joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016820
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015d845
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10254178], 0x10
jl 0x1001687b
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1001686d
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x10016892
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10016901
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_DuanZhengShuLei.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_DuanZhengShuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x10016b90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015d7fd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0x10
jl 0x10016be8
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x10016bda
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x10016bff
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10016c4d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_ZiJieLei.0
mov byte [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x10016ce0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015d845
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10254178], 0x10
jl 0x10016d3b
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x10016d2d
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x10016d52
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10016dbd
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_ZiJieLei.0
mov byte [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_ZiJieLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov al, byte [esi + 0xc]
mov byte [ecx + 0xc], al
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x10017430
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159c55
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0xc
jl 0x10017488
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1001747a
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x1001749f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100174df
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x100174f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159c9d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10254178], 0xc
jl 0x1001754b
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1001753d
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x10017562
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100175b9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x100178e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015aeb5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0x10
jl 0x10017939
push 0x1025417c
call fcn.10031980
mov esi, dword [0x10254174]
add esp, 4
test esi, esi
je 0x1001792b
mov eax, dword [esi]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test esi, esi
jne 0x10017950
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10017998
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [esi], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPXianChengChiLei.0
call fcn.10017c70
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x10017a20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015db4d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x10254178], 0x10
jl 0x10017a7c
push 0x1025417c
call fcn.10031980
mov esi, dword [0x10254174]
add esp, 4
test esi, esi
je 0x10017a6e
mov eax, dword [esi]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test esi, esi
jne 0x10017a93
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10017b0f
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [esi], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPXianChengChiLei.0
call fcn.10017c70
mov byte [ebp - 4], 2
mov dword [esi], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPXianChengChiLei.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x10017ae6
mov ecx, edi
call fcn.10018300
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x10017af2
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x10017c70
Capabilities:
Access peb ldr_data
Get ntdll base address
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015dc08
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
cmp dword [0x10254178], 0xc
jl 0x10017ccf
push 0x1025417c
call fcn.10031980
mov esi, dword [0x10254174]
add esp, 4
test esi, esi
je 0x10017cc1
mov eax, dword [esi]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test esi, esi
jne 0x10017cea
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10017df2
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CRefObject.0
mov dword [esi + 4], 1
mov byte [ebp - 4], 1
push 0x60
mov dword [esi], vtable.CRefObjectWithData_class_CHPSocketThreadPoolWraper_.0
call fcn.10135525
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 2
mov dword [edi], vtable.IHPThreadPool.0
mov byte [ebp - 4], 3
push 0
push 1
push 1
push 0
mov dword [edi], vtable.CHPThreadPool.0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 4], eax
test eax, eax
je 0x10017df9
mov byte [ebp - 4], 4
lea eax, [edi + 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [eax], vtable.ATL::CThreadPool_class_CHPThreadPool::CWorker__class_ATL::CRTThreadTraits__class_ATL::Win32WaitTraits_.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov byte [ebp - 4], 5
xorps xmm0, xmm0
mov dword [eax + 0x10], 0
movups xmmword [eax + 0x14], xmm0
movq qword [eax + 0x24], xmm0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0x8ca0
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x40], 0
mov byte [ebp - 4], 6
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x18], 3
mov byte [ebp - 4], 1
mov dword [esi + 8], edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
push 0x80004005
call fcn.1001f800
int3
Function at 0x10018430
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159c55
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0xc
jl 0x10018488
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1001847a
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x1001849f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100184df
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPTongXinJiChuLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x10018570
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159c9d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10254178], 0xc
jl 0x100185cb
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x100185bd
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x100185e2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10018639
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPTongXinJiChuLei.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPTongXinJiChuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x10018820
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015d7fd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0xc
jl 0x10018878
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1001886a
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x1001888f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100188d9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPTongXinJiChuLei.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPTCPDaiLiJiChuLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x10018970
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015d845
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10254178], 0xc
jl 0x100189cb
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x100189bd
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x100189e2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10018a43
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPTongXinJiChuLei.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPTCPDaiLiJiChuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPTCPDaiLiJiChuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x10018cb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015d7fd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0xc
jl 0x10018d08
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x10018cfa
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x10018d1f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10018d69
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPTongXinJiChuLei.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPTCPFuWuQiJiChuLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x10018e00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015d845
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10254178], 0xc
jl 0x10018e5b
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x10018e4d
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x10018e72
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10018ed3
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPTongXinJiChuLei.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPTCPFuWuQiJiChuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPTCPFuWuQiJiChuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x100190f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159d9d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0x84
jl 0x1001914b
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1001913d
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x10019165
push 0x84
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001918a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.1001a5e0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x10019220
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015ddf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x10254178], 0x84
jl 0x1001927f
push 0x1025417c
call fcn.10031980
mov esi, dword [0x10254174]
add esp, 4
test esi, esi
je 0x10019271
mov eax, dword [esi]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test esi, esi
jne 0x10019299
push 0x84
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x100192fe
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.1001a5e0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HP_TCPDaiLiLei.1.0
mov dword [esi + 0xc], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HP_TCPDaiLiLei.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0x10]
test edi, edi
je 0x100192d5
mov ecx, edi
call fcn.10018300
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x100192e1
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0x10], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x10019b50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159d9d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0x84
jl 0x10019bab
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x10019b9d
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x10019bc5
push 0x84
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10019bea
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.1001a050
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x10019c80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015df65
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x10254178], 0x84
jl 0x10019cdf
push 0x1025417c
call fcn.10031980
mov esi, dword [0x10254174]
add esp, 4
test esi, esi
je 0x10019cd1
mov eax, dword [esi]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test esi, esi
jne 0x10019cf9
push 0x84
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10019d5e
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.1001a050
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HP_TCPFuWuQi.1.0
mov dword [esi + 0xc], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HP_TCPFuWuQi.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0x10]
test edi, edi
je 0x10019d35
mov ecx, edi
call fcn.10018300
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x10019d41
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0x10], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3