joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c8d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4471d5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x469a48], 0xc
jl 0x40c928
push 0x469a4c
call fcn.00422070
mov ecx, dword [0x469a44]
add esp, 4
test ecx, ecx
je 0x40c91a
mov eax, dword [ecx]
mov dword [0x469a44], eax
mov dword [0x469a4c], 1
test ecx, ecx
jne 0x40c93f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40c97f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00435af1
int3

Function at 0x40c990
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44721d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x469a48], 0xc
jl 0x40c9eb
push 0x469a4c
call fcn.00422070
mov ecx, dword [0x469a44]
add esp, 4
test ecx, ecx
je 0x40c9dd
mov eax, dword [ecx]
mov dword [0x469a44], eax
mov dword [0x469a4c], 1
test ecx, ecx
jne 0x40ca02
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40ca59
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00435af1
int3
Function at 0x40cd50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448d1d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x469a48], 0x14
jl 0x40cda8
push 0x469a4c
call fcn.00422070
mov ecx, dword [0x469a44]
add esp, 4
test ecx, ecx
je 0x40cd9a
mov eax, dword [ecx]
mov dword [0x469a44], eax
mov dword [0x469a4c], 1
test ecx, ecx
jne 0x40cdbf
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40ce17
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_volcano_base::rg_KuoZhanDuiXiangLei.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_CheCunLei.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00435af1
int3

Function at 0x40ceb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448d65
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x469a48], 0x14
jl 0x40cf0b
push 0x469a4c
call fcn.00422070
mov ecx, dword [0x469a44]
add esp, 4
test ecx, ecx
je 0x40cefd
mov eax, dword [ecx]
mov dword [0x469a44], eax
mov dword [0x469a4c], 1
test ecx, ecx
jne 0x40cf22
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40cf9d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_volcano_base::rg_KuoZhanDuiXiangLei.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_CheCunLei.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_CheCunLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x10], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00435af1
int3
Function at 0x40d1b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448d1d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x469a48], 0x14
jl 0x40d208
push 0x469a4c
call fcn.00422070
mov ecx, dword [0x469a44]
add esp, 4
test ecx, ecx
je 0x40d1fa
mov eax, dword [ecx]
mov dword [0x469a44], eax
mov dword [0x469a4c], 1
test ecx, ecx
jne 0x40d21f
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40d277
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_volcano_base::rg_KuoZhanDuiXiangLei.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_WeiZhiLei.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00435af1
int3

Function at 0x40d310
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448d65
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x469a48], 0x14
jl 0x40d36b
push 0x469a4c
call fcn.00422070
mov ecx, dword [0x469a44]
add esp, 4
test ecx, ecx
je 0x40d35d
mov eax, dword [ecx]
mov dword [0x469a44], eax
mov dword [0x469a4c], 1
test ecx, ecx
jne 0x40d382
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40d3fd
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_volcano_base::rg_KuoZhanDuiXiangLei.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_WeiZhiLei.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_WeiZhiLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x10], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00435af1
int3
Function at 0x40e010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448d1d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x469a48], 0xc
jl 0x40e068
push 0x469a4c
call fcn.00422070
mov ecx, dword [0x469a44]
add esp, 4
test ecx, ecx
je 0x40e05a
mov eax, dword [ecx]
mov dword [0x469a44], eax
mov dword [0x469a4c], 1
test ecx, ecx
jne 0x40e07f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40e0cf
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x469a70], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ChengXuLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00435af1
int3

Function at 0x40e160
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448d65
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x469a48], 0xc
jl 0x40e1bb
push 0x469a4c
call fcn.00422070
mov ecx, dword [0x469a44]
add esp, 4
test ecx, ecx
je 0x40e1ad
mov eax, dword [ecx]
mov dword [0x469a44], eax
mov dword [0x469a4c], 1
test ecx, ecx
jne 0x40e1d2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40e239
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x469a70], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ChengXuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_ChengXuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00435af1
int3
Function at 0x40e540
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449385
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x469a48], 0xc
jl 0x40e598
push 0x469a4c
call fcn.00422070
mov ecx, dword [0x469a44]
add esp, 4
test ecx, ecx
je 0x40e58a
mov eax, dword [ecx]
mov dword [0x469a44], eax
mov dword [0x469a4c], 1
test ecx, ecx
jne 0x40e5af
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40e609
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x469a70], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ChengXuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_ChuangKouChengXuLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00435af1
int3

Function at 0x40e6a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4493dd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x469a48], 0xc
jl 0x40e6fb
push 0x469a4c
call fcn.00422070
mov ecx, dword [0x469a44]
add esp, 4
test ecx, ecx
je 0x40e6ed
mov eax, dword [ecx]
mov dword [0x469a44], eax
mov dword [0x469a4c], 1
test ecx, ecx
jne 0x40e712
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40e783
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x469a70], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_ChengXuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_volcano_base::rg_ChuangKouChengXuLei.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_volcano_base::rg_ChuangKouChengXuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00435af1
int3
Function at 0x40eb10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4476dd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x469a48], 0x53c
jl 0x40eb6b
push 0x469a4c
call fcn.00422070
mov ecx, dword [0x469a44]
add esp, 4
test ecx, ecx
je 0x40eb5d
mov eax, dword [ecx]
mov dword [0x469a44], eax
mov dword [0x469a4c], 1
test ecx, ecx
jne 0x40eb85
push 0x53c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40ebaa
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040ee50
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00435af1
int3

Function at 0x40ec40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449525
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x469a48], 0x53c
jl 0x40ec9f
push 0x469a4c
call fcn.00422070
mov esi, dword [0x469a44]
add esp, 4
test esi, esi
je 0x40ec91
mov eax, dword [esi]
mov dword [0x469a44], eax
mov dword [0x469a4c], 1
test esi, esi
jne 0x40ecb9
push 0x53c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40ecf6
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040ee50
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_volcano_app::rg_startup_class.0
call fcn.0040edd0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00435af1
int3

Function at 0x40f1b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4471d5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x469a48], 0xc
jl 0x40f208
push 0x469a4c
call fcn.00422070
mov ecx, dword [0x469a44]
add esp, 4
test ecx, ecx
je 0x40f1fa
mov eax, dword [ecx]
mov dword [0x469a44], eax
mov dword [0x469a4c], 1
test ecx, ecx
jne 0x40f21f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40f265
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x469a70], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00435af1
int3
Function at 0x40f6e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4476dd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x469a48], 0xb4
jl 0x40f73b
push 0x469a4c
call fcn.00422070
mov ecx, dword [0x469a44]
add esp, 4
test ecx, ecx
je 0x40f72d
mov eax, dword [ecx]
mov dword [0x469a44], eax
mov dword [0x469a4c], 1
test ecx, ecx
jne 0x40f755
push 0xb4
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40f77a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040fa30
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00435af1
int3

Function at 0x40f820
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4497b5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x469a48], 0xb4
jl 0x40f87f
push 0x469a4c
call fcn.00422070
mov esi, dword [0x469a44]
add esp, 4
test esi, esi
je 0x40f871
mov eax, dword [esi]
mov dword [0x469a44], eax
mov dword [0x469a4c], 1
test esi, esi
jne 0x40f899
push 0xb4
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40f8d6
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040fa30
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_volcano_WinHTTP5_n::rg_WinHttpChengXu.0
call fcn.0040f9a0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00435af1
int3
Function at 0x40fa30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44987b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
lea edx, [esi + 0xc]
mov dword [esi], vtable.rg_volcano_WinHTTP5_n::rg_WinHttpChengXu.0
lea edi, [edx + 4]
mov dword [edx], vtable.CWinHttpRequestEvents.0
mov dword [edi], 0
mov dword [edx + 8], 0
mov dword [edx + 0xc], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], 0
mov dword [edx + 0x1c], 0
mov dword [edx + 0x20], 0
mov byte [ebp - 4], 1
lea eax, [esi + 0x34]
mov dword [ebp - 0x14], eax
mov dword [eax], vtable.CVolObject.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 2
mov dword [eax], vtable.CVolComObject.0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x48]
call fcn.00403a80
mov byte [ebp - 4], 4
mov dword [esi + 0x74], 1
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov byte [ebp - 4], 5
mov dword [esi + 0x84], 1
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov byte [ebp - 4], 6
mov dword [esi + 0x94], 1
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov byte [ebp - 4], 7
mov dword [esi + 0xa4], 1
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0
mov byte [ebp - 4], 8
mov eax, dword [edx]
mov dword [esi + 0x30], 0
mov eax, dword [eax + 4]
cmp eax, method.CWinHttpRequestEvents.virtual_4
jne 0x40fbc5
lock inc dword [edi]
jmp 0x40fbc8
push edx
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410df0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4471d5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x469a48], 0x20
jl 0x410e48
push 0x469a4c
call fcn.00422070
mov ecx, dword [0x469a44]
add esp, 4
test ecx, ecx
je 0x410e3a
mov eax, dword [ecx]
mov dword [0x469a44], eax
mov dword [0x469a4c], 1
test ecx, ecx
jne 0x410e5f
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x410ea6
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
xorps xmm0, xmm0
mov dword [ecx], vtable.CVolComVariant.0
movups xmmword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00435af1
int3
Function at 0x410f50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44785d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x469a48], 0x20
jl 0x410fab
push 0x469a4c
call fcn.00422070
mov ecx, dword [0x469a44]
add esp, 4
test ecx, ecx
je 0x410f9d
mov eax, dword [ecx]
mov dword [0x469a44], eax
mov dword [0x469a4c], 1
test ecx, ecx
jne 0x410fc2
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x410fe9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.00410eb0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00435af1
int3

Function at 0x411510
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4471d5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x469a48], 0x14
jl 0x411568
push 0x469a4c
call fcn.00422070
mov ecx, dword [0x469a44]
add esp, 4
test ecx, ecx
je 0x41155a
mov eax, dword [ecx]
mov dword [0x469a44], eax
mov dword [0x469a4c], 1
test ecx, ecx
jne 0x41157f
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4115cd
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolComObject.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00435af1
int3

Function at 0x411690
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44785d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x469a48], 0x14
jl 0x4116eb
push 0x469a4c
call fcn.00422070
mov ecx, dword [0x469a44]
add esp, 4
test ecx, ecx
je 0x4116dd
mov eax, dword [ecx]
mov dword [0x469a44], eax
mov dword [0x469a4c], 1
test ecx, ecx
jne 0x411702
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x411729
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.004115e0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00435af1
int3