joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52de90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
test eax, eax
jne 0x52de9e
xor al, al
mov esp, ebp
pop ebp
ret
push esi
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x52de70
push 0
push 0
mov dword [ebp - 4], 0
call fcn.0053e671
mov esi, eax
add esp, 0x18
cmp esi, 0xffffffff
je 0x52dec9
test esi, esi
jne 0x52ded0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x52def0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
test edi, edi
jne 0x52defe
xor al, al
mov esp, ebp
pop ebp
ret
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x52df03
sub eax, edx
sar eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
push 0x5cea3e
neg ecx
or ecx, eax
push ecx
call fcn.0053ef06
add esp, 8
test eax, eax
je 0x52def8
push esi
mov esi, eax
mov ecx, edi
sub esi, edi
lea esp, [esp]
movzx edx, word [ecx]
mov word [esi + ecx], dx
add ecx, 2
test dx, dx
jne 0x52df40
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x52de40
push 0
push 0
mov dword [ebp - 4], 0
call fcn.0053e671
add esp, 0x18
pop esi
cmp eax, 0xffffffff
je 0x52def8
test eax, eax
je 0x52def8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x531ee0
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
call esi
test eax, eax
jne 0x531f23
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
je 0x531f10
xor al, al
pop esi
pop ecx
ret
push 8
push 1
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
call esi
test eax, eax
je 0x531f0b
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
push ebx
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov edx, dword [esp + 8]
push 0
test eax, eax
push edx
setne bl
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, bl
pop ebx
pop esi
pop ecx
ret

Function at 0x532320
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or eax, 0xffffffff
test ecx, ecx
je 0x53234c
push esi
jmp 0x532330
movsx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5c72f0]
dec ecx
inc edx
test ecx, ecx
jne 0x532330
pop esi
not eax
ret
Function at 0x532350
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x54
mov eax, dword [0x5c5678]
xor eax, esp
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x5c]
push esi
push edi
mov edi, edx
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], edx
lea edx, [esp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push edx
lea eax, [esp + 0x1c]
call fcn.00534b20
mov esi, dword [esp + 0x64]
lea eax, [esp + 0x1c]
mov edx, eax
add esp, 4
xor ecx, ecx
sub esi, eax
sub edi, edx
mov edi, edi
lea eax, [esp + ecx + 0x18]
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc ecx
cmp ecx, 0x30
mov byte [edi + eax], dl
jl 0x5323a0
mov ecx, dword [esp + 0x58]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0053d78d
add esp, 0x54
ret

Function at 0x532490
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x80
push ebx
mov ebx, dword [esp + 0x88]
push ebp
push esi
push edi
push 0x585448
push ebx
mov ecx, 0x20
mov esi, ebx
lea edi, [esp + 0x18]
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.005323d0
mov ecx, dword [ebx + 0x7c]
shr ecx, 7
and ecx, 1
lea edi, [esp + 0x1c]
lea ebp, [esp + 0x20]
add esp, 0xc
neg ecx
xor edx, edx
sub edi, ebx
lea eax, [ebx + 8]
sub ebp, ebx
lea esp, [esp]
mov esi, dword [eax - 8]
mov ebx, dword [esp + edx*4 + 0x10]
xor ebx, esi
and ebx, ecx
xor ebx, esi
mov esi, dword [eax - 4]
mov dword [eax - 8], ebx
mov ebx, dword [esp + edx*4 + 0x14]
xor ebx, esi
and ebx, ecx
xor ebx, esi
mov esi, dword [eax]
mov dword [eax - 4], ebx
mov ebx, dword [edi + eax]
xor ebx, esi
and ebx, ecx
xor ebx, esi
mov esi, dword [eax + 4]
mov dword [eax], ebx
mov ebx, dword [eax + ebp]
xor ebx, esi
and ebx, ecx
xor ebx, esi
mov dword [eax + 4], ebx
add edx, 4
add eax, 0x10
cmp edx, 0x20
jb 0x5324e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret

Function at 0x5330a0
Capabilities:
Encrypt data using curve25519

Disassembly:
sub esp, 0x1a4
mov eax, dword [0x5c5678]
xor eax, esp
mov dword [esp + 0x1a0], eax
mov eax, dword [esp + 0x1a8]
push 0x20
push eax
lea ecx, [esp + 0x188]
push ecx
call fcn.005475b0
mov dl, byte [esp + 0x1ab]
and byte [esp + 0x18c], 0xf8
and dl, 0x3f
or dl, 0x40
add esp, 0xc
mov byte [esp + 0x19f], dl
xor eax, eax
lea esp, [esp]
movzx ecx, byte [eax + edi]
mov dword [esp + eax*4], ecx
inc eax
cmp eax, 0x20
jb 0x5330f0
lea edx, [esp + 0x180]
push edx
lea eax, [esp + 4]
push eax
call fcn.00532930
lea ecx, [esp + 0x88]
push ecx
mov eax, ecx
call fcn.00532cb0
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0x110]
push eax
lea edx, [esp + 0x14]
call fcn.00532540
lea ecx, [esp + 0x114]
push ecx
call fcn.00532490
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov dl, byte [esp + eax*4 + 0x100]
mov byte [esi + eax], dl
inc eax
cmp eax, 0x20
jb 0x533150
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
xor eax, eax
call fcn.0053d78d
add esp, 0x1a4
ret
Function at 0x533180
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 0x44
push ebx
push esi
push edi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x14], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x18], edx
mov edx, dword [eax + 0x14]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x20], edx
mov edx, dword [eax + 0x1c]
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 0x20]
mov dword [esp + 0x28], edx
mov edx, dword [eax + 0x24]
mov dword [esp + 0x2c], ecx
mov ecx, dword [eax + 0x28]
mov dword [esp + 0x30], edx
mov edx, dword [eax + 0x2c]
mov dword [esp + 0x34], ecx
mov ecx, dword [eax + 0x30]
mov dword [esp + 0x38], edx
mov edx, dword [eax + 0x34]
mov dword [esp + 0x3c], ecx
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x40], edx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x44], ecx
mov ecx, dword [eax + 0x40]
mov dword [esp + 0x48], edx
xor edx, edx
mov esi, 0x5853f0
mov dword [esp + 0x4c], ecx
mov ecx, eax
sub esi, eax
lea edi, [edx + 0x11]
lea ebx, [ebx]
mov ebx, dword [esi + ecx]
add ebx, dword [ecx]
add ecx, 4
add edx, ebx
movzx ebx, dl
mov dword [ecx - 4], ebx
shr edx, 8
sub edi, 1
jne 0x533210
mov edx, dword [eax + 0x40]
shr edx, 7
lea esi, [esp + 0xc]
neg edx
sub esi, eax
mov edi, 0x11
jmp 0x533240
mov ecx, dword [eax]
mov ebx, dword [esi + eax]
xor ebx, ecx
and ebx, edx
xor ebx, ecx
mov dword [eax], ebx
add eax, 4
sub edi, 1
jne 0x533240
pop edi
pop esi
pop ebx
add esp, 0x44
ret
Function at 0x533bf0
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x533d8e
test eax, eax
je 0x533d8e
mov dword [eax + 0xf0], 0xa
mov ecx, dword [esi]
push edi
mov edx, ecx
ror edx, 8
and edx, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or edx, ecx
mov dword [eax], edx
mov edx, dword [esi + 4]
mov edi, edx
ror edi, 8
and edi, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or edi, edx
mov dword [eax + 4], edi
mov edx, dword [esi + 8]
mov edi, edx
ror edi, 8
and edi, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or edi, edx
mov dword [eax + 8], edi
mov edx, dword [esi + 0xc]
lea ecx, [eax + 4]
mov esi, edx
ror esi, 8
and esi, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or esi, edx
mov dword [eax + 0xc], esi
mov edx, esi
shr edx, 0x10
and edx, 0xff
mov edx, dword [edx*4 + 0x583ac8]
xor edx, 0x1000000
mov edi, esi
shr edi, 8
and edi, 0xff
mov edi, dword [edi*4 + 0x583ec8]
and edi, 0xff0000
and edx, 0xff000000
xor edx, edi
mov edi, esi
shr edi, 0x18
movzx edi, byte [edi*4 + 0x5836c8]
xor edx, edi
mov edi, esi
and edi, 0xff
mov edi, dword [edi*4 + 0x5832c8]
and edi, 0xff00
xor edx, edi
xor edx, dword [eax]
mov edi, dword [ecx]
xor edi, edx
mov dword [eax + 0x10], edx
mov edx, dword [eax + 8]
xor edx, edi
mov dword [eax + 0x18], edx
xor edx, esi
mov dword [eax + 0x14], edi
mov dword [eax + 0x1c], edx
mov esi, 0x5853cc
jmp 0x533d00
mov edx, dword [ecx + 0x18]
add ecx, 0x10
mov eax, edx
shr eax, 8
mov edi, edx
and eax, 0xff
mov eax, dword [eax*4 + 0x583ec8]
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x583ac8]
and eax, 0xff0000
and edi, 0xff000000
xor eax, edi
mov edi, edx
and edx, 0xff
mov edx, dword [edx*4 + 0x5832c8]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x5836c8]
xor eax, edi
and edx, 0xff00
xor eax, edx
xor eax, dword [ecx - 4]
add esi, 4
xor eax, dword [esi - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ecx]
xor edx, eax
mov dword [ecx + 0x10], edx
mov eax, dword [ecx + 4]
xor eax, edx
mov dword [ecx + 0x14], eax
mov edx, dword [ecx + 8]
xor edx, eax
mov dword [ecx + 0x18], edx
cmp esi, 0x5853f0
jne 0x533d00
pop edi
xor eax, eax
pop esi
ret
or eax, 0xffffffff
pop esi
ret
Function at 0x533da0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, ebx
call fcn.00533bf0
test eax, eax
jl 0x533fd8
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x533e0d
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
mov edi, edi
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x533dd0
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x533fd4
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x5836c8]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5836c8]
and esi, 0xff
mov esi, dword [esi*4 + 0x5842c8]
and edi, 0xff
xor esi, dword [edi*4 + 0x584ac8]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5836c8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x584ec8]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x5836c8]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x5846c8]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x5836c8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5836c8]
and esi, 0xff
mov esi, dword [esi*4 + 0x5842c8]
and edi, 0xff
xor esi, dword [edi*4 + 0x584ac8]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x5836c8]
and edi, 0xff
xor esi, dword [edi*4 + 0x5846c8]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5836c8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x584ec8]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x5836c8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5836c8]
and esi, 0xff
mov esi, dword [esi*4 + 0x5842c8]
and edi, 0xff
xor esi, dword [edi*4 + 0x584ac8]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x5836c8]
and edi, 0xff
xor esi, dword [edi*4 + 0x5846c8]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5836c8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x584ec8]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x5836c8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x5836c8]
and esi, 0xff
mov esi, dword [esi*4 + 0x5842c8]
and edi, 0xff
xor esi, dword [edi*4 + 0x584ac8]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x5836c8]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5836c8]
and edi, 0xff
xor esi, dword [edi*4 + 0x5846c8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x584ec8]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x533e21
pop edi
xor eax, eax
pop esi
pop ebx
ret
Function at 0x535460
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x5c5678]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00539010
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.005390b0
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.0053d78d
add esp, 0x68
ret
Function at 0x5355d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push 0x20119
xor edi, edi
push edi
push str.SOFTWARE360MachineSignature
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x535763
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x20]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x2c]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x535665
cmp dword [esp + 0x18], 1
jne 0x53574a
mov eax, dword [esp + 0x14]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x53574a
mov eax, dword [esp + 0x1c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x2c], edi
call ebp
test eax, eax
jne 0x5356aa
cmp dword [esp + 0x18], 1
jne 0x53574a
mov eax, dword [esp + 0x14]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x53574a
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x2c], edi
call ebp
test eax, eax
jne 0x5356e1
cmp dword [esp + 0x18], 1
jne 0x53574a
mov eax, dword [esp + 0x14]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x53574a
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x2c], edi
call ebp
test eax, eax
jne 0x53574a
cmp dword [esp + 0x18], 3
jne 0x53574a
mov eax, dword [esp + 0x14]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x53574a
lea eax, [esi + 0xc]
call fcn.005354d0
test eax, eax
je 0x53574a
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x535b60
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x5c5678]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
mov ebx, dword [esp + 0x78]
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.00537b40
add esp, 8
test eax, eax
jne 0x535bd1
pop esi
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0053d78d
add esp, 0x6c
ret
mov eax, dword [esp + 0x78]
test eax, eax
jbe 0x535be6
push esi
lea ecx, [esp + 0x14]
call fcn.00539010
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.005390b0
test edi, edi
je 0x535c04
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0053d78d
add esp, 0x6c
ret

Function at 0x535c40
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x5c5678]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
mov ebx, dword [esp + 0x6c]
xor eax, eax
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
push edi
lea eax, [esp + 0x10]
mov edi, ecx
push eax
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.00537d30
add esp, 4
test eax, eax
jne 0x535ca4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0053d78d
add esp, 0x64
ret
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.005390b0
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0053d78d
add esp, 0x64
ret

Function at 0x535cd0
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x5c5678]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.00537e10
add esp, 8
test eax, eax
jne 0x535d4f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0053d78d
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.00538c10
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.0053d78d
add esp, 0x74
ret

Function at 0x5366a0
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5366cb
push 0x582044
mov eax, 0x582044
call fcn.00539b10
add esp, 4
xor eax, eax
pop ecx
ret
mov eax, 1
cmp esi, dword [esp]
je 0x5366e4
push 0x582044
call fcn.00539b80
add esp, 4
xor eax, eax
pop ecx
ret
Function at 0x536f90
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x5c5678]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
cmp eax, ebx
jne 0x536fc3
mov dword [esp + 0x10], 0xffffffff
jmp 0x536fc9
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x536ff7
push 0x582044
mov eax, 0x582044
call fcn.00539b10
add esp, 4
jmp 0x5370d7
push 0
lea edx, [esp + 0x1c]
push edx
push 8
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x537027
push 0x582044
mov eax, 0x582044
call fcn.00539b10
add esp, 4
jmp 0x5370d7
mov eax, 8
cmp dword [esp + 0x18], eax
je 0x537049
mov eax, 1
push 0x582044
call fcn.00539b80
add esp, 4
jmp 0x5370d7
cmp dword [esp + 0x40], ebx
je 0x537085
mov ebx, eax
cmp dword [esp + 0x10], eax
jae 0x53706b
mov eax, 5
push 0x582044
call fcn.00539b80
add esp, 4
jmp 0x5370d7
mov ecx, dword [esp + 0x24]
mov dx, word [esp + 0x28]
mov dword [esi], ecx
mov cx, word [esp + 0x2a]
mov word [esi + 4], dx
mov word [esi + 6], cx
jmp 0x5370cf
mov esi, dword [esp + 0x24]
cmp esi, dword [esp + 0x10]
jbe 0x537093
mov ebx, esi
jmp 0x537057
mov edx, dword [esp + 0x38]
xor ebx, ebx
push ebx
push ebx
push ebp
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x5370bc
push 0x582044
mov eax, 0x582044
call fcn.00539b10
add esp, 4
jmp 0x5370d7
mov ecx, dword [esp + 0x20]
mov edx, edi
call fcn.005366a0
test eax, eax
je 0x5370d7
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x5370e1
mov dword [eax], ebx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0053d78d
add esp, 0x28
ret
Function at 0x5379c0
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push eax
xor ebx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x537a06
push 0x582044
mov eax, 0x582044
call fcn.00539b10
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0xb4]
xor edx, edx
sub ebx, edi
mov edi, dword [esp + 0x14]
sbb edi, edx
sub ebx, 0x298
sbb edi, ebp
xor eax, eax
cmp edi, eax
jl 0x537a98
jg 0x537a2e
cmp ebx, ecx
jb 0x537a98
mov ebp, dword [esi]
push 0
push 0
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x537a5d
push 0x582044
mov eax, 0x582044
call fcn.00539b10
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
mov esi, 0x298
mov edx, ebp
call fcn.005366a0
test eax, eax
je 0x537a53
mov eax, dword [esp + 0x20]
test eax, eax
je 0x537a7e
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x537aa5
mov ecx, 1
mov word [eax], cx
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x537aa5
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x538350
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x1c
mov eax, dword [0x5c5678]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
cmp eax, ebp
je 0x538491
cmp dword [esp + 0x28], ebp
je 0x538491
push edi
push 0x2800
call fcn.0053e164
mov edi, eax
add esp, 4
cmp edi, ebp
jne 0x5383b3
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0053d78d
add esp, 0x1c
ret
push ebx
push esi
xor ebx, ebx
jmp 0x5383c0
push ebx
push str..PhysicalDrive_d
push 0x2800
call fcn.00536570
add esp, 0xc
push ebp
push 0x80
push 3
push ebp
push 3
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x538467
xor eax, eax
push 0x2800
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.00545940
add esp, 0xc
push ebp
lea eax, [esp + 0x18]
push eax
push 0x2800
push edi
push 0xc
lea ecx, [esp + 0x30]
push ecx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x53845a
mov eax, dword [edi + 0x18]
cmp eax, ebp
jbe 0x53845a
mov edx, dword [esp + 0x34]
add eax, edi
push eax
mov eax, dword [esp + 0x1c]
push edx
push eax
push str.DISKID:
call fcn.005380e0
add esp, 0x10
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebp
jne 0x538471
inc ebx
cmp ebx, 0x10
jl 0x5383c0
push edi
call fcn.0053e31f
mov eax, dword [esp + 0x14]
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0053d78d
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.0053d78d
add esp, 0x1c
ret