joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403450
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439685
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x638e88], 0x150
jl 0x4034ab
push 0x638e8c
call fcn.0041d9d0
mov edx, dword [0x638e84]
add esp, 4
test edx, edx
je 0x40349d
mov eax, dword [edx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test edx, edx
jne 0x4034c5
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x4034f8
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.004027d0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::PictureBoxEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3

Function at 0x403580
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4396cd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x638e88], 0x150
jl 0x4035de
push 0x638e8c
call fcn.0041d9d0
mov edx, dword [0x638e84]
add esp, 4
test edx, edx
je 0x4035d0
mov eax, dword [edx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test edx, edx
jne 0x4035f8
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x403648
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.004027d0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::PictureBoxEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::PictureBoxEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3

Function at 0x403930
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438dbd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x638e88], 0x240
jl 0x40398b
push 0x638e8c
call fcn.0041d9d0
mov ecx, dword [0x638e84]
add esp, 4
test ecx, ecx
je 0x40397d
mov eax, dword [ecx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test ecx, ecx
jne 0x4039a5
push 0x240
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4039ca
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00403c00
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3
Function at 0x403a60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4397e5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x638e88], 0x240
jl 0x403abf
push 0x638e8c
call fcn.0041d9d0
mov esi, dword [0x638e84]
add esp, 4
test esi, esi
je 0x403ab1
mov eax, dword [esi]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test esi, esi
jne 0x403ad9
push 0x240
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x403b20
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00403c00
mov byte [ebp - 4], 1
mov dword [esi], vtable.exui::SuperListboxEx.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3

Function at 0x404220
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439a95
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x638e88], 0x10
jl 0x404278
push 0x638e8c
call fcn.0041d9d0
mov ecx, dword [0x638e84]
add esp, 4
test ecx, ecx
je 0x40426a
mov eax, dword [ecx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test ecx, ecx
jne 0x40428f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4042ea
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2542.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.exui::ExuiProgram.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3
Function at 0x404380
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439aed
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x638e88], 0x10
jl 0x4043dc
push 0x638e8c
call fcn.0041d9d0
mov esi, dword [0x638e84]
add esp, 4
test esi, esi
je 0x4043ce
mov eax, dword [esi]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test esi, esi
jne 0x4043f7
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x404487
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.rg_n1::rg_n2542.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.exui::ExuiProgram.0
mov byte [ebp - 4], 4
mov dword [esi], vtable.exui::ExuiProgram.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x40445e
mov ecx, edi
call fcn.0041a4e0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40446a
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3

Function at 0x404800
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438dbd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x638e88], 0x200
jl 0x40485b
push 0x638e8c
call fcn.0041d9d0
mov ecx, dword [0x638e84]
add esp, 4
test ecx, ecx
je 0x40484d
mov eax, dword [ecx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test ecx, ecx
jne 0x404875
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40489a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00404ad0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3
Function at 0x404930
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439bf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x638e88], 0x200
jl 0x40498f
push 0x638e8c
call fcn.0041d9d0
mov esi, dword [0x638e84]
add esp, 4
test esi, esi
je 0x404981
mov eax, dword [esi]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test esi, esi
jne 0x4049a9
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4049f0
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00404ad0
mov byte [ebp - 4], 1
mov dword [esi], vtable.exui::WindowEx.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3

Function at 0x404f90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439685
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x638e88], 0x150
jl 0x404feb
push 0x638e8c
call fcn.0041d9d0
mov edx, dword [0x638e84]
add esp, 4
test edx, edx
je 0x404fdd
mov eax, dword [edx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test edx, edx
jne 0x405005
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x405038
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.004027d0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::SuperbuttonEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3
Function at 0x4050c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4396cd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x638e88], 0x150
jl 0x40511e
push 0x638e8c
call fcn.0041d9d0
mov edx, dword [0x638e84]
add esp, 4
test edx, edx
je 0x405110
mov eax, dword [edx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test edx, edx
jne 0x405138
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x405188
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.004027d0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::SuperbuttonEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::SuperbuttonEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3

Function at 0x4053a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439685
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x638e88], 0x150
jl 0x4053fb
push 0x638e8c
call fcn.0041d9d0
mov edx, dword [0x638e84]
add esp, 4
test edx, edx
je 0x4053ed
mov eax, dword [edx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test edx, edx
jne 0x405415
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x405448
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.004027d0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::LabelEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3
Function at 0x4054d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4396cd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x638e88], 0x150
jl 0x40552e
push 0x638e8c
call fcn.0041d9d0
mov edx, dword [0x638e84]
add esp, 4
test edx, edx
je 0x405520
mov eax, dword [edx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test edx, edx
jne 0x405548
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x405598
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.004027d0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::LabelEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::LabelEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3

Function at 0x4057b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439ea3
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x638e88], 0x160
jl 0x40580b
push 0x638e8c
call fcn.0041d9d0
mov edx, dword [0x638e84]
add esp, 4
test edx, edx
je 0x4057fd
mov eax, dword [edx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test edx, edx
jne 0x405825
push 0x160
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x405880
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.004027d0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::SliderbarEx.0
mov dword [edx + 0x150], 1
mov dword [edx + 0x154], 0
mov dword [edx + 0x158], 0
mov dword [edx + 0x15c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3
Function at 0x405910
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439eeb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x638e88], 0x160
jl 0x40596e
push 0x638e8c
call fcn.0041d9d0
mov edx, dword [0x638e84]
add esp, 4
test edx, edx
je 0x405960
mov eax, dword [edx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test edx, edx
jne 0x405988
push 0x160
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x405a00
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.004027d0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::SliderbarEx.0
mov dword [edx + 0x150], 1
mov dword [edx + 0x154], 0
mov dword [edx + 0x158], 0
mov dword [edx + 0x15c], 0
mov byte [ebp - 4], 3
mov dword [edx], vtable.exui::SliderbarEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3

Function at 0x405de0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438dbd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x638e88], 0x2118
jl 0x405e3b
push 0x638e8c
call fcn.0041d9d0
mov ecx, dword [0x638e84]
add esp, 4
test ecx, ecx
je 0x405e2d
mov eax, dword [ecx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test ecx, ecx
jne 0x405e55
push 0x2118
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x405e7a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00406660
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3
Function at 0x405f20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439ff5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x638e88], 0x2118
jl 0x405f80
push 0x638e8c
call fcn.0041d9d0
mov esi, dword [0x638e84]
add esp, 4
test esi, esi
je 0x405f72
mov eax, dword [esi]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test esi, esi
jne 0x405f9a
push 0x2118
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x406001
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00406660
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n33261::rg_n33262.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov ebx, dword [edi + 0xc]
test ebx, ebx
je 0x405fcf
mov ecx, ebx
call fcn.0041a4e0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x405fdb
mov eax, dword [ecx]
call dword [eax + 0x20]
push edi
mov ecx, esi
mov dword [esi + 0xc], ebx
call fcn.004077d0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3

Function at 0x4062e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438c75
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x638e88], 0xc
jl 0x406338
push 0x638e8c
call fcn.0041d9d0
mov ecx, dword [0x638e84]
add esp, 4
test ecx, ecx
je 0x40632a
mov eax, dword [ecx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test ecx, ecx
jne 0x40634f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40638f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n33645::rg_n33667.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3
Function at 0x406420
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438cbd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x638e88], 0xc
jl 0x40647b
push 0x638e8c
call fcn.0041d9d0
mov ecx, dword [0x638e84]
add esp, 4
test ecx, ecx
je 0x40646d
mov eax, dword [ecx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test ecx, ecx
jne 0x406492
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4064e9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n33645::rg_n33667.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n33645::rg_n33667.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3
Function at 0x40ab40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ad95
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x638e88], 0x2c
jl 0x40ab98
push 0x638e8c
call fcn.0041d9d0
mov edx, dword [0x638e84]
add esp, 4
test edx, edx
je 0x40ab8a
mov eax, dword [edx]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test edx, edx
jne 0x40abaf
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40abe2
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040be70
mov byte [ebp - 4], 1
mov dword [edx], vtable.CWConstString.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3

Function at 0x40abf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43addd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x63700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x638e88], 0x2c
jl 0x40ac4d
push 0x638e8c
call fcn.0041d9d0
mov edi, dword [0x638e84]
add esp, 4
test edi, edi
je 0x40ac3f
mov eax, dword [edi]
mov dword [0x638e84], eax
mov dword [0x638e8c], 1
test edi, edi
jne 0x40ac64
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40accb
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.0040be70
mov byte [ebp - 4], 1
mov dword [edi], vtable.CWConstString.0
mov byte [ebp - 4], 2
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWConstString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.0040b9c0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00428e70
int3