joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e9d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4607b5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5d9e08], 0x10
jl 0x40ea2c
push 0x5d9e0c
call fcn.0043c770
mov esi, dword [0x5d9e04]
add esp, 4
test esi, esi
je 0x40ea1e
mov eax, dword [esi]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test esi, esi
jne 0x40ea47
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40eacd
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.rg_n::rg_n2298.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.rg_n::rg_n2298.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x40eaa4
mov ecx, edi
call fcn.0042d7a0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40eab0
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x40ee10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f2bd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x170
jl 0x40ee6b
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x40ee5d
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x40ee85
push 0x170
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40eeaa
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040f0e0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x40ef40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4608b5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5d9e08], 0x170
jl 0x40ef9e
push 0x5d9e0c
call fcn.0043c770
mov edx, dword [0x5d9e04]
add esp, 4
test edx, edx
je 0x40ef90
mov eax, dword [edx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test edx, edx
jne 0x40efb8
push 0x170
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40effe
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040f0e0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::WindowBoxEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x40f7e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f2bd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x134
jl 0x40f83b
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x40f82d
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x40f855
push 0x134
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40f87a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040fac0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x40f910
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460c15
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5d9e08], 0x134
jl 0x40f96e
push 0x5d9e0c
call fcn.0043c770
mov edx, dword [0x5d9e04]
add esp, 4
test edx, edx
je 0x40f960
mov eax, dword [edx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test edx, edx
jne 0x40f988
push 0x134
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40f9d4
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040fac0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::MenuEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x4100e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460f00
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x20
jl 0x410138
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x41012a
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x41014f
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4101b2
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.exui::TimerEx.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 1
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x410240
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460f48
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5d9e08], 0x20
jl 0x41029b
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x41028d
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x4102b6
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x410336
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.exui::TimerEx.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 1
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.exui::TimerEx.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x410650
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f445
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0xc
jl 0x4106a8
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x41069a
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x4106bf
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4106ff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n7132::rg_n7133.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x410790
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46004d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5d9e08], 0xc
jl 0x4107eb
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x4107dd
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x410802
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x410859
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n7132::rg_n7133.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n7132::rg_n7133.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x410a60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f445
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0xc
jl 0x410ab8
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x410aaa
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x410acf
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x410b0f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n7072::rg_n7101.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x410ba0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46004d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5d9e08], 0xc
jl 0x410bfb
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x410bed
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x410c12
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x410c69
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n7072::rg_n7101.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n7072::rg_n7101.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x410e70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4610b0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x1c
jl 0x410ec8
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x410eba
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x410edf
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x410f45
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n16900::rg_n17249.0
mov dword [ecx + 0xc], 1
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov byte [ebp - 4], 2
mov dword [0x5d9dd8], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x410fd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4610f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5d9e08], 0x1c
jl 0x41102b
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x41101d
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x411042
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4110bf
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n16900::rg_n17249.0
mov dword [ecx + 0xc], 1
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov byte [ebp - 4], 2
mov dword [0x5d9dd8], ecx
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n16900::rg_n17249.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x411370
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f2bd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x210
jl 0x4113cb
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x4113bd
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x4113e5
push 0x210
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41140a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00411640
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x4114a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4611f5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5d9e08], 0x210
jl 0x4114ff
push 0x5d9e0c
call fcn.0043c770
mov esi, dword [0x5d9e04]
add esp, 4
test esi, esi
je 0x4114f1
mov eax, dword [esi]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test esi, esi
jne 0x411519
push 0x210
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x411560
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00411640
mov byte [ebp - 4], 1
mov dword [esi], vtable.exui::SelectthefolderEx.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x411b30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461455
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x150
jl 0x411b8b
push 0x5d9e0c
call fcn.0043c770
mov edx, dword [0x5d9e04]
add esp, 4
test edx, edx
je 0x411b7d
mov eax, dword [edx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test edx, edx
jne 0x411ba5
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x411bd8
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040dd30
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ButtonEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x411c60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46149d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5d9e08], 0x150
jl 0x411cbe
push 0x5d9e0c
call fcn.0043c770
mov edx, dword [0x5d9e04]
add esp, 4
test edx, edx
je 0x411cb0
mov eax, dword [edx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test edx, edx
jne 0x411cd8
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x411d28
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040dd30
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ButtonEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::ButtonEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x412010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461455
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x150
jl 0x41206b
push 0x5d9e0c
call fcn.0043c770
mov edx, dword [0x5d9e04]
add esp, 4
test edx, edx
je 0x41205d
mov eax, dword [edx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test edx, edx
jne 0x412085
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x4120b8
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040dd30
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ImagebuttonEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x412140
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46149d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5d9e08], 0x150
jl 0x41219e
push 0x5d9e0c
call fcn.0043c770
mov edx, dword [0x5d9e04]
add esp, 4
test edx, edx
je 0x412190
mov eax, dword [edx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test edx, edx
jne 0x4121b8
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x412208
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040dd30
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ImagebuttonEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::ImagebuttonEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x412420
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461455
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x150
jl 0x41247b
push 0x5d9e0c
call fcn.0043c770
mov edx, dword [0x5d9e04]
add esp, 4
test edx, edx
je 0x41246d
mov eax, dword [edx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test edx, edx
jne 0x412495
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x4124c8
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040dd30
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ChoiceboxEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3