Please enable JavaScript to use regex101
/
^
r
e
g
e
x
[
\
-
_
]
?
1
0
1
$
/
i
Reg
ular
Ex
pressions
101
Upgrade to Pro
Enterprise
Regular Expression
r"
0x[0-9a-fA-F]{8}[\t ]*(\S+)
"
gm
Input 1
New
/ 260: fcn.004020b0 (int32_t arg_4h, int32_t arg_8h); | ; var int32_t var_324h @ ebp-0x324 | ; arg int32_t arg_4h @ ebp+0x4 | ; arg int32_t arg_8h @ ebp+0x8 | 0x004020b0 55 push ebp | 0x004020b1 8bec mov ebp, esp | 0x004020b3 81ec24030000 sub esp, 0x324 | 0x004020b9 6a17 push 0x17 ; 23 | 0x004020bb ff151c304000 call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent] ; 0x40301c | 0x004020c1 85c0 test eax, eax | ,=< 0x004020c3 7407 je 0x4020cc | | 0x004020c5 b902000000 mov ecx, 2 | | 0x004020ca cd29 int 0x29 | | ; CODE XREF from fcn.004020b0 @ 0x4020c3 | `-> 0x004020cc a340744000 mov dword [0x407440], eax ; [0x407440:4]=0 | 0x004020d1 890d3c744000 mov dword [0x40743c], ecx ; [0x40743c:4]=0 |
Substitution
/ 260: fcn.004020b0 (int32_t arg_4h, int32_t arg_8h); | ; var int32_t var_324h @ ebp-0x324 | ; arg int32_t arg_4h @ ebp+0x4 | ; arg int32_t arg_8h @ ebp+0x8 | 0x004020b0 55 push ebp | 0x004020b1 8bec mov ebp, esp | 0x004020b3 81ec24030000 sub esp, 0x324 | 0x004020b9 6a17 push 0x17 ; 23 | 0x004020bb ff151c304000 call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent] ; 0x40301c | 0x004020c1 85c0 test eax, eax | ,=< 0x004020c3 7407 je 0x4020cc | | 0x004020c5 b902000000 mov ecx, 2 | | 0x004020ca cd29 int 0x29 | | ; CODE XREF from fcn.004020b0 @ 0x4020c3 | `-> 0x004020cc a340744000 mov dword [0x407440], eax ; [0x407440:4]=0 | 0x004020d1 890d3c744000 mov dword [0x40743c], ecx ; [0x40743c:4]=0 |