joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432220
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x499515
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x4c51b8], 0x160
jl 0x43227f
push 0x4c51bc
call fcn.004478d0
mov esi, dword [0x4c51b4]
add esp, 4
test esi, esi
je 0x432271
mov eax, dword [esi]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test esi, esi
jne 0x432299
push 0x160
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4322e0
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.004366f0
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_volcano_WTLJieMian_base::rg_TuXingAnNiu.1.0
mov dword [esi + method.rg_volcano_WTLJieMian_base::rg_button1.virtual_0], vtable.rg_volcano_WTLJieMian_base::rg_TuXingAnNiu.0
call fcn.0041ef70
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3

Function at 0x4324f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490d7d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4c51b8], 0x158
jl 0x43254b
push 0x4c51bc
call fcn.004478d0
mov ecx, dword [0x4c51b4]
add esp, 4
test ecx, ecx
je 0x43253d
mov eax, dword [ecx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test ecx, ecx
jne 0x432565
push 0x158
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x43258a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00436250
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3
Function at 0x432630
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4995d5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x4c51b8], 0x158
jl 0x43268f
push 0x4c51bc
call fcn.004478d0
mov esi, dword [0x4c51b4]
add esp, 4
test esi, esi
je 0x432681
mov eax, dword [esi]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test esi, esi
jne 0x4326a9
push 0x158
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4326f0
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00436250
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_volcano_WTLJieMian_base::rg_WaiXingKuang.1.0
mov dword [esi + method.rg_volcano_app::rg_my_main_window.1.virtual_0], vtable.rg_volcano_WTLJieMian_base::rg_WaiXingKuang.0
call fcn.0041ef70
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3

Function at 0x432970
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490d7d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4c51b8], 0x160
jl 0x4329cb
push 0x4c51bc
call fcn.004478d0
mov ecx, dword [0x4c51b4]
add esp, 4
test ecx, ecx
je 0x4329bd
mov eax, dword [ecx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test ecx, ecx
jne 0x4329e5
push 0x160
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x432a0a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00435740
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3
Function at 0x432ab0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4996a5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x4c51b8], 0x160
jl 0x432b0f
push 0x4c51bc
call fcn.004478d0
mov esi, dword [0x4c51b4]
add esp, 4
test esi, esi
je 0x432b01
mov eax, dword [esi]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test esi, esi
jne 0x432b29
push 0x160
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x432b70
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00435740
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_volcano_WTLJieMian_base::rg_label.1.0
mov dword [esi + method.rg_volcano_WTLJieMian_base::rg_button1.virtual_0], vtable.rg_volcano_WTLJieMian_base::rg_label.0
call fcn.0041ef70
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3

Function at 0x432ea0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490d7d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4c51b8], 0x160
jl 0x432efb
push 0x4c51bc
call fcn.004478d0
mov ecx, dword [0x4c51b4]
add esp, 4
test ecx, ecx
je 0x432eed
mov eax, dword [ecx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test ecx, ecx
jne 0x432f15
push 0x160
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x432f3a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00435440
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3
Function at 0x432fe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x499765
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x4c51b8], 0x160
jl 0x43303f
push 0x4c51bc
call fcn.004478d0
mov esi, dword [0x4c51b4]
add esp, 4
test esi, esi
je 0x433031
mov eax, dword [esi]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test esi, esi
jne 0x433059
push 0x160
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4330a0
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00435440
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_volcano_WTLJieMian_base::rg_button1.1.0
mov dword [esi + method.rg_volcano_WTLJieMian_base::rg_button1.virtual_0], vtable.rg_volcano_WTLJieMian_base::rg_button1.0
call fcn.0041ef70
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3

Function at 0x4332b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490d7d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4c51b8], 0x158
jl 0x43330b
push 0x4c51bc
call fcn.004478d0
mov ecx, dword [0x4c51b4]
add esp, 4
test ecx, ecx
je 0x4332fd
mov eax, dword [ecx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test ecx, ecx
jne 0x433325
push 0x158
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x43334a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00435120
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3
Function at 0x4333f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x499825
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x4c51b8], 0x158
jl 0x43344f
push 0x4c51bc
call fcn.004478d0
mov esi, dword [0x4c51b4]
add esp, 4
test esi, esi
je 0x433441
mov eax, dword [esi]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test esi, esi
jne 0x433469
push 0x158
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4334b0
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00435120
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_volcano_WTLJieMian_base::rg_FenZuKuang.1.0
mov dword [esi + method.rg_volcano_app::rg_my_main_window.1.virtual_0], vtable.rg_volcano_WTLJieMian_base::rg_FenZuKuang.0
call fcn.0041ef70
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3

Function at 0x433650
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4998b5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x4c51b8], 0x27c
jl 0x4336af
push 0x4c51bc
call fcn.004478d0
mov esi, dword [0x4c51b4]
add esp, 4
test esi, esi
je 0x4336a1
mov eax, dword [esi]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test esi, esi
jne 0x4336c9
push 0x27c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x43371a
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.004345b0
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_volcano_WTLJieMian_base::CVolWinForm.0
mov dword [esi + method.rg_volcano_app::rg_my_main_window.1.virtual_0], vtable.rg_volcano_WTLJieMian_base::CVolWinForm.2.0
mov dword [esi + method.rg_volcano_app::rg_my_main_window.virtual_0], vtable.rg_volcano_WTLJieMian_base::CVolWinForm.1.0
call fcn.0041ef70
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3
Function at 0x433900
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490d7d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4c51b8], 0x5c
jl 0x433958
push 0x4c51bc
call fcn.004478d0
mov ecx, dword [0x4c51b4]
add esp, 4
test ecx, ecx
je 0x43394a
mov eax, dword [ecx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test ecx, ecx
jne 0x43396f
push 0x5c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x433994
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00433c90
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3

Function at 0x433a20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x499955
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x4c51b8], 0x5c
jl 0x433a7c
push 0x4c51bc
call fcn.004478d0
mov esi, dword [0x4c51b4]
add esp, 4
test esi, esi
je 0x433a6e
mov eax, dword [esi]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test esi, esi
jne 0x433a93
push 0x5c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x433ad0
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00433c90
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_volcano_WTLJieMian_base::rg_ChuangKouWeiZhiXianZhiXinXi.0
call fcn.00433be0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3
Function at 0x434970
Capabilities:
Inspect load icon resource
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x499ec0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
cmp dword [0x4c51b8], 0x4c
jl 0x4349cf
push 0x4c51bc
call fcn.004478d0
mov edi, dword [0x4c51b4]
add esp, 4
test edi, edi
je 0x4349c1
mov eax, dword [edi]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test edi, edi
jne 0x4349ea
push 0x4c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x434b8b
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
push 0xd8
call fcn.00477b22
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.00453140
mov byte [ebp - 4], 2
lea ecx, [esi + 0x98]
mov dword [esi], vtable.CVWnd_WinForm.0
call fcn.00405e70
mov byte [ebp - 4], 3
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x7c], 1
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 1
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 1
mov eax, dword [0x4c529c]
test eax, eax
jne 0x434ac0
push 0x1c
lea eax, [ebp - 0x34]
push eax
push 0x444510
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x30]
push 0x64
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], 1
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc8], 0
mov dword [esi + 0xcc], 0
mov dword [esi + 0xd0], 0
mov dword [esi + 0xd4], 0
mov byte [ebp - 4], 0
lea edx, [esi + 4]
mov dword [edi], vtable.CRefObject.0
mov dword [edi + 4], 1
mov byte [ebp - 4], 4
lea ecx, [edi + 8]
mov dword [edi], vtable.CWtlWndObject.0
call fcn.00405e70
mov byte [ebp - 4], 5
mov dword [edi + 0x44], edx
mov dword [edi + 0x34], 0x14000000
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov byte [ebp - 4], 6
mov dword [edi], vtable.CWtlWndObjectImpl_class_CVWnd_WinForm_.0
mov dword [edi + 0x48], esi
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x434b77
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3
Function at 0x435120
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x499fd7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.0041f0a0
mov dword [ebp - 4], 0
mov dword [edi], vtable.rg_volcano_WTLJieMian_base::CVolWinContainer.0
mov dword [edi + 0x14c], 0
mov dword [edi + 0x150], 0
mov dword [ebp - 4], 1
mov dword [edi + method.IContainerEventListener.virtual_0], vtable.IButtonEventListener.0
mov dword [edi], vtable.rg_volcano_WTLJieMian_base::rg_FenZuKuang.1.0
mov dword [edi + method.rg_volcano_app::rg_my_main_window.1.virtual_0], vtable.rg_volcano_WTLJieMian_base::rg_FenZuKuang.0
cmp dword [0x4c51b8], 0x4c
jl 0x4351c9
push 0x4c51bc
call fcn.004478d0
mov esi, dword [0x4c51b4]
add esp, 4
test esi, esi
je 0x4351bb
mov eax, dword [esi]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test esi, esi
jne 0x4351e4
push 0x4c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x435298
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
push 0x44
call fcn.00477b22
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
mov ecx, eax
call fcn.00452260
mov edx, eax
mov byte [ebp - 4], 2
test edx, edx
je 0x435212
lea ebx, [edx + 4]
jmp 0x435214
xor ebx, ebx
mov dword [esi], vtable.CRefObject.0
mov dword [esi + 4], 1
mov byte [ebp - 4], 4
lea ecx, [esi + 8]
mov dword [esi], vtable.CWtlWndObject.0
call fcn.00405e70
mov byte [ebp - 4], 5
mov dword [esi + 0x44], ebx
mov dword [esi + 0x34], 0x14000000
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov byte [ebp - 4], 6
mov dword [esi], vtable.CWtlWndObjectImpl_class_CVWnd_Button_.0
mov dword [esi + 0x48], edx
mov byte [ebp - 4], 1
or dword [esi + 0x34], 0x2007
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x43527a
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [edi + 0xc], esi
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3
Function at 0x435940
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49a166
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x4c51b8], 0x4c
jl 0x43599f
push 0x4c51bc
call fcn.004478d0
mov edi, dword [0x4c51b4]
add esp, 4
test edi, edi
je 0x435991
mov eax, dword [edi]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test edi, edi
jne 0x4359ba
push 0x4c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x435afe
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
push 0x5c
call fcn.00477b22
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 1
lea ecx, [esi + 8]
lea edx, [esi + 4]
mov dword [ebp - 0x18], ecx
mov dword [edx], 0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov byte [ebp - 4], 4
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 0x20], eax
mov byte [ebp - 4], 6
mov dword [esi], vtable.CVWnd_Label.0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x2c], vtable.CVolWindowProcFilters.0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 7
mov dword [esi + 0x54], 0
mov byte [ebp - 4], 8
mov dword [esi + 0x58], 0
mov byte [ebp - 4], 9
mov dword [esi + 0x38], 0xff000000
mov dword [esi + 0x3c], 0xff000000
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 1
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 0
mov dword [edi], vtable.CRefObject.0
mov dword [edi + 4], 1
mov byte [ebp - 4], 0xa
lea ecx, [edi + 8]
mov dword [edi], vtable.CWtlWndObject.0
call fcn.00405e70
mov byte [ebp - 4], 0xb
mov dword [edi + 0x44], edx
mov dword [edi + 0x34], 0x14000000
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov byte [ebp - 4], 0xc
mov dword [edi], vtable.CWtlWndObjectImpl_class_CVWnd_Label_.0
mov dword [edi + 0x48], esi
mov dword [ebp - 4], 0xffffffff
and dword [edi + 0x34], 0xff7fffff
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x435ae9
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [ebx + 0xc], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3
Function at 0x435e60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49a2e7
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
cmp dword [0x4c51b8], 0x4c
jl 0x435ec0
push 0x4c51bc
call fcn.004478d0
mov ebx, dword [0x4c51b4]
add esp, 4
test ebx, ebx
je 0x435eb2
mov eax, dword [ebx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test ebx, ebx
jne 0x435edb
push 0x4c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x4360aa
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
push 0x9c
call fcn.00477b22
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 1
lea ecx, [edi + 8]
lea esi, [edi + 4]
mov dword [ebp - 0x1c], ecx
mov dword [esi], 0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov byte [ebp - 4], 4
mov edx, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 0x20], edx
mov byte [ebp - 4], 6
mov dword [edi], vtable.CVWnd_Edit.0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0xffffffff
mov dword [edi + 0x2c], vtable.CVolWindowProcFilters.0
mov dword [edi + 0x30], 0
mov byte [ebp - 4], 7
mov dword [edi + 0x60], 0
mov byte [ebp - 4], 8
lea ecx, [edi + 0x64]
mov dword [ebp - 0x20], ecx
lea eax, [ecx + 8]
mov dword [ecx + 4], 0
mov dword [ebp - 0x24], eax
mov dword [eax + 0xc], 0
mov byte [ebp - 4], 0xa
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 0xb
mov dword [ecx + 0x20], edx
mov byte [ebp - 4], 0xd
mov dword [ecx], vtable.CEditSpin.0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov byte [ebp - 4], 0xe
mov eax, 0x2a
push 0xffffff
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffff
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov word [edi + 0x50], ax
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0x64
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [edi + 0x60], eax
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 0
mov byte [ebp - 4], 0
mov dword [ebx], vtable.CRefObject.0
mov dword [ebx + 4], 1
mov byte [ebp - 4], 0xf
mov dword [ebx], vtable.CWtlWndObject.0
lea ecx, [ebx + 8]
call fcn.00405e70
mov byte [ebp - 4], 0x10
mov dword [ebx + 0x44], esi
mov dword [ebx + 0x34], 0x14000000
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov byte [ebp - 4], 0x11
mov dword [ebx], vtable.CWtlWndObjectImpl_class_CVWnd_Edit_.0
mov dword [ebx + 0x48], edi
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10]
or dword [ebx + 0x34], 0x10000
or dword [ebx + 0x38], 0x200
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x436095
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3