joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000bfc3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.1000a5fb
add esp, 0xc
mov dword [ebp - 0x730], eax
and dword [ebp - 0x6fc], 0
push 1
pop eax
test eax, eax
je 0x1000c6dc
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x1000c1b1
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
mov byte [ebp - 0x76c], 0x92
mov byte [ebp - 0x76b], 0x97
mov byte [ebp - 0x76a], 0x9e
mov byte [ebp - 0x769], 0x88
mov byte [ebp - 0x768], 0xa7
mov byte [ebp - 0x767], 0xb8
mov byte [ebp - 0x766], 0x94
mov byte [ebp - 0x765], 0x96
mov byte [ebp - 0x764], 0x96
mov byte [ebp - 0x763], 0x94
mov byte [ebp - 0x762], 0x95
mov byte [ebp - 0x761], 0xdb
mov byte [ebp - 0x760], 0xbd
mov byte [ebp - 0x75f], 0x92
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
mov byte [ebp - 0x75c], 0x88
mov byte [ebp - 0x75b], 0xa7
mov byte [ebp - 0x75a], 0xa8
mov byte [ebp - 0x759], 0x82
mov byte [ebp - 0x758], 0x88
mov byte [ebp - 0x757], 0x8f
mov byte [ebp - 0x756], 0x9e
mov byte [ebp - 0x755], 0x96
mov byte [ebp - 0x754], 0xa7
mov byte [ebp - 0x753], 0x88
mov byte [ebp - 0x752], 0x82
mov byte [ebp - 0x751], 0x96
mov byte [ebp - 0x750], 0x88
mov byte [ebp - 0x74f], 0x89
mov byte [ebp - 0x74e], 0x8d
mov byte [ebp - 0x74d], 0xd5
mov byte [ebp - 0x74c], 0x9f
mov byte [ebp - 0x74b], 0x97
mov byte [ebp - 0x74a], 0x97
mov byte [ebp - 0x749], 0xfb
mov bh, 0xf8
invalid
invalid
sti
lea eax, [ebp - 0x77c]
push eax
call fcn.1000a646
pop ecx
mov al, byte [ebp - 0x12c]
mov byte [ebp - 0x778], al
push 0x30
lea eax, [ebp - 0x77c]
push eax
call fcn.1000a646
pop ecx
push eax
lea eax, [ebp - 0x504]
push eax
call fcn.1000a5a7
inc dword [ebx - 0x7a72f33c]
cld
cli
invalid
dec dword [ecx - 0x39f7b]
invalid
jmp 0x1000c5ae
cmp dword [ebp - 0x6fc], 1
jne 0x1000c262
and byte [ebp - 0x78c], 0
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
invalid
movsd dword es:[edi], dword [esi]

Function at 0x1000c1e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
xor eax, esi
test dword [edx + 0x33fffff8], eax
mov byte [ebp - 0x77d], 0x5f
push 0xc
Function at 0x10001aa0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067c35
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10093948], 0xc
jl 0x10001af8
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x10001aea
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x10001b0f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10001b4f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_KuoZhanDuiXiangLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3

Function at 0x10001be0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067c7d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10093948], 0xc
jl 0x10001c3b
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x10001c2d
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x10001c52
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10001ca9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_KuoZhanDuiXiangLei.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_KuoZhanDuiXiangLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3
Function at 0x10001f60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067d98
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10093948], 0x2c
jl 0x10001fb8
push 0x1009394c
call fcn.100433c0
mov edx, dword [0x10093944]
add esp, 4
test edx, edx
je 0x10001faa
mov eax, dword [edx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test edx, edx
jne 0x10001fcf
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x10002022
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov dword [edx], vtable.CVolObject.0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [ebp - 4], 1
mov dword [edx], vtable.rg_HuoShan_JiBen::rg_KuoZhanDuiXiangLei.0
mov byte [ebp - 4], 2
push ecx
lea ecx, [edx + 0xc]
mov dword [edx], vtable.rg_HuoShan_JiBen::rg_WenBenShuZuLei.0
call fcn.10004440
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3

Function at 0x10002160
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067df0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x10093948], 0x2c
jl 0x100021bc
push 0x1009394c
call fcn.100433c0
mov esi, dword [0x10093944]
add esp, 4
test esi, esi
je 0x100021ae
mov eax, dword [esi]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test esi, esi
jne 0x100021d3
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1000223a
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_HuoShan_JiBen::rg_KuoZhanDuiXiangLei.0
mov byte [ebp - 4], 2
push ecx
lea ecx, [esi + 0xc]
mov dword [esi], vtable.rg_HuoShan_JiBen::rg_WenBenShuZuLei.0
call fcn.10004440
mov byte [ebp - 4], 4
mov ecx, esi
push edi
mov dword [esi], vtable.rg_HuoShan_JiBen::rg_WenBenShuZuLei.0
call fcn.10002340
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3
Function at 0x100027c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100683ed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10093948], 0x2c
jl 0x10002818
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x1000280a
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x1000282f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10002854
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.10002c10
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3

Function at 0x100028f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068455
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x10093948], 0x2c
jl 0x1000294d
push 0x1009394c
call fcn.100433c0
mov edi, dword [0x10093944]
add esp, 4
test edi, edi
je 0x1000293f
mov eax, dword [edi]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test edi, edi
jne 0x10002964
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x100029c1
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.10002c10
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.10003f90
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3

Function at 0x10002da0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100683ed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10093948], 0x28
jl 0x10002df8
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x10002dea
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x10002e0f
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10002e35
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push ecx
call fcn.10003120
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3
Function at 0x10002e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068535
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x10093948], 0x28
jl 0x10002e9c
push 0x1009394c
call fcn.100433c0
mov esi, dword [0x10093944]
add esp, 4
test esi, esi
je 0x10002e8e
mov eax, dword [esi]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test esi, esi
jne 0x10002eb3
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10002ef1
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push ecx
mov ecx, esi
call fcn.10003120
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.CVolObjectArray.0
call fcn.10002f40
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3

Function at 0x100034d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067c35
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10093948], 0x10
jl 0x10003528
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x1000351a
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x1000353f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10003586
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3
Function at 0x10003590
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100686fd
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x10093948], 0x10
jl 0x100035ec
push 0x1009394c
call fcn.100433c0
mov esi, dword [0x10093944]
add esp, 4
test esi, esi
je 0x100035de
mov eax, dword [esi]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test esi, esi
jne 0x10003603
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1000367f
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolRefObject.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x10003656
mov ecx, edi
call fcn.1001ec50
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x10003662
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3

Function at 0x10003d20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067c35
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10093948], 0x1c
jl 0x10003d78
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x10003d6a
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x10003d8f
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10003deb
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolMem.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x18], 0x40
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3
Function at 0x10003ea0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006888d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10093948], 0x1c
jl 0x10003efb
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x10003eed
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x10003f12
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10003f39
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.10003e00
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3

Function at 0x10004560
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100683ed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10093948], 0xc
jl 0x100045b8
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x100045aa
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x100045cf
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10004605
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3

Function at 0x10004690
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100689a5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10093948], 0xc
jl 0x100046eb
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x100046dd
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x10004702
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000474f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolObject.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3
Function at 0x10005520
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068b45
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
cmp dword [0x1009387c], 0
je 0x1000556e
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.10044d10
mov edi, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
push ebx
call fcn.10044d10
mov byte [ebp - 4], 1
mov ecx, dword [edi + 0xc]
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x100055ad
cmp dword [edi + 0x24], ecx
jne 0x100055a7
mov dword [ebp + 8], 0x1008039f
jmp 0x100055ad
mov ecx, dword [edi + 0x1c]
mov dword [ebp + 8], ecx
mov ebx, dword [eax + 0xc]
test ebx, ebx
jne 0x100055c1
cmp dword [eax + 0x24], ebx
mov ebx, 0x1008039f
je 0x100055c1
mov ebx, dword [eax + 0x1c]
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x100055d5
cmp dword [esi + 0x24], eax
mov eax, 0x10080564
je 0x100055d5
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.InDev
push edi
call esi
push str.UnDev
push edi
mov dword [0x10093890], eax
call esi
push str.fAdd
push edi
mov dword [0x1009388c], eax
call esi
push str.fDel
push edi
mov dword [0x10093888], eax
call esi
push str.fCls
push edi
mov dword [0x10093884], eax
call esi
mov dword [0x10093880], eax
test edi, edi
je 0x10005674
mov ecx, dword [0x10093890]
test ecx, ecx
je 0x10005674
cmp dword [0x1009388c], 0
je 0x10005674
cmp dword [0x10093888], 0
je 0x10005674
cmp dword [0x10093884], 0
je 0x10005674
test eax, eax
je 0x10005674
push dword [ebp + 8]
push ebx
call ecx
test eax, eax
je 0x1000566d
mov dword [0x1009387c], 1
mov esi, 1
jmp 0x10005679
mov esi, 0xffffff37
jmp 0x10005679
mov esi, 0xffffff9b
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.100039d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.100039d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100067e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100683ed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10093948], 0x50
jl 0x10006838
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x1000682a
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x1000684f
push 0x50
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10006874
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.10006ac0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3
Function at 0x10006900
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068ef5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x10093948], 0x50
jl 0x1000695c
push 0x1009394c
call fcn.100433c0
mov esi, dword [0x10093944]
add esp, 4
test esi, esi
je 0x1000694e
mov eax, dword [esi]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test esi, esi
jne 0x10006973
push 0x50
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x100069c0
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.10006ac0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x28]
mov dword [esi], vtable.rg_HuoShanShiChuang_JSONCaoZuo::rg_JSONJiChuLei.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
lea eax, [edi + 0x28]
push eax
call fcn.10034cf0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3

Function at 0x10006d80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069075
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10093948], 0x50
jl 0x10006dd9
push 0x1009394c
call fcn.100433c0
mov esi, dword [0x10093944]
add esp, 4
test esi, esi
je 0x10006dcb
mov eax, dword [esi]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test esi, esi
jne 0x10006df0
push 0x50
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10006e24
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.10006ac0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_HuoShanShiChuang_JSONCaoZuo::rg_JSONShuZuLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3