joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4093d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edi
call fcn.00418286
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 8
push eax
mov dword [ebp - 0x14], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
call fcn.004187dc
add esp, 4
mov ecx, edi
call fcn.0041a455
call fcn.0041b93f
mov eax, dword [eax + 0x40]
test eax, eax
je 0x409433
mov dword [eax + 0x28], 0
mov dword [eax + 0x38], 2
mov dword [eax + 0x2c], 1
mov dword [eax + 0x3c], 0xffffffff
call fcn.0040acb0
mov dword [ebp - 0x10], eax
call fcn.00565fa7
mov esi, dword [eax]
call fcn.00565fa1
mov ecx, dword [edi + 0x44]
mov edx, dword [eax]
mov dword [0x5f2a6c], ecx
mov dword [0x5f2a70], edx
mov dword [0x5f2a74], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 2
push 0
mov dword [0x5f2a78], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
xor ecx, ecx
test eax, eax
setns cl
mov dword [0x5f29b4], ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push str.SHCore.dll
mov edi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4094d2
push str.GetDpiForMonitor
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4094c9
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 2
push edi
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push eax
call esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4094f9
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 4]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mov eax, dword [ebp - 0x10]
movsd xmm0, qword [0x5c7760]
divsd xmm1, qword [0x5c7768]
maxsd xmm0, xmm1
movsd qword [0x5f29b8], xmm0
mov eax, dword [eax]
call eax
mov dword [0x5f29b0], eax
mov esi, dword [eax]
call fcn.004098f0
mov ecx, dword [0x5f29b0]
push eax
mov eax, dword [esi + 0x34]
call eax
test eax, eax
je 0x409589
mov esi, dword [0x5f29b0]
mov edi, dword [esi]
call fcn.00408e80
push eax
mov eax, dword [edi + 0x34]
mov ecx, esi
call eax
mov esi, dword [ebp - 8]
test eax, eax
je 0x409567
mov eax, dword [0x5f29b0]
mov dword [esi + 0x118], eax
call fcn.0040b130
test eax, eax
je 0x409581
cmp dword [esi + 0x20], 0
je 0x409581
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x5f29b0]
mov eax, dword [ecx]
call dword [eax + 0x30]
push 0xffffffffffffffff
call fcn.00566268
int3
Function at 0x409830
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57eb85
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f2988], 0xc
jl 0x409888
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x40987a
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x40989f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4098e5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f29b0], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3

Function at 0x409c80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e5dd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f2988], 0x2c
jl 0x409cd8
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x409cca
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x409cef
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x409d14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040a240
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3
Function at 0x409db0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f3f5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x5f2988], 0x2c
jl 0x409e0d
push 0x5f298c
call fcn.00414110
mov edi, dword [0x5f2984]
add esp, 4
test edi, edi
je 0x409dff
mov eax, dword [edi]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test edi, edi
jne 0x409e24
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x409e81
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.0040a240
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.00407110
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3

Function at 0x40a430
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e5dd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f2988], 0x20
jl 0x40a488
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x40a47a
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x40a49f
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40a4c4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040a890
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3
Function at 0x40a550
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f545
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5f2988], 0x20
jl 0x40a5ac
push 0x5f298c
call fcn.00414110
mov esi, dword [0x5f2984]
add esp, 4
test esi, esi
je 0x40a59e
mov eax, dword [esi]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test esi, esi
jne 0x40a5c3
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40a621
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040a890
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n1::rg_n7484.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x40a5f8
mov ecx, edi
call fcn.0040f5a0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40a604
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3

Function at 0x40a890
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f626
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CVolObject.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [edi], vtable.CVolRefObject.0
mov dword [edi + 0xc], 0
mov dword [ebp - 4], 1
mov dword [edi], vtable.rg_n1::rg_n7484.0
mov dword [edi + 0x10], 1
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov byte [ebp - 4], 2
cmp dword [0x5f2988], 0x28
jl 0x40a947
push 0x5f298c
call fcn.00414110
mov ebx, dword [0x5f2984]
add esp, 4
test ebx, ebx
je 0x40a939
mov eax, dword [ebx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ebx, ebx
jne 0x40a95e
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x40a9db
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 3
mov dword [ebx], vtable.CRefObject.0
mov dword [ebx + 4], 1
mov byte [ebp - 4], 4
lea esi, [ebx + 8]
push 0
push 0
push 0
mov dword [ebx], vtable.CRefObjectWithData_class_CVolThread_.0
mov dword [ebp - 0x18], esi
push 0
mov dword [esi], vtable.CVolThread.0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 5
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov byte [ebp - 4], 2
mov dword [edi + 0xc], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3
Function at 0x40ade0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f115
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f2988], 0xc
jl 0x40ae38
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x40ae2a
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x40ae4f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40aea9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f29b0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7792.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n42083.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3

Function at 0x40af40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f16d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f2988], 0xc
jl 0x40af9b
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x40af8d
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x40afb2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40b023
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f29b0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7792.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n42083.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n::rg_n42083.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3
Function at 0x40bb60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e5dd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f2988], 0x2c
jl 0x40bbb8
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x40bbaa
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x40bbcf
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40bbf4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040bdd0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3

Function at 0x40bc00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f3f5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x5f2988], 0x2c
jl 0x40bc5d
push 0x5f298c
call fcn.00414110
mov edi, dword [0x5f2984]
add esp, 4
test edi, edi
je 0x40bc4f
mov eax, dword [edi]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test edi, edi
jne 0x40bc74
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40bcd1
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.0040bdd0
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CU8String.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.00407110
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3
Function at 0x40c010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f926
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push esi
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 8
mov dword [ebp - 0x10], 0
mov ecx, 0x5f2990
call fcn.00411ea0
test eax, eax
jne 0x40c05e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.0040a240
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], 0
test eax, eax
je 0x40c089
push eax
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x48]
call dword [eax + 0xc]
push str.BE93FFFFFB5FB8BC3A8BEF2020FBEC5D4E6C2F1485326F6E3273346E71D2650F89B0E9AA2EC80FBC19E84C82E9D37F0B77025EC9B9BC92883C9C540375957365806745A3D0207FC2F43AC3509A9A9780F67926DC8EA05532362E59BC0AC1FAD98D2C40951A1D32768D998F6AAA31D882E6FE13A72EF61DC662612697EE35CD8C44862C2AF9C651623E0C4ECCE17E8BECEB91A955B7CB2C85E96BB43EEDB67D6092CA8368F3FBBDBBDF86FAAD1504DB445138F90CA5D78BBB0C8F609C509B2685E01A70B791D8DF59BC4BACA36A785BE730C53C6E0C4E126C7E2D1D652DA1FACEDF1CB213D05509B00AD9F11BC3772E6128C4A326BCF121833B3877F1C7CCB099C79019974E502355B17D500EA677B65029BBB7E24DFC9DEBB0D92615C368CC591982C355B7EA368AA6DBF73636E8F5160C253687B03913DA065049C173
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
call fcn.00413840
push ecx
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x2c]
call fcn.0040b570
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00409ef0
xor edx, edx
lea ecx, [ebp - 0x2c]
call fcn.0040c120
mov ecx, 1
mov esi, eax
mov dword [ebp - 0x10], ecx
and ecx, 0xfffffffe
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00407570
cmp esi, 1
jne 0x40c100
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d7d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57fdb5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f2988], 0x2c
jl 0x40d828
push 0x5f298c
call fcn.00414110
mov edx, dword [0x5f2984]
add esp, 4
test edx, edx
je 0x40d81a
mov eax, dword [edx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test edx, edx
jne 0x40d83f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40d872
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040a240
mov byte [ebp - 4], 1
mov dword [edx], vtable.CWConstString.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3

Function at 0x40d880
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57fdfd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x5f2988], 0x2c
jl 0x40d8dd
push 0x5f298c
call fcn.00414110
mov edi, dword [0x5f2984]
add esp, 4
test edi, edi
je 0x40d8cf
mov eax, dword [edi]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test edi, edi
jne 0x40d8f4
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40d95b
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.0040a240
mov byte [ebp - 4], 1
mov dword [edi], vtable.CWConstString.0
mov byte [ebp - 4], 2
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWConstString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.00407110
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3
Function at 0x40f7b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e5dd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f2988], 0x28
jl 0x40f808
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x40f7fa
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x40f81f
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40f845
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push ecx
call fcn.0040fb50
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3

Function at 0x40f920
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x580345
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5f2988], 0x28
jl 0x40f97c
push 0x5f298c
call fcn.00414110
mov esi, dword [0x5f2984]
add esp, 4
test esi, esi
je 0x40f96e
mov eax, dword [esi]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test esi, esi
jne 0x40f993
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40f9d1
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push ecx
mov ecx, esi
call fcn.0040fb50
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.CVolObjectArray.0
call fcn.0040fac0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3

Function at 0x40ff80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x580510
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f2988], 0x3c
jl 0x40ffd8
push 0x5f298c
call fcn.00414110
mov edx, dword [0x5f2984]
add esp, 4
test edx, edx
je 0x40ffca
mov eax, dword [edx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test edx, edx
jne 0x40ffef
push 0x3c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x410042
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov dword [edx], vtable.CVolObject.0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [ebp - 4], 1
lea ecx, [edx + 0x10]
mov dword [edx], vtable.CVolException.0
call fcn.0040a240
mov byte [ebp - 4], 2
mov dword [edx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3