joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405260
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59cc98
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x61b088], 0x2c
jl 0x4052b8
push 0x61b08c
call fcn.0042abe0
mov edx, dword [0x61b084]
add esp, 4
test edx, edx
je 0x4052aa
mov eax, dword [edx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test edx, edx
jne 0x4052cf
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x405322
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov dword [edx], vtable.CVolObject.0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [ebp - 4], 1
mov dword [edx], vtable.rg_volcano_base::rg_KuoZhanDuiXiangLei.0
mov byte [ebp - 4], 2
push ecx
lea ecx, [edx + 0xc]
mov dword [edx], vtable.rg_volcano_base::rg_WenBenShuZuLei.0
call fcn.0040a490
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3

Function at 0x405460
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ccf0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x61b088], 0x2c
jl 0x4054bc
push 0x61b08c
call fcn.0042abe0
mov esi, dword [0x61b084]
add esp, 4
test esi, esi
je 0x4054ae
mov eax, dword [esi]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test esi, esi
jne 0x4054d3
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40553a
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_volcano_base::rg_KuoZhanDuiXiangLei.0
mov byte [ebp - 4], 2
push ecx
lea ecx, [esi + 0xc]
mov dword [esi], vtable.rg_volcano_base::rg_WenBenShuZuLei.0
call fcn.0040a490
mov byte [ebp - 4], 4
mov ecx, esi
push edi
mov dword [esi], vtable.rg_volcano_base::rg_WenBenShuZuLei.0
call fcn.00405640
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3
Function at 0x409580
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c465
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x61b088], 0x20
jl 0x4095d8
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x4095ca
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x4095ef
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x409636
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
xorps xmm0, xmm0
mov dword [ecx], vtable.CVolComVariant.0
movups xmmword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3

Function at 0x4096e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c4dd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x61b088], 0x20
jl 0x40973b
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x40972d
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x409752
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x409779
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.00409640
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3

Function at 0x409d10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c465
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x61b088], 0x14
jl 0x409d68
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x409d5a
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x409d7f
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x409dcd
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolComObject.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3
Function at 0x409e90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c4dd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x61b088], 0x14
jl 0x409eeb
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x409edd
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x409f02
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x409f29
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.00409de0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3

Function at 0x40af70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c465
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x61b088], 0x2c
jl 0x40afc8
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x40afba
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x40afdf
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40b046
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ecx], vtable.leyBc_Module::Memory_Info.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov word [ecx + 0x18], ax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
mov dword [ecx + 0x28], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3
Function at 0x40b110
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59cbad
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x61b088], 0x2c
jl 0x40b16b
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x40b15d
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x40b186
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40b236
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ecx], vtable.leyBc_Module::Memory_Info.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov word [ecx + 0x18], ax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
mov dword [ecx + 0x28], eax
mov byte [ebp - 4], 2
mov dword [ecx], vtable.leyBc_Module::Memory_Info.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x14], eax
mov ax, word [esi + 0x18]
mov word [ecx + 0x18], ax
mov eax, dword [esi + 0x1c]
mov dword [ecx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ecx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ecx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ecx + 0x28], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3
Function at 0x40d630
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c26d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x61b088], 0x70
jl 0x40d688
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x40d67a
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x40d69f
push 0x70
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40d6c4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040d9f0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3

Function at 0x40d780
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e7e5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x61b088], 0x70
jl 0x40d7dc
push 0x61b08c
call fcn.0042abe0
mov esi, dword [0x61b084]
add esp, 4
test esi, esi
je 0x40d7ce
mov eax, dword [esi]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test esi, esi
jne 0x40d7f3
push 0x70
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40d830
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040d9f0
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.leyBc_Module::Window_Info.0
call fcn.0040d960
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3

Function at 0x40de60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c26d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x61b088], 0x14c
jl 0x40debb
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x40dead
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x40ded5
push 0x14c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40defa
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040e1c0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3
Function at 0x40dfa0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e8f5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x61b088], 0x14c
jl 0x40dfff
push 0x61b08c
call fcn.0042abe0
mov esi, dword [0x61b084]
add esp, 4
test esi, esi
je 0x40dff1
mov eax, dword [esi]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test esi, esi
jne 0x40e019
push 0x14c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40e056
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040e1c0
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_volcano_MFCJieMian_base::CVolWinControl.0
call fcn.0040e120
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3

Function at 0x40e810
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ebd5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x61b088], 0x154
jl 0x40e86c
push 0x61b08c
call fcn.0042abe0
mov esi, dword [0x61b084]
add esp, 4
test esi, esi
je 0x40e85e
mov eax, dword [esi]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test esi, esi
jne 0x40e886
push 0x154
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40e8ce
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040e1c0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_volcano_MFCJieMian_base::CVolWinContainer.0
mov dword [esi + 0x14c], 0
mov dword [esi + 0x150], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3
Function at 0x40e970
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ec1d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x61b088], 0x154
jl 0x40e9cf
push 0x61b08c
call fcn.0042abe0
mov esi, dword [0x61b084]
add esp, 4
test esi, esi
je 0x40e9c1
mov eax, dword [esi]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test esi, esi
jne 0x40e9e9
push 0x154
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40ea44
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040e1c0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_volcano_MFCJieMian_base::CVolWinContainer.0
mov dword [esi + 0x14c], 0
mov dword [esi + 0x150], 0
mov byte [ebp - 4], 2
mov ecx, esi
push edi
mov dword [esi], vtable.rg_volcano_MFCJieMian_base::CVolWinContainer.0
call fcn.0040e120
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3

Function at 0x40ed50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c26d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x61b088], 0x1d8
jl 0x40edab
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x40ed9d
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x40edc5
push 0x1d8
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40edea
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0041c050
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3

Function at 0x40f390
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c26d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x61b088], 0x27c
jl 0x40f3eb
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x40f3dd
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x40f405
push 0x27c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40f42a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0041c6a0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3
Function at 0x40fb80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c26d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x61b088], 0x28
jl 0x40fbd8
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x40fbca
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x40fbef
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40fc14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040fe90
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3

Function at 0x40fcb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ee95
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x61b088], 0x28
jl 0x40fd0d
push 0x61b08c
call fcn.0042abe0
mov esi, dword [0x61b084]
add esp, 4
test esi, esi
je 0x40fcff
mov eax, dword [esi]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test esi, esi
jne 0x40fd24
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40fd7f
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040fe90
mov byte [ebp - 4], 1
lea ebx, [edi + 0xc]
mov dword [esi], vtable.rg_volcano_base::rg_BianZhengShuShuZuLei.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
lea edi, [esi + 0xc]
mov dword [esi + 8], eax
cmp ebx, edi
je 0x40fd64
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x44]
push ebx
mov ecx, edi
call fcn.00402b60
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3

Function at 0x410200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c26d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x61b088], 0xae0
jl 0x41025b
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x41024d
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x410275
push 0xae0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41029a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00411410
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3
Function at 0x410350
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59efe5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x61b088], 0xae0
jl 0x4103af
push 0x61b08c
call fcn.0042abe0
mov esi, dword [0x61b084]
add esp, 4
test esi, esi
je 0x4103a1
mov eax, dword [esi]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test esi, esi
jne 0x4103c9
push 0xae0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x41041a
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00411410
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_GangJieGou_GeiGe::rg_my_main_window.2.0
mov dword [esi + method.rg_GangJieGou_GeiGe::rg_my_main_window.1.virtual_0], vtable.rg_GangJieGou_GeiGe::rg_my_main_window.1.0
mov dword [esi + method.rg_GangJieGou_GeiGe::rg_my_main_window.virtual_0], vtable.rg_GangJieGou_GeiGe::rg_my_main_window.0
call fcn.004104f0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3

Function at 0x410700
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f08d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x61b088], 0x10
jl 0x410758
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x41074a
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x41076f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4107c0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_KeSheJiLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3