joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a3b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 8
cmp dword [edx + 0x14], 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jb 0x43a3c8
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x43a3e6
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x43a3d4
push esi
push edx
lea eax, [ebp - 8]
mov ecx, ebx
push eax
call fcn.00439c00
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x43a40c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x43a550
push 0x24
call fcn.00455cc4
add esp, 4
mov edi, eax
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.0042de80
mov dword [edi + 0x20], 0
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0x1c]
inc ecx
movss xmm3, dword [ebx]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x45a130]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x45a130]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x43a4e9
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 8], xmm0
fld qword [ebp - 8]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [ebp - 8]
movsd xmm0, qword [ebp - 8]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.00456570
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x43a4cd
cmp eax, 0x200
jae 0x43a4cb
shl eax, 3
cmp eax, ecx
jae 0x43a4cd
mov eax, ecx
push eax
mov ecx, ebx
call fcn.0043dd80
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 8]
push eax
call fcn.00439c00
mov edx, dword [eax]
jmp 0x43a4ec
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x43a518
mov dword [ecx + eax*8], edi
jmp 0x43a53a
cmp esi, edx
jne 0x43a531
mov dword [ecx + eax*8], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x43a53e
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x43afb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0xc]
push ebx
push esi
push edi
mov edi, ecx
push edi
lea esi, [edi + 4]
mov dword [esi], 0x46c648
push eax
mov dword [edi], 0x46c640
call fcn.00443590
add esp, 4
mov ecx, eax
call fcn.004435c0
push esi
call fcn.00443c30
mov ecx, eax
call fcn.00443ec0
mov esi, dword [edi + 8]
add esi, 4
mov ecx, esi
call fcn.004307d0
cmp dword [edi + 0xc], 0
je 0x43b029
mov ecx, dword [edi + 8]
mov eax, dword [edi + 0x14]
cmp eax, dword [ecx + 0x248]
jne 0x43b029
mov eax, dword [edi + 8]
mov ecx, dword [eax + 0x14]
mov eax, dword [edi + 0xc]
push ecx
mov edx, esp
mov dword [edi + 0xc], 0
mov dword [edx], eax
mov eax, dword [ecx]
push dword [edi + 0x10]
call dword [eax + 8]
call sub.KERNEL32.dll_GetCurrentThreadId
mov ebx, eax
mov eax, dword [edi + 8]
add eax, 0x210
movzx ecx, bl
xor ecx, 0x811c9dc5
mov dword [ebp - 4], eax
imul edx, ecx, 0x1000193
mov ecx, ebx
sar ecx, 8
movzx eax, cl
mov dword [ebp - 8], ebx
xor edx, eax
mov eax, ebx
sar eax, 0x10
imul ecx, edx, 0x1000193
movzx eax, al
sar ebx, 0x18
xor ecx, eax
movzx eax, bl
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 4]
push eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00433000
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x43b10b
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x18]
and ecx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], ebx
jne 0x43b0c2
cmp eax, ebx
jne 0x43b0ba
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x43b0ca
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
jmp 0x43b0ca
cmp eax, ebx
jne 0x43b0ca
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx]
dec dword [edx + 8]
mov eax, dword [ebx + 4]
mov dword [eax], ecx
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x43b100
lea edx, [ecx + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
cmp eax, 1
jne 0x43b100
xor eax, eax
test edx, edx
cmovne eax, ecx
push eax
call fcn.00440de0
add esp, 4
push 0x10
push ebx
call fcn.00455eef
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, dword [edi + 8]
push 0
add ecx, 0x1f8
call fcn.00440120
mov esi, dword [edi + 0xc]
test esi, esi
je 0x43b139
mov ecx, esi
call fcn.004442c0
push esi
call fcn.00455d05
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43dc10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0xc], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x43dd6a
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.00433900
mov ecx, dword [ebx + 4]
lea eax, [edi - 1]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x43dd3c
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp + 8], eax
cmp ebx, esi
jne 0x43dcc3
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x43dd2f
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x43dcfa
mov eax, dword [eax]
cmp eax, ecx
je 0x43dcf2
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x43dd2f
cmp ebx, eax
je 0x43dd0c
nop
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x43dd45
cmp ebx, eax
jne 0x43dd00
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ebx, dword [ebp - 0xc]
mov ecx, edx
cmp edx, esi
jne 0x43dc72
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov esi, dword [ebp + 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x43dd2f
push str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x43fe10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x477edc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x477e94]
mov dword [ebp - 0x808], eax
cmp eax, 0xffffffff
jne 0x43feb1
lea eax, [ebp - 0x808]
push eax
call fcn.0044b0a0
add esp, 4
test al, al
jne 0x43fe47
int3
mov ecx, dword [ebp - 0x808]
cmp ecx, 0xffffffff
jne 0x43fe7f
lea eax, [ebp - 0x808]
push eax
call fcn.0044b0a0
add esp, 4
test al, al
je 0x43fe6e
cmp dword [ebp - 0x808], 0xffffffff
jne 0x43fe6f
int3
push 0xffffffffffffffff
call fcn.0044b0c0
mov ecx, dword [ebp - 0x808]
add esp, 4
mov edx, 0x477e94
or eax, 0xffffffff
lock cmpxchg dword [edx], ecx
cmp eax, 0xffffffff
je 0x43feab
push dword [ebp - 0x808]
call fcn.0044b0c0
mov eax, dword [0x477e94]
add esp, 4
mov dword [ebp - 0x808], eax
jmp 0x43feb1
mov eax, dword [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x43febd
int3
push ebx
push esi
push edi
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x804]
or eax, 3
push eax
push dword [ebp - 0x808]
call fcn.0044b0d0
push 0x800
call fcn.00455cbb
mov ebx, eax
lea esi, [ebp - 0x804]
mov ecx, 0x200
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
or ecx, 3
push ecx
push dword [ebp - 0x808]
call fcn.0044b0d0
mov ecx, dword [ebp - 4]
add esp, 0x20
mov eax, ebx
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00455cf4
mov esp, ebp
pop ebp
ret

Function at 0x43ffd0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x477e94]
cmp eax, 0xffffffff
jne 0x43ffdd
xor al, al
ret
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
cmp eax, 1
je 0x43fff1
cmp eax, 2
jne 0x43ffda
mov al, 1
ret
Function at 0x440000
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x140c
call fcn.00455ff0
mov eax, dword [0x477edc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x477e94]
cmp eax, 0xffffffff
je 0x44010e
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x44010d
push esi
push edi
and ebx, 0xfffffffc
lea eax, [ebp - 0x804]
mov ecx, 0x200
lea edi, [ebp - 0x804]
mov esi, ebx
or eax, 1
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x477e94]
push eax
push ecx
mov dword [ebp - 0x140c], ecx
call fcn.0044b0d0
push ebx
call fcn.0044b150
add esp, 0xc
call fcn.0043ff60
mov ecx, eax
mov dword [ebp - 0x1408], eax
call fcn.004307d0
push dword [ebp - 0x1408]
mov ecx, 0x300
lea edi, [ebp - 0x1404]
mov esi, 0x478590
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ebx, 0x100
xor dl, dl
lea esi, [ebp - 0x13fc]
xor edi, edi
mov ecx, dword [ebp + edi*8 - 0x804]
test ecx, ecx
je 0x4400e6
cmp dword [esi - 8], 0
je 0x4400e6
mov eax, dword [ebp + edi*8 - 0x800]
cmp eax, dword [esi]
jne 0x4400e6
mov eax, dword [esi - 4]
test eax, eax
je 0x4400e6
push ecx
mov dword [ebp + edi*8 - 0x804], 0
call eax
add esp, 4
mov dl, 1
inc edi
add esi, 0xc
cmp edi, 0x100
jl 0x4400b0
dec ebx
test ebx, ebx
jle 0x4400fb
test dl, dl
jne 0x4400a6
push 2
push dword [ebp - 0x140c]
call fcn.0044b0d0
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455cf4
mov esp, ebp
pop ebp
ret
Function at 0x441d10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x48]
lea ebx, [esi + 0x30]
push edi
mov dword [esi], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0x30]
mov dword [ebx], eax
mov eax, dword [ebp + 0x34]
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 0x38]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp + 0x28]
mov dword [esi + 0x40], eax
mov eax, dword [ebp + 0x2c]
mov dword [esi + 0x44], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x70], eax
mov eax, dword [ebp + 0x3c]
mov dword [esi + 0x78], eax
mov eax, dword [ebp + 0x40]
mov dword [esi + 0x7c], eax
mov al, byte [ebp + 0x24]
mov byte [esi + 0x80], al
mov eax, dword [ebp + 0x44]
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x48], 0
mov byte [esi + 0x50], 0
mov dword [esi + 0x74], ecx
test eax, eax
je 0x441dc4
push eax
lea ecx, [esi + 0x50]
call fcn.0044b370
mov cl, byte [esi + 0x74]
push ebx
lea eax, [esi + 0x44]
and cl, 1
push eax
movzx eax, cl
lea ecx, [esi + 0x50]
push eax
lea eax, [esi + 0x48]
push eax
call fcn.0044b980
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x44

Function at 0x4421a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x50]
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.0044bbf0
lea ebx, [esi + 0x48]
push 0
mov ecx, ebx
call fcn.0044bba0
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 0x34]
mov ecx, dword [ebp + 0x48]
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 0x38]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp + 0x28]
mov dword [esi + 0x40], eax
mov eax, dword [ebp + 0x2c]
mov dword [esi + 0x44], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x70], eax
mov eax, dword [ebp + 0x3c]
mov dword [esi + 0x78], eax
mov eax, dword [ebp + 0x40]
mov dword [esi + 0x7c], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x24], eax
mov al, byte [ebp + 0x24]
mov byte [esi + 0x80], al
mov eax, dword [ebp + 0x44]
mov dword [esi + 0x74], ecx
test eax, eax
je 0x44224d
push eax
lea ecx, [esi + 0x50]
call fcn.0044b370
mov cl, byte [esi + 0x74]
lea eax, [esi + 0x30]
and cl, 1
push eax
lea eax, [esi + 0x44]
push eax
movzx eax, cl
lea ecx, [esi + 0x50]
push eax
push ebx
call fcn.0044b980
pop edi
pop esi
pop ebx
pop ebp
ret 0x44
Function at 0x442990
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 8
cmp dword [edx + 0x14], 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jb 0x4429a8
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x4429c6
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x4429b4
push esi
push edx
lea eax, [ebp - 8]
mov ecx, ebx
push eax
call fcn.00439c00
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4429ec
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x7ffffff
je 0x442add
push 0x20
call fcn.00455cc4
add esp, 4
mov edi, eax
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.0042de80
mov ecx, dword [ebx + 8]
inc ecx
mov eax, ecx
shr eax, 0x1f
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x45a130]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x45a130]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x442a76
push ecx
mov ecx, ebx
call fcn.00442f10
push eax
mov ecx, ebx
call fcn.0043dd80
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 8]
push eax
call fcn.00439c00
mov edx, dword [eax]
jmp 0x442a79
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x442aa5
mov dword [ecx + eax*8], edi
jmp 0x442ac7
cmp esi, edx
jne 0x442abe
mov dword [ecx + eax*8], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x442acb
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x443090
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x4431e7
mov eax, dword [ebx + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x10], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 8], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.00455eef
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x14]
je 0x44314a
cmp esi, dword [ebp + 0xc]
jne 0x443107
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x4431da
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jne 0x44315c
mov eax, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x44315f
mov eax, dword [ebp - 0x10]
mov dword [ecx + 4], eax
cmp esi, dword [ebp + 0xc]
je 0x4431da
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + ecx*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.00455eef
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x14]
je 0x4431ee
cmp esi, dword [ebp + 0xc]
jne 0x4431b7
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [ebp - 0x10]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp esi, dword [ebp + 0xc]
jne 0x443170
mov eax, dword [ebp - 0x10]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x446070
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x477edc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push 0
push 0x382
push str..._.._3rdparty_chromium_base_files_file_util_win.cc
push 0x46e0b4
push eax
call fcn.0042c420
add esp, 0x10
lea ecx, [ebp - 0x258]
push eax
call fcn.004373e0
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x44614f
cmp eax, 0x104
ja 0x44614f
xor edx, edx
lea ecx, [ebp - 0x20c]
mov eax, ecx
cmp word [ebp - 0x20c], dx
je 0x4460fa
nop dword [eax]
lea eax, [eax + 2]
inc edx
cmp word [eax], 0
jne 0x4460f0
lea eax, [ebp - 0x224]
push eax
push edx
push ecx
lea ecx, [ebp - 0x23c]
call fcn.0042c4b0
mov ecx, eax
call fcn.0042cce0
push eax
mov ecx, esi
call fcn.0042c540
lea ecx, [ebp - 0x224]
call fcn.0042c530
lea ecx, [ebp - 0x23c]
call fcn.0042c530
lea ecx, [ebp - 0x258]
call fcn.004375c0
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455cf4
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x258]
call fcn.004375c0
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.00455cf4
mov esp, ebp
pop ebp
ret

Function at 0x446170
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
lea eax, [ebp - 0x10]
push 0
push 0x392
push str..._.._3rdparty_chromium_base_files_file_util_win.cc
push 0x46e0cc
push eax
call fcn.0042c420
add esp, 0x10
lea ecx, [ebp - 0x2c]
push eax
call fcn.004373e0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4461a7
mov eax, dword [eax]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
lea ecx, [ebp - 0x2c]
setne bl
call fcn.004375c0
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f9a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov dword [ebp - 4], eax
jb 0x44f9bb
mov edi, dword [edx]
mov ebx, dword [edx + 0x10]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x44f9e4
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x44f9d0
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.0044eed0
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x44fa04
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8