joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a0d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ae75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x10
jl 0x41a12b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x41a11d
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x41a142
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41a1b0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2306.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2306.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x41a3b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ae2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x10
jl 0x41a408
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x41a3fa
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x41a41f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41a46f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n::rg_n2302.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x41a510
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ae75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x10
jl 0x41a56b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x41a55d
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x41a582
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41a5f1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n::rg_n2302.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2302.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x41a880
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ae2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x10
jl 0x41a8d8
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x41a8ca
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x41a8ef
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41a93f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n::rg_n2304.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x41a9e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ae75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x10
jl 0x41aa3b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x41aa2d
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x41aa52
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41aac1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n::rg_n2304.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2304.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x41ad10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ae2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x10
jl 0x41ad68
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x41ad5a
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x41ad7f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41adcd
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2300.0
mov byte [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x41ae60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ae75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x10
jl 0x41aebb
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x41aead
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x41aed2
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41af3d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2300.0
mov byte [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2300.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov al, byte [esi + 0xc]
mov byte [ecx + 0xc], al
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x41b620
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447655
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0xc
jl 0x41b678
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x41b66a
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x41b68f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41b6cf
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x41b6e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447aed
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0xc
jl 0x41b73b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x41b72d
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x41b752
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41b7a9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x41c330
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ae2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0xc
jl 0x41c388
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x41c37a
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x41c39f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41c3ef
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5b9740], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n6332.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x41c480
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ae75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0xc
jl 0x41c4db
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x41c4cd
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x41c4f2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41c559
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5b9740], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n6332.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n6332.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x41c860
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b395
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0xc
jl 0x41c8b8
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x41c8aa
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x41c8cf
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41c929
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5b9740], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n6332.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n6341.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x41c9c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b3ed
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0xc
jl 0x41ca1b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x41ca0d
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x41ca32
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41caa3
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5b9740], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n6332.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n6341.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n::rg_n6341.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x41ce30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44750d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x1424
jl 0x41ce8b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x41ce7d
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x41cea5
push 0x1424
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41ceca
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0041d1f0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x41cfd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b535
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5b9718], 0x1424
jl 0x41d032
push 0x5b971c
call fcn.00429990
mov esi, dword [0x5b9714]
add esp, 4
test esi, esi
je 0x41d024
mov eax, dword [esi]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test esi, esi
jne 0x41d050
push 0x1424
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x41d0d5
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0041d1f0
mov byte [ebp - 4], 1
lea ebx, [edi + 0xc]
mov dword [esi], vtable.rg_n16744::rg_n16745.0
lea ecx, [esi + 0xc]
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x10], ebx
call dword [eax + 0x44]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 8]
mov dword [esi + 0x14], eax
mov ebx, dword [ebx + 0xc]
test ebx, ebx
je 0x41d0a0
mov ecx, ebx
call fcn.00423730
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x41d0ac
mov eax, dword [ecx]
call dword [eax + 0x20]
push dword [ebp - 0x10]
lea ecx, [esi + 0xc]
mov dword [esi + 0x18], ebx
call fcn.00413c70
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x41d7f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447655
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0xc
jl 0x41d848
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x41d83a
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x41d85f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41d8a5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5b9740], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x41e670
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44baff
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
call fcn.0042de8b
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x41e721
push eax
push esi
call fcn.0042e27a
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.0042dfee
int3
Function at 0x423900
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44750d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x28
jl 0x423958
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x42394a
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x42396f
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x423995
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push ecx
call fcn.00423ca0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x423a70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44cb85
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5b9718], 0x28
jl 0x423acc
push 0x5b971c
call fcn.00429990
mov esi, dword [0x5b9714]
add esp, 4
test esi, esi
je 0x423abe
mov eax, dword [esi]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test esi, esi
jne 0x423ae3
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x423b21
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push ecx
mov ecx, esi
call fcn.00423ca0
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.CVolObjectArray.0
call fcn.00423c10
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x423fc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447aed
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0xc
jl 0x42401b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x42400d
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x424032
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42408f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5b9740], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolUserApp.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3