joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412550
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4494e5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5b9718], 0x1418
jl 0x4125b0
push 0x5b971c
call fcn.00429990
mov esi, dword [0x5b9714]
add esp, 4
test esi, esi
je 0x4125a2
mov eax, dword [esi]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test esi, esi
jne 0x4125ca
push 0x1418
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x412631
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.004136a0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n16744::rg_n16748.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov ebx, dword [edi + 0xc]
test ebx, ebx
je 0x4125ff
mov ecx, ebx
call fcn.00423730
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41260b
mov eax, dword [ecx]
call dword [eax + 0x20]
push edi
mov ecx, esi
mov dword [esi + 0xc], ebx
call fcn.00413c70
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x4128e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449585
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x40
jl 0x412939
push 0x5b971c
call fcn.00429990
mov esi, dword [0x5b9714]
add esp, 4
test esi, esi
je 0x41292b
mov eax, dword [esi]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test esi, esi
jne 0x412950
push 0x40
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x412984
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00411f70
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n6822::rg_n6999.0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x412a10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4495cd
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5b9718], 0x40
jl 0x412a6c
push 0x5b971c
call fcn.00429990
mov esi, dword [0x5b9714]
add esp, 4
test esi, esi
je 0x412a5e
mov eax, dword [esi]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test esi, esi
jne 0x412a83
push 0x40
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x412ada
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00411f70
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n6822::rg_n6999.0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x28]
mov dword [esi], vtable.rg_n6822::rg_n6999.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
lea eax, [edi + 0x28]
push eax
call fcn.004212f0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x412e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4496f8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x2c
jl 0x412e98
push 0x5b971c
call fcn.00429990
mov edx, dword [0x5b9714]
add esp, 4
test edx, edx
je 0x412e8a
mov eax, dword [edx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test edx, edx
jne 0x412eaf
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x412f02
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov dword [edx], vtable.CVolObject.0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [ebp - 4], 1
mov dword [edx], vtable.rg_n::rg_n2149.0
mov byte [ebp - 4], 2
push ecx
lea ecx, [edx + 0xc]
mov dword [edx], vtable.rg_n::rg_n1726.0
call fcn.004183a0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x413040
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449750
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5b9718], 0x2c
jl 0x41309c
push 0x5b971c
call fcn.00429990
mov esi, dword [0x5b9714]
add esp, 4
test esi, esi
je 0x41308e
mov eax, dword [esi]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test esi, esi
jne 0x4130b3
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x41311a
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n::rg_n2149.0
mov byte [ebp - 4], 2
push ecx
lea ecx, [esi + 0xc]
mov dword [esi], vtable.rg_n::rg_n1726.0
call fcn.004183a0
mov byte [ebp - 4], 4
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n::rg_n1726.0
call fcn.00413220
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x414880
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449d4e
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
push ebx
push esi
push edi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea ebx, [esi + 0x10b4]
cmp edi, ebx
je 0x414a3e
lea eax, [esi + 0xcc4]
cmp edi, eax
jne 0x41491d
push dword [esi + 0x20]
call dword [0x5b9844]
cmp eax, 0x209
jne 0x4148ef
push 0
push 8
push dword [esi + 0xcd0]
call dword [0x5b982c]
push 0x1ac
jmp 0x414914
push dword [esi + 0x20]
call dword [0x5b9844]
cmp eax, 0x1ac
jne 0x41491d
push 1
push 8
push dword [esi + 0xcd0]
call dword [0x5b982c]
push 0x209
push dword [esi + 0x20]
call dword [0x5b9848]
lea eax, [esi + 0x774]
cmp edi, eax
jne 0x41492f
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esi + 0xf64]
cmp edi, eax
jne 0x414a28
lea ecx, [ebp - 0x38]
call fcn.00408010
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x90]
call fcn.00408010
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64]
call fcn.00408010
mov byte [ebp - 4], 2
or dword [edx + 4], 1
or dword [eax + 4], 1
push edx
push ecx
mov edx, eax
lea ecx, [ebp - 0xbc]
call fcn.00415dd0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x38]
push eax
call fcn.004099c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xbc]
call fcn.00408ae0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64]
call fcn.00408ae0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x90]
call fcn.00408ae0
lea ecx, [ebp - 0x38]
call fcn.00417fa0
test eax, eax
je 0x414a19
push 0x5a6814
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x64]
call fcn.0042b0d0
mov byte [ebp - 4], 4
lea ecx, [esi + 0x12b4]
push ecx
mov edx, eax
lea ecx, [ebp - 0x90]
call fcn.0042af50
add esp, 8
mov byte [ebp - 4], 5
lea ecx, [esi + 0xa14]
push eax
call fcn.00404d60
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x90]
call fcn.00408ae0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.00408ae0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00408ae0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
call fcn.00414a70
push ecx
mov ecx, ebx
call fcn.004026f0
push 0x1ac
lea ecx, [esi + 0x14]
call fcn.004026b0
push ecx
lea ecx, [esi + 0xb74]
call fcn.004026f0
mov ecx, esi
call fcn.00416290
int3
Function at 0x417a30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447655
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x14
jl 0x417a88
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x417a7a
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x417a9f
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x417aed
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolComObject.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x417bb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4476cd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x14
jl 0x417c0b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x417bfd
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x417c22
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x417c49
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.00417b00
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x418520
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447655
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x10
jl 0x418578
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x41856a
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x41858f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4185d6
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x4185e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ad1d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5b9718], 0x10
jl 0x41863c
push 0x5b971c
call fcn.00429990
mov esi, dword [0x5b9714]
add esp, 4
test esi, esi
je 0x41862e
mov eax, dword [esi]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test esi, esi
jne 0x418653
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4186cf
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolRefObject.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4186a6
mov ecx, edi
call fcn.00423730
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4186b2
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x418c70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ae2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x10
jl 0x418cc8
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x418cba
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x418cdf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x418d30
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2308.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x418dc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ae75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x10
jl 0x418e1b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x418e0d
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x418e32
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x418ea0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2308.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2308.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x419170
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ae2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x18
jl 0x4191c8
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x4191ba
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x4191df
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x419231
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_n::rg_n2312.0
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x4192f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ae75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x18
jl 0x41934b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x41933d
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x419362
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4193d5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_n::rg_n2312.0
movsd qword [ecx + 0x10], xmm0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2312.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
movsd xmm0, qword [esi + 0x10]
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x4196a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ae2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x10
jl 0x4196f8
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x4196ea
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x41970f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x419760
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2314.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x4197f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ae75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x10
jl 0x41984b
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x41983d
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x419862
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4198d0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2314.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2314.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x419ad0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ae2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x18
jl 0x419b28
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x419b1a
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x419b3f
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x419b97
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2310.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3
Function at 0x419c30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ae75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5b9718], 0x18
jl 0x419c8b
push 0x5b971c
call fcn.00429990
mov edx, dword [0x5b9714]
add esp, 4
test edx, edx
je 0x419c7d
mov eax, dword [edx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test edx, edx
jne 0x419ca2
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x419d1d
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov dword [edx], vtable.CVolObject.0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [ebp - 4], 1
mov dword [edx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.rg_n::rg_n2310.0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov byte [ebp - 4], 3
mov dword [edx], vtable.rg_n::rg_n2310.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3

Function at 0x419f80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ae2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b7018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5b9718], 0x10
jl 0x419fd8
push 0x5b971c
call fcn.00429990
mov ecx, dword [0x5b9714]
add esp, 4
test ecx, ecx
je 0x419fca
mov eax, dword [ecx]
mov dword [0x5b9714], eax
mov dword [0x5b971c], 1
test ecx, ecx
jne 0x419fef
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41a040
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2306.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00433263
int3