joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ba00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ebad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x442df8], 0x10
jl 0x40ba58
push 0x442dfc
call fcn.0041fe10
mov ecx, dword [0x442df4]
add esp, 4
test ecx, ecx
je 0x40ba4a
mov eax, dword [ecx]
mov dword [0x442df4], eax
mov dword [0x442dfc], 1
test ecx, ecx
jne 0x40ba77
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40ba77
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2529.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40bb70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ebf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x442df8], 0x10
jl 0x40bbcb
push 0x442dfc
call fcn.0041fe10
mov ecx, dword [0x442df4]
add esp, 4
test ecx, ecx
je 0x40bbbd
mov eax, dword [ecx]
mov dword [0x442df4], eax
mov dword [0x442dfc], 1
test ecx, ecx
jne 0x40bbea
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40bbea
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2529.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2529.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40bf60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ebad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x442df8], 0x10
jl 0x40bfb8
push 0x442dfc
call fcn.0041fe10
mov ecx, dword [0x442df4]
add esp, 4
test ecx, ecx
je 0x40bfaa
mov eax, dword [ecx]
mov dword [0x442df4], eax
mov dword [0x442dfc], 1
test ecx, ecx
jne 0x40bfd7
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40bfd7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2533.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40c0b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ebf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x442df8], 0x10
jl 0x40c10b
push 0x442dfc
call fcn.0041fe10
mov ecx, dword [0x442df4]
add esp, 4
test ecx, ecx
je 0x40c0fd
mov eax, dword [ecx]
mov dword [0x442df4], eax
mov dword [0x442dfc], 1
test ecx, ecx
jne 0x40c12a
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40c12a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2533.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2533.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c410
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ebad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x442df8], 0x18
jl 0x40c468
push 0x442dfc
call fcn.0041fe10
mov ecx, dword [0x442df4]
add esp, 4
test ecx, ecx
je 0x40c45a
mov eax, dword [ecx]
mov dword [0x442df4], eax
mov dword [0x442dfc], 1
test ecx, ecx
jne 0x40c487
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40c487
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_n1::rg_n2531.0
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40c590
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ebf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x442df8], 0x18
jl 0x40c5eb
push 0x442dfc
call fcn.0041fe10
mov ecx, dword [0x442df4]
add esp, 4
test ecx, ecx
je 0x40c5dd
mov eax, dword [ecx]
mov dword [0x442df4], eax
mov dword [0x442dfc], 1
test ecx, ecx
jne 0x40c60a
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40c60a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_n1::rg_n2531.0
movsd qword [ecx + 0x10], xmm0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2531.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
movsd xmm0, qword [esi + 0x10]
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c940
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ebad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x442df8], 0x18
jl 0x40c998
push 0x442dfc
call fcn.0041fe10
mov ecx, dword [0x442df4]
add esp, 4
test ecx, ecx
je 0x40c98a
mov eax, dword [ecx]
mov dword [0x442df4], eax
mov dword [0x442dfc], 1
test ecx, ecx
jne 0x40c9b7
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40c9b7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2527.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40caa0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ebf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x442df8], 0x18
jl 0x40cafb
push 0x442dfc
call fcn.0041fe10
mov edx, dword [0x442df4]
add esp, 4
test edx, edx
je 0x40caed
mov eax, dword [edx]
mov dword [0x442df4], eax
mov dword [0x442dfc], 1
test edx, edx
jne 0x40cb1a
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x40cb1a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov dword [edx], vtable.CVolObject.0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [ebp - 4], 1
mov dword [edx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.rg_n1::rg_n2527.0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov byte [ebp - 4], 3
mov dword [edx], vtable.rg_n1::rg_n2527.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40cdf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ebad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x442df8], 0x10
jl 0x40ce48
push 0x442dfc
call fcn.0041fe10
mov ecx, dword [0x442df4]
add esp, 4
test ecx, ecx
je 0x40ce3a
mov eax, dword [ecx]
mov dword [0x442df4], eax
mov dword [0x442dfc], 1
test ecx, ecx
jne 0x40ce67
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40ce67
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2521.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40cf50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ebf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x442df8], 0x10
jl 0x40cfab
push 0x442dfc
call fcn.0041fe10
mov ecx, dword [0x442df4]
add esp, 4
test ecx, ecx
je 0x40cf9d
mov eax, dword [ecx]
mov dword [0x442df4], eax
mov dword [0x442dfc], 1
test ecx, ecx
jne 0x40cfca
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40cfca
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2521.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2521.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d280
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ebad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x442df8], 0x10
jl 0x40d2d8
push 0x442dfc
call fcn.0041fe10
mov ecx, dword [0x442df4]
add esp, 4
test ecx, ecx
je 0x40d2ca
mov eax, dword [ecx]
mov dword [0x442df4], eax
mov dword [0x442dfc], 1
test ecx, ecx
jne 0x40d2f7
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40d2f7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2525.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40d3d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ebf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x442df8], 0x10
jl 0x40d42b
push 0x442dfc
call fcn.0041fe10
mov ecx, dword [0x442df4]
add esp, 4
test ecx, ecx
je 0x40d41d
mov eax, dword [ecx]
mov dword [0x442df4], eax
mov dword [0x442dfc], 1
test ecx, ecx
jne 0x40d44a
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40d44a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2525.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2525.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d6b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ebad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x442df8], 0x10
jl 0x40d708
push 0x442dfc
call fcn.0041fe10
mov ecx, dword [0x442df4]
add esp, 4
test ecx, ecx
je 0x40d6fa
mov eax, dword [ecx]
mov dword [0x442df4], eax
mov dword [0x442dfc], 1
test ecx, ecx
jne 0x40d727
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40d727
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2523.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40d800
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ebf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x442df8], 0x10
jl 0x40d85b
push 0x442dfc
call fcn.0041fe10
mov ecx, dword [0x442df4]
add esp, 4
test ecx, ecx
je 0x40d84d
mov eax, dword [ecx]
mov dword [0x442df4], eax
mov dword [0x442dfc], 1
test ecx, ecx
jne 0x40d87a
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40d87a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2523.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2523.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40dae0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ebad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x442df8], 0x10
jl 0x40db38
push 0x442dfc
call fcn.0041fe10
mov ecx, dword [0x442df4]
add esp, 4
test ecx, ecx
je 0x40db2a
mov eax, dword [ecx]
mov dword [0x442df4], eax
mov dword [0x442dfc], 1
test ecx, ecx
jne 0x40db57
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40db57
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2519.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40dc40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ebf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x442df8], 0x10
jl 0x40dc9b
push 0x442dfc
call fcn.0041fe10
mov ecx, dword [0x442df4]
add esp, 4
test ecx, ecx
je 0x40dc8d
mov eax, dword [ecx]
mov dword [0x442df4], eax
mov dword [0x442dfc], 1
test ecx, ecx
jne 0x40dcba
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40dcba
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n1::rg_n2519.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2519.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40dfb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ebad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x442df8], 0x10
jl 0x40e008
push 0x442dfc
call fcn.0041fe10
mov ecx, dword [0x442df4]
add esp, 4
test ecx, ecx
je 0x40dffa
mov eax, dword [ecx]
mov dword [0x442df4], eax
mov dword [0x442dfc], 1
test ecx, ecx
jne 0x40e027
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40e027
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2517.0
mov byte [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40e100
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ebf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x442df8], 0x10
jl 0x40e15b
push 0x442dfc
call fcn.0041fe10
mov ecx, dword [0x442df4]
add esp, 4
test ecx, ecx
je 0x40e14d
mov eax, dword [ecx]
mov dword [0x442df4], eax
mov dword [0x442dfc], 1
test ecx, ecx
jne 0x40e17a
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40e17a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2517.0
mov byte [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n1::rg_n2517.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov al, byte [esi + 0xc]
mov byte [ecx + 0xc], al
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret