joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a360
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45905d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5c21a8], 0x18
jl 0x42a3b8
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x42a3aa
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x42a3cf
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42a421
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_n::rg_n2312.0
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3

Function at 0x42a4e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4590a5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5c21a8], 0x18
jl 0x42a53b
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x42a52d
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x42a552
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42a5c5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_n::rg_n2312.0
movsd qword [ecx + 0x10], xmm0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2312.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
movsd xmm0, qword [esi + 0x10]
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3
Function at 0x42a890
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45905d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5c21a8], 0x10
jl 0x42a8e8
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x42a8da
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x42a8ff
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42a950
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2314.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3

Function at 0x42a9e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4590a5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5c21a8], 0x10
jl 0x42aa3b
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x42aa2d
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x42aa52
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42aac0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2314.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2314.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3
Function at 0x42acc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45905d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5c21a8], 0x18
jl 0x42ad18
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x42ad0a
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x42ad2f
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42ad87
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2310.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3

Function at 0x42ae20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4590a5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5c21a8], 0x18
jl 0x42ae7b
push 0x5c21ac
call fcn.00436ad0
mov edx, dword [0x5c21a4]
add esp, 4
test edx, edx
je 0x42ae6d
mov eax, dword [edx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test edx, edx
jne 0x42ae92
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x42af0d
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov dword [edx], vtable.CVolObject.0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [ebp - 4], 1
mov dword [edx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.rg_n::rg_n2310.0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov byte [ebp - 4], 3
mov dword [edx], vtable.rg_n::rg_n2310.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3
Function at 0x42b170
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45905d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5c21a8], 0x10
jl 0x42b1c8
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x42b1ba
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x42b1df
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42b230
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2306.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3

Function at 0x42b2c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4590a5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5c21a8], 0x10
jl 0x42b31b
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x42b30d
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x42b332
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42b3a0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2306.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2306.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3
Function at 0x42b5a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45905d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5c21a8], 0x10
jl 0x42b5f8
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x42b5ea
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x42b60f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42b65f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n::rg_n2302.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3

Function at 0x42b700
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4590a5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5c21a8], 0x10
jl 0x42b75b
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x42b74d
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x42b772
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42b7e1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n::rg_n2302.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2302.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3
Function at 0x42ba70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45905d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5c21a8], 0x10
jl 0x42bac8
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x42baba
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x42badf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42bb2f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n::rg_n2304.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3

Function at 0x42bbd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4590a5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5c21a8], 0x10
jl 0x42bc2b
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x42bc1d
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x42bc42
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42bcb1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n::rg_n2304.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2304.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3
Function at 0x42bf00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45905d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5c21a8], 0x10
jl 0x42bf58
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x42bf4a
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x42bf6f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42bfbd
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2300.0
mov byte [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3

Function at 0x42c050
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4590a5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5c21a8], 0x10
jl 0x42c0ab
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x42c09d
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x42c0c2
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42c12d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2300.0
mov byte [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2300.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov al, byte [esi + 0xc]
mov byte [ecx + 0xc], al
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3
Function at 0x42c810
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451b75
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5c21a8], 0xc
jl 0x42c868
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x42c85a
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x42c87f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42c8bf
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3

Function at 0x42c8d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45286d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5c21a8], 0xc
jl 0x42c92b
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x42c91d
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x42c942
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42c999
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3
Function at 0x42cce0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4593d7
mov eax, dword fs:[0]
push eax
mov eax, 0x5020
call fcn.00450ee0
mov eax, dword [0x5c000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x501c], edi
mov dword [ebp - 0x5028], edi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x5014], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x502c], edi
mov dword [ebp - 0x5024], edx
mov dword [ebp - 0x5020], eax
mov dword [ebp - 0x5018], 0
call fcn.00402dc0
mov dword [ebp - 4], 0
xor eax, eax
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x5018], 1
test esi, esi
je 0x42cd7b
cmp word [esi], ax
sete al
jmp 0x42cd82
cmp dword [ebx + 0x24], 2
setle al
test eax, eax
jne 0x42ce9c
mov ecx, dword [edx + 0xc]
test ecx, ecx
je 0x42cd99
cmp word [ecx], ax
sete al
jmp 0x42cda0
cmp dword [edx + 0x24], 2
setle al
test eax, eax
jne 0x42ce9c
mov eax, dword [ebp - 0x5014]
xor edx, edx
mov eax, dword [eax + 0xc]
test eax, eax
je 0x42cdbf
cmp word [eax], dx
sete dl
jmp 0x42cdd2
mov edi, dword [ebp - 0x5014]
cmp dword [edi + 0x24], 2
mov edi, dword [ebp - 0x501c]
setle dl
test edx, edx
jne 0x42ce9c
mov word [ebp - 0x5010], dx
test esi, esi
jne 0x42cdf2
mov esi, 0x5ade04
cmp dword [ebx + 0x24], edx
je 0x42cdf2
mov esi, dword [ebx + 0x1c]
mov ebx, dword [ebp - 0x5020]
mov edx, dword [ebx + 0xc]
test edx, edx
jne 0x42ce0c
cmp dword [ebx + 0x24], edx
mov edx, 0x5ade04
je 0x42ce0c
mov edx, dword [ebx + 0x1c]
test eax, eax
jne 0x42ce26
mov eax, dword [ebp - 0x5014]
cmp dword [eax + 0x24], 0
jne 0x42ce23
mov eax, 0x5ade04
jmp 0x42ce26
mov eax, dword [eax + 0x1c]
test ecx, ecx
jne 0x42ce40
mov ecx, dword [ebp - 0x5024]
cmp dword [ecx + 0x24], 0
jne 0x42ce3d
mov ecx, 0x5ade04
jmp 0x42ce40
mov ecx, dword [ecx + 0x1c]
push esi
push 0x2800
lea esi, [ebp - 0x5010]
push esi
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [edi + 0xc], 0
mov ecx, dword [edi + 0x1c]
test ecx, ecx
je 0x42ce6e
mov eax, dword [edi + 0x10]
push ecx
lea ecx, [edi + 0x10]
call dword [eax + 0xc]
cmp word [ebp - 0x5010], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x20], 0
je 0x42ce9c
lea eax, [ebp - 0x5010]
push eax
lea ecx, [edi + 0x10]
call fcn.004360b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043cd82
mov esp, ebp
pop ebp
ret 0xc