joyce8/EMBER2024-capa huggingface dataset:
Function at 0x685aa0
Capabilities:
Encode data using xor

Disassembly:
add al, 0xf2
mov edx, 0xaf659ca
insb byte es:[edi], dx
pop ecx
test byte [edx], 0x6c
mov al, 0xfa
in al, dx
dec eax
loope 0x685aa4
clc
in eax, 0x81
xor ebx, esi
loope 0x685af9
mov eax, dword [0xf3c57f6f]
push ds
imul ebp, dword [eax + 0x47], 0xffffffcf
div byte [edi - 0x56]
ret 0xc300
add eax, eax
jle 0x685b56
loopne 0x685b06
int1
jno 0x685b13
mov al, byte [0x294adefb]
in al, dx
dec edx
sub esp, ebp
stosd dword es:[edi], eax
scasb al, byte es:[edi]
int3
sbb esi, dword [ebx + 0x62b85e62]
lds ebx, [esi - 0x1e]
sub dword [edx], ecx
sub byte [esi + 0x31997f5d], bh
mov ebp, 0xd4255e7e
jge 0x685ba1
shl dword [esi], 1
jecxz 0x685ba1
or byte [ebx + 0x5e], ah
fidivr word [ebx - 0x38]
dec ebx
fisubr dword [edi]
inc edi
les ebx, [esp + ebp*8 - 0x13]
adc ebp, dword [edx]
pop ebx
in al, 0xf2
fldcw word [edx - 0x4d]
mov byte [ebx - 0x4d0c7c74], dl
jno 0x685bb1
test al, 0xa2
invalid
mov al, 0x4f
ficomp dword [ebx + edx*4]
sbb eax, 0xfe3a96f8
adc ebx, dword [ecx]
out dx, eax
mov eax, 0xd54835e0
sub dword [ecx + 0x60], 0x23
in eax, 0xaf
dec eax
or eax, 0x598afbe6
dec eax
dec ecx
push esp
dec byte [ebx + ebp*4 - 0x33b276f3]
adc eax, 0x4dff281b
invalid
pop esp
outsb dx, byte [esi]
or eax, 0xc0fdefc1
xchg esi, eax
int3
mov esi, ebx
invalid

Function at 0x68bde0
Capabilities:
Encode data using xor

Disassembly:
jnp 0x68be49
int1
and byte [edx - 0x60], dh
mov al, byte [eax + esi*4]
cli
invalid
je 0x68bdc8
sbb edx, dword [ecx]
inc ebx
and dh, byte [edi - 0x3bd8a111]
outsb dx, byte [esi]
inc ebx
xchg esp, eax
adc eax, 0xa0fba35f
outsb dx, byte [esi]
xor ch, byte [ebp]
push ss
jmp 0x46dfdb2e
add eax, 0xa26ce4db
shl byte [edi], 1
shl byte [edi - 0x28], 0xbc
and edi, ebp
arpl word [edx + 0x27dcd8e7], dx
cmpsd dword [esi], dword es:[edi]
cli
enter 0xfffffffffffff9a5, 0x63
nop
cmpsb byte [esi], byte es:[edi]
test eax, 0xce4c3315
enter 0x349, 0x68

Function at 0x69ff28
Capabilities:
Encode data using xor

Disassembly:
shr dword [ebx + esi*2], 0xaf
mov eax, 0x8824151a
dec esp
rcl dword [esi - 0x3c], cl
cwde
or edi, edx
lodsd eax, dword [esi]
cmp al, 0xc4
sub byte [ebp - 0x30cb304], bh
movsd dword es:[edi], dword [esi]
xchg ecx, eax
dec ebx
xor dl, bl
bound eax, qword [edx + 0x3c]
add byte [ebp + 0x5ededd6], ch
dec esp
inc ebx
inc ebx
xor eax, 0x5242e401
sub dl, byte [eax + 0x2a]
inc eax
sbb cl, byte [edx - 8]
mov dword [0x4bfe6ba0], eax
invalid

Function at 0x6a3238
Capabilities:
Encode data using xor

Disassembly:
push ss
loopne 0x6a324f
out dx, eax
pop eax
adc bl, 0x3b
and ch, byte [ecx + 0x37]
aaa
les edx, [edx - 4]
fnsave dword [edx]
xchg dword [esp + ebp*4 - 0x45], eax
jae 0x6a3217
Function at 0x6bfb70
Capabilities:
Encode data using xor

Disassembly:
jl 0x6bfafc
sub byte ss:[eax + eax*2], cl
xchg esi, eax
test al, 0x91
cld
and dword [ebx - 0x20], eax
adc al, 0x63
xor ebx, dword [ebp + 0x31]
mov ebp, 0x985e7399
sub bl, byte [eax]
stosb byte es:[edi], al
push ecx
pop edx
wait
sbb al, 0x46
push ebx
je 0x6bfbb6
mov dl, pe_nt_image_headers32
mov dword [0x64e2d86f], eax
scasd eax, dword es:[edi]
ret 0xeda2
lds esp, [esi]
push 0xb
sahf
mov dl, 0xba
add byte [ebp + 0x26], ch
push ebx
dec edx
cmp dword [ecx], eax
ljmp 0xff11

Function at 0x6c1c50
Capabilities:
Encode data using xor

Disassembly:
and dh, byte [edx - 0xb]
lodsd eax, dword [esi]
sub eax, 0x65c99ded
mov bl, 0x44
lea esp, [eax + ebx]
push esi
mov dword [esi + 0x12], eax
bswap ecx
xlatb
mov bl, 0x7a
dec edi
test bl, 0xd5
push ebp
jns 0x6c1c29
invalid
pushal
dec ecx
jns 0x6c1b98
mov ebx, 0xb92b41be
dec ecx
push 0x221c2964
shr dword [ecx], cl
xchg esp, eax
xor eax, 0x5dda64fb
iretd
clc
cmpsb byte [esi], byte es:[edi]
fisttp dword [ebx - 0x3b]
scasb al, byte es:[edi]
and dword [0xa5eafb88], ebx
jnp 0x6c1c7a
lds ebp, [esi - 0x477e2df]
ljmp 0x2b2:0xff627ba5
push dword [edx + 0x7c19702]
mov dh, 0x89
pop esi
jb 0x6c1beb
sub ecx, eax
pop ebp
mov eax, 0xfda9bc2f
adc al, 0x90
test eax, 0x901467fd
push 0x2c2900bf
push cs
lea esi, [edi]
daa
mov dl, 0xc7
mov bl, byte [ecx - 0x341cd84d]
mov bl, 0x27
jecxz 0x6c1c0a
inc edi
add byte [esi - 0x3c83dad3], ah
pop edx
xor edx, dword [edx - 0x1e]
invalid
das
jns 0x6c1c3b
leave
bound ebx, qword [ebx + 0x4c]
sbb ch, dh
ljmp 0xad5f
sbb al, 0xf0
xchg ebx, eax
push edx
out 0x88, al
pop ebx
jnp 0x6c1c0e
push eax
pushfd
cmpsd dword [esi], dword es:[edi]
mov al, byte [0x732b9162]
mov al, 0x1a
push eax
jb 0x6c1c14
leave
add al, 0x84
shr dword [eax - 0x7c], 0x28
imul edi, edx, 0xfffffffd
sub byte [eax + 0x4c], cl
sub ecx, dword [eax + 0x54a39d03]
stosb byte es:[edi], al
push cs
iretd

Function at 0x6d4a48
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0xe24ec0ca
enter 0x3425, 0x3c
sub dword [edx], edx
cmp edi, dword [edx + ecx*4]
xchg ecx, eax
jbe 0x6d4a3b
push 8
scasb al, byte es:[edi]
fst dword [ebp + 0x1f]
imul dword [esi]
outsb dx, byte [esi]
pop ebx
ljmp 0xd64
pop edi
add dword [ebx], ecx
pop ss
ja 0x6d4aba
inc byte [edx + 0x7eaa9b4f]
xchg ecx, eax
mov ah, 0xbd
xchg esp, eax
inc edi
lahf
ja 0x6d4a19
mov dword [ebp + 0xba70923], 0xffb47ad9
or dword [esi - 0x7e], 0x1ae15829
arpl word [ebx], cx
retf 0x3c18
movsd dword es:[edi], dword [esi]
inc ebp
lahf
sub ch, byte [edx + 4]
pushal
xor al, byte [ebp + 0x15abdc32]
loopne 0x6d4aba
sbb eax, edi
mov esi, 0x24163a86
popfd
xor dword [eax + edx*8], esi
push ebp
sal byte [ebp + 0x2dca6629], 0x37
lodsd eax, dword [esi]
daa
inc ebx
test eax, 0x94356818
xlatb
dec esp
daa
out 0xff, al
test ah, dh
ljmp 0x4ac8
Function at 0x6d9050
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x65eaad47
sub dword [ebx], eax
cld
push ds
out dx, eax
fst qword [ecx + eax*8 - 0x5e]
or al, byte [esi + 0x4f5c9b7d]
invalid
stosb byte es:[edi], al
mov edi, 0x7da6f2d9
je 0x6d90c7
cld
sbb byte [ebp - 0x20], 0x4d
mov cl, 0xd
ficom dword [ecx - 0x53f97223]
call 0xbe6fa0b3
jle 0x6d9077
and eax, 0xa837f1c9
js 0x6d900d
and dh, cl
xchg ebp, eax
jno 0x6d90e9
push edi
enter 0x173e, 0xffffffffffffff85
xchg edx, eax
or eax, ecx
sub byte [ecx + 0x44f1e06f], ah
invalid
mov eax, 0xb5c9682f
imul ebp, dword [edx + eax + 0x38], 0xfffffffe
sbb dword [ebx], ebp
mov esi, 0x1008f790
stosd dword es:[edi], eax
xchg esp, eax
dec edx
ljmp 0x6312
add bh, byte [eax]
invalid
sub al, byte [0x4587dde2]
int 0x54
jnp 0x6d912b
invalid
jl 0x6d90ce
xor eax, 0xcafc5418
ror byte [edx], 1
invalid

Function at 0x6e14c8
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x95409f9a
inc eax
xchg ebp, eax
out dx, eax
aas
jno 0x6e14b5
test eax, 0xe0bfaa69
push edi
outsb dx, byte [esi]
sbb esp, dword [esi - 0x33]
jle 0x6e1516
into
jns 0x6e14b2
test dword [ecx], 0x9df89f57
sub esi, dword [edx + 0x54]
dec esp
mov esp, 0x246fa808
insb byte es:[edi], dx
and ebp, dword [ecx + 0x3a]
mov ah, 0x9f
stc
insb byte es:[edi], dx
adc bl, byte [ebp - 0x38]
or ecx, ecx
adc esi, edx
mov edi, 0x903a28a3
dec esi
sub eax, 0xa60201d7
in eax, 0x4a
sbb dh, cl
push edx
push esp
rcr byte [edi + 0x3c970e4a], cl
mov esi, 0x518da6d
inc ebx
dec ebx
mov ch, dl
invalid
lodsb al, byte [esi]
inc esp
je 0x6e1563
sal byte [esp + ebp], cl
sub ah, byte [ecx]
mov esp, 0xd1452335
pushal
xor byte [bx + di - 0x47fe], 0xea
push cs
scasd eax, dword es:[edi]
mov dword [0x961097e4], eax
push edi
dec edx
setne byte [ecx - 0x36]
or dword [edx], esi
in eax, 0x71
cmp dh, 0x53
scasd eax, dword es:[edi]
cdq
mov bl, 0x35
pop esp
mov ebp, 0xf25f917d
loopne 0x6e14f3
arpl word [ebx], di
pop ss
pop ecx
jo 0x66bb3922
dec ebp
adc eax, 0x6ef24d32
xchg edx, eax
clc
fbstp tbyte [ebx - 0x66]
int3
add dl, byte [edi + 1]
xor eax, 0xc718549c
mov edx, 0xb028dd5a
adc eax, 0xbf537484
mov al, byte [0xc5cf475e]
add al, al
salc
jmp 0xd1557993

Function at 0x6eb380
Capabilities:
Encode data using xor

Disassembly:
sbb byte [ecx - 0x627e7e39], ch
mov al, 0x4d
push ds
test byte [eax + edx*4 + 0x1e], dl
add dword [ecx + 0x1e4db09d], 0x1e905484
xchg esi, eax
inc ecx
inc edi
mov esp, 0x4fbdaab0
or al, 0x51
cmpsb byte [esi], byte es:[edi]
adc dword [eax], edi
mov edx, 0x85f66f2
xor eax, 0x90cbe2b8
sbb dh, cl
jbe 0x6eb383
jl 0x6eb3cf
invalid
mov byte [esi - 0x4e], dh
dec eax
or byte [edx], 0xd4
or byte [esi - 0x32977720], al
inc ebp
cmp al, 0x74
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40a873
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40a882
pop dword [ebp - 8]
mov eax, 0x40a882
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x37227
push 0
mov eax, 0x37892755
add eax, 0xc8b7b983
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x1804193c
sub ecx, 0x1803d98d
mov ebx, eax
mov edi, 0x1c97247d
add edi, 0xe3aa1747
add edi, dword [ebp - 8]
mov edx, 0xfbb41c3c
add edx, 0xa6d8b0b4
add dword [ebp - 4], 0x187b1fba
mov esi, dword [edi]
mov dword [ebp - 4], 0xea05c425
xor esi, edx
add dword [ebp - 4], 0x824a1ebc
mov dword [ebx], esi
mov dword [ebp - 4], 0x7109679b
add ebx, 4
add edi, 0xb81164b3
add edi, 0x47ee9b51
loop 0x40a8dc
add eax, 0xf18f
mov ebx, eax
add eax, 0x629b33c0
add eax, 0x9d64cc45
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x404601
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437af1
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x404724
push ecx
lea ecx, [esi + 0x18]
call fcn.00423e21
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x40473b
push ecx
lea ecx, [esi + 0x24]
call fcn.00423d31
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44d591
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x44d5f8
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x44d615
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x44d67e
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00496561
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x44d651
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x44d641
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x44d678
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x44d6d2
inc edi
cmp edi, ecx
jb 0x44d665
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.00480f01
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00494ddd
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x44d678
cmp dword [esi + 0x14], 0x10
jb 0x44d6e1
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x44d6fb
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00496561
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x44d731
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x44d721
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x44d76f
cmp ecx, edx
je 0x44d7e6
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x44d757
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.0046c4d1
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00481031
mov eax, esi
jmp 0x44d6b7
or ecx, 0xffffffff
jmp 0x44d771
Function at 0x44da11
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00480f01
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44db34
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d231
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44db4b
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d141
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4533a5
Capabilities:
Encode data using xor

Disassembly:
jl 0x453408
pushal
mov esi, ebx
lodsb al, byte [esi]
cmp esi, dword [edx + 0x1a942126]
sbb bh, byte [edi + 0x27d87645]
sbb bh, byte [edi + 0x27d87645]
in al, 0xb0
xor eax, 0x353b854c
and byte [edi + 0x43d83591], ch
jge 0x45339a
jl 0x4533bd
dec ebp
or ebp, dword [eax]
invalid
push edi
in eax, 0x3d
mov dword [0x3648bb52], eax
pop eax
dec eax
pop eax
xchg edi, eax
push ebx
jnp 0x453458
test eax, 0x651409e3
imul esp, dword [0x30886ade], 0xffffffd1
jo 0x453479
in eax, 0x70
les edx, [ebp + 0x17a4d394]
ror dword [esi], 0xb3
add ch, 0x72
fadd qword [eax - 0x521ffd8e]
sbb byte [ebp + 0x77], dl
cmpsb byte [esi], byte es:[edi]
and edx, dword [eax - 0x14a13e65]
invalid
loope 0x45340e
and al, bh
rcl byte [edi + 0x70], 0x40
outsd dx, dword [esi]
push 0x18
scasd eax, dword es:[edi]
push ebx
outsd dx, dword [esi]
mov ch, 0xbf
xor bh, byte [ebx - 0x38]
inc edi
inc edx
inc esp
mov edi, 0x1815a21c
push 0x7718f17b
in eax, 0xc6
ja 0x45346d
in eax, 0xc6
jne 0x45349f
pop ecx
and al, 0x32
cmp ecx, ecx
cdq
pop es
ljmp 0x71dc
sbb ebp, dword [ebx]
or byte cs:[edx], al
wait
arpl word [eax + 0x30], si
push 0xffffffffffffffb7
pop eax
aas
push ebp
lodsd eax, dword [esi]
inc edx
push edi
rcl ch, 1
invalid
Function at 0x46d141
Capabilities:
Encode data using xor

Disassembly:
or dword [edx], esp
popfd
pop ss
and byte [esi + 0x72706409], bl
push eax
nop
pushfd
push eax
inc esp
mov byte [0xebbfa779], dh
jmp 0x46d15e
xchg ebx, eax
adc dword gs:[eax - 0x78af2add], 0x13
out 0x8e, eax
add al, 0x50
adc eax, 0x534ccf35
add byte [eax + eax*8 - 0x47e95653], bh
sal dword [ecx - 0x42], 1
mov al, byte [0xd182899]
adc esi, dword [ebp - 0x5983ea28]
and eax, 0x3079a8d2
or al, byte [edx - 0x4e]
invalid

Function at 0x496da1
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca291
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x496ec4
push ecx
lea ecx, [esi + 0x18]
call fcn.004b65c1
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x496edb
push ecx
lea ecx, [esi + 0x24]
call fcn.004b64d1
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4e0201
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005136f1
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e0324
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffa21
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e033b
push ecx
lea ecx, [esi + 0x24]
call fcn.004ff931
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5136f1
Capabilities:
Encode data using xor

Disassembly:
cdq
adc byte [esi + 0x2dab1d6e], ch
and byte [eax - 2], 0x2d
lodsd eax, dword [esi]
js 0x51375d
push eax
and eax, 0x8e91d677
sahf
shr byte [eax - 0x56b723ff], 1
mov ch, 0x3a
imul esp, dword [eax + 0x29], 0xf0e18023
mov dl, 0x1c
push edx
xchg ebp, eax
xor eax, 0xccaec4b5
and esp, edi
lds ebx, [ecx + 0x3a]
ret 0x94c3
rcl byte [ecx + 0x10], 0xe7
rol dword [0xa88d61d1], 1
lahf
xchg ebp, eax
adc esp, dword [edx - 0x57]
inc esp
fild word [ecx - 0x2d]
loopne 0x5137ec
neg byte [ebp - 0x5d]
and eax, 0xdd7d126c
jg 0x513770
sbb esi, esi
or eax, 0xc00bf03
xchg edi, eax
insd dword es:[edi], dx
add edi, dword [edi + 0x6d970c00]
xor byte [ebp + 0x6893c7d9], bh
imul ecx, dword [0x5d421114], 0x59
call 0xf242745a
adc ah, cl
mov dword [ecx], 0x1596c0c9
inc eax
dec eax
test al, 0x34
cmpsd dword [esi], dword es:[edi]
xchg byte [0x55ac459c], cl
mov esp, 0x51616976
xlatb
mov ecx, 0xa24a2840
xor dword [eax], ecx
xchg ecx, eax
js 0x513780
and byte [eax], ch
dec eax
cmp dword [ecx - 0x1856d2cf], ebx
xor eax, 0xe98861cc
popfd
inc esi
mov esp, 0x7f65ed06
rcl dword [eax - 0x80]
sub cl, dh
jns 0x51377b
pop esp
ret 0xcfbe
fcmovne st(0), st(2)
cmp al, 0x9c
test dword [ecx - 0x770ed7c4], edi
sbb ch, dl
Function at 0x572f41
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a6431
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x573064
push ecx
lea ecx, [esi + 0x18]
call fcn.00592761
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x57307b
push ecx
lea ecx, [esi + 0x24]
call fcn.00592671
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret