joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001910
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ef35
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002db38], 0x1c
jl 0x10001968
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x1000195a
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x1000197f
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100019db
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolMem.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x18], 0x40
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3

Function at 0x100019f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ef7d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x1002db38], 0x1c
jl 0x10001a4c
push 0x1002db3c
call fcn.1000c340
mov esi, dword [0x1002db34]
add esp, 4
test esi, esi
je 0x10001a3e
mov eax, dword [esi]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test esi, esi
jne 0x10001a63
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10001ad3
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolMem.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0x40
mov byte [ebp - 4], 2
mov ecx, esi
push edi
mov dword [esi], vtable.CVolMem.0
call fcn.10001b20
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3
Function at 0x10002070
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f04d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002db38], 0xc
jl 0x100020c8
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x100020ba
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x100020df
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10002115
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3

Function at 0x10002120
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f085
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002db38], 0xc
jl 0x1000217b
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x1000216d
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x10002192
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100021df
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolObject.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3
Function at 0x10002be0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f1fd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002db38], 0x10
jl 0x10002c38
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x10002c2a
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x10002c4f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10002c9f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_volcano_base::rg_ZiFuLei.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3

Function at 0x10002d40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f245
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002db38], 0x10
jl 0x10002d9b
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x10002d8d
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x10002db2
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10002e21
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_volcano_base::rg_ZiFuLei.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_ZiFuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3
Function at 0x100030d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f1fd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002db38], 0x10
jl 0x10003128
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x1000311a
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x1000313f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10003190
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_BianZhengShuLei.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3

Function at 0x10003220
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f245
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002db38], 0x10
jl 0x1000327b
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x1000326d
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x10003292
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10003300
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_BianZhengShuLei.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_BianZhengShuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3
Function at 0x10003580
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f1fd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002db38], 0x18
jl 0x100035d8
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x100035ca
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x100035ef
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10003641
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_volcano_base::rg_XiaoShuLei.0
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3

Function at 0x10003700
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f245
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002db38], 0x18
jl 0x1000375b
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x1000374d
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x10003772
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100037e5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_volcano_base::rg_XiaoShuLei.0
movsd qword [ecx + 0x10], xmm0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_XiaoShuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
movsd xmm0, qword [esi + 0x10]
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3
Function at 0x10003ab0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f1fd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002db38], 0x10
jl 0x10003b08
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x10003afa
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x10003b1f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10003b70
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_LuoJiXingLei.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3

Function at 0x10003c00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f245
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002db38], 0x10
jl 0x10003c5b
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x10003c4d
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x10003c72
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10003ce0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_LuoJiXingLei.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_LuoJiXingLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3
Function at 0x10003ee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f1fd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002db38], 0x18
jl 0x10003f38
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x10003f2a
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x10003f4f
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10003fa7
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ChangZhengShuLei.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3

Function at 0x10004040
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f245
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002db38], 0x18
jl 0x1000409b
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x1000408d
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x100040b2
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000412d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ChangZhengShuLei.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_ChangZhengShuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3
Function at 0x10004390
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f1fd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002db38], 0x10
jl 0x100043e8
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x100043da
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x100043ff
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10004450
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ZhengShuLei.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3

Function at 0x100044e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f245
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002db38], 0x10
jl 0x1000453b
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x1000452d
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x10004552
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100045c0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ZhengShuLei.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_ZhengShuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3
Function at 0x100047c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f1fd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1002db38], 0x10
jl 0x10004818
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x1000480a
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x1000482f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000487f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_volcano_base::rg_DuanZhengShuLei.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3

Function at 0x10004920
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f245
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1002c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1002db38], 0x10
jl 0x1000497b
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x1000496d
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x10004992
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10004a01
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_volcano_base::rg_DuanZhengShuLei.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_DuanZhengShuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.10010fb9
int3