joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d01555d
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x214]
sub esp, 0x294
mov eax, dword [0x6d030030]
xor eax, ebp
mov dword [ebp + 0x210], eax
mov eax, dword [ebp + 0x21c]
push ebx
push esi
push edi
push 0x10
pop edi
mov dword [ebp - 0x78], eax
call fcn.6d0153ca
push 8
mov esi, eax
call fcn.6d01582d
mov ebx, eax
pop ecx
lea eax, [ebp + 0xd0]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], ebx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x6d0155c8
mov dword [ebx], eax
lea eax, [ebp + 0xfc]
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
test edi, edi
je 0x6d0155cf
and dword [ebx + 4], 0
jmp 0x6d0155e4
xor eax, eax
jmp 0x6d0156af
lea eax, [ebp - 0x70]
push eax
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindNextFileA]
neg eax
sbb edi, edi
lea eax, [ebp - 0x44]
and edi, eax
test edi, edi
je 0x6d015695
push edi
call fcn.6d017a10
pop ecx
cmp eax, 4
jl 0x6d0155bb
add eax, edi
cmp byte [eax - 4], 0x2e
jne 0x6d0155bb
add eax, 0xfffffffd
push 0x6d02982c
push eax
mov dword [ebp - 0x74], eax
call fcn.6d018270
pop ecx
pop ecx
test eax, eax
je 0x6d01562a
push 0x6d029828
push dword [ebp - 0x74]
call fcn.6d018270
pop ecx
pop ecx
test eax, eax
jne 0x6d0155bb
push 0x3b
push edi
call fcn.6d0193f0
pop ecx
pop ecx
test eax, eax
jne 0x6d0155bb
push dword [ebp - 0x78]
call fcn.6d017a10
push edi
mov ebx, eax
call fcn.6d017a10
mov dword [ebp - 0x74], eax
add eax, ebx
push eax
call fcn.6d01582d
lea ecx, [ebx - 1]
push ecx
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
push eax
call fcn.6d023fa5
mov eax, dword [ebp - 0x74]
inc eax
push eax
push edi
mov edi, dword [ebp - 0x7c]
lea eax, [edi + ebx - 1]
push eax
call fcn.6d023fa5
mov ecx, dword [esi + 4]
add esp, 0x24
inc ecx
call fcn.6d015420
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov ebx, dword [ebp - 0x80]
mov dword [ecx + eax*4], edi
inc dword [esi + 4]
jmp 0x6d0155bb
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindClose]
push dword [ebx + 4]
call fcn.6d015895
push ebx
call fcn.6d015895
pop ecx
pop ecx
mov eax, esi
mov ecx, dword [ebp + 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d018259
add ebp, 0x214
leave
ret

Function at 0x6d018259
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d030030]
jne 0x6d018263
repz ret
jmp fcn.6d01e721
Function at 0x6d023fa5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x6d023fb4
pop dword [ebp - 0x18]
mov eax, 0x6d023fb4
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x17c322d5
sub dword [ebp - 0x28], 0xc970dd8a
mov dword [ebp - 0x24], 0x886161f5
add dword [ebp - 0x24], 0xa9d1ea50
mov dword [ebp - 0x20], 0x9addf690
sub dword [ebp - 0x20], 0x4e91b262
mov dword [ebp - 0x1c], 0x9bd3b7ec
add dword [ebp - 0x1c], 0x642c4814
lea eax, [ebp - 0x28]
push eax
mov eax, 0x4a8716cf
sub eax, 0xdd84967f
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xdca938b1
sub dword [ebp - 0x28], 0x6836cf5b
mov dword [ebp - 0x24], 0x4530e56b
sub dword [ebp - 0x24], 0x3c483f6
mov dword [ebp - 0x20], 0x5a7859
add dword [ebp - 0x20], 0x6314f413
mov dword [ebp - 0x1c], 0xbfc36993
add dword [ebp - 0x1c], 0x403c966d
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x411bd942
sub eax, 0xd41958f6
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3c391
push 0
call eax
mov ecx, 0x5fbe01b
add ecx, 0xfa046bc4
xor edi, edi
add edi, eax
mov esi, 0x5dee6ef1
sub esi, 0xf0eb06f1
add esi, dword [ebp - 0x18]
mov ebx, 0xd4344ae1
add ebx, 0xefc92cc9
xor dword [ebp - 0xc], edx
mov edx, dword [esi]
xor dword [ebp - 0xc], edi
add edx, ebx
xor dword [ebp - 8], 0xe1e9b013
mov dword [edi], edx
xor dword [ebp - 0x10], 0x68990adc
add edi, 4
add esi, 0x586479e5
sub esi, 0x586479e1
loop 0x6d0240d3
add eax, 0xdd47ebf7
add eax, 0x22b93658
xor ebx, ebx
add ebx, eax
add eax, 0x93109418
sub eax, 0x93109413
mov ecx, 0xead7b204
add ecx, 0x82294dfc
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x402ab8
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret

Function at 0x402ac2
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret

Function at 0x402c20
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9ec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
push 0
call sub.OLE32.DLL_OleInitialize
lea eax, [ebp - 8]
push eax
push 0x41480c
push 1
push 0
push 0x41481c
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x402d1f
push esi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
push edi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x402c83
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x402c95
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0x40c]
mov edx, esi
call fcn.0040f850
lea eax, [ebp - 0x40c]
call fcn.00406080
cmp byte [ebp - 0x40c], 0
je 0x402cc6
lea edx, [ebp - 0x40c]
push edx
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x24]
lea edx, [ebp - 0xc]
push edx
push 0x41483c
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
jl 0x402d16
push 0x104
lea edx, [ebp - 0x614]
push edx
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea ecx, [ebp - 0x614]
push ecx
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
test eax, eax
jl 0x402d0d
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
call sub.OLE32.DLL_OleUninitialize
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10002050
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10186fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0x2c
jl 0x100020a8
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x1000209a
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x100020bf
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100020e4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.10002cf0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x10002180
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10187055
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x102007b8], 0x2c
jl 0x100021dd
push 0x102007bc
call fcn.1001cfa0
mov edi, dword [0x102007b4]
add esp, 4
test edi, edi
je 0x100021cf
mov eax, dword [edi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test edi, edi
jne 0x100021f4
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x10002251
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.10002cf0
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.10002840
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x10002630
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10187135
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0x1c
jl 0x10002688
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x1000267a
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x1000269f
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100026fb
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolMem.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x18], 0x40
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x10002710
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018717d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102007b8], 0x1c
jl 0x1000276c
push 0x102007bc
call fcn.1001cfa0
mov esi, dword [0x102007b4]
add esp, 4
test esi, esi
je 0x1000275e
mov eax, dword [esi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test esi, esi
jne 0x10002783
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x100027f3
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolMem.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0x40
mov byte [ebp - 4], 2
mov ecx, esi
push edi
mov dword [esi], vtable.CVolMem.0
call fcn.10002840
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x10002e30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10186fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0xc
jl 0x10002e88
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x10002e7a
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x10002e9f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10002ed5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x10002ee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10187295
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x102007b8], 0xc
jl 0x10002f3b
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x10002f2d
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x10002f52
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10002f9f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolObject.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x10003350
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10186fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0x14c
jl 0x100033ab
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x1000339d
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x100033c5
push 0x14c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100033ea
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.10003720
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x10003470
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10187365
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102007b8], 0x14c
jl 0x100034cf
push 0x102007bc
call fcn.1001cfa0
mov esi, dword [0x102007b4]
add esp, 4
test esi, esi
je 0x100034c1
mov eax, dword [esi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test esi, esi
jne 0x100034e9
push 0x14c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10003526
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.10003720
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n11236::CVolWinControl.0
call fcn.100035f0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x10003d70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10187645
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0x14c
jl 0x10003dcc
push 0x102007bc
call fcn.1001cfa0
mov esi, dword [0x102007b4]
add esp, 4
test esi, esi
je 0x10003dbe
mov eax, dword [esi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test esi, esi
jne 0x10003de6
push 0x14c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10003e1a
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.10003720
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n11236::CVolWinContainer.0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x10003ea0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018768d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102007b8], 0x14c
jl 0x10003eff
push 0x102007bc
call fcn.1001cfa0
mov esi, dword [0x102007b4]
add esp, 4
test esi, esi
je 0x10003ef1
mov eax, dword [esi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test esi, esi
jne 0x10003f19
push 0x14c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10003f60
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.10003720
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n11236::CVolWinContainer.0
mov byte [ebp - 4], 2
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n11236::CVolWinContainer.0
call fcn.100035f0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x10004260
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10186fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0x1d0
jl 0x100042bb
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x100042ad
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x100042d5
push 0x1d0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100042fa
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.100110d0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x100046a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10186fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0x274
jl 0x100046fb
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x100046ed
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x10004715
push 0x274
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000473a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.10011710
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x10004ba0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10186fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0xacc
jl 0x10004bfb
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x10004bed
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x10004c15
push 0xacc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10004c3a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.10006960
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x10004ce0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10187805
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102007b8], 0xacc
jl 0x10004d3f
push 0x102007bc
call fcn.1001cfa0
mov esi, dword [0x102007b4]
add esp, 4
test esi, esi
je 0x10004d31
mov eax, dword [esi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test esi, esi
jne 0x10004d59
push 0xacc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10004daa
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.10006960
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n30578::rg_n30587.2.0
mov dword [esi + method.rg_n30578::rg_n30579.1.virtual_0], vtable.rg_n30578::rg_n30587.1.0
mov dword [esi + method.rg_n30578::rg_n30579.virtual_0], vtable.rg_n30578::rg_n30587.0
call fcn.10004e80
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x100050c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101878a5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0x278
jl 0x1000511c
push 0x102007bc
call fcn.1001cfa0
mov esi, dword [0x102007b4]
add esp, 4
test esi, esi
je 0x1000510e
mov eax, dword [esi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test esi, esi
jne 0x10005136
push 0x278
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10005185
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.10011710
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [esi], vtable.rg_n30578::rg_n30579.2.0
mov dword [esi + method.rg_n30578::rg_n30579.1.virtual_0], vtable.rg_n30578::rg_n30579.1.0
mov dword [esi + method.rg_n30578::rg_n30579.virtual_0], vtable.rg_n30578::rg_n30579.0
call fcn.10006630
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x10005200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101878ed
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102007b8], 0x278
jl 0x1000525f
push 0x102007bc
call fcn.1001cfa0
mov esi, dword [0x102007b4]
add esp, 4
test esi, esi
je 0x10005251
mov eax, dword [esi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test esi, esi
jne 0x10005279
push 0x278
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x100052ef
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.10011710
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [esi], vtable.rg_n30578::rg_n30579.2.0
mov dword [esi + method.rg_n30578::rg_n30579.1.virtual_0], vtable.rg_n30578::rg_n30579.1.0
mov dword [esi + method.rg_n30578::rg_n30579.virtual_0], vtable.rg_n30578::rg_n30579.0
call fcn.10006630
mov byte [ebp - 4], 2
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n30578::rg_n30579.2.0
mov dword [esi + method.rg_n30578::rg_n30579.1.virtual_0], vtable.rg_n30578::rg_n30579.1.0
mov dword [esi + method.rg_n30578::rg_n30579.virtual_0], vtable.rg_n30578::rg_n30579.0
call fcn.100035f0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3