joyce8/EMBER2024-capa huggingface dataset:
Function at 0x510470
Capabilities:
Log keystrokes via polling

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
nop word [eax + eax]
cmp dword [eax*8 + 0x8b0c7c], ecx
je 0x510545
inc eax
cmp eax, 0x4d
jb 0x510480
push ebx
xor bl, bl
cmp ecx, 0x177
jg 0x510512
je 0x5104d5
lea eax, [ecx - 0x7f]
cmp eax, 0xf0
ja case.0x51051d.383
movzx eax, byte [eax + 0x510588]
jmp dword [eax*4 + 0x51055c]
mov bl, 1
mov eax, 0x21
jmp 0x510539
mov bl, 1
mov eax, 0x22
jmp 0x510539
mov bl, 1
mov eax, 0x23
jmp 0x510539
mov bl, 1
mov eax, 0x24
jmp 0x510539
mov bl, 1
mov eax, 0x25
jmp 0x510539
mov bl, 1
mov eax, 0x26
jmp 0x510539
mov bl, 1
mov eax, 0x27
jmp 0x510539
mov bl, 1
mov eax, 0x28
jmp 0x510539
mov bl, 1
mov eax, 0x2d
jmp 0x510539
mov bl, 1
mov eax, 0x2e
jmp 0x510539
lea eax, [ecx - 0x178]
cmp eax, 9
ja case.0x51051d.383
jmp dword [eax*4 + 0x51067c]
push esi
movzx esi, cx
push esi
call dword [sym.imp.USER32.dll_VkKeyScanW]
cmp al, 0xff
movzx eax, al
jne 0x510538
mov eax, esi
pop esi
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x510543
mov byte [ecx], bl
pop ebx
ret
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x510550
mov byte [ecx], 0
mov ax, word [eax*8 + 0x8b0c78]
ret

Function at 0x511ad0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp esi, 1
je 0x511ae4
cmp esi, 2
je 0x511ae4
cmp esi, 4
jne 0x511b1f
cmp dword [0xa5d6f8], 0
je 0x511b1f
push str.cant_use_wxGetKeyState___for_mouse_buttons
push str.key___0x01__key___0x02__key___0x04
push str.wxGetKeyState
push 0x1b9b
push str.C:_vcpkg_buildtreeswxwidgets_src_v3.2.3_90b1eb06ca.clean_srcmswwindow.cpp
call fcn.0073cfd0
add esp, 0x14
cmp byte [0xea569c], 0
je 0x511b1f
mov byte [0xea569c], 0
int3
push 0
push esi
call fcn.00510470
add esp, 8
movzx eax, ax
cmp esi, 0x16c
je 0x511b4f
cmp esi, 0x137
je 0x511b4f
cmp esi, 0x16d
je 0x511b4f
pop esi
mov dword [esp + 4], eax
jmp 0x5126d0
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
pop esi
setne al
ret
push esi
mov esi, dword [esp + 8]
cmp si, 1
je 0x5126e1
cmp si, 2
jne 0x5126f9
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x5126f9
xor eax, eax
cmp si, 1
sete al
lea esi, [eax + 1]
movzx eax, si
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
pop esi
ret
Function at 0x532b40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8501ee
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xa5e224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
movsd xmm0, qword [0x895418]
movsd qword [esi], xmm0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi + 8], ecx
mov dword [esi + 0x14], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 7
mov word [esi + 0x14], ax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x10], 0x46
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], 0x190
mov dword [esi + 0x3c], eax
push dword [ebp + 0x24]
mov dword [ebp - 4], eax
push dword [ebp + 0x20]
mov dword [ebp - 0x10], 1
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call fcn.00532d30
add esp, 0x1c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x553a90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x853495
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xa5e224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov al, byte [esi + 0x10]
movaps xmm0, xmmword [0x8c1540]
and al, 0xe3
movups xmmword [esi + 0x30], xmm0
or al, 3
mov dword [esi], vtable.wxDCImpl.0
movups xmmword [esi + 0x40], xmm0
mov dword [esi + 0xc], 0
movups xmmword [esi + 0x50], xmm0
mov byte [esi + 0x10], al
movsd qword [esi + 0x68], xmm0
xorps xmm0, xmm0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x60], 1
mov dword [esi + 0x64], 1
movups xmmword [esi + 0x70], xmm0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 5
mov dword [esi + 0xa4], 0x6a
mov dword [esi + 0xa8], 1
mov dword [ebp - 4], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xac], vtable.wxPen.0
lea ecx, [esi + 0xb4]
mov byte [ebp - 4], 1
call fcn.00551d30
lea ecx, [esi + 0xbc]
mov byte [ebp - 4], 2
call fcn.00551d30
push 0xb
mov byte [ebp - 4], 3
call fcn.0051bc90
mov ecx, eax
mov dword [esi + 0xc4], vtable.wxObject.0
add esp, 4
mov eax, dword [ecx + 4]
mov dword [esi + 0xc8], eax
test eax, eax
je 0x553bff
inc dword [eax + 4]
mov dword [esi + 0xc4], vtable.wxColour.0
mov eax, dword [ecx + 8]
mov dword [esi + 0xcc], eax
movzx eax, byte [ecx + 0xc]
mov byte [esi + 0xd0], al
movzx eax, byte [ecx + 0xd]
mov byte [esi + 0xd1], al
movzx eax, byte [ecx + 0xe]
mov byte [esi + 0xd2], al
movzx eax, byte [ecx + 0xf]
mov byte [esi + 0xd3], al
movzx eax, byte [ecx + 0x10]
mov byte [esi + 0xd4], al
push 0x12
mov byte [ebp - 4], 4
call fcn.0051bc90
mov ecx, eax
mov dword [esi + 0xd8], vtable.wxObject.0
add esp, 4
mov eax, dword [ecx + 4]
mov dword [esi + 0xdc], eax
test eax, eax
je 0x553c6e
inc dword [eax + 4]
mov dword [esi + 0xd8], vtable.wxColour.0
mov eax, dword [ecx + 8]
mov dword [esi + 0xe0], eax
movzx eax, byte [ecx + 0xc]
mov byte [esi + 0xe4], al
movzx eax, byte [ecx + 0xd]
mov byte [esi + 0xe5], al
movzx eax, byte [ecx + 0xe]
mov byte [esi + 0xe6], al
movzx eax, byte [ecx + 0xf]
mov byte [esi + 0xe7], al
movzx eax, byte [ecx + 0x10]
mov byte [esi + 0xe8], al
mov eax, dword [ebp + 8]
mov dword [esi + 0xf0], 0
mov dword [esi + 0xec], vtable.wxFont.0
mov dword [esi + 0xf8], 0
mov dword [esi + 0xf4], vtable.wxPalette.0
mov dword [esi + 8], eax
mov eax, esi
mov byte [esi + 0xfc], 0
mov dword [esi + 0x100], 0
mov dword [esi + 0x104], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x10c], 0
mov byte [esi + 0x110], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x56b000
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, ecx
cmp dword [esi + 4], 0x100
jne 0x56b048
mov eax, 0x2000
test word [esi + 0xe], ax
jne 0x56b048
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x56b048
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x56b048
mov eax, dword [esi + 8]
cmp eax, 0xd
je 0x56b055
cmp eax, 0x1b
je 0x56b055
cmp eax, 0x73
je 0x56b06e
push esi
mov ecx, ebx
call fcn.00437150
pop esi
pop ebx
ret 4
push 0
push 0
push 0x157
push dword [ebx + 0x13c]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x56b048
pop esi
xor al, al
pop ebx
ret 4
Function at 0x5839e0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x83d90d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0xa5e224]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
lea eax, [esi + 0x30]
push eax
lea ecx, [esi + 8]
call fcn.004f14b0
mov eax, dword [ebp + 0x10]
mov edx, 0x88c2f0
test eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x20], 0
cmovne edx, eax
mov dword [ebp - 0x1c], 7
mov ecx, edx
xor eax, eax
mov word [ebp - 0x30], ax
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x583a50
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x30]
call fcn.00437780
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp + 0x14]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.004cc7c0
push dword [ebp - 0x18]
call fcn.00805aaa
mov edx, dword [ebp - 0x1c]
add esp, 4
cmp edx, 8
jb 0x583ace
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x583ac4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x583ae9
push edx
push ecx
call fcn.00800125
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00800392
mov esp, ebp
pop ebp
ret
call fcn.00805a59
int3
Function at 0x594a80
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x34
mov eax, dword [0xa5e224]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [0xe7bacc]
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
movlpd qword [esp + 0x18], xmm0
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x28], xmm0
mov dword [esp], 0x28
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
test eax, eax
je 0x594b7d
lea ecx, [esp]
push ecx
push 0
push 0x43b
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x594b7d
push esi
push dword [esp + 0xc]
call fcn.00511400
mov esi, eax
add esp, 4
test esi, esi
je 0x594b7c
mov edx, dword [esi]
mov ecx, esi
push edi
mov edx, dword [edx + 0xfc]
call edx
test al, al
je 0x594b6d
push esi
call fcn.004ffa40
mov esi, eax
add esp, 4
test esi, esi
je 0x594b7b
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov edi, eax
cmp edi, 0xa5c018
je 0x594b5d
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x594b48
push 0xa5c018
call fcn.004eec70
test al, al
jne 0x594b5d
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x594b7b
push 0xa5c018
call fcn.004eec70
test al, al
je 0x594b7b
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x3c4]
call eax
test al, al
je 0x594b7b
push 0
push dword [0xe7bacc]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00800392
add esp, 0x34
ret

Function at 0x59b4e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x85a2e3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xa5e224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 1
mov dword [esi], vtable.wxImageRefData.0
mov dword [ebp - 4], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], vtable.wxPalette.0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
push 0
call fcn.00747800
push 0
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 2
call fcn.00747800
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x14], 0
mov word [esi + 0x19], 0
mov byte [esi + 0x1b], 0
mov byte [esi + 0x18], 0
mov word [esi + 0x20], 0
mov byte [esi + 0x22], 0
mov eax, dword [0xa5c814]
mov dword [esi + 0x24], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5b5c50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 8]
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, 0x1001
movzx eax, word [edi + 0x96]
cmp ax, si
jne 0x5b5c73
movzx ebp, byte [edx]
jmp 0x5b5c76
movsx ebp, ax
mov ebx, dword [esp + 0x1c]
xor ecx, ecx
cmp ax, si
sete cl
cmp ecx, dword [esp + 0x24]
jge 0x5b5dca
nop dword [eax]
mov al, byte [ecx + edx]
mov ebx, ebp
mov edx, dword [edi + 0x88]
inc ecx
movzx eax, al
shl ebx, 8
add ebx, eax
mov dword [esp + 0x14], ecx
mov esi, ebx
mov dword [esp + 0x10], eax
shr esi, 0xc
xor esi, ebx
and esi, 0x1fff
mov ecx, esi
mov eax, dword [edx + ecx*4]
shr eax, 0xc
cmp eax, 0xfffff
je 0x5b5ce4
cmp ebx, eax
je 0x5b5d5e
inc ecx
and ecx, 0x1fff
mov eax, dword [edx + ecx*4]
shr eax, 0xc
cmp eax, 0xfffff
jne 0x5b5cc8
push ebp
push dword [esp + 0x20]
mov ecx, edi
call fcn.005b5e30
test al, al
je 0x5b5e0c
movzx eax, word [edi + 0x90]
mov ecx, 0xfff
mov ebp, dword [esp + 0x10]
cmp ax, cx
jl 0x5b5d69
movsx eax, word [edi + 0x8e]
mov ecx, edi
mov ebx, dword [esp + 0x1c]
push eax
push ebx
call fcn.005b5e30
test al, al
je 0x5b5e0c
mov ax, word [edi + 0x8c]
mov ecx, dword [edi + 0x88]
inc ax
mov word [edi + 0x90], ax
mov eax, 0x1fff
mov dword [edi + 0x92], 0x2000009
nop
mov dword [ecx + eax*4], 0xffffffff
sub eax, 1
jns 0x5b5d50
jmp 0x5b5db8
mov ebp, dword [edx + ecx*4]
and ebp, 0xfff
jmp 0x5b5db4
mov ecx, dword [edi + 0x88]
movsx edx, ax
inc eax
mov word [edi + 0x90], ax
mov eax, dword [ecx + esi*4]
and eax, 0xfffff000
cmp eax, 0xfffff000
je 0x5b5da6
nop dword [eax]
inc esi
and esi, 0x1fff
mov eax, dword [ecx + esi*4]
and eax, 0xfffff000
cmp eax, 0xfffff000
jne 0x5b5d90
and edx, 0xfff
shl ebx, 0xc
or edx, ebx
mov dword [ecx + esi*4], edx
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
cmp ecx, dword [esp + 0x24]
jl 0x5b5c90
cmp dword [edi + 0x84], 0
mov word [edi + 0x96], bp
jne 0x5b5e18
push ebp
push ebx
mov ecx, edi
call fcn.005b5e30
test al, al
je 0x5b5e0c
movsx eax, word [edi + 0x8c]
mov ecx, edi
push eax
push ebx
call fcn.005b5e30
test al, al
je 0x5b5e0c
push 0x1000
push ebx
mov ecx, edi
call fcn.005b5e30
test al, al
jne 0x5b5e18
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0xc
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 0xc
Function at 0x5e75d0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x10
mov edi, ecx
call esi
test ax, ax
js 0x5e7617
push 0x11
call esi
test ax, ax
js 0x5e7617
push 0x12
call esi
test ax, ax
js 0x5e7617
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x94]
push eax
call fcn.00508c50
push eax
call fcn.00507c40
add esp, 8
test al, al
je 0x5e7617
pop edi
mov al, 1
pop esi
ret
pop edi
xor al, al
pop esi
ret

Function at 0x5e8040
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push ebx
push edi
cmp dword [eax + 4], 0x100
jne case.0x5e8119.3
mov edi, dword [eax + 8]
mov ecx, 0x2000
test word [eax + 0xe], cx
je 0x5e8071
cmp edi, 8
jne case.0x5e8119.3
pop edi
xor al, al
pop ebx
ret 4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
test ax, ax
push 0x10
sets bl
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
sets cl
add ecx, ebx
sub ecx, 0
je 0x5e80dd
sub ecx, 1
je 0x5e80f3
sub ecx, 1
je case.0x5e8119.3
cmp dword [0xa5d6f8], 0
je 0x5e80dd
push str.how_many_modifiers_have_we_got_
push str._Assert_failure_
push str.wxMSWTextEntryShouldPreProcessMessage
push 0x44d
push str.C:_vcpkg_buildtreeswxwidgets_src_v3.2.3_90b1eb06ca.clean_srcmsw_textentry.cpp
call fcn.0073cfd0
add esp, 0x14
cmp byte [0xea569c], 0
je 0x5e80dd
mov byte [0xea569c], 0
int3
sub edi, 0x23
je case.0x5e8119.0
sub edi, 1
je case.0x5e8119.0
sub edi, 0xa
jne case.0x5e8119.3
pop edi
xor al, al
pop ebx
ret 4
add edi, 0xffffffdd
test ebx, ebx
je 0x5e810d
cmp edi, 0x35
ja case.0x5e8119.3
movzx eax, byte [edi + 0x5e8130]
jmp dword [eax*4 + 0x5e8128]
cmp edi, 0xb
ja case.0x5e8119.3
movzx eax, byte [edi + 0x5e8170]
jmp dword [eax*4 + 0x5e8168]
pop edi
mov al, 1
pop ebx
ret 4
Function at 0x5eabe0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x855bb8
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0xa5e224]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
cmp eax, 9
je 0x5ead0a
cmp eax, 0xd
jne 0x5ead50
push 0
push 0
push 0x157
push dword [edi + 0x13c]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x5ead50
push dword [edi + 0x40]
lea ecx, [ebp - 0x6c]
push dword [0xe7b82c]
call fcn.004cb380
mov eax, dword [edi + 0x190]
lea ecx, [edi + 0x190]
mov dword [ebp - 4], 0
call dword [eax + 0x18]
mov edx, dword [edi + 0x1a4]
lea ecx, [edi + 0x1a4]
mov ebx, eax
lea eax, [ebp - 0x8c]
push eax
mov dword [ebp - 0x20], ebx
call dword [edx + 0x14]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
cmp ecx, eax
je 0x5eaca5
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x5eac99
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x40]
call fcn.00437780
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0
call fcn.00436e00
push ebx
lea eax, [ebp - 0x6c]
mov ecx, edi
push eax
call fcn.00568ad0
lea eax, [ebp - 0x6c]
mov ecx, edi
push eax
call fcn.00545060
test al, al
jne 0x5eace8
lea ecx, [edi + 0x1a4]
call fcn.005e75d0
test al, al
jne 0x5eace8
lea ecx, [ebp - 0x6c]
call fcn.0047ab40
jmp 0x5ead50
lea ecx, [ebp - 0x40]
call fcn.00436e00
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], 2
mov dword [ebp - 0x6c], vtable.wxObject.0
call fcn.0073da90
mov al, 1
jmp 0x5ead52
mov eax, dword [edi + 0xe0]
shr eax, 6
test al, 1
jne 0x5ead50
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 0x10
call esi
test ax, ax
mov ecx, 1
push 0x11
cmovns ebx, ecx
call esi
test ax, ax
jns 0x5ead3a
or ebx, 2
mov ecx, dword [edi + 0x44]
test ecx, ecx
je 0x5ead50
mov eax, dword [ecx]
push ebx
mov eax, dword [eax + 0x284]
call eax
test al, al
jne 0x5ead06
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00800392
mov esp, ebp
pop ebp
ret 4
Function at 0x606bc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
push dword [esi + 0x18]
call dword [eax + 4]
mov eax, dword [esi]
mov ecx, esi
push dword [esi + 0x20]
call dword [eax + 0x1c]
mov ecx, dword [esi + 0x1c]
test ecx, ecx
jle 0x606be4
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 8]
mov edx, dword [esi]
lea eax, [esi + 0x24]
push eax
mov ecx, esi
call dword [edx + 0x18]
mov edx, dword [esi]
lea eax, [esi + 0x4c]
push eax
lea eax, [esi + 0x44]
mov ecx, esi
push eax
call dword [edx + 0x20]
cmp dword [esi + 0x74], 0
lea ecx, [esi + 0x6c]
jle 0x606c15
cmp dword [esi + 0x78], 0
jle 0x606c15
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x24]
mov byte [esi + 0x7c], 0
mov ecx, esi
pop esi
jmp fcn.00605a70
Function at 0x620e90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8670ad
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0xa5e224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], vtable.wxColour.0
call fcn.005322e0
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 1
mov ecx, dword [edi + 8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x90]
call eax
mov ecx, dword [edi + 8]
mov esi, eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x68]
call edx
lea ecx, [ebp - 0x24]
push ecx
push esi
mov esi, dword [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00620dc0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
mov dword [ebp - 0x24], vtable.wxObject.0
call fcn.0073da90
mov eax, dword [ebp + 0xc]
mov dword [esi], vtable.wxMarkupParserRenderOutput.0
mov dword [esi + 0x10], edi
mov byte [ebp - 4], 3
movups xmm0, xmmword [eax]
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x24], eax
movups xmmword [esi + 0x14], xmm0
mov ecx, dword [edi + 8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x98]
call eax
mov ecx, eax
mov dword [esi + 0x28], vtable.wxObject.0
mov eax, dword [ecx + 4]
mov dword [esi + 0x2c], eax
test eax, eax
je 0x620f5d
inc dword [eax + 4]
mov dword [esi + 0x28], vtable.wxColour.0
mov eax, dword [ecx + 8]
mov dword [esi + 0x30], eax
movzx eax, byte [ecx + 0xc]
mov byte [esi + 0x34], al
movzx eax, byte [ecx + 0xd]
mov byte [esi + 0x35], al
movzx eax, byte [ecx + 0xe]
mov byte [esi + 0x36], al
movzx eax, byte [ecx + 0xf]
mov byte [esi + 0x37], al
movzx eax, byte [ecx + 0x10]
mov byte [esi + 0x38], al
mov eax, dword [esi + 0x14]
mov dword [esi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x622c60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x867308
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xa5e224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi], vtable.wxPageSetupDialogData.0
lea ecx, [esi + 0x38]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.00622df0
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00623410
xor eax, eax
mov dword [esi + 0x30], 0x1010100
xor ecx, ecx
mov dword [esi + 0x28], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x10], eax
mov byte [esi + 0x36], al
mov eax, esi
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x24], ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x14], ecx
mov word [esi + 0x34], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x622df0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x867353
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xa5e224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi], vtable.wxPrintData.0
xor eax, eax
mov dword [esi + 0x20], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 7
mov word [esi + 0x20], ax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov eax, dword [0xa5bbb4]
mov ecx, dword [0xa5bbb8]
mov dword [esi + 0x50], eax
xor eax, eax
mov dword [esi + 0x54], ecx
mov dword [esi + 0x58], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 7
mov word [esi + 0x58], ax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov byte [ebp - 4], 2
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 3
mov dword [esi + 0x18], 1
mov word [esi + 0x1c], ax
mov dword [esi + 0x14], 1
mov byte [esi + 0x40], 1
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x4c], eax
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], eax
call fcn.00625940
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x3c]
mov dword [esi + 0x80], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret