joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dca0
Capabilities:
Terminate process

Disassembly:
call fcn.0040dce0
test eax, eax
jle 0x40dcd4
push esi
push edi
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test esi, esi
pop edi
setne al
pop esi
ret
xor eax, eax
ret
Function at 0x40e2e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490ec5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4c51b8], 0x20
jl 0x40e338
push 0x4c51bc
call fcn.004478d0
mov ecx, dword [0x4c51b4]
add esp, 4
test ecx, ecx
je 0x40e32a
mov eax, dword [ecx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test ecx, ecx
jne 0x40e34f
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40e396
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
xorps xmm0, xmm0
mov dword [ecx], vtable.CVolComVariant.0
movups xmmword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3

Function at 0x40e440
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490f3d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x4c51b8], 0x20
jl 0x40e49b
push 0x4c51bc
call fcn.004478d0
mov ecx, dword [0x4c51b4]
add esp, 4
test ecx, ecx
je 0x40e48d
mov eax, dword [ecx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test ecx, ecx
jne 0x40e4b2
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40e4d9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.0040e3a0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3

Function at 0x40e930
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490ec5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4c51b8], 0x14
jl 0x40e988
push 0x4c51bc
call fcn.004478d0
mov ecx, dword [0x4c51b4]
add esp, 4
test ecx, ecx
je 0x40e97a
mov eax, dword [ecx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test ecx, ecx
jne 0x40e99f
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40e9ed
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolComObject.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3
Function at 0x40eab0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490f3d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x4c51b8], 0x14
jl 0x40eb0b
push 0x4c51bc
call fcn.004478d0
mov ecx, dword [0x4c51b4]
add esp, 4
test ecx, ecx
je 0x40eafd
mov eax, dword [ecx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test ecx, ecx
jne 0x40eb22
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40eb49
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.0040ea00
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3

Function at 0x40f350
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492e25
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4c51b8], 0x2c
jl 0x40f3a8
push 0x4c51bc
call fcn.004478d0
mov edx, dword [0x4c51b4]
add esp, 4
test edx, edx
je 0x40f39a
mov eax, dword [edx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test edx, edx
jne 0x40f3bf
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40f3f2
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.00405e70
mov byte [ebp - 4], 1
mov dword [edx], vtable.CWConstString.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3
Function at 0x40f400
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492e6d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x4c51b8], 0x2c
jl 0x40f45d
push 0x4c51bc
call fcn.004478d0
mov edi, dword [0x4c51b4]
add esp, 4
test edi, edi
je 0x40f44f
mov eax, dword [edi]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test edi, edi
jne 0x40f474
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40f4db
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.00405e70
mov byte [ebp - 4], 1
mov dword [edi], vtable.CWConstString.0
mov byte [ebp - 4], 2
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWConstString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.004059c0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3
Function at 0x417110
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490d7d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4c51b8], 0x2c
jl 0x417168
push 0x4c51bc
call fcn.004478d0
mov ecx, dword [0x4c51b4]
add esp, 4
test ecx, ecx
je 0x41715a
mov eax, dword [ecx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test ecx, ecx
jne 0x41717f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4171a4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00417380
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3

Function at 0x4171b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490de5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x4c51b8], 0x2c
jl 0x41720d
push 0x4c51bc
call fcn.004478d0
mov edi, dword [0x4c51b4]
add esp, 4
test edi, edi
je 0x4171ff
mov eax, dword [edi]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test edi, edi
jne 0x417224
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x417281
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.00417380
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CU8String.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.004059c0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3
Function at 0x418cd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490d7d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4c51b8], 0x10
jl 0x418d28
push 0x4c51bc
call fcn.004478d0
mov ecx, dword [0x4c51b4]
add esp, 4
test ecx, ecx
je 0x418d1a
mov eax, dword [ecx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test ecx, ecx
jne 0x418d3f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x418d64
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00418ff0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3

Function at 0x418df0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494f05
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x4c51b8], 0x10
jl 0x418e4c
push 0x4c51bc
call fcn.004478d0
mov esi, dword [0x4c51b4]
add esp, 4
test esi, esi
je 0x418e3e
mov eax, dword [esi]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test esi, esi
jne 0x418e63
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x418ec1
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00418ff0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_YingJianXinXi_LeiKu::rg_YingJian_WangKaXinXiLei.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x418e98
mov ecx, edi
call fcn.004192e0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x418ea4
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3
Function at 0x418ff0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494f98
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.rg_YingJianXinXi_LeiKu::rg_YingJian_WangKaXinXiLei.0
cmp dword [0x4c51b8], 0x10
jl 0x419071
push 0x4c51bc
call fcn.004478d0
mov ecx, dword [0x4c51b4]
add esp, 4
test ecx, ecx
je 0x419063
mov eax, dword [ecx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test ecx, ecx
jne 0x419088
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4190d4
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CRefObject.0
mov dword [ecx + 4], 1
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CRefObjectWithData_class_CWinAdaptersInfo_.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 0
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3

Function at 0x419540
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490d7d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4c51b8], 0xc0
jl 0x41959b
push 0x4c51bc
call fcn.004478d0
mov ecx, dword [0x4c51b4]
add esp, 4
test ecx, ecx
je 0x41958d
mov eax, dword [ecx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test ecx, ecx
jne 0x4195b5
push 0xc0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4195da
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0041a580
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3
Function at 0x4196e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x495095
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x4c51b8], 0xc0
jl 0x41973f
push 0x4c51bc
call fcn.004478d0
mov esi, dword [0x4c51b4]
add esp, 4
test esi, esi
je 0x419731
mov eax, dword [esi]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test esi, esi
jne 0x419759
push 0xc0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x419796
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0041a580
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_i_HTTP::rg_WangYeFangWenXiangYingLeii.0
call fcn.00419860
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3

Function at 0x419b50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490ec5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4c51b8], 0xc
jl 0x419ba8
push 0x4c51bc
call fcn.004478d0
mov ecx, dword [0x4c51b4]
add esp, 4
test ecx, ecx
je 0x419b9a
mov eax, dword [ecx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test ecx, ecx
jne 0x419bbf
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x419bff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_i_HTTP::rg_iWangLaoFangWenLei_WinInetAPIBan.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3
Function at 0x419c90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49115d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x4c51b8], 0xc
jl 0x419ceb
push 0x4c51bc
call fcn.004478d0
mov ecx, dword [0x4c51b4]
add esp, 4
test ecx, ecx
je 0x419cdd
mov eax, dword [ecx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test ecx, ecx
jne 0x419d02
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x419d59
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_i_HTTP::rg_iWangLaoFangWenLei_WinInetAPIBan.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_i_HTTP::rg_iWangLaoFangWenLei_WinInetAPIBan.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3
Function at 0x41d3e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490d7d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4c51b8], 0x10
jl 0x41d438
push 0x4c51bc
call fcn.004478d0
mov ecx, dword [0x4c51b4]
add esp, 4
test ecx, ecx
je 0x41d42a
mov eax, dword [ecx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test ecx, ecx
jne 0x41d44f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41d474
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0041d700
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3

Function at 0x41d500
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x495c75
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x4c51b8], 0x10
jl 0x41d55c
push 0x4c51bc
call fcn.004478d0
mov esi, dword [0x4c51b4]
add esp, 4
test esi, esi
je 0x41d54e
mov eax, dword [esi]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test esi, esi
jne 0x41d573
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x41d5d1
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0041d700
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_HuoShanShiChuang_JSONZhiChi::rg_iJSONZhiDouDuiXiangLei.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x41d5a8
mov ecx, edi
call fcn.004192e0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41d5b4
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3
Function at 0x41d700
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x495d20
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CVolObject.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [edi], vtable.rg_volcano_base::rg_KuoZhanDuiXiangLei.0
mov dword [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [edi], vtable.rg_HuoShanShiChuang_JSONZhiChi::rg_iJSONZhiDouDuiXiangLei.0
cmp dword [0x4c51b8], 0x10
jl 0x41d796
push 0x4c51bc
call fcn.004478d0
mov esi, dword [0x4c51b4]
add esp, 4
test esi, esi
je 0x41d788
mov eax, dword [esi]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test esi, esi
jne 0x41d7ad
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
mov esi, eax
test esi, esi
je 0x41d868
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
mov dword [esi], vtable.CRefObject.0
mov dword [esi + 4], 1
mov byte [ebp - 4], 3
mov dword [esi], vtable.CRefObjectWithData_class_CVolJsonObject_.0
cmp dword [0x4c51b8], 0xc
jl 0x41d800
push 0x4c51bc
call fcn.004478d0
mov ecx, dword [0x4c51b4]
add esp, 4
test ecx, ecx
je 0x41d7f2
mov eax, dword [ecx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test ecx, ecx
jne 0x41d813
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
mov ecx, eax
test ecx, ecx
je 0x41d868
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 4
mov dword [ecx], vtable.CRefObject.0
mov dword [ecx + 4], 1
mov byte [ebp - 4], 5
mov dword [ecx], vtable.CRefJsonObjectPtrWithData.0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 3
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 1
mov dword [edi + 0xc], esi
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3

Function at 0x41ecb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490d7d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4c51b8], 0x14c
jl 0x41ed0b
push 0x4c51bc
call fcn.004478d0
mov ecx, dword [0x4c51b4]
add esp, 4
test ecx, ecx
je 0x41ecfd
mov eax, dword [ecx]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test ecx, ecx
jne 0x41ed25
push 0x14c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41ed4a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0041f0a0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3
Function at 0x41edf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x496225
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x4c51b8], 0x14c
jl 0x41ee4f
push 0x4c51bc
call fcn.004478d0
mov esi, dword [0x4c51b4]
add esp, 4
test esi, esi
je 0x41ee41
mov eax, dword [esi]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test esi, esi
jne 0x41ee69
push 0x14c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x41eea6
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0041f0a0
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_volcano_WTLJieMian_base::CVolWinControl.0
call fcn.0041ef70
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3

Function at 0x41f6f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x496505
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4c51b8], 0x154
jl 0x41f74c
push 0x4c51bc
call fcn.004478d0
mov esi, dword [0x4c51b4]
add esp, 4
test esi, esi
je 0x41f73e
mov eax, dword [esi]
mov dword [0x4c51b4], eax
mov dword [0x4c51bc], 1
test esi, esi
jne 0x41f766
push 0x154
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x41f7ae
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0041f0a0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_volcano_WTLJieMian_base::CVolWinContainer.0
mov dword [esi + 0x14c], 0
mov dword [esi + 0x150], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0047b870
int3