joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48dcf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61c49b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, dword [0x6e0ea0]
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x24], eax
mov dword [esp + 8], vtable.wxListItem.0
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 2
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x44], esi
push ecx
lea ecx, [esp + 0x28]
call fcn.004ea610
mov edx, dword [esp + 0x4c]
lea eax, [esp + 8]
push eax
mov ecx, edi
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], edx
call fcn.0048db40
mov dword [esp + 0x50], eax
mov dword [esp + 8], vtable.wxListItem.0
mov dword [esp + 0x44], 1
mov eax, dword [esp + 0x38]
mov edi, eax
cmp eax, esi
mov dword [esp + 0x4c], edi
je 0x48ddd2
lea ecx, [eax + 0x28]
mov byte [esp + 0x44], 4
call fcn.0047c770
lea ecx, [edi + 0x14]
mov byte [esp + 0x44], 3
call fcn.0047d2b0
mov ecx, edi
mov byte [esp + 0x44], 2
call fcn.0047d2b0
push edi
call fcn.005b6480
add esp, 4
mov ecx, dword [esp + 0x24]
lea eax, [ecx - 0xc]
mov ecx, dword [ecx - 0xc]
cmp ecx, 0xffffffff
je 0x48ddf2
dec ecx
cmp ecx, esi
mov dword [eax], ecx
jne 0x48ddf2
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
lea ecx, [esp + 8]
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 8], vtable.wxObject.0
call fcn.004e8d50
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x50]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x40
ret 8
Function at 0x48de30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61c4db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, dword [0x6e0ea0]
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x24], eax
mov dword [esp + 8], vtable.wxListItem.0
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 2
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
mov dword [esp + 0x28], ecx
push edx
lea ecx, [esp + 0x28]
mov dword [esp + 0x48], esi
call fcn.004ea610
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 8]
push ecx
mov ecx, edi
mov dword [esp + 0x14], 6
mov dword [esp + 0x18], eax
call fcn.0048db40
mov dword [esp + 0x54], eax
mov dword [esp + 8], vtable.wxListItem.0
mov dword [esp + 0x44], 1
mov eax, dword [esp + 0x38]
mov edi, eax
cmp eax, esi
mov dword [esp + 0x50], edi
je 0x48df12
lea ecx, [eax + 0x28]
mov byte [esp + 0x44], 4
call fcn.0047c770
lea ecx, [edi + 0x14]
mov byte [esp + 0x44], 3
call fcn.0047d2b0
mov ecx, edi
mov byte [esp + 0x44], 2
call fcn.0047d2b0
push edi
call fcn.005b6480
add esp, 4
mov edx, dword [esp + 0x24]
mov ecx, dword [edx - 0xc]
lea eax, [edx - 0xc]
cmp ecx, 0xffffffff
je 0x48df32
dec ecx
cmp ecx, esi
mov dword [eax], ecx
jne 0x48df32
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
lea ecx, [esp + 8]
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 8], vtable.wxObject.0
call fcn.004e8d50
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x54]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x40
ret 0xc
Function at 0x48e010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61c51b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, dword [0x6e0ea0]
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x28], eax
mov dword [esp + 0xc], vtable.wxListItem.0
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 2
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x48], esi
push ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x18], 0x42
call fcn.004ea610
mov eax, dword [esp + 0x5c]
cmp eax, 0xffffffff
jle 0x48e0a2
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x38], eax
or ecx, 0x20
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x58]
lea eax, [esp + 0xc]
mov dword [esp + 0x34], edx
push eax
push ecx
mov ecx, edi
call fcn.0048df70
mov ebx, eax
mov dword [esp + 0xc], vtable.wxListItem.0
mov dword [esp + 0x48], 1
mov eax, dword [esp + 0x3c]
mov edi, eax
cmp eax, esi
mov dword [esp + 0x54], edi
je 0x48e10a
lea ecx, [eax + 0x28]
mov byte [esp + 0x48], 4
call fcn.0047c770
lea ecx, [edi + 0x14]
mov byte [esp + 0x48], 3
call fcn.0047d2b0
mov ecx, edi
mov byte [esp + 0x48], 2
call fcn.0047d2b0
push edi
call fcn.005b6480
add esp, 4
mov edx, dword [esp + 0x28]
mov ecx, dword [edx - 0xc]
lea eax, [edx - 0xc]
cmp ecx, 0xffffffff
je 0x48e12a
dec ecx
cmp ecx, esi
mov dword [eax], ecx
jne 0x48e12a
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0xc], vtable.wxObject.0
call fcn.004e8d50
mov ecx, dword [esp + 0x40]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 0x10

Function at 0x491cd0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x61ca78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [esp + 8], esi
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0xc], ecx
mov dword [esi + 0x24], edi
mov edi, dword [esp + 0x30]
mov dword [esi + 0x28], edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, esi
mov dword [esi + 0x40], eax
mov dword [esi], vtable.wxSizerItem.0
mov dword [esp + 0x14], edx
call fcn.00491c60
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 0x18
Function at 0x4a9336
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x61e5a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0xa0]
test al, al
mov byte [esp + 7], al
je 0x4a9358
mov eax, dword [esi + 0x114]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x114]
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0
push 0
push 0x184
push eax
call ebp
mov ecx, dword [esp + 0x24]
xor edi, edi
mov eax, dword [ecx + 4]
test eax, eax
mov dword [esi + 0x158], eax
jbe 0x4a93c4
mov ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ecx, dword [esi + 0x114]
mov eax, dword [edx + 8]
mov eax, dword [eax + edi*4]
push eax
push 0
push 0x180
push ecx
call ebp
test ebx, ebx
je 0x4a93b9
mov eax, dword [ebx + edi*4]
lea ecx, [esi + 0x150]
push eax
push edi
call fcn.004aa8d0
mov eax, dword [esi + 0x158]
inc edi
cmp edi, eax
jb 0x4a938a
mov eax, dword [esi + 0xcc]
test ah, 1
je 0x4a9459
mov ebx, dword [esi + 0x164]
xor edi, edi
test ebx, ebx
jbe 0x4a93f7
mov ecx, dword [esi + 0x168]
mov ecx, dword [ecx + edi*4]
test ecx, ecx
je 0x4a93f2
mov edx, dword [ecx]
push 1
call dword [edx]
inc edi
cmp edi, ebx
jb 0x4a93df
lea ebx, [esi + 0x160]
mov ecx, ebx
call fcn.004f56a0
mov eax, dword [esi + 0x158]
xor edi, edi
test eax, eax
jbe 0x4a9459
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x2ec]
mov ecx, dword [esp + 0x24]
mov ebp, eax
mov edx, dword [ecx + 8]
lea ecx, [ebp + 4]
lea eax, [edx + edi*4]
push eax
call fcn.004ea610
push 1
push ebp
mov ecx, ebx
call fcn.004f53f0
mov eax, dword [esi + 0x114]
push ebp
push edi
push 0x19a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x158]
inc edi
cmp edi, eax
jb 0x4a9410
mov eax, dword [0x6e0ea0]
pop edi
pop ebp
pop ebx
test eax, eax
jne 0x4a946a
mov eax, 0x6fdb50
mov ecx, dword [0x65329c]
push ecx
push 0
push eax
lea ecx, [esp + 0x24]
call fcn.004e9b90
mov edx, dword [esi]
lea eax, [esp + 0x18]
push eax
mov ecx, esi
mov dword [esp + 0x14], 0
call dword [edx + 0x2f0]
mov ecx, dword [esp + 0x18]
lea eax, [ecx - 0xc]
mov ecx, dword [ecx - 0xc]
cmp ecx, 0xffffffff
je 0x4a94b4
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x4a94b4
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov al, byte [esp + 7]
test al, al
je 0x4a94cb
mov edx, dword [esi + 0x114]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4b1630
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x61ee0c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
xor edi, edi
lea ecx, [esi + 4]
mov dword [esp + 8], esi
mov dword [esp + 0xc], ecx
mov dword [ecx + 4], edi
mov dword [esp + 0x18], edi
mov dword [ecx], vtable.wxColour.0
call fcn.0046cf80
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], 1
mov dword [esp + 0xc], ecx
mov dword [ecx + 4], edi
mov byte [esp + 0x18], 2
mov dword [ecx], vtable.wxColour.0
call fcn.0046cf80
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], vtable.wxFont.0
lea ecx, [esi + 0x38]
mov byte [esp + 0x18], 4
call fcn.004f5520
mov ecx, esi
mov byte [esp + 0x18], 5
call fcn.0047dc40
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4b3610
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61f161
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], vtable.wxObject.0
mov dword [esi + 4], ebx
lea edi, [esi + 8]
mov dword [esp + 0x1c], ebx
mov ecx, edi
mov dword [esp + 0x10], ecx
mov dword [ecx + 4], ebx
mov byte [esp + 0x1c], 1
mov dword [ecx], vtable.wxColour.0
call fcn.0046cf80
push fcn.0047d2b0
push fcn.0040f710
push 0x10
lea eax, [esi + 0x1c]
push 0x14
push eax
mov byte [esp + 0x30], 2
call fcn.005b65f2
push 0xff
mov dword [esi], vtable.wxColourData.0
mov byte [esi + 0x15c], bl
mov edx, dword [edi]
push ebx
push ebx
push ebx
mov ecx, edi
mov byte [esp + 0x2c], 3
call dword [edx + 0x3c]
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4b3629
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61f161
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], vtable.wxObject.0
mov dword [esi + 4], ebx
lea edi, [esi + 8]
mov dword [esp + 0x1c], ebx
mov ecx, edi
mov dword [esp + 0x10], ecx
mov dword [ecx + 4], ebx
mov byte [esp + 0x1c], 1
mov dword [ecx], vtable.wxColour.0
call fcn.0046cf80
push fcn.0047d2b0
push fcn.0040f710
push 0x10
lea eax, [esi + 0x1c]
push 0x14
push eax
mov byte [esp + 0x30], 2
call fcn.005b65f2
push 0xff
mov dword [esi], vtable.wxColourData.0
mov byte [esi + 0x15c], bl
mov edx, dword [edi]
push ebx
push ebx
push ebx
mov ecx, edi
mov byte [esp + 0x2c], 3
call dword [edx + 0x3c]
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4b3850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61f1cc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], vtable.wxObject.0
mov dword [esi + 4], ebx
lea edi, [esi + 8]
mov dword [esp + 0x1c], ebx
mov ecx, edi
mov dword [esp + 0x10], ecx
mov dword [ecx + 4], ebx
mov byte [esp + 0x1c], 1
mov dword [ecx], vtable.wxColour.0
call fcn.0046cf80
mov eax, vtable.wxFont.0
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], eax
mov eax, dword [0x6e0ea0]
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], eax
mov dword [esi + 0x44], ebx
cmp edi, 0x701224
mov byte [esp + 0x1c], 5
mov dword [esi], vtable.wxFontData.0
je 0x4b38de
push 0x701224
mov ecx, edi
call fcn.004e8d20
mov ecx, dword [0x70122c]
mov dword [edi + 8], ecx
mov dl, byte [0x701230]
mov byte [edi + 0xc], dl
mov al, byte [0x701231]
mov byte [edi + 0xd], al
mov cl, byte [0x701232]
mov byte [edi + 0xe], cl
mov dl, byte [0x701233]
mov ecx, dword [esp + 0x14]
mov byte [edi + 0xf], dl
mov al, byte [0x701234]
mov byte [edi + 0x10], al
mov byte [esi + 0x1c], bl
mov byte [esi + 0x1d], 1
mov byte [esi + 0x1e], 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], 0xffffffff
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4b3a30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61f24e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
mov dword [esi], vtable.wxObject.0
mov dword [esi + 4], ebx
mov eax, dword [0x6e0ea0]
lea ecx, [esi + 0x20]
mov dword [esp + 0x14], ebx
mov dword [ecx], eax
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov edx, dword [0x6e0ea0]
mov dword [esi + 0x3c], edx
mov eax, 1
mov dword [esi], vtable.wxPrintData.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], 3
mov dword [esi + 0x18], eax
mov byte [esi + 0x1c], bl
mov dword [esi + 0x14], eax
mov byte [esi + 0x1d], bl
mov eax, dword [0x6e0ea0]
push eax
mov byte [esp + 0x18], 2
call fcn.004ea6a0
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x30], ebx
mov ecx, dword [0x7011f4]
mov dword [esi + 0x34], ecx
mov edx, dword [0x7011f8]
mov dword [esi + 0x38], edx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
call fcn.004cf3a0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x3c]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x48], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4b3ed0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x61f2e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
mov dword [esi], vtable.wxObject.0
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
lea ecx, [esi + 0x38]
mov dword [esp + 0x14], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.004b3a30
xor ecx, ecx
xor eax, eax
mov dword [esi + 0xc], ecx
mov ecx, esi
mov byte [esp + 0x14], 1
mov dword [esi], vtable.wxPageSetupDialogData.0
mov dword [esi + 8], eax
call fcn.004b40f0
xor eax, eax
xor ecx, ecx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], 1
mov byte [esi + 0x32], 1
mov byte [esi + 0x33], 1
mov byte [esi + 0x34], 1
mov byte [esi + 0x36], bl
mov byte [esi + 0x35], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4b3ee7
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x61f2e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
mov dword [esi], vtable.wxObject.0
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
lea ecx, [esi + 0x38]
mov dword [esp + 0x14], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.004b3a30
xor ecx, ecx
xor eax, eax
mov dword [esi + 0xc], ecx
mov ecx, esi
mov byte [esp + 0x14], 1
mov dword [esi], vtable.wxPageSetupDialogData.0
mov dword [esi + 8], eax
call fcn.004b40f0
xor eax, eax
xor ecx, ecx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], 1
mov byte [esi + 0x32], 1
mov byte [esi + 0x33], 1
mov byte [esi + 0x34], 1
mov byte [esi + 0x36], bl
mov byte [esi + 0x35], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4d23e6
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x621930
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0045e300
xor edi, edi
mov ecx, esi
mov dword [esi + 0x160], edi
mov dword [esi + 0x164], edi
mov dword [esi + 0x168], edi
mov dword [esi + 0x16c], edi
mov dword [esp + 0x14], edi
mov dword [esi], vtable.wxTopLevelWindowMSW.0
call fcn.00455030
mov ecx, esi
mov dword [esp + 0x14], 1
mov dword [esi], vtable.wxTopLevelWindow.0
call fcn.00455030
push edi
lea ecx, [esi + 0x188]
mov dword [esp + 0x18], 2
call fcn.004634b0
mov ecx, esi
mov dword [esi], vtable.wxDialogBase.0
call fcn.0044ddc0
mov ecx, esi
mov dword [esp + 0x14], 3
mov dword [esi], vtable.wxDialog.0
call fcn.0044f460
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
mov ecx, esi
call fcn.0044f490
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x4d7f50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x622086
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0045e300
xor edi, edi
mov ecx, esi
mov dword [esi + 0x160], edi
mov dword [esi + 0x164], edi
mov dword [esi + 0x168], edi
mov dword [esi + 0x16c], edi
mov dword [esp + 0x14], edi
mov dword [esi], vtable.wxTopLevelWindowMSW.0
call fcn.00455030
mov ecx, esi
mov dword [esp + 0x14], 1
mov dword [esi], vtable.wxTopLevelWindow.0
call fcn.00455030
push edi
lea ecx, [esi + 0x188]
mov dword [esp + 0x18], 2
call fcn.004634b0
mov ecx, esi
mov dword [esi], vtable.wxDialogBase.0
call fcn.0044ddc0
mov ecx, esi
mov dword [esp + 0x14], 3
mov dword [esi], vtable.wxDialog.0
call fcn.0044f460
mov dword [esi], vtable.wxAnyChoiceDialog.0
mov eax, dword [0x6e0ea0]
mov dword [esp + 0x14], 4
mov dword [esi + 0x1a8], eax
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push 0x7011ec
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x34], 5
mov dword [esi], vtable.wxSingleChoiceDialog.0
call fcn.004d8060
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x20
Function at 0x4e3200
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x622e91
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x190
push ebx
push ebp
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
mov dword [esp + 0x2c], ebx
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push ebx
mov dword [esp + 0x1b0], 0
call edi
mov ebp, eax
push 0x5a
push ebx
mov dword [esp + 0x2c], ebp
call edi
mov ecx, dword [esi + 0x84]
mov dword [esp + 0x28], eax
mov dword [ecx + 0x24], eax
lea eax, [esi + 0x2c]
mov dword [ecx + 0x20], ebp
push eax
lea ecx, [esp + 0x54]
call fcn.004e4ee0
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x50]
mov byte [esp + 0x1a8], 1
call dword [edx + 0x68]
test al, al
je 0x4e33cc
mov ebp, dword [esp + 0x138]
push 4
push ebp
call edi
push 6
push ebp
mov dword [esp + 0x20], eax
call edi
push 8
push ebp
mov dword [esp + 0x1c], eax
call edi
push 0xa
push ebp
mov ebx, eax
call edi
push 0x58
push ebp
mov dword [esp + 0x24], eax
call edi
push 0x5a
push ebp
mov dword [esp + 0x18], eax
call edi
mov edi, eax
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x54]
mov dword [esp + 0x24], edi
call fcn.004e54b0
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov ebp, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x10]
test ecx, ecx
mov dword [esp + 0x38], edx
je 0x4e3302
test edi, edi
je 0x4e3302
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4e3302
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x4e3309
mov byte [esi + 0xb4], 0
mov ecx, dword [esp + 0x1c]
fild dword [esp + 0x24]
mov edx, dword [esi + 0x84]
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ecx
fidiv dword [esp + 0x10]
mov dword [edx + 0x10], ebx
mov dword [edx + 0x14], ecx
mov ecx, dword [esi + 0x84]
mov edx, dword [esp + 0x18]
mov dword [ecx + 0x18], edx
mov edx, dword [esp + 0x14]
mov dword [ecx + 0x1c], edx
mov ecx, dword [esi + 0x84]
mov edx, dword [esp + 0x34]
add ecx, 0x30
mov dword [ecx], ebp
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x38]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x84]
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], edi
fstp dword [esi + 0x94]
fild dword [esp + 0x28]
fidiv dword [esp + 0x20]
fstp dword [esi + 0x98]
lea ecx, [esp + 0x150]
mov byte [esp + 0x1a8], 2
call fcn.004b3b70
lea ecx, [esp + 0x50]
mov byte [esp + 0x1a8], 0
call fcn.0046f770
mov edx, dword [esp + 0x2c]
push edx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esp + 0x1a0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x19c
ret
xor ebp, ebp
xor edx, edx
mov ebx, 0x5dc
mov dword [esp + 0x34], edx
mov ecx, 0x9c4
mov edi, 0x258
mov edx, ebx
mov dword [esp + 0x18], 0x96
mov dword [esp + 0x14], 0xfa
mov dword [esp + 0x10], edi
mov dword [esp + 0x20], edi
mov eax, ecx
mov dword [esp + 0x38], edx
mov byte [esi + 0xb4], 0
jmp 0x4e330d