joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10225360
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102edf76
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.bna::rpc::Account.0
mov dword [esi + 4], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov byte [ebp - 4], 3
mov eax, dword [0x103be3bc]
cmp eax, 2
je 0x102253fe
mov dword [ebp - 0x1c], 0x10305578
mov dword [ebp - 0x18], 0x1027f240
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 4
mov ecx, 0x103be3bc
call fcn.1027f1d0
mov eax, dword [0x103be3c0]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x2c], eax
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x44], 1
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10227e00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102de700
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.bna::rpc::InstallInfo.0
mov dword [esi + 4], 0
mov byte [ebp - 4], 1
mov eax, dword [0x103be3bc]
cmp eax, 2
je 0x10227e66
mov dword [ebp - 0x1c], 0x10305578
mov dword [ebp - 0x18], 0x1027f240
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 2
mov ecx, 0x103be3bc
call fcn.1027f1d0
mov eax, dword [0x103be3c0]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x10], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x44], eax
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov byte [esi + 0x54], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 8], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10228050
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102ee032
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push 0x88
call fcn.102d8574
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.bna::rpc::InstallInfo.0
mov dword [esi + 4], 0
mov byte [ebp - 4], 2
mov eax, dword [0x103be3bc]
cmp eax, 2
je 0x102280c3
mov dword [ebp - 0x1c], 0x10305578
mov dword [ebp - 0x18], 0x1027f240
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 3
mov ecx, 0x103be3bc
call fcn.1027f1d0
mov eax, dword [0x103be3c0]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x10], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x44], eax
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov byte [esi + 0x54], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 8], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x102281b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x10228227
xorps xmm0, xmm0
movups xmmword [esi + 0x18], xmm0
movq qword [esi + 0x2c], xmm0
mov dword [esi + 0x34], 0
mov byte [esi + 0x38], 0
test byte [esi + 8], 1
je 0x102281f5
mov eax, dword [esi + 0x10]
cmp eax, dword [0x103be3c0]
je 0x102281f5
cmp dword [eax + 0x14], 0x10
mov ecx, eax
jb 0x102281eb
mov ecx, dword [eax]
mov dword [eax + 0x10], 0
mov byte [ecx], 0
mov eax, dword [esi + 8]
shr eax, 3
test al, 1
je 0x10228227
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x10228227
test byte [ecx + 8], 0x3f
je 0x10228218
movups xmmword [ecx + 0x10], xmm0
movups xmmword [ecx + 0x20], xmm0
mov byte [ecx + 0x30], 0
mov dword [ecx + 8], 0
add ecx, 4
call fcn.100651d0
test dword [esi + 8], 0xff00
je 0x102282c3
xor eax, eax
xorps xmm0, xmm0
mov word [esi + 0x39], ax
mov byte [esi + 0x3b], al
movq qword [esi + 0x48], xmm0
mov byte [esi + 0x50], al
mov eax, dword [esi + 8]
shr eax, 0xb
test al, 1
je 0x10228271
mov eax, dword [esi + 0x3c]
cmp eax, dword [0x103be3c0]
je 0x10228271
cmp dword [eax + 0x14], 0x10
mov ecx, eax
jb 0x10228267
mov ecx, dword [eax]
mov dword [eax + 0x10], 0
mov byte [ecx], 0
mov eax, dword [esi + 8]
shr eax, 0xc
test al, 1
je 0x1022829a
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x1022829a
movups xmmword [ecx + 0x10], xmm0
movq qword [ecx + 0x20], xmm0
mov dword [ecx + 8], 0
add ecx, 4
call fcn.100651d0
mov eax, dword [esi + 8]
shr eax, 0xd
test al, 1
je 0x102282c3
mov eax, dword [esi + 0x44]
cmp eax, dword [0x103be3c0]
je 0x102282c3
cmp dword [eax + 0x14], 0x10
mov ecx, eax
jb 0x102282b9
mov ecx, dword [eax]
mov dword [eax + 0x10], 0
mov byte [ecx], 0
test dword [esi + 8], 0xff0000
je 0x102282dc
push 0x27
lea eax, [esi + 0x51]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xorps xmm0, xmm0
lea ecx, [esi + 4]
movups xmmword [esi + 0x78], xmm0
mov dword [esi + 8], 0
pop esi
jmp fcn.100651d0
Function at 0x10243a60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102de700
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.bna::rpc::Friend.0
mov dword [esi + 4], 0
mov byte [ebp - 4], 1
mov eax, dword [0x103be3bc]
cmp eax, 2
je 0x10243ac6
mov dword [ebp - 0x1c], 0x10305578
mov dword [ebp - 0x18], 0x1027f240
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 2
mov ecx, 0x103be3bc
call fcn.1027f1d0
mov eax, dword [0x103be3c0]
xorps xmm0, xmm0
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x2c], 0
mov word [esi + 0x30], 0
movsd qword [esi + 0x38], xmm0
mov dword [esi + 8], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10243c80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102e11df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push 0x40
call fcn.102d8574
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.bna::rpc::Friend.0
mov dword [esi + 4], 0
mov byte [ebp - 4], 2
mov eax, dword [0x103be3bc]
cmp eax, 2
je 0x10243cf0
mov dword [ebp - 0x1c], 0x10305578
mov dword [ebp - 0x18], 0x1027f240
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 3
mov ecx, 0x103be3bc
call fcn.1027f1d0
mov eax, dword [0x103be3c0]
xorps xmm0, xmm0
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x2c], 0
mov word [esi + 0x30], 0
movsd qword [esi + 0x38], xmm0
mov dword [esi + 8], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10248120
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102de700
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.bna::rpc::ErrorData.0
mov dword [esi + 4], 0
mov byte [ebp - 4], 1
mov eax, dword [0x103be3bc]
cmp eax, 2
je 0x10248186
mov dword [ebp - 0x1c], 0x10305578
mov dword [ebp - 0x18], 0x1027f240
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 2
mov ecx, 0x103be3bc
call fcn.1027f1d0
mov eax, dword [0x103be3c0]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x38], 0
mov dword [esi + 8], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1024e2e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102e11df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push 0x40
call fcn.102d8574
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.bna::rpc::ApplicationState.0
mov dword [esi + 4], 0
mov byte [ebp - 4], 2
mov eax, dword [0x103be3bc]
cmp eax, 2
je 0x1024e350
mov dword [ebp - 0x1c], 0x10305578
mov dword [ebp - 0x18], 0x1027f240
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 3
mov ecx, 0x103be3bc
call fcn.1027f1d0
mov eax, dword [0x103be3c0]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x14], 0
mov word [esi + 0x3c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 8], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10280010
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, dword [eax]
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10280020
sub eax, edx
mov edi, 0x811c9dc5
mov edx, 0
je 0x10280046
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, eax
jb 0x10280035
and edi, 0x7fffffff
mov eax, 0x69c16bd
mul edi
mov esi, edi
mov eax, edi
sub esi, edx
mov ecx, 0x1f31d
shr esi, 1
add esi, edx
xor edx, edx
div ecx
shr esi, 0x10
imul eax, esi, 0xb14
imul ecx, edx, 0x41a7
pop edi
pop esi
sub ecx, eax
lea eax, [ecx + 0x7fffffff]
cmovns eax, ecx
pop ebp
ret 4

Function at 0x102821b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 0x10
jb 0x102821c0
mov esi, dword [esi]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x102821c5
sub eax, edx
mov edi, 0x811c9dc5
mov edx, 0
je 0x102821f1
nop word [eax + eax]
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, eax
jb 0x102821e0
and edi, 0x7fffffff
mov eax, 0x69c16bd
mul edi
mov esi, edi
mov eax, edi
sub esi, edx
mov ecx, 0x1f31d
shr esi, 1
add esi, edx
xor edx, edx
div ecx
shr esi, 0x10
imul eax, esi, 0xb14
imul ecx, edx, 0x41a7
pop edi
pop esi
sub ecx, eax
lea eax, [ecx + 0x7fffffff]
cmovns eax, ecx
pop ebp
ret 4
Function at 0x102880d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102f22cc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov byte [edi + 0x18], 0
movups xmmword [edi + 0x1c], xmm0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
lea esi, [edi + 0x3c]
mov byte [ebp - 4], 1
push 0x14
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.102d8574
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x44]
mov byte [ebp - 4], 2
push 0x14
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.102d8574
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x4c], 0
xorps xmm0, xmm0
movups xmmword [edi + 0x50], xmm0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0xf
mov byte [edi + 0x50], 0
mov ecx, dword [ebp - 0xc]
mov eax, edi
movups xmmword [edi + 0x68], xmm0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0xf
mov byte [edi + 0x68], 0
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x102af2f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102de700
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.google::protobuf::FieldDescriptorProto.0
mov dword [esi + 4], 0
mov byte [ebp - 4], 1
mov eax, dword [0x103be3bc]
cmp eax, 2
je 0x102af356
mov dword [ebp - 0x1c], 0x10305578
mov dword [ebp - 0x18], 0x1027f240
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 2
mov ecx, 0x103be3bc
call fcn.1027f1d0
mov eax, dword [0x103be3c0]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x10], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], eax
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 1
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x102af4c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102f44ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push 0x34
call fcn.102d8574
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.google::protobuf::FieldDescriptorProto.0
mov dword [esi + 4], 0
mov byte [ebp - 4], 2
mov eax, dword [0x103be3bc]
cmp eax, 2
je 0x102af530
mov dword [ebp - 0x1c], 0x10305578
mov dword [ebp - 0x18], 0x1027f240
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 3
mov ecx, 0x103be3bc
call fcn.1027f1d0
mov eax, dword [0x103be3c0]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x10], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], eax
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 1
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x102b3fe0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102f4616
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
lea esi, [edi + 4]
mov dword [edi], vtable.google::protobuf::FileOptions.0
push 0x30
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.102d8574
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov byte [ebp - 4], 3
mov eax, dword [0x103be3bc]
cmp eax, 2
je 0x102b4090
mov dword [ebp - 0x20], 0x10305578
mov dword [ebp - 0x1c], 0x1027f240
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x20]
mov byte [ebp - 4], 4
mov ecx, 0x103be3bc
call fcn.1027f1d0
mov eax, dword [0x103be3c0]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x28], eax
mov eax, edi
mov dword [edi + 0x14], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 1
mov word [edi + 0x3c], 0
mov byte [edi + 0x3e], 0
mov dword [edi + 0x10], 0
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x102b5ea0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102f4666
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
lea esi, [edi + 4]
mov dword [edi], vtable.google::protobuf::FieldOptions.0
push 0x30
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.102d8574
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov byte [ebp - 4], 3
mov eax, dword [0x103be3bc]
cmp eax, 2
je 0x102b5f50
mov dword [ebp - 0x20], 0x10305578
mov dword [ebp - 0x1c], 0x1027f240
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x20]
mov byte [ebp - 4], 4
mov ecx, 0x103be3bc
call fcn.1027f1d0
mov eax, dword [0x103be3c0]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x20], eax
mov eax, edi
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x10], 0
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x102b8f20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102e28fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.google::protobuf::UninterpretedOption.0
mov dword [esi + 4], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov byte [ebp - 4], 2
mov eax, dword [0x103be3bc]
cmp eax, 2
je 0x102b8fa2
mov dword [ebp - 0x1c], 0x10305578
mov dword [ebp - 0x18], 0x1027f240
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 3
mov ecx, 0x103be3bc
call fcn.1027f1d0
mov eax, dword [0x103be3c0]
xorps xmm0, xmm0
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x20], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
movsd qword [esi + 0x38], xmm0
mov dword [esi + 8], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x102ba070
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102f4716
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.google::protobuf::SourceCodeInfo_Location.0
mov dword [esi + 4], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [ebp - 4], 3
mov eax, dword [0x103be3bc]
cmp eax, 2
je 0x102ba100
mov dword [ebp - 0x1c], 0x10305578
mov dword [ebp - 0x18], 0x1027f240
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 4
mov ecx, 0x103be3bc
call fcn.1027f1d0
mov eax, dword [0x103be3c0]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x102c2e00
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102ddb20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ecx
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x1c], eax
push esi
push edi
cmp edx, ebx
jne 0x102c2e47
mov edx, eax
call fcn.102c2c80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ecx
mov edx, 0x6d694b2f
mul edx
mov eax, ecx
mov edi, 0x12e0be82
mov esi, edx
mov ecx, 0x6d694b2f
mul edi
mov edi, eax
mov dword [ebp - 0x10], edx
mov eax, ebx
mul ecx
mov ecx, eax
mov ebx, edx
mov eax, dword [ebp + 0xc]
mov edx, 0x12e0be82
mul edx
add ecx, esi
mov dword [ebp - 0x14], eax
adc ebx, 0
add edi, ecx
mov ecx, dword [ebp - 0x10]
adc ecx, 0
xor eax, eax
add ebx, ecx
mov ecx, dword [ebp - 0x14]
adc eax, eax
add ecx, ebx
mov ebx, dword [ebp + 8]
mov esi, ebx
adc edx, eax
mov eax, dword [ebp + 0xc]
sub esi, ecx
sbb eax, edx
shrd esi, eax, 1
shr eax, 1
add esi, ecx
mov ecx, dword [ebp - 0x1c]
adc eax, edx
shrd esi, eax, 0x1d
shr eax, 0x1d
push eax
push esi
call fcn.102c2e00
mov edi, eax
imul ecx, esi, 0x3b9aca00
mov eax, 0x6b5fca6b
add esp, 8
sub ebx, ecx
mul ebx
shr edx, 0x16
movzx eax, byte [edx*2 + 0x102f9568]
mov byte [edi], al
movzx eax, byte [edx*2 + 0x102f9569]
mov byte [edi + 1], al
imul eax, edx, 0xff676980
add ebx, eax
mov eax, 0x4f8b588f
mul ebx
mov ecx, ebx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x10
movzx eax, byte [ecx*2 + 0x102f9568]
mov byte [edi + 2], al
movzx eax, byte [ecx*2 + 0x102f9569]
mov byte [edi + 3], al
imul eax, ecx, 0xfffe7960
add ebx, eax
mov eax, 0x10624dd3
mul ebx
shr edx, 6
movzx eax, byte [edx*2 + 0x102f9568]
mov byte [edi + 4], al
movzx eax, byte [edx*2 + 0x102f9569]
mov byte [edi + 5], al
imul eax, edx, 0xfffffc18
add ebx, eax
mov eax, 0xcccccccd
mul ebx
mov ecx, dword [ebp - 0xc]
shr edx, 3
movzx eax, byte [edx*2 + 0x102f9568]
mov byte [edi + 6], al
movzx eax, byte [edx*2 + 0x102f9569]
mov byte [edi + 7], al
mov al, dl
shl dl, 2
add al, dl
mov byte [edi + 9], 0
add al, al
sub bl, al
lea eax, [edi + 9]
add bl, 0x30
mov byte [edi + 8], bl
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x102c4a20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102f4d05
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov ebx, edx
lea eax, [ebp - 0x34]
push ebx
mov esi, ecx
mov dword [ebp - 0x10], ebx
push eax
mov dword [ebp - 0x14], esi
call fcn.102c4660
mov edx, dword [eax + 8]
movq xmm0, qword [eax]
movq qword [ebp - 0x28], xmm0
cmp byte [edx + 0xd], 0
jne 0x102c4a85
add edx, 0x10
mov ecx, ebx
call fcn.10061a00
test al, al
js 0x102c4a85
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 4], 0x4ec4ec4
je 0x102c4b07
mov ebx, dword [esi]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
push 0x34
mov dword [ebp - 0x18], 0
call fcn.102d8574
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
push dword [ebp - 0x10]
lea ecx, [edi + 0x10]
mov dword [ebp - 4], 1
call fcn.100080f0
mov ecx, dword [ebp - 0x10]
push edi
mov eax, dword [ecx + 0x18]
mov dword [edi + 0x28], eax
mov eax, dword [ecx + 0x1c]
mov ecx, dword [ecx + 0x20]
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], ecx
push dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x28]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov word [edi + 0xc], 0
call fcn.1001c370
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10017070
int3