joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a8c40
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00401c4e
mov eax, dword [0x5fb740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x600010]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x5a8e18
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x5a8d67
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x5a8d67
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x5a8d45
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x5a8cc9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5a8dd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x5a8e38
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x5a8e13
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x5a8e38
jmp 0x5a8ca2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402d2e
mov esp, ebp
pop ebp
ret
Function at 0x5a8ed0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00401c4e
mov eax, dword [0x5fb740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x600010]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x5a90bb
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x5a9006
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x5a9006
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x5a8fe2
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x5a8f59
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5a9074
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x5a90db
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x5a90b6
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x5a90db
jmp 0x5a8f32
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402d2e
mov esp, ebp
pop ebp
ret
Function at 0x404584
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437a74
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4046a7
push ecx
lea ecx, [esi + 0x18]
call fcn.00423da4
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4046be
push ecx
lea ecx, [esi + 0x24]
call fcn.00423cb4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4372f4
Capabilities:
Encode data using xor

Disassembly:
dec esi
popfd
jecxz 0x437298
test al, 0x67
aas
dec eax
or ebx, dword [eax]
in eax, 0x78
push edx
rcl dh, 1
xchg ecx, eax
adc edi, dword [esi]
cmp byte [ecx], bh
aaa
add ah, byte [eax + 0x79600bd0]
push edx
sub ebp, esp
xchg edi, eax
outsd dx, dword [esi]
push es
cmpsb byte [esi], byte es:[edi]
xor byte [edx + 0x2d9e58d1], ah
loop 0x43731e
jmp 0x4372d6
push edx
jmp 0x437290
jecxz 0x43728c
xor eax, 0x3466d066
pop ebp
dec edi
mov dl, 0xfd
std
sub al, 0x46
or dl, byte [ebx - 0x3c]
xor ebx, dword [ebx]
sar dword [edi], cl
xor bl, ch
and ah, al
idiv dword [ecx - 0x23c4bab0]
push ecx
jo 0x4372fe
sal byte [eax - 0x3ca78cad], cl
sbb al, 0xb3
cmp dword [ebp + 0x525a49cb], ebp
rcl dword [eax + ebp*8 - 0x7ff8b8de], 0x3f
lodsd eax, dword [esi]
retf
imul eax, dword [ebx - 0x3afecc27], 0x5e
sbb bl, al
jecxz 0x43732b
aad 0x75
add edi, dword [edi + 0x47]
and dword [eax + 0x17c81662], edx
rol dword [ebx], 0xcd
mov dh, 0x14
test byte [eax - 0x653c789e], ch
dec edx
mov dh, 0x92
mov bh, 0x13
cdq
lodsb al, byte [esi]
pop ebp
loop 0x4373cd
int3
fsub dword [edx]
fcomp st(6)
std
and dword [esi], edi
ret
Function at 0x44d8a4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00480d94
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44d9c7
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d0c4
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44d9de
push ecx
lea ecx, [esi + 0x24]
call fcn.0046cfd4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x496cb4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca1a4
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x496dd7
push ecx
lea ecx, [esi + 0x18]
call fcn.004b64d4
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x496dee
push ecx
lea ecx, [esi + 0x24]
call fcn.004b63e4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4e0114
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00513604
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e0237
push ecx
lea ecx, [esi + 0x18]
call fcn.004ff934
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e024e
push ecx
lea ecx, [esi + 0x24]
call fcn.004ff844
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x501504
Capabilities:
Encode data using xor

Disassembly:
push ebp
out 0x3f, eax
push 0x47a29952
mov byte [0xad515234], al
push esp
mov edi, 0x6c6e2e42
mov al, byte [0x16612c28]
lcall 0xdd4, 0x65d4802f
jbe 0x501543
hlt
or eax, 0x6d08cd38
in al, dx
add dword [ecx - 0x63bee9a2], esi
pushfd
mov dword [0x3e865817], ebp
jl 0x5014dd
adc al, ah
add ebx, edx
pop ebp
xlatb
cmp edx, dword [eax*2 + 0x7eaa4f65]
dec ebx
in eax, 0x97
std
sbb eax, 0xad27df55
cmp dword [ebp + 0x5c60b75], ebx
invalid
xchg esi, eax
adc eax, 0x83115561
sub al, 0xc3
in eax, 0x25
jae 0x50150f
or ebp, dword [ecx + 0x7a230a01]
in al, 0xb3
pushfd
invalid
Function at 0x529844
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055cd34
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529967
push ecx
lea ecx, [esi + 0x18]
call fcn.00549064
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x52997e
push ecx
lea ecx, [esi + 0x24]
call fcn.00548f74
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x548744
Capabilities:
Check for software breakpoints

Disassembly:
xchg dword [ebp + 0x4a], ecx
fst dword [esi - 0x2d598336]
sbb al, 0x50
invalid
Function at 0x572e54
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a6344
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x572f77
push ecx
lea ecx, [esi + 0x18]
call fcn.00592674
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x572f8e
push ecx
lea ecx, [esi + 0x24]
call fcn.00592584
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x578525
Capabilities:
Encode data using xor

Disassembly:
and byte [ecx], ch
pop eax
cdq
inc ebx
mov word [ebx], es
and bl, dh
sbb ecx, dword [eax - 0x1004c08c]
mov dword [0x3a912fdf], eax
mov ebx, 0xa7d663d5
sbb eax, dword [ebx + 0x4c]
inc edi
cmp eax, 0xa27c2a36
lcall 0x3132, 0xd335eb93
add dword [ebx], 0x71
and esi, dword [eax + 8]
xor eax, 0x833132d3
add esi, dword [ecx + 0x23]
jo 0x57855e
xor eax, 0xb08541f3
mov dword [eax - 0x7d], eax
cmp eax, 0x2e770bba
dec ebp
wait
shr dword [ecx - 0x73], cl
dec edx
xchg ebp, eax
sub dh, byte [ebx]
wait
add eax, dword [ecx]
scasb al, byte es:[edi]
mov esp, gs
jecxz 0x57854c
adc eax, 0xcf2aa13
je 0x5785c6
push 0x68ebe696
not dword [ebp - 0x74dd1a0d]
or esi, dword [ebp - 0x5c]
adc byte [ecx + 0x6e02edc0], al
invalid
stosd dword es:[edi], eax
imul ecx, dword [ecx + 0x3a], 0xffffffa9
dec ecx
cld
test al, 0x5d
dec ecx
adc esp, 0xffffff8a
insb byte es:[edi], dx
int1
out 0xa0, eax
inc ecx
clc
xor dword [edi + 0x27], eax
mov esi, 0x8a0c08bb
xchg ebp, eax
sbb eax, 0x3945eedd
je 0x57863c
push ebx
movsb byte es:[edi], byte [esi]
mov bl, 0x2c
sbb ebp, dword [eax - 0x12]
loopne 0x5786be
in eax, 0xa2
mov dh, 0xee
daa
add edx, dword [edx - 0x1a]
shr ebp, cl
mov ss, word [esi + 0x73]
rcl dword [ebx - 0x4ac5197e], cl
invalid
xor bl, 0xde
xchg dword [esi + 0x7b], ecx
mov ebp, 0x580ba3e6
sti
out 0xa3, al
or ebx, dword [eax - 5]
pop esp
mov ecx, 0x6612db81
or dword [ebx - 0x75f28a6d], esp
adc ah, byte [esi + 9]
mov dword [0x8a0d7593], eax
jb 0x5786b6
inc edi
clc
pop edi
mov cl, dh
mov eax, ds
push ds
jl 0x578746
add edx, esp
jge 0x5786e9
rcr cl, cl
mov eax, dword [0xb364c929]
and byte [ebx + 0x1e], dh
inc ecx
inc edx
daa
imul eax, dword [ebx], 0x72
add cl, 0x50
leave
add dword [edi + 0x63], 0xffffffea
int1
jno 0x5786c7
wait
sbb dword [ebx + 0xfb3c777], 0x59
pop ds
invalid
stosb byte es:[edi], al
das
dec esi
sbb byte [esi - 0x4a96f4dc], dl
invalid

Function at 0x591e74
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x3f27a61c
xchg esi, eax
pop es
lodsd eax, dword [esi]
popfd
and dword [eax + 0x19d5bb6b], ebx
push edx
and edi, dword [ebx - 0x46]
sub byte [edx + 0x720b1b23], cl
invalid
Function at 0x592584
Capabilities:
Encode data using xor

Disassembly:
lahf
das
pop es
mov edx, 0x67870cc3
jnp 0x5925d2
leave
mov ah, 0xf3
jnp 0x59259c
out dx, al
xor esp, dword [edi - 0x1dfd614a]
push ebx
jge 0x59256c
scasd eax, dword es:[edi]
imul ebp, ebx, 0x13
insb byte es:[edi], dx
jl 0x592608
retf
int 0xc8
salc
popfd
and al, 0xf3
inc ebx
add eax, 0xb772d0ac
pop edi
xchg edx, eax
ret
dec edx
adc esi, eax
arpl word [ecx], bx
push ebx
push ebx
sub esp, dword [bp + di + 0x4a]
sub ecx, dword [ebx + esi*8 + 0x176c0965]
xchg ebx, eax
pop esi
xor esp, dword [edi + ebp*4 - 0x4b5c2099]
shl dl, 1
and dword [ecx + 0x2b893b3], ebp
pop ebx
xchg ebp, eax
pop eax
xlatb
inc esi
salc
pop esi
in al, dx
arpl word [ebx + 0x6e283ee2], bp
cmp eax, 0x2c06a396
adc dword [edi - 0x6ddb0bd8], 0xffffff98
mov cl, 0x6d
mov ch, byte [ecx + 0x42]
dec eax
jnp 0x592611
add eax, 0x47445c65
add esp, dword [edx + 0x78]
xor dword [edx - 0x58], ebx
mov esi, 0xe5c299ff
xchg ecx, eax
jns 0x592608
ret 0x91e5
xor al, 0x77
outsd dx, dword [esi]
adc dword [edx + 0x6b813b1c], ebp
add dword [edi], 0x65
mov gs, word [ebx + 0xb]
jge 0x5925be
jno 0x5926a7
xor ebx, dword [ebx]
xchg esi, eax
push ebp
push esp
invalid
sbb al, 0x11
or dword [edx - 0x65], esi
outsd dx, dword [esi]
or dword [eax - 0xd9c3d67], esi
dec ebx
dec esi
sub byte [ecx - 0x25], ah
invalid

Function at 0x5efd74
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
dec edx
and byte [esi + 0x366b2f0c], bl
mov ebx, 0xcfc6b87
jge 0x5efd61
cld
push ecx
xchg ecx, eax
sbb al, 0x3d
invalid
sub bl, 0xd0
xor al, 0xd6
add al, 0x1d
xor al, 0xe4
xchg edi, eax
pushal
retf
test byte [esi + esi], 0x7a
aam 0x44
jp 0x5efd08
mov ah, 0x53
push ss
leave
or al, 0x58
mov dh, 0xc1
jmp 0x9eeca53a