joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e6e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447aed
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0xc
jl 0x40e73b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x40e72d
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x40e752
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40e7a9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n::rg_n2149.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2149.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x40ea40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4488e5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x150
jl 0x40ea9b
push 0x5b971c
call fcn.00429990
mov edx, dword [0x5b9714]
add esp, 4
test edx, edx
je 0x40ea8d
mov eax, dword [edx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test edx, edx
jne 0x40eab5
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40eae8
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040d930
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::PictureBoxEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x40eb70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44892d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x150
jl 0x40ebce
push 0x5b971c
call fcn.00429990
mov edx, dword [0x5b9714]
add esp, 4
test edx, edx
je 0x40ebc0
mov eax, dword [edx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test edx, edx
jne 0x40ebe8
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40ec38
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040d930
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::PictureBoxEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::PictureBoxEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x40ef20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44750d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x200
jl 0x40ef7b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x40ef6d
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x40ef95
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40efba
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040f1f0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x40f050
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448a45
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5b9718], 0x200
jl 0x40f0af
push 0x5b971c
call fcn.00429990
mov esi, dword [0x5b9714]
add esp, 4
test esi, esi
je 0x40f0a1
mov eax, dword [esi]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test esi, esi
jne 0x40f0c9
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40f110
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040f1f0
mov byte [ebp - 4], 1
mov dword [esi], vtable.exui::WindowEx.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x40f710
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448c95
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x10
jl 0x40f768
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x40f75a
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x40f77f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40f7da
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2298.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.exui::ExuiProgram.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x40f870
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448ced
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5b9718], 0x10
jl 0x40f8cc
push 0x5b971c
call fcn.00429990
mov esi, dword [0x5b9714]
add esp, 4
test esi, esi
je 0x40f8be
mov eax, dword [esi]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test esi, esi
jne 0x40f8e7
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40f977
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.rg_n::rg_n2298.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.exui::ExuiProgram.0
mov byte [ebp - 4], 4
mov dword [esi], vtable.exui::ExuiProgram.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x40f94e
mov ecx, edi
call fcn.00423730
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40f95a
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x40fcc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44750d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x170
jl 0x40fd1b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x40fd0d
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x40fd35
push 0x170
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40fd5a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040ff90
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x40fdf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448df5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x170
jl 0x40fe4e
push 0x5b971c
call fcn.00429990
mov edx, dword [0x5b9714]
add esp, 4
test edx, edx
je 0x40fe40
mov eax, dword [edx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test edx, edx
jne 0x40fe68
push 0x170
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40feae
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040ff90
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::WindowBoxEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x4106c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4488e5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x150
jl 0x41071b
push 0x5b971c
call fcn.00429990
mov edx, dword [0x5b9714]
add esp, 4
test edx, edx
je 0x41070d
mov eax, dword [edx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test edx, edx
jne 0x410735
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x410768
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040d930
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::LabelEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x4107f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44892d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x150
jl 0x41084e
push 0x5b971c
call fcn.00429990
mov edx, dword [0x5b9714]
add esp, 4
test edx, edx
je 0x410840
mov eax, dword [edx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test edx, edx
jne 0x410868
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x4108b8
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040d930
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::LabelEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::LabelEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x410ad0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4488e5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x150
jl 0x410b2b
push 0x5b971c
call fcn.00429990
mov edx, dword [0x5b9714]
add esp, 4
test edx, edx
je 0x410b1d
mov eax, dword [edx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test edx, edx
jne 0x410b45
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x410b78
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040d930
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ImagebuttonEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x410c00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44892d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x150
jl 0x410c5e
push 0x5b971c
call fcn.00429990
mov edx, dword [0x5b9714]
add esp, 4
test edx, edx
je 0x410c50
mov eax, dword [edx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test edx, edx
jne 0x410c78
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x410cc8
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040d930
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ImagebuttonEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::ImagebuttonEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x410ee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4488e5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x150
jl 0x410f3b
push 0x5b971c
call fcn.00429990
mov edx, dword [0x5b9714]
add esp, 4
test edx, edx
je 0x410f2d
mov eax, dword [edx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test edx, edx
jne 0x410f55
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x410f88
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040d930
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ChoiceboxEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x411010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44892d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x150
jl 0x41106e
push 0x5b971c
call fcn.00429990
mov edx, dword [0x5b9714]
add esp, 4
test edx, edx
je 0x411060
mov eax, dword [edx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test edx, edx
jne 0x411088
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x4110d8
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040d930
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ChoiceboxEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::ChoiceboxEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x4112f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4491f3
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x160
jl 0x41134b
push 0x5b971c
call fcn.00429990
mov edx, dword [0x5b9714]
add esp, 4
test edx, edx
je 0x41133d
mov eax, dword [edx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test edx, edx
jne 0x411365
push 0x160
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x4113c0
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040d930
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::EditboxEx.0
mov dword [edx + 0x150], 1
mov dword [edx + 0x154], 0
mov dword [edx + 0x158], 0
mov dword [edx + 0x15c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x411450
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44923b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x160
jl 0x4114ae
push 0x5b971c
call fcn.00429990
mov edx, dword [0x5b9714]
add esp, 4
test edx, edx
je 0x4114a0
mov eax, dword [edx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test edx, edx
jne 0x4114c8
push 0x160
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x411540
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040d930
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::EditboxEx.0
mov dword [edx + 0x150], 1
mov dword [edx + 0x154], 0
mov dword [edx + 0x158], 0
mov dword [edx + 0x15c], 0
mov byte [ebp - 4], 3
mov dword [edx], vtable.exui::EditboxEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x411890
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4488e5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x150
jl 0x4118eb
push 0x5b971c
call fcn.00429990
mov edx, dword [0x5b9714]
add esp, 4
test edx, edx
je 0x4118dd
mov eax, dword [edx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test edx, edx
jne 0x411905
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x411938
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040d930
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ProgressbarEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x4119c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44892d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x150
jl 0x411a1e
push 0x5b971c
call fcn.00429990
mov edx, dword [0x5b9714]
add esp, 4
test edx, edx
je 0x411a10
mov eax, dword [edx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test edx, edx
jne 0x411a38
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x411a88
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040d930
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ProgressbarEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::ProgressbarEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x411c90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44750d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x40
jl 0x411ce8
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x411cda
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x411cff
push 0x40
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x411d24
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00411f70
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x411db0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449375
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5b9718], 0x40
jl 0x411e0c
push 0x5b971c
call fcn.00429990
mov esi, dword [0x5b9714]
add esp, 4
test esi, esi
je 0x411dfe
mov eax, dword [esi]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test esi, esi
jne 0x411e23
push 0x40
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x411e70
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00411f70
mov byte [ebp - 4], 1
lea ecx, [esi + 0x28]
mov dword [esi], vtable.rg_n6822::rg_n6823.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
lea eax, [edi + 0x28]
push eax
call fcn.004212f0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x4122d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44750d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x1418
jl 0x41232b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x41231d
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x412345
push 0x1418
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41236a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.004136a0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3