joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a75a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1084
call fcn.0053c780
push ebx
push esi
push edi
mov edi, ecx
lea eax, [esp + 0x38]
push 0x40
xor esi, esi
push esi
push eax
mov dword [edi], vtable.bnl::HTTPFetcherHost.0
call fcn.005530b0
add esp, 0xc
lea eax, [esp + 0x38]
lea ecx, [edi + 8]
push 0x40
push eax
call fcn.004b4cc9
mov ecx, dword [edi + 0xf0]
mov edx, eax
mov eax, dword [edi + 0xe4]
mov dword [esp + 0x34], ecx
mov ecx, dword [edi + 0xec]
push 0x36
mov dword [esp + 0x30], ecx
mov ecx, dword [edi + 0xe8]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x94]
push 0x791e50
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x80]
push str.bnl_downloader
mov dword [esp + 0x3c], str.num5xx
mov dword [esp + 0x34], str.num404
mov dword [esp + 0x2c], str.num4xx
mov dword [esp + 0x24], str.num3xx
mov dword [esp + 0x1c], 0x791e34
mov dword [esp + 0x20], edx
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], str.summaryperformance_s_s_s_s_s
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], 0x1000
mov dword [esp + 0x94], esi
mov dword [esp + 0x98], 2
call fcn.004926a2
lea edx, [esp + 0x10]
lea ecx, [esp + 0x78]
call fcn.004ae1f5
lea edx, [esp + 0x18]
mov ecx, eax
call fcn.004ae235
lea edx, [esp + 0x20]
mov ecx, eax
call fcn.004ae235
lea edx, [esp + 0x28]
mov ecx, eax
call fcn.004ae235
lea edx, [esp + 0x30]
mov ecx, eax
call fcn.004ae235
lea ecx, [esp + 0x78]
call fcn.00497453
lea ebx, [edi + 0xd0]
mov ecx, dword [ebx]
mov eax, dword [ecx]
jmp 0x4a76dd
mov edx, dword [eax + 8]
mov dword [edx + 8], esi
mov eax, dword [eax]
cmp eax, ecx
jne 0x4a76d5
lea esi, [edi + 0xd8]
mov ecx, esi
call fcn.0049674c
push 0x10
push dword [esi]
call fcn.004064ba
pop ecx
pop ecx
mov ecx, ebx
call fcn.00496716
push 0xc
push dword [ebx]
call fcn.004064ba
mov eax, dword [edi + 0xa8]
pop ecx
pop ecx
test eax, eax
je 0x4a771c
push eax
call fcn.0053b990
pop ecx
mov dword [edi], vtable.blz::atomic_ref_count_base_struct_bnl::HTTPFetcherHost_.0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b5655
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [ebp + 0xc]
sub esp, 0x2a0
mov eax, dword [ecx]
push esi
push edi
test eax, eax
je 0x4b5787
dec eax
cmp eax, 1
ja 0x4b5787
lea edx, [esp + 0x228]
call fcn.004ba6b3
push 0x80
lea eax, [esp + 0x22c]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4b5783
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
mov edi, 0x2733
cmp esi, edi
je 0x4b571e
and dword [esp + 0xc], 0
lea eax, [esp + 0x28]
and dword [esp + 0x1c], 0
lea ecx, [esp + 0xc]
push 0xf9
push 0x793d48
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], str.error_connecting_socket_descriptor__d:__s
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x200
mov dword [esp + 0x28], 4
mov dword [esp + 0x2c], str.Downloader
call fcn.00492518
push dword [ebp + 8]
lea ecx, [esp + 0x10]
call fcn.00492b4d
push eax
lea ecx, [esp + 0xc]
call fcn.004ba84a
lea ecx, [esp + 0xc]
call fcn.0042e42b
cmp esi, 0x2719
je 0x4b5787
cmp esi, 0x2740
je 0x4b577f
cmp esi, 0x2741
je 0x4b577f
cmp esi, 0x274d
jne 0x4b5742
push 9
jmp 0x4b5789
cmp esi, 0x2743
jne 0x4b574e
push 0xd
jmp 0x4b5789
cmp esi, 0x271d
jne 0x4b575a
push 8
jmp 0x4b5789
cmp esi, 0x2748
jne 0x4b5766
push 4
jmp 0x4b5789
cmp esi, 0x274c
jne 0x4b5772
push 0xc
jmp 0x4b5789
push 2
pop eax
push 0xf
cmp esi, edi
pop ecx
cmove eax, ecx
jmp 0x4b578a
push 7
jmp 0x4b5789
xor eax, eax
jmp 0x4b578a
push 6
pop eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b594f
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x244
push esi
lea eax, [esp + 8]
mov dword [esp + 8], 0x1c
push eax
lea eax, [esp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x4b5a11
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
and dword [esp + 0x2c], 0
lea ecx, [esp + 0x2c]
and dword [esp + 0x3c], 0
mov esi, eax
push 0x1f0
lea eax, [esp + 0x4c]
mov dword [esp + 0x10], esi
push 0x793d48
mov dword [esp + 0x38], str.error_getting_socket_address_for_descriptor__d:__s
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], 0x200
mov dword [esp + 0x48], 4
mov dword [esp + 0x4c], str.Downloader
call fcn.00492518
push dword [ebp + 8]
lea ecx, [esp + 0x30]
call fcn.00492b4d
push eax
lea ecx, [esp + 0x10]
call fcn.004ba84a
lea ecx, [esp + 0x2c]
call fcn.0042e42b
cmp esi, 0x2719
jne 0x4b5a00
push 6
pop eax
jmp 0x4b5a89
push 2
pop eax
push 7
cmp esi, 0x2740
pop ecx
cmove eax, ecx
jmp 0x4b5a89
push dword [ebp + 0xc]
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
call fcn.004ba81f
pop ecx
test al, al
jne 0x4b5a87
and dword [esp + 0x2c], 0
lea eax, [esp + 0x48]
and dword [esp + 0x3c], 0
lea ecx, [esp + 0x2c]
push 0x217
push 0x793d48
mov dword [esp + 0x38], str.failed_to_convert_accepted_socket_address_for_socket_descriptor__d
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], 0x200
mov dword [esp + 0x48], 4
mov dword [esp + 0x4c], str.Downloader
call fcn.00492518
push dword [ebp + 8]
lea ecx, [esp + 0x30]
call fcn.00492b4d
lea ecx, [esp + 0x2c]
call fcn.0042e42b
push 2
jmp 0x4b59fa
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4b5c0b
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
push dword [edi]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4b5d31
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
mov edi, 0x2733
cmp esi, edi
je 0x4b5cc1
and dword [ebp - 0x21c], 0
lea eax, [ebp - 0x200]
and dword [ebp - 0x20c], 0
lea ecx, [ebp - 0x21c]
push 0x28a
push 0x793d48
mov dword [ebp + 0x10], esi
mov dword [ebp - 0x218], str.error_receiving_data_from_socket_descriptor__d:__s
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], 0x200
mov dword [ebp - 0x208], 4
mov dword [ebp - 0x204], str.Downloader
call fcn.00492518
push dword [ebp + 8]
lea ecx, [ebp - 0x21c]
call fcn.00492b4d
push eax
lea ecx, [ebp + 0x10]
call fcn.004ba84a
lea ecx, [ebp - 0x21c]
call fcn.0042e42b
cmp esi, 0x271e
jne 0x4b5ce0
push 0x28c
push str.d:_buildserver_bna_2work_git_bootstrapper_repositorycontribcontrib_bnl_dl2_net_source_net_standardsocketnetwork.cpp
push str.err___10014L
call fcn.0055c77a
add esp, 0xc
cmp esi, 0x2719
je 0x4b5d2c
cmp esi, 0x2726
je 0x4b5d2c
cmp esi, edi
jne 0x4b5cf8
push 0x10
jmp 0x4b5d2e
cmp esi, 0x274d
jne 0x4b5d04
push 9
jmp 0x4b5d2e
cmp esi, 0x2746
jne 0x4b5d10
push 0xa
jmp 0x4b5d2e
cmp esi, 0x2745
jne 0x4b5d1c
push 0xb
jmp 0x4b5d2e
xor eax, eax
cmp esi, 0x2749
sete al
add eax, 2
jmp 0x4b5d50
push 6
pop eax
jmp 0x4b5d50
test esi, esi
jns 0x4b5d4c
push 0x2da
push str.d:_buildserver_bna_2work_git_bootstrapper_repositorycontribcontrib_bnl_dl2_net_source_net_standardsocketnetwork.cpp
push str.r___0
call fcn.0055c77a
add esp, 0xc
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x4b5d56
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
push dword [edi]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4b5e71
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
mov edi, 0x2733
cmp esi, edi
je 0x4b5e0c
and dword [ebp - 0x21c], 0
lea eax, [ebp - 0x200]
and dword [ebp - 0x20c], 0
lea ecx, [ebp - 0x21c]
push 0x2ec
push 0x793d48
mov dword [ebp + 0x10], esi
mov dword [ebp - 0x218], str.error_sending_data_to_socket_descriptor__d:__s
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], 0x200
mov dword [ebp - 0x208], 4
mov dword [ebp - 0x204], str.Downloader
call fcn.00492518
push dword [ebp + 8]
lea ecx, [ebp - 0x21c]
call fcn.00492b4d
push eax
lea ecx, [ebp + 0x10]
call fcn.004ba84a
lea ecx, [ebp - 0x21c]
call fcn.0042e42b
cmp esi, 0x271e
jne 0x4b5e2b
push 0x2ee
push str.d:_buildserver_bna_2work_git_bootstrapper_repositorycontribcontrib_bnl_dl2_net_source_net_standardsocketnetwork.cpp
push str.err___10014L
call fcn.0055c77a
add esp, 0xc
cmp esi, 0x2719
je 0x4b5e6c
cmp esi, 0x2726
je 0x4b5e6c
cmp esi, edi
jne 0x4b5e43
push 0x10
jmp 0x4b5e6e
cmp esi, 0x2746
jne 0x4b5e4f
push 0xa
jmp 0x4b5e6e
cmp esi, 0x2749
jne 0x4b5e5b
push 3
jmp 0x4b5e6e
push 2
pop eax
push 7
cmp esi, 0x2747
pop ecx
cmove eax, ecx
jmp 0x4b5e90
push 6
pop eax
jmp 0x4b5e90
test esi, esi
jns 0x4b5e8c
push 0x334
push str.d:_buildserver_bna_2work_git_bootstrapper_repositorycontribcontrib_bnl_dl2_net_source_net_standardsocketnetwork.cpp
push str.w___0
call fcn.0055c77a
add esp, 0xc
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x4b5e96
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
movzx eax, byte [ebp + 0xc]
xor eax, 1
push esi
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push 0x8004667e
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x4b5f5a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
and dword [ebp - 0x21c], 0
lea ecx, [ebp - 0x21c]
and dword [ebp - 0x20c], 0
mov esi, eax
push 0x344
lea eax, [ebp - 0x200]
mov dword [ebp + 8], esi
push 0x793d48
mov dword [ebp - 0x218], str.error_setting_socket_blocking_flag:__s
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], 0x200
mov dword [ebp - 0x208], 4
mov dword [ebp - 0x204], str.Network
call fcn.00492518
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp + 8]
call fcn.004ba84a
lea ecx, [ebp - 0x21c]
call fcn.0042e42b
cmp esi, 0x2719
je 0x4b5f55
cmp esi, 0x2726
je 0x4b5f55
push 2
jmp 0x4b5f57
push 6
pop eax
jmp 0x4b5f5c
xor eax, eax
pop esi
leave
ret 8
Function at 0x4bb0f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, 0x6b963a
call fcn.006b6d3c
sub esp, 0x224
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x10]
push esi
call fcn.004222d6
xor ebx, ebx
pop ecx
mov byte [ebp - 0xd], bl
cmp byte [edi + 0x59], bl
jne 0x4bb122
mov byte [edi + 0x58], 1
jmp 0x4bb1b0
push ebx
push 1
lea eax, [ebp - 0xd]
push eax
push dword [edi + 0xc]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4bb1b0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
mov dword [ebp - 0x230], ebx
push 0x126
lea eax, [ebp - 0x214]
mov dword [ebp - 0x22c], str.error_sending_poll_notification:__s
push 0x797140
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], 0x200
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], 4
mov dword [ebp - 0x218], str.Network
call fcn.00492518
lea eax, [ebp - 0x230]
mov dword [ebp - 0x14], edi
push eax
lea ecx, [ebp - 0x14]
call fcn.004ba84a
lea ecx, [ebp - 0x230]
call fcn.0042e42b
push esi
mov dword [ebp - 4], 1
call fcn.004222f5
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4bb554
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push esi
mov esi, ecx
push 0
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x4bb560
pop esi
jns 0x4bb602
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4bb602
and dword [ebp - 0x230], 0
lea ecx, [ebp - 0x230]
and dword [ebp - 0x220], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push 0x1f1
push 0x797140
mov dword [ebp - 0x22c], str.error_reading_from_notification_pipe:__s
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], 0x200
mov dword [ebp - 0x21c], 4
mov dword [ebp - 0x218], str.Network
call fcn.00492518
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 4]
call fcn.004ba84a
lea ecx, [ebp - 0x230]
call fcn.0042e42b
push 2
pop eax
leave
ret
xor eax, eax
leave
ret
Function at 0x4c645e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x6c014c
call fcn.006b6d3c
push ecx
push ecx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.tact_ContainerlessUpdate::PostWorkArray.0
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], ecx
mov dword [ebp - 4], ecx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], ecx
push 0xf
pop eax
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x30], eax
mov byte [edi + 0x1c], cl
mov dword [edi + 0x44], ecx
mov dword [edi + 0x48], eax
mov byte [edi + 0x34], cl
mov dword [edi + 0x54], ecx
lea esi, [edi + 0x58]
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], esi
mov dword [esi], ecx
mov dword [esi + 4], ecx
call fcn.00413f20
mov dword [esi], eax
push dword [ebp + 0x18]
mov ecx, edi
mov byte [ebp - 4], 5
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004c64e8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0x14

Function at 0x4cdd0b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov esi, edx
mov byte [esp + 0x13], 1
mov ebx, 0x1b6
mov edx, 0x8000
push ebx
call fcn.00526d70
mov edi, eax
pop ecx
cmp edi, 0xffffffff
jne 0x4cdd3d
xor al, al
jmp 0x4cddda
push ebx
mov edx, 0x8301
mov ecx, esi
call fcn.00526d70
mov dword [esp + 0x18], eax
pop ecx
cmp eax, 0xffffffff
jne 0x4cdd5d
push edi
call fcn.005721bd
pop ecx
jmp 0x4cdd36
mov ebx, 0x10000
push ebx
call fcn.0053b995
mov esi, eax
push ebx
push esi
push edi
call fcn.00574010
movzx ebx, byte [esp + 0x23]
mov ecx, eax
xor eax, eax
add esp, 0x10
cmp ecx, 0xffffffff
cmove ebx, eax
jmp 0x4cddb8
push ecx
push esi
push dword [esp + 0x1c]
call fcn.00571e41
xor ecx, ecx
movzx ebx, bl
push 0x10000
cmp eax, 0xffffffff
push esi
push edi
cmove ebx, ecx
call fcn.00574010
mov ecx, eax
movzx ebx, bl
xor edx, edx
add esp, 0x18
cmp ecx, 0xffffffff
cmove ebx, edx
test ecx, ecx
jg 0x4cdd86
push dword [esp + 0x14]
call fcn.005721bd
push edi
call fcn.005721bd
pop ecx
pop ecx
test esi, esi
je 0x4cddd8
push esi
call fcn.0053b990
pop ecx
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ce976
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push edi
mov edi, ecx
cmp dword [edi + 0x34], 0xffffffff
jne 0x4cea0d
call fcn.004ce4d6
test al, al
jne 0x4cea0d
push 0xdb
xor ebx, ebx
mov dword [ebp - 0x21c], str.FileBufferHandler___WriteToFile_error:__s
lea eax, [ebp - 0x204]
mov dword [ebp - 0x220], ebx
push str.d:_buildserver_bna_2work_git_bootstrapper_repositorycontribcontrib_bnl_tact_sourcegamemisc_handlersmemorybufferhandler.cpp
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], 0x200
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x20c], 4
mov dword [ebp - 0x208], str.FileBufferHandler
call fcn.00492518
push dword [ebp + 8]
lea ecx, [ebp - 0x220]
call fcn.004928ff
lea ecx, [ebp - 0x220]
call fcn.0042e42b
xor al, al
jmp 0x4ceba2
push esi
push 0x2000
call fcn.0053b995
mov ecx, dword [ebp + 8]
mov edx, 0x8301
mov esi, eax
mov dword [esp], 0x1b6
call fcn.00526d70
mov ebx, eax
mov dword [ebp - 4], ebx
pop ecx
cmp ebx, 0xffffffff
jne 0x4ceacb
push 0xe4
xor ebx, ebx
mov dword [ebp - 0x21c], str.Failed_to_create_file__s:__s
lea eax, [ebp - 0x204]
mov dword [ebp - 0x220], ebx
push str.d:_buildserver_bna_2work_git_bootstrapper_repositorycontribcontrib_bnl_tact_sourcegamemisc_handlersmemorybufferhandler.cpp
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], 0x200
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x20c], 4
mov dword [ebp - 0x208], str.FileBufferHandler
call fcn.00492518
push dword [ebp + 8]
lea ecx, [ebp - 0x220]
call fcn.004928ff
call fcn.00563d3e
push dword [eax]
call fcn.005ce553
pop ecx
push eax
lea ecx, [ebp - 0x220]
call fcn.004928ff
lea ecx, [ebp - 0x220]
call fcn.0042e42b
jmp 0x4ceb94
push 0x2000
push esi
push dword [edi + 0x34]
call fcn.00574010
add esp, 0xc
test eax, eax
jle 0x4ceaef
push eax
push esi
push ebx
call fcn.00571e41
add esp, 0xc
test eax, eax
jg 0x4ceacb
cmp eax, 0xffffffff
je 0x4ceb8b
push 0xf2
xor ebx, ebx
mov dword [ebp - 0x21c], str.Failed_to_write_into__s:__s
lea eax, [ebp - 0x204]
mov dword [ebp - 0x220], ebx
push str.d:_buildserver_bna_2work_git_bootstrapper_repositorycontribcontrib_bnl_tact_sourcegamemisc_handlersmemorybufferhandler.cpp
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], 0x200
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x20c], 4
mov dword [ebp - 0x208], str.FileBufferHandler
call fcn.00492518
push dword [ebp + 8]
lea ecx, [ebp - 0x220]
call fcn.004928ff
call fcn.00563d3e
push dword [eax]
call fcn.005ce553
pop ecx
push eax
lea ecx, [ebp - 0x220]
call fcn.004928ff
lea ecx, [ebp - 0x220]
call fcn.0042e42b
push dword [ebp - 4]
call fcn.005721bd
jmp 0x4ceb93
push ebx
call fcn.005721bd
mov bl, 1
pop ecx
test esi, esi
je 0x4ceb9f
push esi
call fcn.0053b990
pop ecx
mov al, bl
pop esi
pop edi
pop ebx
leave
ret 4

Function at 0x4d631e
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x60], 0
jne 0x4d633e
push 0x6b8
push 0x79bda8
push str.m_haveKey
call fcn.0055c77a
add esp, 0xc
and dword [esi + 0xc0], 0
lea ecx, [esi + 0x68]
and dword [esi + 0xc4], 0
mov byte [esi + 0x65], 1
pop esi
jmp fcn.00493363
Function at 0x4d6d3f
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x6be0f0
call fcn.006b6d3c
sub esp, 0x290
push ebx
push esi
mov eax, edx
mov dword [ebp - 0x1c], ecx
push edi
push 0x100
mov edx, 0x8000
mov dword [ebp - 0x24], eax
mov ecx, eax
call fcn.00526d70
or ebx, 0xffffffff
mov dword [ebp - 0x18], eax
pop ecx
cmp eax, ebx
jne 0x4d6d7e
xor eax, eax
inc eax
jmp 0x4d6e8f
and dword [ebp - 0x14], 0
push dword [ebp + 8]
and dword [ebp - 4], 0
call fcn.0053b995
pop ecx
mov esi, eax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x14], esi
call fcn.00493363
mov edi, dword [ebp + 0xc]
push dword [ebp + 8]
push esi
push dword [ebp - 0x18]
call fcn.00574010
add esp, 0xc
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x4d6dcb
push eax
push esi
lea ecx, [ebp - 0x7c]
call fcn.00493387
test edi, edi
je 0x4d6d9f
cmp byte [edi], 0
mov esi, dword [ebp - 0x14]
je 0x4d6d9f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x7c]
call fcn.0049342f
push dword [ebp - 0x18]
call fcn.005721bd
cmp dword [ebp - 0x20], 0
pop ecx
jge 0x4d6e74
and dword [ebp - 0x298], 0
lea eax, [ebp - 0x27c]
and dword [ebp - 0x288], 0
lea ecx, [ebp - 0x298]
push 0x26
push str.d:_buildserver_bna_2work_git_bootstrapper_repositorycontribcontrib_bnl_tact_sourceutilmd5util.cpp
mov dword [ebp - 0x294], str.Failed_to_get_MD5_for__s_:__s
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x28c], 0x200
mov dword [ebp - 0x284], 4
mov dword [ebp - 0x280], str.MD5Util
call fcn.00492518
push dword [ebp - 0x24]
lea ecx, [ebp - 0x298]
call fcn.004928ff
call fcn.00563d3e
push dword [eax]
call fcn.005ce553
pop ecx
push eax
lea ecx, [ebp - 0x298]
call fcn.004928ff
lea ecx, [ebp - 0x298]
call fcn.0042e42b
xor ebx, ebx
inc ebx
jmp 0x4d6e82
test edi, edi
je 0x4d6e80
cmp byte [edi], 0
mov esi, dword [ebp - 0x14]
jne 0x4d6e82
xor ebx, ebx
test esi, esi
je 0x4d6e8d
push esi
call fcn.0053b990
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4dd63d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov edx, dword [ebp + 8]
mov esi, edi
mov dword [ebp - 4], esi
mov ecx, edi
lea eax, [edx - 1]
sar eax, 1
mov dword [ebp - 8], eax
cmp edi, eax
jge 0x4dd68d
lea esi, [ecx + ecx]
push dword [ebx + esi*4 + 4]
push dword [ebx + esi*4 + 8]
call fcn.004da217
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, esi
mov eax, dword [ebx + ecx*4]
mov dword [ebx + edi*4], eax
mov edi, ecx
mov eax, dword [ebp - 8]
cmp ecx, eax
jl 0x4dd65f
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 4]
cmp ecx, eax
jne 0x4dd6a0
test dl, 1
jne 0x4dd6a0
mov eax, dword [ebx + edx*4 - 4]
mov dword [ebx + edi*4], eax
lea edi, [edx - 1]
cmp esi, edi
jge 0x4dd6c8
mov eax, dword [ebp + 0xc]
lea esi, [edi - 1]
sar esi, 1
push dword [eax]
mov ecx, dword [ebx + esi*4]
push ecx
call fcn.004da217
test al, al
je 0x4dd6c8
mov eax, dword [ebx + esi*4]
mov dword [ebx + edi*4], eax
mov edi, esi
cmp dword [ebp - 4], esi
jl 0x4dd6a4
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4dfb51
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x24], 0xffffffff
jne 0x4dfb5f
push 2
pop eax
jmp 0x4dfb85
push esi
mov esi, dword [ebp + 0xc]
push dword [esi]
push dword [ebp + 8]
push dword [ecx + 0x24]
call fcn.00574010
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4dfb80
and dword [esi], 0
push 0xf
pop eax
jmp 0x4dfb84
mov dword [esi], eax
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x4e5a64
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [edx]
mov edi, ecx
mov ebx, 0x100
lea ecx, [edx + 0x10]
cmp dword [ebp + 0xc], ebx
mov esi, str.expand_16_byte_k
mov dword [edi + 4], eax
cmovne ecx, edx
mov eax, dword [edx + 4]
mov dword [edi + 8], eax
mov eax, dword [edx + 8]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0xc]
mov dword [edi + 0x10], eax
mov eax, str.expand_32_byte_k
cmove esi, eax
mov eax, dword [ecx]
mov dword [edi + 0x2c], eax
mov eax, dword [ecx + 4]
mov dword [edi + 0x30], eax
mov eax, dword [ecx + 8]
mov dword [edi + 0x34], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0x38], eax
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 8]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x3c], eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4e7a7b
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4e7a86
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004e7a8c
Function at 0x4e7df3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
xor edx, edx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [esi + 0x111]
movzx ecx, byte [esi + 0x110]
mov dword [ebp - 4], eax
lea eax, [ebx + edi]
cmp ebx, eax
cmova edi, edx
mov dword [ebp + 0xc], edi
test edi, edi
je 0x4e7e74
lea eax, [ecx + 1]
movzx eax, al
mov dword [ebp + 8], eax
mov edi, dword [ebp + 8]
mov cl, byte [esi + eax + 0x10]
mov eax, dword [ebp - 4]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 4], eax
mov al, byte [esi + eax + 0x10]
mov byte [esi + edi + 0x10], al
mov edi, dword [ebp - 4]
movzx eax, al
add eax, edx
movzx eax, al
mov byte [esi + edi + 0x10], cl
mov ecx, dword [ebp + 8]
mov al, byte [eax + esi + 0x10]
xor byte [ebx], al
inc ebx
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp + 0xc]
jb 0x4e7e29
mov eax, dword [ebp - 4]
pop edi
mov byte [esi + 0x110], cl
mov byte [esi + 0x111], al
pop esi
pop ebx
leave
ret 8

Function at 0x4ec204
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ecx]
xor eax, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
mov edi, dword [ecx + 4]
push eax
push 1
push eax
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
call esi
test eax, eax
jne 0x4ec260
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x4ec24a
push 8
push 1
push 0
push 0
lea eax, [ebp - 8]
push eax
call esi
test eax, eax
jne 0x4ec260
push 0
mov dword [ebp - 4], 1
call fcn.00567f0f
push eax
call fcn.005ce5f0
pop ecx
pop ecx
test edi, edi
je 0x4ec291
xor esi, esi
cmp dword [ebp - 4], esi
jne 0x4ec27e
push ebx
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x4ec28b
mov esi, edi
jmp 0x4ec28b
call fcn.005ce5cf
mov byte [esi + ebx], al
inc esi
cmp esi, edi
jb 0x4ec27e
add ebx, esi
sub edi, esi
jne 0x4ec264
cmp dword [ebp - 4], 0
pop edi
pop esi
pop ebx
jne 0x4ec2a5
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
leave
ret