joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408990
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b852
mov eax, dword fs:[0]
push eax
sub esp, 0x3ec
mov eax, dword [0x45b00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0x2e0], 0
mov dword [ebp - 4], 0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x2dc], 0
mov dword [ebp - 0x2d4], 0
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 0x2d0], 0x40
mov dword [ebp - 4], 1
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2c4], 0
mov byte [ebp - 4], 2
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2bc], 0
mov dword [ebp - 0x2b4], 0x40
mov byte [ebp - 4], 3
mov dword [ebp - method.CWString.virtual_0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2a8], 0
mov byte [ebp - 4], 4
mov dword [ebp - method.CWString.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x2a4], 0
mov dword [ebp - 0x29c], 0
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x298], 0x40
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x348]
call fcn.004020d0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3f8]
call fcn.004020d0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x3f8]
push str.6C6F7665E99988E99D99E99D9964617461
mov dword [ebp - method.CWString.virtual_0], vtable.CWString.0
call fcn.0042a710
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x3cc]
call fcn.004020d0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x3cc]
push str.6C6F7665E99988E99D99E99D9963646B
mov dword [ebp - method.CWString.virtual_0], vtable.CWString.0
call fcn.0042a710
mov byte [ebp - 4], 0xa
push 0x445d2c
jmp 0x40acda
lea esp, [esp + 4]
movsx ecx, sp
mov byte [ebp - 4], 0xb
movzx ecx, bx
lea ecx, [ebp - 0x268]
jmp loc.0045ea95
Function at 0x40bac0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c105
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x45bde8], 0x2c
jl 0x40bb18
push 0x45bdec
call fcn.004296e0
mov edx, dword [0x45bde4]
add esp, 4
test edx, edx
je 0x40bb0a
mov eax, dword [edx]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test edx, edx
jne 0x40bb37
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x40bb37
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.004020d0
mov byte [ebp - 4], 1
mov dword [edx], vtable.CWConstString.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40bb70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c14d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x45bde8], 0x2c
jl 0x40bbcd
push 0x45bdec
call fcn.004296e0
mov edi, dword [0x45bde4]
add esp, 4
test edi, edi
je 0x40bbbf
mov eax, dword [edi]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test edi, edi
jne 0x40bbec
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x40bbec
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.004020d0
mov byte [ebp - 4], 1
mov dword [edi], vtable.CWConstString.0
mov byte [ebp - 4], 2
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWConstString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.00402f40
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c260
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439e0d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x45bde8], 0x10
jl 0x40c2b8
push 0x45bdec
call fcn.004296e0
mov ecx, dword [0x45bde4]
add esp, 4
test ecx, ecx
je 0x40c2aa
mov eax, dword [ecx]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test ecx, ecx
jne 0x40c2d7
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40c2d7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00416500
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40c3f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c368
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x45bde8], 0x2c
jl 0x40c448
push 0x45bdec
call fcn.004296e0
mov edx, dword [0x45bde4]
add esp, 4
test edx, edx
je 0x40c43a
mov eax, dword [edx]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test edx, edx
jne 0x40c467
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x40c467
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov dword [edx], vtable.CVolObject.0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [ebp - 4], 1
mov dword [edx], vtable.rg_n52::rg_n2442.0
mov byte [ebp - 4], 2
push ecx
lea ecx, [edx + 0xc]
mov dword [edx], vtable.rg_n52::rg_n2010.0
call fcn.00412050
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40c5f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c3c0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x45bde8], 0x2c
jl 0x40c64c
push 0x45bdec
call fcn.004296e0
mov esi, dword [0x45bde4]
add esp, 4
test esi, esi
je 0x40c63e
mov eax, dword [esi]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test esi, esi
jne 0x40c66b
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40c66b
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n52::rg_n2442.0
mov byte [ebp - 4], 2
push ecx
lea ecx, [esi + 0xc]
mov dword [esi], vtable.rg_n52::rg_n2010.0
call fcn.00412050
mov byte [ebp - 4], 4
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n52::rg_n2010.0
call fcn.0040c7d0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40cb40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c4c5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x45bde8], 0x10
jl 0x40cb99
push 0x45bdec
call fcn.004296e0
mov esi, dword [0x45bde4]
add esp, 4
test esi, esi
je 0x40cb8b
mov eax, dword [esi]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test esi, esi
jne 0x40cbb8
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40cbb8
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00416500
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n33033::rg_n33800.0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40cc70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c50d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x45bde8], 0x10
jl 0x40cccc
push 0x45bdec
call fcn.004296e0
mov esi, dword [0x45bde4]
add esp, 4
test esi, esi
je 0x40ccbe
mov eax, dword [esi]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test esi, esi
jne 0x40cceb
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40cceb
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00416500
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n33033::rg_n33800.0
mov byte [ebp - 4], 2
mov dword [esi], vtable.rg_n33033::rg_n33800.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x40cd2a
mov ecx, edi
call fcn.00412720
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40cd36
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40d050
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439e0d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x45bde8], 0x98
jl 0x40d0ab
push 0x45bdec
call fcn.004296e0
mov ecx, dword [0x45bde4]
add esp, 4
test ecx, ecx
je 0x40d09d
mov eax, dword [ecx]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test ecx, ecx
jne 0x40d0cd
push 0x98
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40d0cd
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.004110b0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40d1d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c5c5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x45bde8], 0x98
jl 0x40d22f
push 0x45bdec
call fcn.004296e0
mov esi, dword [0x45bde4]
add esp, 4
test esi, esi
je 0x40d221
mov eax, dword [esi]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test esi, esi
jne 0x40d251
push 0x98
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40d251
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.004110b0
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n33033::rg_n33369.0
call fcn.0040d350
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40d530
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c670
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x45bde8], 0xa4
jl 0x40d58c
push 0x45bdec
call fcn.004296e0
mov esi, dword [0x45bde4]
add esp, 4
test esi, esi
je 0x40d57e
mov eax, dword [esi]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test esi, esi
jne 0x40d5ae
push 0xa4
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40d5ae
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
lea ecx, [esi + 0xc]
mov dword [esi], vtable.rg_n33033::rg_n33367.0
call fcn.004110b0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d680
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c6b8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x45bde8], 0xa4
jl 0x40d6e0
push 0x45bdec
call fcn.004296e0
mov edi, dword [0x45bde4]
add esp, 4
test edi, edi
je 0x40d6d2
mov eax, dword [edi]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test edi, edi
jne 0x40d702
push 0xa4
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x40d702
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov dword [edi], vtable.CVolObject.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov byte [ebp - 4], 1
lea ecx, [edi + 0xc]
mov dword [edi], vtable.rg_n33033::rg_n33367.0
call fcn.004110b0
mov byte [ebp - 4], 3
lea ecx, [edi + 0xc]
mov dword [edi], vtable.rg_n33033::rg_n33367.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [edi + 0xc]
call dword [eax + 0x44]
lea eax, [ebx + 0xc]
push eax
lea ecx, [edi + 0xc]
call fcn.0040d350
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40dad0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439e0d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x45bde8], 0x168
jl 0x40db2b
push 0x45bdec
call fcn.004296e0
mov ecx, dword [0x45bde4]
add esp, 4
test ecx, ecx
je 0x40db1d
mov eax, dword [ecx]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test ecx, ecx
jne 0x40db4d
push 0x168
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40db4d
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040e000
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40dce0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c7c5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x45bde8], 0x168
jl 0x40dd3f
push 0x45bdec
call fcn.004296e0
mov esi, dword [0x45bde4]
add esp, 4
test esi, esi
je 0x40dd31
mov eax, dword [esi]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test esi, esi
jne 0x40dd61
push 0x168
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40dd61
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040e000
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n33033::rg_n33034.0
call fcn.0040de60
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412830
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d1ed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x45bde8], 0x10
jl 0x412888
push 0x45bdec
call fcn.004296e0
mov ecx, dword [0x45bde4]
add esp, 4
test ecx, ecx
je 0x41287a
mov eax, dword [ecx]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test ecx, ecx
jne 0x4128a7
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4128a7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n52::rg_n2597.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x412990
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d235
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x45bde8], 0x10
jl 0x4129eb
push 0x45bdec
call fcn.004296e0
mov ecx, dword [0x45bde4]
add esp, 4
test ecx, ecx
je 0x4129dd
mov eax, dword [ecx]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test ecx, ecx
jne 0x412a0a
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x412a0a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n52::rg_n2597.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n52::rg_n2597.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412d10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d1ed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x45bde8], 0x10
jl 0x412d68
push 0x45bdec
call fcn.004296e0
mov ecx, dword [0x45bde4]
add esp, 4
test ecx, ecx
je 0x412d5a
mov eax, dword [ecx]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test ecx, ecx
jne 0x412d87
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x412d87
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n52::rg_n2601.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x412e60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d235
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x45bde8], 0x10
jl 0x412ebb
push 0x45bdec
call fcn.004296e0
mov ecx, dword [0x45bde4]
add esp, 4
test ecx, ecx
je 0x412ead
mov eax, dword [ecx]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test ecx, ecx
jne 0x412eda
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x412eda
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n52::rg_n2601.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n52::rg_n2601.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret