joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e600
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440720
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5a8ec8], 0x20
jl 0x40e658
push 0x5a8ecc
call fcn.004377b0
mov ecx, dword [0x5a8ec4]
add esp, 4
test ecx, ecx
je 0x40e64a
mov eax, dword [ecx]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test ecx, ecx
jne 0x40e677
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40e677
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.exui::TimerEx.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 1
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40e760
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440768
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5a8ec8], 0x20
jl 0x40e7bb
push 0x5a8ecc
call fcn.004377b0
mov ecx, dword [0x5a8ec4]
add esp, 4
test ecx, ecx
je 0x40e7ad
mov eax, dword [ecx]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test ecx, ecx
jne 0x40e7da
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40e7da
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.exui::TimerEx.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 1
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.exui::TimerEx.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ebd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440875
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5a8ec8], 0x10
jl 0x40ec28
push 0x5a8ecc
call fcn.004377b0
mov ecx, dword [0x5a8ec4]
add esp, 4
test ecx, ecx
je 0x40ec1a
mov eax, dword [ecx]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test ecx, ecx
jne 0x40ec47
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40ec47
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2298.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.exui::ExuiProgram.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40ed30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4408cd
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5a8ec8], 0x10
jl 0x40ed8c
push 0x5a8ecc
call fcn.004377b0
mov esi, dword [0x5a8ec4]
add esp, 4
test esi, esi
je 0x40ed7e
mov eax, dword [esi]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test esi, esi
jne 0x40edab
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40edab
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.rg_n::rg_n2298.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.exui::ExuiProgram.0
mov byte [ebp - 4], 4
mov dword [esi], vtable.exui::ExuiProgram.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x40ee12
mov ecx, edi
call fcn.004313e0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40ee1e
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40f1b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f17d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5a8ec8], 0x200
jl 0x40f20b
push 0x5a8ecc
call fcn.004377b0
mov ecx, dword [0x5a8ec4]
add esp, 4
test ecx, ecx
je 0x40f1fd
mov eax, dword [ecx]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test ecx, ecx
jne 0x40f22d
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40f22d
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040f480
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40f2e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4409d5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5a8ec8], 0x200
jl 0x40f33f
push 0x5a8ecc
call fcn.004377b0
mov esi, dword [0x5a8ec4]
add esp, 4
test esi, esi
je 0x40f331
mov eax, dword [esi]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test esi, esi
jne 0x40f361
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40f361
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040f480
mov byte [ebp - 4], 1
mov dword [esi], vtable.exui::WindowEx.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40f940
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4405b5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5a8ec8], 0x150
jl 0x40f99b
push 0x5a8ecc
call fcn.004377b0
mov edx, dword [0x5a8ec4]
add esp, 4
test edx, edx
je 0x40f98d
mov eax, dword [edx]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test edx, edx
jne 0x40f9bd
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x40f9bd
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040d000
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ImagebuttonEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40fa70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4405fd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5a8ec8], 0x150
jl 0x40face
push 0x5a8ecc
call fcn.004377b0
mov edx, dword [0x5a8ec4]
add esp, 4
test edx, edx
je 0x40fac0
mov eax, dword [edx]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test edx, edx
jne 0x40faf0
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x40faf0
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040d000
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ImagebuttonEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::ImagebuttonEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40fd50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4405b5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5a8ec8], 0x150
jl 0x40fdab
push 0x5a8ecc
call fcn.004377b0
mov edx, dword [0x5a8ec4]
add esp, 4
test edx, edx
je 0x40fd9d
mov eax, dword [edx]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test edx, edx
jne 0x40fdcd
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x40fdcd
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040d000
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::LabelEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40fe80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4405fd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5a8ec8], 0x150
jl 0x40fede
push 0x5a8ecc
call fcn.004377b0
mov edx, dword [0x5a8ec4]
add esp, 4
test edx, edx
je 0x40fed0
mov eax, dword [edx]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test edx, edx
jne 0x40ff00
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x40ff00
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040d000
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::LabelEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::LabelEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410160
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4405b5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5a8ec8], 0x150
jl 0x4101bb
push 0x5a8ecc
call fcn.004377b0
mov edx, dword [0x5a8ec4]
add esp, 4
test edx, edx
je 0x4101ad
mov eax, dword [edx]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test edx, edx
jne 0x4101dd
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x4101dd
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040d000
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::PictureBoxEx.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x410290
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4405fd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5a8ec8], 0x150
jl 0x4102ee
push 0x5a8ecc
call fcn.004377b0
mov edx, dword [0x5a8ec4]
add esp, 4
test edx, edx
je 0x4102e0
mov eax, dword [edx]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test edx, edx
jne 0x410310
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x410310
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.0040d000
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::PictureBoxEx.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.exui::PictureBoxEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410540
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f17d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5a8ec8], 0x170
jl 0x41059b
push 0x5a8ecc
call fcn.004377b0
mov ecx, dword [0x5a8ec4]
add esp, 4
test ecx, ecx
je 0x41058d
mov eax, dword [ecx]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test ecx, ecx
jne 0x4105bd
push 0x170
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4105bd
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00410810
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x410670
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440ca5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5a8ec8], 0x170
jl 0x4106ce
push 0x5a8ecc
call fcn.004377b0
mov edx, dword [0x5a8ec4]
add esp, 4
test edx, edx
je 0x4106c0
mov eax, dword [edx]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test edx, edx
jne 0x4106f0
push 0x170
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x4106f0
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.00410810
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::WindowBoxEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410f10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f17d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5a8ec8], 0xa3c
jl 0x410f6b
push 0x5a8ecc
call fcn.004377b0
mov ecx, dword [0x5a8ec4]
add esp, 4
test ecx, ecx
je 0x410f5d
mov eax, dword [ecx]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test ecx, ecx
jne 0x410f8d
push 0xa3c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x410f8d
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00416710
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x411060
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441005
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5a8ec8], 0xa3c
jl 0x4110bf
push 0x5a8ecc
call fcn.004377b0
mov esi, dword [0x5a8ec4]
add esp, 4
test esi, esi
je 0x4110b1
mov eax, dword [esi]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test esi, esi
jne 0x4110e1
push 0xa3c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x4110e1
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00416710
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n16744::rg_n16811.0
call fcn.004111e0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x411620
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f17d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5a8ec8], 0x5a00
jl 0x41167b
push 0x5a8ecc
call fcn.004377b0
mov ecx, dword [0x5a8ec4]
add esp, 4
test ecx, ecx
je 0x41166d
mov eax, dword [ecx]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test ecx, ecx
jne 0x41169d
push 0x5a00
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x41169d
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00421210
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x411760
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4410e5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5a8ec8], 0x5a00
jl 0x4117c0
push 0x5a8ecc
call fcn.004377b0
mov esi, dword [0x5a8ec4]
add esp, 4
test esi, esi
je 0x4117b2
mov eax, dword [esi]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test esi, esi
jne 0x4117e2
push 0x5a00
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x4117e2
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00421210
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n16744::rg_n17018.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov ebx, dword [edi + 0xc]
test ebx, ebx
je 0x411817
mov ecx, ebx
call fcn.004313e0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x411823
mov eax, dword [ecx]
call dword [eax + 0x20]
push edi
mov ecx, esi
mov dword [esi + 0xc], ebx
call fcn.004234b0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411c60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f17d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5a8ec8], 0x4e50
jl 0x411cbb
push 0x5a8ecc
call fcn.004377b0
mov ecx, dword [0x5a8ec4]
add esp, 4
test ecx, ecx
je 0x411cad
mov eax, dword [ecx]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test ecx, ecx
jne 0x411cdd
push 0x4e50
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x411cdd
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0041a180
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x411da0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441205
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5a8ec8], 0x4e50
jl 0x411e00
push 0x5a8ecc
call fcn.004377b0
mov esi, dword [0x5a8ec4]
add esp, 4
test esi, esi
je 0x411df2
mov eax, dword [esi]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test esi, esi
jne 0x411e22
push 0x4e50
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x411e22
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0041a180
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n16744::rg_n16900.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov ebx, dword [edi + 0xc]
test ebx, ebx
je 0x411e57
mov ecx, ebx
call fcn.004313e0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x411e63
mov eax, dword [ecx]
call dword [eax + 0x20]
push edi
mov ecx, esi
mov dword [esi + 0xc], ebx
call fcn.0041b250
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x412260
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f17d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5a8ec8], 0xe28
jl 0x4122bb
push 0x5a8ecc
call fcn.004377b0
mov ecx, dword [0x5a8ec4]
add esp, 4
test ecx, ecx
je 0x4122ad
mov eax, dword [ecx]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test ecx, ecx
jne 0x4122dd
push 0xe28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4122dd
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00418020
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret