joyce8/EMBER2024-capa huggingface dataset:
Function at 0x872590
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x374000]
push edi
jmp 0x8725aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8725b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8725a0
mov eax, 1
add ebx, ebx
jne 0x8725c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8725d4
jne 0x8725f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8725f3
dec eax
add ebx, ebx
jne 0x8725e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x8725b8
add ebx, ebx
jne 0x8725ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x872645
xor ecx, ecx
sub eax, 3
jb 0x87260b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x87267a
sar eax, 1
mov ebp, eax
jmp 0x872616
add ebx, ebx
jne 0x872616
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8725e4
inc ecx
add ebx, ebx
jne 0x872624
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8725e4
add ebx, ebx
jne 0x872631
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x872626
jne 0x872642
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x872626
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x872664
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x872656
jmp 0x8725a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x872664
add edi, ecx
jmp 0x8725a6
pop esi
mov edi, esi
mov ecx, 0x1f93e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x872682
cmp byte [edi], 0xa5
jne 0x872682
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x872687
lea edi, [esi + 0x46f000]
mov eax, dword [edi]
or eax, eax
je 0x8726ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x478abc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x478bec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8726b4
mov ecx, edi
jns 0x8726e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x478bf4]
or eax, eax
je 0x8726f9
mov dword [ebx], eax
add ebx, 4
jmp 0x8726d1
call dword [esi + 0x478bf0]
mov ebp, dword [esi + 0x478bf8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x872733
sub esp, 0xffffff80
jmp 0x61e0ba
Function at 0x10002880
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10052a9d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101c200c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x101c40c8], 0x2c
jl 0x100028d8
push 0x101c40cc
call fcn.100375e0
mov ecx, dword [0x101c40c4]
add esp, 4
test ecx, ecx
je 0x100028ca
mov eax, dword [ecx]
mov dword [0x101c40c4], eax
mov dword [0x101c40cc], 1
test ecx, ecx
jne 0x100028ef
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10002914
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.10002df0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10041c16
int3

Function at 0x100029b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10052b05
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101c200c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x101c40c8], 0x2c
jl 0x10002a0d
push 0x101c40cc
call fcn.100375e0
mov edi, dword [0x101c40c4]
add esp, 4
test edi, edi
je 0x100029ff
mov eax, dword [edi]
mov dword [0x101c40c4], eax
mov dword [0x101c40cc], 1
test edi, edi
jne 0x10002a24
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x10002a81
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.10002df0
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.10003200
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10041c16
int3
Function at 0x10002f90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10052c25
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101c200c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x101c40c8], 0x1c
jl 0x10002fe8
push 0x101c40cc
call fcn.100375e0
mov ecx, dword [0x101c40c4]
add esp, 4
test ecx, ecx
je 0x10002fda
mov eax, dword [ecx]
mov dword [0x101c40c4], eax
mov dword [0x101c40cc], 1
test ecx, ecx
jne 0x10002fff
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000305b
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolMem.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x18], 0x40
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10041c16
int3

Function at 0x10003110
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10052c9d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101c200c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x101c40c8], 0x1c
jl 0x1000316b
push 0x101c40cc
call fcn.100375e0
mov ecx, dword [0x101c40c4]
add esp, 4
test ecx, ecx
je 0x1000315d
mov eax, dword [ecx]
mov dword [0x101c40c4], eax
mov dword [0x101c40cc], 1
test ecx, ecx
jne 0x10003182
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100031a9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.10003070
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10041c16
int3

Function at 0x10003730
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10052a9d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101c200c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x101c40c8], 0xc
jl 0x10003788
push 0x101c40cc
call fcn.100375e0
mov ecx, dword [0x101c40c4]
add esp, 4
test ecx, ecx
je 0x1000377a
mov eax, dword [ecx]
mov dword [0x101c40c4], eax
mov dword [0x101c40cc], 1
test ecx, ecx
jne 0x1000379f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100037d5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10041c16
int3
Function at 0x100037e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10052d75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101c200c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x101c40c8], 0xc
jl 0x1000383b
push 0x101c40cc
call fcn.100375e0
mov ecx, dword [0x101c40c4]
add esp, 4
test ecx, ecx
je 0x1000382d
mov eax, dword [ecx]
mov dword [0x101c40c4], eax
mov dword [0x101c40cc], 1
test ecx, ecx
jne 0x10003852
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000389f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolObject.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10041c16
int3
Function at 0x1000b020
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100534d0
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x101c200c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x101c2c98]
xor eax, eax
test ecx, ecx
je 0x1000b062
cmp word [ecx], ax
sete al
jmp 0x1000b06c
cmp dword [0x101c2cb0], 2
setle al
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000b083
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
jmp 0x1000b1c2
lea ecx, [ebp - 0x268]
call fcn.10002df0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x238]
push 0x228
push 0
push eax
call fcn.1003f470
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000b1ae
lea eax, [ebp - 0x23c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1000b1ab
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop word [eax + eax]
xor ecx, ecx
mov dword [ebp - 0x25c], ecx
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x1000b118
push eax
mov eax, dword [ebp - 0x258]
lea ecx, [ebp - 0x258]
call dword [eax + 0xc]
mov ecx, dword [ebp - 0x25c]
xor edx, edx
xor esi, esi
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x248], edx
cmp word [ebp - 0x218], dx
je 0x1000b15b
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x258]
call fcn.10036bc0
mov esi, dword [ebp - 0x244]
mov edx, dword [ebp - 0x24c]
mov ecx, dword [ebp - 0x25c]
test ecx, ecx
jne 0x1000b169
test esi, esi
mov ecx, 0x101afdf4
cmovne ecx, edx
mov eax, dword [0x101c2c98]
test eax, eax
jne 0x1000b185
cmp dword [0x101c2cb0], 0
mov eax, 0x101afdf4
cmovne eax, dword [0x101c2ca8]
push ecx
push eax
call fcn.10041ca8
add esp, 8
test eax, eax
je 0x1000b200
lea eax, [ebp - 0x23c]
push eax
push edi
call ebx
test eax, eax
jne 0x1000b0f0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
mov dword [ebp - 4], 0xffffffff
xor esi, esi
lea ecx, [ebp - 0x268]
call fcn.10002af0
push esi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call ebx
xor eax, eax
test esi, esi
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003d892
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
mov esi, dword [ebp - 0x234]
mov dword [ebp - 4], 0xffffffff
jmp 0x1000b1b7
Function at 0x1000b5d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100535ce
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push esi
push edi
mov eax, dword [0x101c200c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x1c], 0
call fcn.10002df0
mov dword [ebp - 4], 1
push 0x102
call fcn.1003ddf4
push 0x102
mov edi, eax
push 0
push edi
call fcn.1003f470
movups xmm0, xmmword [0x101afdbc]
push 0xe
movups xmmword [edi], xmm0
movups xmm0, xmmword [0x101afdcc]
movups xmmword [edi + 0x10], xmm0
movups xmm0, xmmword [0x101afddc]
movups xmmword [edi + 0x20], xmm0
mov eax, dword [0x101afdec]
mov dword [edi + 0x30], eax
mov ax, word [0x101afdf0]
mov word [edi + 0x34], ax
call fcn.1003ddf4
xorps xmm0, xmm0
mov dword [ebp - 0x14], eax
add esp, 0x14
mov dword [ebp - 0x10], 6
mov esi, eax
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov word [eax + 0xc], 0
call fcn.100411a5
xor edx, edx
mov ecx, 0x1a
div ecx
push 1
lea eax, [edi + edx*2]
push eax
push esi
call fcn.100411d8
add esp, 0xc
add esi, 2
sub dword [ebp - 0x10], 1
jne 0x1000b685
push edi
call fcn.1003ddfd
mov eax, dword [ebp - 0x2c]
add esp, 4
mov dword [ebp - 0x3c], 0
test eax, eax
je 0x1000b6cc
push eax
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x38]
call dword [eax + 0xc]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
cmp word [esi], 0
je 0x1000b6f3
push esi
lea ecx, [ebp - 0x38]
call fcn.10036bc0
push esi
call fcn.1003ddfd
mov edx, dword [ebp - 0x3c]
add esp, 4
test edx, edx
jne 0x1000b710
cmp dword [ebp - 0x24], 0
mov edx, 0x101afdf4
cmovne edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x18]
mov ecx, esi
call fcn.10002df0
mov byte [ebp - 4], 2
mov ecx, esi
push edx
mov dword [esi], vtable.CWString.0
call fcn.10038190
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.10002af0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1000c210
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10053765
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101c200c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x101c40c8], 0x2c
jl 0x1000c268
push 0x101c40cc
call fcn.100375e0
mov edx, dword [0x101c40c4]
add esp, 4
test edx, edx
je 0x1000c25a
mov eax, dword [edx]
mov dword [0x101c40c4], eax
mov dword [0x101c40cc], 1
test edx, edx
jne 0x1000c27f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x1000c2b2
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.10002df0
mov byte [ebp - 4], 1
mov dword [edx], vtable.CWConstString.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10041c16
int3
Function at 0x1000c2c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100537ad
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101c200c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x101c40c8], 0x2c
jl 0x1000c31d
push 0x101c40cc
call fcn.100375e0
mov edi, dword [0x101c40c4]
add esp, 4
test edi, edi
je 0x1000c30f
mov eax, dword [edi]
mov dword [0x101c40c4], eax
mov dword [0x101c40cc], 1
test edi, edi
jne 0x1000c334
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1000c39b
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.10002df0
mov byte [ebp - 4], 1
mov dword [edi], vtable.CWConstString.0
mov byte [ebp - 4], 2
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWConstString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.10003200
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10041c16
int3

Function at 0x1000c830
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10052c25
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101c200c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x101c40c8], 0x10
jl 0x1000c888
push 0x101c40cc
call fcn.100375e0
mov ecx, dword [0x101c40c4]
add esp, 4
test ecx, ecx
je 0x1000c87a
mov eax, dword [ecx]
mov dword [0x101c40c4], eax
mov dword [0x101c40cc], 1
test ecx, ecx
jne 0x1000c89f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000c8e6
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.exui::BaseEx.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10041c16
int3
Function at 0x1000c970
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005391d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101c200c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x101c40c8], 0x10
jl 0x1000c9cb
push 0x101c40cc
call fcn.100375e0
mov ecx, dword [0x101c40c4]
add esp, 4
test ecx, ecx
je 0x1000c9bd
mov eax, dword [ecx]
mov dword [0x101c40c4], eax
mov dword [0x101c40cc], 1
test ecx, ecx
jne 0x1000c9e2
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000ca46
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.exui::BaseEx.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.exui::BaseEx.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10041c16
int3

Function at 0x1000cd00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10052a9d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101c200c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x101c40c8], 0x150
jl 0x1000cd5b
push 0x101c40cc
call fcn.100375e0
mov ecx, dword [0x101c40c4]
add esp, 4
test ecx, ecx
je 0x1000cd4d
mov eax, dword [ecx]
mov dword [0x101c40c4], eax
mov dword [0x101c40cc], 1
test ecx, ecx
jne 0x1000cd75
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000cd9a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.1000cfd0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10041c16
int3
Function at 0x1000ce30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100539f5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101c200c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x101c40c8], 0x150
jl 0x1000ce8e
push 0x101c40cc
call fcn.100375e0
mov edx, dword [0x101c40c4]
add esp, 4
test edx, edx
je 0x1000ce80
mov eax, dword [edx]
mov dword [0x101c40c4], eax
mov dword [0x101c40cc], 1
test edx, edx
jne 0x1000cea8
push 0x150
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x1000ceee
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.1000cfd0
mov byte [ebp - 4], 1
mov dword [edx], vtable.exui::ControlEx.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10041c16
int3

Function at 0x1000d690
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10053d1d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101c200c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x101c40c8], 0x10
jl 0x1000d6e8
push 0x101c40cc
call fcn.100375e0
mov ecx, dword [0x101c40c4]
add esp, 4
test ecx, ecx
je 0x1000d6da
mov eax, dword [ecx]
mov dword [0x101c40c4], eax
mov dword [0x101c40cc], 1
test ecx, ecx
jne 0x1000d6ff
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000d750
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2298.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10041c16
int3