joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e0379
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.00513869
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e049c
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffb99
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e04b3
push ecx
lea ecx, [esi + 0x24]
call fcn.004ffaa9
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x548609
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xe284730b
call 0x35ceca05
les edx, fs:[edi + esi*8 + 0x4f]
movsb byte es:[edi], byte [esi]
neg byte [eax]
pop ecx
test byte [eax + 0x57d6507d], bh
out dx, eax
iretd
insb byte es:[edi], dx
sbb al, 0xa
fild qword [ebx + 5]
mov word [0x7371df6f], gs
cdq
xor eax, 0x69267d12
jo 0x548578
pop es
dec esp
jbe 0x548664
jbe 0x54865f
dec ebx
idiv eax
mov edi, 0x47b7241e
inc ebx
xor dword [ebx], 0x18d466f3
test eax, 0x2673fe47
invalid
mov al, 0xc3
pop ebp
stosd dword es:[edi], eax
mov edx, 0xa37b5b6c
lahf
fcmovb st(0), st(6)
inc edx
xlatb
mov ah, 0xa3
movsb byte es:[edi], byte [esi]
xchg ecx, eax
adc eax, dword [ebp + 0x23]
pop ebp
loop 0x54865f
sub al, byte [eax - 0x4b3f13e4]
pop ebp
sbb byte [esi + 0x72640d0f], ch
push edi
in eax, 0x80
fldenv [edx + ecx*4 - 0x1c]
xlatb
mov eax, dword [0x5baec796]
rcl dword [edi], cl
adc al, 0x7d
mov ebp, 0x18f40311
sbb byte [esi], al
push ecx
loopne 0x5485d8
invalid
jl 0x5486ce
invalid
push ebp
and eax, 0x25f84564
arpl word [eax + 0x17], cx
loopne 0x5486ca
nop
cmpsb byte [esi], byte es:[edi]
adc dword [edx - 0x3f29ddef], eax
movsb byte es:[edi], byte [esi]
jl 0x5486e0
inc edx
jns 0x548672
mov edx, 0x53a505a0
bound edx, qword [edi + 0x17ae01d6]
xchg ebp, eax
bound esi, qword [0x378061ae]
adc byte [ebp - 0x62], 0x33
mov ebx, 0x65c6b5b4
xchg edi, eax
salc
add dword [esi + 0x35629517], ebp
scasb al, byte es:[edi]
popal
xor byte [edi], 0x80
push ebp
sahf
xor edi, dword [ebx + 0x65c6b5b4]
test ebx, esi
aam 0x90
in eax, 0xf5
test esi, esi
push cs
pushfd
adc al, 0x5f
push edi
dec esi
mov dword [0x35c83614], eax
sahf
aad 0x76
cmpsb byte [esi], byte es:[edi]
jg 0x548684
ror byte [edx], 1
rol dl, 1
in al, 0xc4
jnp 0x548672
or dl, al
ret 0xc4e4
inc eax
aas
push ecx
sbb al, 0x60
out 0xc, eax
sahf
xchg esp, eax
inc edi
inc sp
daa
pop eax
inc esp
lcall 0x8321, 0x761408d7
out dx, al
xchg edi, eax
retf
adc al, 0x76
and dword [ebx - 0x1c346812], eax
push es
ja 0x5486b3
xor byte fs:[eax], cl
sahf
mov dl, 0x1c
and dword [ebp + 0x24], ebp
dec esp
insd dword es:[edi], dx
and al, 0x4c
xchg edx, eax
ficomp word [0x433006a1]
xor eax, 0x74661a7c
in al, 0xb5
mov ah, 0xf6
cmp eax, 0x95d72e56
test al, 0x92
mov bh, 0xd6
scasb al, byte es:[edi]
mov edi, 0x526bd6c4
push edi
push edi
dec edi
sub edx, esp
sbb al, 0xc1
inc ecx
xor al, 0x14
xor esi, dword [eax + esi*8 + 0x25]
mov dl, 0x88
inc ecx
xchg edx, eax
xor byte [edi + 0x12a332d0], 0xbe
invalid

Function at 0x553bd9
Capabilities:
Encode data using xor

Disassembly:
inc esp
and cl, byte [eax - 0x69]
mov al, byte [0x1d4774c7]
dec ecx
lahf
shl byte [ecx], 1
movsd dword es:[edi], dword [esi]
xor ch, dl
loopne 0x553bde
invalid
pop ecx
in al, dx
adc al, 0x78
xchg ebp, eax
xchg edx, eax
mov al, byte [0x88a1e4eb]
into
mov dh, 0x86
push ecx
not ebx
sti
xor eax, 0x6bebe663
arpl word [esi], di
push edi
hlt
Function at 0x5542e9
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x64
jl 0x554286
aam 0x72
inc esi
invalid
jbe 0x55426e
nop
lcall 0xdfd6, 0xee87cc72
sbb dh, al
and eax, 0xc8946b86
mov es, word [eax]
sbb byte [edi - 0x63], cl
imul edx, dword [eax + ecx*8 + 0x4f18008e], 0xffffff9d
cmp dl, byte [ecx - 0xc]
je 0x554203
cmpsb byte [esi], byte es:[edi]
pop esp
mov cl, 0x77
add ah, byte [edi]
dec ecx
invalid
mov esi, 0x57b2e324
push ds
loope 0x5542b3
inc edx
sub eax, 0x7ce011a7
aam 0xb6
arpl sp, ax
mov bh, 0xeb
sbb byte [edi - 0x61], 0x74
mov esp, dword [ebp - 0x1e]
in al, 0x30
ror dword [ebx + 0x663fa747], 1
mov edx, 0x347c34a3
jecxz 0x554265
dec ebp
wait
inc edx
rol dword [esi - 0x545f0975], 1
mov edx, 0xf3d2ec9e
jae 0x554306
jae 0x554306
sbb byte [esi - 0x47abcbab], bl
popal
dec ebp
push ebp
xor al, 0x54
mov eax, 0xd9f04d61
invalid
add eax, 0xda452864
jno 0x5542ca
dec esi
jnp 0x5542c4
jbe 0x554270
dec esi
push ecx
cmp eax, 0xd1cfb6aa
cmp eax, 0xd1cfb6aa
jp 0x554262
xor al, 0x97
bound edi, qword [esi]
adc ebp, 0x70
fldcw word [eax]
push ss
sbb ch, byte [esi]
mov bp, 0xf4b6
jbe 0x5542cc
fcomp qword [ebp - 0x69]
adc eax, 0x9efa3ba5
stosd dword es:[edi], eax
invalid
push edx
xchg esp, eax
pop es
daa
je 0x554351
leave
je 0x554365
out 0x2f, al
dec edx
fadd st(6), st(0)
jp 0x5542be
insb byte es:[edi], dx
loop 0x554375
in al, 0xc9
shr byte [ebp + 0x750718c], 0x11
daa
inc ebp
sti
wait
in al, 0x16
jne 0x55439a
xor eax, dword [eax]
xor dh, byte gs:[ecx + 2]
xchg edi, eax
inc esp
xchg edx, eax
lahf
je 0x5542db
in eax, 0x68
push 0xffffffffffffffaa
hlt
sar dword [ebx - 7], 0x17
test dword [edi - 0x6b], eax
push ss
popfd
mov al, 0x89
hlt
mov ch, 0x96
adc dword [edi - 0x30], 0xffffff96
push ebp
das
outsd dx, dword [esi]
out 0x84, al
push ecx
cwde
cld
xchg ebp, eax
jns 0x5543dd
pop es
pop es
mov edi, 0x41857cfd
mov dh, 0x23
test dword [esi], edi
jbe 0x55438e
push edi
sbb cl, byte [esi - 6]
mov dh, 0xd7
das
inc edx
mov byte [esi + 0x1a], dh
hlt
xchg edi, eax
mov bh, byte [esi - 0x1b]
dec esi
je 0x5543b9
movsb byte es:[edi], byte [esi]
invalid
xor eax, 0xa895bd7f
aad 0x95
mov ebp, 0x95d5a895
jns 0x554398
sub byte [esi + 0x7e], ah
int1
mov edi, 0x1a23c829
ror byte [esi + 0x74], 1
adc eax, ebx
scasd eax, dword es:[edi]
int3
xlatb
xor eax, 0x8be5031c
or ecx, dword [ebp - 0x6afb5155]
and al, 0x48
inc eax
daa
jmp 0x5cde07b6
invalid
Function at 0x55ccc9
Capabilities:
Encode data using xor

Disassembly:
push edi
add al, 0x4e
dec esi
aad 0x51
in eax, dx
pop ecx
adc byte [eax], cl
push es
and dword [esi + esi*4 + 0x1b31f6ed], edi
mov esp, esi
in eax, 0xc0
mov bh, 0xe4
daa
cld
dec ebx
adc eax, 0x58c30075
push es
push ecx
fldcw word [eax]
jnp 0x55ccef
jo 0x55ccf3
xchg dword [edi], eax
jne 0x55cca6
add eax, esp
movsb byte es:[edi], byte [esi]
stc
outsb dx, byte [esi]
jo 0x55cd1d
aaa
movsb byte es:[edi], byte [esi]
jnp 0x55cca4
sbb eax, 0x37e79b2f
push ecx
push es
cmpsb byte [esi], byte es:[edi]
push cs
and dl, byte [esp + edi*8 + 0x36]
inc eax
or eax, 0x5229db55
push edx
cmc
mov byte [0x76d39c65], al
sbb byte [esi - 0x35], 0xf3
mov edi, 0x1293e0f0
das
cmpsd dword [esi], dword es:[edi]
pushfd
xlatb
pop ebp
nop
pop eax
mov ch, 0x16
inc ecx
cmpsd dword [esi], dword es:[edi]
xchg ebp, eax
lodsd eax, dword [esi]
aaa
mov dword [0xbbe3f6d6], ebx
invalid
pushfd
sal dword [esi - 0x7e], cl
pop esi
retf
push esp
mov ch, byte [edi + 0x73]
mov byte fs:[edi], dl
daa
push ss
imul esp, dword [ebx + 0x5a520b4e], 0x2e
jle 0x55cd40
leave
mov al, dh
call 0x7f8ff31e
movsd dword es:[edi], dword [esi]
invalid
daa
popal
jbe 0x55cd77
push edx
and edx, dword [ecx + ebx*8]
aaa
push edx
xor dword [eax - 9], edi
js 0x55cd44
xor eax, 0x81c35df6
mov byte [0x24a46704], al
mov dword gs:[ebx - 0x400609e1], ebp
xchg edi, eax
mov edi, 0x58d1010
jp 0x55cd4b
dec edx
cdq
mov esp, 0x7bf49337
xchg esi, eax
in al, 0xda
test edi, esp
xchg ebx, eax
xlatb
invalid
lodsb al, byte [esi]
or edx, ebp
mov dh, 0x17
cmpsb byte [esi], byte es:[edi]
inc edi
dec edx
mov cl, 0x3e
test dword [edx - 0x2bc547e5], eax
div esi
push 0x6413003e
xchg esi, eax
jae 0x55ce02
jl 0x55ce03
cmc
shl byte [ecx], cl
outsb dx, byte [esi]
invalid
wait
xchg esi, eax
imul cl
or eax, 0x6aa5a7b3
or dword [edx], esi
or bl, dl
daa
lcall 0x9b2b, 0xc6c53789
pop ds
or al, 0x70
jecxz 0x55cd6e
imul eax, esi, 0x15
aam 0x4d
neg dword [edi + 0x12]
mov ebp, 0x26bb8d04
mov edx, esi
sbb eax, 0xe7df8da6
inc edi
pushfd
mov edi, 0xd1d6fdae
insb byte es:[edi], dx
invalid
lea edi, [ebx + 0x1dd68b26]
cmpsb byte [esi], byte es:[edi]
invalid
jbe 0x55cdc8
les edx, [edi - 0x79]
push ebp
xor eax, 0xe3976e3c
push edi
xchg dword [ebp + 0x2e], edx
xor eax, 0xe3976e3c
sub dword fs:[esi - 0x29], eax
jne 0x55ce78
fcomp dword [eax + 0x45]
push esi
pop es
xor ecx, dword [ebx + eax*8]
insd dword es:[edi], dx
cmp dword [ebx + 0xdaeecd7], esi
xchg ebx, eax
wait
aaa
outsd dx, dword [esi]
push edi
sub al, 0x73
cld
jge 0x55cdec
pushal
jne 0x55cdf2
je 0x55cddd
xchg dword [ecx], edx
ret
pop es
test byte [edx + 0x676267c6], dh
push ecx
and eax, 0x44be6e05
sub edx, dword [esi]
push 0x57957065
cmp ah, byte [ebp + 2]
xor al, 0x64
mov cl, 0xf3
nop
mov gs, eax
xlatb
cmc
movsb byte es:[edi], byte [esi]
test al, 0x3f
rol dh, 0x31
xor byte [eax + ebp*2 - 0x28e8f5cc], 0x10
push edi
adc al, 0x94
insb byte es:[edi], dx
inc ecx
add eax, 0x60567012
cmpsb byte [esi], byte es:[edi]
sal ch, cl
aam 0xcc
in al, 0x4d
imul ebp, dword [ebx + 0x667db245], 0x21cc3319
add dword [0x57644e20], esi
and dl, dl
add al, 0xb6
push ebp
idiv dword [esi]
push ss
insb byte es:[edi], dx
invalid
Function at 0x55d0c9
Capabilities:
Encode data using xor

Disassembly:
inc ecx
inc ebx
xor eax, 0x64ce67c7
xchg ebx, eax
into
xchg ebx, eax
push ebp
pushfd
stc
out 0xb, al
and ecx, dword [edx + 0x3767d9ba]
pushal
mov dh, byte [edi]
mov dl, 0x2f
xor eax, 0xf55a484a
lds eax, [edi]
sub al, 0x9b
and al, 0x90
xor al, 0x10
test eax, 0x2499f553
popal
mov ebx, 0xdabd2654
mov ecx, esp
add edx, dword [edi + 0x69a96993]
or eax, 0x19caeb06
jb 0x55d0cd
cmp al, byte [ecx]
pop dword [ecx - 0x26]
stc
call 0x71aab54c
inc esp
sbb ch, byte [edx]
aaa
push ecx
cmp byte [edi], bl
push edi
sbb dword [edi + 0x4b], esp
js 0x55d0ca
cmp dl, byte [edi + eax*8]
mov eax, dword [0xf72b23a8]
lodsd eax, dword [esi]
dec ebx
mov dword [esi + esi*2], ebp
fld xword [ebx + 0x63f94967]
les eax, [ebx - 0x47]
or esi, dword [ebx]
in eax, 0x6b
shr byte [ecx + 0x6b], cl
popal
and al, 0x87
cmp esi, dword [ebx + 0x7a]
adc eax, 0x19d836ed
add al, byte [eax]
mov edi, dword [eax + 0x77]
or byte [ebp - 0x22ee9b7e], al
inc esi
dec edx
movsb byte es:[edi], byte [esi]
pop edx
mov word [eax], ss
mov esi, 0xb789f5eb
sbb edx, dword [ebx - 0x6d1d562a]
jne 0x55d15c
imul ecx, ebx, 2
imul edx, ebp, 0x1f67bf9
out 0xb0, al
and bl, 0x48
cmp esp, dword [esp + 0xd6606ac]
sti
scasd eax, dword es:[edi]
or al, 5
mov ecx, 0xa755b29
les esp, [esi]
push ecx
outsb dx, byte [esi]
or eax, edi
push esp
invalid

Function at 0x5730b9
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a65a9
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5731dc
push ecx
lea ecx, [esi + 0x18]
call int.005928d9
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5731f3
push ecx
lea ecx, [esi + 0x24]
call fcn.005927e9
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x594979
Capabilities:
Encode data using xor

Disassembly:
lcall 0x6dfb, 0x9ab9b2ef
sti
insd dword es:[edi], dx
mov byte [0x84391e1b], al
xor dword [edi - 0x7b84200b], edi
pop ecx
scasb al, byte es:[edi]
push ds
adc cl, bl
cmc
jp 0x594919
and eax, edx
and dl, byte [ecx]
sub dword [ebx], esp
nop
push edi
cmp bh, byte [ecx - 0x46]
jl 0x594981
dec esi
cmpsb byte [esi], byte es:[edi]
dec ecx
imul ecx, dword [edi + 0x1a], 0x51
or byte [0xa1268d77], bl
xor byte [edx + ebx*8 + 0x62f59edf], ah
clc
salc
mov ss, word [ebp + 0x71f4a92]
xchg esi, eax
or esp, edx
mov bl, 0x5d
cmp ebx, esp
stosd dword es:[edi], eax
mov bh, 0x6b
invalid
jbe 0x59491e
invalid
fcomp dword [ebp - 0x3e]
push ecx
ret 0x1926

Function at 0x5bd2b9
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005f07a9
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bd3dc
push ecx
lea ecx, [esi + 0x18]
call fcn.005dcad9
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bd3f3
push ecx
lea ecx, [esi + 0x24]
call fcn.005dc9e9
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x606949
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00639e39
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x606a6c
push ecx
lea ecx, [esi + 0x18]
call fcn.00626169
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x606a83
push ecx
lea ecx, [esi + 0x24]
call fcn.00626079
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x64d9dd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6563a8
cmp edx, dword [eax]
je 0x64d9ff
add eax, 8
inc ecx
cmp eax, 0x656438
jl 0x64d9f0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6563a8]
jne 0x64db2d
mov eax, dword [0xa59d00]
cmp eax, 1
je 0x64db07
test eax, eax
jne 0x64da30
cmp dword [0x6562d4], 1
je 0x64db07
cmp edx, 0xfc
je 0x64db2d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64da67
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064e3c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064e850
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64daaa
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064e850
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x652b4c
push edi
call fcn.00650720
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064e3c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064e3d0
lea eax, [ebp - 0xa0]
push 0x652b2c
push eax
call fcn.0064e3d0
push dword [esi + 0x6563ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064e3d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00650694
add esp, 0x2c
pop edi
jmp 0x64db2d
lea eax, [ebp + 8]
lea esi, [esi + 0x6563ac]
push 0
push eax
push dword [esi]
call fcn.0064e850
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10003626
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x10041024]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
mov ebx, dword [esp + 0x124]
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [edi + 4]
or eax, 0x2001f
push eax
push ebx
push dword [edi]
call fcn.1002668d
mov esi, eax
test esi, esi
jne 0x100036d5
lea eax, [esp + 0x20]
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x100036b0
lea eax, [esp + 0x28]
push eax
call fcn.10003626
mov esi, eax
test esi, esi
jne 0x100036d5
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x30]
mov dword [esp + 0x30], 0x100
call ebp
lea ecx, [esp + 0x14]
test eax, eax
je 0x1000368b
call fcn.10002ded
push ebx
mov ecx, edi
call fcn.10002e76
mov esi, eax
lea ecx, [esp + 0x14]
call fcn.10002ded
mov ecx, dword [esp + 0x128]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000be90
add esp, 0x11c
ret 4
Function at 0x10005a24
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x974
mov eax, dword [0x10041024]
xor eax, esp
mov dword [esp + 0x970], eax
push ebx
push ebp
xor ebp, ebp
mov ebx, 0x400
push esi
mov esi, dword [esp + 0x99c]
inc ebp
push edi
mov edi, dword [esp + 0x988]
test esi, esi
jne 0x10005a7b
push ebx
lea eax, [esp + 0x584]
push eax
push ebp
push edi
call fcn.10008e4e
add esp, 0x10
test eax, eax
je 0x10005a7b
mov eax, str._s_ssvagent.exe
lea esi, [esp + 0x580]
jmp 0x10005a90
test edi, edi
jne 0x10005be0
test esi, esi
je 0x10005be0
mov eax, str._s_bin_ssvagent.exe
push esi
push eax
lea eax, [esp + 0x188]
push ebx
push eax
call fcn.10004e7f
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x194]
push eax
call fcn.1002668d
add esp, 0x18
test eax, eax
jne 0x10005be0
cmp dword [esp + 0x98c], 0
mov ecx, str.__new
mov byte [esp + 0x7c], al
mov ebx, 0x104
mov eax, str.__old
cmovne eax, ecx
push eax
lea eax, [esp + 0x80]
push ebx
push eax
call fcn.1002668d
mov edi, dword [esp + 0x99c]
add esp, 0xc
mov esi, dword [esp + 0x99c]
test edi, edi
jne 0x10005b03
test esi, esi
je 0x10005b19
push str.__high
lea eax, [esp + 0x80]
push ebx
push eax
call fcn.1002668d
add esp, 0xc
cmp dword [esp + 0x998], 0
je 0x10005b39
push str.__settreatas
lea eax, [esp + 0x80]
push ebx
push eax
call fcn.1002668d
add esp, 0xc
test esi, esi
je 0x10005b53
push str.__regdeploy
lea eax, [esp + 0x80]
push ebx
push eax
call fcn.1002668d
add esp, 0xc
push 0x3c
pop esi
push esi
lea eax, [esp + 0x14]
push 0
push eax
call fcn.1000de50
add esp, 0xc
mov dword [esp + 0x10], esi
lea eax, [esp + 0x7c]
mov dword [esp + 0x24], eax
test edi, edi
je 0x10005b8b
call fcn.1002668d
test eax, eax
mov ecx, str.runas
cmove ecx, dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x994], 0
push 0x40
pop ecx
cmovne eax, ecx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x14], eax
lea eax, [esp + 0x180]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x10005be0
cmp dword [esp + 0x48], 0
je 0x10005bdc
push 0xffffffffffffffff
push dword [esp + 0x4c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [esp + 0x48]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, ebp
jmp 0x10005be2
xor eax, eax
mov ecx, dword [esp + 0x980]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000be90
add esp, 0x974
ret
Function at 0x10005d98
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x948
mov eax, dword [0x10041024]
xor eax, esp
mov dword [esp + 0x944], eax
push ebx
push ebp
mov ebp, dword [esp + 0x954]
lea eax, [esp + 0x14c]
push esi
push edi
push 0x400
push 0
push eax
call fcn.1000de50
mov ebx, dword [esp + 0x1c]
add esp, 0xc
xor esi, esi
mov edi, section..data
test esi, esi
jne 0x10005ebe
push ebp
mov ebx, 0x400
mov byte [esp + 0x558], 0
lea eax, [esp + 0x558]
push ebx
push eax
call fcn.1002668d
push 0x100315c4
lea eax, [esp + 0x564]
push ebx
push eax
call fcn.1002668d
push dword [edi]
lea eax, [esp + 0x570]
push ebx
push eax
call fcn.1002668d
add esp, 0x24
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x558]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10005eaf
push ebp
lea eax, [esp + 0x158]
mov byte [esp + 0x158], 0
push 0x400
push eax
call fcn.1002668d
push 0x100315c8
lea eax, [esp + 0x164]
push 0x400
push eax
call fcn.1002668d
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x170]
push 0x400
push eax
call fcn.1002668d
lea eax, [esp + 0x178]
push eax
call fcn.10009086
add esp, 0x28
test eax, eax
je 0x10005eac
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x10005e3d
jmp 0x10005eaf
xor esi, esi
inc esi
add edi, 4
cmp edi, 0x1004100c
jl 0x10005dd9
push ebx
call dword [sym.imp.kernel32.dll_FindClose]
mov ecx, dword [esp + 0x954]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000be90
add esp, 0x948
ret