joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4034e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b9d8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5ee9c8], 0x18
jl 0x403538
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x40352a
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x40354f
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4035a1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_n1::rg_n2531.0
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3

Function at 0x403660
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ba20
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5ee9c8], 0x18
jl 0x4036bb
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x4036ad
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x4036d2
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x403745
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_n1::rg_n2531.0
movsd qword [ecx + 0x10], xmm0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2531.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
movsd xmm0, qword [esi + 0x10]
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3
Function at 0x403a60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b9d8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5ee9c8], 0x10
jl 0x403ab8
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x403aaa
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x403acf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x403b20
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2529.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3

Function at 0x403bd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ba20
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5ee9c8], 0x10
jl 0x403c2b
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x403c1d
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x403c42
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x403cb0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2529.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2529.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3
Function at 0x403fc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b9d8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5ee9c8], 0x10
jl 0x404018
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x40400a
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x40402f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x404080
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2525.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3

Function at 0x404110
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ba20
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5ee9c8], 0x10
jl 0x40416b
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x40415d
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x404182
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4041f0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2525.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2525.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3
Function at 0x404450
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b9d8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5ee9c8], 0x10
jl 0x4044a8
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x40449a
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x4044bf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40450f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2521.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3

Function at 0x4045b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ba20
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5ee9c8], 0x10
jl 0x40460b
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x4045fd
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x404622
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x404691
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2521.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2521.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3
Function at 0x404930
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b9d8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5ee9c8], 0x10
jl 0x404988
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x40497a
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x40499f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4049ef
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2519.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3

Function at 0x404a90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ba20
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5ee9c8], 0x10
jl 0x404aeb
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x404add
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x404b02
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x404b71
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2519.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2519.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3
Function at 0x404e50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b9d8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5ee9c8], 0x10
jl 0x404ea8
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x404e9a
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x404ebf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x404f0d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2517.0
mov byte [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3

Function at 0x404fa0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ba20
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5ee9c8], 0x10
jl 0x404ffb
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x404fed
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x405012
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40507d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2517.0
mov byte [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2517.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov al, byte [esi + 0xc]
mov byte [ecx + 0xc], al
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3
Function at 0x405810
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57bd18
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5ee9c8], 0x10
jl 0x405868
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x40585a
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x40587f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4058a4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00407910
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3

Function at 0x4058b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57bd50
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5ee9c8], 0x10
jl 0x40590c
push 0x5ee9cc
call fcn.00414800
mov esi, dword [0x5ee9c4]
add esp, 4
test esi, esi
je 0x4058fe
mov eax, dword [esi]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test esi, esi
jne 0x405923
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x405981
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00407910
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolMemoryInputStream.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x405958
mov ecx, edi
call fcn.0040fe60
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x405964
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3
Function at 0x405d30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57be50
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5ee9c8], 0x10
jl 0x405d88
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x405d7a
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x405d9f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x405dfa
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseStream.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.CVolBaseInputStream.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3

Function at 0x405e10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57be98
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5ee9c8], 0x10
jl 0x405e6c
push 0x5ee9cc
call fcn.00414800
mov esi, dword [0x5ee9c4]
add esp, 4
test esi, esi
je 0x405e5e
mov eax, dword [esi]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test esi, esi
jne 0x405e87
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x405f17
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolBaseStream.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.CVolBaseInputStream.0
mov byte [ebp - 4], 4
mov dword [esi], vtable.CVolBaseInputStream.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x405eee
mov ecx, edi
call fcn.0040fe60
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x405efa
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3
Function at 0x4062e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57bfa8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5ee9c8], 0x10
jl 0x406338
push 0x5ee9cc
call fcn.00414800
mov ecx, dword [0x5ee9c4]
add esp, 4
test ecx, ecx
je 0x40632a
mov eax, dword [ecx]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test ecx, ecx
jne 0x40634f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4063a0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseStream.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3

Function at 0x4063b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57bff0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e4fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5ee9c8], 0x10
jl 0x40640c
push 0x5ee9cc
call fcn.00414800
mov esi, dword [0x5ee9c4]
add esp, 4
test esi, esi
je 0x4063fe
mov eax, dword [esi]
mov dword [0x5ee9c4], eax
mov dword [0x5ee9cc], 1
test esi, esi
jne 0x406427
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4064ad
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolBaseStream.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.CVolBaseStream.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x406484
mov ecx, edi
call fcn.0040fe60
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x406490
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00563a38
int3