joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416500
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d718
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov dword [esi], vtable.rg_n52::rg_n4981.0
cmp dword [0x45bde8], 0x18
jl 0x416595
push 0x45bdec
call fcn.004296e0
mov ecx, dword [0x45bde4]
add esp, 4
test ecx, ecx
je 0x416587
mov eax, dword [ecx]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test ecx, ecx
jne 0x4165b4
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4165b4
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CRefObject.0
mov dword [ecx + 4], 1
mov byte [ebp - 4], 3
lea eax, [ecx + 8]
mov dword [ecx], vtable.CRefObjectWithData_class_rg_n52::rg_n4977_.0
mov dword [ebp - 0x18], eax
mov dword [eax], vtable.CVolObject.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 4
mov dword [eax], vtable.rg_n52::rg_n4977.0
mov dword [eax + 0xc], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x416860
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439e0d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x45bde8], 0x10
jl 0x4168b8
push 0x45bdec
call fcn.004296e0
mov ecx, dword [0x45bde4]
add esp, 4
test ecx, ecx
je 0x4168aa
mov eax, dword [ecx]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test ecx, ecx
jne 0x4168d7
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4168d7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00416b80
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x416980
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d575
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x45bde8], 0x10
jl 0x4169dc
push 0x45bdec
call fcn.004296e0
mov esi, dword [0x45bde4]
add esp, 4
test esi, esi
je 0x4169ce
mov eax, dword [esi]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test esi, esi
jne 0x4169fb
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x4169fb
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00416b80
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n52::rg_n7225.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x416a30
mov ecx, edi
call fcn.00412720
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x416a3c
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x416b80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d7e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CVolObject.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [edi], vtable.CVolRefObject.0
mov dword [edi + 0xc], 0
mov dword [ebp - 4], 1
mov dword [edi], vtable.rg_n52::rg_n7225.0
cmp dword [0x45bde8], 0x20
jl 0x416c16
push 0x45bdec
call fcn.004296e0
mov esi, dword [0x45bde4]
add esp, 4
test esi, esi
je 0x416c08
mov eax, dword [esi]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test esi, esi
jne 0x416c35
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x416c35
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
mov dword [esi], vtable.CRefObject.0
mov dword [esi + 4], 1
mov byte [ebp - 4], 3
lea eax, [esi + 8]
push eax
mov dword [esi], vtable.CRefObjectWithData_class_CMMutex_.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 1
mov dword [edi + 0xc], esi
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x416e90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d1ed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x45bde8], 0xc
jl 0x416ee8
push 0x45bdec
call fcn.004296e0
mov ecx, dword [0x45bde4]
add esp, 4
test ecx, ecx
je 0x416eda
mov eax, dword [ecx]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test ecx, ecx
jne 0x416f07
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x416f07
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x45be10], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n52::rg_n7855.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x416fe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d235
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x45bde8], 0xc
jl 0x41703b
push 0x45bdec
call fcn.004296e0
mov ecx, dword [0x45bde4]
add esp, 4
test ecx, ecx
je 0x41702d
mov eax, dword [ecx]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test ecx, ecx
jne 0x41705a
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x41705a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x45be10], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n52::rg_n7855.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n52::rg_n7855.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4173b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d915
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x45bde8], 0xc
jl 0x417408
push 0x45bdec
call fcn.004296e0
mov ecx, dword [0x45bde4]
add esp, 4
test ecx, ecx
je 0x4173fa
mov eax, dword [ecx]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test ecx, ecx
jne 0x417427
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x417427
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x45be10], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n52::rg_n7855.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n52::rg_n7865.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x417510
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d96d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x45bde8], 0xc
jl 0x41756b
push 0x45bdec
call fcn.004296e0
mov ecx, dword [0x45bde4]
add esp, 4
test ecx, ecx
je 0x41755d
mov eax, dword [ecx]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test ecx, ecx
jne 0x41758a
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x41758a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x45be10], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n52::rg_n7855.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n52::rg_n7865.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n52::rg_n7865.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x417970
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439e0d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x45bde8], 0xc
jl 0x4179c8
push 0x45bdec
call fcn.004296e0
mov ecx, dword [0x45bde4]
add esp, 4
test ecx, ecx
je 0x4179ba
mov eax, dword [ecx]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test ecx, ecx
jne 0x4179e7
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4179e7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00417ca0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x417a90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43dad5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x45bde8], 0xc
jl 0x417aeb
push 0x45bdec
call fcn.004296e0
mov ecx, dword [0x45bde4]
add esp, 4
test ecx, ecx
je 0x417add
mov eax, dword [ecx]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test ecx, ecx
jne 0x417b0a
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x417b0a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x45be10], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n52::rg_n7855.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n52::rg_n7865.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n::rg_n9.0
mov byte [ebp - 4], 5
mov dword [ecx], vtable.rg_n::rg_n9.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x418270
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a185
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x45bde8], 0xc
jl 0x4182c8
push 0x45bdec
call fcn.004296e0
mov ecx, dword [0x45bde4]
add esp, 4
test ecx, ecx
je 0x4182ba
mov eax, dword [ecx]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test ecx, ecx
jne 0x4182e7
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4182e7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x45be10], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x418450
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43dd26
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x38], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - 0x38], vtable.CVolObject.0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x38], vtable.CVolMem.0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 4], 2
mov edi, dword [edx + 0xc]
test edi, edi
jne 0x4184ec
cmp dword [edx + 0x24], edi
je 0x4185bb
mov edi, dword [edx + 0x1c]
test edi, edi
je 0x4185bb
cmp word [edi], 0
je 0x4185bb
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418500
push 0
push 0
sub ecx, edx
push 0
sar ecx, 1
push 0
lea eax, [ecx + 1]
push eax
push edi
push 0
push 0
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [ebp - 0x2c], 0
mov esi, eax
mov dword [ebp - 0x10], esi
je 0x418544
push esi
lea ecx, [ebp - 0x38]
call fcn.00428ab0
mov esi, eax
mov eax, dword [ebp - 0x10]
jmp 0x41859e
test esi, esi
jne 0x41854d
mov eax, dword [ebp - 0x10]
jmp 0x41859e
mov ebx, dword [ebp - 0x20]
mov eax, 0x40
test ebx, ebx
cmovle ebx, eax
mov eax, esi
cdq
idiv ebx
mov eax, dword [ebp - 0x38]
sub ebx, edx
add ebx, esi
push ebx
mov eax, dword [eax]
cmp eax, method.CWString.virtual_0
jne 0x418588
mov ecx, 0x45bdd8
call fcn.004297c0
mov esi, eax
test esi, esi
jne 0x41858f
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea ecx, [ebp - 0x38]
call eax
mov esi, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], ebx
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], eax
push 0
push 0
push eax
push esi
push dword [ebp - 0x18]
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x4185bb
lea ecx, [eax - 1]
jmp 0x4185c2
mov esi, 0x445ad3
xor ecx, ecx
xor eax, eax
cmp dword [ebp + 8], eax
setne al
add eax, ecx
mov ecx, ebx
push eax
push esi
call fcn.00404450
mov dword [ebp - 0x1c], 1
mov byte [ebp - 4], 0
mov dword [ebp - 0x38], vtable.CVolMem.0
mov dword [ebp - 4], 3
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x418614
mov eax, dword [ebp - 0x38]
push edx
mov eax, dword [eax + 0xc]
cmp eax, fcn.004265e0
jne 0x41860f
mov ecx, 0x45bdd8
call fcn.004298b0
jmp 0x418614
lea ecx, [ebp - 0x38]
call eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 0
mov dword [ebp - 0x38], vtable.CVolObject.0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x418bd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a3b5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x45bde8], 0x23c
jl 0x418c2c
push 0x45bdec
call fcn.004296e0
mov esi, dword [0x45bde4]
add esp, 4
test esi, esi
je 0x418c1e
mov eax, dword [esi]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test esi, esi
jne 0x418c4e
push 0x23c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x418c4e
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
lea eax, [esi + 0xc]
push 0x230
push 0
push eax
mov dword [esi], vtable.rg_n34333::rg_n34393.0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x418d30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43dead
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x45bde8], 0x23c
jl 0x418d8f
push 0x45bdec
call fcn.004296e0
mov esi, dword [0x45bde4]
add esp, 4
test esi, esi
je 0x418d81
mov eax, dword [esi]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test esi, esi
jne 0x418db1
push 0x23c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x418db1
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
lea eax, [esi + 0xc]
push 0x230
push 0
push eax
mov dword [esi], vtable.rg_n34333::rg_n34393.0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov byte [ebp - 4], 2
mov dword [esi], vtable.rg_n34333::rg_n34393.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4190e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439e0d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x45bde8], 0x50
jl 0x419138
push 0x45bdec
call fcn.004296e0
mov ecx, dword [0x45bde4]
add esp, 4
test ecx, ecx
je 0x41912a
mov eax, dword [ecx]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test ecx, ecx
jne 0x419157
push 0x50
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x419157
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00419450
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x419220
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43df65
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x45b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x45bde8], 0x50
jl 0x41927d
push 0x45bdec
call fcn.004296e0
mov edi, dword [0x45bde4]
add esp, 4
test edi, edi
je 0x41926f
mov eax, dword [edi]
mov dword [0x45bde4], eax
mov dword [0x45bdec], 1
test edi, edi
jne 0x41929c
push 0x50
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x41929c
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.00419450
mov byte [ebp - 4], 1
lea ecx, [edi + 0x14]
mov dword [edi], vtable.rg_n34333::rg_n34334.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [edi + 0x14]
call dword [eax + 0x44]
mov eax, dword [ebx + 0x18]
lea ecx, [edi + 0x24]
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [edi + 0x24]
call dword [eax + 0x44]
lea eax, [ebx + 0x24]
push eax
lea ecx, [edi + 0x24]
call fcn.00402f40
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret