joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408cc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4477e5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0xc
jl 0x408d1b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x408d0d
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x408d32
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x408d7f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolObject.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x409040
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [ecx + 0xc]
test eax, eax
jne 0x409054
cmp dword [ecx + 0x24], eax
mov eax, 0x5a6674
je 0x409054
mov eax, dword [ecx + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
ret

Function at 0x409060
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4478a2
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x5b7018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x220], esi
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x224], esi
push 0
push eax
mov dword [ebp - 0x21c], 0
call fcn.00430770
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, esi
call fcn.00408010
mov dword [ebp - 4], 1
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
mov dword [esi], vtable.CWString.0
call fcn.0042a3c0
mov dword [ebp - 4], 0
mov dword [ebp - 0x21c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042e9e7
mov esp, ebp
pop ebp
ret
Function at 0x409b10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447655
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x14
jl 0x409b68
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x409b5a
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x409b7f
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x409bcd
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n13954::rg_n15488.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x409c70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447aed
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x14
jl 0x409ccb
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x409cbd
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x409ce2
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x409d53
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n13954::rg_n15488.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n13954::rg_n15488.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x10], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x409fc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44750d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x280
jl 0x40a01b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x40a00d
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x40a035
push 0x280
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40a05a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040afa0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x40a170
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447bc5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5b9718], 0x280
jl 0x40a1cf
push 0x5b971c
call fcn.00429990
mov esi, dword [0x5b9714]
add esp, 4
test esi, esi
je 0x40a1c1
mov eax, dword [esi]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test esi, esi
jne 0x40a1e9
push 0x280
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40a226
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040afa0
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n13954::rg_n15477.0
call fcn.0040a350
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x40a5d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44750d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x344
jl 0x40a62b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x40a61d
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x40a645
push 0x344
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40a66a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040b9d0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x40a770
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447d35
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5b9718], 0x344
jl 0x40a7cf
push 0x5b971c
call fcn.00429990
mov esi, dword [0x5b9714]
add esp, 4
test esi, esi
je 0x40a7c1
mov eax, dword [esi]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test esi, esi
jne 0x40a7e9
push 0x344
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40a826
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040b9d0
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n13954::rg_n15532.0
call fcn.0040a8f0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x40ac10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447655
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x18
jl 0x40ac68
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x40ac5a
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x40ac7f
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40acd3
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ecx], vtable.rg_n13954::rg_n15528.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov word [ecx + 0x14], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x40ad80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447aed
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x18
jl 0x40addb
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x40adcd
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x40adf2
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40ae71
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ecx], vtable.rg_n13954::rg_n15528.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov word [ecx + 0x14], ax
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n13954::rg_n15528.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x10], eax
mov ax, word [esi + 0x14]
mov word [ecx + 0x14], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x40be20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44805f
mov eax, dword fs:[0]
push eax
sub esp, 0xf0
push esi
push edi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x10], 0
call fcn.00408010
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov ecx, dword [esi + 0xc]
xor eax, eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x34], 0
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x4c], 0x3c
test ecx, ecx
je 0x40bea3
cmp word [ecx], ax
sete al
jmp 0x40beaa
cmp dword [esi + 0x24], 2
setle al
test eax, eax
je 0x40bf7c
lea ecx, [ebp - 0xfc]
call fcn.0041c0f0
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa4]
call fcn.00408010
lea edx, [ebp - 0xa4]
mov dword [ebp - 0x10], 1
call fcn.004282e0
push esi
lea edx, [ebp - 0xa4]
lea ecx, [ebp - 0xd0]
call fcn.0042af50
add esp, 4
mov esi, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x78]
mov edx, dword [ebp - 0x78]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x74], ecx
mov ecx, dword [esi + 8]
mov dword [ebp - 0x70], ecx
lea ecx, [ebp - 0x68]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x68]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x68]
call fcn.00408630
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd0]
call fcn.00408ae0
mov eax, 1
mov dword [ebp - 0x10], eax
and eax, 0xfffffffe
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa4]
call fcn.00408ae0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xfc]
call fcn.00408ae0
mov eax, dword [ebp - 0x6c]
test eax, eax
jne 0x40bf97
cmp dword [ebp - 0x54], 0
mov eax, 0x5a6674
cmovne eax, dword [ebp - 0x5c]
jmp 0x40bf97
test ecx, ecx
je 0x40bf85
mov dword [ebp - 0x3c], ecx
jmp 0x40bf9a
cmp dword [esi + 0x24], 0
jne 0x40bf94
mov dword [ebp - 0x3c], 0x5a6674
jmp 0x40bf9a
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [edi + 0xc]
test eax, eax
jne 0x40bfb2
cmp dword [edi + 0x24], eax
jne 0x40bfaf
mov dword [ebp - 0x38], 0x5a6674
jmp 0x40bfb5
mov eax, dword [edi + 0x1c]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x40], 0x5a6808
push eax
mov dword [ebp - 0x30], 0xa
mov dword [ebp - 0x48], 0x100
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.00408ae0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c300
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4480e5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x2c
jl 0x40c358
push 0x5b971c
call fcn.00429990
mov edx, dword [0x5b9714]
add esp, 4
test edx, edx
je 0x40c34a
mov eax, dword [edx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test edx, edx
jne 0x40c36f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40c3a2
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.00408010
mov byte [ebp - 4], 1
mov dword [edx], vtable.CWConstString.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x40c3b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44812d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x5b9718], 0x2c
jl 0x40c40d
push 0x5b971c
call fcn.00429990
mov edi, dword [0x5b9714]
add esp, 4
test edi, edi
je 0x40c3ff
mov eax, dword [edi]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test edi, edi
jne 0x40c424
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40c48b
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.00408010
mov byte [ebp - 4], 1
mov dword [edi], vtable.CWConstString.0
mov byte [ebp - 4], 2
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWConstString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.00408630
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x40d1e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447655
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x10
jl 0x40d238
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x40d22a
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x40d24f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40d296
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.exui::BaseEx.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x40d320
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447aed
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x10
jl 0x40d37b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x40d36d
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x40d392
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40d3f6
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.exui::BaseEx.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.exui::BaseEx.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x40d660
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44750d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x150
jl 0x40d6bb
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x40d6ad
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x40d6d5
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40d6fa
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040d930
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x40d790
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448405
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x150
jl 0x40d7ee
push 0x5b971c
call fcn.00429990
mov edx, dword [0x5b9714]
add esp, 4
test edx, edx
je 0x40d7e0
mov eax, dword [edx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test edx, edx
jne 0x40d808
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40d84e
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040d930
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ControlEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x40dff0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44872d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x10
jl 0x40e048
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x40e03a
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x40e05f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40e0b0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2298.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x40e140
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448775
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5b9718], 0x10
jl 0x40e19c
push 0x5b971c
call fcn.00429990
mov esi, dword [0x5b9714]
add esp, 4
test esi, esi
je 0x40e18e
mov eax, dword [esi]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test esi, esi
jne 0x40e1b7
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40e23d
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.rg_n::rg_n2298.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.rg_n::rg_n2298.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x40e214
mov ecx, edi
call fcn.00423730
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40e220
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x40e5a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447655
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0xc
jl 0x40e5f8
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x40e5ea
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x40e60f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40e64f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n::rg_n2149.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3