joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408c40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f385
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f3978], 0xc
jl 0x408c9b
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x408c8d
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x408cb2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x408d19
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f39a0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7792.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n7792.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3

Function at 0x408fe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5801e5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f3978], 0xc
jl 0x409038
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x40902a
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x40904f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4090a9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f39a0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7792.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n7802.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3
Function at 0x409140
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58023d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f3978], 0xc
jl 0x40919b
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x40918d
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x4091b2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x409223
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f39a0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7792.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n7802.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n1::rg_n7802.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3
Function at 0x409400
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edi
call fcn.00418a76
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 8
push eax
mov dword [ebp - 0x14], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
call fcn.00418fe2
add esp, 4
mov ecx, edi
call fcn.0041abec
call fcn.0041c0a1
mov eax, dword [eax + 0x40]
test eax, eax
je 0x409463
mov dword [eax + 0x28], 0
mov dword [eax + 0x38], 2
mov dword [eax + 0x2c], 1
mov dword [eax + 0x3c], 0xffffffff
call fcn.0040acf0
mov dword [ebp - 0x10], eax
call fcn.00567037
mov esi, dword [eax]
call fcn.00567031
mov ecx, dword [edi + 0x44]
mov edx, dword [eax]
mov dword [0x5f3a5c], ecx
mov dword [0x5f3a60], edx
mov dword [0x5f3a64], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 2
push 0
mov dword [0x5f3a68], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
xor ecx, ecx
test eax, eax
setns cl
mov dword [0x5f39a4], ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push str.SHCore.dll
mov edi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x409502
push str.GetDpiForMonitor
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4094f9
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 2
push edi
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push eax
call esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 4]
test eax, eax
jne 0x409529
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 4]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mov eax, dword [ebp - 0x10]
movsd xmm0, qword [0x5c8750]
divsd xmm1, qword [0x5c8758]
maxsd xmm0, xmm1
movsd qword [0x5f39a8], xmm0
mov eax, dword [eax]
call eax
mov dword [0x5f39a0], eax
mov esi, dword [eax]
call fcn.00409910
mov ecx, dword [0x5f39a0]
push eax
mov eax, dword [esi + 0x34]
call eax
test eax, eax
je 0x4095b9
mov esi, dword [0x5f39a0]
mov edi, dword [esi]
call fcn.00408ea0
push eax
mov eax, dword [edi + 0x34]
mov ecx, esi
call eax
mov esi, dword [ebp - 8]
test eax, eax
je 0x409597
mov eax, dword [0x5f39a0]
mov dword [esi + 0x118], eax
call fcn.0040b180
test eax, eax
je 0x4095b1
cmp dword [esi + 0x20], 0
je 0x4095b1
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x5f39a0]
mov eax, dword [ecx]
call dword [eax + 0x30]
push 0xffffffffffffffff
call fcn.0056733b
int3
Function at 0x409850
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57fc55
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f3978], 0xc
jl 0x4098a8
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x40989a
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x4098bf
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x409905
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f39a0], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3

Function at 0x409cb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f6ad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f3978], 0x2c
jl 0x409d08
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x409cfa
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x409d1f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x409d44
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040a280
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3
Function at 0x409de0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5804c5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x5f3978], 0x2c
jl 0x409e3d
push 0x5f397c
call fcn.00413df0
mov edi, dword [0x5f3974]
add esp, 4
test edi, edi
je 0x409e2f
mov eax, dword [edi]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test edi, edi
jne 0x409e54
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x409eb1
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.0040a280
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.004070e0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3

Function at 0x40a470
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f6ad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f3978], 0x20
jl 0x40a4c8
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x40a4ba
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x40a4df
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40a504
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040a8d0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3
Function at 0x40a590
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x580615
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5f3978], 0x20
jl 0x40a5ec
push 0x5f397c
call fcn.00413df0
mov esi, dword [0x5f3974]
add esp, 4
test esi, esi
je 0x40a5de
mov eax, dword [esi]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test esi, esi
jne 0x40a603
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40a661
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040a8d0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n1::rg_n7484.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x40a638
mov ecx, edi
call fcn.0040f3d0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40a644
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3

Function at 0x40a8d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5806f6
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CVolObject.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [edi], vtable.CVolRefObject.0
mov dword [edi + 0xc], 0
mov dword [ebp - 4], 1
mov dword [edi], vtable.rg_n1::rg_n7484.0
mov dword [edi + 0x10], 1
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov byte [ebp - 4], 2
cmp dword [0x5f3978], 0x28
jl 0x40a987
push 0x5f397c
call fcn.00413df0
mov ebx, dword [0x5f3974]
add esp, 4
test ebx, ebx
je 0x40a979
mov eax, dword [ebx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ebx, ebx
jne 0x40a99e
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x40aa1b
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 3
mov dword [ebx], vtable.CRefObject.0
mov dword [ebx + 4], 1
mov byte [ebp - 4], 4
lea esi, [ebx + 8]
push 0
push 0
push 0
mov dword [ebx], vtable.CRefObjectWithData_class_CVolThread_.0
mov dword [ebp - 0x18], esi
push 0
mov dword [esi], vtable.CVolThread.0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 5
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov byte [ebp - 4], 2
mov dword [edi + 0xc], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3
Function at 0x40ae20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5801e5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f3978], 0xc
jl 0x40ae78
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x40ae6a
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x40ae8f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40aee9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f39a0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7792.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n42083.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3

Function at 0x40af90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58023d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f3978], 0xc
jl 0x40afeb
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x40afdd
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x40b002
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40b073
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f39a0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7792.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n42083.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n::rg_n42083.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3
Function at 0x40bbb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f6ad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f3978], 0x2c
jl 0x40bc08
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x40bbfa
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x40bc1f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40bc44
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040be20
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3

Function at 0x40bc50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5804c5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x5f3978], 0x2c
jl 0x40bcad
push 0x5f397c
call fcn.00413df0
mov edi, dword [0x5f3974]
add esp, 4
test edi, edi
je 0x40bc9f
mov eax, dword [edi]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test edi, edi
jne 0x40bcc4
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40bd21
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.0040be20
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CU8String.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.004070e0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3
Function at 0x40c070
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5809f6
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push esi
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 8
mov dword [ebp - 0x10], 0
mov ecx, 0x5f3980
call fcn.00411c40
test eax, eax
jne 0x40c0be
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.0040a280
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], 0
test eax, eax
je 0x40c0e9
push eax
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x48]
call dword [eax + 0xc]
push str.BE93FFFFFB5FB8BC3A8BEF2020FBEC5D4E6C2F1485326F6E3273346E71D2650F89B0E9AA2EC80FBC19E84C82E9D37F0B77025EC9B9BC92883C9C540375957365806745A3D0207FC2F43AC3509A9A9780F67926DC8EA05532362E59BC0AC1FAD98D2C40951A1D32768D998F6AAA31D882E6FE13A72EF61DC662612697EE35CD8C44862C2AF9C651623E0C4ECCE17E8BECEB91A955B7CB2C85E96BB43EEDB67D6092CA8368F3FBBDBBDF86FAAD1504DB445138F90CA5D78BBB0C8F609C509B2685E01A70B791D8DF59BC4BACA36A785BE730C53C6E0C4E126C7E2D1D652DA1FACEDF1CB213D05509B00AD9F11BC3772E6128C4A326BCF121833B3877F1C7CCB099C79019974E502355B17D500EA677B65029BBB7E24DFC9DEBB0D92615C368CC591982C355B7EA368AA6DBF73636E8F5160C253687B03913DA065049C173
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
call fcn.00413500
push ecx
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x2c]
call fcn.0040b5c0
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00409f20
xor edx, edx
lea ecx, [ebp - 0x2c]
call fcn.0040c180
mov ecx, 1
mov esi, eax
mov dword [ebp - 0x10], ecx
and ecx, 0xfffffffe
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00407550
cmp esi, 1
jne 0x40c160
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d800
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x580e85
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f3978], 0x2c
jl 0x40d858
push 0x5f397c
call fcn.00413df0
mov edx, dword [0x5f3974]
add esp, 4
test edx, edx
je 0x40d84a
mov eax, dword [edx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test edx, edx
jne 0x40d86f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40d8a2
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040a280
mov byte [ebp - 4], 1
mov dword [edx], vtable.CWConstString.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3

Function at 0x40d8b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x580ecd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x5f3978], 0x2c
jl 0x40d90d
push 0x5f397c
call fcn.00413df0
mov edi, dword [0x5f3974]
add esp, 4
test edi, edi
je 0x40d8ff
mov eax, dword [edi]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test edi, edi
jne 0x40d924
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40d98b
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.0040a280
mov byte [ebp - 4], 1
mov dword [edi], vtable.CWConstString.0
mov byte [ebp - 4], 2
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWConstString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.004070e0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3