joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51d545
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.0056f110
call fcn.0041e292
cmp dword [eax + 0x14], 0
jne 0x51d560
mov ecx, esi
pop esi
jmp fcn.0051c964
pop esi
ret

Function at 0x546625
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push edi
mov edi, ecx
jne 0x546635
xor eax, eax
jmp 0x5466aa
cmp dword [ebp + 0xc], 0
je 0x546631
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x54664e
call fcn.0041e23e
mov eax, dword [eax + 0xc]
test eax, eax
je 0x546631
push esi
push dword [ebp + 0xc]
mov dword [edi + 8], eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x546676
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x54667a
xor eax, eax
jmp 0x5466a9
push ebx
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x5466a8
push dword [ebp + 0xc]
mov esi, dword [edi]
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, edi
call dword [esi + 4]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x56ccc9
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00440e0b
call fcn.0041e292
cmp dword [eax + 0x14], 0
jne 0x56cce4
mov ecx, esi
pop esi
jmp fcn.0056c5a2
pop esi
ret

Function at 0x57b17c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.0058c120
mov eax, dword [ebp + 8]
and dword [ebp - 0x34], 0
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
add esp, 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
leave
ret 0x14
Function at 0x5a60d0
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x64be40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00595364
mov dword [ebp - 0x14], eax
cmp dword [0x65398c], edi
jne 0x5a61c1
push 0x800
push edi
push 0x60bcd0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x5a614e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x5a62a1
push 0x60bcd0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x5a62a1
push 0x60bce8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5a62a1
push eax
call ebx
push 0x60bcf4
push esi
mov dword [0x65398c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x60bd04
push esi
mov dword [0x653990], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x653994], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x65399c], eax
test eax, eax
je 0x5a61be
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x653998], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x5a61e6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5a61d9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x5a61fb
push 4
pop eax
jmp 0x5a62a3
cmp dword [ebp - 0x14], edi
je 0x5a61fb
push dword [0x65398c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x5a61e0
mov eax, dword [0x653998]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x5a6259
cmp dword [0x65399c], esi
je 0x5a6259
push eax
call ebx
push dword [0x65399c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x5a6259
test eax, eax
je 0x5a6259
call ecx
test eax, eax
je 0x5a624e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x5a624e
test byte [ebp - 8], 1
jne 0x5a6259
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x5a6289
mov eax, dword [0x653990]
cmp eax, esi
je 0x5a6286
push eax
call ebx
test eax, eax
je 0x5a6286
call eax
mov edi, eax
test edi, edi
je 0x5a6286
mov eax, dword [0x653994]
cmp eax, esi
je 0x5a6286
push eax
call ebx
test eax, eax
je 0x5a6286
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x65398c]
call ebx
test eax, eax
je 0x5a62a1
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x5a62a3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058a242
leave
ret
Function at 0x5b1acf
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00594596
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x5b1b07
xor eax, eax
jmp 0x5b1b33
cmp esi, dword [ebp - 4]
je 0x5b1b30
cmp dword [ebp + 0xc], 0
je 0x5b1b30
push dword [edi + 0x9c]
call fcn.005b16dd
push dword [edi + 0x9c]
mov esi, eax
call fcn.0058b673
pop ecx
pop ecx
cmp esi, eax
je 0x5b1b03
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1002aaee
pop dword [ebp - 0x28]
mov eax, 0xf924e799
sub eax, 0xe9223cab
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x40a193ff
sub dword [ebp - 0x38], 0xf24f4eb4
mov dword [ebp - 0x34], 0xde42b3e6
sub dword [ebp - 0x34], 0xac0f67a1
mov dword [ebp - 0x30], 0xf7907d9c
add dword [ebp - 0x30], 0x54bbc692
mov dword [ebp - 0x2c], 0x8c9df920
sub dword [ebp - 0x2c], 0x8c9df920
lea eax, [ebp - 0x38]
push eax
mov eax, 0xbe75bec
sub eax, 0xfbe49bb4
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xf6cf8c40
add dword [ebp - 0x38], 0x7da2dd16
mov dword [ebp - 0x34], 0x34d21c27
sub dword [ebp - 0x34], 0xf365bab2
mov dword [ebp - 0x30], 0xb34fc856
sub dword [ebp - 0x30], 0x4fe05bea
mov dword [ebp - 0x2c], 0x1c03df24
add dword [ebp - 0x2c], 0xe3fc20dc
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x57ed75e8
sub eax, 0x47eab5c0
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x32ee4
push 0
call eax
mov ecx, 0xc4a4da60
add ecx, 0x3b5b5f7a
xor esi, esi
add esi, eax
mov edi, 0x10039600
add edi, dword [ebp - 0x28]
mov edx, 0xb4ea725f
mov dword [ebp - 0x1c], 0x58ec8260
mov ebx, dword [edi]
xor dword [ebp - 0x1c], edx
add ebx, edx
sub dword [ebp - 0x10], ecx
mov dword [esi], ebx
xor dword [ebp - 8], 0x32394e4f
add esi, 0x2282d243
add esi, 0xdd7d2dc1
add edi, 0x5a3eee03
add edi, 0xa5c11201
loop 0x1002ac06
add eax, 0xda3b
mov ebx, eax
add eax, 0x4ee1640a
add eax, 0xb11e9bfb
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x40482a
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437d1a
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x40494d
push ecx
lea ecx, [esi + 0x18]
call fcn.0042404a
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x404964
push ecx
lea ecx, [esi + 0x24]
call fcn.00423f5a
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44a210
Capabilities:
Accept command line arguments
Link many functions at runtime

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
push edi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.Kernel32
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x44a2d8
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateToolhelp32Snapshot
push edi
call ebx
push str.Thread32First
push edi
mov dword [esi + 4], eax
call ebx
mov dword [esi + 8], eax
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push str.Thread32Next
push edi
mov ebp, eax
call ebx
push str.Module32FirstW
push edi
mov dword [esi + 0xc], eax
call ebx
push str.Module32NextW
push edi
mov dword [esi + 0x10], eax
call ebx
mov ecx, dword [esi + 4]
mov dword [esi + 0x14], eax
test ecx, ecx
je 0x44a2c7
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44a2c7
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x44a2c7
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x44a2c7
test eax, eax
je 0x44a2c7
push edi
mov dword [esi], 1
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebx, ebx
jmp 0x44a2dc
mov ebp, dword [esp + 0x14]
cmp ebp, ebx
je 0x44a2f2
mov ecx, dword [0x659abc]
push 0x6597d8
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x46c91f
Capabilities:
Encode data using xor

Disassembly:
and byte [ebp - 0x3b], cl
push ds
mov ch, 0xb2
aad 0x60
mov eax, 0x4393ef2d
xor dword [ebx - 0x2c284f7d], edx
ror ch, 0xe6
and al, 0x1d
dec ebx
rcr byte [ebp - 0x28265d62], 1
packsswb mm1, qword [edi - 0x49]
and ecx, edx
insd dword es:[edi], dx
jl 0x46c923
cmpsd dword [esi], dword es:[edi]
mov esi, dword [ebx]
pop es
push 0xfffffffffffffff1
invalid
Function at 0x496f2a
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca41a
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x49704d
push ecx
lea ecx, [esi + 0x18]
call fcn.004b674a
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x497064
push ecx
lea ecx, [esi + 0x24]
call fcn.004b665a
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x50177a
Capabilities:
Encode data using xor

Disassembly:
add al, 0xcd
rol byte ss:[ecx], 1
xor byte [ecx + 0x6a16643a], bl
cdq
cmp ah, byte [esi + edx + 0x6a]
les esp, ss:[ebx - 0x5f]
xchg ebp, eax
inc ebp
mov al, byte [0x494c66f5]
js 0x50175b
or ch, byte [edi + esi*2 - 0x17]
or edx, dword [esi + 0x7a]
push esi
jp 0x501778
jmp 0xfbca6d88
push esi
jp 0x501778
test cl, 0xff
mov dh, 0x2e
jae 0x501761
xchg edi, eax
daa
int3

Function at 0x50ad2a
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
cmc
and dh, byte [ecx - 0x64]
in al, dx
push ecx
ret
push eax
xchg esi, eax
and byte [ecx], ch
js 0x50ac97
mov byte [edx + 0xe], 0xfc
aaa
push cs
xchg ebp, eax
ret
jp 0x50acf7
aaa
and edx, dword [esi + 0xf]
invalid
Function at 0x512fba
Capabilities:
Encode data using xor

Disassembly:
fdiv st(6)
inc esi
invalid
mov al, byte [0x95d7c128]
sub dword [ebx - 0x30f53bda], esp
js 0x512f1e
not eax
pop eax
adc eax, 0x91970a58
dec ebx
into
aad 0x6f
mov al, 0xc3
xchg ebx, eax
mov ch, 0x6a
mov dl, 0xd7
and ch, al
mov ch, 0x8c
xor al, 0x56
clc
retf 0xe4f3
sbb dword [esi + 0x5731863c], ebx
push es
cmp esp, dword [ecx + 0x16]
push ss
push ss
ja 0x512f97
test byte [edi + esi - 0x35], bh
in eax, dx
sbb ebp, 0xdab2410a
in eax, dx
pushal
mov dh, 0x4d
push 0xffffffffffffffd4
pop ecx
xchg esi, eax
loope 0x512fb1
je 0x512f78
insd dword es:[edi], dx
mov eax, 0x14039bf3
sti
lodsd eax, dword [esi]
push esi
inc edx
sub byte [eax], dh
in al, dx
loop 0x512fe9
call esi
loopne 0x513028
sub ah, byte [eax]
xchg ebx, eax
aaa
insd dword es:[edi], dx
lahf
mov byte fs:[edi + eax*8], dh
stosb byte es:[edi], al
jmp 0x513051
cdq
repne lodsb al, byte [esi]
insd dword es:[edi], dx
inc esi
lds edx, [edi - 0x7f]
xchg esi, eax
and bh, byte [ebp + 0x32]
loope 0x51307a
invalid
adc edi, edx
jg 0x513076
inc ebp
add dword [edx - 0x4a], 0x2e
invalid
push esi
fsub dword [esi - 0x22]
std
mov ah, 0x54
inc ebx
mov byte es:[edx], 0x14
invalid

Function at 0x5139aa
Capabilities:
Encode data using xor

Disassembly:
adc byte [esi], dh
add byte [esi + 0x35], ch
sub al, 0xfe
cmp dword [ebp - 0x15788b48], ebp
sbb al, 0x78
sbb dword [ebx + 0x657487cd], ebp
invalid
fldenv [esp + eax - 0x4764f6d]
pop ebx
mov byte [0x9f8547b1], al
movsd dword es:[edi], dword [esi]
dec edi
push edi
loope 0x51397d
dec ebx
add dh, cl
sar byte [ebx - 0xb], 1
invalid
Function at 0x529aba
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055cfaa
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529bdd
push ecx
lea ecx, [esi + 0x18]
call fcn.005492da
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529bf4
push ecx
lea ecx, [esi + 0x24]
call fcn.005491ea
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5381da
Capabilities:
Encode data using xor

Disassembly:
xor byte [ebx], cl
cmpsb byte [esi], byte es:[edi]
xor eax, 0xdba81f56
sbb ah, byte [edi + 0x2e]
mov dl, 0x34
jb 0x5381d5
mov eax, 0xc2dc5a93
idiv dword [ebx - 0x45]
std
scasb al, byte es:[edi]
sbb cl, byte [edi + 0x7c]
mov bl, 0xf7
jbe 0x5381d2
inc ebp
pushfd
inc esi
push ecx
sub dword [ebx - 0x2347d2c6], ebp
in al, 0xfd
stosb byte es:[edi], al
sub dl, byte [edi + 0x4a9a7ab9]
scasb al, byte es:[edi]
lcall 0xf85, 0x3b9cd692
push ebx
rcl dword [eax]
pop ss
xor al, 0xdc
leave
imul eax, dword [edx], 0x5e
lsl edi, word [edi + 0x397150ce]
sti
invalid

Function at 0x54847f
Capabilities:
Encode data using xor

Disassembly:
ret 0xc49
invalid
sub ch, byte [0x920273ff]
test al, 0x1a
sbb edx, dword [ebp + 0x1d]
neg dword [edi - 0x2b6ce882]
inc esi
jecxz 0x54850f
xor ecx, edi
sub ah, cl
out 0xde, al
js 0x5484a9
cmpsb byte [esi], byte es:[edi]
sahf
push esi
idiv byte [bp + si - 0x57d2]
loopne 0x54843a
dec esp
clc
xor eax, 0x3079977e
jle 0x548442
jns 0x5484dd
scasd eax, dword es:[edi]
cli
mov esi, 0x51280efd
dec ebx
lds ebp, [edx]
sti
adc byte es:[0xb1096e3a], dl
adc byte [0xb1096e3a], dl
sub dh, byte [esi - 0x3a5f9672]
mov al, byte [ecx + 0x4d54f430]
inc ebx
loopne 0x54849b
dec esi
int3
aam 0xc5
pop ss
fld xword [ebx - 0x451ea5eb]
jmp 0x5484bb
int3
Function at 0x5730ca
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a65ba
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5731ed
push ecx
lea ecx, [esi + 0x18]
call fcn.005928ea
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x573204
push ecx
lea ecx, [esi + 0x24]
call fcn.005927fa
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x59d90a
Capabilities:
Encode data using xor

Disassembly:
xchg byte [ebp - 0xcabd718], ch
sbb dword [ecx + 0x3b], ebp
insd dword es:[edi], dx
add byte [edx + 8], bh
inc eax
or ah, byte [edx]
add byte [ebp + 0x71], 0x6c
inc ebp
jno 0x59d8a8
popal
xor dword [edi - 0x623370e], eax
fdiv st(1), st(0)
stc
or dword [ecx - 0xe126e1c], edx
lcall 0x5ac1, 0xc316e5f0
xor ebx, dword [esi - 0x2c]
jp 0x59d828
fcmove st(0), st(7)
push esp
adc al, 0x17
fst dword [eax + edx*8 + 0x3454270a]
loope 0x59d8a7
stc
pop es
or ch, dl
mov ebp, 0x18cd8e94
xlatb
test eax, 0x7331ad4f
cmp bl, byte [esi + 0x10]
lodsd eax, dword [esi]
xor dword [ebx + 0x3a], esi
pop esi
adc cl, dh
int1
mov cl, 0xdd
jb 0x59d842
pop ax
leave
jge 0x59d841
xor esi, dword [edi + 0x7e97a154]
pop edi
pop ss
mov bh, 0x54
mov eax, dword [0x175f7e97]
and eax, 0x805e00e0
cmp dword [esi + 0x5a604231], esp
jo 0x59d875
add dh, byte [ecx + 0x5913e493]
imul ebx, dword [ebx], 0x21
and dl, al
aad 0xbf
mov byte [eax - 0x6de05788], dh
xchg esp, eax
jae 0x59d839
out dx, al
or dh, byte [ecx - 0x17]
in eax, dx
sal dword [esp + ebx*2], 1
mov dword [ebp - 0x12], ebx
cmp eax, 0x8df5ff9f
push ebp
cmp edi, ebp
xor byte [eax + 0x3a], al
xor dword [ebp + 9], edi
jns 0x59d880
ljmp 0xadf9:0xc265e891
cli
arpl word [ecx], bp
por mm4, mm0
push cs
jecxz 0x59d86f
sbb byte [ecx], 0x83
sub ebp, dword [ebp + edx*4 + 0x401b0537]
inc eax
pop esp
or dword [edi - 0x43727dd6], 0xffffffb5
enter 0x6177, 0xffffffffffffffec
jno 0x59d8f9
invalid
sub al, 0xa5
movsd dword es:[edi], dword [esi]
rcl dword [eax]
loope 0x59d936
add byte [ebx], ah
ror edi, 1
or byte [ecx + 0x7d], 0x72
rol byte [edx + 0x413b18a1], 1
loope 0x59d98f
or ebp, ecx
inc edi
inc ebp
jecxz 0x59d945
jnp 0x59d8e3
mov dword [ebp - 0x68], ecx
invalid
mov ebx, 0x3eae777d
push esp
jg 0x59d907
invalid
dec ebp
xchg edx, eax
add edx, dword [edi + 0x7493f0c7]
aad 0xf6
sbb dword [ebp - 0x67], ebp
and byte [0xa5001f59], ch
sub bl, bl
adc eax, 0x41a8bf79
popfd
daa
push es
mov eax, dword [0x88c18333]
mov dl, 0xa1
mov eax, gs
sbb eax, 0x9d43add5
ror dword [eax - 0x17735e4e], 0x1d
aad 0xad
inc ebx
popfd
salc
js 0x59d999
add eax, 0xed9d9d29
dec dword [ecx + 0xe]
pop ss
jg 0x59d965
int3
lodsd eax, dword [esi]
cmp ah, byte [eax - 0x17a9b6cd]
add al, 0xb5
push 0xffffffffffffff92
xchg edx, eax
xor ebx, edx
loope 0x59d9bf
push 0x31
popal
cmp ch, ah
out 0xbd, eax
fnstcw word [ebx + 0x28]
xor bl, byte [eax + 0x2344cdd0]
shl byte [ebp + 0xc225c30], 1
int 0x44
and edx, eax
movsd dword es:[edi], dword [esi]
xor byte [edx + 0xc], bl
aad 0x1c
push ss
sub ch, ah
push ss
jp 0x59d9ab
adc byte [esi], dl
push eax
aam 0x42
inc ebx
add al, byte [edi + edi*4 - 0x6eda7c2d]
add al, 0xe9
in eax, dx
lodsd eax, dword [esi]
out dx, eax
cmpsb byte [esi], byte es:[edi]
cmp eax, 0x617615c1
jbe 0x59da49
pushfd
jp 0x59d97b
retf 0x15a9
and dword [ebx], ebp
pop eax
sub ebp, edi
sub ch, byte [edi + 0x43]
mov word [edi - 0x6e1acd41], es
mov ah, 0x7b
pop edx
or ecx, dword [ecx + 0x31017fd6]
mov al, byte [0xc0e7225a]
out 0xc0, eax
out 0x80, eax
push esp
jne 0x59da63