joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f970
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc10
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov ebx, edx
mov edx, dword [ebp + 0x10]
add edx, eax
mov dword [ebp - 0xc0c], edx
mov dword [ebp - 0xc08], 0
cmp ebx, dword [ebp - 0xc0c]
jae 0x40fa22
lea eax, [ebp - 0x404]
cmp word [ebx], 0xa
jne 0x40f9b9
mov word [eax], 0xd
add eax, 2
add eax, 2
add ebx, 2
mov dx, word [ebx - 2]
mov word [eax - 2], dx
lea edx, [ebp - 6]
cmp eax, edx
jae 0x40f9d6
cmp ebx, dword [ebp - 0xc0c]
jb 0x40f9ab
push 0
push 0
push 0x800
lea edx, [ebp - 0xc04]
push edx
lea edx, [ebp - 0x404]
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x404]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x40fa2e
lea esi, [ebp + eax - 0xc04]
lea eax, [ebp - 0xc04]
cmp esi, eax
jbe 0x40fa87
lea edi, [ebp - 0xc04]
jmp 0x40fa60
mov dword [ebp - 0xc10], 0
jmp 0x40fa3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc08]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc10]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
jmp 0x40faca
push dword [ebp + 0xc]
call fcn.0040ff30
pop ecx
push 0
lea edx, [ebp - 4]
push edx
mov edx, esi
sub edx, edi
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40faa6
add edi, dword [ebp - 4]
cmp edi, esi
jb 0x40fa60
mov eax, ebx
sub eax, dword [ebp + 0x10]
mov dword [ebp - 0xc08], eax
add ebx, 2
cmp ebx, dword [ebp - 0xc0c]
jb 0x40f9a5
jmp 0x40fa22
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc08]
mov dword [edx], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410360
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
add edx, eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0xc]
mov edi, eax
mov ebx, edi
cmp ebx, dword [ebp - 0xc]
jae 0x4104a1
cmp byte [ebx], 0x1a
je 0x41044c
cmp byte [ebx], 0xd
jne 0x4103af
lea eax, [ebx + 1]
cmp eax, dword [ebp - 0xc]
jae 0x4103bc
cmp byte [ebx + 1], 0xa
jne 0x4103af
mov byte [edi], 0xa
inc edi
add ebx, 2
jmp 0x410498
inc edi
inc ebx
mov al, byte [ebx - 1]
mov byte [edi - 1], al
jmp 0x410498
inc ebx
push esi
call fcn.0040ff30
pop ecx
push 0
lea edx, [ebp - 8]
push edx
push 1
lea edx, [ebp - 1]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4104bd
cmp dword [ebp - 8], 0
je 0x4104bd
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x4252c4]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
test byte [eax + edx + 4], 0x48
je 0x41043c
cmp byte [ebp - 1], 0xa
je 0x410447
mov byte [edi], 0xd
inc edi
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x4252c4]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
mov cl, byte [ebp - 1]
mov byte [eax + edx + 6], cl
jmp 0x410498
inc edi
jmp 0x410498
cmp byte [ebp - 1], 0xa
jne 0x4104a8
cmp edi, dword [ebp + 0xc]
jne 0x4104a8
mov byte [edi], 0xa
jmp 0x410439
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x4252c4]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
test byte [eax + edx + 4], 0x40
jne 0x410490
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x4252c4]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
or byte [eax + edx + 4], 2
jmp 0x4104a1
inc edi
mov al, byte [ebx]
mov byte [edi - 1], al
jmp 0x4104a1
cmp ebx, dword [ebp - 0xc]
jb 0x410387
mov eax, edi
sub eax, dword [ebp + 0xc]
jmp 0x4104c5
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
call fcn.00410250
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x410498
mov byte [edi], 0xd
jmp 0x410439
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4104d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
add edx, eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0xc]
mov edi, eax
mov ebx, edi
cmp ebx, dword [ebp - 0xc]
jae 0x410654
cmp word [ebx], 0x1a
je 0x4105fb
cmp word [ebx], 0xd
jne 0x410526
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x410539
cmp word [ebx + 2], 0xa
jne 0x410526
mov word [edi], 0xa
add edi, 2
add ebx, 4
jmp 0x41064b
add edi, 2
add ebx, 2
mov ax, word [ebx - 2]
mov word [edi - 2], ax
jmp 0x41064b
add ebx, 2
push esi
call fcn.0040ff30
pop ecx
push 0
lea edx, [ebp - 8]
push edx
push 2
lea edx, [ebp - 2]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x410674
cmp dword [ebp - 8], 0
je 0x410674
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x4252c4]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
test byte [eax + edx + 4], 0x48
je 0x4105e8
cmp word [ebp - 2], 0xa
je 0x4105f4
mov word [edi], 0xd
add edi, 2
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x4252c4]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
mov cl, byte [ebp - 2]
mov byte [eax + edx + 6], cl
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x4252c4]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
movzx ecx, word [ebp - 2]
sar ecx, 8
mov byte [eax + edx + 7], cl
jmp 0x41064b
add edi, 2
jmp 0x41064b
cmp word [ebp - 2], 0xa
jne 0x41065b
cmp edi, dword [ebp + 0xc]
jne 0x41065b
mov word [edi], 0xa
jmp 0x4105e3
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x4252c4]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
test byte [eax + edx + 4], 0x40
jne 0x41063f
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x4252c4]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
or byte [eax + edx + 4], 2
jmp 0x410654
add edi, 2
mov ax, word [ebx]
mov word [edi - 2], ax
jmp 0x410654
cmp ebx, dword [ebp - 0xc]
jb 0x4104f7
mov eax, edi
sub eax, dword [ebp + 0xc]
jmp 0x41067e
push 1
push 0xffffffffffffffff
push 0xfffffffe
push esi
call fcn.00410250
add esp, 0x10
cmp word [ebp - 2], 0xa
je 0x41064b
mov word [edi], 0xd
jmp 0x4105e3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410770
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x4252c4]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
test byte [eax + edx + 4], 0x48
jne 0x4107ad
mov dword [ebp - 8], 0
jmp 0x4107c1
push ebx
push edi
push esi
call fcn.00410710
add esp, 0xc
mov edx, eax
mov dword [ebp - 8], edx
add edi, eax
sub ebx, eax
push esi
call fcn.0040ff30
pop ecx
push 0
lea edx, [ebp - 4]
push edx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4107e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4107eb
mov edx, dword [ebp - 4]
add dword [ebp - 8], edx
xor eax, eax
mov edx, dword [ebp - 8]
xchg edx, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413080
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4252c0]
cmp dword [ebp + 8], eax
jae 0x413173
mov eax, dword [ebp + 8]
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x4252c4]
mov edx, dword [ebp + 8]
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
test byte [eax + edx + 4], 1
je 0x413173
push 1
push 0
push 0
push dword [ebp + 8]
call fcn.00410250
add esp, 0x10
mov esi, eax
mov edi, edx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
cmp edx, 0xffffffff
jne 0x4130e8
cmp eax, 0xffffffff
je 0x41317d
push 2
push 0
push 0
push dword [ebp + 8]
call fcn.00410250
add esp, 0x10
cmp edx, 0xffffffff
jne 0x413103
cmp eax, 0xffffffff
je 0x41317d
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
sub esi, eax
sbb edi, edx
test edi, edi
jg 0x413185
jl 0x413117
test esi, esi
ja 0x413185
test edi, edi
jg 0x413213
jl 0x413129
test esi, esi
jae 0x413213
push 0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push edx
push eax
push dword [ebp + 8]
call fcn.00410250
add esp, 0x10
cmp edx, 0xffffffff
jne 0x41314c
cmp eax, 0xffffffff
je 0x41320e
push dword [ebp + 8]
call fcn.0040ff30
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x413213
mov dword [0x4250b4], 0xd
jmp 0x41320e
mov dword [0x4250b4], 9
or eax, 0xffffffff
jmp 0x41322c
push 0x1000
push 1
call fcn.00411080
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x41320e
push 0x8000
push dword [ebp + 8]
call fcn.004132d0
add esp, 8
mov dword [ebp - 0xc], eax
test edi, edi
jl 0x4131c2
jg 0x4131bb
cmp esi, 0x1000
jb 0x4131c2
mov eax, 0x1000
jmp 0x4131c4
mov eax, esi
push eax
push ebx
push dword [ebp + 8]
call fcn.0040fb40
add esp, 0xc
cmp eax, 0xffffffff
je 0x4131f4
cdq
neg eax
adc edx, 0
neg edx
add eax, esi
adc edx, edi
mov esi, eax
mov edi, edx
test edx, edx
jg 0x4131ad
jl 0x4131f0
test eax, eax
ja 0x4131ad
xor esi, esi
jmp 0x4131f7
or esi, 0xffffffff
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.004132d0
add esp, 8
push ebx
call fcn.0040c9e0
pop ecx
jmp 0x413215
or esi, 0xffffffff
jmp 0x413215
xor esi, esi
push 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
push edx
push eax
push dword [ebp + 8]
call fcn.00410250
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404734
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437c24
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x404857
push ecx
lea ecx, [esi + 0x18]
call fcn.00423f54
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x40486e
push ecx
lea ecx, [esi + 0x24]
call fcn.00423e64
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4374a4
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov byte [ebx + 0x7e], ch
xlatb
daa
test al, 0x53
or bh, byte [edi + 0x1b]
invalid

Function at 0x437774
Capabilities:
Encode data using xor

Disassembly:
imul ebx, dword [ecx + 0x60], 0x6cfb79bf
salc
cmpsd dword [esi], dword es:[edi]
cdq
sub al, 0x1f
sub bl, bl
xlatb
sub eax, 0xd91e3c18
inc edi
push 0xacd09b28
lodsb al, byte [esi]
jg 0x437738
scasd eax, dword es:[edi]
das
mov esi, dword es:[esi + 0x2c8e784e]
sal dword [eax - 0x6a], 0x19
jnp 0x437759
sub al, 0xc1
jo 0x4376d2
sbb dword [ebx + 0x1a], edi
jmp 0x4376ec
imul eax, dword [ecx - 0x40], 0x5a
add ebx, edi
test eax, 0x26ee2d62
and byte [ecx + 0x5b8b2e6f], ch
push esi
pop eax
xlatb
adc dword [esi + 0x21], ebx
inc byte [edi]
jecxz 0x4377b6
std
sbb al, 0x28
lea ebp, [edx]
out dx, eax
jns 0x43772f
mov dl, 0x41
mov edi, 0x1c9a5f24
adc bh, ah
jmp 0x7a0a3fc8
dec dword es:[eax - 0x45]
cmp bh, cl
cmp byte [esi + 0x2ed93f99], cl
fcom qword [esi]
das
and dword [ecx + ebp*8 + 0x5efa0f8d], esp
in eax, 0x49
shl dword [edi - 0x69b71694], cl
jnp 0x437742
mov ecx, 0x29b9561d
iretd
push ecx
pushal
jge 0x437794
add dword [eax + 0x76edb5aa], edx
mov ecx, 0xe91acc22
dec edx
xchg ebx, eax
dec edx
xchg edx, eax
add ecx, dword [eax]
retf 0xb176
Function at 0x44a210
Capabilities:
Accept command line arguments
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov edi, eax
mov dword [esi], 0
call ebx
test ax, ax
jge 0x44a23b
or dword [esi], 0x2000000
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x11
mov edi, eax
call ebx
test ax, ax
jge 0x44a258
or dword [esi], 0x4000000
test edi, edi
je 0x44a26e
mov ecx, dword [0x659a4c]
push 0x659768
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0x12
call ebx
test ax, ax
jge 0x44a27d
or dword [esi], 0x8000000
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x44d624
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x44d68b
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x44d6a8
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x44d711
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004965f4
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x44d6e4
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x44d6d4
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x44d70b
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x44d765
inc edi
cmp edi, ecx
jb 0x44d6f8
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call int.00480f94
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00494e70
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x44d70b
cmp dword [esi + 0x14], 0x10
jb 0x44d774
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x44d78e
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004965f4
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x44d7c4
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x44d7b4
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x44d802
cmp ecx, edx
je 0x44d879
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x44d7ea
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.0046c564
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004810c4
mov eax, esi
jmp 0x44d74a
or ecx, 0xffffffff
jmp 0x44d804
Function at 0x44daa4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.00480f94
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44dbc7
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d2c4
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44dbde
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d1d4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4ca454
Capabilities:
Encode data using xor

Disassembly:
iretd
loop 0x4ca411
mov ecx, 0x6a228fb3
out dx, ax
xor eax, 0x7ada0820
test dh, ch
outsd dx, dword [esi]
invalid

Function at 0x513164
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
sub ah, byte [edi + ebp + 0xae5d58a]
lds edi, [ebx - 0x30]
mov edi, 0x9ea7d634
xchg esp, eax
lahf
dec esp
mov ebp, 0x9d42ac3e
Function at 0x5299c4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055ceb4
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529ae7
push ecx
lea ecx, [esi + 0x18]
call fcn.005491e4
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529afe
push ecx
lea ecx, [esi + 0x24]
call fcn.005490f4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x578aea
Capabilities:
Encode data using xor

Disassembly:
push edi
add dword [ebx + esi*4 + 0x5f672478], edi
adc al, 0x52
std
out 0x48, al
and eax, 0x4d9e7be5
test eax, 0x9345b6b9
test byte [ebx + 0x6a], cl
mov dl, 0x92
mov eax, dword [0xf9de1265]
xchg byte [ecx], ah
cmp ch, 0x5d
sub eax, 0x835880ca
dec edi
cld
xchg esp, eax
sti
pop ecx
int1
test dword [ebx - 0x6f807758], esp
jmp 0x578a8f
cmp al, byte [ebp + edi + 0x4a91209d]
jecxz 0x578b25
xchg ecx, eax
clc
inc ebx
loope 0x578a9b
mov bh, 0x18
mov bh, 0xc2
xchg esi, eax
wait
or byte [edi], 0x5f
or eax, 0x973b1e13
dec eax
xlatb
push ecx
inc edi
ret
mov ebp, 0x47826e4b
jle 0x578b2b
invalid
cmp eax, 0xcb6299ac
cmp byte [edx], bh
xor bl, bl
xchg esi, eax
inc eax
test al, 0x2e
mov esp, 0x298507ba
xor dword [ebx], eax
jb 0x578b2d
lodsb al, byte [esi]
cdq
invalid
fcmovnu st(0), st(4)
retf 0xbc5c

Function at 0x5943c4
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ebx + 0x61], ebx
das
fidivr dword [ecx + 0x7182082b]
push esp
cmp al, 0x95
scasd eax, dword es:[edi]
not dword [ebx + ecx*8 - 0x625532bc]
and al, 0x5b
add byte [ecx - 0x467d3f20], cl
pop ss
sub eax, 0xca38e9fa
push cs
xor ebx, dword [ebx + 0x6b]
push ds
adc al, 0x8d
jns 0x5943e8
mov word [ebp + eax - 0x734c2053], ss
adc ebp, dword [edi + edx*8 - 0x1cb24631]
stosd dword es:[edi], eax
dec edi
lds eax, [ebx - 0x69]
pop edi
invalid