joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53bf60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6ae32c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
xor edi, edi
lea ecx, [esi + 4]
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [ecx + 4], edi
mov dword [esp + 0x18], edi
mov dword [ecx], vtable.wxColour.0
call fcn.004f4f00
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], 1
mov dword [esp + 0xc], ecx
mov dword [ecx + 4], edi
mov byte [esp + 0x18], 2
mov dword [ecx], vtable.wxColour.0
call fcn.004f4f00
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], vtable.wxFont.0
lea ecx, [esi + 0x38]
mov byte [esp + 0x18], 4
call fcn.00575430
mov ecx, esi
mov byte [esp + 0x18], 5
call fcn.00516520
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x53ebe8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6ae89c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00489b80
mov dword [esi], vtable.wxControlBase.0
lea ecx, [esi + 0x144]
mov dword [esp + 0x18], 0
call fcn.00575430
mov dword [esi], vtable.wxControl.0
lea ecx, [esi + 0x150]
mov dword [esp + 0x18], 1
call fcn.00575430
mov ecx, esi
mov byte [esp + 0x18], 2
mov dword [esi], vtable.wxBookCtrlBase.0
call fcn.00566e60
mov dword [esi], vtable.wxNotebookBase.0
lea edi, [esi + 0x180]
mov dword [esp + 0x18], 3
mov dword [esp + 0xc], edi
mov dword [edi + 4], 0
push 0
mov ecx, edi
mov byte [esp + 0x1c], 4
mov dword [edi], vtable.wxListBase.0
call fcn.005858c0
mov dword [edi], vtable.wxNotebookPageInfoList.0
mov ecx, esi
mov byte [esp + 0x18], 5
mov dword [esi], vtable.wxNotebook.0
call fcn.0053e8b0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0053ecc0
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x18
Function at 0x54ffe0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6afdb1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x190
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0
call dword [0x6c7830]
mov ebx, eax
mov dword [esp + 0x2c], ebx
mov edi, dword [0x6c71e0]
push 0x58
push ebx
mov dword [esp + 0x1b0], 0
call edi
mov ebp, eax
push 0x5a
push ebx
mov dword [esp + 0x2c], ebp
call edi
mov ecx, dword [esi + 0x84]
mov dword [esp + 0x28], eax
mov dword [ecx + 0x24], eax
lea eax, [esi + 0x2c]
mov dword [ecx + 0x20], ebp
push eax
lea ecx, [esp + 0x54]
call fcn.0051c720
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x50]
mov byte [esp + 0x1a8], 1
call dword [edx + 0x68]
test al, al
je 0x5501ac
mov ebp, dword [esp + 0x138]
push 4
push ebp
call edi
push 6
push ebp
mov dword [esp + 0x20], eax
call edi
push 8
push ebp
mov dword [esp + 0x1c], eax
call edi
push 0xa
push ebp
mov ebx, eax
call edi
push 0x58
push ebp
mov dword [esp + 0x24], eax
call edi
push 0x5a
push ebp
mov dword [esp + 0x18], eax
call edi
mov edi, eax
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x54]
mov dword [esp + 0x24], edi
call fcn.0051ccf0
mov edx, dword [eax]
mov ebp, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x38], ecx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5500e2
test edi, edi
je 0x5500e2
mov eax, dword [esp + 0x18]
test eax, eax
je 0x5500e2
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x5500e9
mov byte [esi + 0xb4], 0
mov eax, dword [esp + 0x1c]
fild dword [esp + 0x24]
mov ecx, dword [esi + 0x84]
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], eax
fidiv dword [esp + 0x10]
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], eax
mov eax, dword [esi + 0x84]
mov ecx, dword [esp + 0x18]
mov dword [eax + 0x18], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax + 0x1c], ecx
mov eax, dword [esi + 0x84]
add eax, 0x30
mov ecx, dword [esp + 0x3c]
mov dword [eax], edx
mov edx, dword [esp + 0x38]
mov dword [eax + 4], ebp
mov dword [eax + 8], edx
mov edx, dword [esp + 0x10]
mov dword [eax + 0xc], ecx
mov eax, dword [esi + 0x84]
mov dword [eax + 0x28], edx
mov dword [eax + 0x2c], edi
fstp dword [esi + 0x94]
fild dword [esp + 0x28]
fidiv dword [esp + 0x20]
fstp dword [esi + 0x98]
lea ecx, [esp + 0x150]
mov byte [esp + 0x1a8], 2
call fcn.0051c010
lea ecx, [esp + 0x50]
mov byte [esp + 0x1a8], 0
call fcn.004f5e70
mov eax, dword [esp + 0x2c]
push eax
push 0
call dword [0x6c7834]
mov ecx, dword [esp + 0x1a0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x19c
ret
mov ebx, 0x5dc
mov eax, 0x9c4
mov ecx, ebx
mov edi, 0x258
mov dword [esp + 0x38], ecx
mov ecx, eax
xor edx, edx
mov dword [esp + 0x18], 0x96
mov dword [esp + 0x14], 0xfa
mov dword [esp + 0x10], edi
mov dword [esp + 0x20], edi
xor ebp, ebp
mov dword [esp + 0x4c], eax
mov dword [esp + 0x3c], ecx
mov byte [esi + 0xb4], 0
jmp 0x5500ed
Function at 0x565f70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6b18e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004d5e80
xor edi, edi
mov ecx, esi
mov dword [esi + 0x160], edi
mov dword [esi + 0x164], edi
mov dword [esi + 0x168], edi
mov dword [esi + 0x16c], edi
mov dword [esp + 0x14], edi
mov dword [esi], vtable.wxTopLevelWindowMSW.0
call fcn.004d6c50
mov ecx, esi
mov dword [esp + 0x14], 1
mov dword [esi], vtable.wxTopLevelWindow.0
call fcn.004d6c50
push edi
lea ecx, [esi + 0x188]
mov dword [esp + 0x18], 2
call fcn.004dccd0
mov ecx, esi
mov dword [esi], vtable.wxDialogBase.0
call fcn.004cb280
mov ecx, esi
mov dword [esp + 0x14], 3
mov dword [esi], vtable.wxDialog.0
call fcn.004cc8f0
mov dword [esi], vtable.wxAnyChoiceDialog.0
mov eax, dword [0x8b0a50]
mov dword [esp + 0x14], 4
mov dword [esi + 0x1a8], eax
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push 0x8c9ae8
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x34], 5
mov dword [esi], vtable.wxSingleChoiceDialog.0
call fcn.00566080
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x20

Function at 0x565f86
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6b18e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004d5e80
xor edi, edi
mov ecx, esi
mov dword [esi + 0x160], edi
mov dword [esi + 0x164], edi
mov dword [esi + 0x168], edi
mov dword [esi + 0x16c], edi
mov dword [esp + 0x14], edi
mov dword [esi], vtable.wxTopLevelWindowMSW.0
call fcn.004d6c50
mov ecx, esi
mov dword [esp + 0x14], 1
mov dword [esi], vtable.wxTopLevelWindow.0
call fcn.004d6c50
push edi
lea ecx, [esi + 0x188]
mov dword [esp + 0x18], 2
call fcn.004dccd0
mov ecx, esi
mov dword [esi], vtable.wxDialogBase.0
call fcn.004cb280
mov ecx, esi
mov dword [esp + 0x14], 3
mov dword [esi], vtable.wxDialog.0
call fcn.004cc8f0
mov dword [esi], vtable.wxAnyChoiceDialog.0
mov eax, dword [0x8b0a50]
mov dword [esp + 0x14], 4
mov dword [esi + 0x1a8], eax
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push 0x8c9ae8
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x34], 5
mov dword [esi], vtable.wxSingleChoiceDialog.0
call fcn.00566080
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x20
Function at 0x56b72e
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6b2038
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [0x8b0a50]
push ebp
push esi
mov esi, ecx
test eax, eax
push edi
mov dword [esp + 0x10], esi
jne 0x56b73f
mov eax, 0x8c55f4
mov ecx, dword [0x6e14e0]
push ecx
push 0
push eax
lea ecx, [esp + 0x18]
call fcn.00570720
push 0
lea edx, [esp + 0x10]
push 1
push edx
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.00542690
mov eax, dword [esp + 0xc]
mov byte [esp + 0x30], 2
add eax, 0xfffffff4
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x56b78e
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x56b78e
push eax
call dword [0x6c74ac]
add esp, 4
mov ebp, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
push 0
push 0xa
mov dword [esi], vtable.wxCheckListBoxItem.0
mov byte [esi + 0x64], 0
mov dword [esi + 0x68], ebp
mov dword [esi + 0x6c], ecx
call fcn.00515000
add esp, 8
mov edi, 1
shl eax, 1
push 0x47
sub edi, eax
call dword [0x6c77dc]
add edi, eax
mov dword [esi + 0x60], edi
mov eax, dword [0x8cbd5c]
cmp edi, eax
je 0x56b7d5
mov byte [esi + 0xd], 1
lea edx, [esp + 0x14]
mov ecx, ebp
push edx
call fcn.004da560
mov edi, eax
lea ebp, [esi + 0x2c]
mov byte [esp + 0x30], 3
cmp ebp, edi
je 0x56b7f7
push edi
mov ecx, ebp
call fcn.0056f8a0
mov eax, dword [edi + 8]
mov byte [esp + 0x30], 2
mov dword [ebp + 8], eax
mov cl, byte [edi + 0xc]
mov byte [ebp + 0xc], cl
mov dl, byte [edi + 0xd]
mov byte [ebp + 0xd], dl
mov al, byte [edi + 0xe]
mov byte [ebp + 0xe], al
mov cl, byte [edi + 0xf]
mov byte [ebp + 0xf], cl
mov dl, byte [edi + 0x10]
mov byte [ebp + 0x10], dl
lea ecx, [esp + 0x14]
mov byte [esi + 0xd], 1
call fcn.004dd920
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret 8

Function at 0x56bbb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6b2098
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push esi
mov esi, ecx
mov ecx, dword [0x8c9480]
mov eax, dword [esi + 0x68]
mov eax, dword [eax + 0x28]
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.004ec4b0
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x68]
lea edx, [esp + 4]
mov dword [esp + 0x44], 0
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x10], ecx
call fcn.004ee5e0
mov eax, dword [esp + 0x28]
mov dword [esp + 0x44], 0xffffffff
add eax, 0xfffffff4
pop esi
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x56bc2a
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x56bc2a
push eax
call dword [0x6c74ac]
add esp, 4
lea ecx, [esp]
mov dword [esp], vtable.wxObject.0
call fcn.0056f8d0
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
add esp, 0x44
ret
Function at 0x56c340
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6b2184
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], vtable.wxRendererNative.0
lea eax, [esp + 8]
push 0x15
push eax
mov dword [esp + 0x40], 0
call fcn.00514d00
add esp, 8
push 0x64
push 1
push eax
lea ecx, [esi + 4]
mov byte [esp + 0x44], 1
call fcn.004fc0a0
lea ecx, [esp + 8]
mov byte [esp + 0x38], 3
call fcn.004dd920
lea ecx, [esp + 0x1c]
push 0x10
push ecx
call fcn.00514d00
add esp, 8
push 0x64
push 1
push eax
lea ecx, [esi + 0xc]
mov byte [esp + 0x44], 4
call fcn.004fc0a0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 6
call fcn.004dd920
lea edx, [esp + 8]
push 0xf
push edx
call fcn.00514d00
add esp, 8
push 0x64
push 1
push eax
lea ecx, [esi + 0x14]
mov byte [esp + 0x44], 7
call fcn.004fc0a0
lea ecx, [esp + 8]
mov byte [esp + 0x38], 9
call fcn.004dd920
lea eax, [esp + 0x1c]
push 0x14
push eax
call fcn.00514d00
add esp, 8
push 0x64
push 1
push eax
lea ecx, [esi + 0x1c]
mov byte [esp + 0x44], 0xa
call fcn.004fc0a0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 0xc
call fcn.004dd920
mov ecx, dword [esp + 0x30]
mov dword [esi], vtable.wxRendererGeneric.0
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x577bb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6b2fa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
push edi
mov edi, ecx
push eax
mov dword [esp + 0x10], edi
call fcn.0059b850
xor ebx, ebx
push 0x10
mov dword [edi + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [edi + 0x24], ebx
call fcn.00658ea0
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x577c14
push 0x2000
call dword [0x6c746c]
add esp, 4
mov dword [esi], eax
mov dword [esi + 4], 0x2000
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
jmp 0x577c16
xor esi, esi
mov ecx, dword [esp + 0x10]
mov dword [edi + 0x28], esi
mov eax, dword [esi + 0xc]
inc eax
mov dword [esi + 0xc], eax
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi], vtable.wxTeeInputStream.0
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x578390
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6b3026
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi], vtable.wxArchiveEntry.0
mov eax, dword [esp + 0x28]
mov byte [esi + 0xc], bl
mov byte [esi + 0xd], 0x1c
mov word [esi + 0xe], 0x14
mov word [esi + 0x10], bx
mov word [esi + 0x12], 0xffff
mov ecx, dword [eax]
or ebp, 0xffffffff
mov dword [esi + 0x18], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x28], ebp
mov dword [esi + 0x30], eax
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x2c], ebp
mov dword [esi + 0x34], ecx
mov edx, dword [0x8b0a50]
lea edi, [esi + 0x38]
mov dword [esp + 0x1c], ebx
mov dword [edi], edx
mov dword [esi + 0x40], ebp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x44], ebp
mov dword [esi + 0x4c], ebp
mov eax, dword [0x8b0a50]
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x24]
mov word [esi + 0x54], bx
mov word [esi + 0x56], bx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi], vtable.wxZipEntry.0
mov ecx, dword [eax]
mov byte [esp + 0x1c], 2
cmp dword [ecx - 8], ebx
je 0x57849f
lea edx, [esp + 0x24]
push edx
push ebx
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00578e40
add esp, 0x10
push eax
mov ecx, edi
mov byte [esp + 0x20], 3
call fcn.00571160
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x1c], 2
lea eax, [ecx - 0xc]
mov ecx, dword [ecx - 0xc]
cmp ecx, ebp
je 0x578493
dec ecx
cmp ecx, ebx
mov dword [eax], ecx
jne 0x578493
push eax
call dword [0x6c74ac]
add esp, 4
mov eax, dword [esp + 0x24]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x38]
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x57a020
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6b31f8
push eax
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov dword fs:[0], esp
push ebx
mov ebx, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x24]
mov dword [ecx + 0x30], ebx
mov dword [ecx + 0x28], edi
mov dword [ecx + 0x2c], eax
mov eax, dword [esp + 0x1c]
mov dword [ecx + 0x20], esi
mov dword [ecx + 0x34], edx
push eax
lea ecx, [esp + 0x28]
call fcn.005a80a0
push esi
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0
call fcn.005a80b0
push edi
lea ecx, [esp + 0x28]
call fcn.005a80b0
push ebx
lea ecx, [esp + 0x28]
call fcn.005a80b0
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], 0xffffffff
call sym.SuperMark.exe_public:_void___thiscall_CPlotterView::EmulateCut_void_
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov eax, 0xc
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0x18

Function at 0x57a10a
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6b3218
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ebp, dword [esi + 0x10]
test ebp, ebp
jne 0x57a11a
mov ebp, 0x8c55f4
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ebx
mov edi, ecx
lea ecx, [esp + 0x14]
call fcn.005a80a0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov dx, word [esi + 6]
push edi
push eax
mov ax, word [esi + 4]
push ecx
mov cx, word [esi + 2]
push edx
mov dx, word [esi]
push eax
push ecx
push edx
push 0x6054b50
lea ecx, [esp + 0x30]
mov dword [esp + 0x40], 0
call fcn.005a81b0
mov ecx, eax
call fcn.005a8190
mov ecx, eax
call fcn.005a8190
mov ecx, eax
call fcn.005a8190
mov ecx, eax
call fcn.005a8190
mov ecx, eax
call fcn.005a81b0
mov ecx, eax
call fcn.005a81b0
mov ecx, eax
call fcn.005a8190
mov eax, dword [ebx]
and edi, 0xffff
push edi
push ebp
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 4]
lea ecx, [esp + 0x10]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call sym.SuperMark.exe_public:_void___thiscall_CPlotterView::EmulateCut_void_
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x581370
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
mov cl, byte [edx]
test cl, cl
je 0x581396
movsx ecx, cl
add eax, ecx
inc edx
mov ecx, eax
shl ecx, 0xa
add eax, ecx
mov ecx, eax
shr ecx, 6
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x58137c
lea eax, [eax + eax*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
ret
Function at 0x5893d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6b42b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x8b0a50]
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
push edi
push 0
push ecx
mov ecx, dword [esp + 0x2c]
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push ecx
mov dword [esp + 0x34], 0
call fcn.00589120
mov ebx, dword [0x6c74ac]
add esp, 0x1c
test esi, esi
je 0x589494
lea edx, [esp + 0xc]
push edi
lea eax, [esp + 0x30]
push edx
push eax
call fcn.00587380
push esi
lea ecx, [esp + 0x40]
push eax
push ecx
mov byte [esp + 0x30], 1
call fcn.00571790
add esp, 0x18
push eax
mov ecx, esi
mov byte [esp + 0x1c], 2
call fcn.00571160
mov edx, dword [esp + 0x30]
mov ecx, dword [edx - 0xc]
lea eax, [edx - 0xc]
cmp ecx, 0xffffffff
je 0x589479
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x589479
push eax
call ebx
add esp, 4
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff4
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x589494
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x589494
push eax
call ebx
add esp, 4
mov ecx, dword [esp + 0xc]
lea eax, [ecx - 0xc]
mov ecx, dword [ecx - 0xc]
cmp ecx, 0xffffffff
je 0x5894b0
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x5894b0
push eax
call ebx
add esp, 4
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x58e49a
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6b4ce2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], vtable.wxFileSystemHandler.0
lea edi, [esi + 0xc]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], edi
mov dword [edi], vtable.wxObject.0
mov dword [edi + 4], ebx
mov eax, dword [0x8b0a50]
mov dword [edi + 8], eax
mov ecx, dword [0x8b0a50]
mov dword [edi + 0xc], ecx
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
push edx
push eax
push 0x64
lea ecx, [edi + 0x14]
mov byte [esp + 0x2c], 3
call fcn.00452970
mov dword [edi], vtable.wxFileSystem.0
mov dword [edi + 0x10], ebx
mov ecx, dword [0x8b0a50]
lea edi, [esi + 0x38]
mov dword [edi], ecx
mov edx, dword [0x8b0a50]
lea ecx, [esi + 0x3c]
mov dword [ecx], edx
mov eax, dword [0x8b0a50]
lea ebp, [esi + 0x40]
mov dword [ebp], eax
mov dword [esi], vtable.wxArchiveFSHandler.0
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov eax, dword [0x8b0a50]
push eax
mov byte [esp + 0x24], 7
call fcn.00571200
push eax
mov ecx, edi
call fcn.00571160
push edi
mov ecx, ebp
call fcn.00571160
mov ecx, dword [esp + 0x18]
mov al, 1
mov byte [esi + 0x45], al
mov byte [esi + 0x44], al
mov dword [esi + 0x48], ebx
mov dword [esi + 8], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x59bd10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6b5b08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], vtable.wxBufferedInputStream.0
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x18]
push 1
mov dword [esp + 0x1c], 0
mov edi, dword [eax + 8]
mov ebx, dword [eax + 0xc]
mov edx, dword [ecx]
sub edi, ebx
xor eax, eax
neg edi
adc eax, eax
neg eax
push eax
push edi
call dword [edx + 0x30]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x59bd69
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.0059b890
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x5a06e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6b6247
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 0
call fcn.00572ec0
mov eax, dword [0x8b0a50]
mov dword [esp + 0x2c], 1
mov dword [esp + 0xc], eax
push 0x400
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 2
call fcn.00570990
mov esi, dword [esp + 0x38]
mov byte [esp + 0xb], 0
mov al, byte [esi]
cmp al, 0x20
je 0x5a0744
cmp al, 9
jne 0x5a0747
inc esi
jmp 0x5a073a
cmp byte [esi], 0
je 0x5a07c8
mov ecx, dword [0x6e14e0]
xor bl, bl
push ecx
push 0
lea ecx, [esp + 0x14]
call fcn.00570b00
mov cl, byte [esi]
movsx eax, cl
cmp eax, 0x22
ja case.0x5a0772.3
xor edx, edx
mov dl, byte [eax + 0x5a0830]
jmp dword [edx*4 + 0x5a0820]
test bl, bl
jne 0x5a07a2
mov al, byte [esp + 0xb]
test al, al
sete al
mov byte [esp + 0xb], al
inc esi
jmp 0x5a0760
mov al, byte [esp + 0xb]
test al, al
je case.0x5a0772.0
test bl, bl
jne 0x5a07a2
cmp cl, 0x5c
jne 0x5a07a2
mov bl, 1
jmp 0x5a07a4
xor bl, bl
push ecx
push 1
lea ecx, [esp + 0x14]
call fcn.00570940
inc esi
jmp 0x5a0760
lea ecx, [esp + 0xc]
push 1
push ecx
lea ecx, [esp + 0x1c]
call fcn.00573250
jmp 0x5a073a
mov esi, dword [esp + 0x34]
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.00572ee0
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0xc]
add eax, 0xfffffff4
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x5a07ff
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x5a07ff
push eax
call dword [0x6c74ac]
add esp, 4
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 0
call fcn.005730c0
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x5ac28c
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6b73c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x20]
push esi
mov esi, ecx
push eax
push esi
lea ecx, [esp + 0xc]
call fcn.005907e0
mov eax, dword [esp + 8]
mov dword [esp + 0x1c], 0
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x5ac2e5
cmp byte [eax], 0x21
jne 0x5ac2e5
push eax
push str.Cant_change_immutable_entry__s.
call fcn.00573ad0
add esp, 8
lea ecx, [esp + 4]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00590a00
xor al, al
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
push ebx
add esi, 0x28
push edi
mov edi, eax
cmp dword [esi], 0
jne 0x5ac2fa
push 1
mov ecx, esi
call fcn.005a5c90
mov ecx, dword [esp + 0x30]
push ecx
push edi
mov ecx, esi
call fcn.005a74c0
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x24], 0xffffffff
call fcn.00590a00
mov ecx, dword [esp + 0x1c]
mov al, bl
pop edi
pop ebx
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 8