joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415fe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46004d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5d9e08], 0xc
jl 0x41603b
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x41602d
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x416052
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4160a9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_n14110::rg_n14228.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n14110::rg_n14228.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x4162e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461f48
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x2c
jl 0x416338
push 0x5d9e0c
call fcn.0043c770
mov edx, dword [0x5d9e04]
add esp, 4
test edx, edx
je 0x41632a
mov eax, dword [edx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test edx, edx
jne 0x41634f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x4163a2
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov dword [edx], vtable.CVolObject.0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [ebp - 4], 1
mov dword [edx], vtable.rg_n::rg_n2149.0
mov byte [ebp - 4], 2
push ecx
lea ecx, [edx + 0xc]
mov dword [edx], vtable.rg_n::rg_n1726.0
call fcn.0042ce20
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x4164e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461fa0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5d9e08], 0x2c
jl 0x41653c
push 0x5d9e0c
call fcn.0043c770
mov esi, dword [0x5d9e04]
add esp, 4
test esi, esi
je 0x41652e
mov eax, dword [esi]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test esi, esi
jne 0x416553
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4165ba
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n::rg_n2149.0
mov byte [ebp - 4], 2
push ecx
lea ecx, [esi + 0xc]
mov dword [esi], vtable.rg_n::rg_n1726.0
call fcn.0042ce20
mov byte [ebp - 4], 4
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n::rg_n1726.0
call fcn.004166c0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x4169e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f2bd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x28
jl 0x416a38
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x416a2a
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x416a4f
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x416a74
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00416cf0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x416b10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4620a5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5d9e08], 0x28
jl 0x416b6d
push 0x5d9e0c
call fcn.0043c770
mov esi, dword [0x5d9e04]
add esp, 4
test esi, esi
je 0x416b5f
mov eax, dword [esi]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test esi, esi
jne 0x416b84
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x416bdf
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00416cf0
mov byte [ebp - 4], 1
lea ebx, [edi + 0xc]
mov dword [esi], vtable.rg_n::rg_n442.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
lea edi, [esi + 0xc]
mov dword [esi + 8], eax
cmp ebx, edi
je 0x416bc4
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x44]
push ebx
mov ecx, edi
call fcn.00402720
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x41fda0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463d83
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x5d500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [esi + 0x85e8]
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
cmp edi, eax
jne 0x41feeb
mov ecx, 0xc8
call fcn.0040b8e0
lea eax, [ebp - 0x98]
push eax
call ebx
mov edx, dword [ebp - 0x98]
lea ecx, [ebp - 0xc4]
call fcn.004022f0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x90]
push edx
push 0x5c08a4
push eax
mov dword [ebp - 0xc4], vtable.CWString.0
call fcn.0043cc60
add esp, 0xc
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0xc4]
push eax
call fcn.0043d350
mov dword [ebp - 4], 1
lea eax, [ebp - 0xc4]
push eax
lea ecx, [esi + 0x60b4]
call fcn.00407f80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.00401ff0
lea eax, [ebp - 0x98]
push eax
call ebx
mov edx, dword [ebp - 0x94]
lea ecx, [ebp - 0xc4]
call fcn.004022f0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x90]
push edx
push 0x5c08a4
push eax
mov dword [ebp - 0xc4], vtable.CWString.0
call fcn.0043cc60
add esp, 0xc
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0xc4]
push eax
call fcn.0043d350
mov dword [ebp - 4], 3
lea eax, [ebp - 0xc4]
push eax
lea ecx, [esi + 0x64b4]
call fcn.00407f80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.00401ff0
lea eax, [esi + 0x8a78]
cmp edi, eax
jne 0x41ff05
mov ecx, 0xa
call fcn.0040b8e0
inc dword [esi + 0x8a74]
lea eax, [esi + 0x85c8]
cmp edi, eax
jne 0x420049
mov ecx, 0xc8
call fcn.0040b8e0
lea eax, [ebp - 0x98]
push eax
call ebx
mov edx, dword [ebp - 0x94]
lea ecx, [ebp - 0xf0]
call fcn.004022f0
mov dword [ebp - 4], 4
lea eax, [ebp - 0x90]
push edx
push 0x5c08a4
push eax
mov dword [ebp - 0xf0], vtable.CWString.0
call fcn.0043cc60
add esp, 0xc
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0xf0]
push eax
call fcn.0043d350
mov dword [ebp - 4], 5
lea eax, [ebp - 0x98]
push eax
call ebx
mov edx, dword [ebp - 0x98]
lea ecx, [ebp - 0xc4]
call fcn.004022f0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x90]
push edx
push 0x5c08a4
push eax
mov dword [ebp - 0xc4], vtable.CWString.0
call fcn.0043cc60
add esp, 0xc
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0xc4]
push eax
call fcn.0043d350
mov byte [ebp - 4], 7
lea edx, [ebp - 0xc4]
push 0x5be964
lea ecx, [ebp - 0x148]
call fcn.0043eb20
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xf0]
push ecx
mov edx, eax
lea ecx, [ebp - 0x11c]
call fcn.0043e9a0
add esp, 8
mov byte [ebp - 4], 9
lea ecx, [esi + 0x1ff4]
push eax
call fcn.00407f80
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x11c]
call fcn.00401ff0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x148]
call fcn.00401ff0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xc4]
call fcn.00401ff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
call fcn.00401ff0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044a232
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4289f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462e1b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x5d9e08], 0x40
jl 0x428a4d
push 0x5d9e0c
call fcn.0043c770
mov edi, dword [0x5d9e04]
add esp, 4
test edi, edi
je 0x428a3f
mov eax, dword [edi]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test edi, edi
jne 0x428a68
push 0x40
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x428b83
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov dword [edi], vtable.CRefObject.0
mov dword [edi + 4], 1
mov byte [ebp - 4], 1
lea eax, [edi + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push eax
mov dword [edi], vtable.CVolEventObjectPointer.0
call esi
mov byte [ebp - 4], 2
lea eax, [edi + 0x24]
push eax
call esi
mov byte [ebp - 4], 3
mov dword [edi + 8], 0
mov dword [edi + 0x3c], ebx
mov dword [ebp - 4], 0xffffffff
lea esi, [ebx + 0xb74]
push esi
mov dword [ebx + 0xf54], edi
mov dword [ebx + 0x10], 0x20e
call fcn.0043c770
mov edx, dword [esi + 8]
add esp, 4
mov dword [esi + 4], 0x414cc0
mov dword [esi + 0xc], 0
cmp edx, edi
jne 0x428aed
mov dword [esi], 1
jmp 0x428b08
mov ecx, edi
mov dword [esi + 8], edi
call fcn.0042d7a0
mov dword [esi], 1
test edx, edx
je 0x428b08
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0x20]
mov edi, dword [ebx + 0xf54]
lea esi, [ebx + 0xcc4]
push esi
call fcn.0043c770
mov edx, dword [esi + 8]
add esp, 4
mov dword [esi + 0xc], 0
test edi, edi
jne 0x428b33
mov dword [esi + 4], edi
mov dword [esi + 8], edi
jmp 0x428b60
mov dword [esi + 4], 0x414cd0
cmp edx, edi
jne 0x428b56
mov dword [esi], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
mov dword [esi + 8], edi
call fcn.0042d7a0
mov dword [esi], 1
test edx, edx
je 0x428b71
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x42cf40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f445
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x10
jl 0x42cf98
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x42cf8a
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x42cfaf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42cff6
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x42d000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46708d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5d9e08], 0x10
jl 0x42d05c
push 0x5d9e0c
call fcn.0043c770
mov esi, dword [0x5d9e04]
add esp, 4
test esi, esi
je 0x42d04e
mov eax, dword [esi]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test esi, esi
jne 0x42d073
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x42d0ef
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolRefObject.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x42d0c6
mov ecx, edi
call fcn.0042d7a0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x42d0d2
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x42d8b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46720d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x10
jl 0x42d908
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x42d8fa
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x42d91f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42d96f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n::rg_n2304.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x42da10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x467255
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5d9e08], 0x10
jl 0x42da6b
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x42da5d
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x42da82
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42daf1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n::rg_n2304.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2304.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x42dd50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46720d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x10
jl 0x42dda8
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x42dd9a
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x42ddbf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42de10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2308.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x42dea0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x467255
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5d9e08], 0x10
jl 0x42defb
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x42deed
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x42df12
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42df80
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2308.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2308.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x42e200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46720d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x18
jl 0x42e258
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x42e24a
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x42e26f
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42e2c1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_n::rg_n2312.0
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x42e380
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x467255
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5d9e08], 0x18
jl 0x42e3db
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x42e3cd
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x42e3f2
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42e465
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_n::rg_n2312.0
movsd qword [ecx + 0x10], xmm0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2312.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
movsd xmm0, qword [esi + 0x10]
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3
Function at 0x42e730
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46720d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5d9e08], 0x10
jl 0x42e788
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x42e77a
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x42e79f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42e7f0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2314.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3

Function at 0x42e880
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x467255
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5d9e08], 0x10
jl 0x42e8db
push 0x5d9e0c
call fcn.0043c770
mov ecx, dword [0x5d9e04]
add esp, 4
test ecx, ecx
je 0x42e8cd
mov eax, dword [ecx]
mov dword [0x5d9e04], eax
mov dword [0x5d9e0c], 1
test ecx, ecx
jne 0x42e8f2
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x42e960
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2314.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2314.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0044e8c3
int3