joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10059e76
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10059eb5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10059eb5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10059eb5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10059eb5
cmp dword [ecx + 0x74], 0xe
jbe 0x10059eb5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1005b1f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1005b21d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1005b21d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1005b540
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10065620
push 0x10065618
push str.FlsAlloc
push 0x1f
call fcn.1005b823
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005b574
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x1005b57a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1005b5be
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10065630
push 0x10065628
push str.FlsGetValue
push 0x21
call fcn.1005b823
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005b5f5
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1005b5fd
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10065638
push 0x10065630
push str.FlsSetValue
push 0x22
call fcn.1005b823
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005b637
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1005e4fe
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1005e59b
push ebx
push esi
call fcn.1005e59e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1005e402
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1005e548
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1005e59a
push edi
push eax
call fcn.1005e7fc
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1005e568
call fcn.1005caf0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1005e599
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1005e402
add esp, 0x20
test eax, eax
jne 0x1005e587
push edi
call fcn.1005caf0
jmp 0x1005e58f
push ebx
call fcn.1005caf0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x403f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00406930
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov cl, al
mov edx, eax
and cl, 0x38
shr edx, 7
movsx ecx, cl
movsx edx, dl
imul edx, ecx
mov ecx, eax
shr ecx, 8
and cl, al
xor dl, cl
mov byte [ebp + eax - 0x3a988], dl
inc eax
cmp eax, 0x3a980
jb 0x403fe3
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405c7c
mov esp, ebp
pop ebp
ret
Function at 0x4040c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00406930
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov cl, al
mov edx, eax
add cl, cl
shr edx, 7
and dl, cl
mov ecx, eax
shr ecx, 8
and cl, al
xor dl, cl
mov ecx, eax
shr ecx, 3
or dl, cl
mov byte [ebp + eax - 0x3a988], dl
inc eax
cmp eax, 0x3a980
jb 0x404143
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405c7c
mov esp, ebp
pop ebp
ret
Function at 0x404220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00406930
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor esi, esi
lea edi, [esi + 0xd]
nop dword [eax + eax]
mov eax, esi
mov ecx, esi
xor eax, 0x200
shr ecx, 9
shr eax, 9
xor edx, edx
dec ecx
xor eax, ecx
div edi
mov eax, 0xcccccccd
imul edx, esi
mul edx
shr edx, 3
sub dl, 2
shl dl, 6
mov byte [ebp + esi - 0x3a988], dl
inc esi
cmp esi, 0x3a980
jb 0x4042b0
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00405c7c
mov esp, ebp
pop ebp
ret
Function at 0x4064b2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4064f1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4064f1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4064f1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4064f1
cmp dword [ecx + 0x74], 0xe
jbe 0x4064f1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x404690
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437b80
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4047b3
push ecx
lea ecx, [esi + 0x18]
call fcn.00423eb0
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4047ca
push ecx
lea ecx, [esi + 0x24]
call 0x423dc0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42eed0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xfbd8bd3d
pop ebp
or byte [edi], cl
call [esi + edi*8 + 0x78]
jbe 0x42eef5
lea ecx, [edi + 0xd]
or ah, ah
movsb byte es:[edi], byte [esi]
sbb byte [edi + 0x7fcdcc15], cl
arpl word [edi + ebp - 0x3e5ea5fb], bx
cmovns esp, ebp
inc esp
adc edx, dword [eax + 0x2d1fff75]
aaa
invalid

Function at 0x44a210
Capabilities:
Accept command line arguments
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov edi, eax
mov dword [esi], 0
call ebx
test ax, ax
jge 0x44a23b
or dword [esi], 0x2000000
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x11
mov edi, eax
call ebx
test ax, ax
jge 0x44a258
or dword [esi], 0x4000000
test edi, edi
je 0x44a26e
mov ecx, dword [0x657a4c]
push 0x657768
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0x12
call ebx
test ax, ax
jge 0x44a27d
or dword [esi], 0x8000000
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x473df0
Capabilities:
Encode data using xor

Disassembly:
sub ah, dh
jp 0x473e51
dec esp
mov eax, dword [0x15ef2c68]
dec ecx
in eax, dx
adc dl, byte [edi - 0x24498b0a]
xchg ecx, eax
adc bl, byte [eax + 0x4e]
xchg esp, eax
daa
jecxz 0x473e1c
sal dword [edx], 0x9f
call gs:[ebp + 0x1a]
mov al, byte [0x930b833e]
lodsd eax, dword [esi]
je 0x473e35
mov al, byte [0xd2010dc0]
add edx, edx
out 0x76, eax
push esi
mov esi, dword [ebp + 0x10]
mov al, byte [0xa2cc61cc]
cdq
adc al, 0x89
mov eax, dword [0x127c7673]
mov dword [0x19a5815], eax
fcmovne st(0), st(6)
int3
add ebx, ebx
into
hlt
mov esp, 0xfc326ced
arpl word [ebp + 0x10], cx
and eax, 0x22b8ea2
dec ebp
adc byte [0x22b8ea2], ah
ja 0x473e27
xchg ecx, eax
xor al, 0xae
mul dword [ebx - 0x2af15f8a]
jae 0x473e57
or ebx, edx
jge 0x473e97
mov ebx, 0xace05417
scasd eax, dword es:[edi]
test al, 0xf6
add dword [edx + 0x28], 0xbb64c8e8
inc edx
in eax, 0xb4
xchg byte [edi], bl
cmp dl, byte [edx - 0x3f]
in al, 0x21
into
fild dword [edi + 0x3b]
push esp
adc ah, dh
mov ebp, 0x5241c8b7
mov al, byte [0x26975780]
push ebp
xchg edi, eax
push ebp
push edi
or dword [edx - 0x5d], esi
sahf
cwde
test dword [edx], edx
mov ah, 0x6f
mov byte [0xdfb39651], al
mov edx, dword [esi]
dec byte [ebp - 0x4d217be0]
fcomp dword [edi + 0x2699a5a7]
test al, 0xd9
inc edx
loop 0x473e89
mov bh, 0x37
pop ss
sub ebx, dword [ebx - 0x3c23c0a3]
inc esi
sbb eax, 0x2a04353
jno 0x473edf
invalid
ret 0x2d01

Function at 0x480910
Capabilities:
Encode data using xor

Disassembly:
test dword [ecx], edi
movsd dword es:[edi], dword [esi]
pop ds
pop ax
push es
in al, 0xf5
and byte [ebx + 0x3a77c265], dh
jp 0x48094e
retf 0x6c70
invalid

Function at 0x4b30d0
Capabilities:
Encode data using xor

Disassembly:
push edi
not dword [esi + 0x28e2906b]
popal
test eax, 0x5f5da545
test edi, ebx
pop ss
and byte [ebx + 0x14], ah
in eax, 0xab
adc byte [ecx + 0x43d01df], bh
adc eax, 0x7974a5ba
test byte [esi + 0x68f4b30f], dl
in al, 0
pop esi
imul eax, dword [edi + edi*2 - 0x56656647], 0xc7ddfbf4
test byte [esi - 0x3132ca6c], dl
ja 0x4b3158
jecxz 0x4b3156
shr cl, 0x84
insb byte es:[edi], dx
scasd eax, dword es:[edi]
xor al, 0xf
dec edx
add al, 0x47
xchg edx, eax
mov edi, 0x91067454
cmc
cmp byte [edi + 0x49], ah
lea eax, [esi + 0x74ef887e]
inc eax
les esi, [ebx]
invalid
jo 0x4b312a
out 0x77, eax
sbb byte [eax - 0x55], dl
push esi
dec eax
jo 0x4b315b
ja 0x4b315d
push esp
mov al, byte [0x704856ab]
clts
push es
xor eax, 0x8b1754fc
mov bh, 0x76
jge 0x4b3142
jmp 0x4b3141
jmp 0x6bc8317a
push ds
add byte [ebp + 0x6b], bh
push ss
imul edx, dword [esi], 0xffffff88
ljmp 0x46b2
mov dl, ch
mov bl, dh
dec edx
hlt
Function at 0x4e01f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005136e0
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e0313
push ecx
lea ecx, [esi + 0x18]
call 0x4ffa10
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e032a
push ecx
lea ecx, [esi + 0x24]
call fcn.004ff920
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x513390
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0x67
ljmp 0x8408
jne 0x51336e
mov dword [0xd8f8701f], eax
mov cl, byte [ecx + ecx*4]
xchg esi, eax
pop ss
xchg edi, eax
adc edx, 0x60
and eax, 0x6f73184e
outsb dx, byte [esi]
xor dword [eax - 0x45b9d7dc], 0xe2069215
dec ecx
in al, 0x82
and ebp, 0xe30b2512
jo fcn.00513390
xchg dword [edx], ebx
jp 0x51337a
push edi
nop
add esi, dword [esi + ebx - 0x5afaf223]
inc ebp
fld qword [esp + esi*4]
out 0xa0, eax
pop es
div byte [ebx + eax*4 - 0x1f]
cmc
inc ebx
ljmp 0xf7a5
Function at 0x529920
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055ce10
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529a43
push ecx
lea ecx, [esi + 0x18]
call fcn.00549140
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529a5a
push ecx
lea ecx, [esi + 0x24]
call fcn.00549050
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x572f30
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a6420
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x573053
push ecx
lea ecx, [esi + 0x18]
call fcn.00592750
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x57306a
push ecx
lea ecx, [esi + 0x24]
call fcn.00592660
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x58f270
Capabilities:
Encode data using xor

Disassembly:
xchg dword [eax + esi + 0x587e2618], edi
sahf
mov dword [0x30f497b3], eax
fild qword [ebx]
dec ebp
sub dword [ebx + edx], edi
jns 0x58f21d
mov bl, 0x97
hlt
sbb al, 0x43
popal
and al, 0xce
or al, 0x52
jmp 0x3226e5a9
sub al, 0x30
jecxz 0x58f2f1
cmpsb byte [esi], byte es:[edi]
push ds
popal
sub eax, 0xc3a67d28
sbb dword [esi + 0x61], edi
jnp 0x58f214
push eax
lodsb al, byte [esi]
int3
xchg ebp, eax
sub dword [ecx - 0x20], esp
fst qword [edi - 0x5c04ee45]
sar ah, 0x9e
cmpsd dword [esi], dword es:[edi]
mov dword [0x2b6389dc], eax
add dword [ebx - 0x30], esp
push eax
push ebx
or dl, bl
invalid
Function at 0x5bc870
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005efd60
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bc993
push ecx
lea ecx, [esi + 0x18]
call fcn.005dc090
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bc9aa
push ecx
lea ecx, [esi + 0x24]
call fcn.005dbfa0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret