joyce8/EMBER2024-capa huggingface dataset:
Function at 0x537c00
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x60f3d8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
push edi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
call fcn.00537a70
test al, al
jne 0x537c43
or eax, 0xffffffff
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x40
ret
mov eax, dword [esp + 0x50]
push eax
call fcn.00527130
mov ecx, dword [esp + 0x60]
add esp, 4
mov dword [0x6daea8], ecx
push 0
lea ecx, [esp + 0x14]
call fcn.0050cf10
mov dword [esp + 0x48], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x537ca2
push eax
lea edx, [esp + 0x24]
push edx
call fcn.00510280
add esp, 8
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x4c], 1
call fcn.0050ef60
lea ecx, [esp + 0x20]
mov byte [esp + 0x48], 0
call fcn.0050dbc0
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], eax
xor ecx, ecx
inc eax
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005b1f5c
mov edi, eax
mov eax, dword [esp + 0x10]
add esp, 4
xor esi, esi
test eax, eax
jle 0x537cec
mov eax, dword [esp + 0x18]
mov eax, dword [eax + esi*4]
push eax
call fcn.005bb0bc
mov dword [edi + esi*4], eax
mov eax, dword [esp + 0x10]
inc esi
add esp, 4
cmp esi, eax
jl 0x537cd0
mov dword [edi + eax*4], 0
mov ecx, dword [esp + 0xc]
push edi
push ecx
lea edx, [esp + 0x38]
push 0x537af0
push edx
call fcn.00537bd0
lea eax, [esp + 0x1c]
push edi
push eax
mov byte [esp + 0x60], 2
call fcn.00527220
lea ecx, [esp + 0x48]
push ecx
mov esi, eax
mov byte [esp + 0x64], 0
call fcn.00537b20
add esp, 0x1c
lea ecx, [esp + 0x10]
mov dword [esp + 0x48], 0xffffffff
call fcn.0050dbc0
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x40
ret
Function at 0x538690
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x60f4a0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [0x6daf38]
cmp eax, 0xffffffff
jne 0x53885e
mov al, byte [0x6d9f94]
xor ebx, ebx
mov dword [0x6daf38], ebx
mov byte [esp + 0xe], al
mov byte [0x6d9f94], bl
mov byte [esp + 0xf], al
mov eax, dword [0x63bb88]
push eax
push ebx
push str.comctl32.dll
lea ecx, [esp + 0x20]
mov dword [esp + 0x44], ebx
call fcn.0050dd90
push 0x68
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 1
mov dword [esp + 0x18], ebx
call fcn.0052b520
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov byte [esp + 0x38], 3
cmp eax, 0xffffffff
je 0x538730
dec eax
mov dword [ecx], eax
cmp eax, ebx
jne 0x538730
call fcn.0050ccc0
cmp dword [esp + 0x10], ebx
jne 0x538743
mov dword [0x6daf38], ebx
xor eax, eax
jmp 0x538854
mov eax, dword [0x63bb88]
push eax
push ebx
push str.DllGetVersion
lea ecx, [esp + 0x24]
call fcn.0050dd90
push ebx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 4
call fcn.0052b4c0
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff4
mov esi, eax
mov eax, dword [ecx]
mov byte [esp + 0x38], 3
cmp eax, 0xffffffff
je 0x53878d
dec eax
mov dword [ecx], eax
cmp eax, ebx
jne 0x53878d
call fcn.0050ccc0
cmp esi, ebx
je 0x5387b6
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0x14
call esi
cmp eax, ebx
jl 0x5387b6
mov eax, dword [esp + 0x20]
imul eax, eax, 0x64
add eax, dword [esp + 0x24]
mov dword [0x6daf38], eax
jmp 0x5387bb
mov eax, dword [0x6daf38]
cmp eax, ebx
jne 0x538854
push str.InitCommonControlsEx
lea ecx, [esp + 0x1c]
call fcn.004034c3
push ebx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 5
call fcn.0052b4c0
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff4
mov esi, eax
mov eax, dword [ecx]
mov byte [esp + 0x38], 3
cmp eax, 0xffffffff
je 0x538806
dec eax
mov dword [ecx], eax
cmp eax, ebx
jne 0x538806
call fcn.0050ccc0
cmp esi, ebx
jne 0x538811
mov eax, 0x190
jmp 0x53884f
push str.InitializeFlatSB
lea ecx, [esp + 0x1c]
call fcn.004034c3
push ebx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 6
call fcn.0052b4c0
lea ecx, [esp + 0x18]
mov esi, eax
mov byte [esp + 0x38], 3
call fcn.00401017
xor eax, eax
cmp esi, ebx
setne al
add eax, 0x1d6
mov dword [0x6daf38], eax
mov dl, byte [esp + 0xe]
mov byte [0x6d9f94], dl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x5391f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x60f6d5
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x1c4]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
mov esi, dword [esp + 0x1d4]
mov eax, dword [0x6d983c]
mov dword [esi], eax
mov ecx, dword [esp + 0x1e8]
mov edx, dword [esp + 0x1ec]
xor eax, eax
cmp byte [esp + 0x1f0], al
mov dword [esp + 0x10], ecx
setne al
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1dc]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x1e4]
mov dword [esp + 0x1d0], 0
add eax, 0x14
push eax
mov eax, dword [esp + 0x1e4]
push edx
mov edx, dword [esp + 0x1f0]
push eax
push ecx
push edx
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], 1
call fcn.00572180
lea ecx, [esp + 0x18]
mov dword [esp + 0x1cc], 1
call fcn.0056afb0
cmp eax, 0x13ec
jne 0x5392f3
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
call fcn.005a44d0
push eax
mov ecx, esi
mov byte [esp + 0x1d0], 2
call fcn.0050d6d0
mov ecx, dword [esp + 8]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov byte [esp + 0x1cc], 1
cmp eax, 0xffffffff
je 0x5392f3
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x5392f3
call fcn.0050ccc0
lea ecx, [esp + 0x18]
mov byte [esp + 0x1cc], 0
call fcn.00538cb0
mov eax, esi
mov ecx, dword [esp + 0x1c4]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c8
ret
Function at 0x53cd70
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x60fb78
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
push 0x100
call fcn.00529800
push 4
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
call fcn.005b5236
add esp, 0xc
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.0053cc40
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push ecx
push edx
push eax
lea ecx, [esp + 0x24]
call fcn.0053a5b0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push 0x595650
push ecx
push edx
mov bl, al
mov dword [esp + 0x30], 0xffffffff
call fcn.00529830
mov eax, dword [esp + 0x18]
push eax
mov dword [esp + 0x24], 0
call fcn.005b3848
add esp, 0x10
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret 0x18
Function at 0x5427d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x60ffa8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.wxDropFilesEvent.0
mov eax, dword [esi + 0x30]
mov dword [esp + 0x18], 0
test eax, eax
je 0x54282b
mov ecx, dword [eax - 4]
lea edi, [eax - 4]
push fcn.00401017
push ecx
push 4
push eax
call fcn.005b28d8
push edi
call fcn.005b293b
add esp, 4
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
mov dword [esi], vtable.wxObject.0
call fcn.0050f870
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x547630
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x61017e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], vtable.wxMenuItemBase.0
mov ecx, dword [0x6d983c]
mov dword [esp + 0x14], eax
mov dword [esi + 0x14], ecx
mov edx, dword [0x6d983c]
mov dword [esi + 0x18], edx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x30]
mov byte [esi + 0x20], al
mov eax, dword [esp + 0x20]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x2c]
mov byte [esp + 0x14], 2
mov dword [esi + 0x10], edx
mov byte [esi + 0x21], 1
mov dword [esi + 8], eax
mov dword [esi + 0x1c], ecx
cmp eax, 0xffffffff
jne 0x5476ae
call fcn.00538a60
mov dword [esi + 8], eax
cmp dword [esi + 8], 0xfffffffe
jne 0x5476bb
mov dword [esi + 0x1c], 0xffffffff
mov edx, dword [esp + 0x24]
push edx
mov ecx, esi
call fcn.00546580
mov eax, dword [esp + 0x28]
push eax
mov ecx, esi
call fcn.00546620
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x18

Function at 0x548a70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x612548
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push ecx
push edx
push eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push 0x6dbc74
push eax
mov ecx, esi
mov dword [esi], vtable.wxFont.0
call fcn.0054b020
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x1c
Function at 0x54bf00
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x54bf0d
mov byte [edi], 1
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [eax*8 + 0x64b374], esi
je 0x54bf44
inc eax
cmp eax, 0x3c
jb 0x54bf13
cmp esi, 0x177
jg 0x54bf57
je case.0x54bf3d.313
lea eax, [esi - 0x7f]
cmp eax, 0xf0
ja case.0x54bf62.383
movzx eax, byte [eax + 0x54c000]
jmp dword [eax*4 + 0x54bfd4]
mov ax, word [eax*8 + 0x64b370]
pop edi
pop esi
ret
pop edi
mov eax, 0x24
pop esi
ret
lea eax, [esi - 0x178]
cmp eax, 9
ja case.0x54bf62.383
jmp dword [eax*4 + 0x54c0f4]
pop edi
mov eax, 0x21
pop esi
ret
pop edi
mov eax, 0x22
pop esi
ret
pop edi
mov eax, 0x23
pop esi
ret
pop edi
mov eax, 0x25
pop esi
ret
pop edi
mov eax, 0x26
pop esi
ret
pop edi
mov eax, 0x27
pop esi
ret
pop edi
mov eax, 0x28
pop esi
ret
pop edi
mov eax, 0x2d
pop esi
ret
pop edi
mov eax, 0x2e
pop esi
ret
push esi
call dword [sym.imp.USER32.dll_VkKeyScanW]
cmp al, 0xff
je 0x54bfc6
movzx cx, al
pop edi
movzx eax, cx
pop esi
ret
test edi, edi
je 0x54bfcd
mov byte [edi], 0
pop edi
movzx eax, si
pop esi
ret

Function at 0x54c180
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, eax
movzx eax, si
sub eax, 1
je 0x54c152
sub eax, 1
jne 0x54c163
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x54c163
mov esi, 1
movzx eax, si
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and eax, esi
pop esi
ret
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x54c163
mov esi, 2
movzx eax, si
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
pop esi
shr eax, 0xf
and eax, 1
ret
push esi
mov esi, dword [esp + 8]
push 0
push esi
call fcn.0054bf00
add esp, 8
movzx eax, ax
cmp esi, 0x16c
je 0x54c1b1
cmp esi, 0x137
je 0x54c1b1
cmp esi, 0x16d
je 0x54c1b1
pop esi
jmp 0x54c120
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
setne cl
mov al, cl
pop esi
ret
Function at 0x54e000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60ff18
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
cmp byte [esp + 0x44], bl
jne 0x54e045
xor al, al
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x34
ret 8
mov ecx, dword [0x6f0d00]
mov eax, dword [ecx]
mov edx, dword [eax + 0xa8]
call edx
cmp esi, eax
jne 0x54e02f
mov eax, dword [0x6f3b24]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.00513920
mov dword [esp + 0xc], vtable.wxCloseEvent.0
mov byte [esp + 0x31], bl
mov edx, dword [esp + 0x48]
mov ecx, dword [0x6f0d00]
shr edx, 0x1f
and dl, 1
mov byte [esp + 0x30], dl
mov dword [esp + 0x14], ecx
mov byte [esp + 0x32], bl
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x40], ebx
call eax
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0xc], vtable.wxObject.0
call fcn.0050f870
mov al, bl
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x34
ret 8

Function at 0x54e110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60ff18
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x44]
cmp eax, 1
je 0x54e149
cmp eax, 2
je 0x54e149
xor bl, bl
jmp 0x54e14b
mov bl, 1
mov ecx, dword [0x6f3b38]
mov eax, dword [esi + 0x28]
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00513920
mov dword [esp + 0xc], vtable.wxActivateEvent.0
mov byte [esp + 0x30], bl
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x14], esi
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x40], 0
call edx
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0xc], vtable.wxObject.0
call fcn.0050f870
mov al, bl
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x34
ret 0xc
Function at 0x54e1c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x610aa0
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov esi, ecx
test byte [esi + 0xc8], 8
jne 0x54e24f
push esi
lea ecx, [esp + 0x38]
call fcn.00543b40
mov ecx, dword [esi + 0x5c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x78], 0
call eax
cmp dword [esi + 0xa0], 0
je 0x54e227
mov ecx, dword [esi + 0xa0]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
push 0x6ddb50
mov ecx, esi
call fcn.0050f8f0
movzx ecx, al
neg ecx
sbb ecx, ecx
test esi, ecx
je 0x54e265
lea ecx, [esp + 0x34]
mov dword [esp + 0x74], 0xffffffff
call fcn.0040b77d
xor al, al
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x6c
ret 4
mov edx, dword [0x6f3a70]
mov eax, dword [esi + 0x28]
push edx
push eax
lea ecx, [esp + 0x14]
call fcn.00513920
mov dword [esp + 0xc], vtable.wxFocusEvent.0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x7c]
push eax
mov byte [esp + 0x78], 1
mov dword [esp + 0x18], esi
call fcn.0054ddc0
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x34], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
add esp, 4
lea eax, [esp + 0xc]
push eax
call edx
lea ecx, [esp + 0xc]
mov bl, al
mov byte [esp + 0x74], 0
mov dword [esp + 0xc], vtable.wxObject.0
call fcn.0050f870
lea ecx, [esp + 0x34]
mov dword [esp + 0x74], 0xffffffff
call fcn.0040b77d
mov al, bl
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x6c
ret 4

Function at 0x54e450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60ff18
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [0x6f3b44]
mov eax, dword [esi + 0x28]
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00513920
mov dl, byte [esp + 0x44]
mov dword [esp + 0xc], vtable.wxShowEvent.0
mov byte [esp + 0x30], dl
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x14], esi
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x40], 0
call eax
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0xc], vtable.wxObject.0
call fcn.0050f870
mov al, bl
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x34
ret 8
Function at 0x54e4f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x610b88
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [0x6f3bac]
mov eax, dword [esi + 0x28]
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00513920
mov dword [esp + 0xc], vtable.wxInitDialogEvent.0
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x14], esi
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x3c], 0
call edx
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0xc], vtable.wxObject.0
call fcn.0050f870
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret 4

Function at 0x54e870
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x610b88
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x6f3b7c]
push eax
push 0
lea ecx, [esp + 0x14]
call fcn.00513920
mov dword [esp + 0xc], vtable.wxDisplayChangedEvent.0
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x14], esi
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x3c], 0
call edx
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0xc], vtable.wxObject.0
call fcn.0050f870
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret

Function at 0x54ede0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6125d8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
test byte [edi + 0xc8], 0x10
je 0x54ee9b
mov eax, dword [esp + 0x34]
push eax
call fcn.0054ddc0
mov esi, eax
add esp, 4
cmp esi, edi
je 0x54ee49
test byte [edi + 0xc8], 0x80
jne 0x54ee49
test esi, esi
je 0x54ee9b
mov edx, dword [esi]
mov eax, dword [edx + 0x154]
mov ecx, esi
call eax
test al, al
je 0x54ee9b
cmp dword [esi + 0x2c], edi
jne 0x54ee9b
lea ecx, [esp + 0xc]
push ecx
mov ecx, edi
call fcn.005587d0
mov ecx, dword [0x6f3c84]
push 0x64
push eax
mov dword [esp + 0x30], 0
call fcn.00549220
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.005429d0
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 8
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 8
Function at 0x54efd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60ff18
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [0x6f3b48]
mov eax, dword [esi + 0x28]
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00513920
mov dword [esp + 0xc], vtable.wxIconizeEvent.0
mov byte [esp + 0x30], 1
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x14], esi
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x40], 0
call edx
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0xc], vtable.wxObject.0
call fcn.0050f870
mov al, bl
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x34
ret

Function at 0x54f070
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x610b88
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [0x6f3b4c]
mov eax, dword [esi + 0x28]
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00513920
mov dword [esp + 0xc], vtable.wxMaximizeEvent.0
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x14], esi
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x3c], 0
call edx
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0xc], vtable.wxObject.0
call fcn.0050f870
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret

Function at 0x54f770
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov edx, dword [eax + 0x60]
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
call edx
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
mov eax, ebx
sub eax, dword [esp + 0x10]
mov ecx, ebp
sub ecx, dword [esp + 0x14]
mov dword [esi + 0x24], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x28], ecx
mov ecx, eax
mov edx, eax
shr ecx, 3
shr edx, 2
and cl, 1
and dl, 1
mov byte [esi + 0x2f], cl
mov ecx, eax
mov byte [esi + 0x30], dl
mov dl, al
shr ecx, 4
shr eax, 1
and dl, 1
and cl, 1
and al, 1
push 0x12
mov byte [esi + 0x2c], dl
mov byte [esi + 0x2d], cl
mov byte [esi + 0x2e], al
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setl dl
mov byte [esi + 0x31], dl
call dword [sym.imp.USER32.dll_GetMessageTime]
mov dword [esi + 0x10], eax
mov dword [esi + 8], edi
mov eax, dword [edi + 0x28]
mov dword [esi + 0x14], eax
mov edx, dword [edi]
mov edx, dword [edx + 0x1fc]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebp
call edx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
pop edi
mov dword [0x6f3cc8], eax
mov dword [0x6f3ccc], ecx
mov eax, dword [esi + 0xc]
pop esi
pop ebp
mov dword [0x6f3cd0], eax
pop ebx
add esp, 8
ret 0x10
Function at 0x54fa80
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x610c78
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
and byte [esi + 0x11c], 0xfe
push 0x10
xor edi, edi
call ebx
test ax, ax
jge 0x54fac5
mov edi, 4
push 0x11
call ebx
test ax, ax
jge 0x54fad1
or edi, 8
push 1
call ebx
mov ecx, 0x8000
test cx, ax
je 0x54fae2
or edi, 1
push 4
call ebx
mov edx, 0x8000
test dx, ax
je 0x54faf3
or edi, 0x10
push 2
call ebx
mov ecx, 0x8000
test cx, ax
je 0x54fb04
or edi, 2
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x114]
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [0x6f3a60]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
sub dword [esp + 0x10], edx
sub dword [esp + 0x14], eax
push ecx
lea ecx, [esp + 0x2c]
call fcn.00543940
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edi
push edx
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
mov dword [esp + 0x80], 0
call fcn.0054f770
mov ecx, dword [esi + 0x5c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
lea eax, [esp + 0x28]
push eax
call edx
lea ecx, [esp + 0x28]
mov dword [esp + 0x70], 0xffffffff
mov dword [esp + 0x28], vtable.wxObject.0
call fcn.0050f870
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x64
ret