joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f4690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5da270
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x694114]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x6c]
mov ebp, ecx
lea ecx, [esp + 0x24]
push ecx
xor ebx, ebx
mov ecx, ebp
mov dword [esp + 0x30], esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], ebx
call fcn.004f3f90
mov ecx, dword [0x68f790]
mov dword [esp + 0x64], ebx
cmp ecx, ebx
je 0x4f4724
fld qword [0x68f788]
fld qword [esp + 0x74]
fucompp
fnstsw ax
test ah, 0x44
jp 0x4f4720
lea edx, [esp + 0x24]
push edx
mov ecx, 0x68f780
call fcn.004c6980
test al, al
jne 0x4f4761
mov ecx, dword [0x68f790]
cmp ecx, ebx
jne 0x4f4739
push 0x400
call fcn.0058229a
mov ecx, eax
add esp, 4
mov dword [0x68f790], ecx
push 0x400
push ebx
push ecx
call fcn.00585730
add esp, 0xc
lea eax, [esp + 0x24]
push eax
mov ecx, 0x68f780
call fcn.00423b20
fld qword [esp + 0x74]
fstp qword [0x68f788]
cmp dword [esi + 0x14], 8
jb 0x4f476b
mov eax, dword [esi]
jmp 0x4f476d
mov eax, esi
mov edi, eax
mov dword [esp + 0x1c], ebx
cmp dword [esi + 0x14], 8
jb 0x4f477d
mov eax, dword [esi]
jmp 0x4f477f
mov eax, esi
mov ecx, dword [esi + 0x10]
lea eax, [eax + ecx*2]
cmp edi, eax
je 0x4f4874
movzx esi, word [edi]
cmp esi, 0x100
jae 0x4f47ae
mov edx, dword [0x68f790]
mov eax, dword [edx + esi*4]
cmp eax, ebx
je 0x4f47ae
mov dword [esp + 0x14], eax
jmp 0x4f4847
xor eax, eax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], ax
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
push esi
push 1
lea ecx, [esp + 0x3c]
mov byte [esp + 0x6c], 2
call fcn.00414280
mov edx, dword [ebp]
mov edx, dword [edx + 0xc]
push ebx
push ebx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x20]
push ecx
lea eax, [esp + 0x44]
push eax
mov ecx, ebp
mov byte [esp + 0x78], 3
call edx
mov eax, dword [esp + 0x50]
push eax
mov byte [esp + 0x68], bl
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x48], 8
jb 0x4f481f
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00584768
add esp, 4
xor edx, edx
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], dx
cmp esi, 0x100
jae 0x4f4847
mov eax, dword [esp + 0x14]
mov ecx, dword [0x68f790]
mov dword [ecx + esi*4], eax
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [edx + 8]
mov esi, dword [esp + 0x2c]
mov dword [ecx + edx], eax
add ecx, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
add edi, 2
jmp 0x4f4773
lea ecx, [esp + 0x24]
mov dword [esp + 0x64], 0xffffffff
call fcn.004b26e0
mov al, 1
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00585b7b
add esp, 0x54
ret 0x10
Function at 0x507e40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dc318
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00506aa0
fld qword [edi + 0x30]
fstp qword [esi + 0x30]
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
fld qword [edi + 0x40]
fstp qword [esi + 0x40]
lea ecx, [esi + 0x68]
fld qword [edi + 0x48]
lea edx, [edi + 0x68]
fstp qword [esi + 0x48]
push edx
fld qword [edi + 0x50]
mov dword [esp + 0x1c], 0
fstp qword [esi + 0x50]
fld qword [edi + 0x58]
fstp qword [esi + 0x58]
fld qword [edi + 0x60]
fstp qword [esi + 0x60]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.00507a00
mov dword [esi + 0x74], vtable.wxObject.0
mov edi, dword [edi + 0x78]
mov dword [esi + 0x78], edi
mov eax, esi
test edi, edi
je 0x507edb
inc dword [edi + 4]
mov dword [esi + 0x74], vtable.wxGraphicsMatrix.0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x5087b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5da010
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0xc], eax
lea ecx, [esp + 8]
mov dword [esp + 0x24], eax
mov dword [esp + 8], vtable.wxColour.0
call fcn.004e68e0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push 0xff
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
mov edx, dword [eax + 0x2c]
lea ecx, [esp + 0x18]
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
mov dword [esp + 0x28], 1
call edx
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 8], vtable.wxObject.0
call fcn.00423980
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 0xc

Function at 0x5099a0
Capabilities:
Access peb ldr_data

Disassembly:
test byte [ecx + 0xd8], 0x10
je 0x5099ae
jmp fcn.004cdec0
xor eax, eax
ret 8
Function at 0x509a00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5dc598
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x694114]
xor eax, esp
mov dword [esp + 0x7c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
xor eax, eax
mov esi, ecx
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov eax, dword [esi + 0x138]
push 2
push eax
mov dword [esp + 0x20], 0x1c
mov dword [esp + 0x24], 0x15
call dword [sym.imp.USER32.dll_GetScrollInfo]
test eax, eax
jne 0x509a87
xor al, al
jmp 0x509c12
mov ecx, dword [esi + 0x190]
mov eax, dword [esp + 0x20]
mov ebp, eax
cmp ecx, 1
jle 0x509a9d
sub eax, ecx
lea ebp, [eax + 1]
mov dx, word [esp + 0xa8]
mov ecx, dword [esp + 0x28]
mov ebx, dword [0x695a38]
movzx eax, dx
mov edi, ecx
cmp eax, 8
ja case.default.0x509abd
jmp dword [eax*4 + 0x509c3c]
mov ebx, dword [0x6967ec]
xor edi, edi
jmp 0x509b06
mov ebx, dword [0x6967f0]
mov edi, ebp
jmp 0x509b06
mov ebx, dword [0x6967f4]
lea edi, [ecx - 1]
jmp 0x509b06
mov ebx, dword [0x6967f8]
lea edi, [ecx + 1]
jmp 0x509b06
mov edx, dword [esi]
mov eax, dword [edx + 0x3c0]
mov ecx, esi
call eax
mov ebx, dword [0x6967fc]
sub edi, eax
mov ecx, dword [esp + 0x28]
cmp edi, ecx
je case.default.0x509abd
test edi, edi
jns 0x509b10
xor edi, edi
cmp edi, ebp
jle 0x509b16
mov edi, ebp
mov edx, dword [esi]
mov eax, dword [edx + 0x3c8]
push edi
mov ecx, esi
call eax
jmp 0x509b6d
mov edx, dword [esi]
mov eax, dword [edx + 0x3c0]
mov ecx, esi
call eax
mov ebx, dword [0x696800]
add edi, eax
jmp 0x509b02
mov edi, dword [esp + 0x2c]
mov eax, 0x696808
cmp dx, 4
je 0x509b4f
mov eax, 0x696804
mov ebx, dword [eax]
jmp 0x509b06
mov ebx, dword [0x69680c]
cmp ebx, dword [0x696808]
je 0x509b6d
cmp ebx, dword [0x69680c]
jne 0x509a80
mov eax, dword [esi + 0x40]
push 0
push 0
push eax
push ebx
lea ecx, [esp + 0x40]
call fcn.004becc0
mov ecx, dword [esi + 0xdc]
xor ebp, ebp
shr ecx, 3
test cl, 1
mov edx, ebp
setne dl
lea eax, [esp + 0x30]
push eax
mov ecx, esi
mov dword [esp + 0xa0], ebp
mov dword [esp + 0x84], edi
mov dword [esp + 0x3c], esi
lea edx, [edx*4 + 4]
mov dword [esp + 0x88], edx
call fcn.0049d150
mov ecx, dword [esp + 0x78]
push ecx
mov bl, al
mov dword [esp + 0xa0], 0xffffffff
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x70], 8
jb 0x509bec
mov edx, dword [esp + 0x5c]
push edx
call fcn.00584768
add esp, 4
xor eax, eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x70], 7
mov dword [esp + 0x6c], ebp
mov word [esp + 0x5c], ax
mov dword [esp + 0x30], vtable.wxObject.0
call fcn.00423980
mov al, bl
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7c]
xor ecx, esp
call fcn.00585b7b
add esp, 0x8c
ret 0x10
Function at 0x50a560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dc6c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x18]
push eax
call fcn.00509e80
mov edx, dword [edi + 0x194]
mov eax, dword [edx + 0x10]
lea esi, [edi + 0x194]
mov ecx, esi
call eax
mov byte [esp + 0xc], al
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], vtable.wxIcon.0
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], eax
cmp esi, ecx
je 0x50a5cc
mov edx, ecx
push edx
mov ecx, esi
call fcn.00423b20
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.00506650
mov eax, dword [esp + 0x30]
push eax
lea ecx, [edi + 0x190]
call fcn.004dec60
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x1c]
push edx
mov ecx, edi
call fcn.0050a210
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4

Function at 0x50f820
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dcca8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x10]
push eax
call fcn.0049f340
mov ecx, dword [esi + 0x138]
push eax
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x30], 0
call fcn.004a1580
add esp, 0x10
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.004b26e0
mov esi, dword [esi + 0x138]
push 0
push 0xffffffffffffffff
push 0x154
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x28]
cmp ecx, 3
jg 0x50f8a9
mov ecx, 3
jmp 0x50f8b3
cmp ecx, 6
jl 0x50f8b3
mov ecx, 6
mov edx, dword [esp + 8]
add edx, 8
imul edx, ecx
lea eax, [edx + eax - 1]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 4

Function at 0x511470
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x10
mov edi, ecx
call esi
test ax, ax
js 0x5114bc
push 0x11
call esi
test ax, ax
js 0x5114bc
push 0x12
call esi
test ax, ax
js 0x5114bc
mov eax, dword [edi]
mov edx, dword [eax + 0x94]
mov ecx, edi
call edx
push eax
call fcn.004a6f40
push eax
call fcn.004a3a00
add esp, 8
test al, al
je 0x5114bc
pop edi
mov eax, 1
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x516950
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x5dd353
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x694114]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa8]
mov esi, ecx
cmp eax, 9
je 0x516a93
cmp eax, 0xd
jne 0x516adb
mov eax, dword [esi + 0x138]
push 0
push 0
push 0x157
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x516adb
mov eax, dword [esi + 0x40]
push eax
mov eax, dword [0x69f10c]
push eax
lea ecx, [esp + 0x18]
call fcn.00405ef0
mov edx, dword [esi + 0x190]
mov eax, dword [edx + 0x18]
lea ecx, [esi + 0x190]
mov dword [esp + 0xa0], 0
call eax
mov edx, dword [esi + 0x1a4]
mov edx, dword [edx + 0x14]
mov ebx, eax
lea eax, [esp + 0x70]
push eax
lea ecx, [esi + 0x1a4]
mov dword [esp + 0x64], ebx
call edx
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa0], 1
cmp ecx, eax
je 0x516a28
push 0xffffffffffffffff
push 0
push eax
call fcn.00402610
lea ecx, [esp + 0x70]
mov byte [esp + 0xa0], 0
call fcn.00405eb0
push ebx
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.005091f0
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.004cddf0
test al, al
je 0x516a6e
mov dword [esp + 0xa0], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.0049f840
mov al, 1
jmp 0x516add
lea ecx, [esi + 0x1a4]
call fcn.00511470
mov dword [esp + 0xa0], 0xffffffff
lea ecx, [esp + 0x10]
test al, al
jne 0x516a65
call fcn.0049f840
jmp 0x516adb
mov ecx, dword [esi + 0xdc]
shr ecx, 6
test cl, 1
jne 0x516adb
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
xor edi, edi
call ebx
test ax, ax
js 0x516ab7
mov edi, 1
push 0x11
call ebx
test ax, ax
jns 0x516ac3
or edi, 2
cmp dword [esi + 0x44], 0
je 0x516adb
mov ecx, dword [esi + 0x44]
mov edx, dword [ecx]
mov eax, dword [edx + 0x270]
push edi
call eax
test al, al
jne 0x516a6a
xor al, al
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.00585b7b
add esp, 0x94
ret 4
Function at 0x51b0c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5dd98b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00583bc6
push 4
mov dword [esp + 0x24], 0
call fcn.00584773
mov edi, eax
add esp, 4
test edi, edi
je 0x51b142
call fcn.00583487
mov dword [edi], eax
call fcn.00583246
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0058317b
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x51b137
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.005831a3
jmp 0x51b144
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x5267a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5df1d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esi + 0x30]
push eax
mov dword [esp + 0x18], 0
call fcn.005844d1
add esp, 4
cmp dword [esi + 0x28], 8
jb 0x5267ee
mov eax, dword [esi + 0x14]
push eax
call fcn.00584768
add esp, 4
xor ecx, ecx
mov dword [esi + 0x28], 7
mov dword [esi + 0x24], 0
mov word [esi + 0x14], cx
lea ecx, [esi + 0xc]
call fcn.00506650
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
mov dword [esi], vtable.wxObject.0
call fcn.00423980
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x526ac0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5df263
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
mov dword [esi + 4], ebx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esi], vtable.wxThumbBarButton.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], vtable.wxObject.0
mov eax, dword [ecx + 4]
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x10], eax
lea ecx, [ebx + 1]
cmp eax, ebx
je 0x526b1b
add dword [eax + 4], ecx
mov dword [esi + 0xc], vtable.wxIcon.0
mov eax, dword [esp + 0x2c]
push 0xffffffffffffffff
push ebx
mov byte [esp + 0x24], cl
xor edx, edx
mov dword [esi + 0x28], 7
mov dword [esi + 0x24], ebx
push eax
lea ecx, [esi + 0x14]
mov word [esi + 0x14], dx
call fcn.00402610
mov cl, byte [esp + 0x30]
mov dl, byte [esp + 0x34]
mov al, byte [esp + 0x38]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x38], cl
mov cl, byte [esp + 0x3c]
mov byte [esi + 0x39], dl
mov dl, byte [esp + 0x40]
mov byte [esi + 0x3a], al
mov byte [esi + 0x3b], cl
mov byte [esi + 0x3c], dl
mov dword [esi + 0x40], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x20
Function at 0x528360
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5dc9a8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x694114]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
mov eax, dword [0x69675c]
mov ebx, dword [esp + 0x84]
push eax
mov edi, ecx
push ebx
lea ecx, [esp + 0x18]
call fcn.00424270
xor esi, esi
xor ecx, ecx
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], esi
mov word [esp + 0x3c], cx
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x10], vtable.wxCommandEvent.0
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], esi
mov byte [esp + 0x39], 1
mov dword [esp + 0x30], SHDefExtractIconW
mov ecx, dword [edi + 0x70]
mov dword [esp + 0x18], edi
mov dword [esp + 0x60], ebx
mov edx, dword [ecx]
mov edx, dword [edx + 0x18]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x80], esi
call edx
mov eax, dword [esp + 0x58]
push eax
mov dword [esp + 0x80], 0xffffffff
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x50], 8
jb 0x528432
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00584768
add esp, 4
xor edx, edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], esi
mov word [esp + 0x3c], dx
mov dword [esp + 0x10], vtable.wxObject.0
call fcn.00423980
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00585b7b
add esp, 0x70
ret 0xc
Function at 0x5286d0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x5e0a4a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi], vtable.wxToolBarToolBase.0
mov dword [esp + 0x20], ebx
mov dword [esi + 0x10], 0xfffffffd
lea ecx, [esi + 0x20]
mov byte [esp + 0x20], 1
call fcn.004dea70
lea ecx, [esi + 0x24]
mov byte [esp + 0x20], 2
call fcn.004dea70
mov ecx, dword [esp + 0x30]
push 0xffffffffffffffff
push ebx
xor eax, eax
push ecx
mov dword [esi + 0x3c], 7
mov dword [esi + 0x38], ebx
lea ecx, [esi + 0x28]
mov byte [esp + 0x2c], 3
mov word [esi + 0x28], ax
call fcn.00402610
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov eax, dword [esp + 0x44]
push 0xffffffffffffffff
push ebx
xor edx, edx
mov dword [esi + 0x60], 7
mov dword [esi + 0x5c], ebx
push eax
lea ecx, [esi + 0x4c]
mov byte [esp + 0x2c], 4
mov word [esi + 0x4c], dx
call fcn.00402610
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov edx, dword [esp + 0x48]
push 0xffffffffffffffff
xor ecx, ecx
mov dword [esi + 0x84], 7
mov dword [esi + 0x80], ebx
push ebx
mov word [esi + 0x70], cx
push edx
lea ecx, [esi + 0x70]
mov byte [esp + 0x2c], 5
call fcn.00402610
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov edi, dword [esp + 0x2c]
mov byte [esp + 0x20], 6
cmp edi, 0xffffffff
jne 0x5287d2
push 1
call fcn.004e72a0
add esp, 4
jmp 0x5287d4
mov eax, edi
mov ecx, dword [esp + 0x28]
xor edx, edx
cmp edi, 0xfffffffe
sete dl
mov dword [esi + 8], ecx
push eax
lea ecx, [esi + 0x10]
inc edx
mov dword [esi + 0xc], edx
call fcn.004e7250
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x18], ecx
push edx
lea ecx, [esi + 0x20]
mov dword [esi + 0x14], eax
mov word [esi + 0x1c], bx
mov byte [esi + 0x1e], 1
mov dword [esi + 0x94], ebx
call fcn.004dec60
mov eax, dword [esp + 0x38]
push eax
lea ecx, [esi + 0x24]
call fcn.004dec60
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x24
Function at 0x528ef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5df5f3
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x694114]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov edi, dword [esp + 0xb0]
mov esi, ecx
mov ecx, dword [0x696760]
mov eax, dword [esi + 0x40]
push ecx
push eax
lea ecx, [esp + 0x44]
call fcn.00424270
xor ebx, ebx
xor edx, edx
mov dword [esp + 0x7c], 7
mov dword [esp + 0x78], ebx
mov word [esp + 0x68], dx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x3c], vtable.wxCommandEvent.0
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov byte [esp + 0x65], 1
mov dword [esp + 0x5c], SHDefExtractIconW
push esi
mov dword [esp + 0xac], ebx
mov dword [esp + 0x48], esi
mov dword [esp + 0x90], edi
call fcn.0049de40
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x5290c2
mov eax, dword [ebp]
mov edx, dword [eax + 4]
mov ecx, ebp
call edx
mov dword [esp + 0x14], eax
cmp eax, 0x68e36c
je 0x529007
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
je 0x528fe8
push 0x68e36c
call fcn.004239a0
test al, al
jne 0x529007
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x10]
cmp eax, ebx
je 0x5290c2
push 0x68e36c
mov ecx, eax
call fcn.004239a0
test al, al
je 0x5290c2
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], ax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov byte [esp + 0xa8], 1
cmp edi, 0xffffffff
je 0x52906b
mov eax, dword [esi + 0x19c]
cmp eax, ebx
je 0x52906b
lea esp, [esp]
mov ecx, dword [eax + 8]
cmp dword [ecx + 0x10], edi
je 0x529051
mov eax, dword [eax + 0xc]
cmp eax, ebx
jne 0x529040
jmp 0x52906b
cmp ecx, ebx
je 0x52906b
add ecx, 0x70
lea edx, [esp + 0x18]
cmp edx, ecx
je 0x52906b
push 0xffffffffffffffff
push ebx
push ecx
mov ecx, edx
call fcn.00402610
mov eax, dword [ebp]
cmp edi, 0xffffffff
setne cl
movzx edx, cl
push edx
mov edx, dword [eax + 0x44c]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, ebp
call edx
mov eax, dword [esp + 0x34]
push eax
mov byte [esp + 0xac], bl
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x2c], 8
jb 0x5290af
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00584768
add esp, 4
xor edx, edx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], dx
mov esi, dword [esi + 0x70]
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
lea ecx, [esp + 0x3c]
push ecx
mov ecx, esi
call edx
mov eax, dword [esp + 0x84]
push eax
mov dword [esp + 0xac], 0xffffffff
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x7c], 8
jb 0x529102
mov ecx, dword [esp + 0x68]
push ecx
call fcn.00584768
add esp, 4
xor edx, edx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x7c], 7
mov dword [esp + 0x78], ebx
mov word [esp + 0x68], dx
mov dword [esp + 0x3c], vtable.wxObject.0
call fcn.00423980
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00585b7b
add esp, 0x98
ret 4