joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412cc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58bd2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x7bf004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x7c89c8], 0x10
jl 0x412d18
push 0x7c89cc
call fcn.0041cb70
mov ecx, dword [0x7c89c4]
add esp, 4
test ecx, ecx
je 0x412d0a
mov eax, dword [ecx]
mov dword [0x7c89c4], eax
mov dword [0x7c89cc], 1
test ecx, ecx
jne 0x412d2f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x412d7f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2519.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00571c98
int3

Function at 0x412e20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58bd75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7bf004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x7c89c8], 0x10
jl 0x412e7b
push 0x7c89cc
call fcn.0041cb70
mov ecx, dword [0x7c89c4]
add esp, 4
test ecx, ecx
je 0x412e6d
mov eax, dword [ecx]
mov dword [0x7c89c4], eax
mov dword [0x7c89cc], 1
test ecx, ecx
jne 0x412e92
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x412f01
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2519.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2519.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00571c98
int3
Function at 0x413190
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58bd2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x7bf004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x7c89c8], 0x10
jl 0x4131e8
push 0x7c89cc
call fcn.0041cb70
mov ecx, dword [0x7c89c4]
add esp, 4
test ecx, ecx
je 0x4131da
mov eax, dword [ecx]
mov dword [0x7c89c4], eax
mov dword [0x7c89cc], 1
test ecx, ecx
jne 0x4131ff
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41324d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2517.0
mov byte [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00571c98
int3

Function at 0x4132e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58bd75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7bf004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x7c89c8], 0x10
jl 0x41333b
push 0x7c89cc
call fcn.0041cb70
mov ecx, dword [0x7c89c4]
add esp, 4
test ecx, ecx
je 0x41332d
mov eax, dword [ecx]
mov dword [0x7c89c4], eax
mov dword [0x7c89cc], 1
test ecx, ecx
jne 0x413352
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4133bd
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2517.0
mov byte [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2517.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov al, byte [esi + 0xc]
mov byte [ecx + 0xc], al
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00571c98
int3
Function at 0x413a60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58a0e5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x7bf004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x7c89c8], 0xc
jl 0x413ab8
push 0x7c89cc
call fcn.0041cb70
mov ecx, dword [0x7c89c4]
add esp, 4
test ecx, ecx
je 0x413aaa
mov eax, dword [ecx]
mov dword [0x7c89c4], eax
mov dword [0x7c89cc], 1
test ecx, ecx
jne 0x413acf
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x413b0f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00571c98
int3

Function at 0x413b20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58a3ad
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7bf004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x7c89c8], 0xc
jl 0x413b7b
push 0x7c89cc
call fcn.0041cb70
mov ecx, dword [0x7c89c4]
add esp, 4
test ecx, ecx
je 0x413b6d
mov eax, dword [ecx]
mov dword [0x7c89c4], eax
mov dword [0x7c89cc], 1
test ecx, ecx
jne 0x413b92
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x413be9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00571c98
int3
Function at 0x414100
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58bd2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x7bf004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x7c89c8], 0xc
jl 0x414158
push 0x7c89cc
call fcn.0041cb70
mov ecx, dword [0x7c89c4]
add esp, 4
test ecx, ecx
je 0x41414a
mov eax, dword [ecx]
mov dword [0x7c89c4], eax
mov dword [0x7c89cc], 1
test ecx, ecx
jne 0x41416f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4141bf
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x7c89f0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00571c98
int3

Function at 0x414250
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58bd75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7bf004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x7c89c8], 0xc
jl 0x4142ab
push 0x7c89cc
call fcn.0041cb70
mov ecx, dword [0x7c89c4]
add esp, 4
test ecx, ecx
je 0x41429d
mov eax, dword [ecx]
mov dword [0x7c89c4], eax
mov dword [0x7c89cc], 1
test ecx, ecx
jne 0x4142c2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x414329
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x7c89f0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00571c98
int3
Function at 0x414630
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c275
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x7bf004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x7c89c8], 0xc
jl 0x414688
push 0x7c89cc
call fcn.0041cb70
mov ecx, dword [0x7c89c4]
add esp, 4
test ecx, ecx
je 0x41467a
mov eax, dword [ecx]
mov dword [0x7c89c4], eax
mov dword [0x7c89cc], 1
test ecx, ecx
jne 0x41469f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4146f9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x7c89f0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n7771.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00571c98
int3

Function at 0x414790
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c2cd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7bf004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x7c89c8], 0xc
jl 0x4147eb
push 0x7c89cc
call fcn.0041cb70
mov ecx, dword [0x7c89c4]
add esp, 4
test ecx, ecx
je 0x4147dd
mov eax, dword [ecx]
mov dword [0x7c89c4], eax
mov dword [0x7c89cc], 1
test ecx, ecx
jne 0x414802
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x414873
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x7c89f0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n7771.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n1::rg_n7771.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00571c98
int3
Function at 0x414a50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edi
call fcn.00424755
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 8
push eax
mov dword [ebp - 0x14], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
call fcn.00424cab
add esp, 4
mov ecx, edi
call fcn.0042688d
call fcn.00427d97
mov eax, dword [eax + 0x40]
test eax, eax
je 0x414ab3
mov dword [eax + 0x28], 0
mov dword [eax + 0x38], 2
mov dword [eax + 0x2c], 1
mov dword [eax + 0x3c], 0xffffffff
call fcn.00415340
mov dword [ebp - 0x10], eax
call fcn.005719d7
mov esi, dword [eax]
call fcn.005719d1
mov ecx, dword [edi + 0x44]
mov edx, dword [eax]
mov dword [0x7c8aac], ecx
mov dword [0x7c8ab0], edx
mov dword [0x7c8ab4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 2
push 0
mov dword [0x7c8ab8], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
xor ecx, ecx
test eax, eax
setns cl
mov dword [0x7c89f4], ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push str.SHCore.dll
mov edi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x414b52
push str.GetDpiForMonitor
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x414b49
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 2
push edi
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push eax
call esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 4]
test eax, eax
jne 0x414b79
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 4]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mov eax, dword [ebp - 0x10]
movsd xmm0, qword [0x79ce38]
divsd xmm1, qword [0x79ce40]
maxsd xmm0, xmm1
movsd qword [0x7c89f8], xmm0
mov eax, dword [eax]
call eax
mov dword [0x7c89f0], eax
mov esi, dword [eax]
call fcn.00414f80
mov ecx, dword [0x7c89f0]
push eax
mov eax, dword [esi + 0x34]
call eax
test eax, eax
je 0x414c09
mov esi, dword [0x7c89f0]
mov edi, dword [esi]
call fcn.004144b0
push eax
mov eax, dword [edi + 0x34]
mov ecx, esi
call eax
mov esi, dword [ebp - 8]
test eax, eax
je 0x414be7
mov eax, dword [0x7c89f0]
mov dword [esi + 0x118], eax
call fcn.00415a40
test eax, eax
je 0x414c01
cmp dword [esi + 0x20], 0
je 0x414c01
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x7c89f0]
mov eax, dword [ecx]
call dword [eax + 0x30]
push 0xffffffffffffffff
call fcn.00571c98
int3
Function at 0x414ec0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58a0e5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x7bf004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x7c89c8], 0xc
jl 0x414f18
push 0x7c89cc
call fcn.0041cb70
mov ecx, dword [0x7c89c4]
add esp, 4
test ecx, ecx
je 0x414f0a
mov eax, dword [ecx]
mov dword [0x7c89c4], eax
mov dword [0x7c89cc], 1
test ecx, ecx
jne 0x414f2f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x414f75
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x7c89f0], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00571c98
int3
Function at 0x4150b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c4d7
mov eax, dword fs:[0]
push eax
mov eax, 0x5020
call fcn.0056cd40
mov eax, dword [0x7bf004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x501c], esi
mov dword [ebp - 0x5028], esi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x5014], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x502c], esi
mov dword [ebp - 0x5024], edx
mov dword [ebp - 0x5020], eax
mov dword [ebp - 0x5018], 0
call fcn.004097a0
mov dword [ebp - 4], 0
xor eax, eax
mov edi, dword [ebx + 0xc]
mov dword [ebp - 0x5018], 1
test edi, edi
je 0x41514b
cmp word [edi], ax
sete al
jmp 0x415152
cmp dword [ebx + 0x24], 2
setle al
test eax, eax
jne 0x415287
mov eax, dword [edx + 0xc]
xor ecx, ecx
test eax, eax
je 0x41516b
cmp word [eax], cx
sete cl
jmp 0x415172
cmp dword [edx + 0x24], 2
setle cl
test ecx, ecx
jne 0x415287
mov ecx, dword [ebp - 0x5014]
xor edx, edx
mov ecx, dword [ecx + 0xc]
test ecx, ecx
je 0x415191
cmp word [ecx], dx
sete dl
jmp 0x4151a4
mov esi, dword [ebp - 0x5014]
cmp dword [esi + 0x24], 2
mov esi, dword [ebp - 0x501c]
setle dl
test edx, edx
jne 0x415287
mov word [ebp - 0x5010], dx
test edi, edi
jne 0x4151c4
mov edi, 0x5d007c
cmp dword [ebx + 0x24], edx
je 0x4151c4
mov edi, dword [ebx + 0x1c]
mov ebx, dword [ebp - 0x5020]
mov edx, dword [ebx + 0xc]
test edx, edx
jne 0x4151de
cmp dword [ebx + 0x24], edx
mov edx, 0x5d007c
je 0x4151de
mov edx, dword [ebx + 0x1c]
test ecx, ecx
jne 0x4151f8
mov ecx, dword [ebp - 0x5014]
cmp dword [ecx + 0x24], 0
jne 0x4151f5
mov ecx, 0x5d007c
jmp 0x4151f8
mov ecx, dword [ecx + 0x1c]
test eax, eax
jne 0x415212
mov eax, dword [ebp - 0x5024]
cmp dword [eax + 0x24], 0
jne 0x41520f
mov eax, 0x5d007c
jmp 0x415212
mov eax, dword [eax + 0x1c]
push edi
push 0x2800
lea edi, [ebp - 0x5010]
push edi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x415237
cmp dword [esi + 0x24], eax
je 0x415241
mov eax, dword [esi + 0x1c]
lea ecx, [ebp - 0x5010]
cmp ecx, eax
je 0x415287
mov dword [esi + 0xc], 0
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x415259
mov eax, dword [esi + 0x10]
push ecx
lea ecx, [esi + 0x10]
call dword [eax + 0xc]
cmp word [ebp - 0x5010], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
je 0x415287
lea eax, [ebp - 0x5010]
push eax
lea ecx, [esi + 0x10]
call fcn.0041c480
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056c4d0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4154f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589ffd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x7bf004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x7c89c8], 0x1240
jl 0x41554b
push 0x7c89cc
call fcn.0041cb70
mov ecx, dword [0x7c89c4]
add esp, 4
test ecx, ecx
je 0x41553d
mov eax, dword [ecx]
mov dword [0x7c89c4], eax
mov dword [0x7c89cc], 1
test ecx, ecx
jne 0x415565
push 0x1240
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41558a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.004158b0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00571c98
int3

Function at 0x415690
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c595
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7bf004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x7c89c8], 0x1240
jl 0x4156f2
push 0x7c89cc
call fcn.0041cb70
mov esi, dword [0x7c89c4]
add esp, 4
test esi, esi
je 0x4156e4
mov eax, dword [esi]
mov dword [0x7c89c4], eax
mov dword [0x7c89cc], 1
test esi, esi
jne 0x415710
push 0x1240
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x415795
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.004158b0
mov byte [ebp - 4], 1
lea ebx, [edi + 0xc]
mov dword [esi], vtable.rg_n::rg_n54792.0
lea ecx, [esi + 0xc]
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x10], ebx
call dword [eax + 0x44]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 8]
mov dword [esi + 0x14], eax
mov ebx, dword [ebx + 0xc]
test ebx, ebx
je 0x415760
mov ecx, ebx
call fcn.00417ad0
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x41576c
mov eax, dword [ecx]
call dword [eax + 0x20]
push dword [ebp - 0x10]
lea ecx, [esi + 0xc]
mov dword [esi + 0x18], ebx
call fcn.0040eab0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00571c98
int3
Function at 0x417ca0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589ffd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x7bf004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x7c89c8], 0x28
jl 0x417cf8
push 0x7c89cc
call fcn.0041cb70
mov ecx, dword [0x7c89c4]
add esp, 4
test ecx, ecx
je 0x417cea
mov eax, dword [ecx]
mov dword [0x7c89c4], eax
mov dword [0x7c89cc], 1
test ecx, ecx
jne 0x417d0f
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x417d35
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push ecx
call fcn.00418040
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00571c98
int3

Function at 0x417e10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58cd25
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x7bf004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x7c89c8], 0x28
jl 0x417e6c
push 0x7c89cc
call fcn.0041cb70
mov esi, dword [0x7c89c4]
add esp, 4
test esi, esi
je 0x417e5e
mov eax, dword [esi]
mov dword [0x7c89c4], eax
mov dword [0x7c89cc], 1
test esi, esi
jne 0x417e83
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x417ec1
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push ecx
mov ecx, esi
call fcn.00418040
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.CVolObjectArray.0
call fcn.00417fb0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00571c98
int3

Function at 0x418360
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58a3ad
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7bf004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x7c89c8], 0xc
jl 0x4183bb
push 0x7c89cc
call fcn.0041cb70
mov ecx, dword [0x7c89c4]
add esp, 4
test ecx, ecx
je 0x4183ad
mov eax, dword [ecx]
mov dword [0x7c89c4], eax
mov dword [0x7c89cc], 1
test ecx, ecx
jne 0x4183d2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41842f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x7c89f0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolUserApp.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00571c98
int3