joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5875c0
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x708bb8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
and byte [esi + 0x11c], 0xfe
push 0x10
xor edi, edi
call ebx
test ax, ax
jge 0x587605
mov edi, 4
push 0x11
call ebx
test ax, ax
jge 0x587611
or edi, 8
push 1
call ebx
test ax, ax
jns 0x58761d
or edi, 1
push 4
call ebx
test ax, ax
jns 0x587629
or edi, 0x10
push 2
call ebx
test ax, ax
jns 0x587635
or edi, 2
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x114]
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [0x84e188]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
sub dword [esp + 0x10], edx
sub dword [esp + 0x14], eax
push ecx
lea ecx, [esp + 0x2c]
call fcn.005978a0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edi
push edx
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
mov dword [esp + 0x80], 0
call fcn.005872b0
mov ecx, dword [esi + 0x5c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
lea eax, [esp + 0x28]
push eax
call edx
lea ecx, [esp + 0x28]
mov dword [esp + 0x70], 0xffffffff
mov dword [esp + 0x28], vtable.wxObject.0
call fcn.005fd8d0
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x64
ret

Function at 0x5893a0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x20]
push ebx
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, ecx
push eax
mov ecx, esi
mov dword [esp + 0x10], 0
call fcn.005979f0
mov eax, dword [edi + 0x28]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov dword [esi + 0x14], eax
call ebx
test ax, ax
setl cl
push 0x11
mov byte [esi + 0x31], cl
call ebx
test ax, ax
mov eax, dword [esp + 0x34]
setl dl
mov ecx, eax
shr ecx, 0x10
and ecx, 0x2000
cmp ecx, 0x2000
mov ecx, dword [esp + 0x30]
mov byte [esi + 0x30], dl
mov dword [esi + 0x2c], ecx
mov ecx, dword [esp + 0x38]
sete dl
mov byte [esi + 0x32], dl
mov dword [esi + 8], edi
mov word [esi + 0x36], cx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
call dword [sym.imp.USER32.dll_GetMessageTime]
lea edx, [esp + 0xc]
push edx
mov dword [esi + 0x10], eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edi, dword [edi + 0x114]
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
sub ecx, dword [esp + 0x18]
mov dword [esi + 0x24], eax
pop edi
mov dword [esi + 0x28], ecx
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret 0x14
Function at 0x589690
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp byte [esp + 4], 0
je 0x5896c2
mov dword [0x84db38], 0x587ca0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call fcn.005fec10
push eax
mov eax, dword [0x84db38]
push eax
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x84db34], eax
ret
mov ecx, dword [0x84db34]
push ecx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
ret
Function at 0x589890
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x708e0c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.wxDCBase.0
call fcn.005bb760
fld1
mov cl, byte [esi + 8]
fst qword [esi + 0x20]
and cl, 0xe2
fst qword [esi + 0x28]
and al, 1
fst qword [esi + 0x30]
or cl, al
fst qword [esi + 0x38]
or cl, 2
fst qword [esi + 0x40]
mov ebp, 1
fstp qword [esi + 0x48]
mov byte [esi + 8], cl
lea ecx, [esi + 0x84]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x50], ebp
mov dword [esi + 0x54], ebp
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], 5
mov dword [esi + 0x7c], 0x6a
mov dword [esi + 0x80], ebp
call fcn.005c8e10
lea ecx, [esi + 0x8c]
mov byte [esp + 0x1c], 1
call fcn.005bbd40
push 8
mov byte [esp + 0x20], 2
call fcn.0058dd10
mov dword [esi + 0x94], vtable.wxObject.0
mov eax, dword [eax + 4]
add esp, 4
cmp eax, ebx
mov dword [esi + 0x98], eax
je 0x589979
add dword [eax + 4], ebp
mov dword [esi + 0x94], vtable.wxBrush.0
push 0xa
mov byte [esp + 0x20], 3
call fcn.0058d4e0
mov dword [esi + 0x9c], vtable.wxObject.0
mov ecx, dword [eax + 4]
add esp, 4
cmp ecx, ebx
mov dword [esi + 0xa0], ecx
je 0x5899ac
add dword [ecx + 4], ebp
mov dword [esi + 0x9c], vtable.wxColour.0
mov edx, dword [eax + 8]
mov dword [esi + 0xa4], edx
movzx ecx, byte [eax + 0xc]
mov byte [esi + 0xa8], cl
movzx edx, byte [eax + 0xd]
mov byte [esi + 0xa9], dl
movzx ecx, byte [eax + 0xe]
mov byte [esi + 0xaa], cl
movzx edx, byte [eax + 0xf]
mov byte [esi + 0xab], dl
mov al, byte [eax + 0x10]
mov byte [esi + 0xac], al
push 0x10
mov byte [esp + 0x20], 4
call fcn.0058d4e0
mov dword [esi + 0xb0], vtable.wxObject.0
mov ecx, dword [eax + 4]
add esp, 4
cmp ecx, ebx
mov dword [esi + 0xb4], ecx
je 0x589a19
add dword [ecx + 4], ebp
mov dword [esi + 0xb0], vtable.wxColour.0
mov ecx, dword [eax + 8]
mov dword [esi + 0xb8], ecx
movzx edx, byte [eax + 0xc]
mov byte [esi + 0xbc], dl
movzx ecx, byte [eax + 0xd]
mov byte [esi + 0xbd], cl
movzx edx, byte [eax + 0xe]
mov byte [esi + 0xbe], dl
movzx ecx, byte [eax + 0xf]
mov byte [esi + 0xbf], cl
movzx edx, byte [eax + 0x10]
mov byte [esi + 0xc0], dl
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xc4], vtable.wxFont.0
lea ecx, [esi + 0xcc]
mov byte [esp + 0x1c], 6
call fcn.005c6620
and byte [esi + 8], 0xeb
mov byte [esi + 0xd4], bl
mov dword [esi + 0x64], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x68], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x58fb40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x710388
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov dword [esi], vtable.wxSizerItem.0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esi + 0x40], edx
call fcn.0058fab0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x14

Function at 0x5915a0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x7097e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor eax, eax
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov dword [esi], vtable.wxSizerItem.0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], edi
mov edi, dword [esp + 0x38]
mov dword [esi + 0x24], edi
mov edi, dword [esp + 0x34]
mov dword [esi + 0x28], edi
mov dword [esp + 0x10], ecx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, esi
mov dword [esi + 0x40], eax
mov dword [esp + 0x18], edx
call fcn.0058fc30
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 0x18

Function at 0x592750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x70bfe8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [0x84e270]
mov eax, dword [esi + 0x28]
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.005fdcc0
mov dl, byte [esp + 0x44]
mov dword [esp + 0xc], vtable.wxIconizeEvent.0
mov byte [esp + 0x30], dl
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x14], esi
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x40], 0
call eax
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0xc], vtable.wxObject.0
call fcn.005fd8d0
mov al, bl
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x34
ret 4
Function at 0x59a1f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x70a308
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esi + 4], ebx
mov eax, dword [esp + 0x30]
cmp eax, ebx
mov dword [esp + 0x28], ebx
mov dword [esi], vtable.wxBitmap.0
je 0x59a292
push eax
lea ecx, [esp + 0x14]
call fcn.005a28d0
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 1
call fcn.005a14d0
test al, al
je 0x59a27d
push 0xffffffffffffffff
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
call fcn.004075c6
cmp esi, eax
mov byte [esp + 0x28], 2
je 0x59a26f
push eax
mov ecx, esi
call fcn.005fd950
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 1
call fcn.0057d0a0
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
mov dword [esp + 0x10], vtable.wxObject.0
call fcn.005fd8d0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret 4
Function at 0x5a4e40
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x70af68
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
push 0x100
call fcn.00619370
push 4
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
call fcn.00557b2e
add esp, 0xc
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.005a4d70
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push ecx
push edx
push eax
lea ecx, [esp + 0x24]
call fcn.005a25d0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push 0x5a8dc0
push ecx
push edx
mov bl, al
mov dword [esp + 0x30], 0xffffffff
call fcn.006193a0
mov eax, dword [esp + 0x18]
push eax
mov dword [esp + 0x24], 0
call fcn.0054d3b5
add esp, 0x10
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret 0x18

Function at 0x5ab480
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x70b8fe
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], vtable.wxMenuItemBase.0
mov ecx, dword [0x829274]
mov dword [esp + 0x14], eax
mov dword [esi + 0x14], ecx
mov edx, dword [0x829274]
mov dword [esi + 0x18], edx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x30]
mov byte [esi + 0x20], al
mov eax, dword [esp + 0x20]
cmp eax, 0xffffffff
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x2c]
mov byte [esp + 0x14], 2
mov dword [esi + 0x10], edx
mov byte [esi + 0x21], 1
mov dword [esi + 8], eax
mov dword [esi + 0x1c], ecx
jne 0x5ab4fe
call fcn.005a90f0
mov dword [esi + 8], eax
cmp dword [esi + 8], 0xfffffffe
jne 0x5ab50b
mov dword [esi + 0x1c], 0xffffffff
mov edx, dword [esp + 0x24]
push edx
mov ecx, esi
call fcn.005aa3f0
mov eax, dword [esp + 0x28]
push eax
mov ecx, esi
call fcn.005aa490
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x18
Function at 0x5b07b0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x70bea0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [0x8249b0]
cmp eax, 0xffffffff
jne 0x5b0984
mov al, byte [0x829804]
xor ebx, ebx
mov dword [0x8249b0], ebx
mov byte [esp + 0xe], al
mov byte [0x829804], bl
mov byte [esp + 0xf], al
mov eax, dword [0x77132c]
push eax
push ebx
push 0x74c1c8
lea ecx, [esp + 0x20]
mov dword [esp + 0x44], ebx
call fcn.005fc220
push 0x68
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 1
mov dword [esp + 0x18], ebx
call fcn.00617bc0
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
cmp eax, 0xffffffff
mov byte [esp + 0x38], 3
je 0x5b0852
add eax, 0xffffffff
cmp eax, ebx
mov dword [ecx], eax
jne 0x5b0852
call fcn.005fb120
cmp dword [esp + 0x10], ebx
jne 0x5b0865
mov dword [0x8249b0], ebx
xor eax, eax
jmp 0x5b097a
mov eax, dword [0x77132c]
push eax
push ebx
push str.DllGetVersion
lea ecx, [esp + 0x24]
call fcn.005fc220
push ebx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 4
call fcn.00617b60
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff4
mov esi, eax
mov eax, dword [ecx]
cmp eax, 0xffffffff
mov byte [esp + 0x38], 3
je 0x5b08b1
add eax, 0xffffffff
cmp eax, ebx
mov dword [ecx], eax
jne 0x5b08b1
call fcn.005fb120
cmp esi, ebx
je 0x5b08da
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0x14
call esi
cmp eax, ebx
jl 0x5b08da
mov eax, dword [esp + 0x20]
imul eax, eax, 0x64
add eax, dword [esp + 0x24]
mov dword [0x8249b0], eax
jmp 0x5b08df
mov eax, dword [0x8249b0]
cmp eax, ebx
jne 0x5b097a
push str.InitCommonControlsEx
lea ecx, [esp + 0x1c]
call fcn.00402474
push ebx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 5
call fcn.00617b60
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff4
mov esi, eax
mov eax, dword [ecx]
cmp eax, 0xffffffff
mov byte [esp + 0x38], 3
je 0x5b092c
add eax, 0xffffffff
cmp eax, ebx
mov dword [ecx], eax
jne 0x5b092c
call fcn.005fb120
cmp esi, ebx
jne 0x5b0937
mov eax, 0x190
jmp 0x5b0975
push str.InitializeFlatSB
lea ecx, [esp + 0x1c]
call fcn.00402474
push ebx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 6
call fcn.00617b60
lea ecx, [esp + 0x18]
mov esi, eax
mov byte [esp + 0x38], 3
call fcn.00418698
xor eax, eax
cmp esi, ebx
setne al
add eax, 0x1d6
mov dword [0x8249b0], eax
mov dl, byte [esp + 0xe]
mov byte [0x829804], dl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x5b0cd0
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x70bf58
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
push edi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
call fcn.005b0b80
test al, al
jne 0x5b0d13
or eax, 0xffffffff
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x40
ret
mov eax, dword [esp + 0x50]
push eax
call fcn.005fec20
mov ecx, dword [esp + 0x60]
add esp, 4
mov dword [0x824920], ecx
push 0
lea ecx, [esp + 0x14]
call fcn.005fb340
mov dword [esp + 0x48], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x5b0d72
push eax
lea edx, [esp + 0x24]
push edx
call fcn.0061d230
add esp, 8
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x4c], 1
call fcn.005fd420
lea ecx, [esp + 0x20]
mov byte [esp + 0x48], 0
call fcn.005fc0b0
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], eax
xor ecx, ecx
add eax, 1
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005416ea
mov edi, eax
mov eax, dword [esp + 0x10]
add esp, 4
xor esi, esi
test eax, eax
jle 0x5b0dc0
mov eax, dword [esp + 0x18]
mov eax, dword [eax + esi*4]
push eax
call fcn.0054f0d1
mov dword [edi + esi*4], eax
mov eax, dword [esp + 0x10]
add esi, 1
add esp, 4
cmp esi, eax
jl 0x5b0da2
mov dword [edi + eax*4], 0
mov ecx, dword [esp + 0xc]
push edi
push ecx
lea edx, [esp + 0x38]
push 0x5b0bb0
push edx
call fcn.005b0ca0
lea eax, [esp + 0x1c]
push edi
push eax
mov byte [esp + 0x60], 2
call fcn.005fed10
lea ecx, [esp + 0x48]
push ecx
mov esi, eax
mov byte [esp + 0x64], 0
call fcn.005b0bf0
add esp, 0x1c
lea ecx, [esp + 0x10]
mov dword [esp + 0x48], 0xffffffff
call fcn.005fc0b0
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x40
ret

Function at 0x5b9840
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x70c820
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0xe8]
push 1
push eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [esi + 0xd8]
lea eax, [esp + 0x10]
push eax
call fcn.0057fd10
push 0x64
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0
call fcn.005bbd50
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x38]
mov ecx, esi
mov byte [esp + 0x30], 1
call eax
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 0
call fcn.0057d0a0
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0057d0a0
mov ecx, esi
call fcn.005b6990
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret
Function at 0x5bb840
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x713af9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov edi, dword [esp + 0x24]
mov ecx, dword [0x829274]
mov dword [edi], ecx
mov ebx, dword [esp + 0x28]
cmp ebx, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], 1
je 0x5bb8ae
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
add esi, 1
push esi
mov ecx, edi
call fcn.005fbd90
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, edi
call fcn.005fc3a0
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x5bcaf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x70cb73
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esi + 4], edi
lea ecx, [esi + 0x10]
mov dword [esp + 0x18], edi
mov dword [esi], vtable.wxDragImage.0
call fcn.005abf20
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov ecx, esi
mov byte [esp + 0x18], 1
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
call fcn.005e5840
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
mov ecx, esi
call fcn.005e5940
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8

Function at 0x5c1a30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x70d0b3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.wxListItem.0
mov edi, dword [esi + 0x30]
test edi, edi
mov dword [esp + 0x18], 1
je 0x5c1a7e
mov ecx, edi
call fcn.005c0710
push edi
call fcn.005416e5
add esp, 4
mov ecx, dword [esi + 0x1c]
mov eax, dword [ecx - 0xc]
sub ecx, 0xc
cmp eax, 0xffffffff
mov byte [esp + 0x18], 0
je 0x5c1a9d
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x5c1a9d
call fcn.005fb120
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
mov dword [esi], vtable.wxObject.0
call fcn.005fd8d0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x5c1f80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x70cf78
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov edx, dword [0x829274]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], vtable.wxListItem.0
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 2
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x20], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], edx
call fcn.005c1e60
test al, al
mov dword [esp + 0x44], 0xffffffff
lea ecx, [esp + 8]
jne 0x5c2030
call fcn.005c1a30
xor eax, eax
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x40
ret 8
mov esi, dword [esp + 0x1c]
call fcn.005c1a30
mov eax, esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x40
ret 8

Function at 0x5c2050
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x70cfc1
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
mov eax, dword [0x820ac4]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov eax, dword [0x829274]
mov dword [esp + 0x2c], eax
mov eax, 2
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], vtable.wxListItem.0
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov edx, dword [esp + 0x58]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x50], 1
mov dword [esp + 0x20], edx
call fcn.005c1e60
test al, al
jne 0x5c20ff
mov eax, dword [0x829274]
cmp eax, ebx
jne 0x5c20e9
mov eax, 0x7aff50
mov ecx, dword [0x77132c]
mov esi, dword [esp + 0x54]
push ecx
push ebx
push eax
mov ecx, esi
call fcn.005fc220
jmp 0x5c2126
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], ebx
mov esi, dword [esp + 0x54]
jne 0x5c2116
mov edx, dword [0x829274]
mov dword [esi], edx
jmp 0x5c2126
mov dword [esi], eax
mov ecx, dword [eax - 0xc]
cmp ecx, 0xffffffff
je 0x5c2126
add ecx, 1
mov dword [eax - 0xc], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x4c], bl
call fcn.005c1a30
mov eax, esi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x44
ret 8