joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429500
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7a35
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x51df40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0xc]
mov edx, edi
cmp dword [edi + 0x14], 0xf
jbe 0x429537
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x429555
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x429543
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00428b90
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x429586
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x38e38e3
je 0x42969b
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x48
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.004d4281
add esp, 4
mov dword [ebp - 0x18], eax
add eax, 8
mov ecx, eax
mov dword [ebp + 0xc], eax
push edi
call fcn.0040add0
mov edx, dword [ebp + 0xc]
lea eax, [edi + 0x18]
add edx, 0x18
mov dword [edx + 0x24], 0
mov ecx, dword [edi + 0x3c]
test ecx, ecx
je 0x42960c
cmp ecx, eax
jne 0x429602
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x3c], eax
mov ecx, dword [edi + 0x3c]
test ecx, ecx
je 0x42960c
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [edi + 0x18]
cmp ecx, eax
setne al
push eax
call edx
jmp 0x429605
mov dword [edx + 0x24], ecx
mov dword [edi + 0x3c], 0
mov eax, dword [ebx + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4df6d0]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4df6d0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x42966d
mov ecx, ebx
call fcn.0042b500
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00428b90
mov ecx, dword [eax]
jmp 0x429670
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push esi
mov ecx, ebx
call fcn.0042b410
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x4297c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7a93
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x51df40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [esi], 0
push 0x24
mov dword [ebp - 0x18], ebx
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.004d4281
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
mov byte [ebp - 4], 1
push 0x10
call fcn.0042ab00
mov dword [ebp - 4], 2
cmp edi, ebx
je 0x42996b
nop dword [eax + eax]
movzx eax, byte [edi]
mov ecx, esi
xor eax, 0x811c9dc5
imul ebx, eax, 0x1000193
lea eax, [ebp - 0x24]
push ebx
push edi
push eax
call fcn.00428c20
cmp dword [ebp - 0x20], 0
jne 0x42995f
cmp dword [esi + 8], 0x71c71c7
je 0x429981
lea eax, [esi + 4]
mov dword [ebp - 0x2c], eax
push 0x24
mov byte [ebp - 4], 3
mov dword [ebp - 0x28], 0
call fcn.004d4281
mov cl, byte [edi]
lea edx, [edi + 4]
mov dword [ebp - 0x14], eax
add esp, 4
mov dword [ebp - 0x28], eax
add eax, 8
mov dword [ebp - 0x10], eax
push edx
mov byte [eax], cl
lea ecx, [eax + 4]
call fcn.0040add0
mov eax, dword [esi + 8]
inc eax
mov byte [ebp - 4], 4
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4df6d0]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4df6d0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
seta al
test al, al
je 0x429945
mov ecx, esi
call fcn.0042b590
push ebx
push dword [ebp - 0x10]
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
call fcn.00428c20
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
jmp 0x429948
mov ecx, dword [ebp - 0x24]
push dword [ebp - 0x14]
mov dword [ebp - 0x28], 0
push ecx
push ebx
mov ecx, esi
call fcn.0042b410
mov byte [ebp - 4], 2
add edi, 0x1c
cmp edi, dword [ebp - 0x18]
jne 0x429870
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x42ac50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 4], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x42adaa
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.0042ab00
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x42ad7d
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 8], edx
cmp edi, esi
jne 0x42ad03
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x42ad73
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x42ad3d
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x42ad35
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
jmp 0x42ad70
cmp edi, edx
je 0x42ad4d
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x42ad86
cmp edi, edx
jne 0x42ad41
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, ecx
cmp ecx, esi
jne 0x42acb2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x42ad70
push str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x42afb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 8], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x42b0ea
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
mov dword [ebp - 0xc], ecx
lea eax, [edi + edi]
push eax
call fcn.0042ab00
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x42b0bd
mov bl, byte [eax + 8]
mov edi, dword [ebp - 8]
mov ecx, dword [ecx]
movzx edx, bl
xor edx, 0x811c9dc5
mov edi, dword [edi + 0x18]
imul edx, edx, 0x1000193
and edi, edx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 4], edx
cmp edi, esi
jne 0x42b049
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x42b0b3
mov edx, dword [edx + 4]
cmp bl, byte [edx + 8]
jne 0x42b080
mov edx, dword [edx]
mov dword [ebp - 0x10], edx
cmp edx, eax
je 0x42b078
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0x10]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x42b0b3
cmp edi, edx
je 0x42b090
mov edx, dword [edx + 4]
cmp bl, byte [edx + 8]
je 0x42b0c6
cmp edi, edx
jne 0x42b084
mov ebx, dword [eax + 4]
mov dword [ebp - 0x10], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0x10]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
jne 0x42b015
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0x10], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x42b0b3
push str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x42b7e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x42b97a
cmp dword [edx + 0x1c], 0xf
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jbe 0x42b81b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
test eax, eax
je 0x42b844
mov ecx, eax
nop dword [eax]
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x42b830
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.0042a510
push 0x48
push edi
call fcn.004d42b1
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x42b8a9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x42b860
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x42b898
mov edx, dword [ebp - 0xc]
mov dword [edx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x42b8bb
mov ecx, dword [ebp - 0x18]
mov dword [edx], ecx
jmp 0x42b8be
mov ecx, dword [ebp - 8]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x42b96d
nop dword [eax]
cmp dword [esi + 0x1c], 0xf
lea edi, [esi + 8]
mov ebx, dword [edi + 0x10]
jbe 0x42b8de
mov edi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x42b904
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x42b8f0
mov eax, dword [ebp - 4]
and edx, dword [eax + 0x18]
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.0042a510
push 0x48
push edi
call fcn.004d42b1
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x42b957
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x42b916
mov ecx, dword [ebp + 8]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x42b8d0
mov eax, dword [ebp - 8]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x42e970
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
push esi
push edi
xor edx, eax
mov edi, ecx
imul ecx, edx, 0x1000193
mov eax, ebx
shr eax, 0x10
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [edi + 0x2b0]
xor eax, ebx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00428b20
mov esi, dword [eax + 4]
test esi, esi
jne 0x42e9d8
mov esi, dword [edi + 0x2b4]
mov edx, dword [edi + 0x2b4]
cmp esi, edx
je 0x42ea89
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 0x2c8]
and ecx, eax
mov eax, dword [edi + 0x2bc]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x42ea44
cmp eax, esi
jne 0x42ea3c
mov dword [ecx], edx
mov dword [ecx + 4], edx
jmp 0x42ea4c
mov edx, dword [esi + 4]
mov dword [ecx + 4], edx
jmp 0x42ea4c
cmp eax, esi
jne 0x42ea4c
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edi + 0x2b8]
lea edi, [esi + 0x10]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x42ea7e
mov edx, dword [ecx]
cmp ecx, edi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [edi + 0x24], 0
push 0x38
push esi
call fcn.004d42b1
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42f1e0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d80ec
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x51df40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov dword [ebp - 0x10], eax
mov byte [eax], 0
mov dword [eax + 0x18], 0xffffffff
movups xmmword [eax + 0x1c], xmm0
mov dword [eax + 0x2c], 4
mov dword [eax + 0x30], 0xf
mov dword [eax + 0x1c], 0x70747468
mov byte [eax + 0x20], 0
movups xmmword [eax + 0x34], xmm0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0xf
mov byte [eax + 0x34], 0
lea edi, [eax + 0x50]
mov dword [ebp - 4], 1
lea ecx, [edi + 0x860]
mov dword [ebp - 0x18], edi
mov dword [edi], 0x4e0ba0
mov dword [edi + 0x10], 0x4e0ba8
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::constructor_void_]
push 0
lea esi, [edi + 0x18]
mov byte [ebp - 4], 2
push esi
mov ecx, edi
mov dword [ebp - 0x10], 1
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char____]
mov eax, dword [edi]
mov dword [ebp - 4], 3
mov dword [ebp - 0x1c], esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.bell::SocketStream.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x860]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
mov dword [esi], vtable.bell::SocketBuffer.0
mov dword [esi + 0x38], 0
mov dword [esi + 0x38], 0
mov edi, dword [ebp - 0x14]
push 0x400
mov byte [ebp - 4], 4
mov dword [edi + 0xaf8], 0x400
mov dword [edi + 0xafc], 0
mov dword [edi + 0xb00], 0
mov dword [edi + 0xb04], 0
call fcn.004d4281
mov dword [edi + 0xafc], eax
add eax, 0x400
push 0x400
mov dword [edi + 0xb04], eax
mov esi, dword [edi + 0xafc]
push 0
push esi
call sub.VCRUNTIME140.dll_memset
lea eax, [esi + 0x400]
add esp, 0x10
mov dword [edi + 0xb00], eax
mov eax, edi
mov dword [edi + 0xb08], 0
mov dword [edi + 0xb0c], 0
mov dword [edi + 0xb10], 0
mov dword [edi + 0xb18], 0
mov byte [edi + 0xb1c], 0
mov dword [edi + 0xb20], 0
mov dword [edi + 0xb24], 0
mov dword [edi + 0xb28], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x431170
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d83ad
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x51df40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
xor ecx, ecx
xor edi, edi
mov dword [ebp - 0x10], ecx
test edx, edx
je 0x43123d
nop dword [eax]
sub edx, ecx
add ecx, dword [ebp + 8]
push 0
push edx
push ecx
push dword [ebx + 0x28]
mov dword [ebp - 0x14], edx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jg 0x43122a
nop dword [eax + eax]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
je 0x4311fd
cmp eax, 0x2714
je 0x43122a
sub eax, 4
je 0x43122a
sub eax, 7
je 0x4311fd
sub eax, 0x7f
je 0x4311fd
mov eax, edi
inc edi
cmp eax, 4
jg 0x431256
jmp 0x43120f
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x431251
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test al, al
jne 0x431271
mov eax, dword [ebp - 0x10]
add eax, dword [ebp + 8]
push 0
push dword [ebp - 0x14]
push eax
push dword [ebx + 0x28]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jle 0x4311d0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
add ecx, esi
mov dword [ebp - 0x10], ecx
cmp ecx, edx
jb 0x4311b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
push str.Error_in_read
lea ecx, [ebp - 0x20]
call fcn.004309c0
push 0x516938
lea eax, [ebp - 0x20]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
mov eax, dword [0x5209ac]
push str.Connection_lost__will_need_to_reconnect...
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 8], esp
mov eax, dword [eax]
push str.cspot
mov esi, dword [eax + 4]
call fcn.0040ae80
push 0x92
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
push str.D:UsersphiliDropboxDevelopmentSpotConnectcommoncspotcspot_srcPlainConnection.cpp
call fcn.0040ae80
push dword [0x5209ac]
mov dword [ebp - 4], 0xffffffff
call esi
add esp, 0x3c
lea ecx, [ebp - 0x2c]
push str.Reconnection_required
call fcn.004309c0
push 0x516938
lea eax, [ebp - 0x2c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x4313f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d842e
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x51df40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov edx, dword [edi + 4]
sub edx, dword [edi]
mov eax, dword [ebx + 4]
add edx, 4
sub eax, dword [ebx]
add eax, edx
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov esi, eax
mov eax, dword [ebp + 8]
push 4
mov ecx, eax
mov dword [ebp + 0xc], esi
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
call fcn.00416610
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [eax], esi
add eax, 4
mov dword [edx + 4], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ecx
mov dword [ebp - 4], 0
push eax
push ecx
push dword [edx]
mov ecx, edx
mov dword [ebp - 0x14], 3
call fcn.00428e10
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
mov ebx, dword [ebp + 8]
sub eax, ecx
push eax
push ecx
mov ecx, ebx
push dword [ebx + 4]
call fcn.00428e10
mov eax, dword [ebx + 4]
xor edi, edi
xor esi, esi
sub eax, dword [ebx]
je 0x431548
nop dword [eax]
mov eax, dword [ebx + 4]
mov ecx, 0x40
mov edx, dword [ebx]
sub eax, edi
sub eax, edx
cmp eax, ecx
push 0
cmovb ecx, eax
lea eax, [edx + edi]
push ecx
push eax
mov eax, dword [ebp - 0x10]
push dword [eax + 0x28]
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x431539
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
je 0x43151a
cmp eax, 0x2714
je 0x431536
sub eax, 4
je 0x431536
sub eax, 7
je 0x43151a
sub eax, 0x7f
je 0x43151a
mov eax, esi
inc esi
cmp eax, 4
jg 0x431563
jmp 0x4314c0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x43155e
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test al, al
je 0x4314c0
push str.Reconnection_required
jmp 0x431568
mov eax, dword [ebp + 0xc]
add edi, eax
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
cmp edi, eax
jb 0x4314c0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
push str.Error_in_write
lea ecx, [ebp - 0x20]
call fcn.004309c0
push 0x516938
lea eax, [ebp - 0x20]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x431580
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor ecx, ecx
xor esi, esi
mov dword [ebp - 4], ecx
mov edx, dword [edi + 4]
mov eax, edx
mov edi, dword [edi]
sub eax, edi
je 0x431635
mov eax, dword [ebp + 8]
push 0
mov edx, dword [eax]
mov eax, dword [eax + 4]
sub eax, edx
sub eax, ecx
mov ecx, 0x40
cmp eax, ecx
cmovb ecx, eax
mov eax, dword [ebp - 4]
push ecx
add eax, edx
push eax
push dword [ebx + 0x28]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jg 0x431619
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
je 0x431602
cmp eax, 0x2714
je 0x431619
sub eax, 4
je 0x431619
sub eax, 7
je 0x431602
sub eax, 0x7f
je 0x431602
mov eax, esi
inc esi
cmp eax, 4
jg 0x43164e
mov ecx, dword [ebp - 4]
jmp 0x4315a4
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x431649
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test al, al
jne 0x431642
mov ecx, dword [ebp - 4]
jmp 0x4315a4
mov ecx, dword [ebp - 4]
add ecx, edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [edi + 4]
mov eax, edx
mov edi, dword [edi]
sub eax, edi
cmp ecx, eax
jb 0x4315a4
sub edx, edi
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.Reconnection_required
jmp 0x431653
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
push str.Error_in_write
lea ecx, [ebp - 0x10]
call fcn.004309c0
push 0x516938
lea eax, [ebp - 0x10]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3