joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53e670
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov al, byte [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ff260
add esp, 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x53e6b7
mov edx, dword [ebp + 8]
and edx, 0x200000
test edx, edx
je 0x53e6af
xor eax, eax
jmp 0x53e783
or eax, 0xffffffff
jmp 0x53e783
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
push 0
push 0
mov cl, byte [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0053cacc
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
and eax, 0xff
test eax, eax
je 0x53e6eb
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x18], edx
jmp 0x53e6f4
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x64
jae 0x53e781
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx + 2]
and edx, 0x20
test edx, edx
je 0x53e723
xor eax, eax
jmp 0x53e783
mov eax, 1
test eax, eax
je 0x53e781
push 0xf110000b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0x2ca
push 0x7c80dc
call fcn.004ff360
add esp, 0x14
push 0xf110000b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004f6ce3
add esp, 0xc
push 0xf110000b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.005e843a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x541220
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60de49
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0051bd60
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x71f344
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004f9816
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x312
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004fced0
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x5412bf
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x5412f5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004f8328
and eax, 0xff
test eax, eax
jne 0x5412d6
jmp 0x5412f5
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x7c87a4
call fcn.00500660
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004fa564
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x543de0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60e089
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0051bd60
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x71f4ac
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004f9816
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x2e1
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004fced0
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x543e7f
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x543eb5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004f8328
and eax, 0xff
test eax, eax
jne 0x543e96
jmp 0x543eb5
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x7c8aac
call fcn.00500660
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004fa564
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x546ee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60e2c9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0051bd60
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x71f734
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004f9816
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x295
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004fced0
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x546f7f
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x546fb5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004f8328
and eax, 0xff
test eax, eax
jne 0x546f96
jmp 0x546fb5
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x7c8f30
call fcn.00500660
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004fa564
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x549b60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60e679
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0051bd60
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x71f8b4
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004f9816
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x273
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004fced0
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x549bff
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x549c35
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004f8328
and eax, 0xff
test eax, eax
jne 0x549c16
jmp 0x549c35
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x7c919c
call fcn.00500660
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004fa564
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x54f8b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60e8e9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0051bd60
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x71fad8
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004f9816
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x1b7
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004fced0
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x54f94f
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x54f985
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004f8328
and eax, 0xff
test eax, eax
jne 0x54f966
jmp 0x54f985
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x7c9a6c
call fcn.00500660
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004fa564
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x553c90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60ecb9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0051bd60
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x71fd20
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004f9816
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x16f
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004fced0
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x553d2f
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x553d65
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004f8328
and eax, 0xff
test eax, eax
jne 0x553d46
jmp 0x553d65
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x7c9f28
call fcn.00500660
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004fa564
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x557000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60eff9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0051bd60
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x71fea4
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004f9816
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x122
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004fced0
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x55709f
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x5570d5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004f8328
and eax, 0xff
test eax, eax
jne 0x5570b6
jmp 0x5570d5
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x7ca2a0
call fcn.00500660
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004fa564
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x55a090
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60f429
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0051bd60
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x720030
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004f9816
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0xf2
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004fced0
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x55a12f
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x55a165
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004f8328
and eax, 0xff
test eax, eax
jne 0x55a146
jmp 0x55a165
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x7ca504
call fcn.00500660
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004fa564
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x55d130
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60f799
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0051bd60
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x7201a8
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004f9816
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0xd2
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004fced0
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x55d1cf
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x55d205
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004f8328
and eax, 0xff
test eax, eax
jne 0x55d1e6
jmp 0x55d205
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x7ca80c
call fcn.00500660
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004fa564
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x5605d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60fb29
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.005606c0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x720328
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004f9816
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0xb2
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004fced0
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x56066f
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x5606a5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004f8328
and eax, 0xff
test eax, eax
jne 0x560686
jmp 0x5606a5
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x7c8440
call fcn.00500660
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004fa564
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x563b80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60ff09
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0051bd60
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x7203e0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004f9816
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x93
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004fced0
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x563c1f
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x563c55
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004f8328
and eax, 0xff
test eax, eax
jne 0x563c36
jmp 0x563c55
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x7c8440
call fcn.00500660
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004fa564
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x5654a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60ff79
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.00565590
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x720618
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004f9816
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x75
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004fced0
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x56553c
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x565572
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004f8328
and eax, 0xff
test eax, eax
jne 0x565553
jmp 0x565572
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x7c8440
call fcn.00500660
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004fa564
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x569200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6103f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0051bd60
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x7206f4
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004f9816
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x54
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004fced0
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x56929c
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x5692d2
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004f8328
and eax, 0xff
test eax, eax
jne 0x5692b3
jmp 0x5692d2
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x7c8440
call fcn.00500660
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004fa564
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x573c02
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0xffffffffffffffff
push 0x4f1
push 0x7cd2a0
push 0
mov ecx, dword [ebp - 0xc]
call fcn.004f9816
mov eax, dword [eax + 0x5c]
push eax
call fcn.004ff770
add esp, 0x14
test eax, eax
je 0x573c81
push 0xffffffffffffffff
push 0x4f1
push 0x7cd2dc
push 0x4f1
push 0x7cd318
call fcn.004ff360
add esp, 0x14
push 0xffffffffffffffff
push 0x4f1
push 0x7cd354
call fcn.004f6ce3
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.005e843a
mov ecx, dword [ebp + 8]
call fcn.004e1270
push eax
call fcn.005e8634
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
call fcn.00539090
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jle 0x573cce
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 4]
jg 0x573cce
mov edx, dword [ebp - 8]
sub edx, 1
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
call fcn.005014b0
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov dword [ecx + 0x14], edx
jmp 0x573d03
push 0x82c368
mov ecx, dword [ebp + 8]
call fcn.00500d90
and eax, 0xff
test eax, eax
je 0x573d03
push 0
lea eax, [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x6c]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov dword [edx + 0x18], eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x14]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.00573d2d
mov esp, ebp
pop ebp
ret 0x14