joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404a30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f33d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f3978], 0x10
jl 0x404a88
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x404a7a
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x404a9f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x404aed
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2544.0
mov byte [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3

Function at 0x404b80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f385
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f3978], 0x10
jl 0x404bdb
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x404bcd
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x404bf2
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x404c5d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2544.0
mov byte [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2544.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov al, byte [esi + 0xc]
mov byte [ecx + 0xc], al
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3
Function at 0x405450
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f6ad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f3978], 0x10
jl 0x4054a8
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x40549a
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x4054bf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4054e4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.004075e0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3

Function at 0x4054f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f6e5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5f3978], 0x10
jl 0x40554c
push 0x5f397c
call fcn.00413df0
mov esi, dword [0x5f3974]
add esp, 4
test esi, esi
je 0x40553e
mov eax, dword [esi]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test esi, esi
jne 0x405563
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4055c1
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.004075e0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolMemoryInputStream.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x405598
mov ecx, edi
call fcn.0040f3d0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4055a4
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3
Function at 0x405960
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f805
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f3978], 0x10
jl 0x4059b8
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x4059aa
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x4059cf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x405a2a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseStream.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.CVolBaseInputStream.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3

Function at 0x405a40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f85d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5f3978], 0x10
jl 0x405a9c
push 0x5f397c
call fcn.00413df0
mov esi, dword [0x5f3974]
add esp, 4
test esi, esi
je 0x405a8e
mov eax, dword [esi]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test esi, esi
jne 0x405ab7
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x405b47
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolBaseStream.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.CVolBaseInputStream.0
mov byte [ebp - 4], 4
mov dword [esi], vtable.CVolBaseInputStream.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x405b1e
mov ecx, edi
call fcn.0040f3d0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x405b2a
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3
Function at 0x405f00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f96d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f3978], 0x10
jl 0x405f58
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x405f4a
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x405f6f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x405fc0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseStream.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3

Function at 0x405fd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f9b5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5f3978], 0x10
jl 0x40602c
push 0x5f397c
call fcn.00413df0
mov esi, dword [0x5f3974]
add esp, 4
test esi, esi
je 0x40601e
mov eax, dword [esi]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test esi, esi
jne 0x406047
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4060cd
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolBaseStream.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.CVolBaseStream.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4060a4
mov ecx, edi
call fcn.0040f3d0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4060b0
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3
Function at 0x406e70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57fc55
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f3978], 0x1c
jl 0x406ec8
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x406eba
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x406edf
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x406f3b
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolMem.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x18], 0x40
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3

Function at 0x406ff0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57fccd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f3978], 0x1c
jl 0x40704b
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x40703d
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x407062
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x407089
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.00406f50
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3
Function at 0x4075e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57fde8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov dword [esi], vtable.CVolBaseStream.0
mov dword [ebp - 4], 2
mov dword [esi], vtable.CVolBaseInputStream.0
mov dword [ebp - 4], 3
mov dword [esi], vtable.CVolMemoryInputStream.0
cmp dword [0x5f3978], 0x44
jl 0x40768f
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x407681
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x4076aa
push 0x44
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40777f
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 4
mov dword [ecx], vtable.CRefObject.0
mov dword [ecx + 4], 1
mov byte [ebp - 4], 5
mov dword [ecx], vtable.CVBaseStream.0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 6
mov dword [ecx + 0xc], 0
mov dword [ecx], vtable.CVBaseInputStream.0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 7
lea eax, [ecx + 0x28]
mov dword [ecx], vtable.CVMemoryInputStream.0
mov dword [ebp - 0x18], eax
mov dword [eax], vtable.CVolObject.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 8
mov dword [eax], vtable.CVolMem.0
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x18], 0x40
mov byte [ebp - 4], 9
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x20], 0
mov byte [ebp - 4], 3
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3

Function at 0x407810
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57fc55
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f3978], 0xc
jl 0x407868
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x40785a
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x40787f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4078bf
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3
Function at 0x4078d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57fe2d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f3978], 0xc
jl 0x40792b
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x40791d
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x407942
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x407999
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3

Function at 0x407d50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57fc55
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f3978], 0x10
jl 0x407da8
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x407d9a
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x407dbf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x407e06
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3
Function at 0x407e10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ff0d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5f3978], 0x10
jl 0x407e6c
push 0x5f397c
call fcn.00413df0
mov esi, dword [0x5f3974]
add esp, 4
test esi, esi
je 0x407e5e
mov eax, dword [esi]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test esi, esi
jne 0x407e83
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x407eff
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolRefObject.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x407ed6
mov ecx, edi
call fcn.0040f3d0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x407ee2
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3

Function at 0x408320
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f6ad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f3978], 0xc
jl 0x408378
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x40836a
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x40838f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4083c5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3
Function at 0x408450
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ffe5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f3978], 0xc
jl 0x4084ab
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x40849d
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x4084c2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40850f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolObject.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3

Function at 0x408af0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f33d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ea000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f3978], 0xc
jl 0x408b48
push 0x5f397c
call fcn.00413df0
mov ecx, dword [0x5f3974]
add esp, 4
test ecx, ecx
je 0x408b3a
mov eax, dword [ecx]
mov dword [0x5f3974], eax
mov dword [0x5f397c], 1
test ecx, ecx
jne 0x408b5f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x408baf
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f39a0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7792.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056733b
int3