joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418240
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x448070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.Entering___RunningAsAdministrator
push 0x44aca0
call sym.SetupBD.exe_public:_void___cdecl_CNcsDebug::Print_wchar_t_const__
add esp, 8
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x10]
mov word [ebp - 8], 0x500
push eax
push 0
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4182e6
call esi
mov ecx, eax
cmp ecx, 0x3f0
jne 0x4182ca
lea eax, [ebp - 0x10]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4182e6
xor eax, eax
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041b486
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp ecx, 0x78
sete al
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041b486
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 2
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x4182b4
call esi
cmp eax, 0x7a
jne 0x4182b4
mov esi, dword [ebp - 0x1c]
mov eax, esi
call fcn.0041e4b0
mov ebx, esp
test ebx, ebx
je 0x4182b4
lea eax, [ebp - 0x1c]
push eax
push esi
push ebx
push 2
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x4182b4
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4182b4
xor esi, esi
mov dword [ebp - 0x18], 0
cmp dword [ebx], esi
jbe 0x418382
lea edi, [ebx + 4]
push dword [ebp - 0x14]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x41837b
inc esi
add edi, 8
cmp esi, dword [ebx]
jb 0x418362
jmp 0x418382
mov dword [ebp - 0x18], 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x18]
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041b486
mov esp, ebp
pop ebp
ret
Function at 0x419700
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push dword [ebp + 8]
call fcn.0041ca70
add esp, 4
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push 0
push eax
push 0
push 2
push 0
push 0x431fdc
push 0
push str.SOFTWAREINTELNETWORK_SERVICESDMIX
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x419763
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.ForcedLanguage
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x419770
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
mov dword [ebp - 8], 1
push eax
push 0xf003f
push 0
push str.SOFTWAREIntelBasedrivers
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.RebootNeeded
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x428ee5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x448070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0042288d
mov dword [ebp - 0x14], eax
cmp dword [0x44bd2c], esi
jne 0x428fd8
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x428f65
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4290b8
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4290b8
push 0x43cf48
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4290b8
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x44bd2c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x44bd30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x44bd34], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44bd3c], eax
test eax, eax
je 0x428fd5
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44bd38], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x428ffd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x428ff0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x429012
push 4
pop eax
jmp 0x4290ba
cmp dword [ebp - 0x14], esi
je 0x429012
push dword [0x44bd2c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x428ff7
mov eax, dword [0x44bd38]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x429070
cmp dword [0x44bd3c], edi
je 0x429070
push eax
call ebx
push dword [0x44bd3c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x429070
test eax, eax
je 0x429070
call ecx
test eax, eax
je 0x429065
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x429065
test byte [ebp - 8], 1
jne 0x429070
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4290a0
mov eax, dword [0x44bd30]
cmp eax, edi
je 0x42909d
push eax
call ebx
test eax, eax
je 0x42909d
call eax
mov esi, eax
test esi, esi
je 0x42909d
mov eax, dword [0x44bd34]
cmp eax, edi
je 0x42909d
push eax
call ebx
test eax, eax
je 0x42909d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x44bd2c]
call ebx
test eax, eax
je 0x4290b8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4290ba
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041b486
mov esp, ebp
pop ebp
ret
Function at 0x4046f4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437be4
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x404817
push ecx
lea ecx, [esi + 0x18]
call fcn.00423f14
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x40482e
push ecx
lea ecx, [esi + 0x24]
call fcn.00423e24
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x420a34
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
stc
mov ebp, 0x113e6a0d
push ss
mov ch, byte [ebp - 0x4f78760d]
mov esp, 0x9cac6aa9
jp 0x420a73
cli
mov edx, 0xd344e85d
enter 0x664b, 0x45
pop ebp
call 0x4c0add95
inc bp
sbb dword [edx - 0x15], ecx
add dh, byte [ebx]
mov dword [0x8b922a79], eax
fistp qword [edx + 0x5b536a72]
xor al, 0x86
cmpsb byte [esi], byte es:[edi]
ficomp word [ebx + 0x19f8d6eb]
cdq
cmp dword [ecx + 0x38], ebp
dec edx
pop ecx
jnp 0x420a4b
xlatb
fucomp st(2)
cmp dl, dh
or edi, dword [ecx + 0x583726ee]
pop ebx
movsb byte es:[edi], byte [esi]
cmpsb byte [esi], byte es:[edi]
mov ebx, 0x2a68c99a
cmp dword [esi - 0xa14cf0f], ebp
pop ecx
fisttp dword [ebx]
cld
invalid
Function at 0x44a210
Capabilities:
Accept command line arguments
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov edi, eax
mov dword [esi], 0
call ebx
test ax, ax
jge 0x44a23b
or dword [esi], 0x2000000
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x11
mov edi, eax
call ebx
test ax, ax
jge 0x44a258
or dword [esi], 0x4000000
test edi, edi
je 0x44a26e
mov ecx, dword [0x657a4c]
push 0x657768
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0x12
call ebx
test ax, ax
jge 0x44a27d
or dword [esi], 0x8000000
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x44da64
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00480f54
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44db87
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d284
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44db9e
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d194
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46cd24
Capabilities:
Encode data using xor

Disassembly:
pushfd
vaddsubpd ymm3, ymm7, ymmword [esi + 0x1b]
mov byte [ebx - 0x7d5ffe7f], ch
mov edx, 0x8d300d2c
sbb byte [ebp - 0x6d], ah
cmp al, 0x4e
imul eax, dword [ebx + 0x16dc5699], 0x7f
push es
aaa
jne 0x46cda0
adc eax, 0x1f1b4e94
adc eax, 0xb134a405
movsb byte es:[edi], byte [esi]
mov eax, 0x5b2a6aa9
outsb dx, byte [esi]
jb 0x46cd9e
insd dword es:[edi], dx
adc byte [eax], 0x1d
push ss
cli
in eax, dx
or eax, 0x128efc4b
jnp 0x46cd9c
imul edx, dword [edi + 0x57], 0x5b49e4c0
and eax, 0x95ef12a2
mov bh, 4
lds ecx, [edi + 0x64e510d5]
mov cl, 0xec
jno 0x46cde4
popal
adc al, 0x35
scasb al, byte es:[edi]
lcall 0xa70f, 0x5fb36a0d
fcmovnbe st(0), st(6)
xchg edi, eax
neg dword [esi + 0x34a3ec99]
mov dh, 0x34
add al, 0x95
cwde
aaa
je 0x46cd46
test eax, 0x90d85f17
pop ss
pop edi
fcom dword [eax + 0x41e3675f]
nop
pop edi
jcxz 0x46cde6
inc ebp
mov byte [ebp - 0x1b3a8569], dl
insd dword es:[edi], dx
xor byte [eax - 0x11], bh
and eax, 0x27bf1999
cmpsd dword [esi], dword es:[edi]
adc al, 4
outsb dx, byte [esi]
invalid
inc esp
add dl, al
lodsd eax, dword [esi]
mov ss, word [ecx]
pop eax
xor eax, 0xf27f5397
mov al, byte [0xe1265628]
push edi
mov ecx, 0xc6309a15
adc eax, 0x35c6309a
xor dh, al
xor eax, 0xdce76152
push edx
popal
out 0xdc, eax
and al, 0x7e
cmp esi, dword [ebp - 0x7c]
rcr dword [ebp - 0x79], cl
fsub qword [edx - 0x57]
and byte [edi + 0x75617675], bl
adc eax, 0x2595165f
div dword [eax]
pop ebp
scasb al, byte es:[edi]
lcall 0x3785, 0x5e45f3d2
mov bh, 0xa8
pop ecx
and eax, 0x381180b8
cld
std
cmp al, 0xa8
or byte [ecx], ah
xor bl, dl
xor eax, 0x4926bcf9
sti
cmc
jae 0x46cdd0
xor byte [ebx], 0xb8
inc ebp
je 0x46cde9
fisttp word ss:[edx - 0x3c1edb8c]

Function at 0x477774
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
xchg edi, eax
aam 0x50
test byte [esi], bh
sub bl, byte [edi]
movsd dword es:[edi], dword [esi]
xor al, 0xda
adc ebx, dword [ecx]
jmp 0x54ff7082
and byte [edx], bl
jne 0x47774c
sub byte [ebx], al
pop eax
je 0x4777b0
inc ecx
in eax, 0xa4
in eax, 0xd4
cmc
inc esp
movsb byte es:[edi], byte [esi]
mov ebx, 0xeff8587c
pop eax
clc
out dx, eax
pop eax
and al, 3
cmp esp, dword [ebp - 0x17]
xor al, 0x24
jne 0x4777ac
rcr byte [esi], 1
mov bl, 0x7f
dec ebx
or al, ah
pop ds
lds eax, [eax]
clc
adc esi, dword [ebx - 0x2c6f2dea]
dec ebp
and al, 0x95
xchg ebx, eax
shl dword [ebp - 0x2b], 0xbd
clc
jno 0x477787
mov ebp, 0xd7d771f8
xlatb
or dword [esi], edi
mov esi, 0xc13714f5
mov ah, 0x94
call [ebp + 0x34]
inc esi
push edi
mov ah, 5
mov ah, ch
mov edi, 0xc424e465
push ebp
ret 0x9d47
Function at 0x481084
Capabilities:
Encode data using xor

Disassembly:
and eax, 0xf488e2a5
xor byte [esp + ebx*8 + 0x21], dl
sal ch, 0
mov eax, 0x65b8ef80
jnp 0x481028
out dx, eax
mov eax, 0x63ed7b65
mov dl, ah
loopne 0x48109a
arpl word [edx - 0xea51f2c], cx
int1
or al, byte [eax - 0x37dc7c8b]
int1
fisubr word [esi]
push edx
stc
invalid
adc dword [ecx - 0x589f2ecc], ebx
add al, 0xa5
movsd dword es:[edi], dword [esi]
push ecx
shl esp, 0x18
mov al, 0x13
les ebp, [eax]
dec esp
xchg esp, eax
mov edx, 0x847cf505
jp 0x481031
and dword [esp + eax*8 + 0x20], 0x1a690ef5
push ss
shl byte [eax + ebx*2], cl
inc eax
dec esi
je 0x481094
ret 0x51a0
xor dword [eax - 0x1a], edx
mov eax, 0xb44f3915
jnp 0x48105e
mov al, 0x94
aad 0x85
add al, 0x20
mov esp, 0x84008487
jo 0x481057
mov esp, 0xe7079977
jl 0x4810b8
ja 0x481036
pop es
out 0x7c, eax
pop ss
mov al, 0x45
mov esi, 0xd4568c75
inc ebp
invalid
jg 0x481127
shl dword [eax + 0x69], 1
std
int1
inc eax
push ebp
scasd eax, dword es:[edi]
adc esp, esi
cmp eax, 0xef9123d1
movsb byte es:[edi], byte [esi]
sbb esi, dword [ebp + edx*2 + 0x2494a495]
cmpsb byte [esi], byte es:[edi]
test byte [esi], ch
mov ah, 0x44
add byte [ecx + eax*8 + 0x24], al
sar dword [eax + 0xd], 1
invalid
adc byte [0x61a56347], 0x84
invalid

Function at 0x496df4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca2e4
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x496f17
push ecx
lea ecx, [esi + 0x18]
call fcn.004b6614
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x496f2e
push ecx
lea ecx, [esi + 0x24]
call fcn.004b6524
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b58b4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x1a1fcd78
push cs
sub cl, cl
scasb al, byte es:[edi]
mov esi, 0xa26dedc5
cmpsd dword [esi], dword es:[edi]
xor dword [ecx + 0x5f2af028], edi
xchg ebp, eax
ljmp 0x2451
and al, byte [edx]
sbb edi, ebp
fistp dword [edi - 0x61830045]
jl 0x4b585c
pop ebx
test dword [ebx], ebx
lodsd eax, dword [esi]
push edi
xlatb
daa
fld xword [ebp + 0x505d95af]
xor dword [edi - 5], 0xfffffff8
jle 0x4b58bc
or al, byte [ecx + esi*4]
xchg ebp, eax
jl 0x4b58e8
out dx, al
dec ebx
daa
dec edx
jno 0x4b593e
invalid
stosb byte es:[edi], al
pop ss
push ebx
imul edi, dword [ebx + 0x7a], 0xffffffd2
mov bl, byte [ecx + 0x7c]
push ds
xchg edi, eax
test eax, 0xdc2a24bf
jo 0x4b58d8
fistp qword [ecx + 0x3d]
retf 0x9849
mov bl, 0x92
pop edx
leave
xchg esp, eax
inc esp
sti
and byte [eax + edx - 0x4f7b7298], dh
fist word [eax]
mov dword [0xc97105d8], eax
imul ebp, edi, 0xffffff8f
out dx, eax
invalid
cdq
outsb dx, byte [esi]
arpl word [esi + 0x40730fee], bx
jne 0x4b5998
cdq
in eax, 0xbc
ljmp 0xdc84
jp 0x4b59a5
ljmp 0xfe2a:0x84796a3f
jmp 0x4b5a21
mov esi, 0x3122134f
cmp esi, ebx
popal
or byte [edi - 0x40427f31], al
and byte [edx], bh
jmp 0x1984c317
fisub word [ecx + 8]
xchg edi, ecx
cmp byte [ebp - 0x16c5df41], 0xe7
push 0xa8fd1939
loop 0x4b5a72
retf
xor bh, byte [ebx - 0x33491eab]
test al, 0x4f
xchg al, dh
outsb dx, byte [esi]
mov ebx, 0x69aef72a
jecxz 0x4b5a1b
dec ecx
invalid

Function at 0x4e0254
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00513744
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e0377
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffa74
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e038e
push ecx
lea ecx, [esi + 0x24]
call fcn.004ff984
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4fedb4
Capabilities:
Encode data using xor

Disassembly:
xor byte [ebp + 0x9dd44a0], cl
call 0xb29486d7
cli
push esi
mov byte [0xe25f9225], al
xor dword [ecx], ebx
fstp st(6)
xor byte [edi], dl
jecxz 0x4fedc1
mov al, byte [0x5b9046b9]
and dword [ebp - 0x3d], 0xf271916c
mov ah, 0x25
loope 0x4fee28
ret
wait
test al, 0xf
or esp, dword [ebx]
int3
jge 0x4fedd6
shr dword [eax + 0x5a], 0xd0
xchg ebp, eax
mov dh, 0xa8
cmpsb byte [esi], byte es:[edi]
fisubr dword [0x7f73afd5]
dec esi
xchg esi, eax
cmp eax, dword [edi]
sbb al, ch
mov edi, fs
test ah, dl
add cl, byte [eax - 0x5c]
invalid
Function at 0x529984
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055ce74
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529aa7
push ecx
lea ecx, [esi + 0x18]
call fcn.005491a4
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529abe
push ecx
lea ecx, [esi + 0x24]
call fcn.005490b4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x55c5b4
Capabilities:
Encode data using xor

Disassembly:
retf
mov al, 5
in eax, 0xef
mov cl, 0xf6
iretd
mov edx, 0x83e4213
inc eax
dec ebp
ja 0x55c55f
xor al, byte [eax]
pop esi
mov ebp, 0x5ee2c5c9
ja 0x55c55b
sub eax, dword [esi + ebp*2]
push edi
inc ebx
cdq
xchg dword [esi + 0x21168475], ebp
invalid