joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40abd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41dded
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x57ab58], 0x150
jl 0x40ac2b
push 0x57ab5c
call fcn.00419060
mov ecx, dword [0x57ab54]
add esp, 4
test ecx, ecx
je 0x40ac1d
mov eax, dword [ecx]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test ecx, ecx
jne 0x40ac4d
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40ac4d
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040aea0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40ad00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e415
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x57ab58], 0x150
jl 0x40ad5e
push 0x57ab5c
call fcn.00419060
mov edx, dword [0x57ab54]
add esp, 4
test edx, edx
je 0x40ad50
mov eax, dword [edx]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test edx, edx
jne 0x40ad80
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x40ad80
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040aea0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ControlEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b5a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e73d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x57ab58], 0x10
jl 0x40b5f8
push 0x57ab5c
call fcn.00419060
mov ecx, dword [0x57ab54]
add esp, 4
test ecx, ecx
je 0x40b5ea
mov eax, dword [ecx]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test ecx, ecx
jne 0x40b617
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40b617
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2298.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40b6f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e785
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x57ab58], 0x10
jl 0x40b74c
push 0x57ab5c
call fcn.00419060
mov esi, dword [0x57ab54]
add esp, 4
test esi, esi
je 0x40b73e
mov eax, dword [esi]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test esi, esi
jne 0x40b76b
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40b76b
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.rg_n::rg_n2298.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.rg_n::rg_n2298.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x40b7c8
mov ecx, edi
call fcn.00415c70
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40b7d4
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40bba0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41dded
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x57ab58], 0x200
jl 0x40bbfb
push 0x57ab5c
call fcn.00419060
mov ecx, dword [0x57ab54]
add esp, 4
test ecx, ecx
je 0x40bbed
mov eax, dword [ecx]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test ecx, ecx
jne 0x40bc1d
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40bc1d
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040be70
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40bcd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e885
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x57ab58], 0x200
jl 0x40bd2f
push 0x57ab5c
call fcn.00419060
mov esi, dword [0x57ab54]
add esp, 4
test esi, esi
je 0x40bd21
mov eax, dword [esi]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test esi, esi
jne 0x40bd51
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40bd51
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040be70
mov byte [ebp - 4], 1
mov dword [esi], vtable.exui::WindowEx.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c3c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ead5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x57ab58], 0x10
jl 0x40c418
push 0x57ab5c
call fcn.00419060
mov ecx, dword [0x57ab54]
add esp, 4
test ecx, ecx
je 0x40c40a
mov eax, dword [ecx]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test ecx, ecx
jne 0x40c437
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40c437
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2298.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.exui::ExuiProgram.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40c520
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41eb2d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x57ab58], 0x10
jl 0x40c57c
push 0x57ab5c
call fcn.00419060
mov esi, dword [0x57ab54]
add esp, 4
test esi, esi
je 0x40c56e
mov eax, dword [esi]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test esi, esi
jne 0x40c59b
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40c59b
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.rg_n::rg_n2298.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.exui::ExuiProgram.0
mov byte [ebp - 4], 4
mov dword [esi], vtable.exui::ExuiProgram.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x40c602
mov ecx, edi
call fcn.00415c70
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40c60e
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c9e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ec35
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x57ab58], 0x150
jl 0x40ca3b
push 0x57ab5c
call fcn.00419060
mov edx, dword [0x57ab54]
add esp, 4
test edx, edx
je 0x40ca2d
mov eax, dword [edx]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test edx, edx
jne 0x40ca5d
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x40ca5d
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040aea0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::LabelEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40cb10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ec7d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x57ab58], 0x150
jl 0x40cb6e
push 0x57ab5c
call fcn.00419060
mov edx, dword [0x57ab54]
add esp, 4
test edx, edx
je 0x40cb60
mov eax, dword [edx]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test edx, edx
jne 0x40cb90
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x40cb90
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040aea0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::LabelEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::LabelEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40cf00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ec35
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x57ab58], 0x150
jl 0x40cf5b
push 0x57ab5c
call fcn.00419060
mov edx, dword [0x57ab54]
add esp, 4
test edx, edx
je 0x40cf4d
mov eax, dword [edx]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test edx, edx
jne 0x40cf7d
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x40cf7d
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040aea0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ImagebuttonEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40d030
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ec7d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x57ab58], 0x150
jl 0x40d08e
push 0x57ab5c
call fcn.00419060
mov edx, dword [0x57ab54]
add esp, 4
test edx, edx
je 0x40d080
mov eax, dword [edx]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test edx, edx
jne 0x40d0b0
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x40d0b0
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040aea0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ImagebuttonEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::ImagebuttonEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d350
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ec35
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x57ab58], 0x150
jl 0x40d3ab
push 0x57ab5c
call fcn.00419060
mov edx, dword [0x57ab54]
add esp, 4
test edx, edx
je 0x40d39d
mov eax, dword [edx]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test edx, edx
jne 0x40d3cd
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x40d3cd
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040aea0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ButtonEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40d480
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ec7d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x57ab58], 0x150
jl 0x40d4de
push 0x57ab5c
call fcn.00419060
mov edx, dword [0x57ab54]
add esp, 4
test edx, edx
je 0x40d4d0
mov eax, dword [edx]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test edx, edx
jne 0x40d500
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x40d500
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040aea0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ButtonEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::ButtonEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d7a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ec35
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x57ab58], 0x150
jl 0x40d7fb
push 0x57ab5c
call fcn.00419060
mov edx, dword [0x57ab54]
add esp, 4
test edx, edx
je 0x40d7ed
mov eax, dword [edx]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test edx, edx
jne 0x40d81d
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x40d81d
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040aea0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::PictureBoxEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40d8d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ec7d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x57ab58], 0x150
jl 0x40d92e
push 0x57ab5c
call fcn.00419060
mov edx, dword [0x57ab54]
add esp, 4
test edx, edx
je 0x40d920
mov eax, dword [edx]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test edx, edx
jne 0x40d950
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x40d950
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040aea0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::PictureBoxEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::PictureBoxEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40dbc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41dded
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x57ab58], 0x170
jl 0x40dc1b
push 0x57ab5c
call fcn.00419060
mov ecx, dword [0x57ab54]
add esp, 4
test ecx, ecx
je 0x40dc0d
mov eax, dword [ecx]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test ecx, ecx
jne 0x40dc3d
push 0x170
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40dc3d
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040de90
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40dcf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ee25
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x57ab58], 0x170
jl 0x40dd4e
push 0x57ab5c
call fcn.00419060
mov edx, dword [0x57ab54]
add esp, 4
test edx, edx
je 0x40dd40
mov eax, dword [edx]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test edx, edx
jne 0x40dd70
push 0x170
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x40dd70
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040de90
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::WindowBoxEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40e680
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41dded
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x57ab58], 0xa18
jl 0x40e6db
push 0x57ab5c
call fcn.00419060
mov ecx, dword [0x57ab54]
add esp, 4
test ecx, ecx
je 0x40e6cd
mov eax, dword [ecx]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test ecx, ecx
jne 0x40e6fd
push 0xa18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40e6fd
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040ed60
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40e7c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f185
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x57a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x57ab58], 0xa18
jl 0x40e81f
push 0x57ab5c
call fcn.00419060
mov esi, dword [0x57ab54]
add esp, 4
test esi, esi
je 0x40e811
mov eax, dword [esi]
mov dword [0x57ab54], eax
mov dword [0x57ab5c], 1
test esi, esi
jne 0x40e841
push 0xa18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40e841
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040ed60
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n16494::rg_n16498.0
call fcn.0040e940
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret