joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100090a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022c4d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002fd18], 0x10
jl 0x100090f8
push 0x1002fd1c
call fcn.10019570
mov ecx, dword [0x1002fd14]
add esp, 4
test ecx, ecx
je 0x100090ea
mov eax, dword [ecx]
mov dword [0x1002fd14], eax
mov dword [0x1002fd1c], 1
test ecx, ecx
jne 0x10009117
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x10009117
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2519.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x10009200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022c95
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002fd18], 0x10
jl 0x1000925b
push 0x1002fd1c
call fcn.10019570
mov ecx, dword [0x1002fd14]
add esp, 4
test ecx, ecx
je 0x1000924d
mov eax, dword [ecx]
mov dword [0x1002fd14], eax
mov dword [0x1002fd1c], 1
test ecx, ecx
jne 0x1000927a
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x1000927a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2519.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2519.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100095b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022c4d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002fd18], 0x10
jl 0x10009608
push 0x1002fd1c
call fcn.10019570
mov ecx, dword [0x1002fd14]
add esp, 4
test ecx, ecx
je 0x100095fa
mov eax, dword [ecx]
mov dword [0x1002fd14], eax
mov dword [0x1002fd1c], 1
test ecx, ecx
jne 0x10009627
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x10009627
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2523.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x10009700
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022c95
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002fd18], 0x10
jl 0x1000975b
push 0x1002fd1c
call fcn.10019570
mov ecx, dword [0x1002fd14]
add esp, 4
test ecx, ecx
je 0x1000974d
mov eax, dword [ecx]
mov dword [0x1002fd14], eax
mov dword [0x1002fd1c], 1
test ecx, ecx
jne 0x1000977a
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x1000977a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2523.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2523.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10009a20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022c4d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002fd18], 0x10
jl 0x10009a78
push 0x1002fd1c
call fcn.10019570
mov ecx, dword [0x1002fd14]
add esp, 4
test ecx, ecx
je 0x10009a6a
mov eax, dword [ecx]
mov dword [0x1002fd14], eax
mov dword [0x1002fd1c], 1
test ecx, ecx
jne 0x10009a97
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x10009a97
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2521.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x10009b80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022c95
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002fd18], 0x10
jl 0x10009bdb
push 0x1002fd1c
call fcn.10019570
mov ecx, dword [0x1002fd14]
add esp, 4
test ecx, ecx
je 0x10009bcd
mov eax, dword [ecx]
mov dword [0x1002fd14], eax
mov dword [0x1002fd1c], 1
test ecx, ecx
jne 0x10009bfa
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x10009bfa
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2521.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2521.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10009ef0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022c4d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002fd18], 0x10
jl 0x10009f48
push 0x1002fd1c
call fcn.10019570
mov ecx, dword [0x1002fd14]
add esp, 4
test ecx, ecx
je 0x10009f3a
mov eax, dword [ecx]
mov dword [0x1002fd14], eax
mov dword [0x1002fd1c], 1
test ecx, ecx
jne 0x10009f67
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x10009f67
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2517.0
mov byte [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x1000a040
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022c95
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002fd18], 0x10
jl 0x1000a09b
push 0x1002fd1c
call fcn.10019570
mov ecx, dword [0x1002fd14]
add esp, 4
test ecx, ecx
je 0x1000a08d
mov eax, dword [ecx]
mov dword [0x1002fd14], eax
mov dword [0x1002fd1c], 1
test ecx, ecx
jne 0x1000a0ba
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x1000a0ba
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2517.0
mov byte [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2517.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov al, byte [esi + 0xc]
mov byte [ecx + 0xc], al
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000a810
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100219f5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002fd18], 0xc
jl 0x1000a868
push 0x1002fd1c
call fcn.10019570
mov ecx, dword [0x1002fd14]
add esp, 4
test ecx, ecx
je 0x1000a85a
mov eax, dword [ecx]
mov dword [0x1002fd14], eax
mov dword [0x1002fd1c], 1
test ecx, ecx
jne 0x1000a887
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x1000a887
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x1000a8d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10021a3d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002fd18], 0xc
jl 0x1000a92b
push 0x1002fd1c
call fcn.10019570
mov ecx, dword [0x1002fd14]
add esp, 4
test ecx, ecx
je 0x1000a91d
mov eax, dword [ecx]
mov dword [0x1002fd14], eax
mov dword [0x1002fd1c], 1
test ecx, ecx
jne 0x1000a94a
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x1000a94a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000ac00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10023026
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1002f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 1
mov dword [esi], vtable.CVolMem.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0x40
mov dword [ebp - 4], 0
cmp dword [esi + 0xc], 0
mov dword [ebp - 0x10], 1
je 0x1000ac99
push ebx
call fcn.10018b60
mov eax, dword [esi + 0xc]
jmp 0x1000ace6
test ebx, ebx
jne 0x1000aca1
xor eax, eax
jmp 0x1000ace6
mov edi, dword [esi + 0x18]
mov eax, 0x40
test edi, edi
cmovle edi, eax
mov eax, ebx
cdq
idiv edi
mov eax, dword [esi]
sub edi, edx
add edi, ebx
push edi
mov eax, dword [eax]
cmp eax, method.CWString.virtual_0
jne 0x1000acd9
mov ecx, 0x1002fd08
call fcn.10019650
test eax, eax
jne 0x1000acdd
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, esi
call eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], ebx
push dword [esi + 0x14]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000af00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022c4d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002fd18], 0xc
jl 0x1000af58
push 0x1002fd1c
call fcn.10019570
mov ecx, dword [0x1002fd14]
add esp, 4
test ecx, ecx
je 0x1000af4a
mov eax, dword [ecx]
mov dword [0x1002fd14], eax
mov dword [0x1002fd1c], 1
test ecx, ecx
jne 0x1000af77
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x1000af77
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x1002fd40], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6828.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000b050
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022c95
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002fd18], 0xc
jl 0x1000b0ab
push 0x1002fd1c
call fcn.10019570
mov ecx, dword [0x1002fd14]
add esp, 4
test ecx, ecx
je 0x1000b09d
mov eax, dword [ecx]
mov dword [0x1002fd14], eax
mov dword [0x1002fd1c], 1
test ecx, ecx
jne 0x1000b0ca
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x1000b0ca
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x1002fd40], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6828.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n6828.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000b460
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10023125
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002fd18], 0xc
jl 0x1000b4b8
push 0x1002fd1c
call fcn.10019570
mov ecx, dword [0x1002fd14]
add esp, 4
test ecx, ecx
je 0x1000b4aa
mov eax, dword [ecx]
mov dword [0x1002fd14], eax
mov dword [0x1002fd1c], 1
test ecx, ecx
jne 0x1000b4d7
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x1000b4d7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x1002fd40], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6828.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n6848.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000b5c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002317d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002fd18], 0xc
jl 0x1000b61b
push 0x1002fd1c
call fcn.10019570
mov ecx, dword [0x1002fd14]
add esp, 4
test ecx, ecx
je 0x1000b60d
mov eax, dword [ecx]
mov dword [0x1002fd14], eax
mov dword [0x1002fd1c], 1
test ecx, ecx
jne 0x1000b63a
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x1000b63a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x1002fd40], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6828.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n6848.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n1::rg_n6848.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000ba60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100232dd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002fd18], 0xc
jl 0x1000bab8
push 0x1002fd1c
call fcn.10019570
mov ecx, dword [0x1002fd14]
add esp, 4
test ecx, ecx
je 0x1000baaa
mov eax, dword [ecx]
mov dword [0x1002fd14], eax
mov dword [0x1002fd1c], 1
test ecx, ecx
jne 0x1000bad7
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x1000bad7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x1002fd40], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6828.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n6848.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n::rg_n37012.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000bbc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10023335
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002fd18], 0xc
jl 0x1000bc1b
push 0x1002fd1c
call fcn.10019570
mov ecx, dword [0x1002fd14]
add esp, 4
test ecx, ecx
je 0x1000bc0d
mov eax, dword [ecx]
mov dword [0x1002fd14], eax
mov dword [0x1002fd1c], 1
test ecx, ecx
jne 0x1000bc3a
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x1000bc3a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x1002fd40], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6828.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n6848.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n::rg_n37012.0
mov byte [ebp - 4], 5
mov dword [ecx], vtable.rg_n::rg_n37012.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret