joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d5bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x44d623
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x44d640
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x44d6a9
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.0049658c
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x44d67c
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x44d66c
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x44d6a3
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x44d6fd
inc edi
cmp edi, ecx
jb 0x44d690
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.00480f2c
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00494e08
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x44d6a3
cmp dword [esi + 0x14], 0x10
jb 0x44d70c
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x44d726
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.0049658c
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x44d75c
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x44d74c
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x44d79a
cmp ecx, edx
je 0x44d811
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x44d782
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.0046c4fc
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0048105c
mov eax, esi
jmp 0x44d6e2
or ecx, 0xffffffff
jmp 0x44d79c
Function at 0x44da3c
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00480f2c
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44db5f
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d25c
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44db76
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d16c
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x496dcc
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca2bc
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x496eef
push ecx
lea ecx, [esi + 0x18]
call fcn.004b65ec
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x496f06
push ecx
lea ecx, [esi + 0x24]
call fcn.004b64fc
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4e022c
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.0051371c
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e034f
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffa4c
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e0366
push ecx
lea ecx, [esi + 0x24]
call fcn.004ff95c
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4fc56c
Capabilities:
Authenticate hmac

Disassembly:
cmp cl, dl
mov eax, dword [0x9da053a]
popfd
adc eax, 0x3b5ab936
pop ds
cmp ecx, dword [eax - 0x74]
or byte [0x9bc57161], 0xbd
fadd qword [edx]
daa
cmpsb byte [esi], byte es:[edi]
sub ebx, 0xffffffe6
je 0x4fc5c6
sbb dword [ebx], ecx
invalid
shr byte [ecx - 0x4ca11527], cl
xor al, 0x36
invalid
Function at 0x501dcc
Capabilities:
Encode data using xor

Disassembly:
loope 0x501df1
or edx, dword [eax + ebx*4]
loop 0x501e49
sbb eax, dword [bx]
clc
adc byte [ebx], bh
cmpsd dword [esi], dword es:[edi]
inc edx
push ds
inc esp
enter 0x7a4b, 0xffffffffffffffa7
das
shr dword [ecx - 0xd77924f], 1
inc esp
mov eax, 0xa6c4a2fd
push ss
pop ds
in eax, 0x28
invalid
mov dl, 0x63
cmpsb byte [esi], byte es:[edi]
stosd dword es:[edi], eax
test eax, 0x3c59bed8
or dword [0xee27d6b4], esp
cmp al, 9
and eax, 0xee27d6b4
mov al, byte [0x72dc8ea9]
push edi
xor dword [edi - 0x4b], 0x3f612869
call 0x5c9072a3
push 0xb97da8c
pop esi
sub esp, ecx
salc
out 0xef, eax
les esp, [0x15d2b5dd]
stc
adc al, byte [edi - 0x399b3a07]
mul byte [eax - 0x1e3f29]
pop ebp
mov cl, 0xf1
out 0x9a, al
dec eax
xchg edx, eax
mov ebx, 0x5b5283e1
jg 0x501e87
adc dword [edx + 0x5b], 0x7f
clc
push 0x7833
and eax, 0x817c0250
sbb esp, 0xa0fe28c5
xor dword [0xb58ab987], ebx
push edi
jge 0x501e8a
fadd st(5), st(0)
sub dh, bh
mov al, byte [0xb9871d31]
mov dh, byte [ebp + 0x79e47d57]
cdq
jns 0x501e41
mov ecx, dword [eax]
ja 0x501f1d
xor dword [edi - 0x3ebf5605], edx
inc ebx
je 0x501e98
push es
jle 0x501f01
leave
scasd eax, dword es:[edi]
dec eax
jl 0x501ee5
inc esp
sbb al, 0x5f
cmc
and edx, dword [eax]
mov dl, 0x33
cmp dword [eax + 4], 0xffffffbe
cmpsb byte [esi], byte es:[edi]
aad 0xbf
call 0x34e4e337
cwde
jl 0x501ee7
xor byte [ebp + 0x762d6979], ah
aas
jb 0x501e97
fcmovu st(0), st(2)
pop ss
and cl, 0x87
jge 0x501f3f
in eax, dx
jo 0x501ee3
sti
in eax, dx
dec eax
cwde
push ebp
retf
daa
imul ebx, dword [edi], 0x43739121
mov eax, 0x5b458ff
sbb dword [edx - 0x12], eax
xor edx, dword [edx + 0x7a]
fadd qword [ecx]
stc
and esp, edi
cmp eax, dword [esi + esi + 0x3b]
inc eax
les ecx, [esp + edx*8]
sub byte [edi], dh
popfd
xchg ebp, eax
mov ebx, 0xa67624d7
inc eax
invalid
dec ecx
stc
wait
popal
pop ds
fcomp dword [edx + eax*8 + 0x4a874d8f]
mov dword [0x3598f573], eax
push es
mov ah, 0x1a
test dword ss:[esi + 1], 0xc6856477
arpl cx, di
cmpsd dword [esi], dword es:[edi]
leave
jo 0x501f41
xchg edi, eax
aas
cmpsd dword [esi], dword es:[edi]
ror byte [edx + 0x650e69a6], cl
invalid
Function at 0x50a35c
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
in eax, dx
xchg ebp, eax
movsb byte es:[edi], byte [esi]
cmp ch, byte [eax - 0x7f]
pop eax
cmp eax, 0xfda2845
push esp
or edi, dword [esi]
out 0xed, eax
in eax, dx
xor al, 0x45
jnp 0x50a2a6
pop ecx
push edx
jl 0x50a298
mov esi, 0x9dd8fb6a
enter 0xffffffffffff889a, 0x21
or bh, dh
call 0x9dd50da5
adc al, byte [esi + 0x49]
dec esi
jno 0x50a302
cmp eax, dword [eax + edi*8 + 0x633435c]
mov ebx, esp
xor eax, dword [esi - 0x321c7e9]
and dword [edx], ebp
cmpsd dword [esi], dword es:[edi]
daa
xchg esp, eax
push es
mov ebp, 0xf7bc303c
dec esp
out 0x37, al
lahf
add ebx, dword [edi + edx*8 - 0x34]
xchg ecx, eax
sub eax, 0x4eec77d8
adc al, 0xc1
sbb byte [eax + 0x56], ch
mov bl, 0xb3
sbb cl, byte [edi - 0xba177b5]
loopne 0x50a311
mov byte [eax], bl
out 0x31, al
xlatb
sub eax, dword [esi + 0x6a]
cmc
sub al, ch
xchg ecx, eax
sbb dh, dh
push ds
adc al, 0x5b
add al, 0xea
jb 0x50a287
test al, cl
or al, 0xa5
xchg esi, eax
enter 0xffffffffffffa50c, 0xffffffffffffff96
xor edi, dword [eax - 0x36ea50e9]
pop ebp
int 0x54
out dx, al
in al, 0x68
out 0x6e, al
xchg ebp, eax
push 0xffffffffffffff99
sbb dl, byte [ebp - 0x72]
mov dword [0x27f69219], eax
pushfd
push esi
inc ebp
mov ebp, 0xfb478158
inc edi
sti
mov al, 0x2a
in al, 0x36
stc
jg 0x50a2b7
enter 0xffffffffffffe815, 0xffffffffffffffe8
xor byte [eax + 0x28], ch
imul ecx, dword [eax - 0x2e], 0x5ca357b
aaa
sub bh, byte [eax]
in eax, 0x8a
stc
lds ebx, [eax - 0x44675f38]
retf
cwde
mov ebx, 0x8df98cb
sbb al, 0x88
and dh, byte [ecx + 0x36]
adc ah, byte [ecx + ebp*8 - 0x1769569e]
inc esi
jp 0x50a326
cmc
pop ebp
mov cl, 0x44
push esi
sub al, 0x31
loop 0x50a3a8
lcall 0xabac, 0xcfbdf50f
fidivr dword [edi]
cmp eax, 0x67a37892
and byte [ebx], bh
out dx, eax
inc esi
adc dh, byte [edi]
push 0x28
out 0xdc, eax
mov bl, cl
push esp
dec eax
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
fidiv dword [edi - 0x68]
movsb byte es:[edi], byte [esi]
mov cl, 0xa8
cmp al, 0x39
invalid
or dword [edi - 7], ebp
sbb ebx, edx
dec ecx
fimul dword [edx + 0x19a58456]
imul ecx, dword [esi - 0x66], 6
jno 0x50a347
pop ebx
rol byte [ecx + 0x28], 1
xchg dword [ecx + 0x20236a66], ebp
mov dh, 0x7e
sub eax, dword [ebp + eax*8 + 0x505237a]
mov esi, 0x20c9d7b4
or dword [ecx + 0x5a], 0xffffffac
inc edi
push 0x23
and byte [esi - 0x3a7bd482], dh
jp 0x50a3d5
add eax, 0xd7b4be05
leave
and byte [ebx + 0x47ac5a49], al
call edi
sbb dword [ebx + 0x7154af17], ecx
enter 0xffffffffffffdace, 0xffffffffffffffc3
scasd eax, dword es:[edi]
push esp
jno 0x50a38f
into
fcmovb st(0), st(3)
bound ebp, qword [ecx + ecx*4 + 0x3ce02c50]
in eax, 0x17
sub eax, 0x415a385a
cmp byte [edx + 0x41], bl
or dword [edx + 0x6d], edx
lahf
sub dl, byte [esi - 1]
pop edx
dec edi
or esi, edi
xor al, 0x9c
loop 0x50a422
invalid
sbb ecx, dword [ebx - 0x3c]
aad 0x92
inc esi
inc edx
aam 0xa7
push esi
xchg edi, eax
pop esi
sbb dword [esi - 0x385cf9cb], 0x1a
loope 0x50a3c3
dec eax
or cl, bl
push 0x20659339
pop esp
jmp 0x64f74675
Function at 0x5294dc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x529543
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x529560
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x5295c9
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.005724ac
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x52959c
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x52958c
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x5295c3
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x52961d
inc edi
cmp edi, ecx
jb 0x5295b0
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.0055ce4c
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570d28
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x5295c3
cmp dword [esi + 0x14], 0x10
jb 0x52962c
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x529646
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.005724ac
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x52967c
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x52966c
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x5296ba
cmp ecx, edx
je 0x529731
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x5296a2
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.0054841c
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0055cf7c
mov eax, esi
jmp 0x529602
or ecx, 0xffffffff
jmp 0x5296bc
Function at 0x52995c
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055ce4c
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529a7f
push ecx
lea ecx, [esi + 0x18]
call fcn.0054917c
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529a96
push ecx
lea ecx, [esi + 0x24]
call fcn.0054908c
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x572f6c
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a645c
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x57308f
push ecx
lea ecx, [esi + 0x18]
call fcn.0059278c
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5730a6
push ecx
lea ecx, [esi + 0x24]
call int.0059269c
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5a658c
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
xchg dword [esi], esp
fld qword [edi]
jmp dword [esi + 0x42cd9baa]
xor al, 0x42
nop
cmp al, cl
dec ecx
lodsb al, byte [esi]
inc edx
pushal
lcall 0x2805, 0x4d35827
mov cl, 0xc4
mov byte [0x82c4c680], al
stosd dword es:[edi], eax
sbb byte [0x81f094e3], ah
xchg esi, eax
retf 0x7332
sub byte [ecx - 0x397f5d3c], dh
les eax, [edx - 0x1cdae755]
xchg esp, eax
lock adc dword [esi + 0x5e7332ca], 0xd75b8900
and dword [esi], esp
xor dh, byte [ebx + 0x5e]
add byte [ecx + 0x2621d75b], cl
inc ebp
sub byte [eax + 1], al
push eax
push ss
out 0xb2, al
cli
mov byte [0xcb3c92de], al
mov al, 0xb3
inc edx
test al, 0x94
jp 0x5a6500
insb byte es:[edi], dx
je 0x5a6563
push ebp
imul edi, esp, 0x11
jl 0x5a6510
xor al, 0x63
and al, 0x98
xchg ecx, eax
ficom dword [ecx - 0x4f8c4af5]
xchg ecx, eax
mov bl, 0xc4
in eax, dx
sbb esp, dword [ebx + 0x4c]
loop 0x5a64eb
ret 0xc914
jbe 0x5a65a6
adc cl, byte [ebx - 0x1f]
aas
shl ebx, cl
lahf
inc eax
push edx
add al, 0xd4
ljmp 0x92d7
xchg edx, edi
add esi, dword [esi + ecx*4 + 0x71]
and dl, byte [ebx]
push eax
inc ebp
pop es
and al, 0x34
lodsb al, byte [esi]
loop 0x5a65be
invalid
xor dword [ebx + 0x67], esp
mov edi, 0x53b0b2a0
adc bl, 0xec
arpl word [edi - 0x41], sp
mov al, byte [0x8053b0b2]
shr esp, cl
in al, 0xf2
mov cl, 0xa2
jno 0x5a6521
xchg esi, eax
test dword [ebx + edx*8], eax
sal dword [edi - 0x49a02fb6], 0x40
pop edi
mov dh, 0x40
xor dword [edi], ebx
xor dword [ecx], esp
xchg edx, eax
sub byte [edx + 0x43], al
mov dword [0xa8717ee4], eax
mov ecx, 0xb684049a
mov al, byte [ebp - 0x5c3f5312]
jb 0x5a65f8
lcall 0xee85, 0x8ab68404
lodsb al, byte [esi]
shl byte [ebx + 0x82e3572], 6
or byte cs:[esi], al
push ebp
push ds
and dword [ebx + 0x51], esp
and al, 0x40
push ds
adc byte [ebx], cl
jo 0x5a6638
int1
mov dword [0xc77192d4], eax
movsb byte es:[edi], byte [esi]
mov dh, al
mov dword [0x81c09685], eax
sub ah, byte [ebx]
xor byte [ebx], ah
fadd dword [esi + 0x10]
dec eax
and al, 0x9d
cmp ch, byte [ebx]
add al, 0x71
sbb eax, dword [edx - 0x16]
mov dl, 0x41
jecxz 0x5a6644
xchg edx, eax
nop
enter 0xffffffffffffbde0, 0xffffffffffffff81
loop 0x5a657d
loopne 0x5a65b7
and edx, 0xc3839e80
insd dword es:[edi], dx
sahf
add ebx, 0x6d
inc edi
ret 0x41c3
mov ah, 0xf2
xor dword [esi - 0x6995d840], esi
je 0x5a65f7
invalid
add byte [edi + 0x2c], dl
pop es
in al, dx
xor dword [eax + ecx*4], eax
add dword [edx], esi
push eax
push ss
mov al, byte [0xd483e472]
xchg edx, eax
fcmovbe st(0), st(6)
invalid