joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x452087
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x45207d
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x451f5c
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x451f5c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x451f6f
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x452052
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x452044
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x45203b
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x451fc6
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x45200f
mov eax, 1
cmp eax, ecx
ja 0x451ffd
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, eax
add ebx, ebp
mov dword [esp + 0x2c], ebx
sub ecx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.00463dd0
lea esi, [ecx + 7]
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
cmp eax, ecx
jae 0x452036
movzx edi, byte [eax + ebx]
lea ebp, [eax + 1]
mov eax, edi
and edi, 0x7f
mov ecx, esi
shl edi, cl
or edx, edi
test al, 0x80
jne 0x452002
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
jmp 0x451fcb
call fcn.00463d70
xor eax, eax
mov ecx, eax
call fcn.00463d60
call fcn.00463dd0
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
mov eax, edi
cmp ecx, eax
jbe 0x452078
movzx esi, byte [eax + edx]
lea edi, [eax + 1]
mov eax, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
or ebx, esi
test al, 0x80
jne 0x452049
mov ecx, dword [esp + 0x18]
mov eax, edi
jmp 0x451f74
call fcn.00463d70
xor eax, eax
mov ecx, eax
call fcn.00463d60
nop
call fcn.004628d0
jmp fcn.00451f00
Function at 0x459ac0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x459b5f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00463f87
lea ecx, [0x459b70]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.004627c0
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.004628d0
jmp fcn.00459ac0
Function at 0x463b90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0xc2bac0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x46235b
je 0x4623ae
cmp ebx, 0x20
jbe 0x4623b4
cmp ebx, 0x40
jbe 0x4623fa
jmp 0x46249b
test ebx, ebx
je 0x4623a4
add eax, 0x10
test ax, 0xff0
je 0x462390
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x784a20]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x784c20]
jmp 0x462378
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x462378
pxor xmm1, xmmword [0xc2bad0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xc2bad0]
pxor xmm2, xmmword [0xc2bae0]
pxor xmm3, xmmword [0xc2baf0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xc2bad0]
pxor xmm2, xmmword [0xc2bae0]
pxor xmm3, xmmword [0xc2baf0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x4624fa
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0xc2b49b], 0
je 0x463baa
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x462320
jmp fcn.00408400
Function at 0x4061ae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x4061bd
pop dword [ebp - 0x44]
mov eax, 0x33d556c8
sub eax, 0x3394f50b
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x86e681fe
add dword [ebp - 0x54], 0xc76bc34d
mov dword [ebp - 0x50], 0x51716a7a
add dword [ebp - 0x50], 0xe0c1e1cb
mov dword [ebp - 0x4c], 0xf7d7a7a8
add dword [ebp - 0x4c], 0x54749c86
mov dword [ebp - 0x48], 0x9d872f33
sub dword [ebp - 0x48], 0x9d872f33
lea eax, [ebp - 0x54]
push eax
mov eax, 0xf3e43fd0
sub eax, 0xf3a3ce8c
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x6c7365b
sub dword [ebp - 0x54], 0x9254cd05
mov dword [ebp - 0x50], 0xfc31eec6
add dword [ebp - 0x50], 0x453a72af
mov dword [ebp - 0x4c], 0x63173225
sub dword [ebp - 0x4c], 0xffa7c5b9
mov dword [ebp - 0x48], 0x4f1207df
add dword [ebp - 0x48], 0xb0edf821
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xa8d8c7c5
sub eax, 0xa89856b5
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x36b45
push 0
call eax
mov ecx, 0xe28c7e78
sub ecx, 0xe28c3976
mov ebx, eax
mov esi, 0x655b48d6
add esi, 0x9ae8172a
add esi, dword [ebp - 0x44]
mov edx, 0x809bc94
sub dword [ebp - 0x30], 0x3834a901
mov edi, dword [esi]
mov dword [ebp - 0x1c], 0x5f48c869
xor edi, edx
add dword [ebp - 0x24], ebx
mov dword [ebx], edi
add dword [ebp - 0x40], edx
add ebx, 4
add esi, 0x722f7530
add esi, 0x8dd08ad4
loop 0x4062d9
add eax, 0x7f10d5d5
add eax, 0x80f03106
mov ebx, eax
add eax, 0x31056689
sub eax, 0x31056684
mov ecx, 0x4b38b83a
add ecx, 0xb50747c6
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x401780
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4499cd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x467f48], 0x2c
jl 0x4017d8
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x4017ca
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x4017ef
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x401814
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.004024c0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3

Function at 0x4018b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449a35
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x467f48], 0x2c
jl 0x40190d
push 0x467f4c
call fcn.00423ab0
mov edi, dword [0x467f44]
add esp, 4
test edi, edi
je 0x4018ff
mov eax, dword [edi]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test edi, edi
jne 0x401924
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x401981
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.004024c0
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.00402010
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3
Function at 0x401e00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449b15
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x467f48], 0x1c
jl 0x401e58
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x401e4a
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x401e6f
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x401ecb
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolMem.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x18], 0x40
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3

Function at 0x401ee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449b5d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x467f48], 0x1c
jl 0x401f3c
push 0x467f4c
call fcn.00423ab0
mov esi, dword [0x467f44]
add esp, 4
test esi, esi
je 0x401f2e
mov eax, dword [esi]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test esi, esi
jne 0x401f53
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x401fc3
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolMem.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0x40
mov byte [ebp - 4], 2
mov ecx, esi
push edi
mov dword [esi], vtable.CVolMem.0
call fcn.00402010
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3
Function at 0x402600
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4499cd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x467f48], 0xc
jl 0x402658
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x40264a
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x40266f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4026a5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3

Function at 0x4026b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449c75
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x467f48], 0xc
jl 0x40270b
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x4026fd
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x402722
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40276f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolObject.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3

Function at 0x402b20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4499cd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x467f48], 0x14c
jl 0x402b7b
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x402b6d
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x402b95
push 0x14c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x402bba
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00402f80
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3
Function at 0x402c40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449d45
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x467f48], 0x14c
jl 0x402c9f
push 0x467f4c
call fcn.00423ab0
mov esi, dword [0x467f44]
add esp, 4
test esi, esi
je 0x402c91
mov eax, dword [esi]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test esi, esi
jne 0x402cb9
push 0x14c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x402cf6
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00402f80
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n7793::CVolWinControl.0
call fcn.00402dc0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3

Function at 0x4035d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a025
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x467f48], 0x154
jl 0x40362c
push 0x467f4c
call fcn.00423ab0
mov esi, dword [0x467f44]
add esp, 4
test esi, esi
je 0x40361e
mov eax, dword [esi]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test esi, esi
jne 0x403646
push 0x154
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40368e
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00402f80
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n7793::CVolWinContainer.0
mov dword [esi + 0x14c], 0
mov dword [esi + 0x150], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3
Function at 0x403710
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a06d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x467f48], 0x154
jl 0x40376f
push 0x467f4c
call fcn.00423ab0
mov esi, dword [0x467f44]
add esp, 4
test esi, esi
je 0x403761
mov eax, dword [esi]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test esi, esi
jne 0x403789
push 0x154
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4037e4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00402f80
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_n7793::CVolWinContainer.0
mov dword [esi + 0x14c], 0
mov dword [esi + 0x150], 0
mov byte [ebp - 4], 2
mov ecx, esi
push edi
mov dword [esi], vtable.rg_n7793::CVolWinContainer.0
call fcn.00402dc0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3

Function at 0x403a90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4499cd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x467f48], 0x1d8
jl 0x403aeb
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x403add
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x403b05
push 0x1d8
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x403b2a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.004151d0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3

Function at 0x404070
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4499cd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x467f48], 0x27c
jl 0x4040cb
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x4040bd
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x4040e5
push 0x27c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40410a
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00415840
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3
Function at 0x404860
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a2ed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x467f48], 0x10
jl 0x4048b8
push 0x467f4c
call fcn.00423ab0
mov ecx, dword [0x467f44]
add esp, 4
test ecx, ecx
je 0x4048aa
mov eax, dword [ecx]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test ecx, ecx
jne 0x4048cf
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x404920
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolRefObject.0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 2
mov dword [ecx], vtable.rg_n1::rg_n2515.0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3

Function at 0x4049b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a335
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x46500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x467f48], 0x10
jl 0x404a0c
push 0x467f4c
call fcn.00423ab0
mov esi, dword [0x467f44]
add esp, 4
test esi, esi
je 0x4049fe
mov eax, dword [esi]
mov dword [0x467f44], eax
mov dword [0x467f4c], 1
test esi, esi
jne 0x404a27
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x404aad
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.CVolObject.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi], vtable.CVolRefObject.0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 2
mov dword [esi], vtable.rg_n1::rg_n2515.0
mov byte [ebp - 4], 3
mov dword [esi], vtable.rg_n1::rg_n2515.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x404a84
mov ecx, edi
call fcn.0040bc00
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x404a90
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0xc], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0043a4b9
int3