joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a3a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f343
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov dword [esi], vtable.CVolBaseStream.0
mov dword [ebp - 4], 2
mov dword [esi], vtable.CVolBaseInputStream.0
mov dword [ebp - 4], 3
mov dword [esi], vtable.CVolMemoryInputStream.0
cmp dword [0x441ff8], 0x44
jl 0x40a44f
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x40a441
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x40a46a
push 0x44
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40a538
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 4
mov dword [ecx], vtable.CRefObject.0
mov dword [ecx + 4], 1
mov byte [ebp - 4], 5
mov dword [ecx], vtable.CVBaseStream.0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 6
mov dword [ecx], vtable.CVBaseInputStream.0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 7
lea eax, [ecx + 0x28]
mov dword [ecx], vtable.CVMemoryInputStream.0
mov dword [ebp - 0x18], eax
mov dword [eax], vtable.CVolObject.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 8
mov dword [eax], vtable.CVolMem.0
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x18], 0x40
mov byte [ebp - 4], 9
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x20], 0
mov byte [ebp - 4], 3
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3

Function at 0x40a5c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e6c0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x441ff8], 0xc
jl 0x40a618
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x40a60a
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x40a62f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40a66f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3
Function at 0x40a680
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f378
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x441ff8], 0xc
jl 0x40a6db
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x40a6cd
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x40a6f2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40a749
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3

Function at 0x40ab00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e6c0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x441ff8], 0x10
jl 0x40ab58
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x40ab4a
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x40ab6f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40abb6
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3
Function at 0x40abc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f458
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x441ff8], 0x10
jl 0x40ac1c
push 0x441ffc
call fcn.00413870
mov esi, dword [0x441ff4]
add esp, 4
test esi, esi
je 0x40ac0e
mov eax, dword [esi]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test esi, esi
jne 0x40ac33
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40acaf
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolRefObject.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x40ac86
mov ecx, edi
call fcn.0040ee10
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40ac92
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3

Function at 0x40b240
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e578
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x441ff8], 0x20
jl 0x40b298
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x40b28a
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x40b2af
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40b2d4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040b560
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3
Function at 0x40b360
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f580
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x441ff8], 0x20
jl 0x40b3bc
push 0x441ffc
call fcn.00413870
mov esi, dword [0x441ff4]
add esp, 4
test esi, esi
je 0x40b3ae
mov eax, dword [esi]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test esi, esi
jne 0x40b3d3
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40b431
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040b560
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n1::rg_n7453.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x40b408
mov ecx, edi
call fcn.0040ee10
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40b414
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3

Function at 0x40b560
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f611
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CVolObject.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [edi], vtable.CVolRefObject.0
mov dword [edi + 0xc], 0
mov dword [ebp - 4], 1
mov dword [edi], vtable.rg_n1::rg_n7453.0
mov dword [edi + 0x10], 1
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov byte [ebp - 4], 2
cmp dword [0x441ff8], 0x28
jl 0x40b617
push 0x441ffc
call fcn.00413870
mov ebx, dword [0x441ff4]
add esp, 4
test ebx, ebx
je 0x40b609
mov eax, dword [ebx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ebx, ebx
jne 0x40b62e
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x40b6ab
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 3
mov dword [ebx], vtable.CRefObject.0
mov dword [ebx + 4], 1
mov byte [ebp - 4], 4
lea esi, [ebx + 8]
push 0
push 0
push 0
mov dword [ebx], vtable.CRefObjectWithData_class_CVolThread_.0
mov dword [ebp - 0x18], esi
push 0
mov dword [esi], vtable.CVolThread.0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 5
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov byte [ebp - 4], 2
mov dword [edi + 0xc], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3
Function at 0x40bc70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ea88
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x441ff8], 0xc
jl 0x40bcc8
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x40bcba
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x40bcdf
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40bd2f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x442020], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3

Function at 0x40bdc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ead0
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x441ff8], 0xc
jl 0x40be1b
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x40be0d
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x40be32
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40be99
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x442020], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3
Function at 0x40c160
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f800
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x441ff8], 0xc
jl 0x40c1b8
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x40c1aa
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x40c1cf
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40c229
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x442020], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n38329.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3

Function at 0x40c2c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f848
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x441ff8], 0xc
jl 0x40c31b
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x40c30d
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x40c332
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40c3a3
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x442020], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n38329.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n::rg_n38329.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3
Function at 0x40c6c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f800
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x441ff8], 0xc
jl 0x40c718
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x40c70a
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x40c72f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40c789
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x442020], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n7771.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3

Function at 0x40c820
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f848
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x441ff8], 0xc
jl 0x40c87b
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x40c86d
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x40c892
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40c903
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x442020], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7761.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n7771.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n1::rg_n7771.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3
Function at 0x40ce90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e6c0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x441ff8], 0xc
jl 0x40cee8
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x40ceda
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x40ceff
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40cf45
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x442020], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3

Function at 0x40d2c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e578
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x441ff8], 0x2c
jl 0x40d318
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x40d30a
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x40d32f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40d354
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040d620
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3

Function at 0x40d410
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e5d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x441ff8], 0x2c
jl 0x40d46b
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x40d45d
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x40d482
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40d4a9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.0040d360
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3
Function at 0x40f000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e578
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x441ff8], 0x28
jl 0x40f058
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x40f04a
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x40f06f
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40f095
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push ecx
call fcn.0040f390
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3

Function at 0x40f170
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ff30
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x441ff8], 0x28
jl 0x40f1cc
push 0x441ffc
call fcn.00413870
mov esi, dword [0x441ff4]
add esp, 4
test esi, esi
je 0x40f1be
mov eax, dword [esi]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test esi, esi
jne 0x40f1e3
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40f221
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push ecx
mov ecx, esi
call fcn.0040f390
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.CVolObjectArray.0
call fcn.0040f300
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3

Function at 0x40f7f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4300fb
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x441ff8], 0x3c
jl 0x40f848
push 0x441ffc
call fcn.00413870
mov edx, dword [0x441ff4]
add esp, 4
test edx, edx
je 0x40f83a
mov eax, dword [edx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test edx, edx
jne 0x40f85f
push 0x3c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40f8b2
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov dword [edx], vtable.CVolObject.0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [ebp - 4], 1
lea ecx, [edx + 0x10]
mov dword [edx], vtable.CVolException.0
call fcn.00404a60
mov byte [ebp - 4], 2
mov dword [edx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3