joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ca7f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001cb1c
push ebx
push esi
call fcn.1001ca48
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001c9dc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001cac9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001cb1b
push edi
push eax
call fcn.1001da3a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001cae9
call fcn.1001b524
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001cb1a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001c9dc
add esp, 0x20
test eax, eax
jne 0x1001cb08
push edi
call fcn.1001b524
jmp 0x1001cb10
push ebx
call fcn.1001b524
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001cd89
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024cb8
push 0x10024cb0
push str.FlsAlloc
push 0x1f
call fcn.1001cca5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001cdbd
push dword [ebp + 8]
mov ecx, esi
call dword [0x10023140]
call esi
jmp 0x1001cdc3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001ce07
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024cc8
push 0x10024cc0
push str.FlsGetValue
push 0x21
call fcn.1001cca5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001ce3e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10023140]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001ce46
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024cd0
push 0x10024cc8
push str.FlsSetValue
push 0x22
call fcn.1001cca5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001ce80
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10023140]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10022500
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002252d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002252d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40d61f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push eax
add esp, 4
and edi, 0x1827c
sub edi, 0x36eb
jmp 0x40d5d0
pop edi
push edi
push edx
add esp, 4
xor edi, 0x12e0d
pop edi
push eax
jmp 0x40d5e7
pop eax
lea ecx, [ebp - 0x1940]
mov dword [ebp - 0xdd0], ecx
mov edx, dword [ebp - 0x568]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xdcc], eax
xor ecx, ecx
mov word [ebp - 0x244], cx
xor edx, edx
mov word [ebp - 0x48], dx
push edx
call fcn.0040d61f
add byte [ebp + 0x3d], al
aaa
cmp bh, byte [edi + esi]
add esp, 4
or edx, 0x13b89
or edx, 0x130b4
pop edx
push ecx
push ecx
add esp, 4
sub ecx, 0x1767e
jmp 0x40d643
pop ecx
mov eax, dword [ebp - 0xdcc]
mov cx, word [eax]
mov word [ebp - 0x1152], cx
mov edx, dword [ebp - 0xdcc]
add edx, 2
mov dword [ebp - 0xdcc], edx
mov ax, word [ebp - 0x1152]
mov word [ebp - 0x244], ax
mov ecx, dword [ebp - 0xdd0]
mov dx, word [ecx]
mov word [ebp - 0x1154], dx
mov eax, dword [ebp - 0xdd0]
add eax, 2
mov dword [ebp - 0xdd0], eax
mov cx, word [ebp - 0x1154]
mov word [ebp - 0x48], cx
push esi
jmp 0x40d6a4
or esi, 0x498c
pop esi
push ecx
push ebx
add esp, 4
sub ecx, 0x14a87
sub ecx, 0x128b3
jmp 0x40d6c4
pop ecx
push ecx
add ecx, 0x5bd5
pop ecx
movzx edx, word [ebp - 0x48]
test edx, edx
jne 0x40d6ea
movzx eax, word [ebp - 0x244]
movzx ecx, word [ebp - 0x48]
sub eax, ecx
mov dword [ebp - 0x17e4], eax
jmp 0x40d744
movzx edx, word [ebp - 0x244]
movzx eax, word [ebp - 0x48]
cmp edx, eax
je 0x40d612
movzx ecx, word [ebp - 0x244]
xor ecx, 0x20
movzx edx, word [ebp - 0x48]
cmp ecx, edx
je 0x40d612
movzx eax, word [ebp - 0x244]
movzx ecx, word [ebp - 0x48]
cmp eax, ecx
jge 0x40d72e
mov dword [ebp - 0x17e0], 0xffffffff
jmp 0x40d738
mov dword [ebp - 0x17e0], 1
mov edx, dword [ebp - 0x17e0]
mov dword [ebp - 0x17e4], edx
cmp dword [ebp - 0x17e4], 0
jne 0x40d78d
push esi
xor esi, 0x38c3
jmp 0x40d75a
sub esi, 0x10f2a
pop esi
push edx
push eax
add esp, 4
and edx, 0x344b
pop edx
push ebx
push eax
add esp, 4
sub ebx, 0x1246c
or ebx, 0x3c30
pop ebx
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x7f4], eax
jmp 0x40d7f5
push edi
xor edi, 0x13697
call 0x40d7a1
add byte [eax + 0x50], al
xor al, 0x35
dec edx
inc esi
inc ebp
add esp, 4
and edi, 0x6674
pop edi
push ecx
and ecx, 0xa89f
and ecx, 0xbe11
sub ecx, 0xd309
pop ecx
mov ecx, dword [ebp - 0x568]
mov edx, dword [ecx]
mov dword [ebp - 0x568], edx
mov eax, dword [ebp - 0x568]
cmp eax, dword [ebp - 0xdd4]
je 0x40d7eb
mov ecx, dword [ebp - 0x568]
cmp dword [ecx + 0x30], 0
jne 0x40d5b6
mov dword [ebp - 0x7f4], 0
Function at 0x40d7a1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push eax
add esp, 4
and edi, 0x1827c
sub edi, 0x36eb
jmp 0x40d5d0
pop edi
push edi
push edx
add esp, 4
xor edi, 0x12e0d
pop edi
push eax
jmp 0x40d5e7
pop eax
lea ecx, [ebp - 0x1940]
mov dword [ebp - 0xdd0], ecx
mov edx, dword [ebp - 0x568]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xdcc], eax
xor ecx, ecx
mov word [ebp - 0x244], cx
xor edx, edx
mov word [ebp - 0x48], dx
push edx
call fcn.0040d61f
add byte [ebp + 0x3d], al
aaa
cmp bh, byte [edi + esi]
add esp, 4
or edx, 0x13b89
or edx, 0x130b4
pop edx
push ecx
push ecx
add esp, 4
sub ecx, 0x1767e
jmp 0x40d643
pop ecx
mov eax, dword [ebp - 0xdcc]
mov cx, word [eax]
mov word [ebp - 0x1152], cx
mov edx, dword [ebp - 0xdcc]
add edx, 2
mov dword [ebp - 0xdcc], edx
mov ax, word [ebp - 0x1152]
mov word [ebp - 0x244], ax
mov ecx, dword [ebp - 0xdd0]
mov dx, word [ecx]
mov word [ebp - 0x1154], dx
mov eax, dword [ebp - 0xdd0]
add eax, 2
mov dword [ebp - 0xdd0], eax
mov cx, word [ebp - 0x1154]
mov word [ebp - 0x48], cx
push esi
jmp 0x40d6a4
or esi, 0x498c
pop esi
push ecx
push ebx
add esp, 4
sub ecx, 0x14a87
sub ecx, 0x128b3
jmp 0x40d6c4
pop ecx
push ecx
add ecx, 0x5bd5
pop ecx
movzx edx, word [ebp - 0x48]
test edx, edx
jne 0x40d6ea
movzx eax, word [ebp - 0x244]
movzx ecx, word [ebp - 0x48]
sub eax, ecx
mov dword [ebp - 0x17e4], eax
jmp 0x40d744
movzx edx, word [ebp - 0x244]
movzx eax, word [ebp - 0x48]
cmp edx, eax
je 0x40d612
movzx ecx, word [ebp - 0x244]
xor ecx, 0x20
movzx edx, word [ebp - 0x48]
cmp ecx, edx
je 0x40d612
movzx eax, word [ebp - 0x244]
movzx ecx, word [ebp - 0x48]
cmp eax, ecx
jge 0x40d72e
mov dword [ebp - 0x17e0], 0xffffffff
jmp 0x40d738
mov dword [ebp - 0x17e0], 1
mov edx, dword [ebp - 0x17e0]
mov dword [ebp - 0x17e4], edx
cmp dword [ebp - 0x17e4], 0
jne 0x40d78d
push esi
xor esi, 0x38c3
jmp 0x40d75a
sub esi, 0x10f2a
pop esi
push edx
push eax
add esp, 4
and edx, 0x344b
pop edx
push ebx
push eax
add esp, 4
sub ebx, 0x1246c
or ebx, 0x3c30
pop ebx
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x7f4], eax
jmp 0x40d7f5
push edi
xor edi, 0x13697
call 0x40d7a1
add byte [eax + 0x50], al
xor al, 0x35
dec edx
inc esi
inc ebp
add esp, 4
and edi, 0x6674
pop edi
push ecx
and ecx, 0xa89f
and ecx, 0xbe11
sub ecx, 0xd309
pop ecx
mov ecx, dword [ebp - 0x568]
mov edx, dword [ecx]
mov dword [ebp - 0x568], edx
mov eax, dword [ebp - 0x568]
cmp eax, dword [ebp - 0xdd4]
je 0x40d7eb
mov ecx, dword [ebp - 0x568]
cmp dword [ecx + 0x30], 0
jne 0x40d5b6
mov dword [ebp - 0x7f4], 0
Function at 0x40dfb4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push ebx
add esp, 4
add eax, 0x754c
or eax, 0xa926
jmp 0x40ddd3
add eax, 0xd155
pop eax
push esi
push edi
add esp, 4
xor esi, 0x11dee
and esi, 0xf0c4
pop esi
lea ecx, [ebp - 0x1884]
mov dword [ebp - 0xde0], ecx
mov edx, dword [ebp - 0x56c]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xddc], eax
xor ecx, ecx
mov word [ebp - 0x248], cx
xor edx, edx
mov word [ebp - 0x4c], dx
push ebx
push eax
add esp, 4
xor ebx, 0x11fba
add ebx, 0x10f12
add ebx, 0x73af
pop ebx
push eax
xor eax, 0x1392b
and eax, 0x15d4a
xor eax, 0x65f3
or eax, 0x10cf8
pop eax
mov eax, dword [ebp - 0xddc]
mov cx, word [eax]
mov word [ebp - 0x1156], cx
mov edx, dword [ebp - 0xddc]
add edx, 2
mov dword [ebp - 0xddc], edx
mov ax, word [ebp - 0x1156]
mov word [ebp - 0x248], ax
mov ecx, dword [ebp - 0xde0]
mov dx, word [ecx]
mov word [ebp - 0x1158], dx
mov eax, dword [ebp - 0xde0]
add eax, 2
mov dword [ebp - 0xde0], eax
mov cx, word [ebp - 0x1158]
mov word [ebp - 0x4c], cx
push ecx
push eax
add esp, 4
add ecx, 0x14c9c
pop ecx
push eax
sub eax, 0x6a1d
xor eax, 0x109cf
xor eax, 0x11dee
pop eax
push esi
push edx
add esp, 4
add esi, 0xf5d5
or esi, 0x2b5
pop esi
movzx edx, word [ebp - 0x4c]
test edx, edx
jne 0x40deee
movzx eax, word [ebp - 0x248]
movzx ecx, word [ebp - 0x4c]
sub eax, ecx
mov dword [ebp - 0x17fc], eax
jmp 0x40df48
movzx edx, word [ebp - 0x248]
movzx eax, word [ebp - 0x4c]
cmp edx, eax
je 0x40de16
movzx ecx, word [ebp - 0x248]
xor ecx, 0x20
movzx edx, word [ebp - 0x4c]
cmp ecx, edx
je 0x40de16
movzx eax, word [ebp - 0x248]
movzx ecx, word [ebp - 0x4c]
cmp eax, ecx
jge 0x40df32
mov dword [ebp - 0x17f8], 0xffffffff
jmp 0x40df3c
mov dword [ebp - 0x17f8], 1
mov edx, dword [ebp - 0x17f8]
mov dword [ebp - 0x17fc], edx
cmp dword [ebp - 0x17fc], 0
jne 0x40df91
push eax
push ebx
add esp, 4
or eax, 0x123a6
pop eax
push ebx
call fcn.0040df6e
add byte [eax + 0x42], dl
inc esi
dec ebp
xor eax, 0x4348473d
push eax
push esi
add esp, 4
sub eax, 0x5611
and eax, 0xc601
pop eax
push edi
call fcn.0040dfb4
add byte [edi], dh
cmp byte ds:[edi], dh
inc edi
inc ebp
cmp eax, dword [edi + 0x37]
dec edi
add esp, 4
jmp 0x40dfbc
add edi, 0x148f6
pop edi
mov ecx, dword [ebp - 0x56c]
mov edx, dword [ecx]
mov dword [ebp - 0x56c], edx
mov eax, dword [ebp - 0x56c]
cmp eax, dword [ebp - 0xde4]
je 0x40dfef
mov ecx, dword [ebp - 0x56c]
cmp dword [ecx + 0x30], 0
jne 0x40ddba
mov dword [ebp - 0x334], 0
Function at 0x401160
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438c75
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x638e88], 0x10
jl 0x4011b8
push 0x638e8c
call fcn.0041d9d0
mov ecx, dword [0x638e84]
add esp, 4
test ecx, ecx
je 0x4011aa
mov eax, dword [ecx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test ecx, ecx
jne 0x4011cf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x401216
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.exui::BaseEx.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3

Function at 0x4012a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438cbd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x638e88], 0x10
jl 0x4012fb
push 0x638e8c
call fcn.0041d9d0
mov ecx, dword [0x638e84]
add esp, 4
test ecx, ecx
je 0x4012ed
mov eax, dword [ecx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test ecx, ecx
jne 0x401312
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x401376
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.exui::BaseEx.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.exui::BaseEx.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3
Function at 0x401630
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438dbd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x638e88], 0x170
jl 0x40168b
push 0x638e8c
call fcn.0041d9d0
mov ecx, dword [0x638e84]
add esp, 4
test ecx, ecx
je 0x40167d
mov eax, dword [ecx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test ecx, ecx
jne 0x4016a5
push 0x170
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4016ca
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00401900
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3

Function at 0x401760
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438df5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x638e88], 0x170
jl 0x4017be
push 0x638e8c
call fcn.0041d9d0
mov edx, dword [0x638e84]
add esp, 4
test edx, edx
je 0x4017b0
mov eax, dword [edx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test edx, edx
jne 0x4017d8
push 0x170
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40181e
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.00401900
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::WindowBoxEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3

Function at 0x401fe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438dbd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x638e88], 0xc
jl 0x402038
push 0x638e8c
call fcn.0041d9d0
mov ecx, dword [0x638e84]
add esp, 4
test ecx, ecx
je 0x40202a
mov eax, dword [ecx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test ecx, ecx
jne 0x40204f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x402085
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3
Function at 0x402090
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439145
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x638e88], 0xc
jl 0x4020eb
push 0x638e8c
call fcn.0041d9d0
mov ecx, dword [0x638e84]
add esp, 4
test ecx, ecx
je 0x4020dd
mov eax, dword [ecx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test ecx, ecx
jne 0x402102
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40214f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolObject.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3

Function at 0x402500
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438dbd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x638e88], 0x150
jl 0x40255b
push 0x638e8c
call fcn.0041d9d0
mov ecx, dword [0x638e84]
add esp, 4
test ecx, ecx
je 0x40254d
mov eax, dword [ecx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test ecx, ecx
jne 0x402575
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40259a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.004027d0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3

Function at 0x402630
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439215
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x638e88], 0x150
jl 0x40268e
push 0x638e8c
call fcn.0041d9d0
mov edx, dword [0x638e84]
add esp, 4
test edx, edx
je 0x402680
mov eax, dword [edx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test edx, edx
jne 0x4026a8
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x4026ee
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.004027d0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ControlEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3
Function at 0x402e90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43953d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x638e88], 0x10
jl 0x402ee8
push 0x638e8c
call fcn.0041d9d0
mov ecx, dword [0x638e84]
add esp, 4
test ecx, ecx
je 0x402eda
mov eax, dword [ecx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test ecx, ecx
jne 0x402eff
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x402f50
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2542.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3

Function at 0x402fe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439585
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x638e88], 0x10
jl 0x40303c
push 0x638e8c
call fcn.0041d9d0
mov esi, dword [0x638e84]
add esp, 4
test esi, esi
je 0x40302e
mov eax, dword [esi]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test esi, esi
jne 0x403057
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4030dd
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.rg_n1::rg_n2542.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.rg_n1::rg_n2542.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4030b4
mov ecx, edi
call fcn.0041a4e0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4030c0
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3