joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4262e0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x54ae7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x426424
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym.runtime.spanOfHeap
mov eax, dword [esp + 4]
test eax, eax
je 0x42640d
mov dword [esp + 0xc], eax
lea ecx, [eax + 0x4c]
mov dword [esp + 0x18], ecx
mov edx, dword [0x54ae7c]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov ebx, dword [edx + 0x18]
nop
inc dword [ebx + 0x7c]
mov edx, dword [edx + 0x18]
mov dword [esp + 0x14], edx
mov dword [esp], eax
call sym.runtime._mspan_.ensureSwept
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xa], bl
nop
mov ebp, dword [esp + 0x18]
mov dword [esp], ebp
call sym.runtime.lock2
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x50]
mov edx, dword [esp + 0x10]
movzx ebx, byte [esp + 0xa]
jmp 0x426377
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x4263a2
movzx esi, word [ebp + 4]
cmp esi, edx
jne 0x42638c
cmp byte [ebp + 6], bl
je 0x426397
cmp esi, edx
ja 0x42639e
jne 0x426375
cmp byte [ebp + 6], bl
jbe 0x426375
jmp 0x42639e
mov ebx, 1
jmp 0x4263a4
xor ebx, ebx
jmp 0x4263a4
xor ebx, ebx
mov byte [esp + 0xb], bl
test bl, bl
jne 0x4263c2
mov ebx, dword [esp + 0x24]
mov word [ebx + 4], dx
mov edx, dword [ecx]
mov dword [ebx], edx
mov dword [ecx], ebx
mov dword [esp], eax
call sym.runtime.spanHasSpecials
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym.runtime.unlock2
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x7c]
lea edx, [ecx - 1]
nop
mov ebx, dword [0x54ae7c]
mov ebx, dword fs:[ebx]
mov ebx, dword [ebx]
mov dword [eax + 0x7c], edx
cmp ecx, 1
jne 0x4263fd
movzx eax, byte [ebx + 0x65]
test al, al
je 0x4263fd
mov dword [ebx + 8], 0xfffffade
movzx eax, byte [esp + 0xb]
xor eax, 1
mov byte [esp + 0x28], al
add esp, 0x1c
ret
lea eax, [0x4a1c9d]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.addspecial
Function at 0x4268b0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x54ae7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x426a20
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x4269b0
cmp cl, 1
je 0x426942
cmp cl, 2
jne 0x426a09
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call sym.runtime.mProf_Free
nop
nop
lea eax, [0x52f3a0]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x52f344]
sub eax, dword [0x52f328]
nop
mov dword [0x52f344], eax
mov eax, dword [0x52f334]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x52f334], ecx
nop
lea eax, [0x52f3a0]
mov dword [esp], eax
call sym.runtime.unlock2
jmp 0x426a05
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call sym.runtime.queuefinalizer
nop
nop
lea eax, [0x52f3a0]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x52f31c]
sub eax, dword [0x52f300]
nop
mov dword [0x52f31c], eax
mov eax, dword [0x52f30c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x52f30c], ecx
nop
lea eax, [0x52f3a0]
mov dword [esp], eax
call sym.runtime.unlock2
jmp 0x426a05
cmp cl, 3
jne 0x4269bb
mov byte [eax + 8], 1
jmp 0x426a05
cmp cl, 4
jne 0x426a09
nop
nop
lea eax, [0x52f3a0]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x52f394]
sub eax, dword [0x52f378]
nop
mov dword [0x52f394], eax
mov eax, dword [0x52f384]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x52f384], ecx
nop
nop
lea eax, [0x52f3a0]
mov dword [esp], eax
call sym.runtime.unlock2
add esp, 0x14
ret
lea eax, [0x49ef7f]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.freeSpecial
Function at 0x44de40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x54ae7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44dfba
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x44dfb0
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x44de9a
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x44de9a
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x44dead
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x44df87
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x44df7b
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x44df72
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x44df00
mov dword [esp + 0xc], ecx
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x44df43
mov eax, 1
cmp eax, ecx
ja 0x44df37
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
sub ecx, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and eax, ebp
add eax, ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call sym.runtime.panicSliceBU
lea esi, [ecx + 7]
mov ecx, dword [esp + 0xc]
cmp eax, ecx
jae 0x44df6d
movzx edi, byte [eax + ebx]
xchg edi, eax
mov byte [esp + 0xb], al
xchg edi, eax
and edi, 0x7f
mov ecx, esi
shl edi, cl
inc eax
or edx, edi
movzx edi, byte [esp + 0xb]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x44df3c
mov ecx, dword [esp + 0xc]
jmp 0x44df05
call sym.runtime.panicIndexU
xor eax, eax
mov ecx, eax
call sym.runtime.panicIndex
call sym.runtime.panicSliceBU
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jbe 0x44dfab
movzx esi, byte [eax + edx]
mov edi, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
inc eax
or ebx, esi
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x44df80
mov ecx, dword [esp + 0x18]
jmp 0x44deb2
call sym.runtime.panicIndexU
xor eax, eax
mov ecx, eax
call sym.runtime.panicIndex
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.step
Function at 0x451fc0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x54ae7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4520c3
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov ecx, dword [0x54ae7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0xf0], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call sym.runtime.startPCforTrace
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x48ea60]
mov dword [esp], ecx
call sym.runtime.newobject
mov eax, dword [esp + 4]
mov dword [eax], 0xffffffff
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax + 4], ecx
lea ecx, [0x52f45c]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 2
mov dword [esp + 0xc], 2
call sym.runtime._traceStackTable_.put
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call sym.runtime.traceEvent
add esp, 0x28
ret
call sym.runtime.morestack_noctxt
jmp sym.runtime.traceGoCreate
Function at 0x453a00
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x54ae7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x453b96
sub esp, 0x28
movzx eax, byte [esp + 0x2c]
movzx ebx, al
add ebx, dword [edx + 4]
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
mov edi, esi
shl esi, 8
or ebp, esi
shr edi, 0x18
movzx esi, byte [ebx + 2]
mov ecx, esi
shr esi, 0x10
or esi, edi
shl ecx, 0x10
or ecx, ebp
movzx ebp, byte [ebx + 3]
mov edi, ebp
shr ebp, 8
or ebp, esi
shl edi, 0x18
movzx esi, byte [ebx + 4]
or esi, ebp
movzx ebp, byte [ebx + 5]
shl ebp, 8
or esi, ebp
movzx ebp, byte [ebx + 6]
shl ebp, 0x10
or esi, ebp
movzx ebx, byte [ebx + 7]
shl ebx, 0x18
or edi, ecx
or ebx, esi
movzx ebp, byte [esp + 0x2d]
xchg ebp, eax
cmp al, 8
xchg ebp, eax
jae 0x453b23
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], edi
shl ebp, 3
lea ecx, [ebp - 0x40]
neg ecx
mov byte [esp + 9], cl
shl ebx, cl
mov esi, edi
shl esi, cl
add ebp, 0xffffffe0
xchg ebp, eax
mov byte [esp + 0xb], al
xchg ebp, eax
mov ecx, ebp
shr edi, cl
mov dword [esp + 0x18], edi
neg ecx
mov byte [esp + 0xa], cl
mov eax, dword [esp + 0x1c]
shl eax, cl
movzx edx, byte [esp + 9]
cmp dl, 0x20
sbb edi, edi
mov dword [esp + 0x1c], edi
and ebx, edi
and esi, edi
mov ecx, edx
shr esi, cl
and esi, edi
mov dword [esp + 0x14], esi
movzx esi, byte [esp + 0xa]
xchg esi, eax
cmp al, 0x20
xchg esi, eax
sbb edi, edi
and eax, edi
xchg ebp, eax
cmp al, 0x20
xchg ebp, eax
sbb ebp, ebp
mov edx, dword [esp + 0x18]
and edx, ebp
or ebx, edx
or ebx, eax
mov eax, ecx
mov ecx, esi
mov edx, ebx
shr edx, cl
and edi, edx
mov ecx, eax
mov eax, ebx
shr eax, cl
movzx ecx, byte [esp + 0xb]
shl ebx, cl
and ebx, ebp
mov edx, dword [esp + 0x14]
or ebx, edx
mov edx, dword [esp + 0x1c]
and eax, edx
or edi, ebx
mov edx, dword [esp + 0x24]
mov ebx, eax
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ebx
mov eax, dword [edx + 8]
mov dword [esp + 0x20], eax
call sym.runtime.printlock
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call sym.runtime.printhex
call sym.runtime.printunlock
mov edx, dword [esp + 0x20]
mov eax, dword [edx]
movzx ecx, byte [esp + 0x2c]
mov byte [esp], cl
movzx ecx, byte [esp + 0x2e]
mov byte [esp + 1], cl
call eax
movzx eax, byte [esp + 4]
test al, al
jne 0x453b92
call sym.runtime.printlock
lea eax, [0x4bb094]
mov dword [esp], eax
mov dword [esp + 4], 1
call sym.runtime.printstring
call sym.runtime.printunlock
add esp, 0x28
ret
call sym.runtime.morestack
jmp sym.runtime.printArgs.func2
Function at 0x4552e0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x54ae7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45537b
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x54ae7c]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0045db67
lea ecx, [sym.runtime.callers.func1]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call sym.runtime.systemstack
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call sym.runtime.morestack_noctxt
jmp sym.runtime.callers
Function at 0x45a850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x54ae7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45a9b0
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test byte [eax], al
lea ecx, [eax + 0x18]
mov dword [esp + 0x18], ecx
nop
mov dword [esp], ecx
call sym.runtime.lock2
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax + 0x1c]
test cl, cl
jne 0x45a999
mov byte [eax + 0x1c], 1
inc dword [eax + 0x24]
inc dword [eax + 0x60]
mov dword [esp], eax
call sym.runtime._pollDesc_.publishInfo
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0x72
mov byte [esp + 8], 0
call sym.runtime.netpollunblock
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], 0x77
mov byte [esp + 8], 0
call sym.runtime.netpollunblock
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], edx
test ecx, ecx
je 0x45a920
lea ecx, [eax + 0x28]
mov dword [esp], ecx
call sym.runtime.deltimer
mov eax, dword [0x54af50]
test eax, eax
jne 0x45a907
mov eax, dword [esp + 0x20]
jmp 0x45a915
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
call sym.runtime.gcWriteBarrier1
mov dword [edi], ecx
mov dword [eax + 0x3c], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x45a957
lea ecx, [eax + 0x64]
mov dword [esp], ecx
call sym.runtime.deltimer
mov eax, dword [0x54af50]
test eax, eax
jne 0x45a942
mov eax, dword [esp + 0x20]
jmp 0x45a950
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x78]
call sym.runtime.gcWriteBarrier1
mov dword [edi], ecx
mov dword [eax + 0x78], 0
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym.runtime.unlock2
mov eax, dword [esp + 0x14]
test eax, eax
je 0x45a97d
mov dword [esp], eax
mov dword [esp + 4], 3
call sym.runtime.netpollgoready
mov eax, dword [esp + 0x10]
test eax, eax
je 0x45a995
mov dword [esp], eax
mov dword [esp + 4], 3
call sym.runtime.netpollgoready
add esp, 0x1c
ret
lea eax, [0x4a3263]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.internal_poll.runtime_pollUnblock

Function at 0x45d870
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x54ad65], 0
je 0x45d88a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x45d890
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x54ad65], 0
je 0x45d8ab
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x45e700
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x45e71a
mov ecx, 0x14
jmp 0x45e723
shl ecx, 2
add ecx, 0xe10
mov dword [0x54ae7c], ecx
ret
Function at 0x483810
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x54ae7c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4838b1
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [esp + 0x18]
cmp dword [edx], ecx
jne 0x4838a7
movzx ecx, byte [eax + 4]
cmp byte [edx + 4], cl
jne 0x4838a7
movzx ecx, byte [eax + 5]
cmp byte [edx + 5], cl
jne 0x4838a7
movzx ecx, byte [eax + 6]
cmp byte [edx + 6], cl
jne 0x4838a7
movzx ecx, byte [eax + 7]
cmp byte [edx + 7], cl
jne 0x4838a7
movzx ecx, byte [eax + 8]
cmp byte [edx + 8], cl
jne 0x4838a7
movzx ecx, byte [eax + 9]
cmp byte [edx + 9], cl
jne 0x4838a7
movzx ecx, byte [eax + 0xa]
cmp byte [edx + 0xa], cl
jne 0x4838a7
movzx ecx, byte [eax + 0xb]
cmp byte [edx + 0xb], cl
jne 0x4838a7
movzx ecx, byte [eax + 0xc]
cmp byte [edx + 0xc], cl
jne 0x4838a7
add eax, 0x10
mov dword [esp], eax
lea eax, [edx + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x4c
call sym.runtime.memequal
movzx eax, byte [esp + 0xc]
jmp 0x4838a9
xor eax, eax
mov byte [esp + 0x1c], al
add esp, 0x10
ret
call sym.runtime.morestack_noctxt
jmp sym.type:.eq.fmt.fmt
Function at 0x4366c6
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x771b9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
xor edi, edi
mov dword [esp + 0x14], edi
call fcn.004350c0
mov eax, dword [esi + 0x24]
cmp eax, edi
mov dword [esp + 0x14], 0xffffffff
mov dword [esi + 0x20], edi
je 0x4366f7
push eax
call fcn.005752c0
add esp, 4
mov dword [esi + 0x24], edi
mov eax, dword [esi + 0x2c]
cmp eax, edi
mov dword [esi + 0x28], edi
je 0x436710
push 0x40
push eax
call dword [0x80bfdc]
add esp, 8
mov dword [esi + 0x2c], edi
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x438400
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x771b9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
xor edi, edi
mov dword [esp + 0x14], edi
call fcn.004365b0
mov eax, dword [esi + 0x24]
cmp eax, edi
mov dword [esp + 0x14], 0xffffffff
mov dword [esi + 0x20], edi
je 0x438447
push eax
call fcn.005752c0
add esp, 4
mov dword [esi + 0x24], edi
mov eax, dword [esi + 0x2c]
cmp eax, edi
mov dword [esi + 0x28], edi
je 0x438460
push 0x40
push eax
call dword [0x80bfdc]
add esp, 8
mov dword [esi + 0x2c], edi
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x438f90
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x771bff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x1c], ecx
xor eax, eax
lea ecx, [esi + 0x20]
mov dword [esi], 0x786394
mov dword [esi + 0x18], eax
mov dword [esp + 4], esi
mov dword [ecx], ecx
mov dword [ecx + 4], ecx
lea ecx, [esi + 0x38]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esp + 0x10], eax
mov dword [ecx], ecx
mov dword [ecx + 4], ecx
lea ecx, [esi + 0x40]
mov dword [ecx], ecx
mov dword [ecx + 4], ecx
mov edx, dword [esp + 0x1c]
push fcn.004022d0
mov byte [esi + 0x48], al
mov byte [esi + 0x50], al
mov dword [esi + 0x120], eax
push 0x430b50
mov dword [esi + 0x4c], edx
push 0x64
mov dword [esi + 0x130], eax
mov dword [esi + 0x134], eax
mov dword [esi + 0x138], eax
push 0x1c
lea eax, [esi + 0x13c]
push eax
mov byte [esp + 0x24], 2
mov dword [esi + 0x124], 0x7860d0
call fcn.0075c18d
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esi + 0xc30], ecx
mov dword [esi + 0xc34], edx
mov eax, dword [0x827b20]
inc eax
cmp eax, 0x10000
mov byte [esp + 0x10], 3
mov dword [0x827b20], eax
jl 0x43906a
mov eax, 1
mov dword [0x827b20], eax
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x4c]
lea ecx, [esi + 0x60]
push ecx
mov dword [0x827b14], eax
call fcn.0043c7e0
lea edx, [esi + 0xa0]
push edx
call fcn.0043c7e0
lea eax, [esi + 0xe0]
push eax
call fcn.0043c7e0
mov ecx, dword [esp + 0x14]
add esp, 0xc
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x43bd30
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
jle 0x43bd90
push ebx
push esi
push edi
mov edi, ecx
movzx esi, byte [edx]
mov ebx, eax
shr ebx, 0x18
xor ebx, esi
and ebx, 0xff
mov esi, dword [ebx*4 + 0x7868e8]
shl eax, 8
inc edx
xor eax, esi
dec edi
jne 0x43bd45
test ecx, ecx
pop edi
pop esi
pop ebx
jle 0x43bd90
lea esp, [esp]
mov edx, eax
shr edx, 0x18
xor edx, ecx
and edx, 0xff
mov edx, dword [edx*4 + 0x7868e8]
shl eax, 8
sar ecx, 8
xor eax, edx
test ecx, ecx
jg 0x43bd70
not eax
ret
Function at 0x446960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x771f7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x388
mov eax, dword [ecx + 0x74]
push ebx
push esi
lea ebx, [ecx + 0x6c]
xor esi, esi
sub eax, esi
push edi
je 0x4469a1
dec eax
je 0x44699c
dec eax
je 0x4469a1
mov dword [esp + 0x14], esi
jmp 0x4469b1
fild dword [ebx + 4]
jmp 0x4469ad
mov eax, dword [ebx + 4]
dec eax
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fstp dword [esp + 0x14]
mov ecx, ebx
call fcn.005731c0
fdivr dword [esp + 0x14]
lea ecx, [esp + 0x78]
fld dword [0x7872b0]
fmul st(1)
fstp dword [esp + 0x40]
fstp st(0)
call fcn.005e08b0
fld dword [0x7d7d3c]
mov dword [esp + 0x39c], esi
mov dword [esp + 0x14], esi
mov eax, dword [ebx + 8]
fst dword [esp + 0x18]
sub eax, 0
je 0x446a03
dec eax
je 0x4469fe
dec eax
je 0x446a03
fld dword [0x7d7d3c]
jmp 0x446a0f
fild dword [ebx + 4]
jmp 0x446a0f
mov ecx, dword [ebx + 4]
dec ecx
mov dword [esp + 0x1c], ecx
fild dword [esp + 0x1c]
fxch st(1)
fcomp st(1)
fnstsw ax
fstp st(0)
test ah, 0x41
jp 0x446b6b
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
and eax, 1
mov esi, eax
shl eax, 4
lea edi, [esp + eax + 0x50]
push edx
push edi
mov ecx, ebx
xor esi, 1
call fcn.00573100
mov eax, dword [esp + 0x14]
test eax, eax
jle 0x446b2a
fld dword [edi]
mov eax, dword [edi + 8]
fld dword [edi + 4]
shl esi, 4
fld dword [esp + esi + 0x50]
mov ecx, dword [esp + esi + 0x54]
mov edx, dword [esp + esi + 0x58]
fxch st(2)
fsub st(2)
lea esi, [esp + esi + 0x50]
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x44], eax
fstp dword [esp + 0x1c]
mov dword [esp + 0x3c], edx
mov eax, edx
fstp st(1)
mov dword [esp + 0x48], eax
fsub dword [esp + 0x4c]
push 0
fld dword [esp + 0x48]
lea edx, [esp + 0x24]
fsub dword [esp + 0x40]
fld dword [esp + 0x20]
fmul dword [0x784260]
fstp dword [esp + 0x24]
fxch st(1)
fmul dword [0x784260]
fstp dword [esp + 0x28]
fmul dword [0x784260]
fld st(0)
fmul st(1)
fld dword [esp + 0x24]
fmul dword [esp + 0x24]
faddp st(1)
fld dword [esp + 0x28]
fmul dword [esp + 0x28]
faddp st(1)
fsqrt
fadd dword [0x784260]
fstp dword [esp + 0x20]
fld dword [esi]
mov ecx, dword [esp + 0x20]
fld dword [esi + 4]
push ecx
fxch st(1)
push edx
fadd dword [esp + 0x2c]
lea ecx, [esp + 0x84]
fstp dword [esp + 0x2c]
fadd dword [esp + 0x30]
fstp dword [esp + 0x30]
fadd dword [esp + 0x54]
fstp dword [esp + 0x34]
call fcn.005e6d10
push 0x3f800000
push 0x3f000000
push edi
push esi
push 1
push 1
lea ecx, [esp + 0x90]
call fcn.005d3740
test al, al
jne 0x446b40
mov eax, dword [esp + 0x14]
fld dword [esp + 0x18]
fadd dword [esp + 0x40]
inc eax
mov dword [esp + 0x14], eax
jmp 0x4469e4
lea ecx, [esp + 0x78]
mov dword [esp + 0x39c], 0xffffffff
call fcn.005e0960
mov al, 1
mov ecx, dword [esp + 0x394]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x78]
mov dword [esp + 0x39c], 0xffffffff
call fcn.005e0960
mov ecx, dword [esp + 0x394]
pop edi
pop esi
xor al, al
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453190
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x771d98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push 4
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.0044ab80
xor eax, eax
mov ecx, 0xf230
mov word [esi + 0x32], cx
mov word [esi + 0x34], cx
mov edx, 0x40a00000
mov ecx, 0x3f800000
mov dword [esi + 0x2c], edx
mov dword [esi + 0x48], edx
mov edx, dword [esp + 0x20]
mov dword [esi + 0x50], ecx
mov dword [esi + 0x58], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi], 0x787d40
mov word [esi + 0x30], 0x6590
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], 0x447a0000
mov word [esi + 0x54], 0xc738
mov word [esi + 0x56], 0xf8f4
mov dword [esi + 0x5c], 0x3ecccccd
mov dword [esi + 0x60], 0x18
mov dword [esi + 0x68], eax
mov dword [esi + 0xb0], ecx
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], edx
mov dword [esi + 0x64], eax
cmp dword [0x828640], eax
mov dword [esp + 0x10], eax
jne 0x45327c
mov ecx, dword [esi + 0x1c]
mov dword [ecx + 0x280], eax
cmp dword [0x828640], eax
jne 0x45327c
mov edx, dword [esi + 0x1c]
mov dword [edx + 0x284], eax
cmp dword [0x828640], eax
jne 0x45327c
mov ecx, dword [esi + 0x1c]
mov dx, word [0x7eb5d0]
mov word [ecx + 0xc4], dx
mov ecx, esi
mov dword [esi + 0xc0], eax
call fcn.004510f0
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc