joyce8/EMBER2024-capa huggingface dataset:
Function at 0x510300
Capabilities:
Log keystrokes via polling

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
nop word [eax + eax]
cmp dword [eax*8 + 0x8afbfc], ecx
je 0x5103d5
inc eax
cmp eax, 0x4d
jb 0x510310
push ebx
xor bl, bl
cmp ecx, 0x177
jg 0x5103a2
je 0x510365
lea eax, [ecx - 0x7f]
cmp eax, 0xf0
ja case.0x5103ad.383
movzx eax, byte [eax + 0x510418]
jmp dword [eax*4 + 0x5103ec]
mov bl, 1
mov eax, 0x21
jmp 0x5103c9
mov bl, 1
mov eax, 0x22
jmp 0x5103c9
mov bl, 1
mov eax, 0x23
jmp 0x5103c9
mov bl, 1
mov eax, 0x24
jmp 0x5103c9
mov bl, 1
mov eax, 0x25
jmp 0x5103c9
mov bl, 1
mov eax, 0x26
jmp 0x5103c9
mov bl, 1
mov eax, 0x27
jmp 0x5103c9
mov bl, 1
mov eax, 0x28
jmp 0x5103c9
mov bl, 1
mov eax, 0x2d
jmp 0x5103c9
mov bl, 1
mov eax, 0x2e
jmp 0x5103c9
lea eax, [ecx - 0x178]
cmp eax, 9
ja case.0x5103ad.383
jmp dword [eax*4 + 0x51050c]
push esi
movzx esi, cx
push esi
call dword [sym.imp.USER32.dll_VkKeyScanW]
cmp al, 0xff
movzx eax, al
jne 0x5103c8
mov eax, esi
pop esi
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x5103d3
mov byte [ecx], bl
pop ebx
ret
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x5103e0
mov byte [ecx], 0
mov ax, word [eax*8 + 0x8afbf8]
ret

Function at 0x511960
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp esi, 1
je 0x511974
cmp esi, 2
je 0x511974
cmp esi, 4
jne 0x5119af
cmp dword [0xa5c6a0], 0
je 0x5119af
push str.cant_use_wxGetKeyState___for_mouse_buttons
push str.key___0x01__key___0x02__key___0x04
push str.wxGetKeyState
push 0x1b9b
push str.C:_vcpkg_buildtreeswxwidgets_src_v3.2.3_90b1eb06ca.clean_srcmswwindow.cpp
call fcn.0073ce90
add esp, 0x14
cmp byte [0xea464c], 0
je 0x5119af
mov byte [0xea464c], 0
int3
push 0
push esi
call fcn.00510300
add esp, 8
movzx eax, ax
cmp esi, 0x16c
je 0x5119df
cmp esi, 0x137
je 0x5119df
cmp esi, 0x16d
je 0x5119df
pop esi
mov dword [esp + 4], eax
jmp 0x512560
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
pop esi
setne al
ret
push esi
mov esi, dword [esp + 8]
cmp si, 1
je 0x512571
cmp si, 2
jne 0x512589
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x512589
xor eax, eax
cmp si, 1
sete al
lea esi, [eax + 1]
movzx eax, si
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
pop esi
ret
Function at 0x5329d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x84ffde
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
movsd xmm0, qword [0x894398]
movsd qword [esi], xmm0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi + 8], ecx
mov dword [esi + 0x14], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 7
mov word [esi + 0x14], ax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x10], 0x46
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], 0x190
mov dword [esi + 0x3c], eax
push dword [ebp + 0x24]
mov dword [ebp - 4], eax
push dword [ebp + 0x20]
mov dword [ebp - 0x10], 1
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call fcn.00532bc0
add esp, 0x1c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5538f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x853285
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov al, byte [esi + 0x10]
movaps xmm0, xmmword [0x8c04c0]
and al, 0xe3
movups xmmword [esi + 0x30], xmm0
or al, 3
mov dword [esi], vtable.wxDCImpl.0
movups xmmword [esi + 0x40], xmm0
mov dword [esi + 0xc], 0
movups xmmword [esi + 0x50], xmm0
mov byte [esi + 0x10], al
movsd qword [esi + 0x68], xmm0
xorps xmm0, xmm0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x60], 1
mov dword [esi + 0x64], 1
movups xmmword [esi + 0x70], xmm0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 5
mov dword [esi + 0xa4], 0x6a
mov dword [esi + 0xa8], 1
mov dword [ebp - 4], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xac], vtable.wxPen.0
lea ecx, [esi + 0xb4]
mov byte [ebp - 4], 1
call fcn.00551ba0
lea ecx, [esi + 0xbc]
mov byte [ebp - 4], 2
call fcn.00551ba0
push 0xb
mov byte [ebp - 4], 3
call fcn.0051bb30
mov ecx, eax
mov dword [esi + 0xc4], vtable.wxObject.0
add esp, 4
mov eax, dword [ecx + 4]
mov dword [esi + 0xc8], eax
test eax, eax
je 0x553a5f
inc dword [eax + 4]
mov dword [esi + 0xc4], vtable.wxColour.0
mov eax, dword [ecx + 8]
mov dword [esi + 0xcc], eax
movzx eax, byte [ecx + 0xc]
mov byte [esi + 0xd0], al
movzx eax, byte [ecx + 0xd]
mov byte [esi + 0xd1], al
movzx eax, byte [ecx + 0xe]
mov byte [esi + 0xd2], al
movzx eax, byte [ecx + 0xf]
mov byte [esi + 0xd3], al
movzx eax, byte [ecx + 0x10]
mov byte [esi + 0xd4], al
push 0x12
mov byte [ebp - 4], 4
call fcn.0051bb30
mov ecx, eax
mov dword [esi + 0xd8], vtable.wxObject.0
add esp, 4
mov eax, dword [ecx + 4]
mov dword [esi + 0xdc], eax
test eax, eax
je 0x553ace
inc dword [eax + 4]
mov dword [esi + 0xd8], vtable.wxColour.0
mov eax, dword [ecx + 8]
mov dword [esi + 0xe0], eax
movzx eax, byte [ecx + 0xc]
mov byte [esi + 0xe4], al
movzx eax, byte [ecx + 0xd]
mov byte [esi + 0xe5], al
movzx eax, byte [ecx + 0xe]
mov byte [esi + 0xe6], al
movzx eax, byte [ecx + 0xf]
mov byte [esi + 0xe7], al
movzx eax, byte [ecx + 0x10]
mov byte [esi + 0xe8], al
mov eax, dword [ebp + 8]
mov dword [esi + 0xf0], 0
mov dword [esi + 0xec], vtable.wxFont.0
mov dword [esi + 0xf8], 0
mov dword [esi + 0xf4], vtable.wxPalette.0
mov dword [esi + 8], eax
mov eax, esi
mov byte [esi + 0xfc], 0
mov dword [esi + 0x100], 0
mov dword [esi + 0x104], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x10c], 0
mov byte [esi + 0x110], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x56ae80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, ecx
cmp dword [esi + 4], 0x100
jne 0x56aec8
mov eax, 0x2000
test word [esi + 0xe], ax
jne 0x56aec8
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x56aec8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x56aec8
mov eax, dword [esi + 8]
cmp eax, 0xd
je 0x56aed5
cmp eax, 0x1b
je 0x56aed5
cmp eax, 0x73
je 0x56aeee
push esi
mov ecx, ebx
call fcn.00437060
pop esi
pop ebx
ret 4
push 0
push 0
push 0x157
push dword [ebx + 0x13c]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x56aec8
pop esi
xor al, al
pop ebx
ret 4
Function at 0x583840
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x83d6ed
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0xa5d1d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
lea eax, [esi + 0x30]
push eax
lea ecx, [esi + 8]
call fcn.004f1350
mov eax, dword [ebp + 0x10]
mov edx, 0x88b2f0
test eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x20], 0
cmovne edx, eax
mov dword [ebp - 0x1c], 7
mov ecx, edx
xor eax, eax
mov word [ebp - 0x30], ax
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5838b0
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x30]
call fcn.00437690
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp + 0x14]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.004cc680
push dword [ebp - 0x18]
call fcn.008058ea
mov edx, dword [ebp - 0x1c]
add esp, 4
cmp edx, 8
jb 0x58392e
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x583924
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x583949
push edx
push ecx
call fcn.007fff65
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.008001d2
mov esp, ebp
pop ebp
ret
call fcn.00805899
int3
Function at 0x5948e0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x34
mov eax, dword [0xa5d1d4]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [0xe7aa7c]
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
movlpd qword [esp + 0x18], xmm0
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x28], xmm0
mov dword [esp], 0x28
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
test eax, eax
je 0x5949dd
lea ecx, [esp]
push ecx
push 0
push 0x43b
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x5949dd
push esi
push dword [esp + 0xc]
call fcn.00511290
mov esi, eax
add esp, 4
test esi, esi
je 0x5949dc
mov edx, dword [esi]
mov ecx, esi
push edi
mov edx, dword [edx + 0xfc]
call edx
test al, al
je 0x5949cd
push esi
call fcn.004ff8d0
mov esi, eax
add esp, 4
test esi, esi
je 0x5949db
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov edi, eax
cmp edi, 0xa5afc0
je 0x5949bd
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x5949a8
push 0xa5afc0
call fcn.004eeb10
test al, al
jne 0x5949bd
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x5949db
push 0xa5afc0
call fcn.004eeb10
test al, al
je 0x5949db
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x3c4]
call eax
test al, al
je 0x5949db
push 0
push dword [0xe7aa7c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.008001d2
add esp, 0x34
ret

Function at 0x59b360
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x85a0d3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 1
mov dword [esi], vtable.wxImageRefData.0
mov dword [ebp - 4], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], vtable.wxPalette.0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
push 0
call fcn.007476c0
push 0
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 2
call fcn.007476c0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x14], 0
mov word [esi + 0x19], 0
mov byte [esi + 0x1b], 0
mov byte [esi + 0x18], 0
mov word [esi + 0x20], 0
mov byte [esi + 0x22], 0
mov eax, dword [0xa5b7bc]
mov dword [esi + 0x24], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5b5ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 8]
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, 0x1001
movzx eax, word [edi + 0x96]
cmp ax, si
jne 0x5b5ae3
movzx ebp, byte [edx]
jmp 0x5b5ae6
movsx ebp, ax
mov ebx, dword [esp + 0x1c]
xor ecx, ecx
cmp ax, si
sete cl
cmp ecx, dword [esp + 0x24]
jge 0x5b5c3a
nop dword [eax]
mov al, byte [ecx + edx]
mov ebx, ebp
mov edx, dword [edi + 0x88]
inc ecx
movzx eax, al
shl ebx, 8
add ebx, eax
mov dword [esp + 0x14], ecx
mov esi, ebx
mov dword [esp + 0x10], eax
shr esi, 0xc
xor esi, ebx
and esi, 0x1fff
mov ecx, esi
mov eax, dword [edx + ecx*4]
shr eax, 0xc
cmp eax, 0xfffff
je 0x5b5b54
cmp ebx, eax
je 0x5b5bce
inc ecx
and ecx, 0x1fff
mov eax, dword [edx + ecx*4]
shr eax, 0xc
cmp eax, 0xfffff
jne 0x5b5b38
push ebp
push dword [esp + 0x20]
mov ecx, edi
call fcn.005b5ca0
test al, al
je 0x5b5c7c
movzx eax, word [edi + 0x90]
mov ecx, 0xfff
mov ebp, dword [esp + 0x10]
cmp ax, cx
jl 0x5b5bd9
movsx eax, word [edi + 0x8e]
mov ecx, edi
mov ebx, dword [esp + 0x1c]
push eax
push ebx
call fcn.005b5ca0
test al, al
je 0x5b5c7c
mov ax, word [edi + 0x8c]
mov ecx, dword [edi + 0x88]
inc ax
mov word [edi + 0x90], ax
mov eax, 0x1fff
mov dword [edi + 0x92], 0x2000009
nop
mov dword [ecx + eax*4], 0xffffffff
sub eax, 1
jns 0x5b5bc0
jmp 0x5b5c28
mov ebp, dword [edx + ecx*4]
and ebp, 0xfff
jmp 0x5b5c24
mov ecx, dword [edi + 0x88]
movsx edx, ax
inc eax
mov word [edi + 0x90], ax
mov eax, dword [ecx + esi*4]
and eax, 0xfffff000
cmp eax, 0xfffff000
je 0x5b5c16
nop dword [eax]
inc esi
and esi, 0x1fff
mov eax, dword [ecx + esi*4]
and eax, 0xfffff000
cmp eax, 0xfffff000
jne 0x5b5c00
and edx, 0xfff
shl ebx, 0xc
or edx, ebx
mov dword [ecx + esi*4], edx
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
cmp ecx, dword [esp + 0x24]
jl 0x5b5b00
cmp dword [edi + 0x84], 0
mov word [edi + 0x96], bp
jne 0x5b5c88
push ebp
push ebx
mov ecx, edi
call fcn.005b5ca0
test al, al
je 0x5b5c7c
movsx eax, word [edi + 0x8c]
mov ecx, edi
push eax
push ebx
call fcn.005b5ca0
test al, al
je 0x5b5c7c
push 0x1000
push ebx
mov ecx, edi
call fcn.005b5ca0
test al, al
jne 0x5b5c88
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0xc
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 0xc
Function at 0x5e7470
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x10
mov edi, ecx
call esi
test ax, ax
js 0x5e74b7
push 0x11
call esi
test ax, ax
js 0x5e74b7
push 0x12
call esi
test ax, ax
js 0x5e74b7
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x94]
push eax
call fcn.00508ad0
push eax
call fcn.00507ac0
add esp, 8
test al, al
je 0x5e74b7
pop edi
mov al, 1
pop esi
ret
pop edi
xor al, al
pop esi
ret

Function at 0x5e7ee0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push ebx
push edi
cmp dword [eax + 4], 0x100
jne case.0x5e7fb9.3
mov edi, dword [eax + 8]
mov ecx, 0x2000
test word [eax + 0xe], cx
je 0x5e7f11
cmp edi, 8
jne case.0x5e7fb9.3
pop edi
xor al, al
pop ebx
ret 4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
test ax, ax
push 0x10
sets bl
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
sets cl
add ecx, ebx
sub ecx, 0
je 0x5e7f7d
sub ecx, 1
je 0x5e7f93
sub ecx, 1
je case.0x5e7fb9.3
cmp dword [0xa5c6a0], 0
je 0x5e7f7d
push str.how_many_modifiers_have_we_got_
push str._Assert_failure_
push str.wxMSWTextEntryShouldPreProcessMessage
push 0x44d
push str.C:_vcpkg_buildtreeswxwidgets_src_v3.2.3_90b1eb06ca.clean_srcmsw_textentry.cpp
call fcn.0073ce90
add esp, 0x14
cmp byte [0xea464c], 0
je 0x5e7f7d
mov byte [0xea464c], 0
int3
sub edi, 0x23
je case.0x5e7fb9.0
sub edi, 1
je case.0x5e7fb9.0
sub edi, 0xa
jne case.0x5e7fb9.3
pop edi
xor al, al
pop ebx
ret 4
add edi, 0xffffffdd
test ebx, ebx
je 0x5e7fad
cmp edi, 0x35
ja case.0x5e7fb9.3
movzx eax, byte [edi + 0x5e7fd0]
jmp dword [eax*4 + 0x5e7fc8]
cmp edi, 0xb
ja case.0x5e7fb9.3
movzx eax, byte [edi + 0x5e8010]
jmp dword [eax*4 + 0x5e8008]
pop edi
mov al, 1
pop ebx
ret 4
Function at 0x5eaa80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8559a8
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0xa5d1d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
cmp eax, 9
je 0x5eabaa
cmp eax, 0xd
jne 0x5eabf0
push 0
push 0
push 0x157
push dword [edi + 0x13c]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x5eabf0
push dword [edi + 0x40]
lea ecx, [ebp - 0x6c]
push dword [0xe7a7dc]
call fcn.004cb240
mov eax, dword [edi + 0x190]
lea ecx, [edi + 0x190]
mov dword [ebp - 4], 0
call dword [eax + 0x18]
mov edx, dword [edi + 0x1a4]
lea ecx, [edi + 0x1a4]
mov ebx, eax
lea eax, [ebp - 0x8c]
push eax
mov dword [ebp - 0x20], ebx
call dword [edx + 0x14]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
cmp ecx, eax
je 0x5eab45
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x5eab39
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x40]
call fcn.00437690
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0
call fcn.00436d10
push ebx
lea eax, [ebp - 0x6c]
mov ecx, edi
push eax
call fcn.00568960
lea eax, [ebp - 0x6c]
mov ecx, edi
push eax
call fcn.00544ef0
test al, al
jne 0x5eab88
lea ecx, [edi + 0x1a4]
call fcn.005e7470
test al, al
jne 0x5eab88
lea ecx, [ebp - 0x6c]
call fcn.0047aa20
jmp 0x5eabf0
lea ecx, [ebp - 0x40]
call fcn.00436d10
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], 2
mov dword [ebp - 0x6c], vtable.wxObject.0
call fcn.0073d950
mov al, 1
jmp 0x5eabf2
mov eax, dword [edi + 0xe0]
shr eax, 6
test al, 1
jne 0x5eabf0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 0x10
call esi
test ax, ax
mov ecx, 1
push 0x11
cmovns ebx, ecx
call esi
test ax, ax
jns 0x5eabda
or ebx, 2
mov ecx, dword [edi + 0x44]
test ecx, ecx
je 0x5eabf0
mov eax, dword [ecx]
push ebx
mov eax, dword [eax + 0x284]
call eax
test al, al
jne 0x5eaba6
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.008001d2
mov esp, ebp
pop ebp
ret 4
Function at 0x606a70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
push dword [esi + 0x18]
call dword [eax + 4]
mov eax, dword [esi]
mov ecx, esi
push dword [esi + 0x20]
call dword [eax + 0x1c]
mov ecx, dword [esi + 0x1c]
test ecx, ecx
jle 0x606a94
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 8]
mov edx, dword [esi]
lea eax, [esi + 0x24]
push eax
mov ecx, esi
call dword [edx + 0x18]
mov edx, dword [esi]
lea eax, [esi + 0x4c]
push eax
lea eax, [esi + 0x44]
mov ecx, esi
push eax
call dword [edx + 0x20]
cmp dword [esi + 0x74], 0
lea ecx, [esi + 0x6c]
jle 0x606ac5
cmp dword [esi + 0x78], 0
jle 0x606ac5
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x24]
mov byte [esi + 0x7c], 0
mov ecx, esi
pop esi
jmp fcn.00605920
Function at 0x620d20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x866e9d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], vtable.wxColour.0
call fcn.00532170
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 1
mov ecx, dword [edi + 8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x90]
call eax
mov ecx, dword [edi + 8]
mov esi, eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x68]
call edx
lea ecx, [ebp - 0x24]
push ecx
push esi
mov esi, dword [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00620c50
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
mov dword [ebp - 0x24], vtable.wxObject.0
call fcn.0073d950
mov eax, dword [ebp + 0xc]
mov dword [esi], vtable.wxMarkupParserRenderOutput.0
mov dword [esi + 0x10], edi
mov byte [ebp - 4], 3
movups xmm0, xmmword [eax]
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x24], eax
movups xmmword [esi + 0x14], xmm0
mov ecx, dword [edi + 8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x98]
call eax
mov ecx, eax
mov dword [esi + 0x28], vtable.wxObject.0
mov eax, dword [ecx + 4]
mov dword [esi + 0x2c], eax
test eax, eax
je 0x620ded
inc dword [eax + 4]
mov dword [esi + 0x28], vtable.wxColour.0
mov eax, dword [ecx + 8]
mov dword [esi + 0x30], eax
movzx eax, byte [ecx + 0xc]
mov byte [esi + 0x34], al
movzx eax, byte [ecx + 0xd]
mov byte [esi + 0x35], al
movzx eax, byte [ecx + 0xe]
mov byte [esi + 0x36], al
movzx eax, byte [ecx + 0xf]
mov byte [esi + 0x37], al
movzx eax, byte [ecx + 0x10]
mov byte [esi + 0x38], al
mov eax, dword [esi + 0x14]
mov dword [esi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x622af0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8670f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi], vtable.wxPageSetupDialogData.0
lea ecx, [esi + 0x38]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.00622c80
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.006232a0
xor eax, eax
mov dword [esi + 0x30], 0x1010100
xor ecx, ecx
mov dword [esi + 0x28], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x10], eax
mov byte [esi + 0x36], al
mov eax, esi
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x24], ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x14], ecx
mov word [esi + 0x34], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x622c80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x867143
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi], vtable.wxPrintData.0
xor eax, eax
mov dword [esi + 0x20], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 7
mov word [esi + 0x20], ax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov eax, dword [0xa5ab5c]
mov ecx, dword [0xa5ab60]
mov dword [esi + 0x50], eax
xor eax, eax
mov dword [esi + 0x54], ecx
mov dword [esi + 0x58], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 7
mov word [esi + 0x58], ax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov byte [ebp - 4], 2
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 3
mov dword [esi + 0x18], 1
mov word [esi + 0x1c], ax
mov dword [esi + 0x14], 1
mov byte [esi + 0x40], 1
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x4c], eax
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], eax
call fcn.006257d0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x3c]
mov dword [esi + 0x80], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret