joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e5e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cd55
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f7ca8], 0x10
jl 0x40e63b
push 0x5f7cac
call fcn.00415da0
mov ecx, dword [0x5f7ca4]
add esp, 4
test ecx, ecx
je 0x40e62d
mov eax, dword [ecx]
mov dword [0x5f7ca4], eax
mov dword [0x5f7cac], 1
test ecx, ecx
jne 0x40e652
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40e6c1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n8::rg_n2314.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n8::rg_n2314.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041de63
int3

Function at 0x40e950
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cd0d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f7ca8], 0x10
jl 0x40e9a8
push 0x5f7cac
call fcn.00415da0
mov ecx, dword [0x5f7ca4]
add esp, 4
test ecx, ecx
je 0x40e99a
mov eax, dword [ecx]
mov dword [0x5f7ca4], eax
mov dword [0x5f7cac], 1
test ecx, ecx
jne 0x40e9bf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40ea0f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n8::rg_n2312.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041de63
int3
Function at 0x40eab0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cd55
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f7ca8], 0x10
jl 0x40eb0b
push 0x5f7cac
call fcn.00415da0
mov ecx, dword [0x5f7ca4]
add esp, 4
test ecx, ecx
je 0x40eafd
mov eax, dword [ecx]
mov dword [0x5f7ca4], eax
mov dword [0x5f7cac], 1
test ecx, ecx
jne 0x40eb22
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40eb91
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n8::rg_n2312.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n8::rg_n2312.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041de63
int3

Function at 0x40ee60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cd0d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f7ca8], 0x10
jl 0x40eeb8
push 0x5f7cac
call fcn.00415da0
mov ecx, dword [0x5f7ca4]
add esp, 4
test ecx, ecx
je 0x40eeaa
mov eax, dword [ecx]
mov dword [0x5f7ca4], eax
mov dword [0x5f7cac], 1
test ecx, ecx
jne 0x40eecf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40ef1d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n8::rg_n2310.0
mov byte [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041de63
int3
Function at 0x40efc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cd55
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f7ca8], 0x10
jl 0x40f01b
push 0x5f7cac
call fcn.00415da0
mov ecx, dword [0x5f7ca4]
add esp, 4
test ecx, ecx
je 0x40f00d
mov eax, dword [ecx]
mov dword [0x5f7ca4], eax
mov dword [0x5f7cac], 1
test ecx, ecx
jne 0x40f032
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40f09d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n8::rg_n2310.0
mov byte [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n8::rg_n2310.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov al, byte [esi + 0xc]
mov byte [ecx + 0xc], al
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041de63
int3

Function at 0x40f6e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ba15
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f7ca8], 0xc
jl 0x40f738
push 0x5f7cac
call fcn.00415da0
mov ecx, dword [0x5f7ca4]
add esp, 4
test ecx, ecx
je 0x40f72a
mov eax, dword [ecx]
mov dword [0x5f7ca4], eax
mov dword [0x5f7cac], 1
test ecx, ecx
jne 0x40f74f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40f78f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041de63
int3
Function at 0x40f7a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42bc6d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f7ca8], 0xc
jl 0x40f7fb
push 0x5f7cac
call fcn.00415da0
mov ecx, dword [0x5f7ca4]
add esp, 4
test ecx, ecx
je 0x40f7ed
mov eax, dword [ecx]
mov dword [0x5f7ca4], eax
mov dword [0x5f7cac], 1
test ecx, ecx
jne 0x40f812
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40f869
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041de63
int3

Function at 0x40fcb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cd0d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f7ca8], 0xc
jl 0x40fd08
push 0x5f7cac
call fcn.00415da0
mov ecx, dword [0x5f7ca4]
add esp, 4
test ecx, ecx
je 0x40fcfa
mov eax, dword [ecx]
mov dword [0x5f7ca4], eax
mov dword [0x5f7cac], 1
test ecx, ecx
jne 0x40fd1f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40fd6f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f7cd0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n8::rg_n6448.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041de63
int3
Function at 0x40fe00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cd55
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f7ca8], 0xc
jl 0x40fe5b
push 0x5f7cac
call fcn.00415da0
mov ecx, dword [0x5f7ca4]
add esp, 4
test ecx, ecx
je 0x40fe4d
mov eax, dword [ecx]
mov dword [0x5f7ca4], eax
mov dword [0x5f7cac], 1
test ecx, ecx
jne 0x40fe72
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40fed9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f7cd0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n8::rg_n6448.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n8::rg_n6448.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041de63
int3

Function at 0x410220
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d185
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f7ca8], 0xc
jl 0x410278
push 0x5f7cac
call fcn.00415da0
mov ecx, dword [0x5f7ca4]
add esp, 4
test ecx, ecx
je 0x41026a
mov eax, dword [ecx]
mov dword [0x5f7ca4], eax
mov dword [0x5f7cac], 1
test ecx, ecx
jne 0x41028f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4102e9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f7cd0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n8::rg_n6448.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n8::rg_n6458.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041de63
int3
Function at 0x410380
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d1dd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f7ca8], 0xc
jl 0x4103db
push 0x5f7cac
call fcn.00415da0
mov ecx, dword [0x5f7ca4]
add esp, 4
test ecx, ecx
je 0x4103cd
mov eax, dword [ecx]
mov dword [0x5f7ca4], eax
mov dword [0x5f7cac], 1
test ecx, ecx
jne 0x4103f2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x410463
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f7cd0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n8::rg_n6448.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n8::rg_n6458.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n8::rg_n6458.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041de63
int3

Function at 0x410830
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42bb5d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f7ca8], 0x390
jl 0x41088b
push 0x5f7cac
call fcn.00415da0
mov ecx, dword [0x5f7ca4]
add esp, 4
test ecx, ecx
je 0x41087d
mov eax, dword [ecx]
mov dword [0x5f7ca4], eax
mov dword [0x5f7cac], 1
test ecx, ecx
jne 0x4108a5
push 0x390
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4108ca
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00410b90
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041de63
int3
Function at 0x410960
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d325
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x5f7ca8], 0x390
jl 0x4109c0
push 0x5f7cac
call fcn.00415da0
mov edi, dword [0x5f7ca4]
add esp, 4
test edi, edi
je 0x4109b2
mov eax, dword [edi]
mov dword [0x5f7ca4], eax
mov dword [0x5f7cac], 1
test edi, edi
jne 0x4109da
push 0x390
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x410a31
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.00410b90
mov byte [ebp - 4], 1
lea ecx, [edi + 0xc]
mov dword [edi], vtable.rg_n::rg_n1.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [edi + 0xc]
call dword [eax + 0x44]
lea eax, [ebx + 0xc]
push eax
lea ecx, [edi + 0xc]
call fcn.0040b740
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041de63
int3
Function at 0x411200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ba15
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f7ca8], 0xc
jl 0x411258
push 0x5f7cac
call fcn.00415da0
mov ecx, dword [0x5f7ca4]
add esp, 4
test ecx, ecx
je 0x41124a
mov eax, dword [ecx]
mov dword [0x5f7ca4], eax
mov dword [0x5f7cac], 1
test ecx, ecx
jne 0x41126f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4112b5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f7cd0], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041de63
int3
Function at 0x412c50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42bb5d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f7ca8], 0x28
jl 0x412ca8
push 0x5f7cac
call fcn.00415da0
mov ecx, dword [0x5f7ca4]
add esp, 4
test ecx, ecx
je 0x412c9a
mov eax, dword [ecx]
mov dword [0x5f7ca4], eax
mov dword [0x5f7cac], 1
test ecx, ecx
jne 0x412cbf
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x412ce5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push ecx
call fcn.00412ff0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041de63
int3

Function at 0x412dc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d8c5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5f7ca8], 0x28
jl 0x412e1c
push 0x5f7cac
call fcn.00415da0
mov esi, dword [0x5f7ca4]
add esp, 4
test esi, esi
je 0x412e0e
mov eax, dword [esi]
mov dword [0x5f7ca4], eax
mov dword [0x5f7cac], 1
test esi, esi
jne 0x412e33
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x412e71
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push ecx
mov ecx, esi
call fcn.00412ff0
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.CVolObjectArray.0
call fcn.00412f60
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041de63
int3

Function at 0x413350
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42bc6d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f7ca8], 0xc
jl 0x4133ab
push 0x5f7cac
call fcn.00415da0
mov ecx, dword [0x5f7ca4]
add esp, 4
test ecx, ecx
je 0x41339d
mov eax, dword [ecx]
mov dword [0x5f7ca4], eax
mov dword [0x5f7cac], 1
test ecx, ecx
jne 0x4133c2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41341f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f7cd0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolUserApp.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041de63
int3
Function at 0x413720
Capabilities:
Get system information on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42db9b
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push esi
mov eax, dword [0x5f600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x400000
mov dword [0x5f7c90], 0x435a64
mov dword [0x5f7c98], 0x435bb4
push 0
mov dword [ebp - 0x14], 0x5f7c90
mov dword [0x5f7cac], 1
mov dword [0x5f7ca8], 0x100
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4139ce
lea eax, [ecx + 0x400000]
mov dword [0x5f7ca4], ecx
mov dword [0x5f7ca0], eax
mov edx, 0x1555
mov eax, dword [0x5f7ca8]
mov dword [0x5f7c9c], ecx
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x5f7ca8]
add ecx, eax
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x5f7ca8]
add ecx, eax
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x5f7ca8]
add ecx, eax
sub edx, 1
jne 0x4137b4
mov dword [ecx], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0x5f7cb0
mov dword [ebp - 0x18], 0x5f7cb0
mov dword [ebp - 0x1c], 0x5f7cb0
mov dword [0x5f7cb0], 0x434f94
mov dword [0x5f7cb4], edx
mov dword [0x5f7cb8], edx
mov byte [ebp - 4], 1
mov dword [0x5f7cb0], 0x434f30
mov dword [0x5f7cbc], edx
mov dword [0x5f7cc4], edx
mov dword [0x5f7cc0], edx
mov dword [0x5f7cc8], 0x40
mov byte [ebp - 4], 2
mov dword [0x5f7cc8], 0x80
mov byte [ebp - 4], 5
mov dword [0x5f7ccc], edx
mov byte [ebp - 4], 6
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x5f7ce0
mov dword [ebp - 0x20], 0x5f7ce0
call esi
mov byte [ebp - 4], 7
mov dword [0x5f7cf8], 0
mov byte [ebp - 4], 8
push 0x5f7d04
mov dword [ebp - 0x24], 0x5f7d04
call esi
mov byte [ebp - 4], 9
mov dword [0x5f7d1c], 0x3e8
mov dword [ebp - 0x28], 0x5f7d30
mov dword [ebp - 0x2c], 0x5f7d30
mov dword [0x5f7d30], 0x434f94
mov dword [0x5f7d34], 0
mov dword [0x5f7d38], 0
mov byte [ebp - 4], 0xa
mov dword [0x5f7d30], 0x434f30
mov dword [0x5f7d3c], 0
mov dword [0x5f7d44], 0
mov dword [0x5f7d40], 0
mov dword [0x5f7d48], 0x40
mov byte [ebp - 4], 0xb
mov dword [0x5f7d48], 0x80
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x3c]
mov dword [0x5f7d24], 0x3e80
mov dword [0x5f7d28], 1
mov dword [0x5f7d2c], 0
lea eax, [eax*2 + 2]
mov dword [0x5f7d20], eax
mov byte [ebp - 4], 0xe
push 0x5f7d4c
call esi
mov byte [ebp - 4], 0xf
push ecx
mov ecx, 0x5f7d64
call fcn.00412ff0
mov byte [ebp - 4], 0x10
mov dword [0x5f7cd0], 0
mov dword [0x5f7d8c], 0
movsd xmm0, qword [0x5f06f0]
movsd qword [0x5f7cd8], xmm0
xorps xmm0, xmm0
mov dword [0x5f7d90], 0
mov dword [0x5f7d94], 0
mov dword [0x5f7d98], 0
mov dword [0x5f7cd4], 0
movq qword [0x5f7cfc], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, 0x5f7c90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041de63
int3