joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012b70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018a0cb
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
cmp dword [0x102007b8], 0x4c
jge 0x10012bbe
push 0x4c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x10], ecx
jmp 0x10012c02
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
mov dword [ebp - 0x10], ecx
test ecx, ecx
je 0x10012bdf
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x10012c0a
push 0x4c
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x10012d95
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
push 0x148
call fcn.10023f4c
mov ebx, eax
add esp, 4
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x10012d4d
mov ecx, ebx
call fcn.100240bf
mov byte [ebp - 4], 2
mov dword [ebx], vtable.CEdit.0
mov byte [ebp - 4], 3
lea edi, [ebx + 0xac]
mov dword [ebx], vtable.CVWnd_Edit.0
mov dword [ebp - 0x20], edi
mov dword [edi], vtable.CGdiObject.0
mov dword [edi + 4], 0
mov byte [ebp - 4], 4
mov dword [edi], vtable.CBrush.0
mov byte [ebp - 4], 5
lea esi, [ebx + 0xb8]
mov ecx, esi
mov dword [ebp - 0x20], esi
call fcn.100240bf
mov byte [ebp - 4], 6
mov dword [esi], vtable.CSpinButtonCtrl.0
mov byte [ebp - 4], 7
mov dword [esi], vtable.CEditSpin.0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov byte [ebp - 4], 8
mov eax, 0x2a
push 0xffffff
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x84], 0
mov dword [ebx + 0x88], 0xffffff
mov dword [ebx + 0x8c], 0
mov dword [ebx + 0x90], 0
mov dword [ebx + 0x94], 0
mov dword [ebx + 0x98], 0
mov word [ebx + 0x9c], ax
mov dword [ebx + 0xa0], 0
mov dword [ebx + 0xa4], 0
mov dword [ebx + 0xa8], 0x64
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.1002d134
mov dword [ebx + 0x140], 0
mov dword [ebx + 0x144], 0
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x14]
jmp 0x10012d4f
xor ebx, ebx
mov byte [ebp - 4], 0
push ecx
mov ecx, dword [ebp - 0x10]
push ebx
call fcn.10013ff0
mov esi, eax
mov dword [ebp - 4], 0xffffffff
or dword [esi + 0x34], 0x10000
or dword [esi + 0x38], 0x200
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x10012d80
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [edi + 0xc], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x10014270
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10188e6d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0xc
jl 0x100142c8
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x100142ba
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x100142df
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001432f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x102007e0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n6226.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x100143c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10188eb5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x102007b8], 0xc
jl 0x1001441b
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x1001440d
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x10014432
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10014499
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x102007e0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n6226.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n6226.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x100147a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018a555
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0xc
jl 0x100147f8
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x100147ea
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x1001480f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10014869
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x102007e0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n6226.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n6242.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x10014900
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018a5ad
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x102007b8], 0xc
jl 0x1001495b
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x1001494d
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x10014972
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100149e3
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x102007e0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n6226.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n6242.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n::rg_n6242.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x10014bc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov esi, ecx
call fcn.10031fb8
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 8
push eax
mov dword [ebp - 0x10], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
call fcn.100324c0
add esp, 4
mov ecx, esi
call fcn.100315c6
call fcn.10016ce0
mov ecx, dword [esi + 0x44]
push 2
push 0
mov dword [ebp - 0xc], eax
mov dword [0x1020089c], ecx
mov dword [0x102008a0], 0
mov dword [0x102008a4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
xor ecx, ecx
test eax, eax
setns cl
mov dword [0x102007e4], ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push str.SHCore.dll
mov edi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 8], eax
test eax, eax
je 0x10014c86
push str.GetDpiForMonitor
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10014c7d
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 2
push edi
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push eax
call esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10014cad
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 4]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mov eax, dword [ebp - 0xc]
movsd xmm0, qword [0x101d2f18]
divsd xmm1, qword [0x101d2f28]
maxsd xmm0, xmm1
movsd qword [0x102007e8], xmm0
mov eax, dword [eax]
call eax
mov dword [0x102007e0], eax
mov esi, dword [eax]
call fcn.10014f40
mov ecx, dword [0x102007e0]
push eax
mov eax, dword [esi + 0x34]
call eax
pop edi
pop esi
test eax, eax
je 0x10014d05
call fcn.10017330
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x102007e0]
mov eax, dword [ecx]
call dword [eax + 0x30]
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x10014e80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10187135
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0xc
jl 0x10014ed8
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x10014eca
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x10014eef
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10014f35
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x102007e0], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x10015140
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018a798
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0x2c
jl 0x10015198
push 0x102007bc
call fcn.1001cfa0
mov edx, dword [0x102007b4]
add esp, 4
test edx, edx
je 0x1001518a
mov eax, dword [edx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test edx, edx
jne 0x100151af
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x10015202
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov dword [edx], vtable.CVolObject.0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [ebp - 4], 1
mov dword [edx], vtable.rg_n::rg_n2149.0
mov byte [ebp - 4], 2
push ecx
lea ecx, [edx + 0xc]
mov dword [edx], vtable.rg_n::rg_n1726.0
call fcn.10016640
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x10015340
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018a7f0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102007b8], 0x2c
jl 0x1001539c
push 0x102007bc
call fcn.1001cfa0
mov esi, dword [0x102007b4]
add esp, 4
test esi, esi
je 0x1001538e
mov eax, dword [esi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test esi, esi
jne 0x100153b3
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1001541a
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n::rg_n2149.0
mov byte [ebp - 4], 2
push ecx
lea ecx, [esi + 0xc]
mov dword [esi], vtable.rg_n::rg_n1726.0
call fcn.10016640
mov byte [ebp - 4], 4
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n::rg_n1726.0
call fcn.10015520
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x100166e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018ab07
mov eax, dword fs:[0]
push eax
mov eax, 0x5020
call fcn.10168950
mov eax, dword [0x101f7004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x501c], edi
mov dword [ebp - 0x5028], edi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x5014], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x502c], edi
mov dword [ebp - 0x5024], edx
mov dword [ebp - 0x5020], eax
mov dword [ebp - 0x5018], 0
call fcn.10002cf0
mov dword [ebp - 4], 0
xor eax, eax
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x5018], 1
test esi, esi
je 0x1001677b
cmp word [esi], ax
sete al
jmp 0x10016782
cmp dword [ebx + 0x24], 2
setle al
test eax, eax
jne 0x1001689c
mov ecx, dword [edx + 0xc]
test ecx, ecx
je 0x10016799
cmp word [ecx], ax
sete al
jmp 0x100167a0
cmp dword [edx + 0x24], 2
setle al
test eax, eax
jne 0x1001689c
mov eax, dword [ebp - 0x5014]
xor edx, edx
mov eax, dword [eax + 0xc]
test eax, eax
je 0x100167bf
cmp word [eax], dx
sete dl
jmp 0x100167d2
mov edi, dword [ebp - 0x5014]
cmp dword [edi + 0x24], 2
mov edi, dword [ebp - 0x501c]
setle dl
test edx, edx
jne 0x1001689c
mov word [ebp - 0x5010], dx
test esi, esi
jne 0x100167f2
mov esi, 0x101cd86c
cmp dword [ebx + 0x24], edx
je 0x100167f2
mov esi, dword [ebx + 0x1c]
mov ebx, dword [ebp - 0x5020]
mov edx, dword [ebx + 0xc]
test edx, edx
jne 0x1001680c
cmp dword [ebx + 0x24], edx
mov edx, 0x101cd86c
je 0x1001680c
mov edx, dword [ebx + 0x1c]
test eax, eax
jne 0x10016826
mov eax, dword [ebp - 0x5014]
cmp dword [eax + 0x24], 0
jne 0x10016823
mov eax, 0x101cd86c
jmp 0x10016826
mov eax, dword [eax + 0x1c]
test ecx, ecx
jne 0x10016840
mov ecx, dword [ebp - 0x5024]
cmp dword [ecx + 0x24], 0
jne 0x1001683d
mov ecx, 0x101cd86c
jmp 0x10016840
mov ecx, dword [ecx + 0x1c]
push esi
push 0x2800
lea esi, [ebp - 0x5010]
push esi
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [edi + 0xc], 0
mov ecx, dword [edi + 0x1c]
test ecx, ecx
je 0x1001686e
mov eax, dword [edi + 0x10]
push ecx
lea ecx, [edi + 0x10]
call dword [eax + 0xc]
cmp word [ebp - 0x5010], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x20], 0
je 0x1001689c
lea eax, [ebp - 0x5010]
push eax
lea ecx, [edi + 0x10]
call fcn.1001c8b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10167cb7
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10016e90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10186fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0xc
jl 0x10016ee8
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x10016eda
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x10016eff
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10016f24
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.100171d0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x10016fc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018ac05
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x102007b8], 0xc
jl 0x1001701b
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x1001700d
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x10017032
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100170ad
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x102007e0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n::rg_n6226.0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n::rg_n6242.0
mov byte [ebp - 4], 4
mov dword [ecx], vtable.rg_n30578::rg_n30612.0
mov byte [ebp - 4], 5
mov dword [ecx], vtable.rg_n30578::rg_n30612.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x10019060
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10186fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x102007b8], 0x28
jl 0x100190b8
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x100190aa
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x100190cf
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100190f5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push ecx
call fcn.10019400
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3

Function at 0x100191d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018b1f5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102007b8], 0x28
jl 0x1001922c
push 0x102007bc
call fcn.1001cfa0
mov esi, dword [0x102007b4]
add esp, 4
test esi, esi
je 0x1001921e
mov eax, dword [esi]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test esi, esi
jne 0x10019243
push 0x28
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10019281
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push ecx
mov ecx, esi
call fcn.10019400
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.CVolObjectArray.0
call fcn.10019370
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3
Function at 0x10019710
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101891ed
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101f7004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x102007b8], 0xc
jl 0x1001976b
push 0x102007bc
call fcn.1001cfa0
mov ecx, dword [0x102007b4]
add esp, 4
test ecx, ecx
je 0x1001975d
mov eax, dword [ecx]
mov dword [0x102007b4], eax
mov dword [0x102007bc], 1
test ecx, ecx
jne 0x10019782
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100197df
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolUserApp.0
mov dword [0x102007e0], ecx
mov byte [ebp - 4], 2
mov dword [ecx], vtable.CVolUserApp.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1016f37b
int3