joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57bb40
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
cmp dword [esp + 0x14], 0
push ebx
push ebp
push esi
push edi
jne 0x57bb5d
mov eax, 0x80004005
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov edi, dword [esp + 0x20]
lea eax, [edi + 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [edi + 0x128]
add edi, 0x118
cmp dword [edi + 0xc], ebx
jbe 0x57bb84
call fcn.00588c45
mov esi, dword [edi + 0xc]
cmp esi, dword [edi + 0x10]
jbe 0x57bb91
call fcn.00588c45
mov ebp, dword [edi]
mov dword [esp + 0x18], esi
cmp esi, ebx
je 0x57bbaf
jmp 0x57bba0
mov eax, dword [esp + 0x24]
cmp dword [esi], eax
je 0x57bbaf
add esi, 4
cmp esi, ebx
jne 0x57bba0
mov ebx, dword [edi + 0x10]
cmp dword [edi + 0xc], ebx
jbe 0x57bbbc
call fcn.00588c45
mov eax, dword [edi]
test ebp, ebp
je 0x57bbc6
cmp ebp, eax
je 0x57bbcb
call fcn.00588c45
cmp esi, ebx
jne 0x57bbd8
lea ebx, [esp + 0x24]
call fcn.004949a0
mov eax, dword [esp + 0x20]
add eax, 0x134
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x20]
cmp dword [esi + 0x130], 0
jne 0x57bc1a
push 0
push 0
push esi
push 0x57bae0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x130], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
Function at 0x57d550
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5bd1be
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
mov eax, dword [0x615370]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor ebx, ebx
test byte [0x625028], 1
jne 0x57d5d9
or dword [0x625028], 1
xor eax, eax
mov dword [esp + 0x28], ebx
mov ecx, 0x625010
mov dword [0x625010], eax
mov dword [0x625014], eax
mov dword [0x625018], eax
mov dword [0x62501c], eax
mov dword [0x625020], eax
mov dword [0x625024], eax
call fcn.00406430
cmp eax, ebx
jge 0x57d5c4
push eax
call fcn.00406af0
push 0x5c5c70
call fcn.00588d7c
add esp, 4
mov dword [esp + 0x28], 0xffffffff
test byte [0x625028], 2
jne 0x57d5fc
or dword [0x625028], 2
push 0x5c5c50
mov dword [0x6246dc], ebx
call fcn.00588d7c
add esp, 4
mov eax, 4
test byte [0x625028], al
jne 0x57d63f
or dword [0x625028], eax
mov eax, dword [0x621148]
mov edx, dword [eax + 0xc]
mov ecx, 0x621148
mov dword [0x6246d0], ebx
call edx
add eax, 0x10
push 0x5c5c20
mov dword [0x6246d4], eax
mov dword [0x6246d8], ebx
call fcn.00588d7c
add esp, 4
push 0x625010
mov dword [esp + 0x10], 0x625010
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x10], 1
mov dword [esp + 0x28], 1
cmp dword [0x6246d0], ebx
jne 0x57d6bd
cmp dword [0x6246dc], ebx
jne 0x57d6bd
push str.Beacon.EFE12143_20B3_40AC_9981_711D112CCBCA
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x6246dc], eax
cmp eax, ebx
jne 0x57d6bd
push str.Beacon.EFE12143_20B3_40AC_9981_711D112CCBCA
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x6246dc], eax
cmp eax, ebx
jne 0x57d6bd
push 0x625010
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x625010
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x6246dc]
push 0xffffffffffffffff
push eax
mov byte [esp + 0x18], bl
mov dword [esp + 0x1c], 0x6246dc
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [esp + 0x18], 1
mov byte [esp + 0x28], 2
cmp dword [0x6246d0], ebx
jne 0x57d721
call fcn.0057c360
cmp dword [0x6246d0], ebx
jne 0x57d721
mov ecx, dword [0x6246dc]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x6246dc]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.0057ea90
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x57d770
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5acb16
mov eax, dword fs:[0]
push eax
sub esp, 0x460
mov eax, dword [0x615370]
xor eax, esp
mov dword [esp + 0x458], eax
push ebx
push esi
push edi
mov eax, dword [0x615370]
xor eax, esp
push eax
lea eax, [esp + 0x470]
mov dword fs:[0], eax
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0
mov ebx, ecx
push 0x5e776c
mov dword [esp + 0x38], ebx
mov esi, edx
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
neg eax
sbb eax, eax
and eax, dword [esp + 0x10]
push esi
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x478], eax
cmp eax, eax
ja 0x57d820
jb 0x57d809
cmp edi, 0xffffffff
ja 0x57d820
push edi
call fcn.00588eb5
mov ebx, eax
add esp, 4
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x57d843
mov ebx, dword [esp + 0x18]
mov edx, dword [0x621148]
mov eax, dword [edx + 0xc]
mov ecx, 0x621148
call eax
add eax, 0x10
push 0
mov dword [ebx], eax
call fcn.0058870b
mov eax, ebx
jmp 0x57d937
push edi
push esi
push ebx
call fcn.0058e380
add esp, 0xc
push 0x408
lea ecx, [esp + 0x20]
push 0
push ecx
call fcn.0058e300
add esp, 0xc
lea edx, [esp + 0x10]
push 4
push edx
lea esi, [esp + 0x24]
call fcn.0057e340
push edi
push ebx
mov eax, esi
call fcn.0057e410
mov eax, dword [0x621148]
mov edx, dword [eax + 0xc]
add esp, 0x10
mov ecx, 0x621148
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
xor esi, esi
mov byte [esp + 0x478], 1
test edi, edi
jbe 0x57d8f7
movzx eax, byte [esi + ebx]
push eax
push str._02x
lea ecx, [esp + 0x42c]
push 0x20
push ecx
call fcn.0058a8f0
lea eax, [esp + 0x434]
add esp, 0x10
lea edx, [eax + 2]
jmp 0x57d8d0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x57d8d0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x428]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0040f2a0
inc esi
cmp esi, edi
jb 0x57d8a2
mov esi, dword [esp + 0x10]
add esi, 0xfffffff0
mov eax, esi
call fcn.00406580
mov edi, dword [esp + 0x18]
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x478], 0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x57d92f
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
push ebx
call fcn.0058870b
mov eax, edi
add esp, 4
mov ecx, dword [esp + 0x470]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x458]
xor ecx, esp
call fcn.005886fc
mov esp, ebp
pop ebp
ret
Function at 0x57d980
Capabilities:
Check http status code

Disassembly:
sub esp, 0xc
push esi
xor esi, esi
mov dword [esp + 8], 3
mov dword [esp + 4], esi
mov dword [esp + 0xc], 4
test edi, edi
je 0x57da0f
push ebx
mov ebx, dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov eax, dword [esp + 0xc]
mov ecx, eax
dec eax
mov dword [esp + 0xc], eax
test ecx, ecx
jle 0x57da0e
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
mov esi, eax
test esi, esi
jne 0x57d9d6
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x57d9a5
push 0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0x20000013
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 4
call ebx
mov esi, eax
test esi, esi
je 0x57d9c9
cmp dword [esp + 8], 0xc8
je 0x57da0e
xor esi, esi
jmp 0x57d9a5
pop ebx
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x57e2b0
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, eax
lea eax, [esp + 0x10]
push eax
xor ebp, ebp
push edi
xor ebx, ebx
mov dword [esp + 0x18], ebp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebp
je 0x57e334
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [esp + 0x10]
mov ebx, eax
push ebx
push esi
push ecx
push edi
call sub.VERSION.dll_GetFileVersionInfoW
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push 0x5cb130
push ebx
mov dword [esp + 0x24], ebp
call sub.VERSION.dll_VerQueryValueW
mov ebp, eax
test ebp, ebp
je 0x57e323
cmp dword [esp + 0x14], 0
je 0x57e323
mov esi, dword [esp + 0x18]
test esi, esi
je 0x57e323
mov edi, dword [esp + 0x20]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret

Function at 0x57e410
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [eax]
mov edx, dword [eax + 4]
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push esi
xor esi, esi
cmp dword [esp + 0x1c], esi
jle 0x57e46f
push edi
inc cl
movzx edi, cl
mov ecx, dword [eax + edi*4 + 8]
add dl, cl
mov dword [esp + 0x10], ecx
movzx ecx, dl
mov edx, dword [esp + 0x10]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + ecx*4 + 8]
mov dword [eax + edi*4 + 8], ecx
add cl, dl
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0xc]
movzx ecx, cl
mov dword [eax + edi*4 + 8], edx
mov dl, byte [eax + ecx*4 + 8]
xor byte [esi + ebp], dl
mov ecx, dword [esp + 0x14]
inc esi
cmp esi, dword [esp + 0x20]
mov edx, edi
jl 0x57e427
pop edi
pop esi
mov dword [eax + 4], edx
mov dword [eax], ecx
pop ebp
add esp, 0xc
ret

Function at 0x57ec60
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [eax + 4]
mov eax, dword [eax]
movzx ecx, word [eax + 0x14]
push ebp
xor edx, edx
push esi
push edi
lea ecx, [ecx + eax + 0x18]
mov dword [esp + 0x10], 0
cmp dx, word [eax + 6]
jae 0x57ed13
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea esi, [ecx + 0xc]
mov eax, dword [esi + 4]
test eax, eax
jne 0x57ecca
mov eax, dword [esp + 0x1c]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x57ecf9
mov ecx, dword [esi]
push 4
push 0x1000
push edi
add ecx, ebx
push ecx
call ebp
test eax, eax
je 0x57ed1e
mov eax, dword [esi]
push edi
add eax, ebx
push 0
push eax
mov dword [esi - 4], eax
call fcn.0058e300
jmp 0x57ecf6
mov edx, dword [esi]
push 4
push 0x1000
push eax
add edx, ebx
push edx
call ebp
test eax, eax
je 0x57ed1e
mov ecx, dword [esi + 8]
mov eax, dword [esi + 4]
add ecx, dword [esp + 0x18]
mov edi, dword [esi]
push eax
add edi, ebx
push ecx
push edi
call fcn.0058e380
mov dword [esi - 4], edi
add esp, 0xc
mov edx, dword [esp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esp + 0x10]
movzx edx, word [ecx + 6]
inc eax
add esi, 0x28
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x57ec93
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x57edd0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi + 0x30]
mov esi, dword [ecx + eax + 0x20]
dec edx
lea ecx, [ecx + eax + 0x18]
not edx
and edx, esi
mov dword [esp + 0x14], esi
mov esi, dword [ecx + 0x10]
mov dword [esp + 0x18], edx
test esi, esi
jne 0x57ee14
mov ebx, dword [ecx + 0x24]
test bl, 0x40
je 0x57ee0d
mov esi, dword [eax + 0x20]
jmp 0x57ee14
test bl, bl
jns 0x57ee14
mov esi, dword [eax + 0x24]
mov dword [esp + 0x1c], esi
mov esi, dword [ecx + 0x24]
mov dword [esp + 0x20], esi
mov esi, 1
add ecx, 0x28
mov dword [esp + 0x24], 0
mov dword [esp + 0x10], 1
cmp si, word [eax + 6]
jae 0x57eef4
lea ebx, [ecx + 0x24]
mov esi, dword [edi + 0x30]
mov ebp, dword [ebx - 0x1c]
mov edi, dword [ebx - 0x14]
dec esi
not esi
and esi, ebp
test edi, edi
jne 0x57ee69
mov ecx, dword [ebx]
test cl, 0x40
je 0x57ee62
mov edi, dword [eax + 0x20]
jmp 0x57ee69
test cl, cl
jns 0x57ee69
mov edi, dword [eax + 0x24]
cmp edx, esi
je 0x57eea2
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
add eax, ecx
cmp eax, esi
ja 0x57eea2
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.0057ed30
test eax, eax
je 0x57ef15
mov eax, dword [ebx]
mov edx, esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], eax
jmp 0x57eece
mov eax, dword [ebx]
test eax, 0x2000000
je 0x57eebb
test dword [esp + 0x20], 0x2000000
je 0x57eebb
or dword [esp + 0x20], eax
jmp 0x57eec8
or eax, dword [esp + 0x20]
and eax, 0xfdffffff
mov dword [esp + 0x20], eax
sub edi, dword [esp + 0x14]
add edi, ebp
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
movzx esi, word [eax + 6]
inc ecx
add ebx, 0x28
cmp ecx, esi
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x10], ecx
jl 0x57ee44
lea ecx, [esp + 0x14]
mov edx, edi
mov dword [esp + 0x24], 1
call fcn.0057ed30
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x18
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret

Function at 0x57f860
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x615370]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00583230
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.005832d0
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.005886fc
add esp, 0x68
ret
Function at 0x57f9d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push str.SOFTWARE360MachineSignature
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x57fb61
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x57fa63
cmp dword [esp + 0x14], 1
jne 0x57fb48
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x57fb48
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x57faa8
cmp dword [esp + 0x14], 1
jne 0x57fb48
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x57fb48
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x57fadf
cmp dword [esp + 0x14], 1
jne 0x57fb48
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x57fb48
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x57fb48
cmp dword [esp + 0x14], 3
jne 0x57fb48
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x57fb48
lea eax, [esi + 0xc]
call fcn.0057f8d0
test eax, eax
je 0x57fb48
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x57ff50
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x615370]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.00581f70
add esp, 8
test eax, eax
jne 0x57ffbb
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.005886fc
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x57ffd0
push esi
lea ecx, [esp + 0x14]
call fcn.00583230
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.005832d0
test edi, edi
je 0x57ffee
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.005886fc
add esp, 0x6c
ret

Function at 0x580030
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x615370]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00582160
add esp, 4
test eax, eax
jne 0x58008e
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.005886fc
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.005832d0
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.005886fc
add esp, 0x64
ret

Function at 0x5800b0
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x615370]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.00582240
add esp, 8
test eax, eax
jne 0x58012f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.005886fc
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.00583020
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.005886fc
add esp, 0x74
ret

Function at 0x580ae0
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x580b0b
push 0x5caac0
mov eax, 0x5caac0
call fcn.00583d30
add esp, 4
xor eax, eax
pop ecx
ret
mov eax, 1
cmp esi, dword [esp]
je 0x580b24
push 0x5caac0
call fcn.00583da0
add esp, 4
xor eax, eax
pop ecx
ret
Function at 0x5813c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x615370]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
cmp eax, ebx
jne 0x5813f3
mov dword [esp + 0x10], 0xffffffff
jmp 0x5813f9
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x581427
push 0x5caac0
mov eax, 0x5caac0
call fcn.00583d30
add esp, 4
jmp 0x581507
push 0
lea edx, [esp + 0x1c]
push edx
push 8
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x581457
push 0x5caac0
mov eax, 0x5caac0
call fcn.00583d30
add esp, 4
jmp 0x581507
mov eax, 8
cmp dword [esp + 0x18], eax
je 0x581479
mov eax, 1
push 0x5caac0
call fcn.00583da0
add esp, 4
jmp 0x581507
cmp dword [esp + 0x40], ebx
je 0x5814b5
mov ebx, eax
cmp dword [esp + 0x10], eax
jae 0x58149b
mov eax, 5
push 0x5caac0
call fcn.00583da0
add esp, 4
jmp 0x581507
mov ecx, dword [esp + 0x24]
mov dx, word [esp + 0x28]
mov dword [esi], ecx
mov cx, word [esp + 0x2a]
mov word [esi + 4], dx
mov word [esi + 6], cx
jmp 0x5814ff
mov esi, dword [esp + 0x24]
cmp esi, dword [esp + 0x10]
jbe 0x5814c3
mov ebx, esi
jmp 0x581487
mov edx, dword [esp + 0x38]
xor ebx, ebx
push ebx
push ebx
push ebp
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x5814ec
push 0x5caac0
mov eax, 0x5caac0
call fcn.00583d30
add esp, 4
jmp 0x581507
mov ecx, dword [esp + 0x20]
mov edx, edi
call fcn.00580ae0
test eax, eax
je 0x581507
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x581511
mov dword [eax], ebx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005886fc
add esp, 0x28
ret
Function at 0x581df0
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push eax
xor ebx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x581e36
push 0x5caac0
mov eax, 0x5caac0
call fcn.00583d30
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0xb4]
xor edx, edx
sub ebx, edi
mov edi, dword [esp + 0x14]
sbb edi, edx
sub ebx, 0x298
sbb edi, ebp
xor eax, eax
cmp edi, eax
jl 0x581ec8
jg 0x581e5e
cmp ebx, ecx
jb 0x581ec8
mov ebp, dword [esi]
push 0
push 0
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x581e8d
push 0x5caac0
mov eax, 0x5caac0
call fcn.00583d30
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
mov esi, 0x298
mov edx, ebp
call fcn.00580ae0
test eax, eax
je 0x581e83
mov eax, dword [esp + 0x20]
test eax, eax
je 0x581eae
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x581ed5
mov ecx, 1
mov word [eax], cx
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x581ed5
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret