joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4072c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c270
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5ee9c8], 0x1c
jl 0x407318
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x40730a
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x40732f
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40738b
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolMem.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x18], 0x40
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3

Function at 0x407460
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c2c8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5ee9c8], 0x1c
jl 0x4074bb
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x4074ad
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x4074d2
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4074f9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.004073a0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3
Function at 0x407910
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c3e3
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov dword [esi], vtable.CVolBaseStream.0
mov dword [ebp - 4], 2
mov dword [esi], vtable.CVolBaseInputStream.0
mov dword [ebp - 4], 3
mov dword [esi], vtable.CVolMemoryInputStream.0
cmp dword [0x5ee9c8], 0x44
jl 0x4079bf
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x4079b1
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x4079da
push 0x44
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x407aa8
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 4
mov dword [ecx], vtable.CRefObject.0
mov dword [ecx + 4], 1
mov byte [ebp - 4], 5
mov dword [ecx], vtable.CVBaseStream.0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 6
mov dword [ecx], vtable.CVBaseInputStream.0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 7
lea eax, [ecx + 0x28]
mov dword [ecx], vtable.CVMemoryInputStream.0
mov dword [ebp - 0x18], eax
mov dword [eax], vtable.CVolObject.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 8
mov dword [eax], vtable.CVolMem.0
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x18], 0x40
mov byte [ebp - 4], 9
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x20], 0
mov byte [ebp - 4], 3
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3

Function at 0x407b30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c270
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5ee9c8], 0xc
jl 0x407b88
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x407b7a
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x407b9f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x407bdf
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3
Function at 0x407bf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c418
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5ee9c8], 0xc
jl 0x407c4b
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x407c3d
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x407c62
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x407cb9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3

Function at 0x408070
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c270
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5ee9c8], 0x10
jl 0x4080c8
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x4080ba
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x4080df
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x408126
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3
Function at 0x408130
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c4f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5ee9c8], 0x10
jl 0x40818c
push 0x5ee9cc
call fcn.00414800
mov esi, dword [0x5ee9c4]
add esp, 4
test esi, esi
je 0x40817e
mov eax, dword [esi]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test esi, esi
jne 0x4081a3
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40821f
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolRefObject.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4081f6
mov ecx, edi
call fcn.0040fe60
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x408202
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3

Function at 0x408630
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57bd18
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5ee9c8], 0xc
jl 0x408688
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x40867a
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x40869f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4086d5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3
Function at 0x408760
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c5d0
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5ee9c8], 0xc
jl 0x4087bb
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x4087ad
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x4087d2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40881f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolObject.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3

Function at 0x408e10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b9d8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5ee9c8], 0xc
jl 0x408e68
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x408e5a
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x408e7f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x408ecf
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5ee9f0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3
Function at 0x408f60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ba20
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5ee9c8], 0xc
jl 0x408fbb
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x408fad
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x408fd2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x409039
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5ee9f0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3

Function at 0x409300
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c7b0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5ee9c8], 0xc
jl 0x409358
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x40934a
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x40936f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4093c9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5ee9f0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n7771.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3
Function at 0x409460
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c7f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5ee9c8], 0xc
jl 0x4094bb
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x4094ad
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x4094d2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x409543
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5ee9f0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n7771.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n1::rg_n7771.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3
Function at 0x409730
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edi
call fcn.004180f7
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 8
push eax
mov dword [ebp - 0x14], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
call fcn.00418640
add esp, 4
mov ecx, edi
call fcn.0041a1d6
call fcn.0041b6b7
mov eax, dword [eax + 0x40]
test eax, eax
je 0x409793
mov dword [eax + 0x28], 0
mov dword [eax + 0x38], 2
mov dword [eax + 0x2c], 1
mov dword [eax + 0x3c], 0xffffffff
call fcn.0040b0b0
mov dword [ebp - 0x10], eax
call fcn.00563777
mov esi, dword [eax]
call fcn.00563771
mov ecx, dword [edi + 0x44]
mov edx, dword [eax]
mov dword [0x5eeaac], ecx
mov dword [0x5eeab0], edx
mov dword [0x5eeab4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 2
push 0
mov dword [0x5eeab8], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
xor ecx, ecx
test eax, eax
setns cl
mov dword [0x5ee9f4], ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push str.SHCore.dll
mov edi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x409832
push str.GetDpiForMonitor
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x409829
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 2
push edi
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push eax
call esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 4]
test eax, eax
jne 0x409859
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 4]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mov eax, dword [ebp - 0x10]
movsd xmm0, qword [0x5c35e0]
divsd xmm1, qword [0x5c35e8]
maxsd xmm0, xmm1
movsd qword [0x5ee9f8], xmm0
mov eax, dword [eax]
call eax
mov dword [0x5ee9f0], eax
mov esi, dword [eax]
call fcn.00409c90
mov ecx, dword [0x5ee9f0]
push eax
mov eax, dword [esi + 0x34]
call eax
test eax, eax
je 0x4098e9
mov esi, dword [0x5ee9f0]
mov edi, dword [esi]
call fcn.004091d0
push eax
mov eax, dword [edi + 0x34]
mov ecx, esi
call eax
mov esi, dword [ebp - 8]
test eax, eax
je 0x4098c7
mov eax, dword [0x5ee9f0]
mov dword [esi + 0x118], eax
call fcn.0040b540
test eax, eax
je 0x4098e1
cmp dword [esi + 0x20], 0
je 0x4098e1
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x5ee9f0]
mov eax, dword [ecx]
call dword [eax + 0x30]
push 0xffffffffffffffff
call fcn.00563a38
int3
Function at 0x4099d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x118], 0
jne 0x4099ec
push dword [ebp + 8]
call fcn.0041a38b
pop esi
pop ebp
ret 4
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x409a09
mov dword [0x5e59e0], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x5ee8b0], eax
cmp dword [0x5e59e0], 0
je 0x409a2a
push edi
mov ecx, esi
call fcn.0041a38b
mov dword [0x5e59e0], eax
pop edi
mov eax, 1
pop esi
pop ebp
ret 4
cmp edi, 2
jl 0x409a1f
push ecx
mov ecx, 0x5eea24
call fcn.00414b10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x118]
sub eax, dword [0x5ee8b0]
mov edx, dword [ecx]
cmp edx, vtable.rg_n1::rg_n7771.0
jne 0x409a5e
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
pop edi
pop esi
mov dword [ebp + 8], eax
pop ebp
jmp dword [edx + 0x50]

Function at 0x409bd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c270
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5ee9c8], 0xc
jl 0x409c28
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x409c1a
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x409c3f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x409c85
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5ee9f0], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3

Function at 0x409fe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57bd18
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5ee9c8], 0x2c
jl 0x40a038
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x40a02a
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x40a04f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40a074
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040a610
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3