joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449190
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47853d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5e6648], 0x10
jl 0x4491e8
push 0x5e664c
call fcn.00463de0
mov ecx, dword [0x5e6644]
add esp, 4
test ecx, ecx
je 0x4491da
mov eax, dword [ecx]
mov dword [0x5e6644], eax
mov dword [0x5e664c], 1
test ecx, ecx
jne 0x449207
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x449207
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n229::rg_n2533.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4492f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478585
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5e6648], 0x10
jl 0x44934b
push 0x5e664c
call fcn.00463de0
mov ecx, dword [0x5e6644]
add esp, 4
test ecx, ecx
je 0x44933d
mov eax, dword [ecx]
mov dword [0x5e6644], eax
mov dword [0x5e664c], 1
test ecx, ecx
jne 0x44936a
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x44936a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n229::rg_n2533.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n229::rg_n2533.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x449620
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47853d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5e6648], 0x10
jl 0x449678
push 0x5e664c
call fcn.00463de0
mov ecx, dword [0x5e6644]
add esp, 4
test ecx, ecx
je 0x44966a
mov eax, dword [ecx]
mov dword [0x5e6644], eax
mov dword [0x5e664c], 1
test ecx, ecx
jne 0x449697
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x449697
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n229::rg_n2529.0
mov byte [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x449770
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478585
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5e6648], 0x10
jl 0x4497cb
push 0x5e664c
call fcn.00463de0
mov ecx, dword [0x5e6644]
add esp, 4
test ecx, ecx
je 0x4497bd
mov eax, dword [ecx]
mov dword [0x5e6644], eax
mov dword [0x5e664c], 1
test ecx, ecx
jne 0x4497ea
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4497ea
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n229::rg_n2529.0
mov byte [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n229::rg_n2529.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov al, byte [esi + 0xc]
mov byte [ecx + 0xc], al
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x449f30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b5c5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5e6648], 0xc
jl 0x449f88
push 0x5e664c
call fcn.00463de0
mov ecx, dword [0x5e6644]
add esp, 4
test ecx, ecx
je 0x449f7a
mov eax, dword [ecx]
mov dword [0x5e6644], eax
mov dword [0x5e664c], 1
test ecx, ecx
jne 0x449fa7
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x449fa7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x449ff0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46c10d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5e6648], 0xc
jl 0x44a04b
push 0x5e664c
call fcn.00463de0
mov ecx, dword [0x5e6644]
add esp, 4
test ecx, ecx
je 0x44a03d
mov eax, dword [ecx]
mov dword [0x5e6644], eax
mov dword [0x5e664c], 1
test ecx, ecx
jne 0x44a06a
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x44a06a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44a700
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4789b7
mov eax, dword fs:[0]
push eax
mov eax, 0x5014
call fcn.0046ae20
mov eax, dword [0x5e500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x5014], edi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x5020], edi
mov dword [ebp - 0x5018], eax
mov dword [ebp - 0x501c], 0
call fcn.00402290
mov dword [ebp - 4], 0
xor eax, eax
mov ecx, dword [0x5e5244]
mov dword [ebp - 0x501c], 1
mov dword [ebp - 0x5014], ecx
test ecx, ecx
je 0x44a790
cmp word [ecx], ax
sete al
jmp 0x44a79a
cmp dword [0x5e525c], 2
setle al
test eax, eax
jne 0x44a8ac
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x44a7b1
cmp word [ecx], ax
sete al
jmp 0x44a7b8
cmp dword [esi + 0x24], 2
setle al
test eax, eax
jne 0x44a8ac
mov edx, dword [ebx + 0xc]
test edx, edx
je 0x44a7cf
cmp word [edx], ax
sete al
jmp 0x44a7d6
cmp dword [ebx + 0x24], 2
setle al
test eax, eax
jne 0x44a8ac
mov word [ebp - 0x5010], ax
cmp dword [0x5e5244], eax
jne 0x44a806
cmp dword [0x5e525c], 0
mov eax, 0x5ca534
cmovne eax, dword [0x5e5254]
mov dword [ebp - 0x5014], eax
mov eax, dword [ebp - 0x5018]
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x44a829
mov eax, dword [ebp - 0x5018]
cmp dword [eax + 0x24], 0
jne 0x44a826
mov eax, 0x5ca534
jmp 0x44a829
mov eax, dword [eax + 0x1c]
test edx, edx
jne 0x44a83a
cmp dword [ebx + 0x24], edx
mov edx, 0x5ca534
je 0x44a83a
mov edx, dword [ebx + 0x1c]
test ecx, ecx
jne 0x44a84b
cmp dword [esi + 0x24], ecx
mov ecx, 0x5ca534
je 0x44a84b
mov ecx, dword [esi + 0x1c]
push dword [ebp - 0x5014]
lea esi, [ebp - 0x5010]
push 0x2800
push esi
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [edi + 0xc], 0
mov ecx, dword [edi + 0x1c]
test ecx, ecx
je 0x44a87e
mov eax, dword [edi + 0x10]
push ecx
lea ecx, [edi + 0x10]
call dword [eax + 0xc]
cmp word [ebp - 0x5010], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x20], 0
je 0x44a8ac
lea eax, [ebp - 0x5010]
push eax
lea ecx, [edi + 0x10]
call fcn.004633c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00469bcf
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44ab20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47853d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5e6648], 0xc
jl 0x44ab78
push 0x5e664c
call fcn.00463de0
mov ecx, dword [0x5e6644]
add esp, 4
test ecx, ecx
je 0x44ab6a
mov eax, dword [ecx]
mov dword [0x5e6644], eax
mov dword [0x5e664c], 1
test ecx, ecx
jne 0x44ab97
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x44ab97
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5e6670], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n229::rg_n6561.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x44ac70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478585
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5e6648], 0xc
jl 0x44accb
push 0x5e664c
call fcn.00463de0
mov ecx, dword [0x5e6644]
add esp, 4
test ecx, ecx
je 0x44acbd
mov eax, dword [ecx]
mov dword [0x5e6644], eax
mov dword [0x5e664c], 1
test ecx, ecx
jne 0x44acea
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x44acea
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5e6670], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n229::rg_n6561.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n229::rg_n6561.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44afc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478ac5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5e6648], 0xc
jl 0x44b018
push 0x5e664c
call fcn.00463de0
mov ecx, dword [0x5e6644]
add esp, 4
test ecx, ecx
je 0x44b00a
mov eax, dword [ecx]
mov dword [0x5e6644], eax
mov dword [0x5e664c], 1
test ecx, ecx
jne 0x44b037
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x44b037
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5e6670], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n229::rg_n6561.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n229::rg_n6580.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x44b120
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478b1d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5e6648], 0xc
jl 0x44b17b
push 0x5e664c
call fcn.00463de0
mov ecx, dword [0x5e6644]
add esp, 4
test ecx, ecx
je 0x44b16d
mov eax, dword [ecx]
mov dword [0x5e6644], eax
mov dword [0x5e664c], 1
test ecx, ecx
jne 0x44b19a
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x44b19a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5e6670], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n229::rg_n6561.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n229::rg_n6580.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n229::rg_n6580.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44b500
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b43d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5e6648], 0x10dcc
jl 0x44b55b
push 0x5e664c
call fcn.00463de0
mov ecx, dword [0x5e6644]
add esp, 4
test ecx, ecx
je 0x44b54d
mov eax, dword [ecx]
mov dword [0x5e6644], eax
mov dword [0x5e664c], 1
test ecx, ecx
jne 0x44b57d
push 0x10dcc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x44b57d
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0044b890
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x44b630
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478c65
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5e6648], 0x10dcc
jl 0x44b68f
push 0x5e664c
call fcn.00463de0
mov esi, dword [0x5e6644]
add esp, 4
test esi, esi
je 0x44b681
mov eax, dword [esi]
mov dword [0x5e6644], eax
mov dword [0x5e664c], 1
test esi, esi
jne 0x44b6b1
push 0x10dcc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x44b6b1
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0044b890
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n16973::rg_n16974.0
call fcn.0044b7e0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44bb70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478ac5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5e6648], 0xc
jl 0x44bbc8
push 0x5e664c
call fcn.00463de0
mov ecx, dword [0x5e6644]
add esp, 4
test ecx, ecx
je 0x44bbba
mov eax, dword [ecx]
mov dword [0x5e6644], eax
mov dword [0x5e664c], 1
test ecx, ecx
jne 0x44bbe7
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x44bbe7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5e6670], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n229::rg_n6561.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n229::rg_n6570.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x44bcd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478b1d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5e6648], 0xc
jl 0x44bd2b
push 0x5e664c
call fcn.00463de0
mov ecx, dword [0x5e6644]
add esp, 4
test ecx, ecx
je 0x44bd1d
mov eax, dword [ecx]
mov dword [0x5e6644], eax
mov dword [0x5e664c], 1
test ecx, ecx
jne 0x44bd4a
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x44bd4a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5e6670], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n229::rg_n6561.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n229::rg_n6570.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n229::rg_n6570.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44c340
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b5c5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5e6648], 0xc
jl 0x44c398
push 0x5e664c
call fcn.00463de0
mov ecx, dword [0x5e6644]
add esp, 4
test ecx, ecx
je 0x44c38a
mov eax, dword [ecx]
mov dword [0x5e6644], eax
mov dword [0x5e664c], 1
test ecx, ecx
jne 0x44c3b7
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x44c3b7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5e6670], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x459370
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b41f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 5
lea ecx, [esi + 0x7c]
call fcn.0040bae0
mov byte [ebp - 4], 4
lea ecx, [esi + 0x64]
call fcn.0040bae0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x4c]
call fcn.0040bae0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x30]
call fcn.0040bae0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x14]
call fcn.0040bae0
mov byte [ebp - 4], 0
lea ecx, [esi + 8]
call fcn.00456cd0
mov dword [ebp - 4], 0xffffffff
test byte [ebp + 8], 1
mov dword [esi], vtable.Json::StreamWriter.0
je 0x459405
push 0xa0
push esi
call fcn.0046a05a
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x45dae0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b43d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5e6648], 0x28
jl 0x45db38
push 0x5e664c
call fcn.00463de0
mov ecx, dword [0x5e6644]
add esp, 4
test ecx, ecx
je 0x45db2a
mov eax, dword [ecx]
mov dword [0x5e6644], eax
mov dword [0x5e664c], 1
test ecx, ecx
jne 0x45db57
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x45db57
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push ecx
call fcn.0045de80
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x45dc50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47bf65
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5e6648], 0x28
jl 0x45dcac
push 0x5e664c
call fcn.00463de0
mov esi, dword [0x5e6644]
add esp, 4
test esi, esi
je 0x45dc9e
mov eax, dword [esi]
mov dword [0x5e6644], eax
mov dword [0x5e664c], 1
test esi, esi
jne 0x45dccb
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x45dccb
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push ecx
mov ecx, esi
call fcn.0045de80
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.CVolObjectArray.0
call fcn.0045ddf0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret