joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60d380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x708990
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x831704]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x831704]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, dword [esp + 0x78]
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
push edi
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x60d506
mov ebp, dword [sym.imp.MSVCR120.dll_free]
lea esp, [esp]
cmp dword [esi + 0x10], 0
je 0x60d527
lea eax, [edi + 0x2c]
mov dword [esp + 0x30], 7
test eax, eax
mov dword [esp + 0x2c], 0
mov edx, 0x7bf4e8
cmovne edx, eax
xor eax, eax
mov word [esp + 0x1c], ax
cmp word [edx], ax
je 0x60d433
mov eax, edx
lea edi, [eax + 2]
jmp 0x60d420
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x60d420
sub eax, edi
mov edi, dword [esp + 0x18]
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x24]
call fcn.00419290
mov dword [esp + 0x34], 0
push 3
push 0
push 0x7852b8
mov ecx, esi
mov dword [esp + 0x74], 0
call fcn.0060df50
cmp eax, dword [0x77db98]
jne 0x60d474
push esi
lea ecx, [esp + 0x20]
call fcn.005c95c0
mov bl, al
jmp 0x60d4cb
lea eax, [esp + 0x3c]
mov ecx, esi
push eax
call fcn.0060de70
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x6c], 1
call fcn.005c9570
mov ecx, eax
call fcn.005c95c0
push dword [esp + 0x54]
mov bl, al
call ebp
add esp, 4
cmp dword [esp + 0x50], 8
jb 0x60d4b4
push dword [esp + 0x3c]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
push dword [esp + 0x34]
mov dword [esp + 0x6c], 0xffffffff
call ebp
add esp, 4
cmp dword [esp + 0x30], 8
jb 0x60d4ef
push dword [esp + 0x1c]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
test bl, bl
jne 0x60d527
push edi
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x60d3e0
xor al, al
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.006d1ba7
add esp, 0x58
ret
mov al, 1
jmp 0x60d508
Function at 0x60de70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6f91e8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x831704]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov eax, dword [0x831704]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [esp + 0x40]
xor eax, eax
push 0xffffffffffffffff
push eax
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 0
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
call fcn.00419170
mov dword [esp + 0x24], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0
call fcn.005c9570
xor ecx, ecx
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
push ecx
mov dword [esi + 0x10], 0
mov word [esi], cx
mov ecx, esi
push eax
call fcn.00419170
push dword [esp + 0x24]
mov dword [esi + 0x18], 0
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
cmp dword [esp + 0x20], 8
jb 0x60df2d
push dword [esp + 0xc]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.006d1ba7
add esp, 0x34
ret 4
Function at 0x6119d1
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
cmp eax, 0xffffffff
jne 0x6119ea
mov dword [esi + 0xc], 1
xor eax, eax
pop esi
pop ecx
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x611a1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x6d
setne cl
lea ecx, [ecx*2 + 1]
mov dword [esi + 0xc], ecx
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8
Function at 0x61adc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x70cf06
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x831704]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi + 4], 0
mov dword [edi], vtable.wxStringTokenizer.0
xor eax, eax
mov dword [edi + 0x20], 7
mov dword [edi + 0x1c], 0
mov word [edi + 0xc], ax
mov dword [esp + 0x1c], 0
mov dword [edi + 0x24], eax
lea esi, [edi + 0x30]
mov byte [esp + 0x1c], 1
mov dword [edi + 0x2c], eax
mov dword [esp + 0x10], esi
call fcn.005c92f0
mov dword [esi], eax
mov byte [esp + 0x1c], 2
call fcn.005c92f0
mov dword [esi], eax
push dword [esp + 0x2c]
mov ecx, edi
mov byte [esp + 0x20], 3
push dword [esp + 0x2c]
mov dword [edi + 0x38], 0
push dword [esp + 0x2c]
call fcn.0061b1d0
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0xc
Function at 0x61bb20
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x6e5f60
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x831704]
xor eax, esp
mov dword [esp + 0x60], eax
push esi
mov eax, dword [0x831704]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x7c]
cmp dword [eax + 0x14], 8
jb 0x61bb5d
mov eax, dword [eax]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
jne 0x61bcd4
sub esp, 0x20
mov ecx, esp
push 0x721844
call fcn.00418040
push 6
call fcn.00439d10
add esp, 0x24
test al, al
je 0x61bcd0
call fcn.005c92f0
mov dword [esp + 8], eax
mov dword [esp + 0x74], 0
call fcn.005c92f0
mov dword [esp + 0xc], eax
push 0xffffffffffffffff
lea eax, [esp + 0x14]
mov byte [esp + 0x78], 1
push str._s__d_:__s_failed_with_error_0x_08lx___s_.
push eax
call fcn.00439000
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
push 0
mov dword [esp + 0x84], 2
mov dword [esp + 0x30], 6
mov dword [esp + 0x38], str....._srcmsw_snglinst.cpp
mov dword [esp + 0x40], str.wxSingleInstanceCheckerImpl::Create
mov dword [esp + 0x3c], 0x39
mov dword [esp + 0x44], 0x721844
call dword [sym.imp.MSVCR120.dll__time64]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], edx
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [esp + 0x50], eax
xor eax, eax
mov dword [esp + 0x54], 0
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], 0
mov word [esp + 0x58], ax
mov dword [esp + 0x70], eax
mov byte [esp + 0x84], 3
call sub.KERNEL32.dll_GetLastError
push eax
call fcn.005e5210
add esp, 0x14
push eax
call sub.KERNEL32.dll_GetLastError
push eax
push str.CreateMutex
push 0x39
push str....._srcmsw_snglinst.cpp
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x38]
call fcn.00479740
push dword [esp + 0x60]
mov byte [esp + 0x78], 2
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
cmp dword [esp + 0x5c], 8
jb 0x61bc9f
push dword [esp + 0x48]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [esp + 0x5c], 7
lea ecx, [esp + 0x28]
mov dword [esp + 0x58], 0
mov word [esp + 0x48], ax
call fcn.00439c40
lea ecx, [esp + 8]
mov dword [esp + 0x74], 0xffffffff
call fcn.00420020
xor al, al
jmp 0x61bce6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
mov byte [esi], al
mov al, 1
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.006d1ba7
add esp, 0x70
ret 4
Function at 0x61c100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7060a0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x831704]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x30]
mov dword [esp + 0x18], 1
mov dword [esp + 0xc], eax
test esi, esi
je 0x61c18a
push 2
mov ecx, esi
call fcn.005e6a20
cmp dword [0x82e960], 0
je 0x61c18a
mov ecx, eax
and ecx, 6
cmp ecx, eax
je 0x61c18a
push str.format_specifier_doesnt_match_argument_type
push str._argtype___wxFormatString::Arg_String____argtype
push str.wxArgNormalizerWchar_class_wxCStrData_const__::wxArgNormalizerWchar
push 0x225
push str.C:SourceSvn_trunk_tools_sourcewxWidgets_3.0includewx_strvararg.h
call fcn.005c6f20
add esp, 0x14
cmp byte [0x87c8e0], 0
je 0x61c18a
mov byte [0x87c8e0], 0
int3
lea eax, [esp + 0x24]
mov dword [esp + 0x20], eax
test esi, esi
je 0x61c1e3
push 1
mov ecx, esi
call fcn.005e6a20
cmp dword [0x82e960], 0
je 0x61c1e3
mov ecx, eax
and ecx, 6
cmp ecx, eax
je 0x61c1e3
push str.format_specifier_doesnt_match_argument_type
push str._argtype___wxFormatString::Arg_String____argtype
push str.wxArgNormalizerWchar_class_wxCStrData_const__::wxArgNormalizerWchar
push 0x225
push str.C:SourceSvn_trunk_tools_sourcewxWidgets_3.0includewx_strvararg.h
call fcn.005c6f20
add esp, 0x14
cmp byte [0x87c8e0], 0
je 0x61c1e3
mov byte [0x87c8e0], 0
int3
mov ecx, esi
call fcn.005e6500
lea ecx, [esp + 0xc]
mov esi, eax
call fcn.005e7830
push eax
lea ecx, [esp + 0x24]
call fcn.005e7830
push eax
push esi
push edi
call fcn.005c88c0
add esp, 0x10
mov edi, eax
cmp byte [esp + 0x2c], 0
je 0x61c253
mov esi, dword [esp + 0x24]
test esi, esi
je 0x61c253
push dword [esi + 0x18]
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
cmp dword [esi + 0x14], 8
jb 0x61c237
push dword [esi]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push esi
mov word [esi], ax
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp byte [esp + 0x38], 0
je 0x61c29a
mov esi, dword [esp + 0x30]
test esi, esi
je 0x61c29a
push dword [esi + 0x18]
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
cmp dword [esi + 0x14], 8
jb 0x61c27e
push dword [esi]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push esi
mov word [esi], ax
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x1c
Function at 0x62ba50
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
cmp byte [esi], 0x23
jne 0x62bb27
mov al, byte [esi + 1]
inc esi
mov dword [esp + 0x10], esi
test al, al
je 0x62bb20
push edi
lea edi, [ebx + 0x68]
cmp al, 0x61
jl 0x62ba7e
cmp al, 0x7a
jle 0x62baed
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x62baed
lea ecx, [eax - 0x30]
cmp cl, 9
jbe 0x62baed
cmp al, 0x2d
je 0x62baed
cmp al, 0x2e
je 0x62baed
cmp al, 0x5f
je 0x62baed
cmp al, 0x7e
je 0x62baed
cmp al, 0x21
je 0x62baed
cmp al, 0x24
je 0x62baed
cmp al, 0x26
je 0x62baed
cmp al, 0x27
je 0x62baed
cmp al, 0x28
je 0x62baed
cmp al, 0x29
je 0x62baed
cmp al, 0x2a
je 0x62baed
cmp al, 0x2b
je 0x62baed
cmp al, 0x2c
je 0x62baed
cmp al, 0x3b
je 0x62baed
cmp al, 0x3d
je 0x62baed
cmp al, 0x3a
je 0x62baed
cmp al, 0x40
je 0x62baed
cmp al, 0x2f
je 0x62baed
cmp al, 0x3f
je 0x62baed
lea eax, [esp + 0x14]
mov ecx, ebx
push eax
push edi
call fcn.0062b5a0
mov esi, dword [esp + 0x14]
jmp 0x62bb15
inc esi
mov byte [esp + 0xc], al
mov dword [esp + 0x14], esi
cmp al, 0x80
jae 0x62baff
movsx eax, al
jmp 0x62bb0b
push dword [esp + 0xc]
call fcn.005d12e0
add esp, 4
push eax
push 1
mov ecx, edi
call fcn.004390c0
mov al, byte [esi]
test al, al
jne 0x62ba76
pop edi
or dword [ebx + 0xec], 0x40
mov eax, esi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x62c360
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
cmp byte [esi], 0x3f
jne 0x62c440
mov al, byte [esi + 1]
inc esi
mov dword [esp + 0x10], esi
test al, al
je 0x62c439
push edi
cmp al, 0x23
je 0x62c438
cmp al, 0x61
jl 0x62c393
cmp al, 0x7a
jle 0x62c405
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x62c405
lea ecx, [eax - 0x30]
cmp cl, 9
jbe 0x62c405
cmp al, 0x2d
je 0x62c405
cmp al, 0x2e
je 0x62c405
cmp al, 0x5f
je 0x62c405
cmp al, 0x7e
je 0x62c405
cmp al, 0x21
je 0x62c405
cmp al, 0x24
je 0x62c405
cmp al, 0x26
je 0x62c405
cmp al, 0x27
je 0x62c405
cmp al, 0x28
je 0x62c405
cmp al, 0x29
je 0x62c405
cmp al, 0x2a
je 0x62c405
cmp al, 0x2b
je 0x62c405
cmp al, 0x2c
je 0x62c405
cmp al, 0x3b
je 0x62c405
cmp al, 0x3d
je 0x62c405
cmp al, 0x3a
je 0x62c405
cmp al, 0x40
je 0x62c405
cmp al, 0x2f
je 0x62c405
cmp al, 0x3f
je 0x62c405
lea eax, [esp + 0x14]
mov ecx, ebx
push eax
lea eax, [ebx + 0x48]
push eax
call fcn.0062b5a0
mov esi, dword [esp + 0x14]
jmp 0x62c42e
inc esi
mov byte [esp + 0xc], al
mov dword [esp + 0x14], esi
cmp al, 0x80
jae 0x62c417
movsx eax, al
jmp 0x62c423
push dword [esp + 0xc]
call fcn.005d12e0
add esp, 4
push eax
push 1
lea ecx, [ebx + 0x48]
call fcn.004390c0
mov al, byte [esi]
test al, al
jne 0x62c383
pop edi
or dword [ebx + 0xec], 0x20
mov eax, esi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x62c510
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x18]
mov ebx, ecx
push eax
cmp byte [edi], 0x5b
jne 0x62c58a
lea ebp, [edi + 1]
mov dword [esp + 0x1c], ebp
call fcn.0062bca0
add esp, 4
test al, al
je 0x62c560
mov esi, dword [esp + 0x18]
cmp byte [esi], 0x5d
jne 0x62c560
mov dword [ebx + 0xe8], 2
mov eax, esi
lea ecx, [ebx + 0xa8]
sub eax, edi
dec eax
push eax
push ebp
call fcn.00439af0
inc esi
jmp 0x62c5b9
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebp
push eax
call fcn.0062be00
add esp, 4
test al, al
je 0x62c5b7
mov esi, dword [esp + 0x18]
cmp byte [esi], 0x5d
jne 0x62c5b7
mov dword [ebx + 0xe8], 3
jmp 0x62c54b
call fcn.0062bbd0
add esp, 4
test al, al
je 0x62c5b7
mov esi, dword [esp + 0x18]
lea ecx, [ebx + 0xa8]
mov eax, esi
mov dword [ebx + 0xe8], 1
sub eax, edi
push eax
push edi
call fcn.00439af0
jmp 0x62c5b9
mov esi, edi
cmp dword [ebx + 0xe8], 0
jne 0x62c699
cmp byte [edi], 0
mov esi, edi
mov dword [esp + 0x18], esi
je 0x62c699
mov al, byte [esi]
cmp al, 0x2f
je 0x62c699
cmp al, 0x3a
je 0x62c699
cmp al, 0x23
je 0x62c699
cmp al, 0x3f
je 0x62c699
cmp al, 0x61
jl 0x62c5ff
cmp al, 0x7a
jle 0x62c664
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x62c664
lea ecx, [eax - 0x30]
cmp cl, 9
jbe 0x62c664
cmp al, 0x2d
je 0x62c664
cmp al, 0x2e
je 0x62c664
cmp al, 0x5f
je 0x62c664
cmp al, 0x7e
je 0x62c664
cmp al, 0x21
je 0x62c664
cmp al, 0x24
je 0x62c664
cmp al, 0x26
je 0x62c664
cmp al, 0x27
je 0x62c664
cmp al, 0x28
je 0x62c664
cmp al, 0x29
je 0x62c664
cmp al, 0x2a
je 0x62c664
cmp al, 0x2b
je 0x62c664
cmp al, 0x2c
je 0x62c664
cmp al, 0x3b
je 0x62c664
cmp al, 0x3d
je 0x62c664
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
lea eax, [ebx + 0xa8]
push eax
call fcn.0062b5a0
mov esi, dword [esp + 0x18]
jmp 0x62c690
inc esi
mov byte [esp + 0x10], al
mov dword [esp + 0x18], esi
cmp al, 0x80
jae 0x62c676
movsx eax, al
jmp 0x62c682
push dword [esp + 0x10]
call fcn.005d12e0
add esp, 4
push eax
push 1
lea ecx, [ebx + 0xa8]
call fcn.004390c0
cmp byte [esi], 0
jne 0x62c5d5
or dword [ebx + 0xec], 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x62c6b0
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebx, ecx
mov ebp, esi
mov al, byte [esi]
test al, al
je 0x62c78f
push edi
cmp al, 0x40
je 0x62c78e
cmp al, 0x2f
je 0x62c78e
cmp al, 0x23
je 0x62c78e
cmp al, 0x3f
je 0x62c78e
cmp al, 0x61
jl 0x62c6ef
cmp al, 0x7a
jle 0x62c758
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x62c758
lea ecx, [eax - 0x30]
cmp cl, 9
jbe 0x62c758
cmp al, 0x2d
je 0x62c758
cmp al, 0x2e
je 0x62c758
cmp al, 0x5f
je 0x62c758
cmp al, 0x7e
je 0x62c758
cmp al, 0x21
je 0x62c758
cmp al, 0x24
je 0x62c758
cmp al, 0x26
je 0x62c758
cmp al, 0x27
je 0x62c758
cmp al, 0x28
je 0x62c758
cmp al, 0x29
je 0x62c758
cmp al, 0x2a
je 0x62c758
cmp al, 0x2b
je 0x62c758
cmp al, 0x2c
je 0x62c758
cmp al, 0x3b
je 0x62c758
cmp al, 0x3d
je 0x62c758
cmp al, 0x3a
je 0x62c758
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
lea eax, [ebx + 0x88]
push eax
call fcn.0062b5a0
mov esi, dword [esp + 0x18]
jmp 0x62c784
inc esi
mov byte [esp + 0x10], al
mov dword [esp + 0x18], esi
cmp al, 0x80
jae 0x62c76a
movsx eax, al
jmp 0x62c776
push dword [esp + 0x10]
call fcn.005d12e0
add esp, 4
push eax
push 1
lea ecx, [ebx + 0x88]
call fcn.004390c0
mov al, byte [esi]
test al, al
jne 0x62c6c7
pop edi
cmp byte [esi], 0x40
jne 0x62c7a5
or dword [ebx + 0xec], 2
lea eax, [esi + 1]
pop esi
pop ebp
pop ebx
pop ecx
ret 4
cmp dword [ebx + 0x9c], 8
lea eax, [ebx + 0x88]
mov dword [eax + 0x10], 0
jb 0x62c7bd
mov eax, dword [eax]
xor ecx, ecx
pop esi
mov word [eax], cx
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x62dcf0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x70edcc
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x831704]
xor eax, esp
mov dword [esp + 0xc0], eax
push ebx
push esi
push edi
mov eax, dword [0x831704]
xor eax, esp
push eax
lea eax, [esp + 0xd4]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [esp + 0xe4]
test ecx, ecx
je 0x62ded5
mov eax, dword [edi]
test eax, eax
je 0x62deb6
mov esi, dword [esp + 0xe8]
push eax
push esi
push 1
push ecx
call dword [sym.imp.MSVCR120.dll_fread]
mov ebx, eax
add esp, 0x10
cmp ebx, esi
jae 0x62deb2
push dword [edi]
call dword [sym.imp.MSVCR120.dll_ferror]
add esp, 4
test eax, eax
je 0x62deb2
sub esp, 0x20
mov ecx, esp
push 0x721844
call fcn.00418040
push 1
call fcn.00439d10
add esp, 0x24
test al, al
je 0x62deb2
push str.Read_error_on_file__s
lea ecx, [esp + 0x6c]
call fcn.00418040
xor eax, eax
mov dword [esp + 0xdc], 0
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x14]
mov byte [esp + 0xdc], 1
push eax
lea eax, [esp + 0x6c]
push eax
call fcn.00420160
add esp, 8
lea ecx, [esp + 0x34]
push eax
call fcn.0041fd90
push str.wx.sys_error
lea ecx, [esp + 0x4c]
mov byte [esp + 0xe0], 2
call fcn.00418040
sub esp, 0xc
lea ecx, [edi + 4]
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0041f670
push 0x721844
push str.wxFFile::Read
push 0x86
push str....._srccommon_ffile.cpp
push 1
lea ecx, [esp + 0xa8]
mov byte [esp + 0xfc], 4
call fcn.00439de0
mov esi, eax
mov byte [esp + 0xe8], 5
lea eax, [esp + 0x40]
push eax
call sub.KERNEL32.dll_GetLastError
push eax
lea eax, [esp + 0x5c]
mov ecx, esi
push eax
call fcn.0049dde0
mov ecx, eax
mov byte [esp + 0xec], 6
call fcn.00493410
lea ecx, [esp + 0x88]
mov byte [esp + 0xdc], 3
call fcn.0043f270
lea ecx, [esp + 0x48]
call fcn.00418210
lea ecx, [esp + 0x34]
mov byte [esp + 0xdc], 1
call fcn.00420020
lea ecx, [esp + 0x14]
call fcn.00418210
lea ecx, [esp + 0x68]
call fcn.00418210
mov eax, ebx
jmp 0x62df12
cmp dword [0x82e960], 0
je 0x62df10
push str.cant_read_from_closed_file
push str.IsOpened__
push str.wxFFile::Read
push 0x81
jmp 0x62def2
cmp dword [0x82e960], 0
je 0x62df10
push 0x7cfb6c
push str.pBuf
push str.wxFFile::Read
push 0x80
push str....._srccommon_ffile.cpp
call fcn.005c7220
add esp, 0x14
cmp byte [0x87c8e0], 0
je 0x62df10
mov byte [0x87c8e0], 0
int3
xor eax, eax
mov ecx, dword [esp + 0xd4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.006d1ba7
add esp, 0xd0
ret 8
Function at 0x62e780
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x70edcc
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x831704]
xor eax, esp
mov dword [esp + 0xc0], eax
push ebx
push esi
push edi
mov eax, dword [0x831704]
xor eax, esp
push eax
lea eax, [esp + 0xd4]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [esp + 0xe4]
test edx, edx
je 0x62e952
mov eax, dword [ebx]
test eax, eax
je 0x62e933
mov esi, dword [esp + 0xe8]
push eax
push esi
push 1
push edx
call dword [sym.imp.MSVCR120.dll_fwrite]
mov edi, eax
add esp, 0x10
cmp edi, esi
jae 0x62e92f
sub esp, 0x20
mov ecx, esp
push 0x721844
call fcn.00418040
push 1
call fcn.00439d10
add esp, 0x24
test al, al
je 0x62e92f
push str.Write_error_on_file__s
lea ecx, [esp + 0x6c]
call fcn.00418040
xor eax, eax
mov dword [esp + 0xdc], 0
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x14]
mov byte [esp + 0xdc], 1
push eax
lea eax, [esp + 0x6c]
push eax
call fcn.00420160
add esp, 8
lea ecx, [esp + 0x34]
push eax
call fcn.0041fd90
push str.wx.sys_error
lea ecx, [esp + 0x4c]
mov byte [esp + 0xe0], 2
call fcn.00418040
sub esp, 0xc
lea ecx, [ebx + 4]
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0041f670
push 0x721844
push str.wxFFile::Write
push 0x94
push str....._srccommon_ffile.cpp
push 1
lea ecx, [esp + 0xa8]
mov byte [esp + 0xfc], 4
call fcn.00439de0
mov esi, eax
mov byte [esp + 0xe8], 5
lea eax, [esp + 0x40]
push eax
call sub.KERNEL32.dll_GetLastError
push eax
lea eax, [esp + 0x5c]
mov ecx, esi
push eax
call fcn.0049dde0
mov ecx, eax
mov byte [esp + 0xec], 6
call fcn.00493410
lea ecx, [esp + 0x88]
mov byte [esp + 0xdc], 3
call fcn.0043f270
lea ecx, [esp + 0x48]
call fcn.00418210
lea ecx, [esp + 0x34]
mov byte [esp + 0xdc], 1
call fcn.00420020
lea ecx, [esp + 0x14]
call fcn.00418210
lea ecx, [esp + 0x68]
call fcn.00418210
mov eax, edi
jmp 0x62e98f
cmp dword [0x82e960], 0
je 0x62e98d
push str.cant_write_to_closed_file
push str.IsOpened__
push str.wxFFile::Write
push 0x8f
jmp 0x62e96f
cmp dword [0x82e960], 0
je 0x62e98d
push 0x7cfb6c
push str.pBuf
push str.wxFFile::Write
push 0x8e
push str....._srccommon_ffile.cpp
call fcn.005c7220
add esp, 0x14
cmp byte [0x87c8e0], 0
je 0x62e98d
mov byte [0x87c8e0], 0
int3
xor eax, eax
mov ecx, dword [esp + 0xd4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.006d1ba7
add esp, 0xd0
ret 8
Function at 0x6316b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x70f1c3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x831704]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi + 4], 0
xor eax, eax
mov dword [edi], vtable.wxConfigBase.0
push 0xffffffffffffffff
push eax
push dword [esp + 0x28]
mov dword [edi + 0x20], 7
lea ecx, [edi + 0xc]
mov dword [edi + 0x1c], 0
mov dword [esp + 0x24], 0
mov word [edi + 0xc], ax
call fcn.00419170
mov dword [edi + 0x24], 0
xor eax, eax
mov dword [edi + 0x40], 7
push 0xffffffffffffffff
push eax
push dword [esp + 0x2c]
mov dword [edi + 0x3c], 0
lea ecx, [edi + 0x2c]
mov byte [esp + 0x24], 1
mov word [edi + 0x2c], ax
call fcn.00419170
mov eax, dword [esp + 0x30]
mov dword [edi + 0x44], 0
mov dword [edi + 0x4c], eax
mov eax, edi
mov word [edi + 8], 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x14