joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c650
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006d855
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x10093948], 0x250
jl 0x1001c6af
push 0x1009394c
call fcn.100433c0
mov esi, dword [0x10093944]
add esp, 4
test esi, esi
je 0x1001c6a1
mov eax, dword [esi]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test esi, esi
jne 0x1001c6c9
push 0x250
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1001c706
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.1001e030
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_sdk_QuanJuBianLiang::rg_JinChengShuJieGouLei.0
call fcn.10007330
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3

Function at 0x1001c8e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100683ed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10093948], 0x7c
jl 0x1001c938
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x1001c92a
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x1001c94f
push 0x7c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001c974
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.1001d480
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3

Function at 0x1001ca50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006d8f5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x10093948], 0x7c
jl 0x1001caac
push 0x1009394c
call fcn.100433c0
mov esi, dword [0x10093944]
add esp, 4
test esi, esi
je 0x1001ca9e
mov eax, dword [esi]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test esi, esi
jne 0x1001cac3
push 0x7c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1001cb00
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.1001d480
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_sdk_QuanJuBianLiang::rg_CallbackInfoLei.0
call fcn.1001cbe0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3
Function at 0x1001ed60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006dc2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10093948], 0x10
jl 0x1001edb8
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x1001edaa
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x1001edcf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001ee20
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_BianZhengShuLei.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3

Function at 0x1001eeb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006dc75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10093948], 0x10
jl 0x1001ef0b
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x1001eefd
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x1001ef22
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001ef90
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_BianZhengShuLei.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_BianZhengShuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3
Function at 0x1001f270
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006dc2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10093948], 0x18
jl 0x1001f2c8
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x1001f2ba
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x1001f2df
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001f331
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_XiaoShuLei.0
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3

Function at 0x1001f3f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006dc75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10093948], 0x18
jl 0x1001f44b
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x1001f43d
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x1001f462
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001f4d5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_XiaoShuLei.0
movsd qword [ecx + 0x10], xmm0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_XiaoShuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
movsd xmm0, qword [esi + 0x10]
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3
Function at 0x1001f7a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006dc2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10093948], 0x10
jl 0x1001f7f8
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x1001f7ea
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x1001f80f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001f860
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_LuoJiXingLei.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3

Function at 0x1001f8f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006dc75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10093948], 0x10
jl 0x1001f94b
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x1001f93d
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x1001f962
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001f9d0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_LuoJiXingLei.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_LuoJiXingLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3
Function at 0x1001fbd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006dc2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10093948], 0x18
jl 0x1001fc28
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x1001fc1a
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x1001fc3f
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1001fc97
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_ChangZhengShuLei.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3

Function at 0x1001fd30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006dc75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10093948], 0x18
jl 0x1001fd8b
push 0x1009394c
call fcn.100433c0
mov edx, dword [0x10093944]
add esp, 4
test edx, edx
je 0x1001fd7d
mov eax, dword [edx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test edx, edx
jne 0x1001fda2
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x1001fe1d
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov dword [edx], vtable.CVolObject.0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [ebp - 4], 1
mov dword [edx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.rg_HuoShan_JiBen::rg_ChangZhengShuLei.0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov byte [ebp - 4], 3
mov dword [edx], vtable.rg_HuoShan_JiBen::rg_ChangZhengShuLei.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3
Function at 0x10020080
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006dc2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10093948], 0x10
jl 0x100200d8
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x100200ca
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x100200ef
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10020140
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_ZhengShuLei.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3

Function at 0x100201d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006dc75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10093948], 0x10
jl 0x1002022b
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x1002021d
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x10020242
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100202b0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_ZhengShuLei.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_ZhengShuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3
Function at 0x100204b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006dc2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10093948], 0x10
jl 0x10020508
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x100204fa
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x1002051f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1002056d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_ZiJieLei.0
mov byte [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3

Function at 0x10020600
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006dc75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10093948], 0x10
jl 0x1002065b
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x1002064d
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x10020672
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x100206dd
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_ZiJieLei.0
mov byte [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_ZiJieLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov al, byte [esi + 0xc]
mov byte [ecx + 0xc], al
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3
Function at 0x10020960
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006dc2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10093948], 0x10
jl 0x100209b8
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x100209aa
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x100209cf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10020a1f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_ZiFuLei.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3

Function at 0x10020ac0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006dc75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10093948], 0x10
jl 0x10020b1b
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x10020b0d
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x10020b32
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10020ba1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_ZiFuLei.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_ZiFuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3
Function at 0x10020df0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006dc2d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10093948], 0x10
jl 0x10020e48
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x10020e3a
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x10020e5f
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10020eaf
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_DuanZhengShuLei.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3

Function at 0x10020f50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006dc75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10091018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x10093948], 0x10
jl 0x10020fab
push 0x1009394c
call fcn.100433c0
mov ecx, dword [0x10093944]
add esp, 4
test ecx, ecx
je 0x10020f9d
mov eax, dword [ecx]
mov dword [0x10093944], eax
mov dword [0x1009394c], 1
test ecx, ecx
jne 0x10020fc2
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10021031
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_DuanZhengShuLei.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_HuoShan_JiBen::rg_DuanZhengShuLei.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.1004f89d
int3