joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a0f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002c285
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1003e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolMem.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0x40
mov dword [ebp - 4], 1
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
sub eax, edx
mov dword [esi], vtable.CVolMem.0
mov dword [ebp - 0x10], edx
cmp eax, 4
jl 0x1000a189
mov eax, dword [ebp + 8]
mov dword [ecx + edx], eax
add dword [esi + 0x14], 4
jmp 0x1000a213
lea edi, [edx + 4]
cmp edi, edx
je 0x1000a20a
test edi, edi
jne 0x1000a1bc
test ecx, ecx
je 0x1000a1a3
push ecx
mov ecx, 0x1003ff58
call fcn.10014ea0
mov dword [esi + 0xc], 0
xor ecx, ecx
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
jmp 0x1000a20a
test ecx, ecx
jne 0x1000a1cc
push edi
mov ecx, esi
call fcn.100144d0
mov ecx, eax
jmp 0x1000a20a
mov ebx, dword [esi + 0x18]
mov eax, 0x40
test ebx, ebx
cmovle ebx, eax
mov eax, dword [esi + 0x10]
cmp eax, edi
jl 0x1000a1e6
sub eax, edi
cmp eax, ebx
jle 0x1000a207
mov eax, edi
cdq
idiv ebx
sub ebx, edx
add ebx, edi
push ebx
push ecx
mov ecx, 0x1003ff58
call fcn.10014e10
mov ecx, eax
test ecx, ecx
je 0x1000a230
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], edi
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [ecx + edx], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xffffffffffffffff
call fcn.1001e26a
int3

Function at 0x1000a440
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b37d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1003e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1003ff68], 0x10
jl 0x1000a498
push 0x1003ff6c
call fcn.10014cd0
mov ecx, dword [0x1003ff64]
add esp, 4
test ecx, ecx
je 0x1000a48a
mov eax, dword [ecx]
mov dword [0x1003ff64], eax
mov dword [0x1003ff6c], 1
test ecx, ecx
jne 0x1000a4af
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000a500
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2550.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1001e26a
int3
Function at 0x1000a590
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b3c5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1003e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1003ff68], 0x10
jl 0x1000a5eb
push 0x1003ff6c
call fcn.10014cd0
mov ecx, dword [0x1003ff64]
add esp, 4
test ecx, ecx
je 0x1000a5dd
mov eax, dword [ecx]
mov dword [0x1003ff64], eax
mov dword [0x1003ff6c], 1
test ecx, ecx
jne 0x1000a602
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000a670
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2550.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2550.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1001e26a
int3

Function at 0x1000a940
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b37d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1003e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1003ff68], 0x18
jl 0x1000a998
push 0x1003ff6c
call fcn.10014cd0
mov ecx, dword [0x1003ff64]
add esp, 4
test ecx, ecx
je 0x1000a98a
mov eax, dword [ecx]
mov dword [0x1003ff64], eax
mov dword [0x1003ff6c], 1
test ecx, ecx
jne 0x1000a9af
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000aa07
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2554.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1001e26a
int3
Function at 0x1000aaa0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b3c5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1003e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1003ff68], 0x18
jl 0x1000aafb
push 0x1003ff6c
call fcn.10014cd0
mov ecx, dword [0x1003ff64]
add esp, 4
test ecx, ecx
je 0x1000aaed
mov eax, dword [ecx]
mov dword [0x1003ff64], eax
mov dword [0x1003ff6c], 1
test ecx, ecx
jne 0x1000ab12
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000ab8d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2554.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2554.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1001e26a
int3

Function at 0x1000ae40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b37d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1003e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1003ff68], 0x18
jl 0x1000ae98
push 0x1003ff6c
call fcn.10014cd0
mov ecx, dword [0x1003ff64]
add esp, 4
test ecx, ecx
je 0x1000ae8a
mov eax, dword [ecx]
mov dword [0x1003ff64], eax
mov dword [0x1003ff6c], 1
test ecx, ecx
jne 0x1000aeaf
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000af01
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_n1::rg_n2558.0
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1001e26a
int3
Function at 0x1000afc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b3c5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1003e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1003ff68], 0x18
jl 0x1000b01b
push 0x1003ff6c
call fcn.10014cd0
mov ecx, dword [0x1003ff64]
add esp, 4
test ecx, ecx
je 0x1000b00d
mov eax, dword [ecx]
mov dword [0x1003ff64], eax
mov dword [0x1003ff6c], 1
test ecx, ecx
jne 0x1000b032
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000b0a5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_n1::rg_n2558.0
movsd qword [ecx + 0x10], xmm0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2558.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
movsd xmm0, qword [esi + 0x10]
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1001e26a
int3

Function at 0x1000b3a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b37d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1003e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1003ff68], 0x10
jl 0x1000b3f8
push 0x1003ff6c
call fcn.10014cd0
mov ecx, dword [0x1003ff64]
add esp, 4
test ecx, ecx
je 0x1000b3ea
mov eax, dword [ecx]
mov dword [0x1003ff64], eax
mov dword [0x1003ff6c], 1
test ecx, ecx
jne 0x1000b40f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000b460
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2560.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1001e26a
int3
Function at 0x1000b4f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b3c5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1003e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1003ff68], 0x10
jl 0x1000b54b
push 0x1003ff6c
call fcn.10014cd0
mov ecx, dword [0x1003ff64]
add esp, 4
test ecx, ecx
je 0x1000b53d
mov eax, dword [ecx]
mov dword [0x1003ff64], eax
mov dword [0x1003ff6c], 1
test ecx, ecx
jne 0x1000b562
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000b5d0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2560.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2560.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1001e26a
int3

Function at 0x1000b810
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b37d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1003e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1003ff68], 0x10
jl 0x1000b868
push 0x1003ff6c
call fcn.10014cd0
mov ecx, dword [0x1003ff64]
add esp, 4
test ecx, ecx
je 0x1000b85a
mov eax, dword [ecx]
mov dword [0x1003ff64], eax
mov dword [0x1003ff6c], 1
test ecx, ecx
jne 0x1000b87f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000b8d0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2556.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1001e26a
int3
Function at 0x1000b980
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b3c5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1003e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1003ff68], 0x10
jl 0x1000b9db
push 0x1003ff6c
call fcn.10014cd0
mov ecx, dword [0x1003ff64]
add esp, 4
test ecx, ecx
je 0x1000b9cd
mov eax, dword [ecx]
mov dword [0x1003ff64], eax
mov dword [0x1003ff6c], 1
test ecx, ecx
jne 0x1000b9f2
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000ba60
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2556.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2556.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1001e26a
int3

Function at 0x1000bd50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b37d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1003e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1003ff68], 0x10
jl 0x1000bda8
push 0x1003ff6c
call fcn.10014cd0
mov ecx, dword [0x1003ff64]
add esp, 4
test ecx, ecx
je 0x1000bd9a
mov eax, dword [ecx]
mov dword [0x1003ff64], eax
mov dword [0x1003ff6c], 1
test ecx, ecx
jne 0x1000bdbf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000be10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2552.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1001e26a
int3
Function at 0x1000bea0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b3c5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1003e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1003ff68], 0x10
jl 0x1000befb
push 0x1003ff6c
call fcn.10014cd0
mov ecx, dword [0x1003ff64]
add esp, 4
test ecx, ecx
je 0x1000beed
mov eax, dword [ecx]
mov dword [0x1003ff64], eax
mov dword [0x1003ff6c], 1
test ecx, ecx
jne 0x1000bf12
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000bf80
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2552.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2552.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1001e26a
int3

Function at 0x1000c1c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b37d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1003e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1003ff68], 0x10
jl 0x1000c218
push 0x1003ff6c
call fcn.10014cd0
mov ecx, dword [0x1003ff64]
add esp, 4
test ecx, ecx
je 0x1000c20a
mov eax, dword [ecx]
mov dword [0x1003ff64], eax
mov dword [0x1003ff6c], 1
test ecx, ecx
jne 0x1000c22f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000c27f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2548.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1001e26a
int3
Function at 0x1000c320
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b3c5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1003e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1003ff68], 0x10
jl 0x1000c37b
push 0x1003ff6c
call fcn.10014cd0
mov ecx, dword [0x1003ff64]
add esp, 4
test ecx, ecx
je 0x1000c36d
mov eax, dword [ecx]
mov dword [0x1003ff64], eax
mov dword [0x1003ff6c], 1
test ecx, ecx
jne 0x1000c392
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000c401
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2548.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2548.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1001e26a
int3

Function at 0x1000c690
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b37d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1003e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1003ff68], 0x10
jl 0x1000c6e8
push 0x1003ff6c
call fcn.10014cd0
mov ecx, dword [0x1003ff64]
add esp, 4
test ecx, ecx
je 0x1000c6da
mov eax, dword [ecx]
mov dword [0x1003ff64], eax
mov dword [0x1003ff6c], 1
test ecx, ecx
jne 0x1000c6ff
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000c74f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2546.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1001e26a
int3
Function at 0x1000c7f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b3c5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1003e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1003ff68], 0x10
jl 0x1000c84b
push 0x1003ff6c
call fcn.10014cd0
mov ecx, dword [0x1003ff64]
add esp, 4
test ecx, ecx
je 0x1000c83d
mov eax, dword [ecx]
mov dword [0x1003ff64], eax
mov dword [0x1003ff6c], 1
test ecx, ecx
jne 0x1000c862
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000c8d1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2546.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2546.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1001e26a
int3

Function at 0x1000cba0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b37d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1003e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1003ff68], 0x10
jl 0x1000cbf8
push 0x1003ff6c
call fcn.10014cd0
mov ecx, dword [0x1003ff64]
add esp, 4
test ecx, ecx
je 0x1000cbea
mov eax, dword [ecx]
mov dword [0x1003ff64], eax
mov dword [0x1003ff6c], 1
test ecx, ecx
jne 0x1000cc0f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000cc5d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2544.0
mov byte [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1001e26a
int3