joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f300
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10189455
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102007b8], 0x1d0
jl 0x1000f35f
push 0x102007bc
call fcn.1001cfa0
mov esi, dword [0x102007b4]
add esp, 4
test esi, esi
je 0x1000f351
mov eax, dword [esi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test esi, esi
jne 0x1000f379
push 0x1d0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1000f3c0
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.100110d0
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n11236::rg_n11242.0
mov dword [esi + method.rg_n30578::rg_n30579.1.virtual_0], vtable.rg_n11236::rg_n11242.1.0
call fcn.100035f0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x1000f6b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10186fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0x160
jl 0x1000f70b
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x1000f6fd
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x1000f725
push 0x160
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000f74a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.1000fa00
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x1000f7d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101894f5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102007b8], 0x160
jl 0x1000f82f
push 0x102007bc
call fcn.1001cfa0
mov esi, dword [0x102007b4]
add esp, 4
test esi, esi
je 0x1000f821
mov eax, dword [esi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test esi, esi
jne 0x1000f849
push 0x160
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1000f890
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.1000fa00
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n11236::rg_n11466.0
mov dword [esi + method.rg_n30578::rg_n30579.1.virtual_0], vtable.rg_n11236::rg_n11466.1.0
call fcn.100035f0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x1000fcb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10186fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0x160
jl 0x1000fd0b
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x1000fcfd
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x1000fd25
push 0x160
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000fd4a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.10012590
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x1000fdd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10189645
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102007b8], 0x160
jl 0x1000fe2f
push 0x102007bc
call fcn.1001cfa0
mov esi, dword [0x102007b4]
add esp, 4
test esi, esi
je 0x1000fe21
mov eax, dword [esi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test esi, esi
jne 0x1000fe49
push 0x160
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1000fe90
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.10012590
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n11236::rg_n11526.1.0
mov dword [esi + method.rg_n30578::rg_n30579.1.virtual_0], vtable.rg_n11236::rg_n11526.0
call fcn.100035f0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x10010030
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101896b5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102007b8], 0x274
jl 0x1001008f
push 0x102007bc
call fcn.1001cfa0
mov esi, dword [0x102007b4]
add esp, 4
test esi, esi
je 0x10010081
mov eax, dword [esi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test esi, esi
jne 0x100100a9
push 0x274
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x100100fa
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.10011710
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n11236::CVolWinForm.0
mov dword [esi + method.rg_n30578::rg_n30579.1.virtual_0], vtable.rg_n11236::CVolWinForm.2.0
mov dword [esi + method.rg_n30578::rg_n30579.virtual_0], vtable.rg_n11236::CVolWinForm.1.0
call fcn.100035f0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x10010320
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10186fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0x160
jl 0x1001037b
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x1001036d
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x10010395
push 0x160
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100103ba
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.10012250
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x10010440
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10189755
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102007b8], 0x160
jl 0x1001049f
push 0x102007bc
call fcn.1001cfa0
mov esi, dword [0x102007b4]
add esp, 4
test esi, esi
je 0x10010491
mov eax, dword [esi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test esi, esi
jne 0x100104b9
push 0x160
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10010500
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.10012250
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n11236::rg_n11522.1.0
mov dword [esi + method.rg_n30578::rg_n30579.1.virtual_0], vtable.rg_n11236::rg_n11522.0
call fcn.100035f0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x100106f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10186fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0x170
jl 0x1001074b
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x1001073d
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x10010765
push 0x170
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001078a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.100129b0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x10010810
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101897f5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102007b8], 0x170
jl 0x1001086f
push 0x102007bc
call fcn.1001cfa0
mov esi, dword [0x102007b4]
add esp, 4
test esi, esi
je 0x10010861
mov eax, dword [esi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test esi, esi
jne 0x10010889
push 0x170
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x100108d0
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.100129b0
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n11236::rg_n11595.1.0
mov dword [esi + method.rg_n30578::rg_n30579.1.virtual_0], vtable.rg_n11236::rg_n11595.0
call fcn.100035f0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x10010b00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10186fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0x5c
jl 0x10010b58
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x10010b4a
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x10010b6f
push 0x5c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10010b94
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.10010e90
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x10010c20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10189895
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102007b8], 0x5c
jl 0x10010c7c
push 0x102007bc
call fcn.1001cfa0
mov esi, dword [0x102007b4]
add esp, 4
test esi, esi
je 0x10010c6e
mov eax, dword [esi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test esi, esi
jne 0x10010c93
push 0x5c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10010cd0
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.10010e90
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n11236::rg_n11305.0
call fcn.10010de0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x100110d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10189b37
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.10003720
mov dword [ebp - 4], 0
mov dword [edi], vtable.rg_n11236::CVolWinContainer.0
mov dword [ebp - 4], 1
mov dword [edi + method.CSimpleException.virtual_4], vtable.IContainerEventListener.0
mov dword [edi], vtable.rg_n11236::rg_n11242.0
mov dword [edi + method.rg_n30578::rg_n30579.1.virtual_0], vtable.rg_n11236::rg_n11242.1.0
mov dword [edi + 0x15c], 1
mov dword [edi + 0x150], 0
mov dword [edi + 0x154], 0
mov dword [edi + 0x158], 0
mov byte [ebp - 4], 2
mov dword [edi + 0x16c], 1
mov dword [edi + 0x160], 0
mov dword [edi + 0x164], 0
mov dword [edi + 0x168], 0
mov byte [ebp - 4], 3
mov dword [edi + 0x17c], 1
mov dword [edi + 0x170], 0
mov dword [edi + 0x174], 0
mov dword [edi + 0x178], 0
mov byte [ebp - 4], 4
mov dword [edi + 0x18c], 1
mov dword [edi + 0x180], 0
mov dword [edi + 0x184], 0
mov dword [edi + 0x188], 0
mov byte [ebp - 4], 5
mov dword [edi + 0x19c], 1
mov dword [edi + 0x190], 0
mov dword [edi + 0x194], 0
mov dword [edi + 0x198], 0
mov byte [ebp - 4], 6
mov dword [edi + 0x1ac], 1
mov dword [edi + 0x1a0], 0
mov dword [edi + 0x1a4], 0
mov dword [edi + 0x1a8], 0
mov byte [ebp - 4], 7
mov dword [edi + 0x1bc], 1
mov dword [edi + 0x1b0], 0
mov dword [edi + 0x1b4], 0
mov dword [edi + 0x1b8], 0
mov byte [ebp - 4], 8
mov dword [edi + 0x1cc], 1
mov dword [edi + 0x1c0], 0
mov dword [edi + 0x1c4], 0
mov dword [edi + 0x1c8], 0
mov byte [ebp - 4], 9
cmp dword [0x102007b8], 0x4c
jl 0x100112c4
push 0x102007bc
call fcn.1001cfa0
mov esi, dword [0x102007b4]
add esp, 4
test esi, esi
je 0x100112b6
mov eax, dword [esi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test esi, esi
jne 0x100112db
push 0x4c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10011341
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0xa
push 0xa0
call fcn.10023f4c
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xb
test eax, eax
je 0x10011303
mov ecx, eax
call fcn.10013d20
jmp 0x10011305
xor eax, eax
mov byte [ebp - 4], 0xa
push ecx
push eax
mov ecx, esi
call fcn.10013ff0
mov esi, eax
mov byte [ebp - 4], 9
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x10011324
mov edx, dword [ecx]
call dword [edx + 0x20]
mov dword [edi + 0xc], esi
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x10011af0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10189dcb
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
cmp dword [0x102007b8], 0x4c
jl 0x10011b4f
push 0x102007bc
call fcn.1001cfa0
mov edi, dword [0x102007b4]
add esp, 4
test edi, edi
je 0x10011b41
mov eax, dword [edi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test edi, edi
jne 0x10011b6a
push 0x4c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x10011cfa
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
push 0x150
call fcn.10023f4c
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x10011cbf
mov ecx, esi
call fcn.10013d20
mov byte [ebp - 4], 2
lea ecx, [esi + 0xe0]
mov dword [esi], vtable.CVWnd_WinForm.0
call fcn.10002cf0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x120]
call fcn.10002cf0
mov byte [ebp - 4], 4
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], 0
mov dword [esi + 0xbc], 0
mov dword [esi + 0xc0], 2
mov dword [esi + 0xc4], 1
mov dword [esi + 0xc8], 0
mov dword [esi + 0xcc], 1
mov dword [esi + 0xd0], 0
mov dword [esi + 0xd4], 1
mov eax, dword [0x1020089c]
test eax, eax
jne 0x10011c6e
push 0x1c
lea eax, [ebp - 0x34]
push eax
push 0x1001bad0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x30]
push 0x64
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [esi + 0xd8], eax
mov dword [esi + 0xdc], 1
mov dword [esi + 0x10c], 0
mov dword [esi + 0x110], 0
mov dword [esi + 0x114], 0
mov dword [esi + 0x118], 0
mov dword [esi + 0x11c], 0
mov byte [ebp - 4], 1
jmp 0x10011cc1
xor esi, esi
mov byte [ebp - 4], 0
push ecx
push esi
mov ecx, edi
call fcn.10013ff0
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x10011ce6
mov edx, dword [ecx]
call dword [edx + 0x20]
mov dword [esi + 0xc], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x10012250
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10189ed5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
call fcn.1000fa00
mov dword [ebp - 4], 0
mov dword [ebx], vtable.rg_n11236::rg_n11522.1.0
mov dword [ebx + method.rg_n30578::rg_n30579.1.virtual_0], vtable.rg_n11236::rg_n11522.0
cmp dword [0x102007b8], 0x4c
jl 0x100122ce
push 0x102007bc
call fcn.1001cfa0
mov edi, dword [0x102007b4]
add esp, 4
test edi, edi
je 0x100122c0
mov eax, dword [edi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test edi, edi
jne 0x100122e9
push 0x4c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x100123d4
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 1
push 0x98
call fcn.10023f4c
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x1001238e
mov ecx, esi
call fcn.100240bf
mov byte [ebp - 4], 3
mov dword [esi], vtable.CButton.0
mov byte [ebp - 4], 4
mov dword [esi], vtable.CVWnd_Button.0
add esi, 0x8c
mov dword [ebp - 0x1c], esi
mov dword [esi], vtable.CGdiObject.0
mov dword [esi + 4], 0
mov byte [ebp - 4], 5
mov dword [esi], vtable.CBrush.0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x10]
push 0xf
mov dword [eax + 0x80], 0
mov dword [eax + 0x84], 0
mov dword [eax + 0x88], 0xff000000
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, esi
call fcn.1002d134
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
jmp 0x10012390
xor eax, eax
mov byte [ebp - 4], 1
push ecx
push eax
mov ecx, edi
call fcn.10013ff0
mov esi, eax
mov byte [ebp - 4], 0
or dword [esi + 0x34], 0x12000
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x100123b6
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [ebx + 0xc], esi
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x10012590
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10189fa1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.10003720
mov dword [ebp - 4], 0
mov dword [ebx + method.CSimpleException.virtual_4], vtable.ILabelEventListener.0
mov dword [ebx], vtable.rg_n11236::rg_n11526.1.0
mov dword [ebx + method.rg_n30578::rg_n30579.1.virtual_0], vtable.rg_n11236::rg_n11526.0
mov dword [ebx + 0x15c], 1
mov dword [ebx + 0x150], 0
mov dword [ebx + 0x154], 0
mov dword [ebx + 0x158], 0
mov byte [ebp - 4], 1
cmp dword [0x102007b8], 0x4c
jl 0x10012644
push 0x102007bc
call fcn.1001cfa0
mov edi, dword [0x102007b4]
add esp, 4
test edi, edi
je 0x10012636
mov eax, dword [edi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test edi, edi
jne 0x1001265f
push 0x4c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x10012779
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 2
push 0xb0
call fcn.10023f4c
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 3
test esi, esi
je 0x10012733
mov ecx, esi
call fcn.100240bf
mov byte [ebp - 4], 4
lea eax, [esi + 0xa0]
mov dword [esi], vtable.CVWnd_Label.0
mov dword [ebp - 0x1c], eax
mov dword [eax], vtable.CGdiObject.0
mov dword [eax + 4], 0
mov byte [ebp - 4], 5
mov dword [eax], vtable.CFont.0
mov byte [ebp - 4], 6
lea eax, [esi + 0xa8]
mov dword [ebp - 0x1c], eax
mov dword [eax], vtable.CGdiObject.0
mov dword [eax + 4], 0
mov byte [ebp - 4], 7
mov dword [eax], vtable.CBitmap.0
mov byte [ebp - 4], 8
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0xff000000
mov dword [esi + 0x88], 0xff000000
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 1
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov byte [ebp - 4], 3
jmp 0x10012735
xor esi, esi
mov byte [ebp - 4], 2
push ecx
push esi
mov ecx, edi
call fcn.10013ff0
mov esi, eax
mov byte [ebp - 4], 1
and dword [esi + 0x34], 0xff7fffff
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x1001275b
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [ebx + 0xc], esi
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3