joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40492e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437e1e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x404a51
push ecx
lea ecx, [esi + 0x18]
call fcn.0042414e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x404a68
push ecx
lea ecx, [esi + 0x24]
call fcn.0042405e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x424d4e
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x1f
or eax, 0x4632f6be
imul ebp, dword [0x7a79c88f], 0x7f
out dx, al
outsb dx, byte [esi]
or dword [ecx + 0x29], ecx
mov ebx, 0x9275b311
inc esp
xchg ecx, eax
popal
enter 0xffffffffffffe23f, 0x41
pop ss
sub bh, ah
test eax, 0x197c07a9
sub al, 0x94
mov ecx, 0x1a92ca51
add byte [ebp - 0x68], cl
push edi
adc ecx, dword [edi - 0x5e8951e4]
and dword [edi - 0x1bb59068], ecx
out 0xbd, al
invalid
Function at 0x42e63e
Capabilities:
Encode data using xor

Disassembly:
and dword [eax - 0x27], ebp
adc dword [edi + 0x47], eax
xor al, 0xee
cmp byte [esi - 0x12a75788], bl
mov dl, 0x60
xchg byte [ecx], bh
loop 0x42e690
lahf
add byte [esi + 0x3f], ah
idiv byte [edx - 0x56d6f030]
mov al, 0xd0
fisubr word [ebx - 0x6f]
sub dword [ecx + 0x6bded0b0], ebp
xchg ecx, eax
jle 0x42e6bf
pop esi
or bl, byte [edi - 0x21a2e0a7]
je 0x42e65a
fistp qword gs:[ebx]
jmp 0x53c95c1c
cmp eax, 0xad5c0841
adc dword [eax + 0xe7f190f], edi
outsd dx, dword [esi]
loop 0x42e6fa
xor ch, byte [edi - 0x68]
loop 0x42e6e7
leave
invalid
sub dword [ebp - 0x62], ebp
mov ecx, ecx
mov ch, byte [esi - 0x2c835f25]
xchg esi, eax
invalid
stc
mov ch, 0xba
movsd dword es:[edi], dword [esi]
test eax, 0x8b7f9f28
dec eax
out dx, eax
xor ebp, dword [edi + 0x6ce629d]
mov esi, 0x5c2f51af
scasd eax, dword es:[edi]
and dword ss:[ebx - 0x23fcdfb2], ebx
salc
xor eax, 0x735b0c4f
pop ecx
leave
dec ebx
les ebx, [edx + 0x79]
cld
pop edx
jns 0x42e6e6
jbe 0x42e6ac
jnp 0x42e6a1
inc ebx
invalid
fild qword [edi - 0x36]
dec ebx
pop ebp
cmp al, 0xa3
sub al, 0xa2
cld
pop ds
pushfd
mov eax, dword [0x2082766c]
add ebp, dword [eax]
push cs
jle 0x42e783
inc edx
lahf
push ds
test al, 0xfe
or ebx, dword [edi]
add ch, byte [esi + 0x427b4355]
jmp dword [edx + 0x1a]
pop ecx
push 0x549be659
cmp al, 0x58
mov byte [0xea24a9ee], al
fld st(6)
scasd eax, dword es:[edi]
lds ecx, [esi - 0x45]
out dx, eax
invalid

Function at 0x44dc3e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0048112e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44dd61
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d45e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44dd78
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d36e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46c51e
Capabilities:
Encode data using xor

Disassembly:
mov byte [edi + 0x32], bh
cmpsb byte [esi], byte es:[edi]
jnp 0x46c4e2
pushal
std
or byte [esp + ebp*4 - 0x193a86d0], dl
push ecx
or al, 0x41
inc ecx
and dword [0x49454199], 0xe15bbc48
mov eax, ecx
dec ecx
dec eax
mov esp, 0xc18be15b
push 0xffffffffffffff83
je 0x46c4af
cwde
cmc
sal byte [ebp - 0x27], 0x33
and edx, ebx
sbb eax, 0x61816b2b
jne 0x46c498
xor esp, dword [ecx]
ficomp dword [0x61816b2b]
inc ebp
mov eax, dword [ecx]
popal
cmpsd dword [esi], dword es:[edi]
test byte [edi + 0x74], bl
inc esp
rol dword [ebx], cl
pop ebp
jg 0x46c4bd
jg 0x46c54c
xchg dword [eax - 0x64], eax
add dword [eax + 0x159399f], esi
lahf
cmp dword [ecx + 1], ebx
mov esi, dword [ecx]
les esi, [ebx - 8]
xchg ecx, eax
pop edi
rcl byte [ebp + 0x65]
daa
mov byte [ebx + 0x77], bh
pop eax
pop ecx
scasb al, byte es:[edi]
push ebx
dec edx
xor byte [esi - 0x62], dh
and dword [eax - 0x37], ecx
inc ebp
sbb ebx, dword [esi - 0x27614350]
loope 0x46c4dc
ljmp 0xd56a:0x2553d8e2
push cs
jmp 0x46c4a9
xor dword [eax], ebx
or dh, bh
dec esp
cmc
add byte [eax - 1], ah
push ebx
cmp al, 0x8d
inc eax
inc ebx
lea eax, [eax + 0x43]
mov cl, 0x77
xchg ecx, eax
jge 0x46c54c
sbb al, byte [eax - 0x2d52e770]
or esp, dword [ebp - 0x313c2b24]
mov ecx, 0x5a402cad
enter 0xffffffffffffeb31, 0x60
mov al, 0xcc
je 0x46c541

Function at 0x46f02e
Capabilities:
Encode data using xor

Disassembly:
les eax, [eax - 0x75]
mov ecx, 0x461eda06
push 0xf8c07ad5
out dx, al
fadd st(0), st(0)
pushal
ror byte [ebx], 0xb3
fld xword [edi]
add ecx, dword ss:[eax]
xor dword [ebx - 0x7b], esp
enter 0x28ad, 0xffffffffffffffc1
dec ebp
mov edi, 0x2a60b7b9
outsd dx, dword [esi]
xchg edi, eax
test ch, cl
jo 0x46f044
arpl word [edi - 0x21ec5d00], bx
dec ecx
daa
ror byte [esi - 0x17], cl
sbb cl, byte [edx - 0x5a]
mov dword [edx + 0x7dc7af69], ebx
dec eax
fcomp dword [ebx - 0x764e044b]
mov dh, 0x93
jno 0x46f07e
inc ecx
add al, 0xd3
dec edi
xchg esi, eax
pop edi
out 0x65, eax
sub eax, 0x9b306451
xor ch, dl
and al, 0xb9
jns 0x46f0b3
add al, 0xb
into
int3
pop edi
xchg dword [esp + 0x3dd40f99], eax
mov bl, 0xab
int 0x39
xchg ebp, eax
invalid

Function at 0x493570
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
push esi
lea eax, [ebp - 0x198]
push edi
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.0044a210
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 8], 1
call edi
lea ecx, [ebp - 4]
mov esi, eax
push ecx
push 0x2000000
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4935f0
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push 4
push edx
push 0x18
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x4935e6
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4935f0
call edi
jmp 0x4935f0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0xb6e137
Function at 0x496fbe
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.004ca4ae
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4970e1
push ecx
lea ecx, [esi + 0x18]
call fcn.004b67de
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4970f8
push ecx
lea ecx, [esi + 0x24]
call fcn.004b66ee
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b58ee
Capabilities:
Encode data using xor

Disassembly:
pop ss
rcr dword [edi], cl
ror byte [ecx - 0x47], 1
lds ebp, [edi + 0x4bd99fbc]
mov dword [edx + 0x6f], esi
stc
out 0x32, al
das
retf
aas
xor eax, 0x2afc65dc
pop edi
popal
cld
sub bl, byte [edi + 0x61]
dec eax
and al, al
dec esi
jl 0x4b5924
int1
je 0x4b5863
ja 0x4b58dd
lodsb al, byte [esi]
pushfd
ja 0x4b58df
mov dword [esi], 0x730bc707
jne 0x4b589b
out 0x34, eax
jns 0x4b593a
pop ebx
cmp bh, 0x55
outsd dx, dword [esi]
sbb edx, ebx
aad 0x27
sub eax, 0xa9089377
ja 0x4b5914
test eax, 0x816ec99a
mov dword [ebp - 0x1d0df66b], esi
enter 0xffffffffffffb02f, 0xffffffffffffffc5
and byte [ebx + 0x5d], 0x2d
arpl word [ebp + 0x2d], bx
sub eax, 0x54f9b1b0
mov al, 0xb1
stc
push esp
imul ebp, dword [esi], 0xe
mov ecx, 0x75237793
cmp edi, 0x807552a4
movsb byte es:[edi], byte [esi]
push edx
jne 0x4b5872
movsb byte es:[edi], byte [esi]
push edx
jne 0x4b5872
cmc
inc ebx
sbb al, 0x11
sar dword [esi], 1
test al, 0x90
push esi
cwde
inc ecx
jno 0x4b5973
lds esi, [eax]
pop ds
jecxz 0x4b5967
ror byte [eax - 0x4e], cl
dec esp
push edx
in eax, dx
wait
pushfd
mov dword [0x705769c1], eax
jg 0x4b5897
xor al, al
dec ecx
aaa
and eax, dword [edi + 0x756f9771]
out dx, eax
sub edi, 0xfffffff1
aaa
loop 0x4b595a
jb 0x4b592f
mov dl, 1
pop esp
push edx
add dword [edx], 0xffffff81
mov dl, 0x36
xchg ebx, eax
mov byte [0x95b743e1], al
rol byte [edi], cl
out 0x22, eax
xlatb
and dl, bh
jnp 0x4b590d
invalid
push ebx
cmc
rcl dword [edi + 0x61322fbe], cl
lcall 0x633e, 0x33360ad5
invalid
arpl si, ax
and dl, byte cs:[eax + 0x616766e5]
lea esi, [edx + 0x3c]
neg dword [ebx]
adc dword [ecx], 0x67
fild qword [ebp - 0x61d89827]
cmp al, 0xf7
sbb eax, dword [ebx - 0x522098ef]
fldenv [edi + 0x27]
sahf
invalid

Function at 0x4c0cce
Capabilities:
Encode data using xor

Disassembly:
jno 0x4c0d01
mov ebx, 0xc95873a3
aam 0x26
stc
arpl word [esi - 0x19ee29d3], bx
daa
std
adc dword [bp + si + 0x5e8e], eax
lea edx, [eax + 0x62bb5400]
dec ebx
push es
daa
or eax, 0xfaf88231
wait
stosd dword es:[edi], eax
iretd
insd dword es:[edi], dx
and edi, esi
add dword [edi], edx
invalid
Function at 0x4e041e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0051390e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e0541
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffc3e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e0558
push ecx
lea ecx, [esi + 0x24]
call int.004ffb4e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5296ce
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x529735
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x529752
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x5297bb
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.0057269e
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x52978e
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x52977e
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x5297b5
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x52980f
inc edi
cmp edi, ecx
jb 0x5297a2
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.0055d03e
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570f1a
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x5297b5
cmp dword [esi + 0x14], 0x10
jb 0x52981e
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x529838
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.0057269e
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x52986e
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x52985e
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x5298ac
cmp ecx, edx
je 0x529923
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x529894
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.0054860e
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0055d16e
mov eax, esi
jmp 0x5297f4
or ecx, 0xffffffff
jmp 0x5298ae
Function at 0x529b4e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055d03e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529c71
push ecx
lea ecx, [esi + 0x18]
call fcn.0054936e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529c88
push ecx
lea ecx, [esi + 0x24]
call fcn.0054927e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x52f438
Capabilities:
Encode data using xor

Disassembly:
jp 0x52f3b7
xor esi, 0xffffff9a
test al, 0x9d
retf 0xe4b1
sub byte [edi + 8], al
stc
mov cl, 0xbb
push edx
daa
lodsb al, byte [esi]
inc edx
mov edx, 0xb8b98473
dec ecx
xor eax, 0x83e4f2bc
popal
jmp 0x52f3dd
jp 0x52f39d
cdq
imul esp, dword [ebx - 0x7e3651d7], 0x6850eb2f
mov ecx, 0x9dd3024e
mov ch, 0x26
cmp ebp, ecx
invalid
jge 0x52f43c
mov ecx, 0xdb26c43a
cmp dword [ebp + 0x28], ebp
pop ebx
dec eax
loope 0x52f3ba
mov al, 0x2c
ja 0x52f498
imul esi, dword [0xddeaeed4], 0x49f5ab6c
sar byte [edi - 0x27], 0x6e
stosd dword es:[edi], eax
sub dword [esi + eax*4 - 0x7a0e05cc], 0xfde86e58
inc ecx
sbb eax, ebp
sub al, byte [ebx + 0x4b]
inc ebx
dec ebx
inc ebx
dec ebx
dec edi
nop
sbb byte [ebx + 0xf0fe53d], dh
and al, 0x96
fstp dword [ebp + 0x44]
inc esp
adc ebp, edi
mov esi, 0x7e3d5a8a
xor byte [ecx + 0x54], bl
inc ecx
mov al, al
jecxz 0x52f4ce
test eax, 0x58b224ba
pop eax
push ebx
clc
das
sub dword [ebx - 0x694f63d4], ecx
pop ebx
xor ecx, ebx
xchg edx, eax
jbe 0x52f446
push 0xffffffffffffffc7
push ds
xchg ebp, eax
in al, 0x11
std
or al, 0xd1
jnp 0x52f408
inc ecx
outsd dx, dword [esi]
add ch, byte [edi]
push es
retf 0x4d93
std
inc edi
mov dh, 0x8d
out dx, eax
mov dh, 0xca
rcl byte [ebp + 0x12], 0xc9
retf
inc esi
cmp dword [ebp + edi*4 + 0x73], ecx
pop esp
sub al, 0xd9
dec esp
mov ebp, 0xd92c5c73
push ebp
pop es
and dword [eax - 0x71], 0x3229f632
hlt
mov al, byte [0x59e4a434]
mov byte [ebp + 0x6a1210a8], al
push eax
adc ch, byte [edx + 0x50]
wait
movsb byte es:[edi], byte [esi]
jle 0x52f49b
cmp bl, byte [ebx + 0xb]
jns 0x52f485
fst dword [ecx]
sub ebx, dword [ecx - 0x6d]
dec ebp
jl 0x52f4c5
dec esi
dec edx
retf
Function at 0x57315e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a664e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x573281
push ecx
lea ecx, [esi + 0x18]
call int.0059297e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x573298
push ecx
lea ecx, [esi + 0x24]
call fcn.0059288e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret