joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446e60
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x446e87
add esp, 0x14
ret
xor ecx, ecx
lea edx, [esp + 8]
mov dword [esp + 8], ecx
push edx
mov dword [esp + 0x10], ecx
push 0x6cbd48
mov dword [esp + 0x18], ecx
push ecx
mov dword [esp + 0x10], 1
mov dword [esp + 0x1c], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x446ebe
add esp, 0x14
ret
mov ecx, dword [esp]
push 0
push 0
lea eax, [esp + 0xc]
push 0
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x446ede
add esp, 0x14
ret
push 0
push 8
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, 1
add esp, 0x14
ret
Function at 0x45a590
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x617a78
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
mov ecx, dword [esi + 0xa0]
test ecx, ecx
je 0x45a5ba
mov eax, dword [ecx]
call dword [eax + 0x10]
push 0x7023ec
mov ecx, esi
call fcn.004e8b20
neg al
sbb eax, eax
and eax, esi
mov dword [esp + 4], eax
je 0x45a5e6
xor al, al
pop esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret 4
test byte [esi + 0xc8], 8
je 0x45a603
xor al, al
pop esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret 4
mov ecx, dword [0x70044c]
mov eax, dword [esi + 0x28]
push ebx
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.004e9080
mov dword [esp + 0xc], vtable.wxFocusEvent.0
mov dword [esp + 0x30], 0
mov edx, dword [esp + 0x44]
mov dword [esp + 0x3c], 0
push edx
mov dword [esp + 0x18], esi
call fcn.00459da0
mov ecx, dword [esi + 0x5c]
add esp, 4
mov dword [esp + 0x30], eax
lea edx, [esp + 0xc]
mov eax, dword [ecx]
push edx
call dword [eax + 0x10]
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0xc], vtable.wxObject.0
call fcn.004e8d50
mov ecx, dword [esp + 0x34]
mov al, bl
pop ebx
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 4

Function at 0x45a6b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x617a98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x70037c]
push ecx
lea ecx, [esp + 0xc]
mov eax, dword [esi + 0x28]
push eax
call fcn.004e9080
mov dl, byte [esp + 0x40]
mov dword [esp + 8], vtable.wxShowEvent.0
mov byte [esp + 0x2c], dl
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x10], esi
lea edx, [esp + 8]
mov dword [esp + 0x38], 0
mov eax, dword [ecx]
push edx
call dword [eax + 0x10]
lea ecx, [esp + 8]
mov bl, al
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 8], vtable.wxObject.0
call fcn.004e8d50
mov ecx, dword [esp + 0x30]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 8

Function at 0x45afd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x617ba8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [0x700348]
push esi
mov esi, ecx
push eax
push 0
lea ecx, [esp + 0xc]
call fcn.004e9080
mov dword [esp + 4], vtable.wxSysColourChangedEvent.0
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0xc], esi
lea eax, [esp + 4]
mov dword [esp + 0x30], 0
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
lea ecx, [esp + 4]
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 4], vtable.wxObject.0
call fcn.004e8d50
mov ecx, dword [esp + 0x28]
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x45b2b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x617c08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov esi, ecx
call fcn.00462fb0
mov eax, dword [esp + 0x44]
push eax
call fcn.00459da0
mov ecx, dword [0x700370]
add esp, 4
mov edi, eax
mov eax, dword [esi + 0x28]
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.004e9080
mov dword [esp + 0x30], edi
mov dword [esp + 0xc], vtable.wxMouseCaptureChangedEvent.0
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x14], esi
lea eax, [esp + 0xc]
mov dword [esp + 0x3c], 0
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0xc], vtable.wxObject.0
call fcn.004e8d50
mov ecx, dword [esp + 0x34]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 4

Function at 0x45bd80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x617d58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x700378]
push ecx
lea ecx, [esp + 0xc]
mov eax, dword [esi + 0x28]
push eax
call fcn.004e9080
mov dword [esp + 8], vtable.wxIconizeEvent.0
mov byte [esp + 0x2c], 1
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x10], esi
lea eax, [esp + 8]
mov dword [esp + 0x38], 0
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
lea ecx, [esp + 8]
mov bl, al
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 8], vtable.wxObject.0
call fcn.004e8d50
mov ecx, dword [esp + 0x30]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret

Function at 0x45be90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x617d98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
mov ebx, dword [esp + 0x54]
push esi
mov esi, ecx
mov ecx, dword [0x7003a8]
push edi
mov eax, dword [esi + 0x28]
mov edi, dword [esp + 0x58]
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.004e9080
xor eax, eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0xc], vtable.wxMoveEvent.0
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x50], eax
mov dword [esp + 0x14], esi
lea eax, [esp + 0xc]
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x50], 0xffffffff
mov dword [esp + 0xc], vtable.wxObject.0
call fcn.004e8d50
mov ecx, dword [esp + 0x48]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret 8
Function at 0x45bf40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x617db8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov eax, dword [0x72500c]
push ebx
push esi
push edi
mov esi, ecx
push eax
push 0
lea ecx, [esp + 0x14]
mov ebx, dword [esi + 0x28]
call fcn.004e9080
mov edi, dword [esp + 0x58]
mov dword [esp + 0xc], vtable.wxMoveEvent.0
mov dword [esp + 0x20], ebx
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [esp + 0x30], ecx
mov ecx, edi
mov dword [esp + 0x34], eax
mov edx, dword [ecx]
mov dword [esp + 0x38], edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x3c], eax
mov edx, dword [ecx + 8]
mov dword [esp + 0x40], edx
mov eax, dword [ecx + 0xc]
mov ecx, dword [0x7003a4]
mov dword [esp + 0x44], eax
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x14], esi
lea eax, [esp + 0xc]
mov dword [esp + 0x50], 0
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
mov bl, al
test bl, bl
je 0x45bfef
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov dword [edi], ecx
mov ecx, dword [esp + 0x44]
mov dword [edi + 4], edx
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x50], 0xffffffff
mov dword [esp + 0xc], vtable.wxObject.0
call fcn.004e8d50
mov ecx, dword [esp + 0x48]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret 4

Function at 0x45c1c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x617df8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov eax, dword [0x72500c]
push ebx
push esi
push edi
mov esi, ecx
push eax
push 0
lea ecx, [esp + 0x14]
mov ebx, dword [esi + 0x28]
call fcn.004e9080
mov edi, dword [esp + 0x58]
mov dword [esp + 0xc], vtable.wxSizeEvent.0
mov dword [esp + 0x20], ebx
mov ecx, dword [edi + 8]
mov eax, dword [edi + 0xc]
mov dword [esp + 0x30], ecx
mov ecx, edi
mov dword [esp + 0x34], eax
mov edx, dword [ecx]
mov dword [esp + 0x38], edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x3c], eax
mov edx, dword [ecx + 8]
mov dword [esp + 0x40], edx
mov eax, dword [ecx + 0xc]
mov ecx, dword [0x7003ac]
mov dword [esp + 0x44], eax
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x14], esi
lea eax, [esp + 0xc]
mov dword [esp + 0x50], 0
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
mov bl, al
test bl, bl
je 0x45c270
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov dword [edi], ecx
mov ecx, dword [esp + 0x44]
mov dword [edi + 4], edx
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x50], 0xffffffff
mov dword [esp + 0xc], vtable.wxObject.0
call fcn.004e8d50
mov ecx, dword [esp + 0x48]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret 4
Function at 0x45c480
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x60]
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x10]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
mov edx, ebx
mov eax, ebp
sub edx, esi
mov esi, dword [esp + 0x1c]
sub eax, ecx
push 0x12
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x24], edx
mov edx, eax
mov ecx, eax
shr edx, 3
shr ecx, 2
and dl, 1
and cl, 1
mov byte [esi + 0x2f], dl
mov byte [esi + 0x30], cl
mov edx, eax
mov cl, al
shr edx, 4
shr eax, 1
and cl, 1
and dl, 1
and al, 1
mov byte [esi + 0x2c], cl
mov byte [esi + 0x2d], dl
mov byte [esi + 0x2e], al
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setl al
mov byte [esi + 0x31], al
call dword [sym.imp.USER32.dll_GetMessageTime]
mov dword [esi + 0x10], eax
mov dword [esi + 8], edi
mov ecx, dword [edi + 0x28]
lea eax, [esp + 0x1c]
mov dword [esi + 0x14], ecx
mov edx, dword [edi]
lea ecx, [esp + 0x20]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebp
call dword [edx + 0x1fc]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov dword [0x700e1c], eax
mov dword [0x700e20], ecx
mov edx, dword [esi + 0xc]
pop edi
pop esi
pop ebp
mov dword [0x700e24], edx
pop ebx
add esp, 8
ret 0x10

Function at 0x45ca40
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x617eb8
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
mov esi, ecx
push edi
push 0x10
xor edi, edi
mov bl, byte [esi + 0x11c]
and bl, 0xfe
mov byte [esi + 0x11c], bl
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
call ebx
test ax, ax
jge 0x45ca82
mov edi, 4
push 0x11
call ebx
test ax, ax
jge 0x45ca8e
or edi, 8
push 1
call ebx
test ah, ah
jns 0x45ca99
or edi, 1
push 4
call ebx
test ah, ah
jns 0x45caa4
or edi, 0x10
push 2
call ebx
test ah, ah
jns 0x45caaf
or edi, 2
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x114]
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [0x700460]
sub eax, edx
push ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
sub ebx, eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], ebx
call fcn.00453340
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edi
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x7c], 0
call fcn.0045c480
mov ecx, dword [esi + 0x5c]
lea eax, [esp + 0x24]
push eax
mov edx, dword [ecx]
call dword [edx + 0x10]
lea ecx, [esp + 0x24]
mov dword [esp + 0x6c], 0xffffffff
mov dword [esp + 0x24], vtable.wxObject.0
call fcn.004e8d50
mov ecx, dword [esp + 0x64]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x64
ret
Function at 0x45cb50
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x617eef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
mov eax, dword [esp + 0x70]
push esi
push edi
mov esi, ecx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0xc], 0
call fcn.004536c0
mov eax, dword [esi + 0x28]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov dword [esp + 0x70], 1
mov dword [esp + 0x3c], eax
call edi
test ax, ax
setl cl
push 0x11
mov byte [esp + 0x59], cl
call edi
test ax, ax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x2c], esi
mov ecx, eax
mov dword [esp + 0x60], eax
setl dl
shr ecx, 0x10
and ecx, 0x2000
mov byte [esp + 0x54], dl
cmp ecx, 0x2000
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x84]
sete dl
mov byte [esp + 0x56], dl
mov word [esp + 0x5a], cx
mov dword [esp + 0x5c], ecx
call dword [sym.imp.USER32.dll_GetMessageTime]
lea edx, [esp + 0xc]
mov dword [esp + 0x34], eax
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov esi, dword [esi + 0x114]
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
sub ecx, edx
sub eax, esi
mov esi, dword [esp + 0x74]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x4c], eax
call fcn.00453700
mov dword [esp + 8], 1
lea ecx, [esp + 0x24]
mov byte [esp + 0x6c], 0
mov dword [esp + 0x24], vtable.wxObject.0
call fcn.004e8d50
mov ecx, dword [esp + 0x64]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x68
ret 0x14

Function at 0x45d6e0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x45d6ed
mov byte [edi], 1
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [eax*8 + 0x644b24], esi
je 0x45d725
inc eax
cmp eax, 0x3c
jb 0x45d6f3
cmp esi, 0x177
jg 0x45d738
je case.0x45d71e.129
lea eax, [esi - 0x7f]
cmp eax, 0xf0
ja case.0x45d743.383
xor ecx, ecx
mov cl, byte [eax + 0x45d7dc]
jmp dword [ecx*4 + 0x45d7b0]
mov ax, word [eax*8 + 0x644b20]
pop edi
pop esi
ret
pop edi
mov eax, 0x24
pop esi
ret
lea eax, [esi - 0x178]
cmp eax, 9
ja case.0x45d743.383
jmp dword [eax*4 + 0x45d8d0]
pop edi
mov eax, 0x21
pop esi
ret
pop edi
mov eax, 0x22
pop esi
ret
pop edi
mov eax, 0x23
pop esi
ret
pop edi
mov eax, 0x25
pop esi
ret
pop edi
mov eax, 0x26
pop esi
ret
pop edi
mov eax, 0x27
pop esi
ret
pop edi
mov eax, 0x28
pop esi
ret
pop edi
mov eax, 0x2d
pop esi
ret
pop edi
mov eax, 0x2e
pop esi
ret
push esi
call dword [sym.imp.USER32.dll_VkKeyScanW]
cmp al, 0xff
je 0x45d7a4
pop edi
pop esi
movzx ax, al
ret
test edi, edi
je 0x45d7ab
mov byte [edi], 0
mov eax, esi
pop edi
pop esi
ret
Function at 0x45d900
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
push esi
call fcn.0045d6e0
add esp, 8
cmp esi, 0x16c
je 0x45d96e
cmp esi, 0x137
je 0x45d96e
cmp esi, 0x16d
je 0x45d96e
mov esi, eax
and eax, 0xffff
dec eax
je 0x45d948
dec eax
jne 0x45d959
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x45d959
mov esi, 1
jmp 0x45d959
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x45d959
mov esi, 2
and esi, 0xffff
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and eax, 1
pop esi
ret
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
neg ax
sbb eax, eax
pop esi
neg eax
ret

Function at 0x45da40
Capabilities:
Log keystrokes via application hook

Disassembly:
mov al, byte [esp + 4]
test al, al
je 0x45da73
mov dword [0x700e6c], 0x45da90
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call fcn.0050ec10
push eax
mov eax, dword [0x700e6c]
push eax
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x700e68], eax
ret
mov ecx, dword [0x700e68]
push ecx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
ret

Function at 0x45eba9
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6180f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x700378]
push ecx
lea ecx, [esp + 0xc]
mov eax, dword [esi + 0x28]
push eax
call fcn.004e9080
mov dl, byte [esp + 0x40]
mov dword [esp + 8], vtable.wxIconizeEvent.0
mov byte [esp + 0x2c], dl
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x10], esi
lea edx, [esp + 8]
mov dword [esp + 0x38], 0
mov eax, dword [ecx]
push edx
call dword [eax + 0x10]
lea ecx, [esp + 8]
mov bl, al
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 8], vtable.wxObject.0
call fcn.004e8d50
mov ecx, dword [esp + 0x30]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 4
Function at 0x460f80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x618532
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
lea ecx, [esp + 0x28]
mov dword [esp + 8], 0
call fcn.00415f10
mov dword [esp + 0x28], vtable.wxFont.0
lea eax, [esp + 0x30]
lea ecx, [esp + 0x30]
mov dword [esp + 0x60], 1
mov dword [esp + 0xc], eax
call fcn.00411000
lea ecx, [esp + 0x30]
mov byte [esp + 0x60], 2
mov dword [esp + 0x30], vtable.wxColour.0
call fcn.0046cf80
lea ecx, [esp + 0x44]
mov byte [esp + 0x60], 3
call fcn.0040f710
lea ecx, [esp + 0xc]
mov ebx, 4
push 0x11
push ecx
mov dword [esp + 0x68], ebx
call fcn.0049c590
add esp, 8
lea edx, [esp + 0x28]
mov byte [esp + 0x60], 5
cmp edx, eax
je 0x46101f
push eax
lea ecx, [esp + 0x2c]
call fcn.004e8d20
lea ecx, [esp + 0xc]
mov byte [esp + 0x60], bl
call fcn.0047c770
lea eax, [esp + 0x14]
push 8
push eax
call fcn.0049c3a0
add esp, 8
mov esi, eax
push esi
lea ecx, [esp + 0x34]
mov byte [esp + 0x64], 6
call fcn.005c5080
mov ecx, dword [esi + 8]
mov byte [esp + 0x60], bl
mov dword [esp + 0x38], ecx
mov dl, byte [esi + 0xc]
mov byte [esp + 0x3c], dl
mov al, byte [esi + 0xd]
mov byte [esp + 0x3d], al
mov cl, byte [esi + 0xe]
mov byte [esp + 0x3e], cl
mov dl, byte [esi + 0xf]
mov byte [esp + 0x3f], dl
mov al, byte [esi + 0x10]
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], al
call fcn.0047d2b0
lea ecx, [esp + 0x14]
push 0xf
push ecx
call fcn.0049c3a0
add esp, 8
mov esi, eax
push esi
lea ecx, [esp + 0x48]
mov byte [esp + 0x64], 7
call fcn.005c5080
mov edx, dword [esi + 8]
mov byte [esp + 0x60], bl
mov dword [esp + 0x4c], edx
mov al, byte [esi + 0xc]
mov byte [esp + 0x50], al
mov cl, byte [esi + 0xd]
mov byte [esp + 0x51], cl
mov dl, byte [esi + 0xe]
mov byte [esp + 0x52], dl
mov al, byte [esi + 0xf]
mov byte [esp + 0x53], al
mov cl, byte [esi + 0x10]
mov byte [esp + 0x54], cl
lea ecx, [esp + 0x14]
call fcn.0047d2b0
mov esi, dword [esp + 0x68]
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.00463480
lea eax, [esp + 0x30]
lea ecx, [esi + 8]
push eax
mov byte [esp + 0x64], 8
call fcn.00415f20
lea ecx, [esp + 0x44]
mov byte [esp + 0x60], 9
push ecx
lea ecx, [esi + 0x1c]
call fcn.00415f20
mov dword [esp + 8], 1
lea ecx, [esp + 0x44]
mov dword [esp + 0x60], 0xb
call fcn.0047d2b0
mov byte [esp + 0x60], 0xa
lea ecx, [esp + 0x30]
call fcn.0047d2b0
lea ecx, [esp + 0x28]
mov byte [esp + 0x60], 0
call fcn.0047c770
mov ecx, dword [esp + 0x58]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x5c
ret
Function at 0x461a9a
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x618660
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x28]
lea eax, [esi + 0xa4]
push eax
call fcn.004091c0
mov dword [esp + 0x28], vtable.wxRegion.0
mov edx, dword [esi]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
xor ebx, ebx
push ecx
mov ecx, esi
mov dword [esp + 0x58], ebx
call dword [edx + 0x21c]
mov edx, dword [esi]
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call dword [edx + 0x60]
mov ecx, dword [eax]
mov dword [esp + 0x38], ecx
mov edx, dword [eax + 4]
lea eax, [esp + 0x38]
lea ecx, [esp + 0x20]
push eax
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], ebp
call fcn.0049f6f0
mov edx, dword [esp + 0x28]
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x54], 1
call dword [edx + 0x44]
lea ecx, [esp + 0x20]
mov byte [esp + 0x50], bl
call fcn.0047d2b0
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x38]
call dword [edx + 0x2c]
test al, al
je 0x461b6a
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], eax
jmp 0x461b7a
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov edx, dword [esi]
lea eax, [esp + 0x38]
mov edi, dword [eax]
mov ebx, dword [eax + 4]
mov ebp, dword [eax + 8]
mov ecx, dword [eax + 0xc]
lea eax, [esp + 0x30]
mov dword [esp + 0x44], ecx
push eax
mov ecx, esi
call dword [edx + 0x60]
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x58]
mov eax, dword [esp + 0x34]
sub edi, ecx
mov ecx, esi
mov edx, dword [esp + 0x44]
sub ebx, eax
mov dword [esp + 0x50], 0xffffffff
mov dword [ecx], edi
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebp
mov dword [ecx + 0xc], edx
lea ecx, [esp + 0x28]
call fcn.0047d2b0
mov ecx, dword [esp + 0x48]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 4

Function at 0x461f38
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6186a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
mov ecx, dword [0x700314]
mov eax, dword [esi + 0x28]
push ecx
push eax
lea ecx, [esp + 0xc]
call fcn.004e9080
mov dword [esp + 4], vtable.wxInitDialogEvent.0
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0xc], esi
lea eax, [esp + 4]
mov dword [esp + 0x30], 0
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
lea ecx, [esp + 4]
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 4], vtable.wxObject.0
call fcn.004e8d50
mov ecx, dword [esp + 0x28]
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x463010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6187b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov ecx, dword [0x70036c]
push esi
mov esi, dword [esp + 0x38]
push ecx
lea ecx, [esp + 8]
mov eax, dword [esi + 0x28]
push eax
call fcn.004e9080
mov dword [esp + 4], vtable.wxMouseCaptureLostEvent.0
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0xc], esi
lea eax, [esp + 4]
mov dword [esp + 0x30], 0
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
lea ecx, [esp + 4]
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 4], vtable.wxObject.0
call fcn.004e8d50
mov ecx, dword [esp + 0x28]
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret

Function at 0x46c9d8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x619768
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
mov ecx, dword [0x700314]
mov eax, dword [esi + 0x28]
push ecx
push eax
lea ecx, [esp + 0xc]
call fcn.004e9080
mov dword [esp + 4], vtable.wxInitDialogEvent.0
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0xc], esi
lea eax, [esp + 4]
mov dword [esp + 0x30], 0
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
lea ecx, [esp + 4]
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 4], vtable.wxObject.0
call fcn.004e8d50
mov ecx, dword [esp + 0x28]
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret