joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a050
Capabilities:
Access peb ldr_data
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015e07a
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPTongXinJiChuLei.0
mov dword [ebp - 4], 1
mov dword [esi], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPTCPFuWuQiJiChuLei.0
mov dword [ebp - 4], 2
lea edi, [esi + 0xc]
mov dword [ebp - 0x14], edi
mov dword [edi], vtable.ISocketListenerT_class_ITcpServer_.0
mov byte [ebp - 4], 3
mov dword [edi], vtable.IComplexSocketListenerT_class_ITcpServer_.0
mov byte [ebp - 4], 4
mov dword [edi], vtable.IServerListenerT_class_ITcpServer_.0
mov byte [ebp - 4], 5
mov dword [edi], vtable.ITcpServerListener.0
mov byte [ebp - 4], 6
mov dword [esi], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HP_TCPFuWuQi.1.0
mov dword [edi], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HP_TCPFuWuQi.0
mov dword [esi + 0x14], 1
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 7
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 8
mov dword [esi + 0x34], 1
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov byte [ebp - 4], 9
mov dword [esi + 0x44], 1
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 0xa
mov dword [esi + 0x54], 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov byte [ebp - 4], 0xb
mov dword [esi + 0x64], 1
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov byte [ebp - 4], 0xc
mov dword [esi + 0x74], 1
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov byte [ebp - 4], 0xd
cmp dword [0x10254178], 0xc
jl 0x1001a203
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1001a1f5
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x1001a21a
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001a286
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xe
mov dword [ecx], vtable.CRefObject.0
mov dword [ecx + 4], 1
mov byte [ebp - 4], 0xf
mov dword [ecx], vtable.CRefObjectWithData_class_CHPSocketWrapperTcpServer_.0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 0xd
push 0x384
mov dword [esi + 0x10], ecx
call fcn.10135525
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x11
mov ecx, eax
push edi
call fcn.100213f0
mov byte [ebp - 4], 0xd
mov ecx, dword [esi + 0x10]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x1001a5e0
Capabilities:
Access peb ldr_data
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015e36a
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPTongXinJiChuLei.0
mov dword [ebp - 4], 1
mov dword [esi], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HPTCPDaiLiJiChuLei.0
mov dword [ebp - 4], 2
lea edi, [esi + 0xc]
mov dword [ebp - 0x14], edi
mov dword [edi], vtable.ISocketListenerT_class_ITcpAgent_.0
mov byte [ebp - 4], 3
mov dword [edi], vtable.IComplexSocketListenerT_class_ITcpAgent_.0
mov byte [ebp - 4], 4
mov dword [edi], vtable.IAgentListenerT_class_ITcpAgent_.0
mov byte [ebp - 4], 5
mov dword [edi], vtable.ITcpAgentListener.0
mov byte [ebp - 4], 6
mov dword [esi], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HP_TCPDaiLiLei.1.0
mov dword [edi], vtable.rg_HuoShan_ShiChuang_WangLao::rg_HP_TCPDaiLiLei.0
mov dword [esi + 0x14], 1
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 7
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 8
mov dword [esi + 0x34], 1
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov byte [ebp - 4], 9
mov dword [esi + 0x44], 1
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 0xa
mov dword [esi + 0x54], 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov byte [ebp - 4], 0xb
mov dword [esi + 0x64], 1
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov byte [ebp - 4], 0xc
mov dword [esi + 0x74], 1
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov byte [ebp - 4], 0xd
cmp dword [0x10254178], 0xc
jl 0x1001a793
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1001a785
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x1001a7aa
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001a816
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xe
mov dword [ecx], vtable.CRefObject.0
mov dword [ecx + 4], 1
mov byte [ebp - 4], 0xf
mov dword [ecx], vtable.CRefObjectWithData_class_CHPSocketWrapperTcpAgent_.0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 0xd
push 0x38c
mov dword [esi + 0x10], ecx
call fcn.10135525
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x11
mov ecx, eax
push edi
call fcn.10021be0
mov byte [ebp - 4], 0xd
mov ecx, dword [esi + 0x10]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x1001d8b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159d9d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0x10
jl 0x1001d908
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1001d8fa
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x1001d91f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001d944
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.1001dbd0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x1001d9d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015edd5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x10254178], 0x10
jl 0x1001da2c
push 0x1025417c
call fcn.10031980
mov esi, dword [0x10254174]
add esp, 4
test esi, esi
je 0x1001da1e
mov eax, dword [esi]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test esi, esi
jne 0x1001da43
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1001daa1
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.1001dbd0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_HuoShan_JiBen::rg_HuChiSuoLei.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x1001da78
mov ecx, edi
call fcn.10018300
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1001da84
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x1001dbd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015ee70
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CVolObject.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [edi], vtable.CVolRefObject.0
mov dword [edi + 0xc], 0
mov dword [ebp - 4], 1
mov dword [edi], vtable.rg_HuoShan_JiBen::rg_HuChiSuoLei.0
cmp dword [0x10254178], 0x20
jl 0x1001dc66
push 0x1025417c
call fcn.10031980
mov esi, dword [0x10254174]
add esp, 4
test esi, esi
je 0x1001dc58
mov eax, dword [esi]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test esi, esi
jne 0x1001dc7d
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1001dcc6
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
mov dword [esi], vtable.CRefObject.0
mov dword [esi + 4], 1
mov byte [ebp - 4], 3
lea eax, [esi + 8]
push eax
mov dword [esi], vtable.CRefObjectWithData_class_CMMutex_.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 1
mov dword [edi + 0xc], esi
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x1001df40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015d7fd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0xc
jl 0x1001df98
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1001df8a
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x1001dfaf
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001dfff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x102541a0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_ChengXuLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x1001e090
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015d845
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10254178], 0xc
jl 0x1001e0eb
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1001e0dd
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x1001e102
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001e169
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x102541a0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_ChengXuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_ChengXuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x1001e3f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015ef55
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0xc
jl 0x1001e448
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1001e43a
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x1001e45f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001e4b9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x102541a0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_ChengXuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_DongTaiKuChengXuLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x1001e550
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015efad
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10254178], 0xc
jl 0x1001e5ab
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1001e59d
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x1001e5c2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001e633
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x102541a0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_ChengXuLei.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_DongTaiKuChengXuLei.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_DongTaiKuChengXuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3

Function at 0x1001e9c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159d9d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0x2c
jl 0x1001ea18
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1001ea0a
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x1001ea2f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001ea54
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.1001ece0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x1001eae0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015f0f5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x10254178], 0x2c
jl 0x1001eb3d
push 0x1025417c
call fcn.10031980
mov edi, dword [0x10254174]
add esp, 4
test edi, edi
je 0x1001eb2f
mov eax, dword [edi]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test edi, edi
jne 0x1001eb54
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1001ebc0
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.1001ece0
mov byte [ebp - 4], 1
lea ecx, [edi + 0xc]
mov dword [edi], vtable.rg_HuoShan_ChengXu::rg_QiDongLei.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [edi + 0xc]
call dword [eax + 0x44]
mov eax, dword [ebx + 0x10]
lea ecx, [edi + 0x1c]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [edi + 0x1c]
call dword [eax + 0x44]
mov eax, dword [ebx + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [ebx + 0x24]
mov dword [edi + 0x24], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x1001ef90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015f25d
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x1001f0f4
sub eax, 1
jne 0x1001f194
call fcn.1001e810
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [0x1025425c], ecx
mov dword [0x10254260], 0
mov dword [0x10254264], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 2
push 0
mov dword [0x10254268], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
xor ecx, ecx
test eax, eax
setns cl
mov dword [0x102541a4], ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push str.SHCore.dll
mov edi, eax
mov dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1001f064
push str.GetDpiForMonitor
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 8], eax
test eax, eax
je 0x1001f05d
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 2
push edi
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push eax
call dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x1001f08b
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push edi
mov dword [ebp + 0xc], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp + 0xc]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mov eax, dword [ebp - 0x10]
movsd xmm0, qword [0x1023f330]
divsd xmm1, qword [0x1023f338]
maxsd xmm0, xmm1
movsd qword [0x102541a8], xmm0
mov eax, dword [eax]
call eax
mov dword [0x102541a0], eax
mov esi, dword [eax]
call fcn.1001f360
mov ecx, dword [0x102541a0]
push eax
mov eax, dword [esi + 0x34]
call eax
test eax, eax
je 0x1001f1ac
call fcn.1001eec0
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [0x102541a0]
mov edi, dword [esi]
call fcn.1001e270
push eax
mov eax, dword [edi + 0x34]
mov ecx, esi
call eax
test eax, eax
je 0x1001f118
mov ecx, dword [0x102541a0]
mov eax, dword [ecx]
call dword [eax + 0x4c]
mov ecx, 0x102541d4
call fcn.10031ba0
mov ecx, dword [0x102541a0]
test ecx, ecx
je 0x1001f13b
mov eax, dword [ecx]
call dword [eax + 0x30]
mov dword [0x102541a0], 0
mov ecx, 0x10254234
call fcn.1002bec0
mov ecx, 0x10254180
call fcn.1002f410
push 0x102541b0
mov dword [ebp + 0xc], 0x102541b0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [0x102541c8]
test eax, eax
je 0x1001f182
push eax
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov dword [0x102541c8], 0
mov dword [ebp - 4], 0xffffffff
push 0x102541b0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [0x102541a0]
mov eax, dword [ecx]
call dword [eax + 0x30]
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x1001f2a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159c55
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10254178], 0xc
jl 0x1001f2f8
push 0x1025417c
call fcn.10031980
mov ecx, dword [0x10254174]
add esp, 4
test ecx, ecx
je 0x1001f2ea
mov eax, dword [ecx]
mov dword [0x10254174], eax
mov dword [0x1025417c], 1
test ecx, ecx
jne 0x1001f30f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001f355
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x102541a0], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1013aa09
int3
Function at 0x1001fd00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015f450
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1024ed04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push esi
push eax
call fcn.10020620
mov edx, dword [eax + 4]
test edx, edx
je 0x1001fdd7
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x1001fd9b
cmp eax, edx
jne 0x1001fd93
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x1001fda3
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x1001fda3
cmp eax, edx
jne 0x1001fda3
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
dec dword [edi + 8]
mov eax, dword [edx + 4]
push 0xc
push edx
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.101354f4
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4