joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004c90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f1fd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002db38], 0x10
jl 0x10004ce8
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x10004cda
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x10004cff
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10004d4d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ZiJieLei.0
mov byte [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3

Function at 0x10004de0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f245
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002db38], 0x10
jl 0x10004e3b
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x10004e2d
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x10004e52
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10004ebd
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ZiJieLei.0
mov byte [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_ZiJieLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov al, byte [esi + 0xc]
mov byte [ecx + 0xc], al
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3
Function at 0x10005560
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ef35
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002db38], 0xc
jl 0x100055b8
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x100055aa
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x100055cf
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000560f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3

Function at 0x10005620
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f4fd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002db38], 0xc
jl 0x1000567b
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x1000566d
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x10005692
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100056e9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3
Function at 0x10005b10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f1fd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002db38], 0xc
jl 0x10005b68
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x10005b5a
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x10005b7f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10005bcf
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x1002db60], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ChengXuLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3

Function at 0x10005c60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f245
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002db38], 0xc
jl 0x10005cbb
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x10005cad
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x10005cd2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10005d39
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x1002db60], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ChengXuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_ChengXuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3
Function at 0x10006040
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f695
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002db38], 0xc
jl 0x10006098
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x1000608a
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x100060af
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10006109
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x1002db60], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ChengXuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_DongTaiKuChengXuLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3

Function at 0x100061a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f6ed
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002db38], 0xc
jl 0x100061fb
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x100061ed
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x10006212
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10006283
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x1002db60], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ChengXuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_DongTaiKuChengXuLei.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_volcano_base::rg_DongTaiKuChengXuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3
Function at 0x10006610
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f84d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002db38], 0xc
jl 0x10006668
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x1000665a
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x1000667f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100066e3
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x1002db60], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ChengXuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_DongTaiKuChengXuLei.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_volcano_app::rg_startup_class.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3

Function at 0x10006770
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f8a5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002db38], 0xc
jl 0x100067cb
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x100067bd
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x100067e2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000685d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x1002db60], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ChengXuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_DongTaiKuChengXuLei.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_volcano_app::rg_startup_class.0
mov byte [ebp - 4], 5
mov dword [ecx], vtable.rg_volcano_app::rg_startup_class.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3
Function at 0x10006f40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f04d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002db38], 0x2c
jl 0x10006f98
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x10006f8a
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x10006faf
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10006fd4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.10007420
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3

Function at 0x10006fe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001fa85
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x1002db38], 0x2c
jl 0x1000703d
push 0x1002db3c
call fcn.1000c340
mov edi, dword [0x1002db34]
add esp, 4
test edi, edi
je 0x1000702f
mov eax, dword [edi]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test edi, edi
jne 0x10007054
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x100070b1
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.10007420
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.10001b20
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3
Function at 0x100074e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ef35
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002db38], 0xc
jl 0x10007538
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x1000752a
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x1000754f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10007595
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x1002db60], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3
Function at 0x10009420
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f04d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002db38], 0x28
jl 0x10009478
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x1000946a
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x1000948f
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100094b5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push ecx
call fcn.10009790
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3

Function at 0x10009590
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ff75
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x1002db38], 0x28
jl 0x100095ec
push 0x1002db3c
call fcn.1000c340
mov esi, dword [0x1002db34]
add esp, 4
test esi, esi
je 0x100095de
mov eax, dword [esi]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test esi, esi
jne 0x10009603
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10009641
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push ecx
mov ecx, esi
call fcn.10009790
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.CVolObjectArray.0
call fcn.10009700
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3
Function at 0x10009b70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f4fd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002db38], 0xc
jl 0x10009bcb
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x10009bbd
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x10009be2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10009c3f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x1002db60], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolUserApp.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3
Function at 0x10009fb0
Capabilities:
Get system information on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002026b
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x80000
mov dword [0x1002db20], 0x1002781c
mov dword [0x1002db28], 0x10027974
push 0
mov dword [ebp - 0x10], 0x1002db20
mov dword [0x1002db3c], 1
mov dword [0x1002db38], 0x100
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000a248
lea eax, [ecx + 0x80000]
mov dword [0x1002db34], ecx
mov dword [0x1002db30], eax
mov edx, 0x7ff
mov eax, dword [0x1002db38]
mov dword [0x1002db2c], ecx
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x1002db38]
add ecx, eax
sub edx, 1
jne 0x1000a044
mov dword [ecx], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], 0x1002db40
mov dword [ebp - 0x18], 0x1002db40
mov dword [ebp - 0x1c], 0x1002db40
mov dword [0x1002db40], 0x1002701c
mov dword [0x1002db44], edx
mov dword [0x1002db48], edx
mov byte [ebp - 4], 1
mov dword [0x1002db40], 0x10026f6c
mov dword [0x1002db4c], edx
mov dword [0x1002db54], edx
mov dword [0x1002db50], edx
mov dword [0x1002db58], 0x40
mov byte [ebp - 4], 2
mov dword [0x1002db58], 0x80
mov byte [ebp - 4], 5
mov dword [0x1002db5c], edx
mov byte [ebp - 4], 6
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x1002db70
mov dword [ebp - 0x1c], 0x1002db70
call esi
mov byte [ebp - 4], 7
mov dword [0x1002db88], 0
mov byte [ebp - 4], 8
push 0x1002db94
mov dword [ebp - 0x1c], 0x1002db94
call esi
mov byte [ebp - 4], 9
mov dword [0x1002dbac], 0x3e8
mov dword [ebp - 0x18], 0x1002dbc0
mov dword [ebp - 0x14], 0x1002dbc0
mov dword [0x1002dbc0], 0x1002701c
mov dword [0x1002dbc4], 0
mov dword [0x1002dbc8], 0
mov byte [ebp - 4], 0xa
mov dword [0x1002dbc0], 0x10026f6c
mov dword [0x1002dbcc], 0
mov dword [0x1002dbd4], 0
mov dword [0x1002dbd0], 0
mov dword [0x1002dbd8], 0x40
mov byte [ebp - 4], 0xb
mov dword [0x1002dbd8], 0x80
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x2c]
mov dword [0x1002dbb4], 0x3e80
mov dword [0x1002dbb8], 1
mov dword [0x1002dbbc], 0
lea eax, [eax*2 + 2]
mov dword [0x1002dbb0], eax
mov byte [ebp - 4], 0xe
push 0x1002dbdc
call esi
mov byte [ebp - 4], 0xf
push ecx
mov ecx, 0x1002dbf4
call fcn.10009790
mov byte [ebp - 4], 0x10
mov dword [0x1002db60], 0
mov dword [0x1002dc1c], 0
movsd xmm0, qword [0x100279b8]
movsd qword [0x1002db68], xmm0
xorps xmm0, xmm0
mov dword [0x1002dc20], 0
mov dword [0x1002dc24], 0
mov dword [0x1002dc28], 0
mov dword [0x1002db64], 0
movq qword [0x1002db8c], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, 0x1002db20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3
Function at 0x1000ab70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [esi + 0x14], 0
test ebx, ebx
jne 0x1000ab8f
pop esi
lea eax, [ebx + 1]
pop ebx
pop ebp
ret 0xc
mov eax, dword [ecx]
push edi
xor edi, edi
call dword [eax]
push dword [ebp + 0x10]
mov ecx, eax
movzx eax, bx
push eax
push ecx
mov dword [ebp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x1000ac65
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x1000ac65
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x1000ac5c
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [esi + 0x14], 0
cmp dword [esi + 0x10], edi
jl 0x1000ac40
cmp edi, 1
jne 0x1000ac05
mov eax, dword [esi + 0xc]
mov cl, byte [ebx]
mov byte [eax], cl
inc dword [esi + 0x14]
jmp 0x1000ac57
cmp edi, 2
jne 0x1000ac18
mov eax, dword [esi + 0xc]
movzx ecx, word [ebx]
mov word [eax], cx
add dword [esi + 0x14], edi
jmp 0x1000ac57
cmp edi, 4
jne 0x1000ac29
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx]
mov dword [eax], ecx
add dword [esi + 0x14], edi
jmp 0x1000ac57
cmp edi, 8
jne 0x1000ac40
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
add dword [esi + 0x14], edi
jmp 0x1000ac57
test edi, edi
jle 0x1000ac57
push edi
mov ecx, esi
call fcn.1000bc60
push edi
push ebx
push eax
call fcn.10010710
add esp, 0xc
mov edi, 1
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc