joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
xchg byte [ecx], ch
fbld tbyte [edx]
inc eax
add bl, bh
adc al, 0xb5
add byte [esi], dl
adc eax, 0x1b170040
add esi, esi
sbb ebx, dword [ebx]
sbb eax, dword [edx]
sbb ebx, dword [ebx]
sbb edi, eax
sbb ebx, dword [ebx]
sbb eax, dword [ebx]
sbb ebx, dword [ebx]
add al, 5
sbb eax, dword [esi]
cmp eax, dword [edi]
sbb ebx, dword [ebx]
sbb ebx, dword [ebx]
sbb ebx, dword [ebx]
sbb ecx, dword [esi - 0x27f6293e]
or ebx, dword [ebx]
mov esp, 0xf41b0e0d
sbb ebx, dword [ebx]
adc byte [ebx], bl
adc dword [edx], edx
adc ebx, dword [ebx]
adc al, 0x15
push ss
pop ss
sbb ah, dh
sbb cl, byte [ebx + 0x2d909090]
nop
nop
nop
cmp dl, byte [eax - 0x6f6f6f70]
push ebp
mov ebp, esp
mov eax, dword [ebp - 0xa]
push ds
or eax, sym.imp.MSVCRT.dll__iob
push eax
xor dword [ebp + 0x40], 0x68
je 0x401735
jg 0x401765
push ecx
push dword [ecx]
adc byte [edi - 0x535effc0], 0xbe
inc ecx
add byte [ebx - 0x617af33c], al
je 0x401787
push eax
push str.Total_of__d_requests_completed_n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop
sub ecx, dword [ebx - 0x476f7e1e]
add byte [eax], al
add byte [ecx + 0xa7da78], ah
test eax, eax
mov eax, dword [0x994053]
je 0x4017bb
push 0x413c3a
dec eax
cli
sahf
inc eax
add byte [eax], al
ror byte [0x410274], 0xeb
les ecx, [ebx + 0x4118ab15]
sbb byte [edx - 0xc], dl
call 0x8a404050
mov cx, word [0xc4117f4]
mov dword [0x411808], eax
scasd eax, dword es:[edi]
mov byte [edx], al
inc ecx
add byte [ebx + 0x56], dl
mov ebp, dword [eax + 0x64]
rol dword [eax], 0x66
in al, 0xa9
mov ah, 0xb
inc ecx
sub byte [ebp + 0x5d7557c0], al
mov edx, dword [0x411800]
push edx
push 0x53d498
mov ecx, 0x2a2a120
inc ecx
add byte [ebx - 0x3fe6843c], al
add bh, ah
mov eax, dword [0x410274]
push eax
push 0x48413c40
inc ebp
test ah, dl
fiadd word [eax]
push ds
salc
add esp, 0xc
mov eax, dword [0x7240d014]
test dword [ebx - 0x542b7fba], ebx
add byte [ebp + 5], dh
mov eax, 0x40d47c
push eax
push 0x40d411
call esi
mov eax, dword [ecx + 0xc2c0c8]
add ecx, 0x20
push ecx
sub edx, dword [sym.imp.MSVCRT.dll_fflush]
adc ecx, 0xffffffe9
mov edx, dword [0x40d018]
mov esi, dword [0x40c1ee]
push 0xeb60
invalid
mov edx, dword [0x184118ab]
push edx
hlt

Function at 0x4080c3
Capabilities:
Encode data using xor

Disassembly:
call fcn.00407fa1
mov ecx, 0x1ca
call 0x4080c3
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x4080c6
ljmp 0xa2b6:0xda8d5821
Function at 0x409340
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, dword [esi + 0x56]
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 4], 0xffffffff
je 0x4093d8
mov al, byte [esi + 0x2c]
test al, al
push 0x6fe85608
pop ds
add byte [ecx - 0x75], bh
clc
dec edi
aas
push eax
and eax, 0x6000000
je 0x4093c7
cmp eax, 0x6000000
jne 0x40938b
push 0xffffffffffffffb0
call dword [0x5d4008]
add esp, 4
push 0xffffffffffffffff
movsd dword es:[edi], dword [esi]
hlt
cmp eax, 0x400438d
jne 0x4093a9
push 1
enter 0x815, 0xffffffffffffffc1
inc eax
add byte [ebx - 0x20fb3c], al
push 0xffffffffffffff8f
call dword [sym.imp.MSVCRT.dll__adjust_fdiv]
ja 0x409359
add byte [eax], al
add dh, byte [ebp + 0x21]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
dec esp
les eax, [edx + ebp*2]
mov eax, dword [esi - 0x4b]
push eax
Function at 0x416840
Capabilities:
Create pipe

Disassembly:
mov eax, dword [0x427b30]
sub esp, 0x14
push ebx
mov ebx, dword [0x2bccfbc]
push edi
mov edi, dword [0x2bcf43c]
call fcn.004167b0
cmp dword [0x2bcf43c], 0x2f
jne 0x4168a2
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.004167e0
pop edi
pop ebx
add esp, 0x14
ret
Function at 0x416ba0
Capabilities:
Get disk information
Manipulate console buffer
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x427004]
xor eax, ebp
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
jmp 0x416bc5
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1519a5
jge 0x416c0e
mov dword [0x2bcf0a4], 0x8e46a6f0
cmp dword [0x2bcf43c], 0x3dc
jne 0x416c0c
xor ecx, ecx
mov word [ebp - 8], cx
xor edx, edx
mov word [ebp - 6], dx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x416bbc
mov dword [ebp - 0x10], 0
jmp 0x416c20
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x12cad2a
jge 0x416cbb
cmp dword [0x2bcf43c], 0xa5f
jne 0x416c72
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x820]
push ecx
push str.xonatoyuhejigoriramadiguyo
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [ebp - 0x10], 0x84620b
jne 0x416c96
mov edx, dword [0x428950]
mov dword [0x2bcf43c], edx
mov eax, dword [0x2bcf43c]
add eax, 0xa231
mov dword [0x2bcf43c], eax
cmp dword [0x2bcf43c], 0x141
jne 0x416cb6
mov dword [0x429f28], 0xec58acac
mov dword [0x429f2c], 0xffffffff
jmp 0x416c17
call fcn.004168b0
jmp dword [0x2bccfbc]
Function at 0x40473e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.00437c2e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x404861
push ecx
lea ecx, [esi + 0x18]
call fcn.00423f5e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x404878
push ecx
lea ecx, [esi + 0x24]
call int.00423e6e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44a210
Capabilities:
Accept command line arguments
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov edi, eax
mov dword [esi], 0
call ebx
test ax, ax
jge 0x44a23b
or dword [esi], 0x2000000
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x11
mov edi, eax
call ebx
test ax, ax
jge 0x44a258
or dword [esi], 0x4000000
test edi, edi
je 0x44a26e
mov ecx, dword [0x659a4c]
push 0x659768
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0x12
call ebx
test ax, ax
jge 0x44a27d
or dword [esi], 0x8000000
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x44daae
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00480f9e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44dbd1
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d2ce
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44dbe8
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d1de
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x453864
Capabilities:
Encode data using xor

Disassembly:
or al, 1
pop ds
movsd dword es:[edi], dword [esi]
mov dword [esi + 0x6f], eax
test dword [eax], ebp
add byte [ebp - 0x3a], bh
invalid
add eax, 0xdc8970d4
jae 0x453815
mov edi, 0xc4e0e3a1
inc ecx
jnp 0x45387b
add ebx, esp
or esp, dword [eax - 0x2c9900e7]
mov ecx, 0x6829d13d
pop edi
nop
cmp dl, ch
popal
neg byte [ebx + 0x1223cd58]
daa
pop eax
pop ss
and al, 0x26
mov eax, 0x70d8b808
or dh, byte [ebx + 0x7b]
pop ecx
lea ebp, [ecx + 0x25296318]
cmp byte [eax], bh
test al, 0xba
jg 0x4538f8
mov bl, 0x12
xchg esp, eax
xchg ecx, eax
imul ebp, dword [ebx + 0x402b2224], 0x242b505b
imul esi, dword [edi], 0xfffffff6
mov ch, 0x37
xchg dword [0xcebb3355], ebp
fild dword [edi + 0x53afd852]
sahf
xchg dword [edi], ebp
mov byte [0xfc2d805e], al
mov edi, 0x65cfc437
xor dh, dl
jo 0x453957
iretd
ret 0x2e78
mov al, byte [0x77080e30]
mov al, byte [0xf7e4615a]
fcompi st(4)
dec edi
fidiv dword [0x88963a20]
les edx, [ecx - 0x733b054e]
sub byte [edi + edx], bh
mov word [eax], gs
cmp al, 0x17
sub al, 0xa0
xchg dword [eax], esi
inc edi
ror byte [esp + edi*8 + 0x7dcbf16a], 0x40
mov esp, 0x70c4b72f
mov esp, 0xfb50e752
xlatb
mov ch, 0xa9
mov edx, 0xcabfd579
inc ecx
push edx
xchg esi, ecx
xor eax, 0x32391481
leave
jp 0x45396f
cmp al, 0x5b
cmp ah, byte [edx - 0x7b]
cmp dword [edx + 0x38], 0xe9a97c0
jne 0x4539af
mov bh, 0x4c
or dl, byte [edi]
pop ebx
xchg ebx, eax
and dh, byte es:[edx - 0x533f5d08]
cmp byte [esi + esi*2], ah
rcl dword [esi + 0x6b], 0x47
inc esp
sbb dword [ecx + edx + 0x65], 0xffffff90
invalid

Function at 0x46c56e
Capabilities:
Encode data using xor

Disassembly:
or esi, dword [edi]
sbb al, byte [eax - 0x5f58f02e]
cli
enter 0xffffffffffffff54, 0xffffffffffffffa2
ror byte [eax + 0x38], cl
mov al, 0xe0
movsb byte es:[edi], byte [esi]
invalid
jb 0x46c533
retf
Function at 0x4e029e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0051378e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e03c1
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffabe
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e03d8
push ecx
lea ecx, [esi + 0x24]
call fcn.004ff9ce
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x50a3ce
Capabilities:
Encode data using xor

Disassembly:
das
clc
pop ds
bound esi, qword [edx - 0x1dd9fbc6]
lodsb al, byte [esi]
add bl, byte [edi + 0x7c646ca3]
sar dword [ecx + edx*2 - 0x51], 1
lahf
mov dword [0xd17c646c], eax
jl 0x50a40f
scasd eax, dword es:[edi]
mov edx, 0x27be7649
scasb al, byte es:[edi]
sti
cdq
insd dword es:[edi], dx
xchg ebx, eax
xor al, 0x92
jo 0x50a3c6
adc eax, 0xd53f4ee8
jo 0x50a3b6
call 0x7125e321
loop 0x50a3ab
salc
sub byte [ecx + esi*2], bh
enter 0x5b9a, 0xffffffffffffffb2
mov ebx, 0x30afdead
mov al, byte [0x6aa984db]
mov esp, 0x2e32d655
pop ds
aas
scasb al, byte es:[edi]
xchg edi, eax
push ds
invalid
inc ebp
std
inc eax
jbe 0x50a3c7
test al, 0xe2
pop ebp
out dx, al
invalid
Function at 0x5299ce
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.0055cebe
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529af1
push ecx
lea ecx, [esi + 0x18]
call fcn.005491ee
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529b08
push ecx
lea ecx, [esi + 0x24]
call fcn.005490fe
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x548fce
Capabilities:
Encode data using xor

Disassembly:
xor ebx, dword [esi]
sub byte [ebp + 0x73], ch
pop eax
in eax, dx
add dl, bl
enter 0xfffffffffffff828, 0xffffffffffffffdb
fist dword [ebx - 0x68c72e39]
cmpsd dword [esi], dword es:[edi]
adc eax, 0xd3d99b42
inc ecx
int1
cmp byte [ecx + 0x4a], 0x21
retf
mov bl, 0x34
cmp bl, bh
add bh, 0x3f
wait
inc ebp
loope 0x548fa7
in al, dx
out dx, al
sub edx, ebx
je 0x54902d
repe scasd eax, dword es:[edi]
cmp byte [edi - 0x3ca10aea], bl
clc
sbb bh, byte [esi + 0x494b859b]
rol byte [ebx], cl
adc ebx, dword [edi + 0x1abc0dff]
xchg esp, eax
xor al, 0xc1
or byte [esi - 0x1abab177], 0xb3
lodsd eax, dword [esi]
xchg esp, eax
jp 0x548fe4
push ss
cmc
pop esi
ret
inc ebx
sti
invalid
add ecx, dword [ebx]
inc eax
jmp 0x81b01f20

Function at 0x55c5fe
Capabilities:
Encode data using xor

Disassembly:
mov ss, word [edi + 0x40]
lahf
mov bl, 0xe3
stosd dword es:[edi], eax
neg edx
xchg byte [eax], dh
invalid
Function at 0x5bcf5e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005f044e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bd081
push ecx
lea ecx, [esi + 0x18]
call fcn.005dc77e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bd098
push ecx
lea ecx, [esi + 0x24]
call int.005dc68e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5deafe
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0xa41de62f
xor al, 0x2b
jecxz 0x5deb40
cli
in eax, dx
push cs
test eax, 0xc9741898
mov bh, 0x1b
sbb dword [edx], ebp
pop es
jmp 0xe37ab6a6
fisub dword [ebx]
out dx, al
loope 0x5deba5
wait
dec ebx
mov al, byte [0xa4b6df28]
movsb byte es:[edi], byte [esi]
xor byte [0xee199d86], bh
invalid
test ebx, ebp
and edi, dword [edi + edi*2 - 0x597a63de]
popal
or al, 0x91
mov edx, 0xaaf78f63
mov al, 0x22
sub al, 0x3a
aaa
cmp eax, 0x1c740719
jge 0x5deb4b
cld
call dword [ecx]
leave
jae 0x5dec25
and byte [eax], dh
mov esp, 0xca0cb5b9
sbb dh, byte [ecx]
push ebx
and ebx, esp
and eax, dword [esp + ebp*8]
xor eax, 0x6b49093c
pop eax
jge 0x5debd2
retf 0xf8a1
dec esp
salc
lds ebx, [ebx + 0x7d]
int 0xac
leave
pushfd
xchg byte [0x32692edb], al
cmpsb byte [esi], byte es:[edi]
pushal
rcl dword [edx]
adc ebp, dword [edx + 0x7f]
inc ecx
je 0x5dec2a
pop esi
or dword [ecx - 0x26fb2b26], edx
aam 0x46
mov eax, 0xcc49240c
imul edx, dword [eax + 0x23], 0x744178ee
sbb eax, 0x39a27d4d
inc esi
jmp 0x5dec49
and al, 0x49
int3
Function at 0x639c0e
Capabilities:
Encode data using xor

Disassembly:
xchg byte [esi - 0x49], dl
or eax, 0xed76a977
inc esi
fld dword [ebx - 0x26]
push ebp
add edi, dword [eax + 0x51]
pop ax
mov dl, dh
pop es
mov byte [0x97c88fda], al
or esp, ecx
jae 0x639bbc
cmp dl, dl
cmp byte [eax], cl
pop ss
and ch, byte [edi]
in eax, dx
xchg ebp, eax
call 0xadc44aec
mov dh, 0x27
push esi
leave
inc ecx
invalid
push ebp
fldcw word [esi - 0x2c57e093]
jno 0x639c4d
pop ds
pop ds
or eax, 0x8825b47b
aas
mov ah, 0x25
mov byte [edi], bh
mov bl, 0x2c
pop ecx
xor dl, 0xba
fst st(2)
adc dword [edi - 0x5e], eax
jne 0x639c47
add eax, 0xb2374cc9
cmp esi, esi
test al, 0x8f
sbb dword [edi], edx
dec ebp
cmpsb byte [esi], byte es:[edi]
sub eax, 0x1c718c4
jae 0x639bd1
sbb bh, al
add dword [ebx - 0x6f], esi
movsd dword es:[edi], dword [esi]
fnsave dword [ebp - 6]
cmp cl, ah
push edx
pop eax
mov ebp, 0xc952f936
leave
mov ecx, 0x3d56bc3
jecxz 0x639c1b
dec esp
cmp al, 0x52
loop 0x639c16
cmp eax, 0x36c08326
mov esi, 0xb7a2cea
adc ebx, edx
cmp dword [edi], esp
stosb byte es:[edi], al
fdivr qword [eax + 0x56b67846]
out 0x7d, al
push ss
jp 0x639c3b
push 0x3de74582
inc ebx
cmp dh, al
insb byte es:[edi], dx
xchg esi, eax
sbb eax, 0xa976e366
xor al, byte [edi + 0x1c]
push edi
imul edi, dword [ebp - 0x45f95209], 0xcee69077
push ss
jp 0x639c47
or dword [ecx + esi*2 + 0x79c22a4c], edx
rcl bh, cl
xor eax, 0x76fd37cb
in eax, dx
xchg ecx, eax
mov dword [edx - 0x4a4fada3], edi
lea eax, [esi]
mov word [edi - 0x28], ss
scasb al, byte es:[edi]
in eax, 0xb7
jb 0x639c47
mov bh, 0x72
xchg edx, eax
or dword [ebx - 0x534723ee], edx
xchg byte ds:[edi - 0x22], cl
sbb eax, 0xfd32edf2
adc al, al
inc edx
jno 0x639ca3
loop 0x639d3f
mov esp, 0xaf152c53
mov dl, pe_nt_image_headers32
mov byte [0x47177339], al
dec ebp
dec esp
sub eax, 0xadc27876
fcomp qword [ecx + 0x22]
lodsd eax, dword [esi]
invalid
sbb bl, byte [edx + 0x1f96e127]
and byte [ebp + 2], dl
fistp qword [ebx]
loope 0x639cb2
mov eax, 0xd9955d57
out 0x7d, eax
aaa
insd dword es:[edi], dx
invalid
test dword [edx], ebp
jmp 0x639d7a
sub ch, bl
aaa
cmp byte [edi + 0x38], ch
test dword [edx], edx
xchg ebx, eax
pop ecx
jb 0x639cfe
sbb eax, 0xb5055ba7
out 0x41, eax
mov esp, ebp
sahf
mov ch, 0x19
sbb dword [ebp + 0x48], ebp
xor eax, 0x4b95c7f8
in al, dx
invalid
add edx, dword [esi + 0x3d7fa36]
dec ebx
push ss
pop ecx
sbb ch, 0xc1
loopne 0x639d40
sbb esp, dword [esi - 0x66b85385]
push edx
fidiv word [esi - 0x6d844399]
imul ebp, dword [eax - 0x60], 0xffffffb6
push eax
outsd dx, dword [esi]
push 0x6f50b6a0
xor esp, edi
sahf
movsx edi, word [bx + di - 0x16]
loop 0x639d96
xor al, 0x77
retf 0xd249
Function at 0x64d7dd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x656338
cmp edx, dword [eax]
je 0x64d7ff
add eax, 8
inc ecx
cmp eax, 0x6563c8
jl 0x64d7f0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x656338]
jne 0x64d92d
mov eax, dword [0xa59c90]
cmp eax, 1
je 0x64d907
test eax, eax
jne 0x64d830
cmp dword [0x656264], 1
je 0x64d907
cmp edx, 0xfc
je 0x64d92d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64d867
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064e1c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064e650
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64d8aa
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064e650
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x652a14
push edi
call fcn.00650520
invalid
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064e1c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064e1d0
lea eax, [ebp - 0xa0]
push 0x6529f4
push eax
call fcn.0064e1d0
push dword [esi + 0x65633c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064e1d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00650494
add esp, 0x2c
pop edi
jmp 0x64d92d
lea eax, [ebp + 8]
lea esi, [esi + 0x65633c]
cmp al, 0x63
add byte gs:[edx], ch