joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c430
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586b05
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x74c968], 0x10
jl 0x40c48c
push 0x74c96c
call fcn.0041a430
mov esi, dword [0x74c964]
add esp, 4
test esi, esi
je 0x40c47e
mov eax, dword [esi]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test esi, esi
jne 0x40c4a7
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40c52d
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.rg_n31::rg_n2329.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.rg_n31::rg_n2329.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x40c504
mov ecx, edi
call fcn.00417050
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40c510
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3

Function at 0x40c940
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586c15
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x74c968], 0x10
jl 0x40c998
push 0x74c96c
call fcn.0041a430
mov ecx, dword [0x74c964]
add esp, 4
test ecx, ecx
je 0x40c98a
mov eax, dword [ecx]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test ecx, ecx
jne 0x40c9af
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40ca0a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n31::rg_n2329.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.exui::ExuiProgram.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3
Function at 0x40caa0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586c6d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x74c968], 0x10
jl 0x40cafc
push 0x74c96c
call fcn.0041a430
mov esi, dword [0x74c964]
add esp, 4
test esi, esi
je 0x40caee
mov eax, dword [esi]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test esi, esi
jne 0x40cb17
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40cba7
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.rg_n31::rg_n2329.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.exui::ExuiProgram.0
mov byte [ebp - 4], 4
mov dword [esi], vtable.exui::ExuiProgram.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x40cb7e
mov ecx, edi
call fcn.00417050
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40cb8a
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3

Function at 0x40cf60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586d75
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x74c968], 0x150
jl 0x40cfbb
push 0x74c96c
call fcn.0041a430
mov edx, dword [0x74c964]
add esp, 4
test edx, edx
je 0x40cfad
mov eax, dword [edx]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test edx, edx
jne 0x40cfd5
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40d008
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040bbe0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ButtonEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3
Function at 0x40d090
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586dbd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x74c968], 0x150
jl 0x40d0ee
push 0x74c96c
call fcn.0041a430
mov edx, dword [0x74c964]
add esp, 4
test edx, edx
je 0x40d0e0
mov eax, dword [edx]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test edx, edx
jne 0x40d108
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40d158
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040bbe0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ButtonEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::ButtonEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3

Function at 0x40d480
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586d75
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x74c968], 0x150
jl 0x40d4db
push 0x74c96c
call fcn.0041a430
mov edx, dword [0x74c964]
add esp, 4
test edx, edx
je 0x40d4cd
mov eax, dword [edx]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test edx, edx
jne 0x40d4f5
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40d528
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040bbe0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ImagebuttonEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3
Function at 0x40d5b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586dbd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x74c968], 0x150
jl 0x40d60e
push 0x74c96c
call fcn.0041a430
mov edx, dword [0x74c964]
add esp, 4
test edx, edx
je 0x40d600
mov eax, dword [edx]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test edx, edx
jne 0x40d628
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40d678
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040bbe0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ImagebuttonEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::ImagebuttonEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3

Function at 0x40d8d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586d75
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x74c968], 0x150
jl 0x40d92b
push 0x74c96c
call fcn.0041a430
mov edx, dword [0x74c964]
add esp, 4
test edx, edx
je 0x40d91d
mov eax, dword [edx]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test edx, edx
jne 0x40d945
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40d978
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040bbe0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::LabelEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3
Function at 0x40da00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586dbd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x74c968], 0x150
jl 0x40da5e
push 0x74c96c
call fcn.0041a430
mov edx, dword [0x74c964]
add esp, 4
test edx, edx
je 0x40da50
mov eax, dword [edx]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test edx, edx
jne 0x40da78
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40dac8
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040bbe0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::LabelEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::LabelEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3

Function at 0x40dd20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586d75
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x74c968], 0x150
jl 0x40dd7b
push 0x74c96c
call fcn.0041a430
mov edx, dword [0x74c964]
add esp, 4
test edx, edx
je 0x40dd6d
mov eax, dword [edx]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test edx, edx
jne 0x40dd95
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40ddc8
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040bbe0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::PictureBoxEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3
Function at 0x40de50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586dbd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x74c968], 0x150
jl 0x40deae
push 0x74c96c
call fcn.0041a430
mov edx, dword [0x74c964]
add esp, 4
test edx, edx
je 0x40dea0
mov eax, dword [edx]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test edx, edx
jne 0x40dec8
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40df18
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040bbe0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::PictureBoxEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::PictureBoxEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3

Function at 0x40e170
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58616d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x74c968], 0x200
jl 0x40e1cb
push 0x74c96c
call fcn.0041a430
mov ecx, dword [0x74c964]
add esp, 4
test ecx, ecx
je 0x40e1bd
mov eax, dword [ecx]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test ecx, ecx
jne 0x40e1e5
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40e20a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040e440
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3
Function at 0x40e2a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586f65
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x74c968], 0x200
jl 0x40e2ff
push 0x74c96c
call fcn.0041a430
mov esi, dword [0x74c964]
add esp, 4
test esi, esi
je 0x40e2f1
mov eax, dword [esi]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test esi, esi
jne 0x40e319
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40e360
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040e440
mov byte [ebp - 4], 1
mov dword [esi], vtable.exui::WindowEx.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3

Function at 0x40e910
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58616d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x74c968], 0x170
jl 0x40e96b
push 0x74c96c
call fcn.0041a430
mov ecx, dword [0x74c964]
add esp, 4
test ecx, ecx
je 0x40e95d
mov eax, dword [ecx]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test ecx, ecx
jne 0x40e985
push 0x170
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40e9aa
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040ebe0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3
Function at 0x40ea40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5871a5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x74c968], 0x170
jl 0x40ea9e
push 0x74c96c
call fcn.0041a430
mov edx, dword [0x74c964]
add esp, 4
test edx, edx
je 0x40ea90
mov eax, dword [edx]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test edx, edx
jne 0x40eab8
push 0x170
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40eafe
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040ebe0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::WindowBoxEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3

Function at 0x40f3e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58616d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x74c968], 0xa18
jl 0x40f43b
push 0x74c96c
call fcn.0041a430
mov ecx, dword [0x74c964]
add esp, 4
test ecx, ecx
je 0x40f42d
mov eax, dword [ecx]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test ecx, ecx
jne 0x40f455
push 0xa18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40f47a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040fac0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3

Function at 0x40f520
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587505
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x74c968], 0xa18
jl 0x40f57f
push 0x74c96c
call fcn.0041a430
mov esi, dword [0x74c964]
add esp, 4
test esi, esi
je 0x40f571
mov eax, dword [esi]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test esi, esi
jne 0x40f599
push 0xa18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40f5d6
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040fac0
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n::rg_n4.0
call fcn.0040f6a0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3
Function at 0x40fc50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5876db
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x74c968], 0x40
jl 0x40fcad
push 0x74c96c
call fcn.0041a430
mov edi, dword [0x74c964]
add esp, 4
test edi, edi
je 0x40fc9f
mov eax, dword [edi]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test edi, edi
jne 0x40fcc8
push 0x40
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40fe3c
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov dword [edi], vtable.CRefObject.0
mov dword [edi + 4], 1
mov byte [ebp - 4], 1
lea eax, [edi + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push eax
mov dword [edi], vtable.CVolEventObjectPointer.0
call esi
mov byte [ebp - 4], 2
lea eax, [edi + 0x24]
push eax
call esi
mov byte [ebp - 4], 3
mov dword [edi + 8], 0
mov dword [edi + 0x3c], ebx
mov dword [ebp - 4], 0xffffffff
lea esi, [ebx + 0x394]
push esi
mov dword [ebx + 0xa14], edi
mov dword [ebx + 0x10], 0x1f4
call fcn.0041a430
mov edx, dword [esi + 8]
add esp, 4
mov dword [esi + 4], 0x40f830
mov dword [esi + 0xc], 0
cmp edx, edi
jne 0x40fd4d
mov dword [esi], 1
jmp 0x40fd68
mov ecx, edi
mov dword [esi + 8], edi
call fcn.00417050
mov dword [esi], 1
test edx, edx
je 0x40fd68
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0x20]
mov edi, dword [ebx + 0xa14]
lea esi, [ebx + 0x784]
push esi
call fcn.0041a430
mov edx, dword [esi + 8]
add esp, 4
mov dword [esi + 0xc], 0
test edi, edi
jne 0x40fd93
mov dword [esi + 4], edi
mov dword [esi + 8], edi
jmp 0x40fdb0
mov dword [esi + 4], 0x40f850
cmp edx, edi
jne 0x40fda6
mov dword [esi], 1
jmp 0x40fdc1
mov ecx, edi
mov dword [esi + 8], edi
call fcn.00417050
mov dword [esi], 1
test edx, edx
je 0x40fdc1
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0x20]
mov edi, dword [ebx + 0xa14]
lea esi, [ebx + 0x8d4]
push esi
call fcn.0041a430
mov edx, dword [esi + 8]
add esp, 4
mov dword [esi + 0xc], 0
test edi, edi
jne 0x40fdec
mov dword [esi + 4], edi
mov dword [esi + 8], edi
jmp 0x40fe19
mov dword [esi + 4], 0x40f850
cmp edx, edi
jne 0x40fe0f
mov dword [esi], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
mov dword [esi + 8], edi
call fcn.00417050
mov dword [esi], 1
test edx, edx
je 0x40fe2a
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3
Function at 0x4104e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586025
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x74c968], 0x10
jl 0x410538
push 0x74c96c
call fcn.0041a430
mov ecx, dword [0x74c964]
add esp, 4
test ecx, ecx
je 0x41052a
mov eax, dword [ecx]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test ecx, ecx
jne 0x41054f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x410596
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3

Function at 0x4105a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5878ad
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x743004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x74c968], 0x10
jl 0x4105fc
push 0x74c96c
call fcn.0041a430
mov esi, dword [0x74c964]
add esp, 4
test esi, esi
je 0x4105ee
mov eax, dword [esi]
mov dword [0x74c964], eax
mov dword [0x74c96c], 1
test esi, esi
jne 0x410613
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x41068f
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolRefObject.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x410666
mov ecx, edi
call fcn.00417050
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x410672
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056e115
int3