joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47ad60
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.0049b540
mov eax, dword [esp + 0x11c70]
push ebx
push ebp
mov ebp, dword [esp + 0x11c74]
push esi
mov esi, ecx
movzx ecx, word [edx]
xor ebx, ebx
cmp ecx, 0x41
je 0x47ad8c
cmp ecx, 0x61
jne 0x47adee
cmp word [edx + 2], bx
jne 0x47adee
cmp word [edi], bx
jne 0x47adee
cmp word [eax], bx
jne 0x47adee
cmp word [esi], bx
jne 0x47adee
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, ebx
je 0x47adcf
cmp byte [ebp + 0xea], bl
jne 0x47adcf
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x47adcd
push esi
call fcn.0047b9c0
add esp, 4
test al, al
je 0x47adcf
xor esi, esi
cmp byte [esp + 0x11c84], bl
je 0x47ade2
cmp esi, ebx
je 0x47ade2
mov dword [ebp + 0xc4], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
cmp cx, bx
jne 0x47ae13
cmp word [edi], bx
jne 0x47ae13
cmp word [eax], bx
jne 0x47ae13
cmp word [esi], bx
jne 0x47ae13
mov eax, ebp
call fcn.0047af70
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
push esi
push edi
push edx
push ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x102c], 0x4a3910
mov byte [esp + 0x1849], bl
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x1850], ebx
mov dword [esp + 0x1854], ebx
mov dword [esp + 0x1858], ebx
mov dword [esp + 0x185c], ebx
mov dword [esp + 0x1860], ebx
mov dword [esp + 0x186c], ebx
mov dword [esp + 0x1870], ebx
call fcn.0047bb20
test eax, eax
je 0x47af22
test byte [esp + 0x10], 2
mov al, byte [esp + 0x11c80]
mov ecx, dword [esp + 0x11c88]
mov edx, dword [esp + 0x11c8c]
mov byte [esp + 0x1839], al
mov dword [esp + 0x1848], ecx
mov dword [esp + 0x184c], edx
je 0x47af2e
mov eax, dword [esp + 0x102c]
cmp eax, 0xffff
je 0x47aefa
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47af22
cmp byte [ebp + 0xea], bl
jne 0x47aef3
mov esi, dword [esp + 0x102c]
call fcn.0047ba30
cmp al, bl
jne 0x47aef3
mov eax, dword [esp + 0x102c]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x47af22
mov eax, dword [esp + 0x102c]
cmp dword [esp + 0x1860], eax
je 0x47af13
lea esi, [esp + 0x10]
mov dword [esp + 0x1860], eax
call fcn.0047bf80
push ebx
lea ecx, [esp + 0x14]
push ecx
call fcn.0047c040
test eax, eax
jne 0x47af3e
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
lea edx, [esp + 0x10]
push edx
push 0x47aff0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x1840]
cmp byte [esp + 0x11c84], bl
je 0x47af58
cmp eax, ebx
je 0x47af58
mov dword [ebp + 0xc4], eax
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
Function at 0x47bf80
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov ecx, dword [esi + 0x1850]
test ecx, ecx
je 0x47c03e
mov eax, dword [esi]
test eax, eax
je 0x47c03e
push edi
test al, 1
jne 0x47bfaa
mov eax, dword [esi + 0x100c]
cmp word [eax], 0
je 0x47bfc6
push 0x7fff
lea edi, [esi + 0x1858]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x47bfc6
xor ecx, ecx
mov word [edi], cx
test byte [esi], 4
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
je 0x47bfe1
mov eax, dword [esi + 0x1850]
lea edx, [esi + 0x1854]
push edx
push eax
call edi
test byte [esi], 0x20
je 0x47c01f
mov edx, dword [esi + 0x1850]
lea ecx, [esp + 4]
push ecx
push edx
call edi
test eax, eax
je 0x47c01f
movzx eax, byte [esi + 0x1828]
mov ecx, dword [esp + 4]
push eax
lea eax, [esi + 0x11a58]
call fcn.00452300
add esp, 4
test eax, eax
jne 0x47c01f
xor ecx, ecx
mov word [esi + 0x11a58], cx
test byte [esi], 8
pop edi
je 0x47c03e
mov eax, dword [esi + 0x1850]
push 0x101
lea edx, [esi + 0x11856]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
pop ecx
ret

Function at 0x47c880
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c64
call fcn.0049b540
mov eax, dword [esp + 0x11c68]
mov eax, dword [eax + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x47c92d
mov dword [esp + 0x1848], eax
lea eax, [esp + 8]
push eax
push 0x47d000
mov dword [esp + 0x10], ebx
mov dword [esp + 0x101c], 0x4a3910
mov byte [esp + 0x1839], bl
mov dword [esp + 0x183c], ebx
mov dword [esp + 0x1840], ebx
mov dword [esp + 0x1844], ebx
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x185c], ebx
mov dword [esp + 0x1860], ebx
mov byte [esp + 0x1854], cl
mov dword [esp + 0x1858], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0x1838], ebx
je 0x47c92d
mov ecx, dword [0x4c6a44]
mov eax, dword [ecx + 0x54]
cmp eax, 0xffffffff
jle 0x47c92d
push 1
push eax
call fcn.004013d0
add esp, 8
mov eax, 1
pop ebx
add esp, 0x11c64
ret 4
Function at 0x47c940
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
jne 0x47c95c
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4c6a44]
push eax
push esi
mov ecx, edi
call fcn.0047ce00
cmp byte [edi], 0
mov dword [esp + 0x10], eax
je 0x47c993
test eax, eax
jne 0x47c997
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push edi
call fcn.0047ca50
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test eax, eax
jne 0x47ca16
test esi, esi
je 0x47ca16
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 1
push 0x8000012f
mov ebx, eax
call fcn.004013d0
mov edi, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call edi
test eax, eax
je 0x47c9f5
mov edi, edi
call ebp
lea ecx, [ebx + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x47c9f5
push 1
push 0x8000012f
call fcn.004013d0
add esp, 8
push esi
call edi
test eax, eax
jne 0x47c9d0
mov edx, dword [0x4c6a44]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x47ca0e
push 1
push eax
call fcn.004013d0
add esp, 8
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x47ca30
mov ecx, dword [esp + 0x1c]
push 0
push ecx
push edi
call fcn.0047ca50
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov edx, dword [esp + 0x1c]
push edx
mov ecx, edi
call fcn.0047cbd0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x47cbd0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.0049b540
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x47cd50
xor cl, cl
mov eax, edi
call fcn.0047cd70
test eax, eax
jne 0x47cc05
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov eax, dword [0x4c6a44]
push eax
push ebp
mov ecx, edi
call fcn.0047ce00
test eax, eax
je 0x47cc28
xor eax, eax
mov dword [0x4cb470], eax
jmp 0x47cc2d
mov eax, dword [0x4cb470]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1024], 0x4a3910
mov dword [esp + 0x1844], ebx
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x1864], ebx
mov dword [esp + 0x1868], ebx
cmp byte [esp + 0x11c7c], bl
je 0x47cc73
mov byte [esp + 0x1841], bl
cmp eax, ebx
je 0x47cc7b
mov byte [esp + 0x1841], 1
mov ecx, dword [0x4cb46c]
mov edx, dword [edi + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x1854], eax
lea eax, [esp + 0x18]
push eax
push 0x47ced0
mov dword [esp + 0x1858], ecx
mov dword [esp + 0x1860], edx
call esi
mov eax, dword [esp + 0x1848]
cmp eax, ebx
je 0x47cd28
lea ecx, [esp + 0x10]
push ecx
push 0x47b890
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x47cce5
mov edx, dword [esp + 0x1848]
call fcn.0047c510
mov dword [esp + 0x1848], esi
mov eax, dword [esp + 0x1848]
call fcn.0047a810
mov edx, dword [esp + 0x1848]
call fcn.0047c510
mov edx, dword [0x4c6a44]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x47cd50
push 1
push eax
call fcn.004013d0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
mov eax, dword [0x4cb470]
cmp eax, ebx
je 0x47cd50
cmp eax, 1
setg al
mov dword [0x4cb470], ebx
cmp al, bl
je 0x47cd50
mov edx, ebp
call fcn.0047c510
push ebx
mov ecx, edi
call fcn.0047cbd0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x11c68
ret 4
Function at 0x496cc6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c5dd0]
jne 0x496cd0
repz ret
jmp fcn.0049b256

Function at 0x499460
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c5dd0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00493ba2
and dword [ebp - 0x14], 0
cmp dword [0x4c8c54], 0
mov dword [ebp - 0x18], eax
jne 0x499513
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4995bb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4a3020
push ebx
call edi
test eax, eax
je 0x4995bb
mov esi, dword [fcn.0048ff70]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4c8c54], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4c8c58], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4c8c5c], eax
call edi
push eax
call esi
mov dword [0x4c8c64], eax
test eax, eax
je 0x499513
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4c8c60], eax
mov eax, dword [0x4c8c60]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.0048ff74]
cmp eax, ecx
je 0x49956c
cmp dword [0x4c8c64], ecx
je 0x49956c
push eax
call esi
push dword [0x4c8c64]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x49956c
test ebx, ebx
je 0x49956c
call edi
test eax, eax
je 0x499563
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x499563
test byte [ebp - 8], 1
jne 0x49956c
or dword [ebp + 0x10], 0x200000
jmp 0x49959f
mov eax, dword [0x4c8c58]
cmp eax, dword [ebp - 0x18]
je 0x49959f
push eax
call esi
test eax, eax
je 0x49959f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x49959f
mov eax, dword [0x4c8c5c]
cmp eax, dword [ebp - 0x18]
je 0x49959f
push eax
call esi
test eax, eax
je 0x49959f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c8c54]
call esi
test eax, eax
je 0x4995bb
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4995bd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00496cc6
leave
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x505e48a6
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x252b66db
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427aa5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x438d98], 0xc
jl 0x401608
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x4015fa
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x401627
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x401627
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_volcano_base::rg_KuoZhanDuiXiangLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4016f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427aed
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x438d98], 0xc
jl 0x40174b
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x40173d
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x40176a
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40176a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_volcano_base::rg_KuoZhanDuiXiangLei.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_KuoZhanDuiXiangLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401b10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427bed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x438d98], 0x2c
jl 0x401b68
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x401b5a
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x401b87
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x401b87
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00401ec0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x401ce0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427c25
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x438d98], 0x2c
jl 0x401d3d
push 0x438d9c
call fcn.0041fd10
mov esi, dword [0x438d94]
add esp, 4
test esi, esi
je 0x401d2f
mov eax, dword [esi]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test esi, esi
jne 0x401d5c
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x401d5c
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00401ec0
mov byte [ebp - 4], 1
lea ebx, [edi + 0xc]
mov dword [esi], vtable.rg_volcano_base::rg_WenBenShuZuLei.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
lea edi, [esi + 0xc]
mov dword [esi + 8], eax
cmp ebx, edi
je 0x401d9c
mov ecx, edi
call fcn.00416800
push ebx
mov ecx, edi
call fcn.004166d0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402180
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427bed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x438d98], 0x2c
jl 0x4021d8
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x4021ca
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x4021f7
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4021f7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00402750
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4022b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427e35
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x438d98], 0x2c
jl 0x40230d
push 0x438d9c
call fcn.0041fd10
mov edi, dword [0x438d94]
add esp, 4
test edi, edi
je 0x4022ff
mov eax, dword [edi]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test edi, edi
jne 0x40232c
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x40232c
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.00402750
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.00402d10
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402aa0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427aa5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x438d98], 0x1c
jl 0x402af8
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x402aea
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x402b17
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x402b17
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolMem.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x18], 0x40
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x402c20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427ffd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x438d98], 0x1c
jl 0x402c7b
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x402c6d
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x402c9a
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x402c9a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.00402b80
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403290
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427bed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x438d98], 0xc
jl 0x4032e8
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x4032da
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x403307
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x403307
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4033c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4280d5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x438008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x438d98], 0xc
jl 0x40341b
push 0x438d9c
call fcn.0041fd10
mov ecx, dword [0x438d94]
add esp, 4
test ecx, ecx
je 0x40340d
mov eax, dword [ecx]
mov dword [0x438d94], eax
mov dword [0x438d9c], 1
test ecx, ecx
jne 0x40343a
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40343a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolObject.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret