joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460716
Capabilities:
Hash data with crc32

Disassembly:
or al, 0
add byte [eax], al
pushfd
inc eax
add ah, dh
sub al, 0x40
add byte [eax - 0x2fffbfd5], ch
sub eax, dword [eax]
shr byte [ebx], 1
inc eax
add byte [esp + ebp], dl
inc eax
add byte [esi], cl
inc ebp
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
rol byte [0xc0046], 0
add byte [ebp + eax + 0x46], bh
inc esi
add ah, dh
sub al, 0x40
add byte [eax - 0x2fffbfd5], ch
sub eax, dword [eax]
adc al, 0x2c
inc eax
add byte [edx], dl
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x4607b5
jae 0x4607b9
inc esp
popal
je 0x4607ab
inc ebp
jb 0x4607bf
outsd dx, dword [esi]
jb 0x4606e0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
or byte [esi], al
inc esi
add byte [eax + eax], cl
add byte [eax], al
jl 0x460777
inc esi
add ah, dh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 6], ah
add byte [eax], al
add ah, ch
add ah, dh
sub al, 0x40
add byte [eax - 0x2fffbfd5], ch
sub eax, dword [eax]
adc al, 0x2c
inc eax
add byte [eax + ecx + 0x46], bh
add byte [esi + eax + 0x46], dh
inc esi
add byte [esi + eax + 0x46], bh
inc esi
add byte [ebx], dl
push esp
inc ebx
jne 0x460854
je 0x460852
insd dword es:[edi], dx
inc esp
arpl word gs:[edi + 0x6d], bp
jo 0x46085d
jae 0x460861
outsd dx, dword [esi]
jb 0x4607da
add al, 0x1d
add byte [eax], al
lea eax, [eax]
jmp 0x462501
invalid
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
or al, 7
test al, al
jne 0x46250c
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x462564
xor eax, eax
push ebp
push 0x4623d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.00465125
push eax
mov eax, esi
call fcn.0046512d
push eax
call fcn.004671f7
mov dword [ebp - 4], eax
call fcn.00467327
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4623d7
lea eax, [ebp - 0xc]
call fcn.004c3b97
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46d720
Capabilities:
Packed with generic packer

Disassembly:
arpl word [edi + 0x6d], bp
jo 0x46d797
jae 0x46d79b
dec ecx
outsb dx, byte [esi]
imul esi, dword [eax + eax], 0x5a420000
xor bl, byte [edi + 0x62]
jp 0x46d77b
arpl word gs:[edi + 0x6d], bp
jo 0x46d7af
jae 0x46d7b3
add byte [eax], al
add byte [eax], al
inc edx
pop edx
xor bl, byte [edi + 0x62]
jp 0x46d78f
arpl word gs:[edi + 0x6d], bp
jo fcn.0046d7c3
jae 0x46d7c7
inc ebp
outsb dx, byte [esi]
add byte fs:[ebx + 0x56], dl
push edi
add esp, 0xfffffff4
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp ebx, 0xfffffffd
jne 0x46d76e
call fcn.00475fea
mov dword [esp], ebx
mov edx, edi
test edx, edx
jl 0x46d784
inc edx
mov eax, esi
cmp ebx, dword [eax]
je 0x46d7aa
sbb byte [esp + ebp - 0x7d], dh
rol byte [edx + ecx*2], 0x75
invalid
mov dword [esp + 4], ebx
invalid
add eax, 4
dec edx
jne 0x46d77a
mov dword [esp + 4], ebx
invalid

Function at 0x46e00a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 0x24
mov edx, dword [eax + 0x10]
mov dword [esp + 0xc], edx
mov ecx, dword [esp]
mov eax, dword [ecx + 0x34]
mov dword [esp + 0x10], eax
mov edx, dword [esp]
mov ecx, dword [edx + 0x38]
mov dword [esp + 0x14], ecx
mov eax, dword [esp]
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x18], edx
mov ecx, dword [esp]
or al, 0x24
Function at 0x46e33b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shr ecx, 5
sub dx, cx
mov ecx, dword [esp + 0x4c]
mov word [ecx], dx
mov edx, dword [esp + 0x10]
add edx, edx
add edx, dword [esp + 0xc]
add edx, 0x180
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x4c]
movzx edx, word [edx]
cmp esi, 0x1000000
jae 0x46e37e
mov ecx, dword [esp + 0x48]
shl eax, 8
or byte [edi], cl
mov dh, 9
shl esi, 8
or eax, ecx
inc dword [esp + 0x48]
mov ecx, esi
shr ecx, 0xb
or ecx, dword [edi]
scasd eax, dword es:[edi]
invalid

Function at 0x46e55f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jbe 0x46e584
mov esi, ecx
mov ecx, 0x800
sub ecx, edx
shr ecx, 5
add cx, dx
mov edx, dword [esp + 0x4c]
sub esi, ecx
sub eax, ecx
mov ecx, edx
shr ecx, 5
sub dx, cx
mov ecx, dword [esp + 0x4c]
mov word [ecx], dx
mov edx, dword [esp + 0x10]
add edx, edx
add edx, dword [esp + 0xc]
add edx, 0x1c8
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x4c]
movzx edx, word [edx]
cmp esi, 0x1000000
jae 0x46e5cd
mov ecx, dword [esp + 0x48]
shl eax, 8
movzx ecx, byte [ecx]
shl esi, 8
or eax, ecx
inc dword [esp + 0x48]
mov ecx, esi
shr ecx, 0xb
imul ecx, edx
cmp ecx, eax
jbe 0x46e5f9
mov esi, ecx
mov ecx, 0x800
sub ecx, edx
shr ecx, 5
add cx, dx
mov edx, dword [esp + 0x4c]
mov word [edx], cx
mov edx, dword [esp + 0x1c]
push esp
and al, 0x1c
mov dword [esp + 0x64], edx
jmp 0x46e61c
sub esi, ecx
sub eax, ecx
mov ecx, edx
shr ecx, 5
sub dx, cx
mov ecx, dword [esp + 0x4c]
mov word [ecx], dx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x64], edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], ecx
dec esp
and al, 0x1c
mov edx, dword [esp + 0x14]
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x10], 7
jae 0x46e642
mov edx, 8
jmp 0x46e647
mov edx, 0xb
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0xc]
add ecx, 0xa68
mov dword [esp + 0x4c], ecx
mov ebx, dword [esp + 0x4c]
movzx edx, word [ebx]
cmp esi, 0x1000000
jae 0x46e67b
Function at 0x46e668
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 0x48]
shl eax, 8
movzx ecx, byte [ecx]
shl esi, 8
or eax, ecx
sar edi, 0x44
and al, 0x48
mov ecx, esi
shr ecx, 0xb
imul ecx, edx
cmp ecx, eax
jbe 0x46e6bc
mov esi, ecx
mov ecx, 0x800
sub ecx, edx
shr ecx, 5
add cx, dx
mov word [ebx], cx
mov ebx, dword [esp + 0x50]
shl ebx, 3
add ebx, ebx
add ebx, dword [esp + 0x4c]
add ebx, 4
xor edx, edx
mov dword [esp + 0x6c], edx
mov dword [esp + 0x68], 8
jmp 0x4dc064
test al, 0xd9
push es
invalid
sub esi, ecx
sub eax, ecx
mov ecx, edx
shr ecx, 5
sub dx, cx
mov word [ebx], dx
mov ebx, dword [esp + 0x4c]
add ebx, 2
movzx edx, word [ebx]
cmp esi, 0x1000000
jae 0x46e6f0
mov ecx, dword [esp + 0x48]
shl eax, 8
movzx ecx, byte [ecx]
shl esi, 8
or eax, ecx
inc dword [esp + 0x48]
mov ecx, esi
shr ecx, 0xb
imul ecx, edx
cmp ecx, eax
jbe 0x46e733
mov esi, ecx
mov ecx, 0x800
add byte [eax], al
sub ecx, edx
shr ecx, 5
add cx, dx
mov word [ebx], cx
mov ebx, dword [esp + 0x50]
shl ebx, 3
add ebx, ebx
add ebx, dword [esp + 0x4c]
mov dword [esp + 0x6c], 8
inc esp
and al, 0x6c
or byte [eax], al
add byte [eax], al
sub esi, ecx
sub eax, ecx
mov ecx, edx
shr ecx, 5
sub dx, cx
mov word [ebx], dx
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x6c], 0x10
mov dword [esp + 0x68], pe_nt_image_headers32
add ebx, 0x204
mov dword [esp + 0x44], 1
mov edx, dword [esp + 0x44]
movzx edx, word [ebx + edx*2]
cmp esi, 0x1000000
jae fcn.0046e787
mov ecx, dword [esp + 0x48]
shl eax, 8
movzx ecx, byte [ecx]
shl esi, 8
or byte [ebx], cl
sar edi, 0x44
and al, 0x48

Function at 0x46e905
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or eax, ecx
inc dword [esp + 0x48]
mov ecx, esi
shr ecx, 0xb
imul ecx, edx
cmp ecx, eax
jbe 0x46e932
mov ebx, 0x800
mov esi, ecx
sub ebx, edx
mov ecx, dword [esp + 0x4c]
shr ebx, 5
add bx, dx
mov word [ecx + edi*2], bx
add edi, edi
jmp 0x46e94a
sub esi, ecx
sub eax, ecx
mov ecx, edx
shr ecx, 5
sub dx, cx
mov ecx, dword [esp + 0x4c]
mov word [ecx + edi*2], dx
lea edi, [edi + edi + 1]
mov edx, dword [esp + 0x4c]
Function at 0x46e96b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx edx, word [edx + edi*2]
cmp esi, 0x1000000
jae 0x46e96d
mov ecx, dword [esp + 0x48]
shl eax, 8
movzx ecx, byte [ecx]
shl esi, 8
or eax, ecx
inc dword [esp + 0x48]
and al, 0x48
mov ecx, esi
shr ecx, 0xb
imul ecx, edx
cmp ecx, eax
jbe 0x46e994
mov ebx, 0x800
mov esi, ecx
sub ebx, edx
mov ecx, dword [esp + 0x4c]
shr ebx, 5
add bx, dx
mov word [ecx + edi*2], bx
add edi, edi
jmp 0x46e9ac
sub esi, ecx
sub eax, ecx
mov ecx, edx
shr ecx, 5
sub dx, cx
mov ecx, dword [esp + 0x4c]
mov word [ecx + edi*2], dx
lea edi, [edi + edi + 1]
mov edx, dword [esp + 0x4c]
movzx edx, word [edx + edi*2]
cmp esi, 0x1000000
jae 0x46e9cf
mov ecx, dword [esp + 0x48]
shl eax, 8
movzx ecx, byte [ecx]
shl esi, 8
or eax, ecx
inc dword [esp + 0x48]
mov ecx, esi
shr ecx, 0xb
imul ecx, edx
cmp ecx, eax
jbe 0x46e9f6
mov ebx, 0x800
mov esi, ecx
sub ebx, edx
mov ecx, dword [esp + 0x4c]
shr ebx, 5
add bx, dx
mov word [ecx + edi*2], bx
add edi, edi
jmp 0x46ea0e
sub esi, ecx
sub eax, ecx
mov ecx, edx
shr ecx, 5
sub dx, cx
mov ecx, dword [esp + 0x4c]
mov word [ecx + edi*2], dx
lea edi, [edi + edi + 1]
mov edx, dword [esp + 0x4c]
movzx edx, word [edx + edi*2]
cmp esi, 0x1000000
jae 0x46ea31
mov ecx, dword [esp + 0x48]
shl eax, 8
movzx ecx, byte [ecx]
shl esi, 8
or eax, ecx
inc dword [esp + 0x48]
mov ecx, esi
shr ecx, 0xb
imul ecx, edx
cmp ecx, eax
jbe 0x46ea58
mov ebx, 0x800
mov esi, ecx
sub ebx, edx
mov ecx, dword [esp + 0x4c]
shr ebx, 5
add bx, dx
mov word [ecx + edi*2], bx
add edi, edi
jmp 0x46ea70
sub esi, ecx
sub eax, ecx
mov ecx, edx
shr ecx, 5
sub dx, cx
sub edx, ecx
mov ecx, dword [esp + 0x4c]
mov word [ecx + edi*2], dx
lea edi, [edi + edi + 1]
sub edi, 0x40
cmp edi, 4
jb 0x46ee20
mov edx, edi
mov dword [esp + 0x70], edi
shr edx, 1
and edi, 1
dec edx
or edi, 2
mov dword [esp + 0x74], edx
cmp dword [esp + 0x70], 0xe
jae 0x46eb61
mov ecx, dword [esp + 0x74]
shl edi, cl
mov edx, edi
mov ecx, dword [esp + 0x70]
add edx, edx
add ecx, ecx
add edx, dword [esp + 0xc]
add edx, 0x560
add byte [ebx], ch
rol dword [ebx + 0x5489fec2], 1
and al, 0x4c
mov dword [esp + 0x78], 1
mov dword [esp + 0x7c], 1
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x7c]
movzx edx, word [edx + ecx*2]
adc al, 0x4a
cmp esi, 0x1000000
jae 0x46eaf4
mov ecx, dword [esp + 0x48]
shl eax, 8
movzx ecx, byte [ecx]
shl esi, 8
or eax, ecx
inc dword [esp + 0x48]
mov ecx, esi
shr ecx, 0xb
invalid
scasd eax, dword es:[edi]
Function at 0x46eb85
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp esi, 0x1000000
jae 0x46eb82
mov ecx, dword [esp + 0x48]
xor edx, edx
shl eax, 8
shl esi, 8
mov dl, byte [ecx]
or eax, edx
inc dword [esp + 0x48]
shr esi, 1
sub eax, esi
xor edx, edx
mov ecx, eax
add edi, edi
shr ecx, 0x1f
sub edx, ecx
mov dword [esp + 0x80], edx
add edi, dword [esp + 0x80]
mov ecx, dword [esp + 0x80]
and ecx, esi
inc edi
add eax, ecx
dec dword [esp + 0x74]
jne 0x46eb66
mov edx, dword [esp + 0xc]
add edx, 0x644
shl edi, 4
mov dword [esp + 0x4c], edx
mov dword [esp + 0x84], 1
test byte [esp + eax*4], ah
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ebx - 0x74b3dbb4], cl
xchg esp, eax
and al, 0x84
add byte [eax], al
add byte [edi], cl
mov bh, 0x14
push ecx

Function at 0x46ec0c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 0x4c]
shr ebp, 5
mov ebx, dword [esp + 0x84]
test byte [eax], al
add byte [eax], al

Function at 0x46ec16
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test byte [eax], al
add byte [eax], al
add bp, dx
mov word [ecx + ebx*2], bp
mov edx, dword [esp + 0x84]
add dword [esp + 0x84], edx
jmp 0x46ec65
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x84]
movzx edx, word [ecx + edx*2]
cmp esi, 0x1000000
add dword [ebx + 0x13], esi
mov ecx, dword [esp + 0x48]
shl eax, 8
movzx ecx, byte [ecx]
shl esi, 8
or eax, ecx
inc dword [esp + 0x48]
mov ecx, esi
shr ecx, 0xb
imul ecx, edx
cmp ecx, eax
jbe 0x46ecc9
mov ebp, 0x800
mov esi, ecx
sub ebp, edx
mov ecx, dword [esp + 0x4c]
invalid

Function at 0x470ba2
Capabilities:
Packed with generic packer

Disassembly:
dec esp
add byte [ebp + ecx*4 + 0xe004b], ah
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
invalid
movsb byte es:[edi], byte [esi]

Function at 0x470bab
Capabilities:
Packed with generic packer

Disassembly:
dec esp
add byte [ebp + ecx*4 + 0xe004b], ah
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
invalid
movsb byte es:[edi], byte [esi]
Function at 0x47740a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 8]
call 0x4f70f6
mov eax, dword [ebp - 0x10]

Function at 0x47741d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword [ebx + 0xc]
call 0x4f7105
mov eax, dword [ebp - 0x14]

Function at 0x4778ff
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
add byte [eax], al
push ebx
je 0x477968
imul ebp, dword [esi + 0x67], 0x72657020
insd dword es:[edi], dx
imul esi, dword [ebx + 0x73], 0x736e6f69
imul ebp, dword [edi + 0x6e], 0x6e6f2073
and byte [edx + 0x65], dh
imul esi, dword [bp + di + 0x74], 0x6b207972
and byte [ebx + 0x65], ch
jns 0x47794e
outsd dx, dword [esi]

Function at 0x47d613
Capabilities:
Packed with generic packer

Disassembly:
call fcn.0048243c
mov dword [0x4ceff4], eax
dec esp
add byte [ebx - 0x3d], bl

Function at 0x48b4d3
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword [eax + 0x20c]
push eax
mov eax, dword [0x4ceeac]
push eax
lea edx, [ebp - 0x30]
mov al, 0x95
call 0x5144b5
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x1ec]
mov edx, 8
or byte [eax], al
add byte [eax], al
mov eax, dword [ebx]
call 0x5169c1
lea edx, [ebp - 0x30]
mov al, 0x96
call 0x5144d7
add byte [eax + 0x558b0008], dl
ror byte [ebx - 0x4b7f74fd], 1
add al, byte [eax]
add al, ch
int 0xb
add byte [edx + 0xc], bh
mov eax, dword [ebx]
call 0x53da6b
or eax, dword [eax]
mov edi, eax
mov eax, dword [ebx]
mov eax, dword [eax + 0x300]
mov eax, dword [eax + 0x24]
mov edx, dword [ebx]
mov edx, dword [edx + 0x300]
add eax, dword [edx + 0x2c]
add edi, eax
mov eax, dword [ebx]
mov esi, dword [eax + 0x2b4]
mov eax, edi
sub eax, dword [esi + 0x24]

Function at 0x48c661
Capabilities:
Get number of processors

Disassembly:
outsd dx, dword [esi]
je 0x48c6dc
popal
jb 0x48c6cd
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
jae 0x48c6df
je 0x48c6cf
arpl word [edi + 0x6e], bp

Function at 0x48c66e
Capabilities:
Get number of processors

Disassembly:
outsd dx, dword [esi]
je 0x48c6dc
popal
jb 0x48c6cd
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
jae 0x48c6df
je 0x48c6cf
arpl word [edi + 0x6e], bp

Function at 0x48c684
Capabilities:
Get number of processors

Disassembly:
je 0x48c6cf
push edi
imul ebp, dword [esi + 0x64], 0x5c73776f
inc ebx
jne 0x48c6f0
jb 0x48c6e5
outsb dx, byte [esi]
je 0x48c6d9
jb 0x48c6f9
imul ebp, dword [edi + 0x6e], 0x696e555c
outsb dx, byte [esi]
jae 0x48c704
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
outsd dx, dword [esi]
dec ecx
outsb dx, byte [esi]
jo 0x48c76b
add byte [eax], al
Function at 0x48c6be
Capabilities:
Get number of processors

Disassembly:
add byte [eax], al
dec ecx
outsb dx, byte [esi]
outsb dx, byte [esi]
outsd dx, dword [esi]
and byte [ebx + 0x65], dl
je 0x48c73e
jo 0x48c705
and byte [ecx + 0x63], cl
outsd dx, dword [esi]
outsb dx, byte [esi]
and byte [edi + 0x72], al
outsd dx, dword [esi]
jne 0x48c746
add byte [eax], al
add byte gs:[eax], al
dec ecx
outsb dx, byte [esi]
outsb dx, byte [esi]
outsd dx, dword [esi]
and byte [ebx + 0x65], dl
je 0x48c786
jo 0x48c74d
and byte [ebx + 0x65], dl
insb byte es:[edi], dx
arpl word gs:[ebp + 0x64], si
and byte [ebx + 0x6f], al
insd dword es:[edi], dx
jo 0x48c791
outsb dx, byte [esi]
outsb dx, byte gs:[esi]
je fcn.0048c79a
add byte [ecx + 0x6e], cl
outsb dx, byte [esi]
outsd dx, dword [esi]
and byte [ebx + 0x65], dl
je 0x48c7a6
jo 0x48c76d
and byte [ebx + 0x6f], al
insd dword es:[edi], dx
jo 0x48c7b3
outsb dx, byte [esi]
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
je 0x48c7bc
add byte [eax], al
add byte [ecx + 0x6e], cl
outsb dx, byte [esi]
outsb dx, byte [esi]
outsd dx, dword [esi]
and byte [ebx + 0x65], dl
je 0x48c7ca
jo 0x48c791
and byte [ebx + 0x65], dl
insb byte es:[edi], dx
arpl word gs:[ebp + 0x64], si
and byte [ecx + 0x73], dl
imul esi, dword [ebx], 0
dec ecx
outsb dx, byte [esi]
outsb dx, byte [esi]
outsd dx, dword [esi]
and byte [ebx + 0x65], dl
je 0x48c7e6
push ebx
je 0x48c7e6
jo 0x48c7ad
add byte [eax], al
dec ecx
outsb dx, byte [esi]
outsb dx, byte [esi]
outsd dx, dword [esi]
and byte [ebx + 0x65], dl
je 0x48c806
jo 0x48c7cd
and byte [ebp + 0x73], dl
jb 0x48c7b9
dec ecx
outsb dx, byte [esi]
outsd dx, dword [esi]
and byte [ebx + 0x65], dl
je 0x48c822
jo 0x48c7e9
and byte [ebp + 0x73], dl
jb 0x48c7d5
jb 0x48c7d5
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
outsd dx, dword [esi]
cmp ah, byte [eax]
dec edi
jb 0x48c825
popal
outsb dx, byte [esi]
imul edi, dword [edx + 0x61], 0x6e6f6974
je 0x48c82e
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [ecx + 0x6e], cl
outsb dx, byte [esi]
outsd dx, dword [esi]
and byte [ebx + 0x65], dl
je 0x48c846
push ebx
jae 0x48c83c
jb 0x48c7f9
add byte [eax], al
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x270]
call 0x54955a
mov edx, dword [ebx + 0x270]
mov eax, ebx
call 0x515b3b
xchg ebx, eax
inc eax
add al, byte [eax]
add byte [ebx - 0x6cbf173d], cl
or byte [eax], al
invalid
lodsb al, byte [esi]
invalid

Function at 0x48c6d8
Capabilities:
Get number of processors

Disassembly:
dec ecx
outsb dx, byte [esi]
outsb dx, byte [esi]
outsd dx, dword [esi]
and byte [ebx + 0x65], dl
je 0x48c756
jo 0x48c71d
and byte [esi + 0x6f], cl
and byte [ecx + 0x63], cl
outsd dx, dword [esi]
outsb dx, byte [esi]
jae 0x48c6ed
add byte [eax], al
add byte [ecx + 0x6e], cl
outsb dx, byte [esi]
outsd dx, dword [esi]
and byte [ebx + 0x65], dl
je 0x48c76e
jo 0x48c735
and byte [ebx + 0x65], dl
je 0x48c775
jo 0x48c722
push esp
jns 0x48c775
inc ebx
outsd dx, dword [esi]
jae 0x48c79d
insb byte es:[edi], dx
cmp ah, byte [eax]
push ebx
insb byte es:[edi], dx
jae 0x48c7dd
insb byte es:[edi], dx
arpl word gs:[ebp + 0x64], si
cmp ah, byte [eax]
dec esi
popal
insd dword es:[edi], dx
add byte gs:[ecx + 0x6e], cl
Function at 0x48c733
Capabilities:
Get number of processors

Disassembly:
and byte [ebp + 0x73], al
insb byte es:[edi], dx
arpl word gs:[ebp + 0x64], si

Function at 0x48c77f
Capabilities:
Get number of processors

Disassembly:
push esp
popal
jae 0x48c7ee
jae 0x48c785
add byte [eax], al
add byte [ecx + 0x6e], cl
add al, byte [eax]

Function at 0x491ff8
Capabilities:
Packed with generic packer

Disassembly:
or al, 0x60
dec ebx
add byte [eax - 0x289fffb5], dl
pushal
xlatb
dec ebx
add byte [eax + 0x67], cl
dec ebx
add byte [eax + 0x23], ch
inc ecx
add al, bl
pop ds
dec ecx
add al, ah
adc ecx, dword [eax + eax - 0x1c]
dec ebx
add byte [edx + edx + 0x4c], dl
adc cl, byte [eax + eax - 0xc]
ror dword [ebx], 1
test al, 0xd2
dec ebx
add byte [eax], dl
dec ebx
add al, cl
xor dword [ebx], ecx
test al, 0x12
dec esp
add al, dh
adc cl, byte [eax + eax + 0x10]
push cs
dec esp
add ah, dl
adc cl, byte [eax + eax + 0x4c]
push 0x4b
add byte [esi*8 + 0x221c004b], bh
dec ecx
add byte [ebx + esi*2 + 0x306c004b], ch
dec ebx
add byte [esp + esi*2 + 0x4b], dh
add byte [esp + esi*8 + 0x7ac4004b], cl
dec ebx
add ah, al
jp 0x49209e
add byte [ecx + edx], cl
dec esp
add byte [ebp + ecx*4 + 0xe004b], ah
inc ecx
pop ds
dec ecx
add ah, dl
add dword [eax], eax
add byte [eax], al
add byte [0x6574754f], cl
jb 0x4920bd
outsd dx, dword [esi]
je 0x4920d7
bound ebp, qword [edi + 0x6f]
imul ebx, eax, 1
add byte [eax], al
add dword [eax], eax
or dword [ecx + 0x6e], ecx
outsb dx, byte [esi]
jb 0x4920d3
popal
fadd qword gs:[bx + di]
add byte [eax], al
add byte [eax], al
or eax, 0x656e6e49
jb 0x4920e1
outsd dx, dword [esi]
je 0x4920fb
bound ebp, qword [edi + 0x6f]
imul esp, eax, 1
add byte [eax], al
add dword [eax], eax
push cs
dec ecx
outsb dx, byte [esi]
jae 0x492119
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
imul ebp, dword [esi + 0x67], 0x65676150
in al, 1
add byte [eax], al
add al, byte [eax]
or dword [ebp + 0x61], ecx
imul ebp, dword [esi + 0x50], 0x6c656e61
insb byte es:[edi], dx
call 0x34920c5
add byte [0x65676150], cl
dec esi
popal
insd dword es:[edi], dx
dec esp
popal
bound esp, qword [ebp + 0x6c]
in al, dx
add dword [eax], eax
add byte [ebx], al
add byte [eax + edx*2], dl
add eax, dword [eax]
adc al, 0x50
popal
inc esp
jae 0x492145
arpl word [edx + 0x69], si
jb 0x49214d
jo 0x49215a
imul ebp, dword [edi + 0x6e], 0x6562614c
push ebx
insd dword es:[edi], dx
add dword [eax], eax
add byte [ebx], al
add byte [ebx], cl
push ebx
je 0x492183
je 0x492199
jae 0x492172
popal
bound esp, qword [ebp + 0x6c]
cld
add dword [eax], eax
add byte [esi], al
add byte [ebx], cl
push eax
jb 0x4921a3
jb 0x49219c
jae 0x4921ac
inc edx
popal
jb fcn.0049213d
jbe 0x4921ac
insb byte es:[edi], dx
inc ebp
add byte [eax + 0x580041c7], ch
mov dword [0xf4bc0045], eax
inc ebp
add byte [eax + 0x55541607], dl
mov dword [ecx], 0x45a358
mov esp, 0x900045f4
pop es

Function at 0x4985cc
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax - 0x80000000], al
and byte [eax], al
Function at 0x4985d6
Capabilities:
Packed with generic packer

Disassembly:
mov al, 0
add bh, bh
mov al, 0
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
invalid
invalid
mov bh, 0x4b
add byte [eax], ah
pushal
add byte [eax], al
jmp dword [eax]
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax - 0x80000000], al
and byte [eax], al
or ecx, dword [edi + 0x6e]
or ecx, dword [edi + 0x6e]
dec ebp
outsd dx, dword [esi]
jne 0x498650
inc esp
outsd dx, dword [esi]
ja 0x498650
js 0x49859b
dec ebx
add byte [eax], ch
add bh, bh
push 0x1ff0000
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f0b0021], al
outsb dx, byte [esi]
dec ebp
outsd dx, dword [esi]
jne fcn.00498676
dec ebp
outsd dx, dword [esi]
jbe 0x49866d
sbb byte [edi + 0x70004b], dh
add bh, bh
jo 0x498612
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f090022], al
outsb dx, byte [esi]
dec ebp
outsd dx, dword [esi]
jne 0x49869c
push ebp
jo 0x4985bd
scasd eax, dword es:[edi]
inc eax
add byte [eax - 0x7f010000], al
add byte [eax], al
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f0c0023], al
outsb dx, byte [esi]
dec ebp
outsd dx, dword [esi]
jne 0x4986c0
inc ebp
outsb dx, byte [esi]
je 0x4986b7
jb 0x4985e4
scasd eax, dword es:[edi]
inc eax
add byte [eax], bh
add bh, bh
js 0x49865d
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax - 0x80000000], al
and al, 0
or al, 0x4f
outsb dx, byte [esi]
dec ebp
outsd dx, dword [esi]
jne 0x4986e7
invalid
dec esp
dec esp
add byte [ebx - 0x43e3453d], cl
dec ebx
add al, ch
push 0x84000020
test al, al
je 0x4986b9
mov eax, ebx
call 0x558e81
mov ebx, eax
jmp 0x4986bb
call fcn.004b3990
test al, al
je 0x4986d4
push esi
push ebx
call dword [0x4ce574]
mov dword [0x4cf438], eax
pop esi
pop ebx
ret
xor eax, eax
mov dword [0x4cf438], eax
pop esi
pop ebx
ret
add ah, ch
test byte [ecx], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, ah
invalid
dec ecx
add byte [eax + eax], bl
add ah, dl
ret 0x4b

Function at 0x498617
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f090022], al
outsb dx, byte [esi]