joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4070a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584265
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f69d8], 0x10
jl 0x4070fb
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x4070ed
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x407112
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x407180
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2525.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2525.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3

Function at 0x4073c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58421d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f69d8], 0x10
jl 0x407418
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x40740a
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x40742f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40747f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2521.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3
Function at 0x407520
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584265
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f69d8], 0x10
jl 0x40757b
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x40756d
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x407592
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x407601
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2521.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2521.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3

Function at 0x407890
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58421d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f69d8], 0x10
jl 0x4078e8
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x4078da
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x4078ff
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40794f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2519.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3
Function at 0x4079f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584265
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f69d8], 0x10
jl 0x407a4b
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x407a3d
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x407a62
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x407ad1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2519.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2519.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3

Function at 0x407da0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58421d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f69d8], 0x10
jl 0x407df8
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x407dea
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x407e0f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x407e5d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2517.0
mov byte [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3
Function at 0x407ef0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584265
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f69d8], 0x10
jl 0x407f4b
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x407f3d
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x407f62
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x407fcd
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2517.0
mov byte [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2517.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov al, byte [esi + 0xc]
mov byte [ecx + 0xc], al
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3

Function at 0x408810
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x583e3d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f69d8], 0x10
jl 0x408868
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x40885a
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x40887f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4088a4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040a150
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3
Function at 0x4088b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584595
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5f69d8], 0x10
jl 0x40890c
push 0x5f69dc
call fcn.00414380
mov esi, dword [0x5f69d4]
add esp, 4
test esi, esi
je 0x4088fe
mov eax, dword [esi]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test esi, esi
jne 0x408923
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x408981
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040a150
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolMemoryInputStream.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x408958
mov ecx, edi
call fcn.0040f810
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x408964
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3

Function at 0x408d20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5846b5
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f69d8], 0x10
jl 0x408d78
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x408d6a
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x408d8f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x408dea
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseStream.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.CVolBaseInputStream.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3
Function at 0x408e00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58470d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5f69d8], 0x10
jl 0x408e5c
push 0x5f69dc
call fcn.00414380
mov esi, dword [0x5f69d4]
add esp, 4
test esi, esi
je 0x408e4e
mov eax, dword [esi]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test esi, esi
jne 0x408e77
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x408f07
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolBaseStream.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.CVolBaseInputStream.0
mov byte [ebp - 4], 4
mov dword [esi], vtable.CVolBaseInputStream.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x408ede
mov ecx, edi
call fcn.0040f810
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x408eea
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3

Function at 0x4092c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58481d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f69d8], 0x10
jl 0x409318
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x40930a
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x40932f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x409380
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseStream.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3
Function at 0x409390
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584865
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5f69d8], 0x10
jl 0x4093ec
push 0x5f69dc
call fcn.00414380
mov esi, dword [0x5f69d4]
add esp, 4
test esi, esi
je 0x4093de
mov eax, dword [esi]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test esi, esi
jne 0x409407
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40948d
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolBaseStream.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.CVolBaseStream.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x409464
mov ecx, edi
call fcn.0040f810
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x409470
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3
Function at 0x40a150
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584b48
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov dword [esi], vtable.CVolBaseStream.0
mov dword [ebp - 4], 2
mov dword [esi], vtable.CVolBaseInputStream.0
mov dword [ebp - 4], 3
mov dword [esi], vtable.CVolMemoryInputStream.0
cmp dword [0x5f69d8], 0x44
jl 0x40a1ff
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x40a1f1
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x40a21a
push 0x44
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40a2e8
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 4
mov dword [ecx], vtable.CRefObject.0
mov dword [ecx + 4], 1
mov byte [ebp - 4], 5
mov dword [ecx], vtable.CVBaseStream.0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 6
mov dword [ecx], vtable.CVBaseInputStream.0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 7
lea eax, [ecx + 0x28]
mov dword [ecx], vtable.CVMemoryInputStream.0
mov dword [ebp - 0x18], eax
mov dword [eax], vtable.CVolObject.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 8
mov dword [eax], vtable.CVolMem.0
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x18], 0x40
mov byte [ebp - 4], 9
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x20], 0
mov byte [ebp - 4], 3
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3

Function at 0x40a370
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x583f85
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f69d8], 0xc
jl 0x40a3c8
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x40a3ba
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x40a3df
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40a41f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3
Function at 0x40a430
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584b8d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5f69d8], 0xc
jl 0x40a48b
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x40a47d
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x40a4a2
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40a4f9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3

Function at 0x40a8a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x583f85
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f69d8], 0x10
jl 0x40a8f8
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x40a8ea
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x40a90f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40a956
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3
Function at 0x40a960
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584c6d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x5f69d8], 0x10
jl 0x40a9bc
push 0x5f69dc
call fcn.00414380
mov esi, dword [0x5f69d4]
add esp, 4
test esi, esi
je 0x40a9ae
mov eax, dword [esi]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test esi, esi
jne 0x40a9d3
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40aa4f
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.CVolRefObject.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x40aa26
mov ecx, edi
call fcn.0040f810
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40aa32
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3

Function at 0x40b0b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58421d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5f69d8], 0xc
jl 0x40b108
push 0x5f69dc
call fcn.00414380
mov ecx, dword [0x5f69d4]
add esp, 4
test ecx, ecx
je 0x40b0fa
mov eax, dword [ecx]
mov dword [0x5f69d4], eax
mov dword [0x5f69dc], 1
test ecx, ecx
jne 0x40b11f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40b16f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x5f6a00], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n6828.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0056b5c8
int3