
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
lea edx, [esp + 0xc]
push edx
stosw word es:[edi], ax
call fcn.004db5e0
mov ecx, dword [esi + 0x68]
add esp, 4
lea eax, [esp + 0xc]
push eax
push 0x411
push ecx
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x4d9170
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [ecx + 0x5c]
test eax, eax
je 0x4d919b
cmp eax, 1
jne 0x4d9196
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push str.bookmarks.dat
push ecx
push edx
call fcn.004ad6f0
add esp, 0xc
ret 8
cmp eax, 2
jne 0x4d91bc
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
dec eax
push eax
mov eax, dword [ecx + 0x68]
push edx
push 0x411
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
ret 8