joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d6e
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0xec]
sub esp, 0x16c
mov eax, dword [0x1003004]
mov dword [ebp + 0xe8], eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x1001d98
push 7
jmp 0x1001e1e
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1001dd5
cmp dword [ebp - 0x24], 2
jne 0x1001dd5
cmp dword [ebp - 0x30], 5
jne 0x1001dd5
cmp dword [ebp - 0x2c], 1
jb 0x1001dd5
cmp dword [ebp - 0x2c], 5
ja 0x1001dd5
cmp dword [ebp - 0x2c], 1
jne 0x1001dd9
cmp word [ebp + 0xe0], 1
jae 0x1001dd9
push 5
jmp 0x1001e1e
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x5c]
cmp ax, word [ebp - 0x80]
je 0x1001dfb
push 6
jmp 0x1001e1e
lea eax, [ebp - 0x38]
push eax
push 0x10011f8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1001e21
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 8
pop eax
jmp 0x1001e23
xor eax, eax
mov ecx, dword [ebp + 0xe8]
call fcn.010026f6
add ebp, 0xec
leave
ret

Function at 0x1001f1f
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or dword [ebp - 4], 0xffffffff
push edi
push 8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
je 0x1001f45
or dword [eax + 4], 0xffffffff
mov dword [eax], 0x10014e4
mov edi, eax
jmp 0x1001f47
xor edi, edi
test edi, edi
je 0x1001fd2
mov eax, dword [ebp + 0xc]
mov cl, al
and cl, 3
neg cl
push ebx
push esi
sbb ecx, ecx
and ecx, 0xc0000000
add ecx, 0x80000000
test ah, 1
mov dword [ebp - 8], ecx
je 0x1001f8c
test ah, 4
je 0x1001f7b
xor ebx, ebx
inc ebx
jmp 0x1001f9d
and eax, 0x200
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 4
jmp 0x1001f9b
and eax, 0x200
neg eax
sbb eax, eax
and eax, 2
add eax, 3
mov ebx, eax
mov esi, 0x80
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push esi
push ebx
push 0
push 1
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
pop esi
mov dword [edi + 4], eax
pop ebx
je 0x1001fd2
cmp edi, 0xffffffff
mov dword [ebp - 4], edi
jne 0x1001fd9
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
pop edi
leave
ret

Function at 0x100218c
Capabilities:
Create process on windows

Disassembly:
push ebp
push esi
push edi
push 0
push 0x301
mov ebp, 0x10014f8
push ebp
mov esi, ecx
call fcn.01001f1f
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x10021e8
mov eax, dword [edi]
push ebx
mov ebx, dword [esi + 0x1c]
mov esi, dword [esi + 0x18]
push ebx
push esi
mov ecx, edi
call dword [eax + 4]
mov esi, eax
mov eax, dword [edi]
sub esi, ebx
neg esi
sbb esi, esi
mov ecx, edi
inc esi
call dword [eax + 8]
test esi, esi
pop ebx
je 0x10021e8
push 1
push 0
push ebp
push 0x1001510
push 0
push dword [esp + 0x24]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebp
ret 4
Function at 0x10026f6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1003004]
jne 0x10026ff
ret
jmp 0x1002704
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x1003004]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x1003014]
test eax, eax
je 0x1002728
call eax
cmp dword [0x1003010], 0
je 0x100276f
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x1003010]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.010026f6
add ebp, 0x2a8
leave
ret
Function at 0x401d80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f2bd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x2c
jl 0x401dd8
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x401dca
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x401def
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x401e14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.004022f0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x401eb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f325
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x5d9e08], 0x2c
jl 0x401f0d
push 0x5d9e0c
call fcn.0043c770
mov edi, dword [0x5d9e04]
add esp, 4
test edi, edi
je 0x401eff
mov eax, dword [edi]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test edi, edi
jne 0x401f24
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x401f81
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.004022f0
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.00402720
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x4024b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f445
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x1c
jl 0x402508
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x4024fa
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x40251f
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40257b
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolMem.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x18], 0x40
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x402630
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f4bd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5d9e08], 0x1c
jl 0x40268b
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x40267d
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x4026a2
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4026c9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.00402590
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x402c50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f2bd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0xc
jl 0x402ca8
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x402c9a
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x402cbf
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x402cf5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x402d80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f5c5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5d9e08], 0xc
jl 0x402ddb
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x402dcd
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x402df2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x402e3f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolObject.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x40b770
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x40b788
cmp dword [esi + 0x24], eax
mov eax, 0x5be34c
je 0x40b788
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40b7e2
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x40b7a7
cmp dword [esi + 0x24], eax
mov eax, 0x5be34c
je 0x40b7a7
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov edi, eax
test edi, edi
je 0x40b7e2
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push edi
call dword [sym.imp.SHELL32.dll_SHOpenFolderAndSelectItems]
mov esi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
push edi
call dword [sym.imp.SHELL32.dll_ILFree]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x40b880
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40b8b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret 4

Function at 0x40c180
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f445
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x14
jl 0x40c1d8
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x40c1ca
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x40c1ef
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40c23d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n14110::rg_n15605.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x40c2e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46004d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5d9e08], 0x14
jl 0x40c33b
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x40c32d
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x40c352
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40c3c3
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n14110::rg_n15605.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n14110::rg_n15605.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x10], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x40cfc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4601b5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x2c
jl 0x40d018
push 0x5d9e0c
call fcn.0043c770
mov edx, dword [0x5d9e04]
add esp, 4
test edx, edx
je 0x40d00a
mov eax, dword [edx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test edx, edx
jne 0x40d02f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40d062
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.004022f0
mov byte [ebp - 4], 1
mov dword [edx], vtable.CWConstString.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x40d070
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4601fd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x5d9e08], 0x2c
jl 0x40d0cd
push 0x5d9e0c
call fcn.0043c770
mov edi, dword [0x5d9e04]
add esp, 4
test edi, edi
je 0x40d0bf
mov eax, dword [edi]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test edi, edi
jne 0x40d0e4
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40d14b
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.004022f0
mov byte [ebp - 4], 1
mov dword [edi], vtable.CWConstString.0
mov byte [ebp - 4], 2
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWConstString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.00402720
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x40d5e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f445
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x10
jl 0x40d638
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x40d62a
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x40d64f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40d696
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.exui::BaseEx.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x40d720
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46004d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5d9e08], 0x10
jl 0x40d77b
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x40d76d
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x40d792
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40d7f6
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.exui::BaseEx.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.exui::BaseEx.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x40da60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f2bd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x150
jl 0x40dabb
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x40daad
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x40dad5
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40dafa
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040dd30
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x40db90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4603d5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5d9e08], 0x150
jl 0x40dbee
push 0x5d9e0c
call fcn.0043c770
mov edx, dword [0x5d9e04]
add esp, 4
test edx, edx
je 0x40dbe0
mov eax, dword [edx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test edx, edx
jne 0x40dc08
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40dc4e
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040dd30
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ControlEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x40e3c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f445
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0xc
jl 0x40e418
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x40e40a
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x40e42f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40e46f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n::rg_n2149.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x40e500
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46004d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5d9e08], 0xc
jl 0x40e55b
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x40e54d
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x40e572
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40e5c9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n::rg_n2149.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2149.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x40e880
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46076d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x10
jl 0x40e8d8
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x40e8ca
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x40e8ef
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40e940
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2298.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3