joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ed70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b5cd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x467f48], 0xc
jl 0x40edcb
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x40edbd
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x40ede2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40ee39
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3

Function at 0x40f130
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b6dd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x467f48], 0x14
jl 0x40f188
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x40f17a
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x40f19f
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40f1f7
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n1::rg_n2366.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n3684.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3
Function at 0x40f290
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b725
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x467f48], 0x14
jl 0x40f2eb
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x40f2dd
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x40f302
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40f37d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n1::rg_n2366.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n3684.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n3684.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x10], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3

Function at 0x40f590
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b6dd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x467f48], 0x14
jl 0x40f5e8
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x40f5da
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x40f5ff
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40f657
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n1::rg_n2366.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n3558.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3
Function at 0x40f6f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b725
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x467f48], 0x14
jl 0x40f74b
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x40f73d
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x40f762
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40f7dd
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n1::rg_n2366.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n3558.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n3558.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x10], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3

Function at 0x4100c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b6dd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x467f48], 0xc
jl 0x410118
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x41010a
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x41012f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41017f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x467f70], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6828.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3
Function at 0x410210
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b725
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x467f48], 0xc
jl 0x41026b
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x41025d
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x410282
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4102e9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x467f70], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6828.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n6828.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3

Function at 0x4105f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44bd25
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x467f48], 0xc
jl 0x410648
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x41063a
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x41065f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4106b9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x467f70], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6828.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n6838.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3
Function at 0x410750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44bd7d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x467f48], 0xc
jl 0x4107ab
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x41079d
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x4107c2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x410833
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x467f70], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6828.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n6838.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n1::rg_n6838.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3

Function at 0x410bc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4499cd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x467f48], 0x1518
jl 0x410c1b
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x410c0d
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x410c35
push 0x1518
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x410c5a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00410f00
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3
Function at 0x410cf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44bec5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x467f48], 0x1518
jl 0x410d50
push 0x467f4c
call fcn.00423ab0
mov ebx, dword [0x467f44]
add esp, 4
test ebx, ebx
je 0x410d42
mov eax, dword [ebx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ebx, ebx
jne 0x410d6a
push 0x1518
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x410dca
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
mov ecx, ebx
call fcn.00410f00
mov byte [ebp - 4], 1
lea ecx, [ebx + 0xc]
mov dword [ebx], vtable.rg_n::rg_n13327.0
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
add edi, 0xc
mov dword [ebx + 8], eax
mov eax, dword [ebx + 0xc]
call dword [eax + 0x44]
push edi
lea ecx, [ebx + 0xc]
call fcn.00402dc0
push edi
lea ecx, [ebx + 0xc]
call fcn.004069d0
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3

Function at 0x411260
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449b15
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x467f48], 0xc
jl 0x4112b8
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x4112aa
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x4112cf
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x411315
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x467f70], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3
Function at 0x411540
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4499cd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x467f48], 0x50
jl 0x411598
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x41158a
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x4115af
push 0x50
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4115d4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00411e80
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3

Function at 0x411660
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c0d5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x467f48], 0x50
jl 0x4116bc
push 0x467f4c
call fcn.00423ab0
mov esi, dword [0x467f44]
add esp, 4
test esi, esi
je 0x4116ae
mov eax, dword [esi]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test esi, esi
jne 0x4116d3
push 0x50
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x411731
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00411e80
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n7331::rg_n7746.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x411708
mov ecx, edi
call fcn.0040bc00
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x411714
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3

Function at 0x411950
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4499cd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x467f48], 0x10
jl 0x4119a8
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x41199a
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x4119bf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4119e4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00411c70
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3
Function at 0x411a70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c175
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x467f48], 0x10
jl 0x411acc
push 0x467f4c
call fcn.00423ab0
mov esi, dword [0x467f44]
add esp, 4
test esi, esi
je 0x411abe
mov eax, dword [esi]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test esi, esi
jne 0x411ae3
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x411b41
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00411c70
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n7331::rg_n7561.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x411b18
mov ecx, edi
call fcn.0040bc00
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x411b24
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3

Function at 0x411c70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c1fd
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.rg_n7331::rg_n7561.0
cmp dword [0x467f48], 0x18
jl 0x411cf1
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x411ce3
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x411d08
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x411d62
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CRefObject.0
mov dword [ecx + 4], 1
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CRefObjectWithData_class_CWinKeyboardOperateModule_.0
mov dword [ecx + 8], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0xc], 1
mov dword [ecx + 0x14], 0
mov byte [ebp - 4], 0
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3
Function at 0x411e80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c27f
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.rg_n7331::rg_n7746.0
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x40], 1
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov byte [ebp - 4], 4
cmp dword [0x467f48], 0x34
jl 0x411f81
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x411f73
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x411f9c
push 0x34
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x412030
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 5
mov dword [ecx], vtable.CRefObject.0
mov dword [ecx + 4], 1
mov byte [ebp - 4], 6
lea eax, [ecx + 8]
mov dword [ecx], vtable.CRefObjectWithData_class_CWinHookMessage_.0
mov dword [ebp - 0x18], eax
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov byte [ebp - 4], 7
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0xc], 0
mov byte [ebp - 4], 4
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3

Function at 0x4125c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4499cd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x467f48], 0x160
jl 0x41261b
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x41260d
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x412635
push 0x160
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41265a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00412980
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3