joyce8/EMBER2024-capa huggingface dataset:
Function at 0x518e20
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x518e89
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x518e89
mov edx, dword [esp + 0xc]
push edx
push ecx
push eax
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x518e8b
call fcn.004f0590
test eax, eax
je 0x518e71
mov edx, dword [eax]
push 0
push str.cant_read_from_file_descriptor__d
mov ecx, eax
call dword [edx + 8]
mov ecx, dword [esi]
push ecx
push eax
call fcn.004f45b0
add esp, 8
or eax, 0xffffffff
pop esi
ret 8
mov ecx, dword [esi]
mov eax, str.cant_read_from_file_descriptor__d
push ecx
push eax
call fcn.004f45b0
add esp, 8
or eax, 0xffffffff
pop esi
ret 8
xor eax, eax
pop esi
ret 8
Function at 0x519460
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 8]
call fcn.00518dc0
mov eax, dword [esi]
push eax
call fcn.00518bb0
add esp, 4
test al, al
je 0x5194c4
mov eax, dword [esi]
push eax
call dword [sym.imp.MSVCRT.dll__wremove]
add esp, 4
test eax, eax
je 0x5194c4
mov esi, dword [esi]
call fcn.004f0590
test eax, eax
je 0x5194b1
mov edx, dword [eax]
push 0
push str.cant_remove_file__s
mov ecx, eax
call dword [edx + 8]
push esi
push eax
call fcn.004f45b0
add esp, 8
xor al, al
pop esi
ret
mov eax, str.cant_remove_file__s
push esi
push eax
call fcn.004f45b0
add esp, 8
xor al, al
pop esi
ret
push 1
lea eax, [esi + 4]
push esi
push eax
call fcn.004fa730
add esp, 0xc
test al, al
jne 0x519511
mov esi, dword [esi]
call fcn.004f0590
test eax, eax
je 0x5194fe
mov edx, dword [eax]
push 0
push str.cant_commit_changes_to_file__s
mov ecx, eax
call dword [edx + 8]
push esi
push eax
call fcn.004f45b0
add esp, 8
xor al, al
pop esi
ret
mov eax, str.cant_commit_changes_to_file__s
push esi
push eax
call fcn.004f45b0
add esp, 8
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x519520
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 8]
call fcn.00518dc0
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.MSVCRT.dll__wremove]
add esp, 4
test eax, eax
je 0x519571
mov esi, dword [esi + 4]
call fcn.004f0590
test eax, eax
je 0x519562
mov edx, dword [eax]
push 0
push str.cant_remove_temporary_file__s
mov ecx, eax
call dword [edx + 8]
push esi
push eax
call fcn.004f45b0
add esp, 8
pop esi
ret
mov eax, str.cant_remove_temporary_file__s
push esi
push eax
call fcn.004f45b0
add esp, 8
pop esi
ret
Function at 0x51b6c0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x6274f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x6e0ea0]
mov dword [esp], eax
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push edx
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0
call fcn.004ec2e0
push 1
push str.
push 0x6d1fc8
lea ecx, [esp + 0xc]
call fcn.004ebbb0
push 1
push 0x6e8054
push 0x6d2d94
lea ecx, [esp + 0xc]
call fcn.004ebbb0
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [esp]
lea eax, [ecx - 0xc]
mov ecx, dword [ecx - 0xc]
cmp ecx, 0xffffffff
je 0x51b74f
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x51b74f
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x51f700
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x627b68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
push edi
mov edi, ecx
push eax
mov dword [esp + 0x10], edi
call fcn.00513530
xor ebx, ebx
push 0x10
mov dword [esp + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x51f764
push 0x2000
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [esi], eax
mov dword [esi + 4], 0x2000
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
jmp 0x51f766
xor esi, esi
mov ecx, dword [esp + 0x10]
mov dword [edi + 0x28], esi
mov eax, dword [esi + 0xc]
inc eax
mov dword [esi + 0xc], eax
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi], vtable.wxTeeInputStream.0
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x51fe10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x627be6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi], vtable.wxArchiveEntry.0
mov eax, dword [esp + 0x28]
mov byte [esi + 0xc], bl
mov byte [esi + 0xd], 0x1c
mov word [esi + 0xe], 0x14
mov word [esi + 0x10], bx
mov word [esi + 0x12], 0xffff
mov ecx, dword [eax]
or ebp, 0xffffffff
mov dword [esi + 0x18], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], ebp
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
mov edx, dword [0x6e0ea0]
lea edi, [esi + 0x38]
mov dword [esp + 0x1c], ebx
mov dword [edi], edx
mov dword [esi + 0x40], ebp
mov dword [esi + 0x44], ebp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], ebp
mov eax, dword [0x6e0ea0]
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x24]
mov word [esi + 0x54], bx
mov word [esi + 0x56], bx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi], vtable.wxZipEntry.0
mov ecx, dword [eax]
mov byte [esp + 0x1c], 2
cmp dword [ecx - 8], ebx
je 0x51ff1f
lea edx, [esp + 0x24]
push edx
push ebx
push eax
lea eax, [esp + 0x34]
push eax
call fcn.005208b0
add esp, 0x10
push eax
mov ecx, edi
mov byte [esp + 0x20], 3
call fcn.004ea610
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x1c], 2
lea eax, [ecx - 0xc]
mov ecx, dword [ecx - 0xc]
cmp ecx, ebp
je 0x51ff13
dec ecx
cmp ecx, ebx
mov dword [eax], ecx
jne 0x51ff13
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, dword [esp + 0x24]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x38]
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x521c50
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x627e08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x40]
push ebp
mov ebp, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x38]
push edi
mov edi, dword [esp + 0x40]
mov dword [ecx + 0x20], esi
mov dword [ecx + 0x28], edi
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], ebp
mov dword [ecx + 0x34], edx
mov dword [esp + 0x18], vtable.wxConvAuto.0
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0
call fcn.0052cb20
mov dword [esp + 0x18], vtable.wxConvAuto.0
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x30], 3
test ecx, ecx
je 0x521cdd
mov al, byte [esp + 0x24]
test al, al
je 0x521cdd
mov edx, dword [ecx]
push 1
call dword [edx + 0x18]
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 2
call fcn.004f6110
push esi
lea ecx, [esp + 0x10]
call fcn.0052cb50
push edi
lea ecx, [esp + 0x10]
call fcn.0052cb50
push ebp
lea ecx, [esp + 0x10]
call fcn.0052cb50
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.0052cb40
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov eax, 0xc
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret 0x18
Function at 0x521d8a
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x627e40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x3c]
push edi
mov eax, dword [esi + 0x10]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.004f85a0
mov ebx, dword [esp + 0x40]
xor edx, edx
cmp ebx, edx
mov dword [esp + 0x34], edx
jne 0x521db3
mov ebx, 0x6ff0e0
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x1c], vtable.wxConvAuto.0
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x20], edx
mov edi, ecx
mov ebp, dword [esp + 0x3c]
lea ecx, [esp + 0x1c]
push ecx
push ebp
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 1
call fcn.0052cb20
mov dword [esp + 0x1c], vtable.wxConvAuto.0
mov ecx, dword [esp + 0x20]
mov byte [esp + 0x34], 4
test ecx, ecx
je 0x521e09
mov al, byte [esp + 0x28]
test al, al
je 0x521e09
mov edx, dword [ecx]
push 1
call dword [edx + 0x18]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 3
call fcn.004f6110
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov dx, word [esi + 6]
push edi
push eax
mov ax, word [esi + 4]
push ecx
mov cx, word [esi + 2]
push edx
mov dx, word [esi]
push eax
push ecx
push edx
push 0x6054b50
lea ecx, [esp + 0x30]
call fcn.0052cc20
mov ecx, eax
call fcn.0052cc60
mov ecx, eax
call fcn.0052cc60
mov ecx, eax
call fcn.0052cc60
mov ecx, eax
call fcn.0052cc60
mov ecx, eax
call fcn.0052cc20
mov ecx, eax
call fcn.0052cc20
mov ecx, eax
call fcn.0052cc60
mov eax, dword [ebp]
and edi, 0xffff
push edi
push ebx
mov ecx, ebp
call dword [eax + 0x1c]
mov edx, dword [ebp]
mov ecx, ebp
call dword [edx + 4]
lea ecx, [esp + 0x10]
mov bl, al
mov byte [esp + 0x34], 0
call fcn.0052cb40
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.MSVCRT.dll_free]
mov ecx, dword [esp + 0x30]
add esp, 4
mov al, bl
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
Function at 0x524b10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x628298
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x48]
mov dword [esp + 0xc], edi
mov ecx, dword [esp + 0x38]
mov eax, dword [esi + 0x40]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov cl, byte [esi + 0x4c]
xor ebx, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x44]
cmp cl, bl
mov dword [esp + 0x30], ebx
mov dword [esi + 0x48], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
je 0x524b6f
mov eax, dword [esi + 0x18]
jmp 0x524b88
cmp eax, ebx
lea eax, [esp + 0x10]
jne 0x524b7b
lea eax, [esp + 0x18]
mov edx, dword [esi]
push eax
mov eax, dword [esi + 0x18]
push edi
push eax
mov ecx, esi
call dword [edx + 0x50]
mov ecx, dword [esi + 0x78]
mov edx, dword [esi + 0x7c]
and ecx, edx
mov dword [esi + 0x6c], eax
cmp ecx, 0xffffffff
jne 0x524bca
cmp dword [edi + 0x20], ebx
je 0x524bb7
mov edx, dword [edi + 0x28]
mov ecx, dword [edi + 0x2c]
and edx, ecx
cmp edx, 0xffffffff
je 0x524bb7
mov eax, dword [edi + 0x30]
mov edx, dword [edi + 0x34]
and eax, edx
cmp eax, 0xffffffff
jne 0x524bca
mov ecx, dword [edi + 0x28]
mov edx, dword [edi + 0x2c]
and ecx, edx
cmp ecx, 0xffffffff
je 0x524bce
or byte [edi + 0x10], 8
jmp 0x524bce
and byte [edi + 0x10], 0xf7
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0xc]
push eax
push edx
mov ecx, edi
call fcn.005211b0
mov edx, dword [esi]
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0xc]
mov ecx, esi
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
call dword [edx + 4]
test al, al
je 0x524c10
push edi
lea ecx, [esi + 0x24]
mov dword [esp + 0x10], ebx
call fcn.0050a1b0
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x40]
mov eax, dword [esi]
push ecx
push edx
mov ecx, esi
call dword [eax + 0x34]
lea ecx, [esp + 0xc]
mov dword [esi + 0x44], ebx
mov dword [esp + 0x30], 0xffffffff
call fcn.00527990
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x524b29
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x628298
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x48]
mov dword [esp + 0xc], edi
mov ecx, dword [esp + 0x38]
mov eax, dword [esi + 0x40]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov cl, byte [esi + 0x4c]
xor ebx, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x44]
cmp cl, bl
mov dword [esp + 0x30], ebx
mov dword [esi + 0x48], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
je 0x524b6f
mov eax, dword [esi + 0x18]
jmp 0x524b88
cmp eax, ebx
lea eax, [esp + 0x10]
jne 0x524b7b
lea eax, [esp + 0x18]
mov edx, dword [esi]
push eax
mov eax, dword [esi + 0x18]
push edi
push eax
mov ecx, esi
call dword [edx + 0x50]
mov ecx, dword [esi + 0x78]
mov edx, dword [esi + 0x7c]
and ecx, edx
mov dword [esi + 0x6c], eax
cmp ecx, 0xffffffff
jne 0x524bca
cmp dword [edi + 0x20], ebx
je 0x524bb7
mov edx, dword [edi + 0x28]
mov ecx, dword [edi + 0x2c]
and edx, ecx
cmp edx, 0xffffffff
je 0x524bb7
mov eax, dword [edi + 0x30]
mov edx, dword [edi + 0x34]
and eax, edx
cmp eax, 0xffffffff
jne 0x524bca
mov ecx, dword [edi + 0x28]
mov edx, dword [edi + 0x2c]
and ecx, edx
cmp ecx, 0xffffffff
je 0x524bce
or byte [edi + 0x10], 8
jmp 0x524bce
and byte [edi + 0x10], 0xf7
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0xc]
push eax
push edx
mov ecx, edi
call fcn.005211b0
mov edx, dword [esi]
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0xc]
mov ecx, esi
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
call dword [edx + 4]
test al, al
je 0x524c10
push edi
lea ecx, [esi + 0x24]
mov dword [esp + 0x10], ebx
call fcn.0050a1b0
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x40]
mov eax, dword [esi]
push ecx
push edx
mov ecx, esi
call dword [eax + 0x34]
lea ecx, [esp + 0xc]
mov dword [esi + 0x44], ebx
mov dword [esp + 0x30], 0xffffffff
call fcn.00527990
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x527f60
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x6287ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov dword [esp], 0
mov eax, dword [0x6e0ea0]
push esi
mov dword [esp + 4], eax
lea ecx, [esp + 8]
push 0x104
push ecx
mov dword [esp + 0x220], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 8]
lea ecx, [esp + 4]
push edx
call fcn.004ea6a0
push 0x5c
push 1
lea ecx, [esp + 0xc]
call fcn.004e9db0
mov eax, dword [esp + 4]
mov esi, dword [esp + 0x220]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x527fdf
mov ecx, dword [0x6e0ea0]
mov dword [esi], ecx
jmp 0x527ff1
mov dword [esi], eax
mov ecx, dword [eax - 0xc]
cmp ecx, 0xffffffff
je 0x527ff1
inc ecx
mov dword [eax - 0xc], ecx
mov eax, dword [esp + 4]
mov ecx, dword [eax - 0xc]
add eax, 0xfffffff4
cmp ecx, 0xffffffff
je 0x52800d
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x52800d
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov ecx, dword [esp + 0x210]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret

Function at 0x52a080
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
call fcn.00528910
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x52a0ec
push eax
call fcn.00518bb0
add esp, 4
test al, al
je 0x52a0ec
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll__wremove]
add esp, 4
cmp eax, 0xffffffff
jne 0x52a0ec
mov esi, dword [esi + 0x1c]
call fcn.004f0590
test eax, eax
je 0x52a0d9
mov edx, dword [eax]
push 0
push str.cant_delete_user_configuration_file__s
mov ecx, eax
call dword [edx + 8]
push esi
push eax
call fcn.004f45b0
add esp, 8
xor al, al
pop esi
ret
mov eax, str.cant_delete_user_configuration_file__s
push esi
push eax
call fcn.004f45b0
add esp, 8
xor al, al
pop esi
ret
mov ecx, esi
call fcn.005282b0
mov al, 1
pop esi
ret
Function at 0x52f6e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6294c4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi], vtable.wxArchiveEntry.0
mov ecx, dword [0x6e0ea0]
mov dword [esp + 0x1c], eax
mov dword [esi + 0xc], ecx
mov byte [esp + 0x1c], 1
mov dword [esi + 0x10], 0x1a4
mov byte [esi + 0x14], al
call fcn.0052f930
mov edx, dword [eax]
mov dword [esi + 0x18], edx
call fcn.0052f930
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp + 0xc]
or edi, 0xffffffff
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], edx
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov ecx, dword [eax]
mov dword [esi + 0x30], ecx
mov edx, dword [eax + 4]
mov eax, edi
mov ecx, edi
mov dword [esi + 0x34], edx
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], 0x30
mov eax, dword [0x6e0ea0]
mov dword [esi + 0x4c], eax
mov byte [esp + 0x1c], 2
call fcn.0052f930
mov eax, dword [eax + 8]
lea ecx, [esi + 0x50]
test eax, eax
jne 0x52f7a0
mov eax, 0x6fdb50
mov edx, dword [0x65329c]
push edx
push 0
push eax
call fcn.004e9b90
mov byte [esp + 0x1c], 3
call fcn.0052f930
mov eax, dword [eax + 0xc]
lea ecx, [esi + 0x54]
test eax, eax
jne 0x52f7c8
mov eax, 0x6fdb50
mov edx, dword [0x65329c]
push edx
push 0
push eax
call fcn.004e9b90
mov eax, dword [ebp + 8]
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi], vtable.wxTarEntry.0
mov ecx, dword [eax]
mov byte [esp + 0x1c], 4
mov edx, dword [ecx - 8]
test edx, edx
je 0x52f7fe
push 0
push eax
mov ecx, esi
call fcn.0052fea0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x54e750
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x54e783
push esi
call fcn.0054fe80
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x54e77c
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x54e809
mov eax, dword [esi + 0x1b4]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x54e7f2
mov eax, dword [esi + 8]
test eax, eax
je 0x54e7a7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b4]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x54e7ee
cmp eax, 2
je 0x54e7f2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x54e79a
cmp eax, 3
je 0x54e7cd
cmp eax, 1
jne 0x54e79a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x54e79a
mov edx, dword [esi + 0x140]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x54e79a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0054e840
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x54e829
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.0054e840
add esp, 4
pop esi
ret
Function at 0x5508c0
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov dword [edi + 4], ebx
call fcn.005585d0
push 0x54
push edi
mov dword [esp + 0x18], eax
call fcn.00558580
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x550904
push edi
call fcn.00404680
mov eax, dword [edi]
push edi
mov dword [eax + 0x14], 0x36
mov ecx, dword [edi]
mov dword [ecx + 0x18], ebx
mov edx, dword [edi]
call dword [edx]
add esp, 8
mov dword [esi], fcn.00550a00
mov dword [esi + 4], fcn.00550b50
mov dword [esi + 8], fcn.00550c00
mov dword [esi + 0xc], fcn.00550ca0
mov dword [esi + 0x10], 0x550d50
mov dword [esi + 0x14], 0x550dc0
mov dword [esi + 0x18], 0x550e30
mov dword [esi + 0x1c], 0x550fc0
mov dword [esi + 0x20], 0x5511b0
mov dword [esi + 0x24], fcn.005513a0
mov dword [esi + 0x28], 0x5514a0
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [esp + 0xc]
mov ecx, 2
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x40]
mov dword [eax - 8], ebx
mov dword [eax], ebx
sub eax, 4
dec ecx
jne 0x550966
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
cmp eax, ebx
je 0x5509f8
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push ecx
push edx
push str._ld_c
push eax
mov byte [esp + 0x24], 0x78
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x10
test eax, eax
jle 0x5509f8
mov al, byte [esp + 0x14]
cmp al, 0x6d
je 0x5509c1
cmp al, 0x4d
jne 0x5509e5
mov eax, dword [esp + 0xc]
pop edi
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esi + 0x2c], eax
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esp + 0xc]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x56c290
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
cmp eax, 3
push ebx
push esi
jne 0x56c2f9
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov cx, word [eax + 0x118]
test cx, cx
jne 0x56c2bb
test byte [eax + 0x230], 1
jne 0x56c2d8
movzx si, byte [edx]
cmp si, cx
jbe 0x56c2d8
push str.Invalid_background_palette_index
push eax
call fcn.005673a0
add esp, 8
pop esi
pop ebx
add esp, 8
ret
mov cl, byte [edx]
push 1
mov byte [esp + 0xc], cl
lea edx, [esp + 0xc]
push edx
push str.bKGD
push eax
call fcn.0056afb0
add esp, 0x10
pop esi
pop ebx
add esp, 8
ret
test al, 2
je 0x56c371
mov esi, dword [esp + 0x18]
xor eax, eax
lea ecx, [esp + 8]
mov ax, word [esi + 2]
push eax
push ecx
call fcn.0056af90
xor edx, edx
lea eax, [esp + 0x12]
mov dx, word [esi + 4]
push edx
push eax
call fcn.0056af90
xor ecx, ecx
lea edx, [esp + 0x1c]
mov cx, word [esi + 6]
push ecx
push edx
call fcn.0056af90
mov eax, dword [esp + 0x2c]
add esp, 0x18
cmp byte [eax + 0x127], 8
jne 0x56c36a
mov cl, byte [esp + 0xc]
mov bl, byte [esp + 0xa]
mov dl, byte [esp + 8]
or cl, bl
or cl, dl
je 0x56c36a
push str.Ignoring_attempt_to_write_16_bit_bKGD_chunk_when_bit_depth_is_8
push eax
call fcn.005673a0
add esp, 8
pop esi
pop ebx
add esp, 8
ret
push 6
jmp 0x56c2e0
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
xor eax, eax
mov edx, 1
mov ax, word [ecx + 8]
mov cl, byte [esi + 0x127]
shl edx, cl
cmp eax, edx
jl 0x56c3a4
push str.Ignoring_attempt_to_write_bKGD_chunk_out_of_range_for_bit_depth
push esi
call fcn.005673a0
add esp, 8
pop esi
pop ebx
add esp, 8
ret
push eax
lea eax, [esp + 0xc]
push eax
call fcn.0056af90
lea ecx, [esp + 0x10]
push 2
push ecx
push str.bKGD
push esi
call fcn.0056afb0
add esp, 0x18
pop esi
pop ebx
add esp, 8
ret
Function at 0x577fc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x62a213
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi], vtable.wxObject.0
mov dword [esi + 4], edi
lea ecx, [esi + 0xc]
push edi
mov dword [esp + 0x18], edi
call fcn.004ec5b0
lea ecx, [esi + 0x1c]
mov byte [esp + 0x14], 1
call fcn.004f5520
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x28], edi
mov eax, dword [0x6e0ea0]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi], vtable.wxXmlResourceHandler.0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret