joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bc6a0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x410
push ebx
push esi
push edi
mov esi, dword [esp + 0x420]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x216]
mov word [esp + 0x214], 0
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
stosw word es:[edi], ax
push 0x4e33c0
lea eax, [esp + 0x21c]
push 0x103
push eax
call ebx
push esi
lea ecx, [esp + 0x228]
push 0x104
push ecx
call fcn.004bc5e0
add esp, 0x1c
lea edx, [esp + 0x214]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x4bc7c8
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.0049c3a0
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.004ca180
lea edx, [esp + 0x1c]
push 0x104
push edx
call fcn.0049c3a0
add esp, 0x18
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4bc7ab
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
lea edx, [esi + eax*2]
lea eax, [esp + 0xc]
push edx
push 0x4e33c0
push 0x103
push eax
call ebx
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.004af0f0
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x410
ret
push 0x104
push esi
call fcn.004af0f0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x410
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x410
ret
Function at 0x4bc7e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push esi
lea eax, [esp + 4]
push edi
push eax
mov dword [esp + 0xc], 0
call fcn.004af1c0
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 4
test eax, eax
jne 0x4bc869
push 0
push 6
push 0x698260
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4bc926
push 1
push 0x698260
call fcn.004ca180
mov eax, dword [esp + 0x220]
add esp, 8
test eax, eax
je 0x4bc959
mov ecx, dword [esp + 0x21c]
push 0x698260
dec ecx
push 0x4e33c0
push ecx
push eax
call esi
add esp, 0x10
mov eax, 0x698260
pop edi
pop esi
add esp, 0x20c
ret
cmp eax, 3
jne 0x4bc918
push 1
push 0x104
push 0x698260
call fcn.004bc4e0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], 0
add esp, 0xc
lea edx, [esp + 0xc]
rep stosd dword es:[edi], eax
push 0x698260
push 0x4e33c0
push 0x103
push edx
stosw word es:[edi], ax
call esi
push 0x698260
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0x14
test eax, eax
jne 0x4bc926
push eax
push 6
push 0x698260
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4bc926
push 1
push 0x698260
call fcn.004ca180
mov eax, dword [esp + 0x220]
add esp, 8
test eax, eax
je 0x4bc959
mov ecx, dword [esp + 0x21c]
push 0x698260
dec ecx
push 0x4e33c0
push ecx
push eax
call esi
add esp, 0x10
mov eax, 0x698260
pop edi
pop esi
add esp, 0x20c
ret
mov ecx, 0x82
xor eax, eax
mov edi, 0x698260
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x218]
test eax, eax
je 0x4bc94a
mov edx, dword [esp + 0x21c]
push 0x698260
dec edx
push 0x4e33c0
push edx
push eax
call esi
add esp, 0x10
push 1
push 0x698260
call fcn.004ca180
add esp, 8
pop edi
mov eax, 0x698260
pop esi
add esp, 0x20c
ret
Function at 0x4bc970
Capabilities:
Check if file exists
Create thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d24fb
push eax
mov dword fs:[0], esp
sub esp, 0x424
push ebx
push ebp
push esi
mov esi, dword [esp + 0x440]
xor ebp, ebp
push edi
cmp esi, ebp
mov ebx, ecx
jne 0x4bc9a6
or eax, 0xffffffff
jmp 0x4bcba8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, 1
cmp eax, ecx
jne 0x4bc9be
mov dword [ebx + 0x62794], ecx
jmp 0x4bc9c4
mov dword [ebx + 0x62794], ebp
mov eax, dword [ebx + 0x6278c]
cmp eax, ebp
je 0x4bc9f6
push 0xffffffffffffffff
push eax
mov dword [ebx + 0x62790], ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebx + 0x6278c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x6278c], ebp
mov dword [ebx + 0x62790], ebp
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x26]
mov word [esp + 0x24], bp
rep stosd dword es:[edi], eax
push esi
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x4e33c0
lea ecx, [esp + 0x2c]
push 0x103
push ecx
stosw word es:[edi], ax
call esi
lea edx, [esp + 0x34]
push ebp
push edx
call fcn.004ca180
lea edi, [ebx + 0x3d0]
push ebp
push edi
call fcn.004ca180
add esp, 0x20
lea eax, [esp + 0x24]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x4bca5b
cmp dword [ebx + 0x14], 2
jne 0x4bca5b
or eax, 0xffffffff
jmp 0x4bcba8
push 1
mov ecx, ebx
call fcn.004b2480
mov eax, dword [ebx + 0x62780]
cmp eax, ebp
je 0x4bca7d
push eax
call fcn.0049bb1b
add esp, 4
mov dword [ebx + 0x62780], ebp
mov ecx, ebx
mov dword [ebx + 0x62784], ebp
mov dword [ebx + 0x62788], ebp
call fcn.004b0d50
mov ecx, dword [esp + 0x444]
mov dword [ebx + 0x14], 2
push ecx
push 0x4e33c0
push 0x104
push edi
call esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x23e]
mov word [esp + 0x23c], bp
rep stosd dword es:[edi], eax
push ebp
push ebp
stosw word es:[edi], ax
call fcn.004bc7e0
add esp, 0x18
lea edx, [esp + 0x22c]
push eax
push 0x4e33c0
push 0x104
push edx
call esi
add esp, 0x10
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [ebx + 0x62774]
mov edx, dword [ebx + 0x62778]
mov dword [esp + 0x10], eax
mov eax, edx
cmp eax, edx
mov dword [esp + 0x43c], ebp
je 0x4bcb35
mov edi, dword [esp + 0x10]
mov ecx, 0x83
mov esi, eax
add eax, 0x20c
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x10]
add edi, 0x20c
cmp eax, edx
mov dword [esp + 0x10], edi
jne 0x4bcb11
mov ecx, dword [ebx + 0x62778]
mov edx, dword [esp + 0x10]
push ebp
push ebp
push 1
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x30], ecx
push ebp
push eax
lea ecx, [esp + 0x244]
push 2
push ecx
mov ecx, ebx
mov dword [ebx + 0x62778], edx
call fcn.004bd660
lea edx, [esp + 0x14]
mov ecx, ebx
push edx
call fcn.004bcea0
mov ecx, ebx
call fcn.004bea80
push ebp
push ebp
push ebx
push 0x4bc4c0
push ebp
push ebp
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov dword [ebx + 0x6278c], eax
mov eax, dword [esp + 0x2c]
add esp, 0x18
cmp eax, ebp
je 0x4bcba3
push eax
call fcn.0049bb1b
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x434]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x430
ret 4
Function at 0x4be8b0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x62768]
test eax, eax
jne 0x4be8e0
lea eax, [esi + 0x6276c]
push eax
push 0
push 0
push 0x4be7b0
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x62768], eax
mov eax, dword [esi + 0x62768]
pop esi
neg eax
sbb eax, eax
and eax, 2
dec eax
ret
Function at 0x4c3780
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x208
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov dword [esi + 0x490], 1
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4c388b
mov eax, dword [esp + 0x210]
test eax, eax
je 0x4c388b
push ebx
push ebp
push edi
push 4
mov ecx, esi
call fcn.004c38a0
mov edx, dword [0x5d1134]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
push 0x103
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
push 0xea81
push edx
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [esi + 0xc]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
lea eax, [esp + 0x10]
push eax
push 1
push ecx
call edi
mov ebp, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
call ebp
mov edx, dword [esi + 0xc]
push 1
push 1
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [esi + 0xc]
push 0
push 2
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi + 0xc]
push 0
push 0x41b
push ecx
call edi
push eax
call ebx
mov edx, dword [esi + 0xc]
push 0
push 0x41c
push edx
call edi
push eax
call ebx
mov eax, dword [esi + 0xc]
push 0
push 0x41a
push eax
call edi
push eax
call ebx
mov ecx, dword [esi + 0xc]
push 0
push 0x3ec
push ecx
call edi
push eax
call ebx
mov edx, dword [esp + 0x21c]
mov eax, dword [esi + 0xc]
push edx
push 0x419
push eax
call edi
push eax
call ebp
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x208
ret 4

Function at 0x4c3920
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x4c50f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push edi
push 1
mov esi, ecx
push 4
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 0
call ebx
add esp, 0x10
cmp eax, 1
je 0x4c5136
or eax, 0xffffffff
lea esp, [ebp - 0x254]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
push 1
lea ecx, [esi + 0x18]
push 4
push ecx
call ebx
add esp, 0x10
cmp eax, 1
je 0x4c515b
or eax, 0xffffffff
lea esp, [ebp - 0x254]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ebx, [esi + 0x1c]
mov ecx, 0x19
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov edx, dword [ebp + 8]
mov ecx, 0xc
lea edi, [ebp - 0x3f]
mov byte [ebp - 0x40], al
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push edx
push 0x32
lea eax, [ebp - 0x40]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
lea ecx, [ebp - 0x40]
add esp, 0x10
test ecx, ecx
mov dword [ebp - 4], eax
jne 0x4c519a
xor edi, edi
jmp 0x4c51d0
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.0049bb40
mov edi, esp
push esi
push edi
lea eax, [ebp - 0x40]
push 0xffffffffffffffff
push eax
push 0
push 0
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [ebp - 0xc]
push edi
push 0x4e33c0
push 0x31
push ebx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
add esi, 0x288
push str.1.0.0.3
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
call esi
test eax, eax
jl 0x4c5289
lea ecx, [ebp + 8]
xor edi, edi
push ecx
mov dword [ebp + 8], edi
call fcn.004af1c0
mov eax, dword [ebp + 8]
add esp, 4
cmp eax, 2
jne 0x4c526b
mov word [ebp - 0x248], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x246]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x248]
push 0x103
push edx
stosw word es:[edi], ax
call fcn.004a7080
mov ecx, eax
call fcn.004ad2e0
lea eax, [ebp - 0x248]
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x4c5289
or eax, 0xffffffff
lea esp, [ebp - 0x254]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x4f5820
push ebx
call esi
test eax, eax
je 0x4c5289
or eax, 0xffffffff
lea esp, [ebp - 0x254]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x254]
sub eax, 0x32
neg eax
pop edi
pop esi
sbb eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c52b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
cmp eax, ecx
jle 0x4c52d6
mov ecx, 0x64
mov edi, dword [esi + 0x14]
add edi, ecx
mov edx, edi
mov dword [esi + 0x14], edi
cmp eax, edx
jg 0x4c52c8
mov edi, dword [esi + 0x14]
lea eax, [edi + edi*4]
lea eax, [eax + eax*4]
shl eax, 7
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
xor ebx, ebx
add esp, 4
or ebp, 0xffffffff
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x4c53a5
dec edi
cmp edi, ebx
jl 0x4c53a1
inc edi
lea edx, [eax + 0x48]
mov dword [esp + 0x10], edi
mov ecx, 0x28b
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, 0x30e
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, 0x30e
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [edx - 0x2c]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
lea eax, [edx - 0x1c]
add edx, 0xc80
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x10]
mov dword [edx - 0xcc8], ebp
mov dword [edx - 0xcc4], ebp
mov dword [edx - 0xcc0], ebx
mov dword [edx - 0xcb4], ebx
mov dword [edx - 0xcbc], 1
mov dword [edx - 0xcb8], ebx
mov dword [edx - 0xc84], ebp
mov dword [edx - 0xc88], ebp
mov dword [edx - 0xc8c], ebp
mov dword [edx - 0xcb0], ebx
dec eax
mov dword [esp + 0x10], eax
jne 0x4c530d
mov eax, dword [esp + 0x14]
mov edi, eax
jmp 0x4c53a7
xor edi, edi
cmp edi, ebx
mov dword [esi + 0x10], edi
jne 0x4c53ba
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [esi + 0x14]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
xor eax, eax
shl ecx, 7
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x18]
cmp eax, 0x2710
jge 0x4c540b
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 0x10]
push ecx
push eax
push 0xc80
push edx
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esi + 0x18]
add esp, 0x10
cmp eax, ecx
je 0x4c5441
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 0x10]
push eax
push 0x2710
push 0xc80
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 0x2710
je 0x4c543a
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov dword [esi + 0x18], 0x2710
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 4
Function at 0x4c6700
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
push 0x4edc1c
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov ebx, eax
add esp, 8
test ebx, ebx
mov edi, 3
jne 0x4c672b
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push ebx
call esi
push ebx
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push ebx
mov ebp, eax
call esi
add esp, 0x1c
test ebp, ebp
jle 0x4c67d5
lea edi, [ebp + 2]
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x4c6772
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
ret 4
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebx
and ecx, 3
push 1
push ebp
push esi
rep stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_fread]
xor eax, eax
add esp, 0x10
mov ah, byte [esi + 1]
mov al, byte [esi]
mov edi, eax
cmp di, 0xbbef
jne 0x4c67aa
cmp byte [esi + 2], 0xbf
je 0x4c67b8
push ebp
push esi
call fcn.004c66a0
add esp, 8
test eax, eax
je 0x4c67bf
mov edi, 2
jmp 0x4c67cb
xor ecx, ecx
cmp di, 0xfeff
sete cl
mov edi, ecx
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4c67f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x21c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x22c]
push edi
xor ebp, ebp
push esi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], ebp
call fcn.004c6560
mov ebx, eax
test esi, esi
mov dword [esp + 0x20], ebx
je 0x4c69aa
mov ax, word [0x4f5820]
mov ecx, 0x81
mov word [esp + 0x24], ax
xor eax, eax
lea edi, [esp + 0x26]
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
push ecx
push 0x4e33c0
push 0x103
push edx
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x4edc1c
push esi
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x4c69aa
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push ebp
push esi
call edi
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push esi
mov ebp, eax
call edi
lea edi, [ebp + 1]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, eax
add esp, 0x20
test edx, edx
mov dword [esp + 0x14], edx
je 0x4c698f
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor edi, edi
cmp ebx, 1
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
jne 0x4c68f2
push esi
push 1
lea eax, [esp + 0x1b]
push 1
push eax
call ebx
mov al, byte [esp + 0x23]
add esp, 0x10
cmp al, 0x3c
je 0x4c68f2
push esi
push 1
lea ecx, [esp + 0x1b]
push 1
push ecx
call ebx
mov al, byte [esp + 0x23]
add esp, 0x10
inc edi
cmp al, 0x3c
jne 0x4c68da
push 0
push edi
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
mov eax, dword [esp + 0x20]
mov edx, ebp
push esi
sub edx, edi
push 1
push edx
push eax
call ebx
lea ecx, [ebp + ebp*2]
lea edx, [ecx + ecx + 2]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 0x20
test ebx, ebx
je 0x4c6982
lea ebp, [ebp + ebp*2]
xor eax, eax
mov edi, ebx
push ebp
lea ecx, [ebp + 1]
push ebx
mov edx, ecx
push 0xffffffffffffffff
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
cmp dword [esp + 0x2c], 1
jne 0x4c6954
mov eax, dword [esp + 0x20]
push eax
push 0
push 0xfde9
jmp 0x4c695d
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [esp + 0x234]
mov ecx, dword [esp + 0x1c]
push edx
push ebx
call fcn.004c5f30
push ebx
mov dword [esp + 0x1c], eax
call fcn.0049bb1b
add esp, 4
mov eax, dword [esp + 0x14]
push eax
call fcn.0049bb1b
add esp, 4
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret 8
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret 8
Function at 0x4c7560
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
push esi
mov esi, ecx
push edi
push 0
push 0x3eb
mov eax, dword [esi + 0x68]
push eax
call ebx
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
mov ecx, dword [esi + 0x68]
push 0
push 0x3ef
push ecx
call ebx
push eax
call edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea edx, [esp + 0x10]
push 0x103
stosw word es:[edi], ax
mov eax, dword [0x5d1134]
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push edx
push 0xea81
push eax
call edi
mov edx, dword [esi + 0x68]
lea ecx, [esp + 0x10]
push ecx
push 2
push edx
call ebx
mov ebp, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
call ebp
mov eax, dword [esi + 0x74]
push 0x103
test eax, eax
je 0x4c7600
mov ecx, dword [0x5d1134]
lea eax, [esp + 0x14]
push eax
push 0xea82
push ecx
jmp 0x4c7610
mov eax, dword [0x5d1134]
lea edx, [esp + 0x14]
push edx
push 0xea8e
push eax
call edi
mov edx, dword [esi + 0x68]
lea ecx, [esp + 0x10]
push ecx
push 0x419
push edx
call ebx
push eax
call ebp
mov dword [esi + 0x60], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret

Function at 0x4c7640
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push esi
mov esi, ecx
push edi
push 0
mov eax, dword [esi + 0x68]
push 0x423
push eax
call ebx
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
mov ecx, dword [esi + 0x68]
push 0
push 0x424
push ecx
call ebx
push eax
call edi
mov edx, dword [esi + 0x68]
push 0
push 0x410
push edx
call ebx
push eax
call edi
mov eax, dword [esi + 0x68]
push 0
push 0x40f
push eax
call ebx
push eax
call edi
mov ecx, dword [esi + 0x68]
push 0
push 0x411
push ecx
call ebx
push eax
call edi
mov edx, dword [esi + 0x68]
push 0
push 0x412
push edx
call ebx
push eax
call edi
mov eax, dword [esi + 0x68]
push 0
push 1
push eax
call ebx
push eax
call edi
mov ecx, dword [esi + 0x68]
push 0
push 0x420
push ecx
call ebx
push eax
call edi
mov edx, dword [esi + 0x68]
push 0
push 0x3ee
push edx
call ebx
push eax
call edi
mov eax, dword [esi + 0x68]
push 5
push 0x3eb
push eax
mov dword [esi + 0x78], 0
call ebx
push eax
call edi
mov ecx, dword [esi + 0x68]
push 5
push 0x3ef
push ecx
call ebx
push eax
call edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x74]
push 0x103
test eax, eax
je 0x4c773f
mov eax, dword [0x5d1134]
lea edx, [esp + 0x10]
push edx
push 0xea8b
push eax
jmp 0x4c7750
mov edx, dword [0x5d1134]
lea ecx, [esp + 0x10]
push ecx
push 0xea8c
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [esi + 0x68]
lea eax, [esp + 0xc]
push eax
push 0x419
push ecx
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x4c7780
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x208
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x74]
test eax, eax
je 0x4c77c8
mov eax, dword [esi + 0x68]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x423
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi + 0x68]
push 0
push 0x424
push ecx
call edi
push eax
call ebx
pop edi
pop esi
pop ebx
add esp, 0x208
ret
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
push ebp
lea edx, [esp + 0x10]
push 0x103
stosw word es:[edi], ax
mov eax, dword [0x5d1134]
push edx
push 0xea85
push eax
call ebx
mov edx, dword [esi + 0x68]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [esp + 0x10]
push ecx
push 0x419
push edx
call edi
mov ebp, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
call ebp
mov ecx, dword [0x5d1134]
lea eax, [esp + 0x10]
push 0x103
push eax
push 0xea86
push ecx
call ebx
mov eax, dword [esi + 0x68]
lea edx, [esp + 0x10]
push edx
push eax
call ebp
mov edx, dword [0x5d1134]
lea ecx, [esp + 0x10]
push 0x103
push ecx
push 0xea87
push edx
call ebx
mov ecx, dword [esi + 0x68]
lea eax, [esp + 0x10]
push eax
push 1
push ecx
call edi
push eax
call ebp
mov edx, dword [esi + 0x68]
push 0
push 0x411
push edx
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov eax, dword [esi + 0x68]
push 0
push 0x412
push eax
call edi
push eax
call ebx
mov ecx, dword [esi + 0x68]
push 0
push 0x420
push ecx
call edi
push eax
call ebx
mov edx, dword [esi + 0x68]
push 0
push 0x3ee
push edx
call edi
push eax
call ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x208
ret

Function at 0x4c7d90
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x208
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x5c]
cmp eax, 2
je 0x4c7ddd
test eax, eax
je 0x4c7ddd
mov eax, dword [esi + 0x68]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x411
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi + 0x68]
push 0
push 0x412
push ecx
call edi
push eax
call ebx
pop edi
pop esi
pop ebx
add esp, 0x208
ret
mov edx, dword [esi + 0x68]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push 0x411
push edx
call ebx
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
mov eax, dword [esi + 0x68]
push 5
push 0x412
push eax
call ebx
push eax
call edi
cmp dword [esi + 0x5c], 2
jne 0x4c7e2f
mov ecx, dword [esi + 0x68]
push 0
push 0x412
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
lea edx, [esp + 0xc]
push edx
stosw word es:[edi], ax
call fcn.004ca1e0
mov ecx, dword [esi + 0x68]
add esp, 4
lea eax, [esp + 0xc]
push eax
push 0x411
push ecx
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x4c7e80
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [ecx + 0x5c]
test eax, eax
je 0x4c7eab
cmp eax, 1
jne 0x4c7ea6
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push str.bookmarks.dat
push ecx
push edx
call fcn.0049c3f0
add esp, 0xc
ret 8
cmp eax, 2
jne 0x4c7ecc
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
dec eax
push eax
mov eax, dword [ecx + 0x68]
push edx
push 0x411
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
ret 8