joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408860
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587355
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5f2000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5fbae8], 0x10
jl 0x4088bc
push 0x5fbaec
call fcn.00414190
mov esi, dword [0x5fbae4]
add esp, 4
test esi, esi
je 0x4088ae
mov eax, dword [esi]
mov dword [0x5fbae4], eax
mov dword [0x5fbaec], 1
test esi, esi
jne 0x4088d3
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x408931
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040a100
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolMemoryInputStream.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x408908
mov ecx, edi
call fcn.0040f770
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x408914
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056d8ab
int3

Function at 0x408cd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587475
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5f2000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5fbae8], 0x10
jl 0x408d28
push 0x5fbaec
call fcn.00414190
mov ecx, dword [0x5fbae4]
add esp, 4
test ecx, ecx
je 0x408d1a
mov eax, dword [ecx]
mov dword [0x5fbae4], eax
mov dword [0x5fbaec], 1
test ecx, ecx
jne 0x408d3f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x408d9a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseStream.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.CVolBaseInputStream.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056d8ab
int3
Function at 0x408db0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5874cd
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5f2000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5fbae8], 0x10
jl 0x408e0c
push 0x5fbaec
call fcn.00414190
mov esi, dword [0x5fbae4]
add esp, 4
test esi, esi
je 0x408dfe
mov eax, dword [esi]
mov dword [0x5fbae4], eax
mov dword [0x5fbaec], 1
test esi, esi
jne 0x408e27
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x408eb7
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolBaseStream.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.CVolBaseInputStream.0
mov byte [ebp - 4], 4
mov dword [esi], vtable.CVolBaseInputStream.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x408e8e
mov ecx, edi
call fcn.0040f770
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x408e9a
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056d8ab
int3

Function at 0x409270
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5875dd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5f2000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5fbae8], 0x10
jl 0x4092c8
push 0x5fbaec
call fcn.00414190
mov ecx, dword [0x5fbae4]
add esp, 4
test ecx, ecx
je 0x4092ba
mov eax, dword [ecx]
mov dword [0x5fbae4], eax
mov dword [0x5fbaec], 1
test ecx, ecx
jne 0x4092df
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x409330
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseStream.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056d8ab
int3
Function at 0x409340
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587625
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5f2000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5fbae8], 0x10
jl 0x40939c
push 0x5fbaec
call fcn.00414190
mov esi, dword [0x5fbae4]
add esp, 4
test esi, esi
je 0x40938e
mov eax, dword [esi]
mov dword [0x5fbae4], eax
mov dword [0x5fbaec], 1
test esi, esi
jne 0x4093b7
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40943d
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolBaseStream.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.CVolBaseStream.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x409414
mov ecx, edi
call fcn.0040f770
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x409420
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056d8ab
int3
Function at 0x40a100
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587908
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x5f2000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov dword [esi], vtable.CVolBaseStream.0
mov dword [ebp - 4], 2
mov dword [esi], vtable.CVolBaseInputStream.0
mov dword [ebp - 4], 3
mov dword [esi], vtable.CVolMemoryInputStream.0
cmp dword [0x5fbae8], 0x44
jl 0x40a1af
push 0x5fbaec
call fcn.00414190
mov ecx, dword [0x5fbae4]
add esp, 4
test ecx, ecx
je 0x40a1a1
mov eax, dword [ecx]
mov dword [0x5fbae4], eax
mov dword [0x5fbaec], 1
test ecx, ecx
jne 0x40a1ca
push 0x44
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40a29f
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 4
mov dword [ecx], vtable.CRefObject.0
mov dword [ecx + 4], 1
mov byte [ebp - 4], 5
mov dword [ecx], vtable.CVBaseStream.0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 6
mov dword [ecx + 0xc], 0
mov dword [ecx], vtable.CVBaseInputStream.0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 7
lea eax, [ecx + 0x28]
mov dword [ecx], vtable.CVMemoryInputStream.0
mov dword [ebp - 0x18], eax
mov dword [eax], vtable.CVolObject.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 8
mov dword [eax], vtable.CVolMem.0
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x18], 0x40
mov byte [ebp - 4], 9
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x20], 0
mov byte [ebp - 4], 3
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056d8ab
int3

Function at 0x40a330
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586d45
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5f2000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5fbae8], 0xc
jl 0x40a388
push 0x5fbaec
call fcn.00414190
mov ecx, dword [0x5fbae4]
add esp, 4
test ecx, ecx
je 0x40a37a
mov eax, dword [ecx]
mov dword [0x5fbae4], eax
mov dword [0x5fbaec], 1
test ecx, ecx
jne 0x40a39f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40a3df
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056d8ab
int3
Function at 0x40a3f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58794d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5f2000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5fbae8], 0xc
jl 0x40a44b
push 0x5fbaec
call fcn.00414190
mov ecx, dword [0x5fbae4]
add esp, 4
test ecx, ecx
je 0x40a43d
mov eax, dword [ecx]
mov dword [0x5fbae4], eax
mov dword [0x5fbaec], 1
test ecx, ecx
jne 0x40a462
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40a4b9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056d8ab
int3

Function at 0x40a870
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586d45
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5f2000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5fbae8], 0x10
jl 0x40a8c8
push 0x5fbaec
call fcn.00414190
mov ecx, dword [0x5fbae4]
add esp, 4
test ecx, ecx
je 0x40a8ba
mov eax, dword [ecx]
mov dword [0x5fbae4], eax
mov dword [0x5fbaec], 1
test ecx, ecx
jne 0x40a8df
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40a926
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056d8ab
int3
Function at 0x40a930
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587a2d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5f2000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5fbae8], 0x10
jl 0x40a98c
push 0x5fbaec
call fcn.00414190
mov esi, dword [0x5fbae4]
add esp, 4
test esi, esi
je 0x40a97e
mov eax, dword [esi]
mov dword [0x5fbae4], eax
mov dword [0x5fbaec], 1
test esi, esi
jne 0x40a9a3
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40aa1f
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolRefObject.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x40a9f6
mov ecx, edi
call fcn.0040f770
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40aa02
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056d8ab
int3

Function at 0x40b0a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586fdd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5f2000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5fbae8], 0xc
jl 0x40b0f8
push 0x5fbaec
call fcn.00414190
mov ecx, dword [0x5fbae4]
add esp, 4
test ecx, ecx
je 0x40b0ea
mov eax, dword [ecx]
mov dword [0x5fbae4], eax
mov dword [0x5fbaec], 1
test ecx, ecx
jne 0x40b10f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40b15f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5fbb10], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056d8ab
int3
Function at 0x40b1f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587025
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5f2000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5fbae8], 0xc
jl 0x40b24b
push 0x5fbaec
call fcn.00414190
mov ecx, dword [0x5fbae4]
add esp, 4
test ecx, ecx
je 0x40b23d
mov eax, dword [ecx]
mov dword [0x5fbae4], eax
mov dword [0x5fbaec], 1
test ecx, ecx
jne 0x40b262
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40b2c9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5fbb10], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056d8ab
int3

Function at 0x40b580
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587c35
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5f2000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5fbae8], 0xc
jl 0x40b5d8
push 0x5fbaec
call fcn.00414190
mov ecx, dword [0x5fbae4]
add esp, 4
test ecx, ecx
je 0x40b5ca
mov eax, dword [ecx]
mov dword [0x5fbae4], eax
mov dword [0x5fbaec], 1
test ecx, ecx
jne 0x40b5ef
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40b649
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5fbb10], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n7771.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056d8ab
int3
Function at 0x40b6e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587c8d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5f2000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5fbae8], 0xc
jl 0x40b73b
push 0x5fbaec
call fcn.00414190
mov ecx, dword [0x5fbae4]
add esp, 4
test ecx, ecx
je 0x40b72d
mov eax, dword [ecx]
mov dword [0x5fbae4], eax
mov dword [0x5fbaec], 1
test ecx, ecx
jne 0x40b752
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40b7c3
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5fbb10], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n7771.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n1::rg_n7771.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056d8ab
int3
Function at 0x40b9a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edi
call fcn.0041ee45
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 8
push eax
mov dword [ebp - 0x14], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
call fcn.0041f3b1
add esp, 4
mov ecx, edi
call fcn.00420fbb
call fcn.00422470
mov eax, dword [eax + 0x40]
test eax, eax
je 0x40ba03
mov dword [eax + 0x28], 0
mov dword [eax + 0x38], 2
mov dword [eax + 0x2c], 1
mov dword [eax + 0x3c], 0xffffffff
call fcn.0040cb00
mov dword [ebp - 0x10], eax
call fcn.0056d5a7
mov esi, dword [eax]
call fcn.0056d5a1
mov ecx, dword [edi + 0x44]
mov edx, dword [eax]
mov dword [0x5fbbcc], ecx
mov dword [0x5fbbd0], edx
mov dword [0x5fbbd4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 2
push 0
mov dword [0x5fbbd8], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
xor ecx, ecx
test eax, eax
setns cl
mov dword [0x5fbb14], ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push str.SHCore.dll
mov edi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40baa2
push str.GetDpiForMonitor
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40ba99
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 2
push edi
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push eax
call esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40bac9
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 4]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mov eax, dword [ebp - 0x10]
movsd xmm0, qword [0x5cfb10]
divsd xmm1, qword [0x5cfb18]
maxsd xmm0, xmm1
movsd qword [0x5fbb18], xmm0
mov eax, dword [eax]
call eax
mov dword [0x5fbb10], eax
mov esi, dword [eax]
call fcn.0040beb0
mov ecx, dword [0x5fbb10]
push eax
mov eax, dword [esi + 0x34]
call eax
test eax, eax
je 0x40bb59
mov esi, dword [0x5fbb10]
mov edi, dword [esi]
call fcn.0040b450
push eax
mov eax, dword [edi + 0x34]
mov ecx, esi
call eax
mov esi, dword [ebp - 8]
test eax, eax
je 0x40bb37
mov eax, dword [0x5fbb10]
mov dword [esi + 0x118], eax
call fcn.0040cf80
test eax, eax
je 0x40bb51
cmp dword [esi + 0x20], 0
je 0x40bb51
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x5fbb10]
mov eax, dword [ecx]
call dword [eax + 0x30]
push 0xffffffffffffffff
call fcn.0056d8ab
int3
Function at 0x40bdf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586d45
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5f2000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5fbae8], 0xc
jl 0x40be48
push 0x5fbaec
call fcn.00414190
mov ecx, dword [0x5fbae4]
add esp, 4
test ecx, ecx
je 0x40be3a
mov eax, dword [ecx]
mov dword [0x5fbae4], eax
mov dword [0x5fbaec], 1
test ecx, ecx
jne 0x40be5f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40bea5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5fbb10], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056d8ab
int3

Function at 0x40c280
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586bfd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5f2000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5fbae8], 0x20
jl 0x40c2d8
push 0x5fbaec
call fcn.00414190
mov ecx, dword [0x5fbae4]
add esp, 4
test ecx, ecx
je 0x40c2ca
mov eax, dword [ecx]
mov dword [0x5fbae4], eax
mov dword [0x5fbaec], 1
test ecx, ecx
jne 0x40c2ef
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40c314
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040c6e0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056d8ab
int3