joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584265
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f69d8], 0xc
jl 0x40b25b
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x40b24d
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x40b272
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40b2d9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f6a00], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6828.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n6828.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3

Function at 0x40b590
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584e75
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f69d8], 0xc
jl 0x40b5e8
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x40b5da
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x40b5ff
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40b659
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f6a00], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6828.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n6838.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3
Function at 0x40b6f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584ecd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f69d8], 0xc
jl 0x40b74b
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x40b73d
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x40b762
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40b7d3
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f6a00], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6828.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n6838.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n1::rg_n6838.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3
Function at 0x40b9b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edi
call fcn.0041e492
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 8
push eax
mov dword [ebp - 0x14], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
call fcn.0041e9d9
add esp, 4
mov ecx, edi
call fcn.004205bb
call fcn.00421ac0
mov eax, dword [eax + 0x40]
test eax, eax
je 0x40ba13
mov dword [eax + 0x28], 0
mov dword [eax + 0x38], 2
mov dword [eax + 0x2c], 1
mov dword [eax + 0x3c], 0xffffffff
call fcn.0040cb10
mov dword [ebp - 0x10], eax
call fcn.0056b307
mov esi, dword [eax]
call fcn.0056b301
mov ecx, dword [edi + 0x44]
mov edx, dword [eax]
mov dword [0x5f6abc], ecx
mov dword [0x5f6ac0], edx
mov dword [0x5f6ac4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 2
push 0
mov dword [0x5f6ac8], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
xor ecx, ecx
test eax, eax
setns cl
mov dword [0x5f6a04], ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push str.SHCore.dll
mov edi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40bab2
push str.GetDpiForMonitor
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40baa9
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 2
push edi
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push eax
call esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40bad9
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 4]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mov eax, dword [ebp - 0x10]
movsd xmm0, qword [0x5cb710]
divsd xmm1, qword [0x5cb718]
maxsd xmm0, xmm1
movsd qword [0x5f6a08], xmm0
mov eax, dword [eax]
call eax
mov dword [0x5f6a00], eax
mov esi, dword [eax]
call fcn.0040bed0
mov ecx, dword [0x5f6a00]
push eax
mov eax, dword [esi + 0x34]
call eax
test eax, eax
je 0x40bb69
mov esi, dword [0x5f6a00]
mov edi, dword [esi]
call fcn.0040b460
push eax
mov eax, dword [edi + 0x34]
mov ecx, esi
call eax
mov esi, dword [ebp - 8]
test eax, eax
je 0x40bb47
mov eax, dword [0x5f6a00]
mov dword [esi + 0x118], eax
call fcn.0040cf90
test eax, eax
je 0x40bb61
cmp dword [esi + 0x20], 0
je 0x40bb61
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x5f6a00]
mov eax, dword [ecx]
call dword [eax + 0x30]
push 0xffffffffffffffff
call fcn.0056b5c8
int3
Function at 0x40be10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x583f85
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f69d8], 0xc
jl 0x40be68
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x40be5a
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x40be7f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40bec5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f6a00], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3

Function at 0x40c290
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x583e3d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f69d8], 0x20
jl 0x40c2e8
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x40c2da
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x40c2ff
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40c324
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040c6f0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3
Function at 0x40c3b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x585165
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5f69d8], 0x20
jl 0x40c40c
push 0x5f69dc
call fcn.00414380
mov esi, dword [0x5f69d4]
add esp, 4
test esi, esi
je 0x40c3fe
mov eax, dword [esi]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test esi, esi
jne 0x40c423
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40c481
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040c6f0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n1::rg_n6520.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x40c458
mov ecx, edi
call fcn.0040f810
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40c464
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3

Function at 0x40cc40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584e75
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f69d8], 0xc
jl 0x40cc98
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x40cc8a
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x40ccaf
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40cd09
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f6a00], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6828.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n39416.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3
Function at 0x40cda0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584ecd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f69d8], 0xc
jl 0x40cdfb
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x40cded
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x40ce12
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40ce83
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f6a00], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6828.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n39416.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n::rg_n39416.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3
Function at 0x40d9c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x583e3d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f69d8], 0x2c
jl 0x40da18
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x40da0a
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x40da2f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40da54
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040dc30
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3

Function at 0x40da60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x583ea5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x5f69d8], 0x2c
jl 0x40dabd
push 0x5f69dc
call fcn.00414380
mov edi, dword [0x5f69d4]
add esp, 4
test edi, edi
je 0x40daaf
mov eax, dword [edi]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test edi, edi
jne 0x40dad4
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40db31
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.0040dc30
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CU8String.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.00404990
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3
Function at 0x40de70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x585546
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push esi
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 8
mov dword [ebp - 0x10], 0
mov ecx, 0x5f69e0
call fcn.00412110
test eax, eax
jne 0x40debe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00404e80
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], 0
test eax, eax
je 0x40dee9
push eax
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x48]
call dword [eax + 0xc]
push str.BE93FFFFFB5FB8BC3A8BEF2020FBEC5D4E6C2F1485326F6E3273346E71D2650F89B0E9AA2EC80FBC19E84C82E9D37F0B77025EC9B9BC92883C9C540375957365806745A3D0207FC2F43AC3509A9A9780F67926DC8EA05532362E59BC0AC1FAD98D2C40951A1D32768D998F6AAA31D882E6FE13A72EF61DC662612697EE35CD8C44862C2AF9C651623E0C4ECCE17E8BECEB91A955B7CB2C85E96BB43EEDB67D6092CA8368F3FBBDBBDF86FAAD1504DB445138F90CA5D78BBB0C8F609C509B2685E01A70B791D8DF59BC4BACA36A785BE730C53C6E0C4E126C7E2D1D652DA1FACEDF1CB213D05509B00AD9F11BC3772E6128C4A326BCF121833B3877F1C7CCB099C79019974E502355B17D500EA677B65029BBB7E24DFC9DEBB0D92615C368CC591982C355B7EA368AA6DBF73636E8F5160C253687B03913DA065049C173
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
call fcn.00413ab0
push ecx
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x2c]
call fcn.0040d3d0
mov esi, eax
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.004042f0
xor edx, edx
mov ecx, esi
call fcn.00402320
mov ecx, 1
mov esi, eax
mov dword [ebp - 0x10], ecx
and ecx, 0xfffffffe
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00404df0
cmp esi, 1
jne 0x40df61
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40fa20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x583e3d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f69d8], 0x28
jl 0x40fa78
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x40fa6a
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x40fa8f
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40fab5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push ecx
call fcn.0040fdc0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3

Function at 0x40fb90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5859c5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5f69d8], 0x28
jl 0x40fbec
push 0x5f69dc
call fcn.00414380
mov esi, dword [0x5f69d4]
add esp, 4
test esi, esi
je 0x40fbde
mov eax, dword [esi]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test esi, esi
jne 0x40fc03
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40fc41
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push ecx
mov ecx, esi
call fcn.0040fdc0
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.CVolObjectArray.0
call fcn.0040fd30
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3

Function at 0x4101f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x585b90
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f69d8], 0x3c
jl 0x410248
push 0x5f69dc
call fcn.00414380
mov edx, dword [0x5f69d4]
add esp, 4
test edx, edx
je 0x41023a
mov eax, dword [edx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test edx, edx
jne 0x41025f
push 0x3c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x4102b2
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov dword [edx], vtable.CVolObject.0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [ebp - 4], 1
lea ecx, [edx + 0x10]
mov dword [edx], vtable.CVolException.0
call fcn.00404e80
mov byte [ebp - 4], 2
mov dword [edx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3
Function at 0x410400
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x585c18
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x5f69d8], 0x3c
jl 0x41045d
push 0x5f69dc
call fcn.00414380
mov edi, dword [0x5f69d4]
add esp, 4
test edi, edi
je 0x41044f
mov eax, dword [edi]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test edi, edi
jne 0x410478
push 0x3c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x410505
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov dword [edi], vtable.CVolObject.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CVolException.0
call fcn.00404e80
mov byte [ebp - 4], 2
mov dword [edi + 0xc], 0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x20]
mov dword [edi], vtable.CVolException.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 0x20]
call dword [eax + 0x44]
lea eax, [ebx + 0x20]
push eax
lea ecx, [edi + 0x20]
call fcn.00404990
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3

Function at 0x410930
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584b8d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f69d8], 0xc
jl 0x41098b
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x41097d
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x4109a2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4109ff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f6a00], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolUserApp.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3