joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461450
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46159a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004609cc
xor eax, eax
push ebp
push 0x46157d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x4614b5
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4614b5
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x461567
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4614c8
call fcn.00403c9c
jmp 0x461584
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x461567
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x461567
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403660
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x461567
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040d744
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4615b4
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x46ba08]
mov dl, 1
mov eax, dword [0x45f834]
call fcn.0040e068
call fcn.00403bf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461584
mov eax, dword [ebp - 4]
call fcn.004609d8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4615a1
lea eax, [ebp - 0x28]
call fcn.00404238
ret
Function at 0x1000134b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x1000135e
xor eax, eax
jmp 0x10001401
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, 8
imul eax, edx, 0
ret 0x8b00
dec ebp
hlt
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
jmp 0x1000139d
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x18]
jae 0x100013ff
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.100014bb
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x100013fd
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
jmp 0x10001394
xor eax, eax

Function at 0x10002840
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100238bb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1003406c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x30], 0
mov byte [esi + 0x34], 0
call fcn.10002fb0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000b190
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1003406c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
push edi
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.10002900
mov ecx, eax
call fcn.1000b4b0
call fcn.10002900
mov dword [eax], 7
call fcn.10002900
mov esi, eax
mov dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push 0x10002af0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x1000b211
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10002900
mov edx, eax
xor ecx, ecx
cmp dword [edx + 0x2c], ecx
jbe 0x1000b23b
nop
mov eax, dword [edx + 0x24]
mov esi, dword [edx + 0x20]
sub eax, esi
sar eax, 2
cmp eax, ecx
jbe 0x1000b254
mov al, byte [esi + ecx*4]
mov byte [ecx + edi], al
inc ecx
cmp ecx, dword [edx + 0x2c]
jb 0x1000b220
cmp dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
pop edi
pop esi
call fcn.1000c5be
mov esp, ebp
pop ebp
ret 0x10
push str.invalid_vector_T__subscript
call fcn.1000bd0f
int3

Function at 0x1000b260
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1003406c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.10002900
mov ecx, eax
call fcn.1000b4b0
call fcn.10002900
mov dword [eax], 8
call fcn.10002900
mov esi, eax
mov dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push 0x10002af0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x1000b2df
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 8], eax
pop esi
sete al
xor ecx, ebp
call fcn.1000c5be
mov esp, ebp
pop ebp
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40de38
nop
mov ecx, 0x6d56000a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x7f133c3d
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4035a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e420
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x441ff8], 0x2c
jl 0x4035f8
push 0x441ffc
call fcn.00413870
mov edx, dword [0x441ff4]
add esp, 4
test edx, edx
je 0x4035ea
mov eax, dword [edx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test edx, edx
jne 0x40360f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x403642
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.00404a60
mov byte [ebp - 4], 1
mov dword [edx], vtable.CWConstString.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3

Function at 0x403650
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e458
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x441ff8], 0x2c
jl 0x4036ad
push 0x441ffc
call fcn.00413870
mov esi, dword [0x441ff4]
add esp, 4
test esi, esi
je 0x40369f
mov eax, dword [esi]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test esi, esi
jne 0x4036c8
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40374f
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00404a60
mov byte [ebp - 4], 1
mov dword [esi], vtable.CWConstString.0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CWConstString.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x10]
cmp eax, vtable.CVolMem.0
jne 0x403756
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov ecx, dword [edi + 0x24]
test ecx, ecx
jne 0x403720
xor eax, eax
jmp 0x403723
mov eax, dword [edi + 0x1c]
push ecx
push eax
lea ecx, [esi + 0x10]
mov dword [esi + 0x24], 0
call fcn.004132a0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
lea ecx, [esi + 0x10]
call dword [eax + 0x44]
jmp 0x403709
Function at 0x403d00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e578
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x441ff8], 0x2c
jl 0x403d58
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x403d4a
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x403d6f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x403d94
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00404a60
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3

Function at 0x403e50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e5d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x441ff8], 0x2c
jl 0x403eab
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x403e9d
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x403ec2
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x403ee9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.00403da0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3

Function at 0x404410
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e6c0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x441ff8], 0x1c
jl 0x404468
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x40445a
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x40447f
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4044db
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolMem.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x18], 0x40
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3
Function at 0x4045b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e5d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x441ff8], 0x1c
jl 0x40460b
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x4045fd
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x404622
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x404649
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.004044f0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3

Function at 0x404ba0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e578
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x441ff8], 0xc
jl 0x404bf8
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x404bea
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x404c0f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x404c45
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3

Function at 0x404cd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e830
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x441ff8], 0xc
jl 0x404d2b
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x404d1d
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x404d42
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x404d8f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolObject.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3
Function at 0x405780
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ea88
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x441ff8], 0x10
jl 0x4057d8
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x4057ca
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x4057ef
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x405840
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2533.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3

Function at 0x4058d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ead0
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x441ff8], 0x10
jl 0x40592b
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x40591d
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x405942
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4059b0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2533.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2533.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3
Function at 0x405ce0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ea88
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x441ff8], 0x10
jl 0x405d38
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x405d2a
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x405d4f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x405da0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2523.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3

Function at 0x405e30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ead0
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x441ff8], 0x10
jl 0x405e8b
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x405e7d
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x405ea2
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x405f10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2523.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2523.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3
Function at 0x406170
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ea88
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x441ff8], 0x18
jl 0x4061c8
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x4061ba
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x4061df
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x406237
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2527.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3

Function at 0x4062d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ead0
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x441ff8], 0x18
jl 0x40632b
push 0x441ffc
call fcn.00413870
mov ecx, dword [0x441ff4]
add esp, 4
test ecx, ecx
je 0x40631d
mov eax, dword [ecx]
mov dword [0x441ff4], eax
mov dword [0x441ffc], 1
test ecx, ecx
jne 0x406342
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4063bd
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2527.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2527.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0041f2f3
int3