joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422ee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d78cd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x8d0d94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x8d6bb8], 0x10
jl 0x422f38
push 0x8d6bbc
call fcn.00448ff0
mov ecx, dword [0x8d6bb4]
add esp, 4
test ecx, ecx
je 0x422f2a
mov eax, dword [ecx]
mov dword [0x8d6bb4], eax
mov dword [0x8d6bbc], 1
test ecx, ecx
jne 0x422f4f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x422fa0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n402::rg_n2710.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.005b06c0
int3

Function at 0x423030
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7915
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x8d0d94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x8d6bb8], 0x10
jl 0x42308b
push 0x8d6bbc
call fcn.00448ff0
mov ecx, dword [0x8d6bb4]
add esp, 4
test ecx, ecx
je 0x42307d
mov eax, dword [ecx]
mov dword [0x8d6bb4], eax
mov dword [0x8d6bbc], 1
test ecx, ecx
jne 0x4230a2
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x423110
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n402::rg_n2710.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n402::rg_n2710.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.005b06c0
int3
Function at 0x423310
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d78cd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x8d0d94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x8d6bb8], 0x10
jl 0x423368
push 0x8d6bbc
call fcn.00448ff0
mov ecx, dword [0x8d6bb4]
add esp, 4
test ecx, ecx
je 0x42335a
mov eax, dword [ecx]
mov dword [0x8d6bb4], eax
mov dword [0x8d6bbc], 1
test ecx, ecx
jne 0x42337f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4233cf
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n402::rg_n2708.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.005b06c0
int3

Function at 0x423470
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7915
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x8d0d94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x8d6bb8], 0x10
jl 0x4234cb
push 0x8d6bbc
call fcn.00448ff0
mov ecx, dword [0x8d6bb4]
add esp, 4
test ecx, ecx
je 0x4234bd
mov eax, dword [ecx]
mov dword [0x8d6bb4], eax
mov dword [0x8d6bbc], 1
test ecx, ecx
jne 0x4234e2
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x423551
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n402::rg_n2708.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n402::rg_n2708.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.005b06c0
int3
Function at 0x4237a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d78cd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x8d0d94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x8d6bb8], 0x10
jl 0x4237f8
push 0x8d6bbc
call fcn.00448ff0
mov ecx, dword [0x8d6bb4]
add esp, 4
test ecx, ecx
je 0x4237ea
mov eax, dword [ecx]
mov dword [0x8d6bb4], eax
mov dword [0x8d6bbc], 1
test ecx, ecx
jne 0x42380f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42385d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n402::rg_n2704.0
mov byte [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.005b06c0
int3

Function at 0x4238f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7915
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x8d0d94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x8d6bb8], 0x10
jl 0x42394b
push 0x8d6bbc
call fcn.00448ff0
mov ecx, dword [0x8d6bb4]
add esp, 4
test ecx, ecx
je 0x42393d
mov eax, dword [ecx]
mov dword [0x8d6bb4], eax
mov dword [0x8d6bbc], 1
test ecx, ecx
jne 0x423962
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4239cd
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n402::rg_n2704.0
mov byte [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n402::rg_n2704.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov al, byte [esi + 0xc]
mov byte [ecx + 0xc], al
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.005b06c0
int3
Function at 0x4240b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1875
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x8d0d94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x8d6bb8], 0xc
jl 0x424108
push 0x8d6bbc
call fcn.00448ff0
mov ecx, dword [0x8d6bb4]
add esp, 4
test ecx, ecx
je 0x4240fa
mov eax, dword [ecx]
mov dword [0x8d6bb4], eax
mov dword [0x8d6bbc], 1
test ecx, ecx
jne 0x42411f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42415f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.005b06c0
int3

Function at 0x424170
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d235d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x8d0d94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x8d6bb8], 0xc
jl 0x4241cb
push 0x8d6bbc
call fcn.00448ff0
mov ecx, dword [0x8d6bb4]
add esp, 4
test ecx, ecx
je 0x4241bd
mov eax, dword [ecx]
mov dword [0x8d6bb4], eax
mov dword [0x8d6bbc], 1
test ecx, ecx
jne 0x4241e2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x424239
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.005b06c0
int3

Function at 0x424550
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d12dd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x8d0d94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x8d6bb8], 0x28
jl 0x4245a8
push 0x8d6bbc
call fcn.00448ff0
mov ecx, dword [0x8d6bb4]
add esp, 4
test ecx, ecx
je 0x42459a
mov eax, dword [ecx]
mov dword [0x8d6bb4], eax
mov dword [0x8d6bbc], 1
test ecx, ecx
jne 0x4245bf
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4245e4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.004255d0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.005b06c0
int3
Function at 0x424670
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7ca5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x8d0d94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x8d6bb8], 0x28
jl 0x4246cc
push 0x8d6bbc
call fcn.00448ff0
mov esi, dword [0x8d6bb4]
add esp, 4
test esi, esi
je 0x4246be
mov eax, dword [esi]
mov dword [0x8d6bb4], eax
mov dword [0x8d6bbc], 1
test esi, esi
jne 0x4246e3
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x424748
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.004255d0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n7333::rg_n7334.1.0
mov dword [esi + 0xc], vtable.rg_n7333::rg_n7334.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0x14]
test edi, edi
je 0x42471f
mov ecx, edi
call fcn.004280d0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x42472b
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0x14], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.005b06c0
int3

Function at 0x424d60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d12dd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x8d0d94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x8d6bb8], 0xc0
jl 0x424dbb
push 0x8d6bbc
call fcn.00448ff0
mov ecx, dword [0x8d6bb4]
add esp, 4
test ecx, ecx
je 0x424dad
mov eax, dword [ecx]
mov dword [0x8d6bb4], eax
mov dword [0x8d6bbc], 1
test ecx, ecx
jne 0x424dd5
push 0xc0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x424dfa
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00427a70
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.005b06c0
int3
Function at 0x424f00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7d85
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x8d0d94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x8d6bb8], 0xc0
jl 0x424f5f
push 0x8d6bbc
call fcn.00448ff0
mov esi, dword [0x8d6bb4]
add esp, 4
test esi, esi
je 0x424f51
mov eax, dword [esi]
mov dword [0x8d6bb4], eax
mov dword [0x8d6bbc], 1
test esi, esi
jne 0x424f79
push 0xc0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x424fb6
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00427a70
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n7333::rg_n8128.0
call fcn.00412b40
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.005b06c0
int3

Function at 0x425190
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d12dd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x8d0d94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x8d6bb8], 0x48
jl 0x4251e8
push 0x8d6bbc
call fcn.00448ff0
mov ecx, dword [0x8d6bb4]
add esp, 4
test ecx, ecx
je 0x4251da
mov eax, dword [ecx]
mov dword [0x8d6bb4], eax
mov dword [0x8d6bbc], 1
test ecx, ecx
jne 0x4251ff
push 0x48
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x425224
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00425f20
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.005b06c0
int3
Function at 0x4252b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7e25
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x8d0d94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x8d6bb8], 0x48
jl 0x42530d
push 0x8d6bbc
call fcn.00448ff0
mov esi, dword [0x8d6bb4]
add esp, 4
test esi, esi
je 0x4252ff
mov eax, dword [esi]
mov dword [0x8d6bb4], eax
mov dword [0x8d6bbc], 1
test esi, esi
jne 0x425324
push 0x48
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x425398
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00425f20
mov byte [ebp - 4], 1
lea ecx, [esi + 0xc]
mov dword [esi], vtable.rg_n7333::rg_n8076.0
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 8]
mov dword [esi + 8], eax
mov eax, dword [esi + 0xc]
call dword [eax + 0x44]
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [esi + 0x14], eax
mov ebx, dword [ebx + 0x20]
test ebx, ebx
je 0x42536e
mov ecx, ebx
call fcn.004280d0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x42537a
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0x20], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.005b06c0
int3
Function at 0x4255d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7f0e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x8d0d94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CVolObject.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
sub esp, 0xc
lea esi, [edi + 0xc]
mov dword [esi], vtable.IVolNoticeReceiver.0
mov dword [esi + 4], 0
call fcn.00445930
mov dword [esi + 4], eax
test eax, eax
je 0x425657
push esi
push str._VOL_IVolNoticeReceiver
push eax
call dword [sym.imp.USER32.dll_SetPropW]
test eax, eax
jne 0x425657
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 4], 0
mov byte [ebp - 4], 1
mov dword [edi], vtable.rg_n7333::rg_n7334.1.0
mov dword [esi], vtable.rg_n7333::rg_n7334.0
mov dword [edi + 0x18], 1
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov byte [ebp - 4], 2
cmp dword [0x8d6bb8], 0x2c
jl 0x4256bc
push 0x8d6bbc
call fcn.00448ff0
mov esi, dword [0x8d6bb4]
add esp, 4
test esi, esi
je 0x4256ae
mov eax, dword [esi]
mov dword [0x8d6bb4], eax
mov dword [0x8d6bbc], 1
test esi, esi
jne 0x4256d3
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x425752
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 3
mov dword [esi], vtable.CRefObject.0
mov dword [esi + 4], 1
mov byte [ebp - 4], 4
mov dword [esi], vtable.CRefObjectWithData_class_CCurlWraper_.0
call fcn.00552140
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [ebp - 4], 2
mov dword [edi + 0x14], esi
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.005b06c0
int3
Function at 0x425f20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d8079
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x8d0d94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CVolObject.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
lea ecx, [edi + 0xc]
mov dword [edi], vtable.rg_n7333::rg_n8076.0
call fcn.004255d0
mov byte [ebp - 4], 1
mov dword [edi + 0x34], 1
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov byte [ebp - 4], 2
cmp dword [0x8d6bb8], 0x40
jl 0x425fcf
push 0x8d6bbc
call fcn.00448ff0
mov ebx, dword [0x8d6bb4]
add esp, 4
test ebx, ebx
je 0x425fc1
mov eax, dword [ebx]
mov dword [0x8d6bb4], eax
mov dword [0x8d6bbc], 1
test ebx, ebx
jne 0x425fea
push 0x40
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x4260aa
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 3
mov dword [ebx], vtable.CRefObject.0
mov dword [ebx + 4], 1
mov byte [ebp - 4], 4
lea eax, [ebx + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push eax
mov dword [ebx], vtable.CVolEventObjectPointer.0
call esi
mov byte [ebp - 4], 5
lea eax, [ebx + 0x24]
push eax
call esi
mov byte [ebp - 4], 6
mov dword [ebx + 8], 0
mov dword [ebx + 0x3c], edi
mov byte [ebp - 4], 2
push ecx
lea ecx, [edi + 0xc]
mov dword [edi + 0x44], ebx
call fcn.00425950
mov ebx, dword [edi + 0x44]
lea esi, [edi + 0x24]
push esi
call fcn.00448ff0
mov edx, dword [esi + 8]
add esp, 4
mov dword [esi + 0xc], 0
test ebx, ebx
jne 0x426061
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
jmp 0x42607e
mov dword [esi + 4], 0x425510
cmp edx, ebx
jne 0x426074
mov dword [esi], 1
jmp 0x42608f
mov ecx, ebx
mov dword [esi + 8], ebx
call fcn.004280d0
mov dword [esi], 1
test edx, edx
je 0x42608f
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0x20]
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.005b06c0
int3
Function at 0x428210
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1995
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x8d0d94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x8d6bb8], 0x10
jl 0x428269
push 0x8d6bbc
call fcn.00448ff0
mov esi, dword [0x8d6bb4]
add esp, 4
test esi, esi
je 0x42825b
mov eax, dword [esi]
mov dword [0x8d6bb4], eax
mov dword [0x8d6bbc], 1
test esi, esi
jne 0x428280
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4282ca
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n8373::rg_n8382.0
call dword [sym.imp.DeelxToolx86.dll_DeelxTool_Create]
mov dword [esi + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.005b06c0
int3

Function at 0x428360
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d85bd
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x8d0d94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x8d6bb8], 0x10
jl 0x4283bc
push 0x8d6bbc
call fcn.00448ff0
mov esi, dword [0x8d6bb4]
add esp, 4
test esi, esi
je 0x4283ae
mov eax, dword [esi]
mov dword [0x8d6bb4], eax
mov dword [0x8d6bbc], 1
test esi, esi
jne 0x4283d3
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x428434
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n8373::rg_n8382.0
call dword [sym.imp.DeelxToolx86.dll_DeelxTool_Create]
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 2
mov dword [esi], vtable.rg_n8373::rg_n8382.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.005b06c0
int3