joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410c70
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4025e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x70
call fcn.004025e0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x401f20
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [fcn.00401094]
mov dword [ebp - 4], 3
call fcn.00404fd8
mov dword [ebp - 0x6c], eax
call dword [fcn.00401068]
lea eax, [ebp - 0x64]
push eax
push 0x28
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.00405038
mov dword [ebp - 0x70], eax
call dword [fcn.00401068]
xor edx, edx
cmp dword [ebp - 0x70], 0
setne dl
neg edx
movsx eax, dx
test eax, eax
je 0x410e25
mov dword [ebp - 4], 4
xor ecx, ecx
test ecx, ecx
je 0x410d46
mov dword [ebp - 4], 6
mov dword [ebp - 0x6c], 0x1c
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0x1c
lea ecx, [ebp - 0x60]
push ecx
push 0
mov edx, dword [ebp - 0x64]
push edx
call fcn.00405088
call dword [fcn.00401068]
jmp 0x410e25
mov dword [ebp - 4], 9
lea eax, [ebp - 0x44]
push eax
push 0x404ae4
lea ecx, [ebp - 0x68]
push ecx
call dword [fcn.004011cc]
push eax
push 0
call fcn.004050e8
mov dword [ebp - 0x6c], eax
call dword [fcn.00401068]
xor edx, edx
cmp dword [ebp - 0x6c], 0
setne dl
neg edx
mov word [ebp - 0x74], dx
lea ecx, [ebp - 0x68]
call dword [fcn.00401210]
movsx eax, word [ebp - 0x74]
test eax, eax
je 0x410e25
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x60], 1
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410dc3
mov dword [ebp - 0x8c], 0
jmp 0x410dcf
call dword [0x4010d4]
mov dword [ebp - 0x8c], eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x74]
imul edx, edx, 0xc
lea eax, [ebp + edx - 0x5c]
push eax
push 8
call dword [0x401058]
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410e06
mov dword [ebp - 0x90], 0
jmp 0x410e12
call dword [0x4010d4]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x74]
imul ecx, ecx, 0xc
mov dword [ebp + ecx - 0x54], 2
jmp 0x410d14
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x64]
push edx
call fcn.00404e50
call dword [fcn.00401068]
push 0x410e4d
jmp 0x410e4c
ret
Function at 0x40197f
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], section..rdata
call sym._system
mov dword [esp], 0x74
call sym._malloc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4019be
mov dword [esp], str.Memory_allocation_failed.
call sym._puts
mov dword [esp], 1
call sym._exit
call dbg.DisplayBar
mov dword [esp], str._nAdding_a_New_Record
call sym._puts
mov dword [esp], str.First_Name:
call sym._puts
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0x405103
call sym._scanf
mov dword [esp], str.Last_Name:
call sym._puts
mov eax, dword [ebp - 0x10]
add eax, 0x32
mov dword [esp + 4], eax
mov dword [esp], 0x405103
call sym._scanf
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._stricmp
mov eax, dword [ebp - 0x10]
lea edx, [eax + 0x32]
mov eax, dword [ebp - 0x10]
add eax, 0x32
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._stricmp
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x6c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x70], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x401ab0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._stricmp
test eax, eax
jne 0x401aa7
mov eax, dword [ebp - 0x10]
lea edx, [eax + 0x32]
mov eax, dword [ebp - 0xc]
add eax, 0x32
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._stricmp
test eax, eax
jne 0x401aa7
mov dword [esp], str.The_same_person_already_exists_in_the_records_
call sym._puts
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp + 8]
jmp 0x401b38
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401a56
cmp dword [ebp + 8], 0
jne 0x401ac4
mov eax, dword [ebp - 0x10]
mov dword [ebp + 8], eax
jmp 0x401af1
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x401ad5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x6c]
test eax, eax
jne 0x401acc
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x6c], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x70], edx
mov dword [esp], str.Height_cm_:
call sym._puts
mov eax, dword [ebp - 0x10]
add eax, 0x64
mov dword [esp + 4], eax
mov dword [esp], 0x40538f
call sym._scanf
mov dword [esp], str.Weight_kg_:
call sym._puts
mov eax, dword [ebp - 0x10]
add eax, 0x68
mov dword [esp + 4], eax
mov dword [esp], 0x40538f
call sym._scanf
mov eax, dword [ebp + 8]
leave
ret
Function at 0x401b3a
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [esp], section..rdata
call sym._system
mov dword [esp], str._nExisting_Records__First_to_Last_
call sym._puts
mov dword [esp], str._n________________________________________________________________________________
call sym._puts
mov dword [esp + 0x18], str.Result
mov dword [esp + 0x14], 0x40541d
mov dword [esp + 0x10], str.Weight_kg_
mov dword [esp + 0xc], str.Height_cm_
mov dword [esp + 8], str.Last_Name
mov dword [esp + 4], str.First_Name
mov dword [esp], str.__15s___15s___10s___10s___10s___15s_n
call sym._printf
mov dword [esp], str.________________________________________________________________________________
call sym._puts
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.CountRecords
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
jne 0x401bdd
mov dword [esp], str.The_current_records_are_currently_empty_.
call sym._puts
mov dword [esp], str._n
call sym._puts
jmp 0x401c8a
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x401c61
mov eax, dword [ebp - 0xc]
fld dword [eax + 0x68]
mov eax, dword [ebp - 0xc]
fld dword [eax + 0x64]
fxch st(1)
fstp dword [esp + 4]
fstp dword [esp]
call dbg.CalculateBMI
mov eax, dword [ebp - 0xc]
fld dword [eax + 0x68]
mov eax, dword [ebp - 0xc]
fld dword [eax + 0x64]
fxch st(2)
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0x32]
mov eax, dword [ebp - 0xc]
fstp qword [esp + 0x1c]
fstp qword [esp + 0x14]
fstp qword [esp + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str.__15s___15s___10.2f___10.2f___10.2f
call sym._printf
mov eax, dword [ebp - 0xc]
fld dword [eax + 0x68]
mov eax, dword [ebp - 0xc]
fld dword [eax + 0x64]
fxch st(1)
fstp dword [esp + 4]
fstp dword [esp]
call dbg.CategoryBMI
mov dword [esp], eax
call sym._puts
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401be5
mov dword [esp], str._n
call sym._puts
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str._n_nTotal_Records:__d_n
call sym._printf
nop
leave
ret
Function at 0x401c8d
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [esp], section..rdata
call sym._system
mov dword [esp], str._nExisting_Records__Last_to_First_
call sym._puts
mov dword [esp], str._n________________________________________________________________________________
call sym._puts
mov dword [esp + 0x18], str.Result
mov dword [esp + 0x14], 0x40541d
mov dword [esp + 0x10], str.Weight_kg_
mov dword [esp + 0xc], str.Height_cm_
mov dword [esp + 8], str.Last_Name
mov dword [esp + 4], str.First_Name
mov dword [esp], str.__15s___15s___10s___10s___10s___15s_n
call sym._printf
mov dword [esp], str.________________________________________________________________________________
call sym._puts
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.CountRecords
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
jne 0x401d30
mov dword [esp], str.The_current_records_are_currently_empty_.
call sym._puts
mov dword [esp], str._n
call sym._puts
jmp 0x401df2
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x401d41
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x6c]
test eax, eax
jne 0x401d38
jmp 0x401dc9
mov eax, dword [ebp - 0xc]
fld dword [eax + 0x68]
mov eax, dword [ebp - 0xc]
fld dword [eax + 0x64]
fxch st(1)
fstp dword [esp + 4]
fstp dword [esp]
call dbg.CalculateBMI
mov eax, dword [ebp - 0xc]
fld dword [eax + 0x68]
mov eax, dword [ebp - 0xc]
fld dword [eax + 0x64]
fxch st(2)
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0x32]
mov eax, dword [ebp - 0xc]
fstp qword [esp + 0x1c]
fstp qword [esp + 0x14]
fstp qword [esp + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str.__15s___15s___10.2f___10.2f___10.2f
call sym._printf
mov eax, dword [ebp - 0xc]
fld dword [eax + 0x68]
mov eax, dword [ebp - 0xc]
fld dword [eax + 0x64]
fxch st(1)
fstp dword [esp + 4]
fstp dword [esp]
call dbg.CategoryBMI
mov dword [esp], eax
call sym._puts
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x70]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401d4d
mov dword [esp], str._n
call sym._puts
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str._n_nTotal_Records:__d_n
call sym._printf
nop
leave
ret

Function at 0x4026e0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x402740
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40639c]
test esi, esi
jle 0x402840
mov eax, dword [0x4063a0]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x402770
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4027ef
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x402760
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x402867
mov eax, dword [0x4063a0]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x4063a0]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x402847
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4027e8
sub eax, 4
and eax, 0xfffffffb
jne 0x4027f6
add dword [0x40639c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x4063a0]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4027e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
xor esi, esi
jmp 0x40277a
mov eax, dword [0x4063a0]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x402d20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4063b0]
sub esp, 4
test ebx, ebx
je 0x402d75
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x402d6e
test esi, esi
je 0x402d6e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402d50
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0xe7c8bc
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe7c8c6
pushal
call 0xe7c8cc
pop ebp
sub ebp, 0x10
sub ebp, 0xa7c8bc
jmp 0xe7c8e2
mov eax, 0xa7c8bc
add eax, ebp
add eax, 0x4c
mov ecx, 0x591
mov edx, 0xbdaeaeec
xor byte [eax], dl
inc eax
dec ecx
jne 0xe7c8f9
jmp 0xe7c90c
and dword [bx + 0x65], esp
shr ah, 1
in al, dx
in al, dx
insd dword es:[edi], dx
sub eax, 0xececec14
out dx, eax
and dword [edi - 0x14], edx
in al, dx
in al, dx
push esi
invalid

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x401440
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422ea5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x431e68], 0xc
jl 0x401498
push 0x431e6c
call fcn.0041a980
mov ecx, dword [0x431e64]
add esp, 4
test ecx, ecx
je 0x40148a
mov eax, dword [ecx]
mov dword [0x431e64], eax
mov dword [0x431e6c], 1
test ecx, ecx
jne 0x4014b7
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4014b7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_volcano_base::rg_KuoZhanDuiXiangLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x401580
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422eed
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x431e68], 0xc
jl 0x4015db
push 0x431e6c
call fcn.0041a980
mov ecx, dword [0x431e64]
add esp, 4
test ecx, ecx
je 0x4015cd
mov eax, dword [ecx]
mov dword [0x431e64], eax
mov dword [0x431e6c], 1
test ecx, ecx
jne 0x4015fa
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4015fa
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_volcano_base::rg_KuoZhanDuiXiangLei.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_KuoZhanDuiXiangLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401940
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x431e68], 0x28
jl 0x401998
push 0x431e6c
call fcn.0041a980
mov ecx, dword [0x431e64]
add esp, 4
test ecx, ecx
je 0x40198a
mov eax, dword [ecx]
mov dword [0x431e64], eax
mov dword [0x431e6c], 1
test ecx, ecx
jne 0x4019b7
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4019b7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00401c50
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x401a70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423025
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x431e68], 0x28
jl 0x401acd
push 0x431e6c
call fcn.0041a980
mov esi, dword [0x431e64]
add esp, 4
test esi, esi
je 0x401abf
mov eax, dword [esi]
mov dword [0x431e64], eax
mov dword [0x431e6c], 1
test esi, esi
jne 0x401aec
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x401aec
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00401c50
mov byte [ebp - 4], 1
lea ebx, [edi + 0xc]
mov dword [esi], vtable.rg_volcano_base::rg_ZhengShuShuZuLei.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
lea edi, [esi + 0xc]
mov dword [esi + 8], eax
cmp ebx, edi
je 0x401b2c
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x44]
push ebx
mov ecx, edi
call fcn.004032c0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401f30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x431e68], 0x2c
jl 0x401f88
push 0x431e6c
call fcn.0041a980
mov ecx, dword [0x431e64]
add esp, 4
test ecx, ecx
je 0x401f7a
mov eax, dword [ecx]
mov dword [0x431e64], eax
mov dword [0x431e6c], 1
test ecx, ecx
jne 0x401fa7
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x401fa7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.004023d0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x402100
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423175
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x431e68], 0x2c
jl 0x40215c
push 0x431e6c
call fcn.0041a980
mov esi, dword [0x431e64]
add esp, 4
test esi, esi
je 0x40214e
mov eax, dword [esi]
mov dword [0x431e64], eax
mov dword [0x431e6c], 1
test esi, esi
jne 0x40217b
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40217b
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.004023d0
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_volcano_base::rg_WenBenShuZuLei.0
call fcn.00402280
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402690
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x431e68], 0x2c
jl 0x4026e8
push 0x431e6c
call fcn.0041a980
mov ecx, dword [0x431e64]
add esp, 4
test ecx, ecx
je 0x4026da
mov eax, dword [ecx]
mov dword [0x431e64], eax
mov dword [0x431e6c], 1
test ecx, ecx
jne 0x402707
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x402707
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.004029d0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4027c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4233d5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x431e68], 0x2c
jl 0x40281d
push 0x431e6c
call fcn.0041a980
mov edi, dword [0x431e64]
add esp, 4
test edi, edi
je 0x40280f
mov eax, dword [edi]
mov dword [0x431e64], eax
mov dword [0x431e6c], 1
test edi, edi
jne 0x40283c
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x40283c
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.004029d0
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.004032c0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403050
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422ea5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x431e68], 0x1c
jl 0x4030a8
push 0x431e6c
call fcn.0041a980
mov ecx, dword [0x431e64]
add esp, 4
test ecx, ecx
je 0x40309a
mov eax, dword [ecx]
mov dword [0x431e64], eax
mov dword [0x431e6c], 1
test ecx, ecx
jne 0x4030c7
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4030c7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolMem.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x18], 0x40
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret