joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49e330
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x49e39b
cmp byte [ebx + 0xd3], 0
jne 0x49e39b
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406968
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x49e388
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x49e3a8
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040682c
jmp 0x49e3a8
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040682c
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x49fbd0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x49fc3e
mov eax, esi
call fcn.004783e0
test al, al
je 0x49fc3e
mov eax, dword [ebx + 0x84]
call fcn.00478060
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x49fc3e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x49fc32
push 0
mov eax, dword [ebx + 0x84]
call fcn.00478060
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0046f0f0
jmp 0x49fc3e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0049fa08
pop esi
pop ebx
ret
Function at 0x4010cb
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push str.E5C53971_D80E_4500_BE0D_761BF3CD8458
push 1
push 0
mov dword [0x5151ac], esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x5151b4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401113
push dword [0x5151b4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [0x5151b4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x401128
push 0
push 0x40112c
push 0
push 0x65
push esi
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 1
pop eax
pop esi
ret 0x10

Function at 0x40187d
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x209], 0x5c
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x4018c6
lea eax, [ebp - 0x208]
push 0x4112cc
push eax
call edi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x104]
push 0x411354
push eax
call edi
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401906
xor eax, eax
jmp 0x401996
cmp byte [ebp - 0x31c], 0x2e
je 0x401965
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x104]
push eax
call edi
cmp dword [ebp - 0x348], 0x10
jne 0x401946
lea eax, [ebp - 0x104]
push eax
call fcn.0040187d
jmp 0x401965
lea eax, [ebp - 0x104]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x348]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401906
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40199d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4019b5
test al, 0x10
je 0x4019b5
push 1
pop eax
jmp 0x4019b7
xor eax, eax
ret 4
Function at 0x4019ba
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
push esi
push esi
push 2
push esi
push 1
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp edi, 0xffffffff
je 0x4019f1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp + 0x10], eax
jbe 0x4019f6
or eax, 0xffffffff
jmp 0x401a5d
push ebx
push esi
push esi
mov dword [ebp - 4], esi
push dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 0xc]
push esi
mov ebx, 0x100000
push eax
mov esi, 0x4151ac
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
call edi
test eax, eax
je 0x401a50
cmp dword [ebp + 0xc], 0
jbe 0x401a50
lea eax, [ebp - 0xc]
push 0
push eax
push dword [ebp + 0xc]
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xc]
push 0
add dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push ebx
push esi
push dword [ebp + 8]
jmp 0x401a1e
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
leave
ret

Function at 0x401a61
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
push edi
push edi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 4]
push edi
push eax
push 0x100000
push 0x4151ac
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401aad
cmp word [0x4151ac], 0x5a4d
jne 0x401aad
mov ecx, dword [0x4151e8]
cmp dword [ecx + 0x4151ac], 0x4550
je 0x401ab2
or eax, 0xffffffff
jmp 0x401add
push esi
xor eax, eax
movzx esi, word [ecx + 0x4151b2]
cmp esi, edi
jle 0x401adc
lea edx, [ecx + 0x4152b4]
mov ecx, dword [edx + 4]
add ecx, dword [edx]
cmp ecx, eax
jbe 0x401ad1
mov eax, ecx
add edx, 0x28
inc edi
movsx ecx, di
cmp ecx, esi
jl 0x401ac6
pop esi
pop edi
leave
ret
Function at 0x401ae0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push 0x44
pop esi
xor edi, edi
push esi
lea eax, [ebp - 0x54]
push edi
push eax
call fcn.00407c00
mov ebx, dword [ebp + 8]
add esp, 0xc
cmp dword [0x5151b0], edi
mov dword [ebp - 0x54], esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x401b18
push str.__AUTOPATCH
push ebx
call esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x401b33
push 0x411358
push ebx
call esi
push dword [ebp + 0xc]
push ebx
call esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401b7f
cmp dword [ebp + 0x10], edi
je 0x401b6a
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp + 0xc]
jmp 0x401b82
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401b87
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 8]
mov dword [ebp - 4], esi
push esi
mov ebx, 0x100000
push eax
mov esi, 0x4151ac
push ebx
push esi
push dword [ebp + 8]
call edi
test eax, eax
je 0x401bec
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x401bec
lea ecx, [ecx + 0x4151ac]
mov eax, esi
cmp ecx, esi
jbe 0x401bdf
mov edx, dword [eax]
add eax, 4
add dword [ebp - 4], edx
cmp eax, ecx
jb 0x401bd3
lea eax, [ebp - 8]
push 0
push eax
push ebx
push esi
push dword [ebp + 8]
jmp 0x401bba
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4022f9
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14038
call fcn.00408260
push ebx
push esi
push edi
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407f00
push 0x41139c
push dword [ebp + 0x14]
call fcn.004080ae
add esp, 0x14
mov dword [ebp + 0xc], eax
test eax, eax
je 0x402436
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.00407c00
push 0x38
push str.1.1.3
lea eax, [ebp - 0x38]
push 0xfffffffffffffff1
push eax
mov dword [ebp - 0x14], 0x4024c3
mov dword [ebp - 0x18], 0x4024b2
call fcn.00402620
mov edi, dword [ebp + 0x10]
add esp, 0x1c
mov esi, 0xa000
push 1
pop ebx
test edi, edi
jbe 0x40243a
push dword [ebp + 8]
cmp edi, esi
jbe 0x40237e
push esi
jmp 0x40237f
push edi
lea eax, [ebp - 0x14038]
push ebx
push eax
call fcn.00407e18
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
lea ecx, [ebp - 0x14038]
add esp, 0x10
mov dword [ebp - 0x38], ecx
sub edi, eax
lea ecx, [ebp - 0xa038]
mov dword [ebp - 0x34], eax
test eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], esi
jbe 0x4023f6
cmp dword [ebp - 0x28], 0
jne 0x4023db
push dword [ebp + 0xc]
lea eax, [ebp - 0xa038]
push esi
push ebx
push eax
call fcn.00407caa
lea eax, [ebp - 0xa038]
add esp, 0x10
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.00402730
pop ecx
test eax, eax
pop ecx
jl 0x40241a
cmp eax, ebx
je 0x4023f6
cmp dword [ebp - 0x34], 0
ja 0x4023b5
mov eax, esi
sub eax, dword [ebp - 0x28]
je 0x40236c
push dword [ebp + 0xc]
push ebx
push eax
lea eax, [ebp - 0xa038]
push eax
call fcn.00407caa
add esp, 0x10
jmp 0x40236c
lea eax, [ebp - 0x38]
push eax
call fcn.004025d0
push dword [ebp + 0xc]
call fcn.00407dc2
pop ecx
pop ecx
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
jmp 0x4024ab
lea eax, [ebp - 0xa038]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x28], 0
jne 0x40246c
push dword [ebp + 0xc]
lea eax, [ebp - 0xa038]
push esi
push ebx
push eax
call fcn.00407caa
lea eax, [ebp - 0xa038]
add esp, 0x10
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x38]
push 4
push eax
call fcn.00402730
pop ecx
test eax, eax
pop ecx
je 0x402446
sub esi, dword [ebp - 0x28]
je 0x402496
push dword [ebp + 0xc]
lea eax, [ebp - 0xa038]
push ebx
push esi
push eax
call fcn.00407caa
add esp, 0x10
lea eax, [ebp - 0x38]
push eax
call fcn.004025d0
push dword [ebp + 0xc]
call fcn.00407dc2
pop ecx
mov al, bl
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4024ce
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push esi
lea eax, [ebp - 0x12c]
push dword [ebp + 8]
push eax
call fcn.00407c58
lea eax, [ebp - 0x12c]
push 0x5c
push eax
call fcn.00407750
add esp, 0x10
mov esi, eax
test esi, esi
je 0x402541
lea eax, [ebp]
cmp esi, eax
jae 0x402541
and byte [esi], 0
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40252d
lea eax, [ebp - 0x12c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40253d
mov byte [esi], 0x5c
inc esi
push 0x5c
push esi
call fcn.00407750
pop ecx
pop ecx
jmp 0x4024f8
xor eax, eax
jmp 0x402544
push 1
pop eax
pop esi
leave
ret 4
Function at 0x402140
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c26d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x61b088], 0x28
jl 0x402198
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x40218a
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x4021af
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4021d5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push ecx
call fcn.00402730
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3

Function at 0x4021e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c2a5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x61b088], 0x28
jl 0x40223c
push 0x61b08c
call fcn.0042abe0
mov esi, dword [0x61b084]
add esp, 4
test esi, esi
je 0x40222e
mov eax, dword [esi]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test esi, esi
jne 0x402253
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x402291
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push ecx
mov ecx, esi
call fcn.00402730
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.CVolObjectArray.0
call fcn.004022e0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3

Function at 0x4028f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c465
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x61b088], 0x1c
jl 0x402948
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x40293a
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x40295f
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4029bb
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolMem.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x18], 0x40
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3
Function at 0x402a70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c4dd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x61b088], 0x1c
jl 0x402acb
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x402abd
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x402ae2
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x402b09
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.004029d0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3

Function at 0x403090
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c26d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x61b088], 0xc
jl 0x4030e8
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x4030da
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x4030ff
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x403135
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3

Function at 0x403140
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c5b5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x61b088], 0xc
jl 0x40319b
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x40318d
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x4031b2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4031ff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolObject.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3
Function at 0x403fe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c8a5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x61b088], 0x2c
jl 0x404038
push 0x61b08c
call fcn.0042abe0
mov edx, dword [0x61b084]
add esp, 4
test edx, edx
je 0x40402a
mov eax, dword [edx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test edx, edx
jne 0x40404f
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x404082
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov ecx, edx
call fcn.00404bd0
mov byte [ebp - 4], 1
mov dword [edx], vtable.CWConstString.0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3

Function at 0x404090
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c8ed
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x61b088], 0x2c
jl 0x4040ed
push 0x61b08c
call fcn.0042abe0
mov edi, dword [0x61b084]
add esp, 4
test edi, edi
je 0x4040df
mov eax, dword [edi]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test edi, edi
jne 0x404104
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40416b
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.00404bd0
mov byte [ebp - 4], 1
mov dword [edi], vtable.CWConstString.0
mov byte [ebp - 4], 2
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWConstString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.00402b60
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3
Function at 0x404650
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c26d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x61b088], 0x2c
jl 0x4046a8
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x40469a
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x4046bf
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4046e4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00404bd0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3

Function at 0x404780
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ca55
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x61b088], 0x2c
jl 0x4047dd
push 0x61b08c
call fcn.0042abe0
mov edi, dword [0x61b084]
add esp, 4
test edi, edi
je 0x4047cf
mov eax, dword [edi]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test edi, edi
jne 0x4047f4
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x404851
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.00404bd0
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.00402b60
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3
Function at 0x404da0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c465
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x61b088], 0xc
jl 0x404df8
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x404dea
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x404e0f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x404e4f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_volcano_base::rg_KuoZhanDuiXiangLei.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3

Function at 0x404ee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59cbad
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x611004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x61b088], 0xc
jl 0x404f3b
push 0x61b08c
call fcn.0042abe0
mov ecx, dword [0x61b084]
add esp, 4
test ecx, ecx
je 0x404f2d
mov eax, dword [ecx]
mov dword [0x61b084], eax
mov dword [0x61b08c], 1
test ecx, ecx
jne 0x404f52
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x404fa9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.rg_volcano_base::rg_KuoZhanDuiXiangLei.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_volcano_base::rg_KuoZhanDuiXiangLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00582789
int3