joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019240
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e5a95
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102f8384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102fbb38], 0x54
jl 0x1001929c
push 0x102fbb3c
call fcn.100281d0
mov esi, dword [0x102fbb34]
add esp, 4
test esi, esi
je 0x1001928e
mov eax, dword [esi]
mov dword [0x102fbb34], eax
mov dword [0x102fbb3c], 1
test esi, esi
jne 0x100192b3
push 0x54
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10019318
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.10019790
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_volcano_windows_WangLao::rg_HPXianChengChiLei.1.0
mov dword [esi + 0xc], vtable.rg_volcano_windows_WangLao::rg_HPXianChengChiLei.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0x10]
test edi, edi
je 0x100192ef
mov ecx, edi
call fcn.10019b40
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x100192fb
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0x10], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.101c3949
int3
Function at 0x10019790
Capabilities:
Access peb ldr_data
Get kernel32 base address
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e5baf
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x102f8384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi + 0xc], vtable.IHPThreadPoolListener.0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_volcano_windows_WangLao::rg_HPXianChengChiLei.1.0
mov dword [esi + 0xc], vtable.rg_volcano_windows_WangLao::rg_HPXianChengChiLei.0
mov dword [esi + 0x14], 1
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x34], 1
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x44], 1
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
cmp dword [0x102fbb38], 0xc
jl 0x100198a3
push 0x102fbb3c
call fcn.100281d0
mov ecx, dword [0x102fbb34]
add esp, 4
test ecx, ecx
je 0x10019895
mov eax, dword [ecx]
mov dword [0x102fbb34], eax
mov dword [0x102fbb3c], 1
test ecx, ecx
jne 0x100198ba
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100198ff
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 6
mov dword [ecx], vtable.CRefObject.0
mov dword [ecx + 4], 1
mov byte [ebp - 4], 7
mov dword [ecx], vtable.CRefObjectWithData_class_CHPSocketThreadPoolWraper_.0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 5
mov dword [esi + 0x10], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.101c3949
int3

Function at 0x10019d00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e15b5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x102f8384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102fbb38], 0xc
jl 0x10019d58
push 0x102fbb3c
call fcn.100281d0
mov ecx, dword [0x102fbb34]
add esp, 4
test ecx, ecx
je 0x10019d4a
mov eax, dword [ecx]
mov dword [0x102fbb34], eax
mov dword [0x102fbb3c], 1
test ecx, ecx
jne 0x10019d6f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10019daf
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_volcano_windows_WangLao::rg_HPTongXinJiChuLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.101c3949
int3
Function at 0x10019e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e15fd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x102f8384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x102fbb38], 0xc
jl 0x10019e9b
push 0x102fbb3c
call fcn.100281d0
mov ecx, dword [0x102fbb34]
add esp, 4
test ecx, ecx
je 0x10019e8d
mov eax, dword [ecx]
mov dword [0x102fbb34], eax
mov dword [0x102fbb3c], 1
test ecx, ecx
jne 0x10019eb2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10019f09
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_volcano_windows_WangLao::rg_HPTongXinJiChuLei.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_windows_WangLao::rg_HPTongXinJiChuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.101c3949
int3

Function at 0x1001a0f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e571d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x102f8384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102fbb38], 0xc
jl 0x1001a148
push 0x102fbb3c
call fcn.100281d0
mov ecx, dword [0x102fbb34]
add esp, 4
test ecx, ecx
je 0x1001a13a
mov eax, dword [ecx]
mov dword [0x102fbb34], eax
mov dword [0x102fbb3c], 1
test ecx, ecx
jne 0x1001a15f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001a1a9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_volcano_windows_WangLao::rg_HPTongXinJiChuLei.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_windows_WangLao::rg_HPTCPDaiLiJiChuLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.101c3949
int3
Function at 0x1001a240
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e5765
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x102f8384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x102fbb38], 0xc
jl 0x1001a29b
push 0x102fbb3c
call fcn.100281d0
mov ecx, dword [0x102fbb34]
add esp, 4
test ecx, ecx
je 0x1001a28d
mov eax, dword [ecx]
mov dword [0x102fbb34], eax
mov dword [0x102fbb3c], 1
test ecx, ecx
jne 0x1001a2b2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001a313
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_volcano_windows_WangLao::rg_HPTongXinJiChuLei.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_windows_WangLao::rg_HPTCPDaiLiJiChuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_windows_WangLao::rg_HPTCPDaiLiJiChuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.101c3949
int3

Function at 0x1001a580
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e571d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x102f8384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102fbb38], 0xc
jl 0x1001a5d8
push 0x102fbb3c
call fcn.100281d0
mov ecx, dword [0x102fbb34]
add esp, 4
test ecx, ecx
je 0x1001a5ca
mov eax, dword [ecx]
mov dword [0x102fbb34], eax
mov dword [0x102fbb3c], 1
test ecx, ecx
jne 0x1001a5ef
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001a639
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_volcano_windows_WangLao::rg_HPTongXinJiChuLei.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_windows_WangLao::rg_HPTCPFuWuQiJiChuLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.101c3949
int3
Function at 0x1001a6d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e5765
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x102f8384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x102fbb38], 0xc
jl 0x1001a72b
push 0x102fbb3c
call fcn.100281d0
mov ecx, dword [0x102fbb34]
add esp, 4
test ecx, ecx
je 0x1001a71d
mov eax, dword [ecx]
mov dword [0x102fbb34], eax
mov dword [0x102fbb3c], 1
test ecx, ecx
jne 0x1001a742
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001a7a3
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_volcano_windows_WangLao::rg_HPTongXinJiChuLei.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_windows_WangLao::rg_HPTCPFuWuQiJiChuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_windows_WangLao::rg_HPTCPFuWuQiJiChuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.101c3949
int3

Function at 0x1001a9c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e16fd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x102f8384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102fbb38], 0x84
jl 0x1001aa1b
push 0x102fbb3c
call fcn.100281d0
mov ecx, dword [0x102fbb34]
add esp, 4
test ecx, ecx
je 0x1001aa0d
mov eax, dword [ecx]
mov dword [0x102fbb34], eax
mov dword [0x102fbb3c], 1
test ecx, ecx
jne 0x1001aa35
push 0x84
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001aa5a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.1001bea0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.101c3949
int3
Function at 0x1001aaf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e5da5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102f8384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102fbb38], 0x84
jl 0x1001ab4f
push 0x102fbb3c
call fcn.100281d0
mov esi, dword [0x102fbb34]
add esp, 4
test esi, esi
je 0x1001ab41
mov eax, dword [esi]
mov dword [0x102fbb34], eax
mov dword [0x102fbb3c], 1
test esi, esi
jne 0x1001ab69
push 0x84
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1001abce
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.1001bea0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_volcano_windows_WangLao::rg_HP_TCPDaiLiLei.1.0
mov dword [esi + 0xc], vtable.rg_volcano_windows_WangLao::rg_HP_TCPDaiLiLei.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0x10]
test edi, edi
je 0x1001aba5
mov ecx, edi
call fcn.10019b40
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x1001abb1
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0x10], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.101c3949
int3

Function at 0x1001b420
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e16fd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x102f8384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102fbb38], 0x84
jl 0x1001b47b
push 0x102fbb3c
call fcn.100281d0
mov ecx, dword [0x102fbb34]
add esp, 4
test ecx, ecx
je 0x1001b46d
mov eax, dword [ecx]
mov dword [0x102fbb34], eax
mov dword [0x102fbb3c], 1
test ecx, ecx
jne 0x1001b495
push 0x84
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001b4ba
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.1001b920
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.101c3949
int3
Function at 0x1001b550
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e5ee5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102f8384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102fbb38], 0x84
jl 0x1001b5af
push 0x102fbb3c
call fcn.100281d0
mov esi, dword [0x102fbb34]
add esp, 4
test esi, esi
je 0x1001b5a1
mov eax, dword [esi]
mov dword [0x102fbb34], eax
mov dword [0x102fbb3c], 1
test esi, esi
jne 0x1001b5c9
push 0x84
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1001b62e
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.1001b920
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_volcano_windows_WangLao::rg_HP_TCPFuWuQi.1.0
mov dword [esi + 0xc], vtable.rg_volcano_windows_WangLao::rg_HP_TCPFuWuQi.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0x10]
test edi, edi
je 0x1001b605
mov ecx, edi
call fcn.10019b40
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x1001b611
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0x10], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.101c3949
int3
Function at 0x1001b920
Capabilities:
Access peb ldr_data
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e5fe8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x102f8384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CVolObject.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [edi], vtable.rg_volcano_windows_WangLao::rg_HPTongXinJiChuLei.0
mov dword [ebp - 4], 1
mov dword [edi], vtable.rg_volcano_windows_WangLao::rg_HPTCPFuWuQiJiChuLei.0
mov dword [ebp - 4], 2
lea ebx, [edi + 0xc]
mov dword [ebp - 0x14], ebx
mov dword [ebx], vtable.ISocketListenerT_class_ITcpServer_.0
mov byte [ebp - 4], 3
mov dword [ebx], vtable.IComplexSocketListenerT_class_ITcpServer_.0
mov byte [ebp - 4], 4
mov dword [ebx], vtable.IServerListenerT_class_ITcpServer_.0
mov byte [ebp - 4], 5
mov dword [ebx], vtable.ITcpServerListener.0
mov byte [ebp - 4], 6
mov dword [edi], vtable.rg_volcano_windows_WangLao::rg_HP_TCPFuWuQi.1.0
mov dword [ebx], vtable.rg_volcano_windows_WangLao::rg_HP_TCPFuWuQi.0
mov dword [edi + 0x14], 1
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov byte [ebp - 4], 7
mov dword [edi + 0x24], 1
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov byte [ebp - 4], 8
mov dword [edi + 0x34], 1
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov byte [ebp - 4], 9
mov dword [edi + 0x44], 1
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov byte [ebp - 4], 0xa
mov dword [edi + 0x54], 1
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov byte [ebp - 4], 0xb
mov dword [edi + 0x64], 1
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov byte [ebp - 4], 0xc
mov dword [edi + 0x74], 1
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov byte [ebp - 4], 0xd
cmp dword [0x102fbb38], 0xc
jl 0x1001bad4
push 0x102fbb3c
call fcn.100281d0
mov esi, dword [0x102fbb34]
add esp, 4
test esi, esi
je 0x1001bac6
mov eax, dword [esi]
mov dword [0x102fbb34], eax
mov dword [0x102fbb3c], 1
test esi, esi
jne 0x1001baeb
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1001bb3e
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0xe
mov dword [esi], vtable.CRefObject.0
mov dword [esi + 4], 1
mov byte [ebp - 4], 0xf
mov dword [esi], vtable.CRefObjectWithData_class_CHPSocketWrapperTcpServer_.0
mov dword [esi + 8], 0
mov byte [ebp - 4], 0xd
push ebx
mov dword [edi + 0x10], esi
call fcn.1002d4e0
add esp, 4
mov dword [esi + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.101c3949
int3
Function at 0x1001bea0
Capabilities:
Access peb ldr_data
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e62c8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x102f8384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CVolObject.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [edi], vtable.rg_volcano_windows_WangLao::rg_HPTongXinJiChuLei.0
mov dword [ebp - 4], 1
mov dword [edi], vtable.rg_volcano_windows_WangLao::rg_HPTCPDaiLiJiChuLei.0
mov dword [ebp - 4], 2
lea ebx, [edi + 0xc]
mov dword [ebp - 0x14], ebx
mov dword [ebx], vtable.ISocketListenerT_class_ITcpAgent_.0
mov byte [ebp - 4], 3
mov dword [ebx], vtable.IComplexSocketListenerT_class_ITcpAgent_.0
mov byte [ebp - 4], 4
mov dword [ebx], vtable.IAgentListenerT_class_ITcpAgent_.0
mov byte [ebp - 4], 5
mov dword [ebx], vtable.ITcpAgentListener.0
mov byte [ebp - 4], 6
mov dword [edi], vtable.rg_volcano_windows_WangLao::rg_HP_TCPDaiLiLei.1.0
mov dword [ebx], vtable.rg_volcano_windows_WangLao::rg_HP_TCPDaiLiLei.0
mov dword [edi + 0x14], 1
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov byte [ebp - 4], 7
mov dword [edi + 0x24], 1
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov byte [ebp - 4], 8
mov dword [edi + 0x34], 1
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov byte [ebp - 4], 9
mov dword [edi + 0x44], 1
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov byte [ebp - 4], 0xa
mov dword [edi + 0x54], 1
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov byte [ebp - 4], 0xb
mov dword [edi + 0x64], 1
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov byte [ebp - 4], 0xc
mov dword [edi + 0x74], 1
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov byte [ebp - 4], 0xd
cmp dword [0x102fbb38], 0xc
jl 0x1001c054
push 0x102fbb3c
call fcn.100281d0
mov esi, dword [0x102fbb34]
add esp, 4
test esi, esi
je 0x1001c046
mov eax, dword [esi]
mov dword [0x102fbb34], eax
mov dword [0x102fbb3c], 1
test esi, esi
jne 0x1001c06b
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1001c0be
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0xe
mov dword [esi], vtable.CRefObject.0
mov dword [esi + 4], 1
mov byte [ebp - 4], 0xf
mov dword [esi], vtable.CRefObjectWithData_class_CHPSocketWrapperTcpAgent_.0
mov dword [esi + 8], 0
mov byte [ebp - 4], 0xd
push ebx
mov dword [edi + 0x10], esi
call fcn.1002d4b0
add esp, 4
mov dword [esi + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.101c3949
int3
Function at 0x1001f160
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e16fd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x102f8384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102fbb38], 0x10
jl 0x1001f1b8
push 0x102fbb3c
call fcn.100281d0
mov ecx, dword [0x102fbb34]
add esp, 4
test ecx, ecx
je 0x1001f1aa
mov eax, dword [ecx]
mov dword [0x102fbb34], eax
mov dword [0x102fbb3c], 1
test ecx, ecx
jne 0x1001f1cf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001f1f4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.1001f480
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.101c3949
int3

Function at 0x1001f280
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e6d75
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102f8384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102fbb38], 0x10
jl 0x1001f2dc
push 0x102fbb3c
call fcn.100281d0
mov esi, dword [0x102fbb34]
add esp, 4
test esi, esi
je 0x1001f2ce
mov eax, dword [esi]
mov dword [0x102fbb34], eax
mov dword [0x102fbb3c], 1
test esi, esi
jne 0x1001f2f3
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1001f351
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.1001f480
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_volcano_base::rg_HuChiSuoLei.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x1001f328
mov ecx, edi
call fcn.10019b40
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1001f334
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.101c3949
int3