joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4121f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42abdd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x438d98], 0x10
jl 0x412248
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x41223a
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x412267
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x412267
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_BianZhengShuLei.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x412340
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ac25
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x438d98], 0x10
jl 0x41239b
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x41238d
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x4123ba
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4123ba
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_BianZhengShuLei.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_BianZhengShuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412660
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42abdd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x438d98], 0x10
jl 0x4126b8
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x4126aa
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x4126d7
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4126d7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ZhengShuLei.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4127b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ac25
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x438d98], 0x10
jl 0x41280b
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x4127fd
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x41282a
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x41282a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ZhengShuLei.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_ZhengShuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412ad0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42abdd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x438d98], 0x10
jl 0x412b28
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x412b1a
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x412b47
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x412b47
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_volcano_base::rg_DuanZhengShuLei.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x412c30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ac25
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x438d98], 0x10
jl 0x412c8b
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x412c7d
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x412caa
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x412caa
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_volcano_base::rg_DuanZhengShuLei.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_DuanZhengShuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412fe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42abdd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x438d98], 0x10
jl 0x413038
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x41302a
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x413057
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x413057
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ZiJieLei.0
mov byte [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x413130
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ac25
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x438d98], 0x10
jl 0x41318b
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x41317d
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x4131aa
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4131aa
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ZiJieLei.0
mov byte [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_ZiJieLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov al, byte [esi + 0xc]
mov byte [ecx + 0xc], al
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x413880
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427aa5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x438d98], 0xc
jl 0x4138d8
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x4138ca
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x4138f7
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4138f7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x413940
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427aed
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x438d98], 0xc
jl 0x41399b
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x41398d
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x4139ba
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4139ba
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x413c70
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x438008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x438ea0]
mov ecx, 0x438ea0
push esi
push 0x438e9c
call dword [eax + 4]
test eax, eax
je 0x413d71
mov esi, dword [0x43805c]
test esi, esi
jne 0x413cb8
cmp dword [0x438074], 0
mov esi, 0x42d644
cmovne esi, dword [0x43806c]
mov eax, dword [0x438ea0]
mov ecx, 0x438ea0
call dword [eax + 8]
test eax, eax
je 0x413d71
push dword [ebp + 0xc]
mov edx, esi
lea ecx, [ebp - 0x14]
call fcn.004210b0
add esp, 4
test eax, eax
je 0x413d71
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [0x438eb0]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x413d3a
push 0x21
push 0x8078
push dword [0x438ea8]
push dword [0x438eb0]
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
cmp eax, 0xffffffff
je 0x413d3a
mov dword [0x438eb4], 1
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426886
mov esp, ebp
pop ebp
ret 8
mov esi, dword [0x438eb0]
mov dword [0x438eb4], 0
cmp esi, 0xffffffff
je 0x413d71
push 0
push 0
push dword [0x438ea8]
push esi
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x438eb0], 0xffffffff
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00426886
mov esp, ebp
pop ebp
ret 8

Function at 0x413f20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42abdd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x438d98], 0xc
jl 0x413f78
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x413f6a
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x413f97
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x413f97
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x438dc0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ChengXuLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x414070
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ac25
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x438d98], 0xc
jl 0x4140cb
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x4140bd
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x4140ea
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4140ea
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x438dc0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ChengXuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_ChengXuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x414480
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b025
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x438d98], 0xc
jl 0x4144d8
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x4144ca
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x4144f7
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4144f7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x438dc0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ChengXuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_ChuangKouChengXuLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4145e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b07d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x438d98], 0xc
jl 0x41463b
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x41462d
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x41465a
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x41465a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x438dc0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ChengXuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_ChuangKouChengXuLei.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_volcano_base::rg_ChuangKouChengXuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x414a80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b1dd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x438d98], 0xc
jl 0x414ad8
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x414aca
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x414af7
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x414af7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x438dc0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ChengXuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_ChuangKouChengXuLei.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_qweqwe_ffff::rg_startup_class.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x414be0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b235
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x438d98], 0xc
jl 0x414c3b
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x414c2d
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x414c5a
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x414c5a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x438dc0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ChengXuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_ChuangKouChengXuLei.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_qweqwe_ffff::rg_startup_class.0
mov byte [ebp - 4], 5
mov dword [ecx], vtable.rg_qweqwe_ffff::rg_startup_class.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4150a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427aa5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x438d98], 0xc
jl 0x4150f8
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x4150ea
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x415117
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x415117
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x438dc0], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret