joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4051a0
Capabilities:
Initialize winsock library

Disassembly:
push esi
push 0x40fcfc
call fcn.00401430
push 0x590
call fcn.004067b5
push 0x40fce0
mov esi, eax
call fcn.00401430
add esp, 0xc
push esi
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x4051eb
push eax
push 0x40fcb0
call fcn.00401430
push esi
call fcn.004067aa
add esp, 0xc
xor al, al
pop esi
ret
push 0x40fc98
call fcn.00401430
mov ax, word [esi]
add esp, 4
mov cl, al
xor cl, 1
jne 0x40523a
and eax, 0xffff
mov edx, eax
xor edx, 0x100
test edx, 0xffffff00
jne 0x40523a
mov ecx, eax
and eax, 0xff
shr ecx, 8
push ecx
push eax
push 0x40fc7c
call fcn.00401430
push esi
call fcn.004067aa
add esp, 0x10
mov al, 1
pop esi
ret
push 0x40fc58
call fcn.00401430
push esi
call fcn.004067aa
add esp, 8
xor al, al
pop esi
ret
Function at 0x409441
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4105e8
cmp edx, dword [eax]
je 0x409463
add eax, 8
inc ecx
cmp eax, 0x410678
jl 0x409454
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4105e8]
jne 0x409591
mov eax, dword [0x55a1d0]
cmp eax, 1
je 0x40956b
test eax, eax
jne 0x409494
cmp dword [0x410504], 1
je 0x40956b
cmp edx, 0xfc
je 0x409591
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4094cb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040aac0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004089c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40950e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004089c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40e548
push edi
call fcn.00406b90
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040aac0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040aad0
lea eax, [ebp - 0xa0]
push 0x40e528
push eax
call fcn.0040aad0
push dword [esi + 0x4105ec]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040aad0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040bc68
add esp, 0x2c
pop edi
jmp 0x409591
lea eax, [ebp + 8]
lea esi, [esi + 0x4105ec]
push 0
push eax
push dword [esi]
call fcn.004089c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401c90
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
push edi
push 0x10
push 2
mov dword [ebp - 4], 0
mov dword [ebp - 8], edi
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x401ced
mov ecx, dword [ebp - 4]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
test eax, eax
jne 0x401ceb
push str.Error_allocating_memory_needed_to_call_GetAdaptersAddresses_n
push eax
call fcn.00406c80
push eax
call fcn.0040aad0
add esp, 0xc
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
mov edi, eax
push ebx
push esi
lea edx, [ebp - 4]
push edx
push edi
push 0
push 0x10
push 2
xor bl, bl
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x401d61
mov esi, edi
test edi, edi
je 0x401db4
nop
test bl, bl
jne 0x401d76
cmp dword [esi + 0xc], 0
je 0x401d58
mov eax, dword [esi + 0x28]
test eax, eax
je 0x401d58
mov ecx, dword [ebp + 8]
push ecx
push eax
call fcn.0045f144
add esp, 8
test eax, eax
jne 0x401d58
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401d40
mov ecx, dword [ebp + 0xc]
sub eax, edi
push eax
push edx
call fcn.00401b50
mov edi, dword [ebp - 8]
mov bl, 1
mov esi, dword [esi + 8]
test esi, esi
jne 0x401d10
jmp 0x401d76
push str.GetAdaptersAddresses_failed
push 0
call fcn.00406c80
push eax
call fcn.0040aad0
add esp, 0xc
test edi, edi
je 0x401d8a
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp bl, 1
jne 0x401db4
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 0x10
jb 0x401d9a
mov eax, dword [eax]
mov edx, dword [ebp + 8]
push eax
push edx
push str.FriendlyName___S__AdapterName___s
push 2
call fcn.00406c80
push eax
call fcn.0040aad0
add esp, 0x14
pop esi
mov al, bl
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x401dc0
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x491300]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
lea esi, [ebp - 0x28c]
lea ecx, [ebp - 0x298]
push ecx
mov edx, esi
push edx
mov dword [ebp - 0x29c], eax
mov dword [ebp - 0x290], edi
mov dword [ebp - 0x298], 0x288
mov dword [ebp - 0x294], esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x401e59
mov eax, dword [ebp - 0x298]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x294], eax
test eax, eax
jne 0x401e57
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo
push eax
call fcn.00406c80
push eax
call fcn.0040aad0
add esp, 0xc
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045ea71
mov esp, ebp
pop ebp
ret
mov esi, eax
push ebx
lea ecx, [ebp - 0x298]
push ecx
push esi
xor bl, bl
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x401f00
mov edi, esi
test esi, esi
je 0x401f36
jmp 0x401e80
test bl, bl
jne 0x401ed7
cmp dword [edi + 0x1a0], 6
jne 0x401ed1
lea eax, [edi + 8]
test eax, eax
je 0x401ed1
mov edx, dword [ebp - 0x29c]
push eax
push edx
call fcn.0045f2c8
add esp, 8
test eax, eax
jne 0x401ed1
lea edx, [edi + 0x1b0]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401eb3
mov ecx, dword [ebp - 0x290]
sub eax, esi
push eax
push edx
call fcn.00401b50
mov esi, dword [ebp - 0x294]
mov bl, 1
mov edi, dword [edi]
test edi, edi
jne 0x401e80
mov edi, dword [ebp - 0x290]
test esi, esi
je 0x401ef1
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp bl, 1
jne 0x401f36
cmp dword [edi + 0x14], 0x10
jb 0x401f17
mov eax, dword [edi]
jmp 0x401f19
push str.GetAdaptersInfo_failed
push 0
call fcn.00406c80
push eax
call fcn.0040aad0
add esp, 0xc
jmp 0x401edd
mov eax, edi
push eax
mov eax, dword [ebp - 0x29c]
push eax
push str.AdapterName___s__IP___s
push 2
call fcn.00406c80
push eax
call fcn.0040aad0
add esp, 0x14
mov ecx, dword [ebp - 4]
mov al, bl
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0045ea71
mov esp, ebp
pop ebp
ret
Function at 0x401f50
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x491300]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push 0x4f
lea eax, [ebp - 0x53]
push 0
push eax
mov byte [ebp - 0x54], 0
call fcn.0045ef40
add esp, 0xc
push 0x50
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x401fb4
lea edx, [ebp - 0x54]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x401fb4
mov edx, dword [eax + 0xc]
xor ecx, ecx
cmp dword [edx], ecx
je 0x401fb4
mov eax, edx
mov eax, dword [eax]
mov eax, dword [eax]
cmp al, 0xa9
jne 0x401fc5
inc ecx
cmp dword [edx + ecx*4], 0
lea eax, [edx + ecx*4]
jne 0x401fa2
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045ea71
mov esp, ebp
pop ebp
ret
push esi
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x401fd2
sub ecx, esi
push ecx
push eax
mov ecx, edi
call fcn.00401b50
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov al, 1
pop edi
call fcn.0045ea71
mov esp, ebp
pop ebp
ret
Function at 0x4079b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47659b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x491300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0045df38
push 4
mov dword [ebp - 4], 0
call fcn.0045eebb
mov edi, eax
add esp, 4
test edi, edi
je 0x407a30
call fcn.0045dc99
mov dword [edi], eax
call fcn.0045da58
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0045d98d
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x407a26
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0045d9b5
jmp 0x407a32
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408f90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x476758
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x491300]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x4090b1
cmp byte [edi + 0x49], bl
je 0x4090b1
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x4090a5
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x409005
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x40901d
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x409046
dec eax
je 0x40904a
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x4090a0
jmp 0x4090ac
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x40905a
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x409083
cmp ebx, 0x10
jae 0x409069
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.00460cb4
add esp, 0x10
cmp esi, eax
jne 0x40909d
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x4090a9
test esi, esi
jne 0x409011
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.004038f0
jmp 0x40900b
lea ecx, [ebp - 0x2c]
call fcn.004017e0
xor al, al
jmp 0x4090b3
lea ecx, [ebp - 0x2c]
call fcn.004017e0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045ea71
mov esp, ebp
pop ebp
ret
Function at 0x40a890
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4768e7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x491300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], eax
je 0x40a8de
mov dword [ebx], 0x47cadc
mov dword [ebx + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov edx, dword [ebx]
mov edi, dword [edx + 4]
add edi, ebx
mov ecx, edi
call fcn.00406f70
lea esi, [ebx + 4]
push 0x20
mov ecx, edi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], 0
call fcn.00408190
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x40a92a
mov eax, dword [edi + 0xc]
or eax, 4
or eax, 4
push 0
push eax
mov ecx, edi
call fcn.00402da0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.004079b0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], 0
mov byte [esi + 0x49], 0
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
xor ecx, ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ecx
mov eax, dword [esi + 0x24]
mov dword [eax], ecx
mov edx, dword [esi + 0x34]
mov dword [edx], ecx
mov eax, dword [esi + 0x10]
mov dword [eax], ecx
mov edx, dword [esi + 0x20]
mov dword [edx], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], ecx
mov dword [esi + 0x54], ecx
mov edx, dword [0x4926e8]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b590
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push 0
push 4
mov esi, ecx
push esi
push 0x40b540
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
pop esi
test eax, eax
je 0x40b5b9
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
ret
xor al, al
ret
Function at 0x40c760
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 4]
push 2
lea eax, [ebp + 8]
push eax
push 0x1002
push 0xffff
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
pop ebp
ret 4

Function at 0x40ca30
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 2
push eax
mov eax, dword [ecx + 4]
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
pop ebp
ret 8
Function at 0x419400
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, edx
push esi
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x419410
sub eax, esi
add eax, edx
mov ecx, 0x811c9dc5
cmp edx, eax
je 0x419434
movsx esi, byte [edx]
imul ecx, ecx, 0x1000193
inc edx
xor ecx, esi
cmp edx, eax
jne 0x419424
and ecx, 0x7fffffff
push 0x1f31d
push ecx
call fcn.0046270b
imul eax, eax, 0xb14
imul edx, edx, 0x41a7
add esp, 8
sub edx, eax
pop esi
mov eax, edx
jns 0x419460
add eax, 0x7fffffff
pop ebp
ret 4
Function at 0x4285a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478cd6
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x491300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
xor ebx, ebx
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov byte [esi + 0x1c], bl
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], ebx
mov dword [ebp - 4], ebx
mov byte [esi + 0x20], bl
push 0x14
mov byte [ebp - 4], 1
mov dword [esi + 0x4c], ebx
call fcn.0045eebb
add esp, 4
cmp eax, ebx
je 0x428654
mov dword [esi + 0x48], eax
mov dword [eax], eax
mov eax, dword [esi + 0x48]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x48]
mov dword [eax + 8], eax
mov eax, dword [esi + 0x48]
mov byte [eax + 0x10], 1
mov ecx, dword [esi + 0x48]
mov byte [ecx + 0x11], 1
mov dword [esi + 0x54], ebx
mov dword [esi + 0x6c], 0xf
mov dword [esi + 0x68], ebx
mov byte [esi + 0x58], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea edx, [ebp + 8]
push edx
lea ecx, [ebp - 0x1c]
mov dword [ebp + 8], ebx
call fcn.0045e1d6
push 0x488c7c
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], vtable.std::bad_alloc.0
call fcn.0045ea80
int3
Function at 0x429ab0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
cmp esi, dword [eax]
jne 0x429adf
cmp ecx, eax
jne 0x429adf
mov ecx, ebx
call fcn.00428b40
mov eax, dword [ebx + 4]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 0xc
cmp esi, ecx
je 0x429bbd
push edi
mov edx, dword [esi]
mov dword [ebp + 0xc], edx
mov edx, dword [esi + 8]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x429af5
sub eax, edi
add eax, edx
mov ecx, 0x811c9dc5
cmp edx, eax
je 0x429b20
lea esp, [esp]
movsx edi, byte [edx]
imul ecx, ecx, 0x1000193
inc edx
xor ecx, edi
cmp edx, eax
jne 0x429b10
and ecx, 0x7fffffff
push 0x1f31d
push ecx
call fcn.0046270b
imul edx, edx, 0x41a7
imul eax, eax, 0xb14
add esp, 8
sub edx, eax
jns 0x429b4a
add edx, 0x7fffffff
mov ecx, dword [ebx + 0x20]
mov eax, ecx
and eax, edx
cmp dword [ebx + 0x24], eax
ja 0x429b5f
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [ebx + 0x10]
cmp dword [ecx + eax*8 + 4], esi
lea ecx, [ecx + eax*8]
jne 0x429b88
cmp dword [ecx], esi
jne 0x429b80
mov edx, dword [ebx + 4]
mov dword [ecx], edx
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 4]
mov dword [ecx + eax*8 + 4], edx
jmp 0x429b90
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x429b90
cmp dword [ecx], esi
jne 0x429b90
mov edx, dword [esi]
mov dword [ecx], edx
cmp esi, dword [ebx + 4]
je 0x429bb0
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [esi + 4]
push esi
mov dword [edx + 4], eax
call fcn.0045e38a
add esp, 4
dec dword [ebx + 8]
mov esi, dword [ebp + 0xc]
cmp esi, dword [ebp + 0x10]
jne 0x429ae8
pop edi
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x441940
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47a833
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x491300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x38
call fcn.0045eebb
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x4419c5
lea ecx, [esi + 4]
mov byte [ebp - 4], 1
mov dword [esi], vtable.google::protobuf::SourceCodeInfo_Location.0
call fcn.0041a150
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov eax, 0x4905e0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4426a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47a7f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x491300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [ebp - 4], edi
mov dword [esi], vtable.google::protobuf::FileDescriptorProto.0
call fcn.0041a150
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov eax, 0x4905e0
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x80], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x84], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x442b20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47a7f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x491300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [ebp - 4], edi
mov dword [esi], vtable.google::protobuf::DescriptorProto.0
call fcn.0041a150
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x60], edi
mov dword [esi + 8], 0x4905e0
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x444b20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47a7f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x491300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
lea ecx, [esi + 4]
mov dword [ebp - 4], edi
mov dword [esi], vtable.google::protobuf::UninterpretedOption.0
call fcn.0041a150
fldz
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
fstp qword [esi + 0x30]
mov eax, 0x4905e0
mov dword [esi + 0x18], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x44], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret