joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401650
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e20d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x42caf8], 0x18
jl 0x4016a8
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x40169a
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x4016bf
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x401717
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2310.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3

Function at 0x4017b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e255
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x42caf8], 0x18
jl 0x40180b
push 0x42cafc
call fcn.0040c2c0
mov edx, dword [0x42caf4]
add esp, 4
test edx, edx
je 0x4017fd
mov eax, dword [edx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test edx, edx
jne 0x401822
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x40189d
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov dword [edx], vtable.CVolObject.0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [ebp - 4], 1
mov dword [edx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.rg_n::rg_n2310.0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov byte [ebp - 4], 3
mov dword [edx], vtable.rg_n::rg_n2310.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3
Function at 0x401b10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e20d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x42caf8], 0x10
jl 0x401b68
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x401b5a
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x401b7f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x401bd0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2314.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3

Function at 0x401c60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e255
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x42caf8], 0x10
jl 0x401cbb
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x401cad
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x401cd2
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x401d40
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2314.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2314.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3
Function at 0x401f40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e20d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x42caf8], 0x18
jl 0x401f98
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x401f8a
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x401faf
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x402001
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_n::rg_n2312.0
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3

Function at 0x4020c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e255
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x42caf8], 0x18
jl 0x40211b
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x40210d
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x402132
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4021a5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_n::rg_n2312.0
movsd qword [ecx + 0x10], xmm0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2312.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
movsd xmm0, qword [esi + 0x10]
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3
Function at 0x402460
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e20d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x42caf8], 0x10
jl 0x4024b8
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x4024aa
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x4024cf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x402520
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2308.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3

Function at 0x4025b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e255
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x42caf8], 0x10
jl 0x40260b
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x4025fd
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x402622
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x402690
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2308.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2308.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3
Function at 0x402890
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e20d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x42caf8], 0x10
jl 0x4028e8
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x4028da
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x4028ff
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40294f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n::rg_n2304.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3

Function at 0x4029f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e255
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x42caf8], 0x10
jl 0x402a4b
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x402a3d
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x402a62
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x402ad1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n::rg_n2304.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2304.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3
Function at 0x402d20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e20d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x42caf8], 0x10
jl 0x402d78
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x402d6a
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x402d8f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x402ddf
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n::rg_n2302.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3

Function at 0x402e80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e255
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x42caf8], 0x10
jl 0x402edb
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x402ecd
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x402ef2
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x402f61
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n::rg_n2302.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2302.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3
Function at 0x4031f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e20d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x42caf8], 0x10
jl 0x403248
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x40323a
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x40325f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4032ad
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2300.0
mov byte [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3

Function at 0x403340
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e255
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x42caf8], 0x10
jl 0x40339b
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x40338d
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x4033b2
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40341d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n2300.0
mov byte [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n2300.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov al, byte [esi + 0xc]
mov byte [ecx + 0xc], al
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3
Function at 0x403ac0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e505
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x42caf8], 0xc
jl 0x403b18
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x403b0a
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x403b2f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x403b6f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3

Function at 0x403b80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e54d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x42caf8], 0xc
jl 0x403bdb
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x403bcd
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x403bf2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x403c49
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3

Function at 0x403fb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e64d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x42caf8], 0xc
jl 0x404008
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x403ffa
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x40401f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x404055
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3
Function at 0x4040e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e6b5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x42caf8], 0xc
jl 0x40413b
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x40412d
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x404152
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40419f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolObject.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3

Function at 0x4045b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e20d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x42b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x42caf8], 0xc
jl 0x404608
push 0x42cafc
call fcn.0040c2c0
mov ecx, dword [0x42caf4]
add esp, 4
test ecx, ecx
je 0x4045fa
mov eax, dword [ecx]
mov dword [0x42caf4], eax
mov dword [0x42cafc], 1
test ecx, ecx
jne 0x40461f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40466f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x42cb20], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n6332.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00410943
int3