joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a210
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebp, ebp
push str.Kernel32
mov dword [esi], ebp
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebp
je 0x44a2b0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateToolhelp32Snapshot
push edi
call ebx
push str.Thread32First
push edi
mov dword [esi + 4], eax
call ebx
push str.Thread32Next
push edi
mov dword [esi + 8], eax
call ebx
push str.Module32FirstW
push edi
mov dword [esi + 0xc], eax
call ebx
push str.Module32NextW
push edi
mov dword [esi + 0x10], eax
call ebx
mov ecx, dword [esi + 4]
mov dword [esi + 0x14], eax
cmp ecx, ebp
pop ebx
je 0x44a2a7
cmp dword [esi + 8], ebp
je 0x44a2a7
cmp dword [esi + 0xc], ebp
je 0x44a2a7
cmp dword [esi + 0x10], ebp
je 0x44a2a7
cmp eax, ebp
je 0x44a2a7
push edi
mov dword [esi], 1
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebp
ret
push edi
mov dword [esi], ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebp
ret

Function at 0x44dbed
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004810dd
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44dd10
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d40d
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44dd27
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d31d
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48120d
Capabilities:
Encode data using xor

Disassembly:
push ss
imul edi, edx, 0x38
call 0x940c04f0
call dword [edx - 0x4f344902]
into
sar dword [edi + 0x82eb298], cl
mov dl, 0xd8
jbe 0x4811ad
fdiv dword [esi + 0x37]
adc ch, byte [0x5a4267a3]
dec ebx
div dh
mov fs, word [edx + 0x232b52c0]
push ebx
repne cmpsb byte [esi], byte es:[edi]
mov ecx, 0xd27e9a9f
mov eax, 0x54466e57
jge 0x4811ef
cmp ebp, dword [ebx]
jb 0x4811b6
call ebx
out dx, al
cmp cl, byte [ecx + 0x69]
jecxz 0x481173
sub dh, 0x5e
scasb al, byte es:[edi]
retf
mov eax, 0x4122af13
xor cl, byte [ebx + 0x43]
and al, byte [ecx + 0x32]
dec ebx
inc ebx
xor al, 0xb3
mov bl, 0x71
test dword [edi], 0x2502bd6e
lds esi, [edi]
jno 0x4811b0
pop es
outsb dx, byte [esi]
mov ebp, 0x37c52502
aaa
push edi
mov ah, byte [edx - 0x6d457d65]
mov ebx, 0x9fb68183
mov edx, 0x41bed24d
sub ah, byte [eax - 0x26]
xchg ebx, eax
jnp 0x48115c
cmp ebp, dword [esi + edx*2 + 0x29e31c05]
push 0x4e673c52
sbb al, 0xe3
sub dword [eax + 0x52], ebp
cmp al, 0x67
dec esi
push 0xffffffffffffff97
jp 0x4811bf
wait
jp 0x4811b7
xor dword [ecx - 0x47dd5e3e], esi
and ch, byte [ebx - 0x2b7ea30]
mov eax, 0x15d0ab22
dec eax
std
add ch, byte [edi + 0x62]
add dh, byte [edx + 0x16]
add dword [edx + 0x33], edx
in eax, dx
adc byte [ecx], al
mov esi, 0xec3fc128
dec bl
inc ecx
movsb byte es:[edi], byte [esi]
xor eax, 0x6dbb5356
push esi
push ebx
invalid
insd dword es:[edi], dx
push esi
push ebx
mov ebx, 0x2acffe6d
inc edi
imul edi, dword [esi - 0x70e523ab], 0x7d
jecxz 0x481226
dec bh
sub al, byte [edi + 0x6b]
mov esi, 0x8f1adc55
jge 0x481200
or byte [edi + esi], ah
and al, 0x37
insd dword es:[edi], dx
xor eax, 0xad07e82a
lodsd eax, dword [esi]
mov dl, 0x5e
inc esp
dec ebp
pushal
push ebx
jnp 0x481211
loop 0x481268
wait
jno 0x4811db
inc ebx
test byte [ebp - 0x54], bh
xchg edx, eax
add esp, dword [0xea7743]
xor ebp, esp
cmpsb byte [esi], byte es:[edi]
clc
enter 0x1b9b, 0x5d
invalid
and bh, byte [edx - 0x51]
pop edx
fst qword [edx + ebx*8 + 0x42]
jb 0x4812cb
ret 0x5655
pop edx
int 0x5c
popfd
pop esi
in al, dx
pop ebx
jb 0x4812da
cld
fnstenv [esi - 0x44]
jge 0x481272
xor ah, byte [edx + 0xa0ffd10]
sbb eax, 0x7caa1790
cmp edi, dword [edi - 0x71]
cmp dword [ebp + 0x60bf8361], 0x45
adc al, 0x91
mov ch, 0xa9
salc
jbe 0x481343
and dh, dl
in al, 0x1d
retf 0x17d2
cmp ebp, dword [ebp - 0x57534d1e]
aad 0x52
xchg ecx, eax
bound eax, qword [esi + edx*4]
pop ebx
push 0xffffffffffffffe4
mov dword [0x44b6b23a], eax
in eax, 0x1b
mov bh, 0x1c
wait
popfd
fld xword [edx + 0x27ae8e74]
dec ebx
xor eax, 0x3db44e4a
js 0x48136f
adc dword [ebx + 0x1f], edi
xchg dword [edx + 0x7d], ecx
and al, 0x8f
movsb byte es:[edi], byte [esi]
sub dh, byte [0xc368be6]
inc ecx
push esp
push ebx
cmp byte [esi + 0x7e3f1d73], cl
and dword [edx + 0x1a], esi
invalid
dec edx
jge 0x481396
invalid
or bh, al
aam 0x54
out dx, eax
mov ecx, 0x7266cd39
push edi
outsb dx, byte [esi]
sub eax, dword [edi + eax*2 + 0x1d]
lodsb al, byte [esi]
push eax
ljmp 0xc9a5
Function at 0x496efd
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca3ed
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x497020
push ecx
lea ecx, [esi + 0x18]
call fcn.004b671d
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x497037
push ecx
lea ecx, [esi + 0x24]
call fcn.004b662d
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4c9b2d
Capabilities:
Authenticate hmac

Disassembly:
retf 0xd31f
lcall 0x8b0, 0x462285d
inc esp
std
and ah, byte [edi - 0x5f]
xor byte [ebx - 0x71], 0x5c
push 0xffffffffffffffe0
cmpsb byte [esi], byte es:[edi]
adc eax, 0xf72870db
xchg esp, edx
mov ecx, 0xbcec297c
fsubr st(6), st(0)
loope 0x4c9aec
inc ebx
add al, 0x7c
sub dword [edx - 0x5a06d374], eax
dec ecx
push ecx
mov ah, 0x90
stosd dword es:[edi], eax
jns 0x4c9bba
imul ecx, dword [ecx], 0xffffffa2
cli
push edi
or al, 0x1d
cdq
movsb byte es:[edi], byte [esi]
invalid
mov eax, 0x2d50b810
movsd dword es:[edi], dword [esi]
pop eax
pushal
js 0x4c9b5b
or eax, 0x88e7fd77
add byte [ecx], cl
inc esi
stosb byte es:[edi], al
invalid
Function at 0x4ca51d
Capabilities:
Encode data using xor

Disassembly:
cmc
xor dword [ecx], ecx
fstp st(0)
xor al, 0x97
or ah, 0x5f
scasb al, byte es:[edi]
add byte [edi + 0x1d0fe177], dl
mov al, 4
add al, 0x25
dec edi
aas
invalid
mov al, 0x52
invalid
add al, 0x25
dec edi
aas
test eax, 0xa5c752b0
mov bl, 0x55
add eax, 0x18b0285
or edi, edx
xor eax, 0x7d9f2645
sbb dword [ecx + ebx], ebp
jb 0x4ca50b
lodsd eax, dword [esi]
ficom word [edx + ebp*4]
adc ebx, ebx
sub eax, 0xcbe7b44a
xchg edx, eax
bnd jno 0x4ca5b2
test eax, 0x6c2b0178
stc
call [esi + 0xc]
xchg ebx, eax
add byte [ebx + eax], ah
pop ds
fbstp tbyte [edi - 0x873099f]
mov cl, 0xa8
shr byte [eax + 0x6cd3f2ae], 0x94
je 0x4ca5d9
clc
add eax, 0xdbfa9205
pop eax
adc al, byte [ebx + edx*2 + 0x6ae8e755]
pop es
push ebx
push ebp
out 0xe8, eax
push 7
or dword [edx - 0x3bc417a0], 0x36cf2799
dec eax
jnp 0x4ca5d1
and byte [ecx + 0x5ed15f1], al
sbb al, 0x94
mov esi, 0xb92d6e7e
loope 0x4ca572
dec dword [ecx - 0x379fd8bc]
adc byte [edi + 0x43abb28b], al
pop ebx
or esi, 0xffffffe7
arpl word [eax - 0x2e45bf21], cx
sub eax, 0xa588d61c
mov al, 0xda
sub ecx, dword [ecx - 0x30]
stosd dword es:[edi], eax
xor dword [eax], ecx
add dword [ebx + 0x5096889e], ebx
imul edx, dword [ebx - 0x62dbbada], 0xe2708766
dec ecx
outsd dx, dword [esi]
or esp, dword [ecx]
cmp dword [edi + 0x98e3d49], ebp
mov cs, word [ecx]
sub dword [0xbe371d17], ebx
mov ah, bl
mov edx, 0x878b68bf
mov ch, 0x86
mov al, byte [0xb8965b]
insd dword es:[edi], dx
xchg ebx, eax
dec ecx
std
or byte [eax], dh
out 1, eax
call 0x880a7e6f
sar byte [edx + 0x37ae782b], 1
xchg ebp, eax
int3
Function at 0x4e035d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0051384d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e0480
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffb7d
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e0497
push ecx
lea ecx, [esi + 0x24]
call fcn.004ffa8d
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4e5bde
Capabilities:
Encode data using xor

Disassembly:
and al, 0x5e
outsb dx, byte [esi]
inc ebp
and al, bh
mov edi, 0xd7a8ca1a
aas
rcl esi, cl
fimul word [ecx - 5]
push ss
cmc
lodsb al, byte [esi]
cmp dh, ch
movsd dword es:[edi], dword [esi]
mov ch, 0x78
xchg edi, eax
pop esp
sub dword [ecx + 0x7f], ecx
pop esi
std
mov dl, 0xed
invalid
in al, 0x4b
and al, 0x6c
int3
pop ecx
test dword [ecx - 0x71], ecx
mov ch, 0xb9
call 0xf5349b77
xchg edi, eax
in al, 0x2e
xchg dword [esi + 0x386cdc09], eax
je 0x4e5b07
push 0x8bd9018c
sal byte [edi - 0x22bbfc6c], 0xab
sub ecx, edx
jno 0x4e5b35
ror dword [edi + 0x27da561e], cl
fdiv dword [ecx + 9]
xchg ecx, eax
salc
mov byte ds:[esi - 0x5730a4f6], 0xe5
or bl, byte [ebx - 0x31]
test al, 0xe5
invalid
or eax, 0xca941fb
xchg esi, eax
rcl edi, 1
push es
mov dh, 0xd5
mov ecx, 0xa77054b4
pushal
std
push edx
jnp 0x4e5c2a
push esi
mov bh, 0xe0
out 0x25, eax
fdiv qword [eax + 0x73]
fnstenv [edi - 0x1dc96903]
push 0xffffffffffffffcf
jl 0x4e5b61
loopne 0x4e5bb3
and eax, 0xd97370dc
mov bh, 0xfd
xchg esi, eax
loop 0x4e5c41
iretd
in eax, 0xba
repne cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
dec esp
dec esp
sub al, byte [ecx + 0x40]
cmc
jp 0x4e5b95
pop es
rcl byte [esi + edi]
test ah, dl
xor al, 0xec
or eax, 0x38b5410e
insb byte es:[edi], dx
add dword [ecx - 0x1bcce21f], 0xffffffb1
xor dword [ebp - 0xd9596e1], esp
jbe 0x4e5bca
aad 0x3b
test dword [ebx + 0x621b3d7], esp
out 0xc4, al
jbe 0x4e5c69
fild dword [eax + 0x6b]
insb byte es:[edi], dx
push esi
popal
imul edx, dword [ebx - 0x761b8422], 0xfaabe766
mov dword [esi - 0x19], esp
stosd dword es:[edi], eax
cli
push ss
xchg edi, eax
push 0x3e
and dword [ecx + eax*2], 0x64e6805b
and dh, 0x64
mov byte [0x8ec6b0f2], al
dec eax
xchg esp, eax
fcom qword [edi + ecx + 0x58653189]
mov dword [esi + 0x6b], ebx
scasd eax, dword es:[edi]
invalid
lodsb al, byte [esi]
push dx
or byte [ecx + eax*2 - 0x47], dh
cmpsb byte [esi], byte es:[edi]
xchg edx, eax
pop es
cdq
jbe 0x4e5c74
enter 0xffffffffffff9174, 0xffffffffffffff90
jge 0x4e5c92
in eax, 0xe6
out 0xb4, al
add ah, byte [edx + 0x236f0e66]
inc esp
ljmp 0xb675
jne 0x4e5c1d
pushal
loope 0x4e5ccc
bound eax, qword [esp + edx*8 - 0x2c844ce]
das
or byte [edx + 0x667f0ede], 0xb6
xchg edi, eax
test ah, dl
xor bh, byte [ebx - 0x7fd002c9]
mov bl, dh
push cs
jg 0x4e5cdd
mov dh, 0x97
jo 0x4e5cba
push 0x2e
clc
push es
pop ds
push 0x6449dd34
jb 0x4e5c65
or al, 0x82
mov word [esp + eax], fs
jl 0x4e5c67
sub bl, byte [eax + 0x6277a608]
cmpsb byte [esi], byte es:[edi]
ja 0x4e5cf7
mov cl, 0xd7
cmp al, 0xe6
mov ebx, 0xd6eb14f9
xchg dword [edx + eax + 0x190b6876], edi
add dh, byte [esi + 0x68]
or ebx, dword [ecx]
test esp, edx
int 0x3a
movsb byte es:[edi], byte [esi]
dec ecx
shr edx, 1
dec ebx
push edi
and dword [eax - 0x7d01a83a], eax
jnp 0x4e5cee
lcall 0x544, 0x2205149a
mul dword [ecx]
scasd eax, dword es:[edi]
test al, 0xf6
xchg edi, eax
Function at 0x4feaed
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0x84
or al, 0xe4
lahf
jecxz 0x4feb58
adc eax, 0xb707ac30
mov ch, 0x3c
cmp dword [edx + ebx + 0x34], ecx
pop ebx
popal
jbe 0x4feb82
adc dh, byte [edx + 0x6e85162]
adc al, 0x16
out dx, al
aas
push ss
dec esp
mov dword es:[eax], 0x6050386
pushfd
cmpsd dword [esi], dword es:[edi]
xchg bh, ah
mov ah, 0xb6
pop ss
les edx, [ebp + 6]
mov dl, 0x48
jne 0x4feb89
ljmp 0x587b:0x90143086
sub byte [edx*4 + 0x7ce417cd], 0x5b
sbb eax, 0x6b58feab
jbe 0x4feba1
adc byte [ebp - 0x6c], dh
pop es
xchg esi, eax
xor eax, 0x57e66fba
invalid
mov dl, 0x97
movsb byte es:[edi], byte [esi]
and cl, cl
mov ds, word [esi]
jbe 0x4feb7d
xor dword [esi + 0x66511a14], eax
xor al, 0x3a
adc al, 0x1a
push ecx
xor al, 0x3a
jno 0x4feb7f
jae 0x4feb9c
inc edi
out 7, al
jbe 0x4febf4
les esp, [edi + edx*2]
test al, 0x4e
dec esi
hlt
loopne 0x4febfd
inc esp
push 0x74
scasd eax, dword es:[edi]
mov al, byte [0xf7f210b]
sbb al, 0x20
cmpsb byte [esi], byte es:[edi]
and al, 0xe6
aam 0x26
out dx, al
out 0x6e, al
aad 0x34
lodsb al, byte [esi]
cwde
sahf
test bl, ah
mov ebp, 0xa5194c78
lodsb al, byte [esi]
movsb byte es:[edi], byte [esi]
das
arpl bp, cx
add ecx, eax
xor al, 0xe6
sub al, 0x27
jns 0x4fec01
cld
mov esi, 0x3a2e55e
not byte [esi]
mov dword [0xe4089072], eax
scasb al, byte es:[edi]
inc edx
invalid
cld
mov ebp, 0x4170056c
adc al, 0x84
test ebx, ebx
mov ah, 0xe0
pop esi
invalid
sbb dword [ebx + 0x2e], 0x7b
outsd dx, dword [esi]
jg 0x4fec22
and dl, byte [edi + 0x2e]
pushal
insd dword es:[edi], dx
cmp byte [esp - 0x2f8048fe], al
cmpsb byte [esi], byte es:[edi]
jae 0x4fec96
popal
fist dword [edi]
fild dword [ecx - 0x7b6be1ac]
mov ebp, 0x2ccb42f5
pushal
ljmp 0x9241
inc edx
retf
ret

Function at 0x50674d
Capabilities:
Encode data using xor

Disassembly:
xor esi, ecx
je 0x5067c2
jl 0x5067cf
jl 0x5067ca
jbe 0x506752
std
cwde
in eax, dx
pop esi
inc ebp
out 0x95, al
cwde
test dword cs:[esi], esp
invalid
add dl, dl
insb byte es:[edi], dx
sbb byte [ebp + 0x4e980ccc], dh
dec esi
and al, 0xa5
sbb ch, byte [edi]
add al, 0x97
sub bh, dh
mov edx, 0x1d7e6f30
lodsd eax, dword [esi]
retf 0xe454
Function at 0x529a8d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055cf7d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529bb0
push ecx
lea ecx, [esi + 0x18]
call fcn.005492ad
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529bc7
push ecx
lea ecx, [esi + 0x24]
call fcn.005491bd
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x57309d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a658d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5731c0
push ecx
lea ecx, [esi + 0x18]
call fcn.005928bd
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5731d7
push ecx
lea ecx, [esi + 0x24]
call 0x5927cd
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x57b65d
Capabilities:
Encode data using xor

Disassembly:
push eax
inc edx
invalid
rcl byte [ecx - 0x46987ac0], cl
cmp eax, 0x91f2aecb
ljmp 0xf9c5
mov dword [0x5fdb7200], eax
leave
outsd dx, dword [esi]
sbb eax, 0x58327926
pop eax
aas
add al, 0x2d
xchg esp, eax
xor dword [eax - 0x69], 0x5312eedd
ja 0x57b62f
test byte [edx + esi*8], cl
push ss
pop esp
and al, byte [edx + 0x6c16f4f4]
in al, 0xb5
push es
loop 0x57b601
invalid
sbb byte [eax + 0x52a482c0], bl
ficom dword [esi + 0x44]
jb 0x57b615
pop esi
sub dh, al
sahf
sub dl, al
push esi
xor byte [edi + 0x64], cl
je 0x57b63a
outsb dx, byte [esi]
dec edx
xchg ebp, eax
adc byte [ecx], cl
xor dl, bl
scasb al, byte es:[edi]
mov ebx, 0xf4217265
shl dword [ecx + 0x1c], 0x7c
dec ebx
scasb al, byte es:[edi]
aam 0xf2
outsb dx, byte [esi]
mov byte [eax + ecx*2 - 0xd], 0xc9
hlt
Function at 0x5bd28d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005f077d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bd3b0
push ecx
lea ecx, [esi + 0x18]
call fcn.005dcaad
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bd3c7
push ecx
lea ecx, [esi + 0x24]
call fcn.005dc9bd
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret