joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405480
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e5dd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f2988], 0x10
jl 0x4054d8
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x4054ca
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x4054ef
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x405514
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00407600
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3

Function at 0x405520
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e615
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5f2988], 0x10
jl 0x40557c
push 0x5f298c
call fcn.00414110
mov esi, dword [0x5f2984]
add esp, 4
test esi, esi
je 0x40556e
mov eax, dword [esi]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test esi, esi
jne 0x405593
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4055f1
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00407600
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolMemoryInputStream.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4055c8
mov ecx, edi
call fcn.0040f5a0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4055d4
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3
Function at 0x405990
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e735
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f2988], 0x10
jl 0x4059e8
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x4059da
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x4059ff
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x405a5a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseStream.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.CVolBaseInputStream.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3

Function at 0x405a70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e78d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5f2988], 0x10
jl 0x405acc
push 0x5f298c
call fcn.00414110
mov esi, dword [0x5f2984]
add esp, 4
test esi, esi
je 0x405abe
mov eax, dword [esi]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test esi, esi
jne 0x405ae7
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x405b77
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolBaseStream.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.CVolBaseInputStream.0
mov byte [ebp - 4], 4
mov dword [esi], vtable.CVolBaseInputStream.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x405b4e
mov ecx, edi
call fcn.0040f5a0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x405b5a
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3
Function at 0x405f30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e89d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f2988], 0x10
jl 0x405f88
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x405f7a
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x405f9f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x405ff0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseStream.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3

Function at 0x406000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e8e5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5f2988], 0x10
jl 0x40605c
push 0x5f298c
call fcn.00414110
mov esi, dword [0x5f2984]
add esp, 4
test esi, esi
je 0x40604e
mov eax, dword [esi]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test esi, esi
jne 0x406077
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4060fd
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolBaseStream.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.CVolBaseStream.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4060d4
mov ecx, edi
call fcn.0040f5a0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4060e0
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3
Function at 0x406ea0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57eb85
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f2988], 0x1c
jl 0x406ef8
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x406eea
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x406f0f
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x406f6b
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolMem.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x18], 0x40
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3

Function at 0x407020
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ebfd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f2988], 0x1c
jl 0x40707b
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x40706d
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x407092
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4070b9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.00406f80
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3
Function at 0x407600
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ed18
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov dword [esi], vtable.CVolBaseStream.0
mov dword [ebp - 4], 2
mov dword [esi], vtable.CVolBaseInputStream.0
mov dword [ebp - 4], 3
mov dword [esi], vtable.CVolMemoryInputStream.0
cmp dword [0x5f2988], 0x44
jl 0x4076af
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x4076a1
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x4076ca
push 0x44
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x407798
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 4
mov dword [ecx], vtable.CRefObject.0
mov dword [ecx + 4], 1
mov byte [ebp - 4], 5
mov dword [ecx], vtable.CVBaseStream.0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 6
mov dword [ecx], vtable.CVBaseInputStream.0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 7
lea eax, [ecx + 0x28]
mov dword [ecx], vtable.CVMemoryInputStream.0
mov dword [ebp - 0x18], eax
mov dword [eax], vtable.CVolObject.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 8
mov dword [eax], vtable.CVolMem.0
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x18], 0x40
mov byte [ebp - 4], 9
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x20], 0
mov byte [ebp - 4], 3
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3

Function at 0x407820
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57eb85
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f2988], 0xc
jl 0x407878
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x40786a
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x40788f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4078cf
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3
Function at 0x4078e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ed5d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f2988], 0xc
jl 0x40793b
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x40792d
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x407952
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4079a9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3

Function at 0x407d50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57eb85
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f2988], 0x10
jl 0x407da8
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x407d9a
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x407dbf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x407e06
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3
Function at 0x407e10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ee3d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5f2988], 0x10
jl 0x407e6c
push 0x5f298c
call fcn.00414110
mov esi, dword [0x5f2984]
add esp, 4
test esi, esi
je 0x407e5e
mov eax, dword [esi]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test esi, esi
jne 0x407e83
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x407eff
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolRefObject.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x407ed6
mov ecx, edi
call fcn.0040f5a0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x407ee2
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3

Function at 0x408310
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e5dd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f2988], 0xc
jl 0x408368
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x40835a
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x40837f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4083b5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3
Function at 0x408440
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ef15
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f2988], 0xc
jl 0x40849b
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x40848d
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x4084b2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4084ff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolObject.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3

Function at 0x408ad0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e26d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f2988], 0xc
jl 0x408b28
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x408b1a
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x408b3f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x408b8f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f29b0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7792.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3
Function at 0x408c20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e2b5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f2988], 0xc
jl 0x408c7b
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x408c6d
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x408c92
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x408cf9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f29b0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7792.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n7792.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3

Function at 0x408fb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f115
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f2988], 0xc
jl 0x409008
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x408ffa
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x40901f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x409079
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f29b0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7792.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n7802.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3
Function at 0x409110
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f16d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f2988], 0xc
jl 0x40916b
push 0x5f298c
call fcn.00414110
mov ecx, dword [0x5f2984]
add esp, 4
test ecx, ecx
je 0x40915d
mov eax, dword [ecx]
mov dword [0x5f2984], eax
mov dword [0x5f298c], 1
test ecx, ecx
jne 0x409182
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4091f3
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f29b0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n7792.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n7802.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n1::rg_n7802.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00566268
int3