joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404700
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e255
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x42caf8], 0xc
jl 0x40475b
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x40474d
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x404772
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4047d9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x42cb20], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n6332.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n6332.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3

Function at 0x404ae0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e815
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x42caf8], 0xc
jl 0x404b38
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x404b2a
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x404b4f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x404ba9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x42cb20], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n6332.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n6341.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3
Function at 0x404c40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e86d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x42caf8], 0xc
jl 0x404c9b
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x404c8d
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x404cb2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x404d23
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x42cb20], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n6332.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n6341.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n::rg_n6341.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3

Function at 0x4050b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e9cd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x42caf8], 0xc
jl 0x405108
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x4050fa
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x40511f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x405183
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x42cb20], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n6332.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n6341.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n9612::rg_n9613.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3
Function at 0x405210
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ea25
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x42caf8], 0xc
jl 0x40526b
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x40525d
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x405282
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4052fd
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x42cb20], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n6332.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n6341.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n9612::rg_n9613.0
mov byte [ebp - 4], 5
mov dword [ecx], vtable.rg_n9612::rg_n9613.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3
Function at 0x405a70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e64d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x42caf8], 0x2c
jl 0x405ac8
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x405aba
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x405adf
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x405b04
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.004066f0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3

Function at 0x405b10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ebd5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x42caf8], 0x2c
jl 0x405b6d
push 0x42cafc
call fcn.0040c2c0
mov edi, dword [0x42caf4]
add esp, 4
test edi, edi
je 0x405b5f
mov eax, dword [edi]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test edi, edi
jne 0x405b84
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x405be1
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.004066f0
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.00406240
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3
Function at 0x406030
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e505
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x42caf8], 0x1c
jl 0x406088
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x40607a
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x40609f
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4060fb
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolMem.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x18], 0x40
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3

Function at 0x406110
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ecbd
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x42caf8], 0x1c
jl 0x40616c
push 0x42cafc
call fcn.0040c2c0
mov esi, dword [0x42caf4]
add esp, 4
test esi, esi
je 0x40615e
mov eax, dword [esi]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test esi, esi
jne 0x406183
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4061f3
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolMem.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0x40
mov byte [ebp - 4], 2
mov ecx, esi
push edi
mov dword [esi], vtable.CVolMem.0
call fcn.00406240
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3
Function at 0x4067b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e505
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x42caf8], 0xc
jl 0x406808
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x4067fa
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x40681f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x406865
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x42cb20], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3
Function at 0x4081b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e64d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x42caf8], 0x28
jl 0x408208
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x4081fa
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x40821f
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x408245
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push ecx
call fcn.00408520
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3

Function at 0x408320
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f145
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x42caf8], 0x28
jl 0x40837c
push 0x42cafc
call fcn.0040c2c0
mov esi, dword [0x42caf4]
add esp, 4
test esi, esi
je 0x40836e
mov eax, dword [esi]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test esi, esi
jne 0x408393
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4083d1
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push ecx
mov ecx, esi
call fcn.00408520
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.CVolObjectArray.0
call fcn.00408490
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3

Function at 0x408990
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f320
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x42caf8], 0x3c
jl 0x4089e8
push 0x42cafc
call fcn.0040c2c0
mov edx, dword [0x42caf4]
add esp, 4
test edx, edx
je 0x4089da
mov eax, dword [edx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test edx, edx
jne 0x4089ff
push 0x3c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x408a52
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov dword [edx], vtable.CVolObject.0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [ebp - 4], 1
lea ecx, [edx + 0x10]
mov dword [edx], vtable.CVolException.0
call fcn.004066f0
mov byte [ebp - 4], 2
mov dword [edx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3
Function at 0x408ba0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f3a8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x42caf8], 0x3c
jl 0x408bfd
push 0x42cafc
call fcn.0040c2c0
mov edi, dword [0x42caf4]
add esp, 4
test edi, edi
je 0x408bef
mov eax, dword [edi]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test edi, edi
jne 0x408c18
push 0x3c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x408ca5
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov dword [edi], vtable.CVolObject.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CVolException.0
call fcn.004066f0
mov byte [ebp - 4], 2
mov dword [edi + 0xc], 0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x20]
mov dword [edi], vtable.CVolException.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 0x20]
call dword [eax + 0x44]
lea eax, [ebx + 0x20]
push eax
lea ecx, [edi + 0x20]
call fcn.00406240
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3

Function at 0x409140
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e54d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x42caf8], 0xc
jl 0x40919b
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x40918d
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x4091b2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40920f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x42cb20], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolUserApp.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3
Function at 0x409580
Capabilities:
Get system information on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f60b
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push esi
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x800000
mov dword [0x42cae0], 0x426788
mov dword [0x42cae8], 0x4268d4
push 0
mov dword [ebp - 0x14], 0x42cae0
mov dword [0x42cafc], 1
mov dword [0x42caf8], 0x100
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x409818
lea eax, [ecx + 0x800000]
mov dword [0x42caf4], ecx
mov dword [0x42caf0], eax
mov edx, 0x7fff
mov eax, dword [0x42caf8]
mov dword [0x42caec], ecx
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x42caf8]
add ecx, eax
sub edx, 1
jne 0x409614
mov dword [ecx], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0x42cb00
mov dword [ebp - 0x18], 0x42cb00
mov dword [ebp - 0x1c], 0x42cb00
mov dword [0x42cb00], 0x426268
mov dword [0x42cb04], edx
mov dword [0x42cb08], edx
mov byte [ebp - 4], 1
mov dword [0x42cb00], 0x4263b4
mov dword [0x42cb0c], edx
mov dword [0x42cb14], edx
mov dword [0x42cb10], edx
mov dword [0x42cb18], 0x40
mov byte [ebp - 4], 2
mov dword [0x42cb18], 0x80
mov byte [ebp - 4], 5
mov dword [0x42cb1c], edx
mov byte [ebp - 4], 6
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x42cb30
mov dword [ebp - 0x20], 0x42cb30
call esi
mov byte [ebp - 4], 7
mov dword [0x42cb48], 0
mov byte [ebp - 4], 8
push 0x42cb54
mov dword [ebp - 0x24], 0x42cb54
call esi
mov byte [ebp - 4], 9
mov dword [0x42cb6c], 0x3e8
mov dword [ebp - 0x28], 0x42cb80
mov dword [ebp - 0x2c], 0x42cb80
mov dword [0x42cb80], 0x426268
mov dword [0x42cb84], 0
mov dword [0x42cb88], 0
mov byte [ebp - 4], 0xa
mov dword [0x42cb80], 0x4263b4
mov dword [0x42cb8c], 0
mov dword [0x42cb94], 0
mov dword [0x42cb90], 0
mov dword [0x42cb98], 0x40
mov byte [ebp - 4], 0xb
mov dword [0x42cb98], 0x80
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x3c]
mov dword [0x42cb74], 0x3e80
mov dword [0x42cb78], 1
mov dword [0x42cb7c], 0
lea eax, [eax*2 + 2]
mov dword [0x42cb70], eax
mov byte [ebp - 4], 0xe
push 0x42cb9c
call esi
mov byte [ebp - 4], 0xf
push ecx
mov ecx, 0x42cbb4
call fcn.00408520
mov byte [ebp - 4], 0x10
mov dword [0x42cb20], 0
mov dword [0x42cbdc], 0
movsd xmm0, qword [0x426918]
movsd qword [0x42cb28], xmm0
xorps xmm0, xmm0
mov dword [0x42cbe0], 0
mov dword [0x42cbe4], 0
mov dword [0x42cbe8], 0
mov dword [0x42cb24], 0
movq qword [0x42cb4c], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, 0x42cae0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3
Function at 0x40a110
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [esi + 0x14], 0
test ebx, ebx
jne 0x40a12f
pop esi
lea eax, [ebx + 1]
pop ebx
pop ebp
ret 0xc
mov eax, dword [ecx]
push edi
xor edi, edi
call dword [eax]
push dword [ebp + 0x10]
mov ecx, eax
movzx eax, bx
push eax
push ecx
mov dword [ebp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x40a205
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x40a205
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40a1fc
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [esi + 0x14], 0
cmp dword [esi + 0x10], edi
jl 0x40a1e0
cmp edi, 1
jne 0x40a1a5
mov eax, dword [esi + 0xc]
mov cl, byte [ebx]
mov byte [eax], cl
inc dword [esi + 0x14]
jmp 0x40a1f7
cmp edi, 2
jne 0x40a1b8
mov eax, dword [esi + 0xc]
movzx ecx, word [ebx]
mov word [eax], cx
add dword [esi + 0x14], edi
jmp 0x40a1f7
cmp edi, 4
jne 0x40a1c9
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx]
mov dword [eax], ecx
add dword [esi + 0x14], edi
jmp 0x40a1f7
cmp edi, 8
jne 0x40a1e0
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
add dword [esi + 0x14], edi
jmp 0x40a1f7
test edi, edi
jle 0x40a1f7
push edi
mov ecx, esi
call fcn.0040bb10
push edi
push ebx
push eax
call fcn.00410050
add esp, 0xc
mov edi, 1
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40a530
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x42caf8]
jg 0x40a56b
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x40a55d
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x40a581
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40a588
mov eax, ecx
pop esi
pop ebp
ret 4
push 0xffffffffffffffff
call fcn.00410943
int3

Function at 0x40a5f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x42caec]
jb 0x40a664
cmp esi, dword [0x42caf0]
jae 0x40a664
mov eax, dword [ebp + 0xc]
cmp eax, dword [0x42caf8]
jle 0x40a679
push edi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40a67d
push dword [0x42caf8]
push esi
push edi
call fcn.00410050
push 0x42cafc
call fcn.0040c2c0
mov eax, dword [0x42caf4]
add esp, 0x10
mov dword [esi], eax
mov dword [0x42caf4], esi
mov esi, edi
mov dword [0x42cafc], 1
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
push dword [ebp + 0xc]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
test esi, esi
jne 0x40a65d
push 0xffffffffffffffff
call fcn.00410943
int3