joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404bf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414bad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x41e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x41eb98], 0x18
jl 0x404c48
push 0x41eb9c
call fcn.0040eab0
mov ecx, dword [0x41eb94]
add esp, 4
test ecx, ecx
je 0x404c3a
mov eax, dword [ecx]
mov dword [0x41eb94], eax
mov dword [0x41eb9c], 1
test ecx, ecx
jne 0x404c67
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x404c67
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n9::rg_n2535.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x404d50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414bf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x41e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x41eb98], 0x18
jl 0x404dab
push 0x41eb9c
call fcn.0040eab0
mov edx, dword [0x41eb94]
add esp, 4
test edx, edx
je 0x404d9d
mov eax, dword [edx]
mov dword [0x41eb94], eax
mov dword [0x41eb9c], 1
test edx, edx
jne 0x404dca
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x404dca
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
mov dword [edx], vtable.CVolObject.0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [ebp - 4], 1
mov dword [edx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [edx], vtable.rg_n9::rg_n2535.0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov byte [ebp - 4], 3
mov dword [edx], vtable.rg_n9::rg_n2535.0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x405100
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414bad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x41e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x41eb98], 0x18
jl 0x405158
push 0x41eb9c
call fcn.0040eab0
mov ecx, dword [0x41eb94]
add esp, 4
test ecx, ecx
je 0x40514a
mov eax, dword [ecx]
mov dword [0x41eb94], eax
mov dword [0x41eb9c], 1
test ecx, ecx
jne 0x405177
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x405177
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_n9::rg_n2539.0
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x405280
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414bf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x41e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x41eb98], 0x18
jl 0x4052db
push 0x41eb9c
call fcn.0040eab0
mov ecx, dword [0x41eb94]
add esp, 4
test ecx, ecx
je 0x4052cd
mov eax, dword [ecx]
mov dword [0x41eb94], eax
mov dword [0x41eb9c], 1
test ecx, ecx
jne 0x4052fa
push 0x18
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4052fa
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ecx], vtable.rg_n9::rg_n2539.0
movsd qword [ecx + 0x10], xmm0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n9::rg_n2539.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
movsd xmm0, qword [esi + 0x10]
movsd qword [ecx + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x405620
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414bad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x41e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x41eb98], 0x10
jl 0x405678
push 0x41eb9c
call fcn.0040eab0
mov ecx, dword [0x41eb94]
add esp, 4
test ecx, ecx
je 0x40566a
mov eax, dword [ecx]
mov dword [0x41eb94], eax
mov dword [0x41eb9c], 1
test ecx, ecx
jne 0x405697
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x405697
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n9::rg_n2541.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x405770
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414bf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x41e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x41eb98], 0x10
jl 0x4057cb
push 0x41eb9c
call fcn.0040eab0
mov ecx, dword [0x41eb94]
add esp, 4
test ecx, ecx
je 0x4057bd
mov eax, dword [ecx]
mov dword [0x41eb94], eax
mov dword [0x41eb9c], 1
test ecx, ecx
jne 0x4057ea
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4057ea
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n9::rg_n2541.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n9::rg_n2541.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x405ae0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414bad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x41e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x41eb98], 0x10
jl 0x405b38
push 0x41eb9c
call fcn.0040eab0
mov ecx, dword [0x41eb94]
add esp, 4
test ecx, ecx
je 0x405b2a
mov eax, dword [ecx]
mov dword [0x41eb94], eax
mov dword [0x41eb9c], 1
test ecx, ecx
jne 0x405b57
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x405b57
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n9::rg_n2537.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x405c50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414bf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x41e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x41eb98], 0x10
jl 0x405cab
push 0x41eb9c
call fcn.0040eab0
mov ecx, dword [0x41eb94]
add esp, 4
test ecx, ecx
je 0x405c9d
mov eax, dword [ecx]
mov dword [0x41eb94], eax
mov dword [0x41eb9c], 1
test ecx, ecx
jne 0x405cca
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x405cca
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n9::rg_n2537.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n9::rg_n2537.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x405fe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414bad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x41e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x41eb98], 0x10
jl 0x406038
push 0x41eb9c
call fcn.0040eab0
mov ecx, dword [0x41eb94]
add esp, 4
test ecx, ecx
je 0x40602a
mov eax, dword [ecx]
mov dword [0x41eb94], eax
mov dword [0x41eb9c], 1
test ecx, ecx
jne 0x406057
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x406057
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n9::rg_n2533.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x406130
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414bf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x41e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x41eb98], 0x10
jl 0x40618b
push 0x41eb9c
call fcn.0040eab0
mov ecx, dword [0x41eb94]
add esp, 4
test ecx, ecx
je 0x40617d
mov eax, dword [ecx]
mov dword [0x41eb94], eax
mov dword [0x41eb9c], 1
test ecx, ecx
jne 0x4061aa
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4061aa
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n9::rg_n2533.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n9::rg_n2533.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x406410
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414bad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x41e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x41eb98], 0x10
jl 0x406468
push 0x41eb9c
call fcn.0040eab0
mov ecx, dword [0x41eb94]
add esp, 4
test ecx, ecx
je 0x40645a
mov eax, dword [ecx]
mov dword [0x41eb94], eax
mov dword [0x41eb9c], 1
test ecx, ecx
jne 0x406487
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x406487
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n9::rg_n2529.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x406570
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414bf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x41e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x41eb98], 0x10
jl 0x4065cb
push 0x41eb9c
call fcn.0040eab0
mov ecx, dword [0x41eb94]
add esp, 4
test ecx, ecx
je 0x4065bd
mov eax, dword [ecx]
mov dword [0x41eb94], eax
mov dword [0x41eb9c], 1
test ecx, ecx
jne 0x4065ea
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4065ea
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n9::rg_n2529.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n9::rg_n2529.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4068a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414bad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x41e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x41eb98], 0x10
jl 0x4068f8
push 0x41eb9c
call fcn.0040eab0
mov ecx, dword [0x41eb94]
add esp, 4
test ecx, ecx
je 0x4068ea
mov eax, dword [ecx]
mov dword [0x41eb94], eax
mov dword [0x41eb9c], 1
test ecx, ecx
jne 0x406917
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x406917
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n9::rg_n2531.0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4069f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414bf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x41e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x41eb98], 0x10
jl 0x406a4b
push 0x41eb9c
call fcn.0040eab0
mov ecx, dword [0x41eb94]
add esp, 4
test ecx, ecx
je 0x406a3d
mov eax, dword [ecx]
mov dword [0x41eb94], eax
mov dword [0x41eb9c], 1
test ecx, ecx
jne 0x406a6a
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x406a6a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n9::rg_n2531.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n9::rg_n2531.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x406cd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414bad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x41e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x41eb98], 0x10
jl 0x406d28
push 0x41eb9c
call fcn.0040eab0
mov ecx, dword [0x41eb94]
add esp, 4
test ecx, ecx
je 0x406d1a
mov eax, dword [ecx]
mov dword [0x41eb94], eax
mov dword [0x41eb9c], 1
test ecx, ecx
jne 0x406d47
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x406d47
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n9::rg_n2527.0
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x406e30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414bf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x41e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x41eb98], 0x10
jl 0x406e8b
push 0x41eb9c
call fcn.0040eab0
mov ecx, dword [0x41eb94]
add esp, 4
test ecx, ecx
je 0x406e7d
mov eax, dword [ecx]
mov dword [0x41eb94], eax
mov dword [0x41eb9c], 1
test ecx, ecx
jne 0x406eaa
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x406eaa
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx], vtable.rg_n9::rg_n2527.0
mov word [ecx + 0xc], ax
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n9::rg_n2527.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4071a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414bad
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x41e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x41eb98], 0x10
jl 0x4071f8
push 0x41eb9c
call fcn.0040eab0
mov ecx, dword [0x41eb94]
add esp, 4
test ecx, ecx
je 0x4071ea
mov eax, dword [ecx]
mov dword [0x41eb94], eax
mov dword [0x41eb9c], 1
test ecx, ecx
jne 0x407217
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x407217
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n9::rg_n2525.0
mov byte [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4072f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414bf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x41e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x41eb98], 0x10
jl 0x40734b
push 0x41eb9c
call fcn.0040eab0
mov ecx, dword [0x41eb94]
add esp, 4
test ecx, ecx
je 0x40733d
mov eax, dword [ecx]
mov dword [0x41eb94], eax
mov dword [0x41eb9c], 1
test ecx, ecx
jne 0x40736a
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40736a
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolBaseDataType.0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n9::rg_n2525.0
mov byte [ecx + 0xc], 0
mov byte [ebp - 4], 3
mov dword [ecx], vtable.rg_n9::rg_n2525.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov al, byte [esi + 0xc]
mov byte [ecx + 0xc], al
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret