joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b74c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004098e0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40b7e7
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x411da8]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x40b7e7
cmp eax, 1
je 0x40b808
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40b7e7
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x40b7b4
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x40b7e3
xor eax, eax
inc eax
jmp 0x40b827
cmp edi, eax
jae 0x40b7eb
xor eax, eax
jmp 0x40b827
cmp eax, esi
jae 0x40b7f2
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x411da8]
jmp 0x40b80b
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x401980
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0xffffffff
je 0x401a0f
mov eax, dword [esi + 8]
push edi
push 5
push eax
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov eax, dword [esi + 0x7c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x401a01
mov byte [esi + 0x8c], 0
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetCommMask]
mov edx, dword [esi + 0xa0]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x7c]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4019e7
mov ecx, dword [esi + 0x7c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x401a01
mov edx, dword [esi + 0x7c]
push edx
call edi
mov eax, dword [esi + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [esi + 0x7c], 0
mov ecx, dword [esi + 8]
push ecx
call edi
mov dword [esi + 8], 0xffffffff
pop edi
pop esi
ret

Function at 0x401ca0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 8]
mov dword [esi], vtable.cnComm.0
cmp eax, 0xffffffff
je 0x401d32
mov eax, dword [esi + 8]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x401d25
mov byte [esi + 0x8c], 0
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetCommMask]
mov edx, dword [esi + 0xa0]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x7c]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x401d0b
mov ecx, dword [esi + 0x7c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x401d25
mov edx, dword [esi + 0x7c]
push edx
call edi
mov eax, dword [esi + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [esi + 0x7c], 0
mov ecx, dword [esi + 8]
push ecx
call edi
mov dword [esi + 8], 0xffffffff
mov eax, dword [esi + 0x64]
test eax, eax
je 0x401d3c
push eax
call edi
mov eax, dword [esi + 0x78]
test eax, eax
je 0x401d46
push eax
call edi
mov eax, dword [esi + 0xa0]
test eax, eax
je 0x401d53
push eax
call edi
lea edx, [esi + 0xa4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
test byte [esp + 0xc], 1
je 0x401d70
push esi
call fcn.005b6480
add esp, 4
mov eax, esi
pop edi
pop esi
ret 4
Function at 0x404320
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x29e]
mov ecx, dword [esi + 0x2a2]
mov dword [esp + 0x18], eax
xor eax, eax
mov al, byte [esi + 0x28a]
xor dl, dl
mov dword [esp + 0x1c], ecx
lea edi, [esi + 0x2a8]
lea ebp, [esp + eax + 0x18]
xor eax, eax
mov bl, byte [edi]
cmp dl, 8
jae 0x404370
mov ecx, eax
shl bl, cl
or byte [ebp - 1], bl
jmp 0x404378
lea ecx, [eax - 8]
shl bl, cl
or byte [ebp], bl
inc dl
inc eax
add edi, 4
cmp dl, 0x10
jb 0x404360
xor eax, eax
xor bl, bl
mov al, byte [esi + 0x28c]
lea ecx, [esp + eax + 0x17]
lea edx, [eax - 1]
test edx, edx
mov byte [ecx], 0
jle 0x4043b6
xor eax, eax
mov al, byte [esp + eax + 0x18]
add byte [ecx], al
inc bl
mov byte [esp + 0x10], bl
mov eax, dword [esp + 0x10]
and eax, 0xff
cmp eax, edx
jl 0x40439d
lea eax, [esi + 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x1c0]
mov edi, dword [sym.imp.KERNEL32.dll_ClearCommError]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
or ebp, 0xffffffff
cmp eax, ebp
je 0x4044a1
mov edx, dword [esi + 0x1c0]
lea ecx, [esp + 0x10]
push 0
push ecx
push edx
call edi
test eax, eax
je 0x40440b
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x40440b
mov eax, dword [esi + 0x1c0]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_PurgeComm]
lea ecx, [esi + 0x220]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x1c0]
push edx
lea eax, [esp + 0x20]
push 8
push eax
push ecx
mov dword [esp + 0x28], 0
call ebx
test eax, eax
jne 0x404439
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 0x1c0], ebp
je 0x4044a1
mov eax, dword [esi + 0x1c0]
lea edx, [esp + 0x14]
push 0
push edx
push eax
call edi
test eax, eax
je 0x40446c
mov eax, dword [esp + 0x14]
test eax, eax
jbe 0x40446c
mov ecx, dword [esi + 0x1c0]
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_PurgeComm]
lea edx, [esi + 0x220]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esi + 0x1c0]
push eax
lea ecx, [esp + 0x20]
push 8
push ecx
push edx
mov dword [esp + 0x24], 0
call ebx
test eax, eax
jne 0x4044a1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x404550
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x424]
test eax, eax
je 0x4045e8
mov eax, dword [esi + 0x28e]
mov ecx, dword [esi + 0x292]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x1c0]
cmp eax, 0xffffffff
mov dword [esp + 0x10], ecx
je 0x4045e8
mov eax, dword [esi + 0x1c0]
lea edx, [esp + 4]
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
test eax, eax
je 0x4045b2
mov eax, dword [esp + 4]
test eax, eax
jbe 0x4045b2
mov ecx, dword [esi + 0x1c0]
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_PurgeComm]
lea edx, [esi + 0x220]
lea eax, [esp + 8]
push edx
mov edx, dword [esi + 0x1c0]
push eax
lea ecx, [esp + 0x14]
push 8
push ecx
push edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4045e8
pop esi
add esp, 0x10
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
add esp, 0x10
ret

Function at 0x404553
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x424]
test eax, eax
je 0x4045e8
mov eax, dword [esi + 0x28e]
mov ecx, dword [esi + 0x292]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x1c0]
cmp eax, 0xffffffff
mov dword [esp + 0x10], ecx
je 0x4045e8
mov eax, dword [esi + 0x1c0]
lea edx, [esp + 4]
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
test eax, eax
je 0x4045b2
mov eax, dword [esp + 4]
test eax, eax
jbe 0x4045b2
mov ecx, dword [esi + 0x1c0]
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_PurgeComm]
lea edx, [esi + 0x220]
lea eax, [esp + 8]
push edx
mov edx, dword [esi + 0x1c0]
push eax
lea ecx, [esp + 0x14]
push 8
push ecx
push edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4045e8
pop esi
add esp, 0x10
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
add esp, 0x10
ret

Function at 0x4045f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0x424]
test eax, eax
je 0x404678
push esi
lea esi, [ebp + 0x404]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edi, [ebp + 0x2e8]
mov edx, 0x10
mov eax, edi
mov ecx, dword [eax - 0x40]
test ecx, ecx
je 0x404629
mov ecx, dword [eax]
test ecx, ecx
je 0x404629
dec ecx
mov dword [eax], ecx
add eax, 4
dec edx
jne 0x404619
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor cl, cl
mov eax, edi
mov edx, 0x10
mov esi, dword [eax - 0x40]
test esi, esi
je 0x404664
cmp dword [eax], 0
jne 0x404664
mov esi, dword [ebp + 0x42c]
test esi, esi
je 0x404664
mov cl, 1
mov dword [eax - 0x40], 0
mov dword [eax], 0
add eax, 4
dec edx
jne 0x40463f
pop edi
pop esi
test cl, cl
je 0x404678
mov ecx, ebp
pop ebp
jmp fcn.00404320
pop ebp
ret
Function at 0x406e60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6105aa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0045fca0
xor edi, edi
mov ecx, esi
mov dword [esi + 0x134], edi
mov dword [esi + 0x138], edi
mov dword [esi + 0x13c], edi
mov dword [esi + 0x140], edi
mov dword [esp + 0x18], edi
mov dword [esi], vtable.wxWindow.0
call fcn.00456640
push edi
lea ecx, [esi + 0x144]
mov dword [esp + 0x1c], 1
call fcn.004634b0
mov ecx, esi
mov dword [esi], vtable.wxPanel.0
call fcn.0046c950
lea ecx, [esi + 0x178]
mov dword [esp + 0x18], 2
mov dword [esp + 0xc], ecx
mov dword [ecx + 4], edi
mov byte [esp + 0x18], 3
mov dword [ecx], vtable.wxColour.0
call fcn.0046cf80
mov eax, dword [0x6e0ea0]
mov dword [esi + 0x18c], eax
lea ecx, [esi + 0x190]
mov byte [esp + 0x18], 5
call fcn.0044d490
mov ecx, esi
mov byte [esp + 0x18], 6
mov dword [esi], vtable.CamMovPanel.0
call fcn.00407040
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00406f60
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x14
Function at 0x4086e9
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61078e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0045fca0
xor ebx, ebx
mov ecx, esi
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.wxWindow.0
call fcn.00456640
push ebx
lea ecx, [esi + 0x144]
mov dword [esp + 0x20], 1
call fcn.004634b0
mov ecx, esi
mov dword [esi], vtable.wxPanel.0
call fcn.0046c950
lea edi, [esi + 0x160]
mov dword [esp + 0x1c], 2
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004e9420
mov dword [edi], vtable.wxTimerBase.0
mov dword [edi + 0x2c], 0xffffffff
mov dword [edi + 0x30], ebx
mov byte [edi + 0x34], bl
mov dword [edi + 0x28], edi
mov eax, dword [0x6cdbb0]
dec eax
mov dword [0x6cdbb0], eax
mov dword [edi + 0x2c], eax
mov ecx, edi
mov byte [esp + 0x1c], 3
mov dword [edi], vtable.wxTimer.0
call fcn.0046f240
mov ecx, esi
mov byte [esp + 0x1c], 4
mov dword [esi], vtable.CamMovPreviewPanel.0
call fcn.004ab820
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x408830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6107ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0045fca0
xor ebx, ebx
mov ecx, esi
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.wxWindow.0
call fcn.00456640
push ebx
lea ecx, [esi + 0x144]
mov dword [esp + 0x20], 1
call fcn.004634b0
mov ecx, esi
mov dword [esi], vtable.wxPanel.0
call fcn.0046c950
lea edi, [esi + 0x160]
mov dword [esp + 0x1c], 2
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004e9420
mov dword [edi + 0x30], ebx
mov byte [edi + 0x34], bl
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], 0x2711
mov ecx, edi
mov byte [esp + 0x1c], 3
mov dword [edi], vtable.wxTimer.0
call fcn.0046f240
mov ecx, esi
mov byte [esp + 0x1c], 4
mov dword [esi], vtable.CamMovPreviewPanel.0
call fcn.004ab820
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push eax
push ecx
mov ecx, esi
call fcn.00408930
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0x14
Function at 0x409b60
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push ebx
push ebp
mov ebp, ecx
push esi
lea esi, [eax + 5]
push edi
mov ecx, dword [ebp + 0x18]
mov edi, edx
shl esi, 5
mov ebx, ecx
add esi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov bl, byte [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cl, byte [ebp + 0x20]
mov esi, dword [ebp + 0x24]
add cl, bl
dec cl
cmp eax, 0x32
mov byte [esi + edx - 1], cl
jne 0x409ba8
mov eax, dword [ebp + 0x780]
jmp 0x409bc0
cmp eax, 0x33
jne 0x409bb5
mov eax, dword [ebp + 0x784]
jmp 0x409bc0
cmp eax, 0x34
jne 0x409bd8
mov eax, dword [ebp + 0x788]
cmp eax, 0xff
je 0x409ca9
mov cl, byte [esp + 0x20]
mov byte [eax + edx - 1], cl
jmp 0x409ca9
cmp eax, 0x35
jne 0x409c19
mov eax, dword [ebp + 0x78c]
cmp eax, 0xff
je 0x409ca9
cmp dword [ebp + 0x790], 0xff
je 0x409ca9
mov cl, byte [esp + 0x20]
mov byte [eax + edx - 1], cl
mov eax, dword [ebp + 0x790]
mov cl, byte [esp + 0x24]
mov byte [eax + edx - 1], cl
jmp 0x409ca9
cmp eax, 6
je 0x409c66
cmp eax, 8
je 0x409c66
cmp eax, 2
je 0x409c2d
cmp eax, 0xc
jne 0x409ca9
mov ecx, dword [ebp + 0x90]
test ecx, ecx
mov dword [esp + 0x20], ecx
jle 0x409ca9
mov esi, dword [ebp + 0x94]
mov edi, dword [ebp + 0x98]
xor al, al
cmp esi, edi
jge 0x409c5e
mov bl, 1
mov ecx, esi
shl bl, cl
or al, bl
inc esi
cmp esi, edi
jl 0x409c4d
mov ecx, dword [esp + 0x20]
mov bl, al
and al, byte [esp + 0x24]
jmp 0x409c9d
mov ecx, dword [ebp + 0x84]
test ecx, ecx
mov dword [esp + 0x24], ecx
jle 0x409ca9
mov esi, dword [ebp + 0x88]
mov edi, dword [ebp + 0x8c]
xor al, al
cmp esi, edi
jge 0x409c97
mov bl, 1
mov ecx, esi
shl bl, cl
or al, bl
inc esi
cmp esi, edi
jl 0x409c86
mov ecx, dword [esp + 0x24]
mov bl, al
and al, byte [esp + 0x20]
not bl
and bl, byte [ecx + edx - 1]
or bl, al
mov byte [ecx + edx - 1], bl
lea eax, [ebp + 0x50]
mov ebx, 4
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x409d40
cmp ecx, dword [ebp + 0x18]
jg 0x409d40
mov byte [ecx + edx - 1], 0
mov ecx, dword [eax - 0xc]
test ecx, ecx
jne 0x409cec
mov esi, dword [eax - 4]
mov ecx, dword [eax]
dec esi
cmp esi, ecx
jge 0x409d40
mov ecx, dword [eax - 8]
lea edi, [ecx + edx - 1]
mov cl, byte [esi + edx]
add byte [edi], cl
mov ecx, dword [eax]
inc esi
cmp esi, ecx
jl 0x409cd7
jmp 0x409d40
cmp ecx, 1
jne 0x409d10
mov esi, dword [eax - 4]
mov ecx, dword [eax]
dec esi
cmp esi, ecx
jge 0x409d40
mov ecx, dword [eax - 8]
lea edi, [ecx + edx - 1]
mov cl, byte [esi + edx]
xor byte [edi], cl
mov ecx, dword [eax]
inc esi
cmp esi, ecx
jl 0x409cfb
jmp 0x409d40
cmp ecx, 2
jne 0x409d40
mov esi, dword [eax - 4]
mov ecx, dword [eax]
dec esi
cmp esi, ecx
jge 0x409d32
mov ecx, dword [eax - 8]
lea edi, [ecx + edx - 1]
mov cl, byte [esi + edx]
add byte [edi], cl
mov ecx, dword [eax]
inc esi
cmp esi, ecx
jl 0x409d1f
mov ecx, dword [eax - 8]
lea esi, [ecx + edx - 1]
or cl, 0xff
sub cl, byte [esi]
mov byte [esi], cl
add eax, 0x10
dec ebx
jne 0x409cb1
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
Function at 0x40ed29
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x610f3e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0045fca0
xor ebx, ebx
mov ecx, esi
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.wxWindow.0
call fcn.00456640
push ebx
lea ecx, [esi + 0x144]
mov dword [esp + 0x20], 1
call fcn.004634b0
mov ecx, esi
mov dword [esi], vtable.wxPanel.0
call fcn.0046c950
lea edi, [esi + 0x158]
mov dword [esp + 0x1c], 2
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004e9420
mov dword [edi], vtable.wxTimerBase.0
mov dword [edi + 0x2c], 0xffffffff
mov dword [edi + 0x30], ebx
mov byte [edi + 0x34], bl
mov dword [edi + 0x28], edi
mov eax, dword [0x6cdbb0]
dec eax
mov dword [0x6cdbb0], eax
mov dword [edi + 0x2c], eax
mov ecx, edi
mov byte [esp + 0x1c], 3
mov dword [edi], vtable.wxTimer.0
call fcn.0046f240
mov ecx, esi
mov byte [esp + 0x1c], 4
mov dword [esi], vtable.CamPtzPreviewPanel.0
call fcn.004ab820
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x40ee20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x610f7e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0045fca0
xor ebx, ebx
mov ecx, esi
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.wxWindow.0
call fcn.00456640
push ebx
lea ecx, [esi + 0x144]
mov dword [esp + 0x20], 1
call fcn.004634b0
mov ecx, esi
mov dword [esi], vtable.wxPanel.0
call fcn.0046c950
lea edi, [esi + 0x158]
mov dword [esp + 0x1c], 2
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004e9420
mov dword [edi + 0x30], ebx
mov byte [edi + 0x34], bl
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], 0x2711
mov ecx, edi
mov byte [esp + 0x1c], 3
mov dword [edi], vtable.wxTimer.0
call fcn.0046f240
mov ecx, esi
mov byte [esp + 0x1c], 4
mov dword [esi], vtable.CamPtzPreviewPanel.0
call fcn.004ab820
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push eax
push ecx
mov ecx, esi
call fcn.0040ef20
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0x14
Function at 0x40f780
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x611152
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0045fca0
xor edi, edi
mov ecx, esi
mov dword [esi + 0x134], edi
mov dword [esi + 0x138], edi
mov dword [esi + 0x13c], edi
mov dword [esi + 0x140], edi
mov dword [esp + 0x18], edi
mov dword [esi], vtable.wxWindow.0
call fcn.00456640
push edi
lea ecx, [esi + 0x144]
mov dword [esp + 0x1c], 1
call fcn.004634b0
mov ecx, esi
mov dword [esi], vtable.wxPanel.0
call fcn.0046c950
push fcn.0047d2b0
push fcn.0040f710
push 8
lea eax, [esi + 0x194]
push 0x14
push eax
mov dword [esp + 0x2c], 2
call fcn.005b65f2
lea ecx, [esi + 0x234]
mov dword [esp + 0xc], ecx
mov dword [ecx + 4], edi
mov byte [esp + 0x18], 4
mov dword [ecx], vtable.wxColour.0
call fcn.0046cf80
lea ecx, [esi + 0x248]
mov byte [esp + 0x18], 5
call fcn.0044d490
lea ecx, [esi + 0x268]
mov byte [esp + 0x18], 6
call fcn.0044d490
mov ecx, esi
mov byte [esp + 0x18], 7
mov dword [esi], vtable.CamRecPanel.0
call fcn.0040f9b0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0040f8a0
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x14
Function at 0x411a00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6114c7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0045fca0
xor ebx, ebx
mov ecx, esi
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
mov dword [esp + 0x20], ebx
mov dword [esi], vtable.wxWindow.0
call fcn.00456640
push ebx
lea ecx, [esi + 0x144]
mov dword [esp + 0x24], 1
call fcn.004634b0
mov ecx, esi
mov dword [esi], vtable.wxPanel.0
call fcn.0046c950
lea ecx, [esi + 0x1b4]
mov dword [esp + 0x20], 2
call fcn.0044d490
push fcn.0046b6c0
push 0x411970
push 0x24
lea eax, [esi + 0x1d4]
push 0x7c
push eax
mov byte [esp + 0x34], 3
call fcn.005b65f2
lea edi, [esi + 0x1344]
mov dword [esp + 0x10], edi
mov dword [edi + 4], ebx
mov ecx, edi
mov byte [esp + 0x20], 5
mov dword [edi], vtable.wxColour.0
call fcn.0046cf80
lea ecx, [edi + 0x14]
mov dword [esp + 0x14], ecx
mov dword [ecx + 4], ebx
mov byte [esp + 0x20], 7
mov dword [ecx], vtable.wxColour.0
call fcn.0046cf80
lea ecx, [edi + 0x28]
mov dword [esp + 0x14], ecx
mov dword [ecx + 4], ebx
mov byte [esp + 0x20], 9
mov dword [ecx], vtable.wxColour.0
call fcn.0046cf80
mov ecx, esi
mov byte [esp + 0x20], 0xa
mov dword [esi], vtable.CamVideoPanel.0
call fcn.00411c40
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00411b40
mov eax, esi
pop edi
mov ecx, dword [esp + 0x14]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0x14