joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402630
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
mov esi, dword [esp + 0x40]
mov dword [esp], ebx
movzx ebp, bp
call sym._SocketQueue_IsEmpty
test eax, eax
jne 0x402688
test esi, esi
je 0x402660
mov dword [esi], 0
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], ebx
call sym._SocketQueue_Enqueue
test eax, eax
setne al
movzx eax, al
neg eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
cmp eax, 0xffffffff
je 0x4026c8
test esi, esi
je 0x4026b3
mov dword [esi], eax
cmp eax, ebp
je 0x402700
sub ebp, eax
add eax, edi
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
jmp 0x402668
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
lea ecx, [eax - 0x2714]
mov edx, eax
mov eax, 0xffffff92
cmp ecx, 0x3d
ja 0x40267a
movsx eax, byte [edx + 0x405bcc]
cmp eax, 0xffffff94
je 0x40267a
cmp eax, 0xffffff92
je 0x40267a
test eax, eax
jne 0x402656
jmp 0x4026ad
xor eax, eax
jmp 0x40267a
Function at 0x402ec0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push esi
push ebx
sub esp, 0x34
mov dword [esp + 8], 0
mov esi, dword [esp + 0x44]
mov dword [esp + 4], 1
mov dword [esp], 2
call dword [sym.imp.WS2_32.dll_socket]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x402f8d
mov ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0x8004667e
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x402f8d
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_htonl]
sub esp, 4
mov dword [esp + 0x24], eax
mov eax, 2
mov word [esp + 0x20], ax
movzx eax, si
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_htons]
sub esp, 4
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_connect]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x402f80
add esp, 0x34
mov eax, ebx
pop ebx
pop esi
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x402f70
mov ebx, 0xffffffff
add esp, 0x34
mov eax, ebx
pop ebx
pop esi
ret

Function at 0x403170
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push edi
xor edx, edx
xor eax, eax
push esi
push ebx
sub esp, 0x30
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov dword [esp + eax + 0x14], edx
add eax, 4
cmp eax, 0x1c
jb 0x403182
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0x17
call dword [sym.imp.WS2_32.dll_socket]
sub esp, 0xc
mov ebx, eax
cmp eax, 0xffffffff
je 0x403255
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0x8004667e
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x403255
mov eax, dword [esi]
movzx edi, di
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0xc]
mov dword [esp], edi
mov dword [esp + 0x28], eax
mov eax, 0x17
mov word [esp + 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
sub esp, 4
mov word [esp + 0x16], ax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_connect]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x403248
add esp, 0x30
mov eax, ebx
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x40323c
add esp, 0x30
mov ebx, 0xffffffff
mov eax, ebx
pop ebx
pop esi
pop edi
ret
Function at 0x4034a0
Capabilities:
Connect socket

Disassembly:
push esi
push ebx
xor ebx, ebx
sub esp, 0x14
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._ConnectionManager_GetConnectionByIndex
mov dword [esp + 8], 0x10
mov esi, eax
add eax, 0x10
mov dword [esp + 4], eax
mov eax, dword [esi + 8]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_connect]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x4034f0
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4034e0
mov dword [esi + 4], 6
xor ebx, ebx
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret

Function at 0x4046f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, 0x186a0
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
mov ecx, dword [ebx]
test ecx, ecx
jg 0x404775
jmp 0x40485a
mov dword [esp + 4], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
mov esi, eax
cmp eax, 0xffffffff
je 0x404839
mov edi, dword [ebx + 4]
mov eax, ebp
sub eax, edi
cmp esi, eax
jge 0x4047d0
mov ecx, dword [ebx]
cmp esi, ecx
cmovg esi, ecx
add edi, esi
mov eax, edi
mov edx, 0x14f8b589
sub ecx, esi
imul edx
mov eax, edi
mov dword [ebx], ecx
sar eax, 0x1f
sar edx, 0xd
sub edx, eax
imul edx, edx, 0x186a0
sub edi, edx
mov dword [ebx + 4], edi
test ecx, ecx
jle 0x40485a
cmp ecx, 0x64
mov eax, 0x64
mov edx, ebp
cmovg ecx, eax
mov eax, dword [ebx + 4]
sub edx, eax
add eax, dword [ebx + 0xc]
mov dword [esp + 0xc], 0
cmp ecx, edx
jg 0x404710
mov dword [esp + 4], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 8], ecx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
cmp eax, 0xffffffff
je 0x404839
mov ecx, dword [ebx]
mov edi, dword [ebx + 4]
cmp eax, ecx
cmovg eax, ecx
mov esi, eax
add edi, eax
jmp 0x40474b
sub edi, 0x1863c
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
cmp eax, 0xffffffff
je 0x404850
add esi, eax
mov ecx, dword [ebx + 4]
cmp esi, dword [ebx]
mov edx, 0x14f8b589
mov edi, esi
cmovg edi, dword [ebx]
add ecx, edi
mov eax, ecx
imul edx
mov eax, ecx
sar eax, 0x1f
sar edx, 0xd
sub edx, eax
imul edx, edx, 0x186a0
sub ecx, edx
mov dword [ebx + 4], ecx
mov ecx, dword [ebx]
sub ecx, edi
mov dword [ebx], ecx
cmp esi, 0xffffffff
jne 0x40476d
add esp, 0x1c
mov eax, 0xffffff97
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebx]
test ecx, ecx
jg 0x404775
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404b90
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x404bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40b070]
test esi, esi
jle 0x404d10
mov eax, dword [0x40b074]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x404c24
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x404ca7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x404c10
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x404d37
mov eax, dword [0x40b074]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x40b074]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x404d17
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x404ca0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x404cb0
add dword [0x40b070], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40b074]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x404ca0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x404c2e
mov eax, dword [0x40b074]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop
Function at 0x4051f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40b08c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40b084]
sub esp, 4
test ebx, ebx
je 0x405245
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40523e
test esi, esi
je 0x40523e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x405220
mov dword [esp], 0x40b08c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x414d3e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x414d4d
pop dword [ebp - 0x30]
mov eax, 0x414d4d
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x4875fe40
sub dword [ebp - 0x40], 0xfa23b8f5
mov dword [ebp - 0x3c], 0x8760dcb5
sub dword [ebp - 0x3c], 0x552d9070
mov dword [ebp - 0x38], 0x2a5e335e
sub dword [ebp - 0x38], 0xde11ef30
mov dword [ebp - 0x34], 0xba7187df
add dword [ebp - 0x34], 0x458e7821
lea eax, [ebp - 0x40]
push eax
mov eax, 0x6957b83a
add eax, 0x96ea783a
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xb4b3b226
add dword [ebp - 0x40], 0xbfbeb730
mov dword [ebp - 0x3c], 0xaf939cce
sub dword [ebp - 0x3c], 0x6e273b59
mov dword [ebp - 0x38], 0x3b0d9abc
add dword [ebp - 0x38], 0x2861d1b0
mov dword [ebp - 0x34], 0xde61b23d
sub dword [ebp - 0x34], 0xde61b23d
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x19fba53a
add eax, 0xe6468bea
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3d45a
push 0
call eax
mov ecx, 0xde9b7032
sub ecx, 0xde9b2a1d
xor edx, edx
add edx, eax
mov edi, 0x30ef387c
sub edi, 0x30abf47c
add edi, dword [ebp - 0x30]
mov esi, 0x606f239f
sub esi, 0xb181597f
mov dword [ebp - 0x20], 0x92d7b39a
mov ebx, dword [edi]
xor dword [ebp - 0x1c], esi
xor ebx, esi
mov dword [edx], ebx
xor dword [ebp - 0x14], 0x6706ba03
add edx, 4
add edi, 0xb591c4f8
sub edi, 0xb591c4f4
loop 0x414e6c
add eax, 0x56328553
add eax, 0xa9ce85d4
xor ebx, ebx
add ebx, eax
add eax, 0x6886655d
sub eax, 0x68866558
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x407d60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44752d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b96e8], 0x2c
jl 0x407db8
push 0x5b96ec
call fcn.00427800
mov ecx, dword [0x5b96e4]
add esp, 4
test ecx, ecx
je 0x407daa
mov eax, dword [ecx]
mov dword [0x5b96e4], eax
mov dword [0x5b96ec], 1
test ecx, ecx
jne 0x407dcf
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x407df4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00408010
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00430f13
int3

Function at 0x407e00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447565
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x5b96e8], 0x2c
jl 0x407e5d
push 0x5b96ec
call fcn.00427800
mov edi, dword [0x5b96e4]
add esp, 4
test edi, edi
je 0x407e4f
mov eax, dword [edi]
mov dword [0x5b96e4], eax
mov dword [0x5b96ec], 1
test edi, edi
jne 0x407e74
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x407ed1
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.00408010
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.00408630
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00430f13
int3
Function at 0x4083c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447675
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b96e8], 0x1c
jl 0x408418
push 0x5b96ec
call fcn.00427800
mov ecx, dword [0x5b96e4]
add esp, 4
test ecx, ecx
je 0x40840a
mov eax, dword [ecx]
mov dword [0x5b96e4], eax
mov dword [0x5b96ec], 1
test ecx, ecx
jne 0x40842f
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40848b
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolMem.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x18], 0x40
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00430f13
int3

Function at 0x408540
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4476ed
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b96e8], 0x1c
jl 0x40859b
push 0x5b96ec
call fcn.00427800
mov ecx, dword [0x5b96e4]
add esp, 4
test ecx, ecx
je 0x40858d
mov eax, dword [ecx]
mov dword [0x5b96e4], eax
mov dword [0x5b96ec], 1
test ecx, ecx
jne 0x4085b2
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4085d9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.004084a0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00430f13
int3

Function at 0x408c10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44752d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b96e8], 0xc
jl 0x408c68
push 0x5b96ec
call fcn.00427800
mov ecx, dword [0x5b96e4]
add esp, 4
test ecx, ecx
je 0x408c5a
mov eax, dword [ecx]
mov dword [0x5b96e4], eax
mov dword [0x5b96ec], 1
test ecx, ecx
jne 0x408c7f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x408cb5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00430f13
int3
Function at 0x408cc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447805
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b96e8], 0xc
jl 0x408d1b
push 0x5b96ec
call fcn.00427800
mov ecx, dword [0x5b96e4]
add esp, 4
test ecx, ecx
je 0x408d0d
mov eax, dword [ecx]
mov dword [0x5b96e4], eax
mov dword [0x5b96ec], 1
test ecx, ecx
jne 0x408d32
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x408d7f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolObject.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00430f13
int3

Function at 0x409040
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4478c2
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x5b7018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x220], esi
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x224], esi
push 0
push eax
mov dword [ebp - 0x21c], 0
call fcn.0042e420
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, esi
call fcn.00408010
mov dword [ebp - 4], 1
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
mov dword [esi], vtable.CWString.0
call fcn.00428200
mov dword [ebp - 4], 0
mov dword [ebp - 0x21c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042c695
mov esp, ebp
pop ebp
ret

Function at 0x4098f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447675
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b96e8], 0x14
jl 0x409948
push 0x5b96ec
call fcn.00427800
mov ecx, dword [0x5b96e4]
add esp, 4
test ecx, ecx
je 0x40993a
mov eax, dword [ecx]
mov dword [0x5b96e4], eax
mov dword [0x5b96ec], 1
test ecx, ecx
jne 0x40995f
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4099ad
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n13954::rg_n15488.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00430f13
int3
Function at 0x409a50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447aad
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b96e8], 0x14
jl 0x409aab
push 0x5b96ec
call fcn.00427800
mov ecx, dword [0x5b96e4]
add esp, 4
test ecx, ecx
je 0x409a9d
mov eax, dword [ecx]
mov dword [0x5b96e4], eax
mov dword [0x5b96ec], 1
test ecx, ecx
jne 0x409ac2
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x409b33
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n13954::rg_n15488.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n13954::rg_n15488.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x10], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00430f13
int3

Function at 0x409da0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44752d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b96e8], 0x280
jl 0x409dfb
push 0x5b96ec
call fcn.00427800
mov ecx, dword [0x5b96e4]
add esp, 4
test ecx, ecx
je 0x409ded
mov eax, dword [ecx]
mov dword [0x5b96e4], eax
mov dword [0x5b96ec], 1
test ecx, ecx
jne 0x409e15
push 0x280
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x409e3a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040ad80
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00430f13
int3