joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x409b38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x409b47
pop dword [ebp - 0x38]
mov eax, 0x409b47
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x3f9f5a69
add dword [ebp - 0x48], 0xeb2eae2
mov dword [ebp - 0x44], 0xc07cfcf6
sub dword [ebp - 0x44], 0x8e49b0b1
mov dword [ebp - 0x40], 0xb8e89e8c
add dword [ebp - 0x40], 0x9363a5a2
mov dword [ebp - 0x3c], 0x62606e69
add dword [ebp - 0x3c], 0x9d9f9197
lea eax, [ebp - 0x48]
push eax
mov eax, 0x5f37aa7a
add eax, 0xa10925da
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xb084455b
sub dword [ebp - 0x48], 0x3c11dc05
mov dword [ebp - 0x44], 0xd6b6ca0a
add dword [ebp - 0x44], 0x6ab5976b
mov dword [ebp - 0x40], 0x62ebfb6d
sub dword [ebp - 0x40], 0xff7c8f01
mov dword [ebp - 0x3c], 0xd184a268
sub dword [ebp - 0x3c], 0xd184a268
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xdcd45ec2
sub eax, 0xdc938e76
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x38e46
push 0
call eax
mov ecx, 0xa90f4fca
sub ecx, 0xa90f0a64
xor esi, esi
add esi, eax
mov edx, 0x4368a6d3
sub edx, 0x4326f6d3
add edx, dword [ebp - 0x38]
mov ebx, 0x1901f2a4
add ebx, 0xf7341898
xor dword [ebp - 0x34], ebx
mov edi, dword [edx]
xor dword [ebp - 0x1c], 0x7ced8d6d
sub edi, ebx
add dword [ebp - 0x24], 0x62f44af
mov dword [esi], edi
xor dword [ebp - 0x2c], ecx
add esi, 0xc5e9453d
sub esi, 0xc5e94539
add edx, 0x3440f80b
add edx, 0xcbbf07f9
loop 0x409c66
add eax, 0x912f5be4
sub eax, 0x912e5379
xor ebx, ebx
add ebx, eax
add eax, 0xdc913bb7
add eax, 0x236ec44e
mov ecx, 0xd53f39d
sub ecx, 0xd13f39d
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10009830
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009830
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10009830
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10009830
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10009830
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10009830
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10009830
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10009830
push 0xd008
push edi
call fcn.10009830
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10009830
int3

Function at 0x10009830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1000983f
pop dword [ebp - 8]
mov eax, 0x9492f2bc
sub eax, 0x84925a7d
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x39f5b
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x4bd5
mov ebx, eax
mov esi, 0x712232a4
add esi, 0x9edf535c
add esi, dword [ebp - 8]
mov edi, 0xca1dc982
sub edi, 0xaa6d8ca8
add dword [ebp - 4], ecx
mov edx, dword [esi]
xor edx, edi
sub dword [ebp - 4], 0xfb730bb0
mov dword [ebx], edx
mov dword [ebp - 4], 0x4f9e2d74
add ebx, 4
add esi, 0x67602ecb
sub esi, 0x67602ec7
loop 0x10009893
add eax, 0xd239fc79
add eax, 0x2dc725ae
xor ebx, ebx
add ebx, eax
add eax, 0x246e37c9
add eax, 0xdb91c83c
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x1000c871
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp esi, 0x7ff80000
jbe 0x1000c892
lea edi, [esi - 0x7ff80000]
cmp esi, 0x80000000
jb 0x1000c897
mov ebx, 0xfff80000
jmp 0x1000c89d
mov edi, 0x10000
lea ebx, [esi + 0x7ff80000]
mov edx, dword [0x10013e68]
mov eax, dword [0x10013e60]
test edx, edx
jne 0x1000c8b8
test eax, eax
je 0x1000c8cb
mov edx, eax
mov dword [0x10013e68], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x1000c8cb
cmp ecx, edi
jb 0x1000c8cb
cmp ecx, ebx
jbe 0x1000c9ab
mov edx, eax
test eax, eax
jmp 0x1000c8ed
test edx, edx
je 0x1000c8e8
mov eax, dword [edx + 8]
test eax, eax
je 0x1000c8e8
cmp eax, edi
jb 0x1000c8e8
cmp eax, ebx
jbe 0x1000c9ab
mov edx, dword [edx + 4]
test edx, edx
mov dword [0x10013e68], edx
jne 0x1000c8d1
and esi, 0xffff0000
mov eax, 0x40000000
cmp esi, eax
jbe 0x1000c9d0
lea edx, [esi - 0x40000000]
mov ecx, edi
call fcn.10009830
mov edx, eax
test edx, edx
jne 0x1000c971
mov eax, 0x40000000
cmp esi, eax
jbe 0x1000c93e
lea ecx, [esi - 0x40000000]
mov edx, esi
call fcn.10009830
mov edx, eax
test edx, edx
jne 0x1000c971
mov eax, 0x40000000
cmp esi, eax
jae 0x1000c953
lea edx, [esi + 0x40000000]
mov ecx, esi
call fcn.10009830
mov edx, eax
test edx, edx
jne 0x1000c971
mov edx, esi
mov ecx, edi
call fcn.10009830
mov edx, eax
test edx, edx
jne 0x1000c971
mov edx, ebx
mov ecx, esi
call fcn.10009830
mov edx, eax
test edx, edx
je 0x1000c9ee
xor ecx, ecx
mov dword [edx], 0x52727464
mov dword [edx + 8], ecx
mov esi, 0x38b
mov eax, dword [0x10013e60]
mov dword [edx + 4], eax
lea eax, [edx + 0xffa8]
mov dword [0x10013e68], edx
mov dword [0x10013e60], edx
mov dword [eax + 0x40], ecx
mov ecx, eax
sub eax, 0x48
sub esi, 1
jne 0x1000c99b
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, edi
jb 0x1000c9ee
cmp esi, ebx
ja 0x1000c9ee
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [edx + 8], ecx
call fcn.1000ec20
add esp, 0xc
mov eax, esi
jmp 0x1000c9f0
jae 0x1000c920
lea ecx, [esi + 0x40000000]
mov edx, ebx
call fcn.10009830
mov edx, eax
test edx, edx
jne 0x1000c971
jmp 0x1000c940
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x1000ca7b
Capabilities:
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [0x10013e58]
xor ebx, ebx
test edi, edi
je 0x1000cab8
push esi
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1000caa9
mov esi, dword [edi]
push edi
call fcn.1000dd99
mov edi, esi
pop ecx
test esi, esi
jne 0x1000ca8a
jmp 0x1000cab7
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
mov dword [0x10013e70], ebx
pop esi
mov dword [0x10013e58], edi
mov eax, ebx
pop edi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x43c0e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x43c0f2
pop dword [ebp - 0x14]
mov eax, 0xc4e764fc
sub eax, 0xc4a3a40a
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x6fffe08f
add dword [ebp - 0x24], 0xde5264bc
mov dword [ebp - 0x20], 0xecaa6b70
add dword [ebp - 0x20], 0x4588e0d5
mov dword [ebp - 0x1c], 0x5f325cdd
add dword [ebp - 0x1c], 0xed19e751
mov dword [ebp - 0x18], 0xcb79eff
sub dword [ebp - 0x18], 0xcb79eff
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xfa512bd7
sub dword [ebp - 0x24], 0x85dec281
mov dword [ebp - 0x20], 0x8f8ded97
add dword [ebp - 0x20], 0xb1de73de
mov dword [ebp - 0x1c], 0x21eabc5e
sub dword [ebp - 0x1c], 0xbe7b4ff2
mov dword [ebp - 0x18], 0x5713dd9b
sub dword [ebp - 0x18], 0x5713dd9b
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xbcf47584
sub eax, 0xbcaec504
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x4ff9b
push 0
call eax
mov ecx, 0x5298
xor ebx, ebx
add ebx, eax
mov esi, 0x1dd3dd74
sub esi, 0x1d8c7d74
add esi, dword [ebp - 0x14]
mov edx, 0xf73a7113
sub edx, 0x6e86d376
add dword [ebp - 4], eax
mov edi, dword [esi]
add dword [ebp - 8], 0x5d844fcc
add edi, edx
xor dword [ebp - 0xc], eax
mov dword [ebx], edi
add dword [ebp - 8], eax
add ebx, 4
add esi, 4
loop 0x43c20b
add eax, 0x8c04332
add eax, 0xf740fa01
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x404926
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437e16
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x404a49
push ecx
lea ecx, [esi + 0x18]
call 0x424146
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x404a60
push ecx
lea ecx, [esi + 0x24]
call fcn.00424056
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44dc36
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.00481126
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44dd59
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d456
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44dd70
push ecx
lea ecx, [esi + 0x24]
call 0x46d366
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x493570
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
push esi
lea eax, [ebp - 0x198]
push edi
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.0044a210
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 8], 1
call edi
lea ecx, [ebp - 4]
mov esi, eax
push ecx
push 0x2000000
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4935f0
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push 4
push edx
push 0x18
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x4935e6
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4935f0
call edi
jmp 0x4935f0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0xb5c835
Function at 0x496fb6
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca4a6
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4970d9
push ecx
lea ecx, [esi + 0x18]
call int.004b67d6
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4970f0
push ecx
lea ecx, [esi + 0x24]
call fcn.004b66e6
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4e0416
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.00513906
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e0539
push ecx
lea ecx, [esi + 0x18]
call int.004ffc36
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e0550
push ecx
lea ecx, [esi + 0x24]
call 0x4ffb46
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4e60dc
Capabilities:
Encode data using xor

Disassembly:
jnp 0x4e6129
push edi
adc dh, byte [edx + ecx*4]
inc ebp
ljmp 0x2a7f
adc dword [edi - 0x86d23df], esi
pop ebx
mov edi, 0xe010b004
dec edx
clc
scasd eax, dword es:[edi]
mov cl, 0xe4
out 0x4f, eax
salc
mov al, ch
xor byte [0x677b2aa2], 0xc8
xchg dword [ecx + 1], ebp
xchg edx, eax
and eax, 0xf4c0702e
invalid

Function at 0x4e61b5
Capabilities:
Encode data using xor

Disassembly:
dec ecx
lodsb al, byte [esi]
fdivr st(6), st(0)
mov ch, 0xb
mov dl, 0x5a
xchg dword [eax + 0x42], esi
dec eax
sal dword [0xd6f30e91], cl
loop 0x4e6220
inc eax
xor dword [ecx], 0x47
xor bh, byte [edx - 0x6f]
inc ebx
xchg dword [edi - 0x4036425d], edx
fsub st(3), st(0)
insb byte es:[edi], dx
mov cl, 0x32
or al, 0xfa
invalid
test esp, edx
outsd dx, dword ss:[esi]
jecxz 0x4e628c
pop esi
retf 0x8b26
invalid
Function at 0x529b46
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055d036
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529c69
push ecx
lea ecx, [esi + 0x18]
call fcn.00549366
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529c80
push ecx
lea ecx, [esi + 0x24]
call fcn.00549276
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x549276
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0xa3
sbb edx, dword [0x263b4956]
cmp esi, dword [ebp + 0x2c53bada]
mov ecx, 0xfb71b1c4
mov cl, 0x71
sti
sbb byte [edx + 0x12e74b86], 0x58
rcl byte [ebp - 0x452db9dd], cl
test byte [esi + 0x2362c7e], cl
cmc
sub al, 0x36
add dh, byte [esi]
cmc
mov esp, 0x248e9973
jp 0x549289
rol dword [eax + ebx*4 - 0x447df10d], 1
and byte [ebp + 0x1b550ab6], dl
pop ecx
dec eax
pushal
wait
lahf
push eax
push eax
add byte [ecx], al
xor al, dh
sub byte [ebx + 0xf], al
push esp
pop edi
mov ecx, 0x655bbb67
push ebp
cli
adc ecx, 0xe9e30b71
cmp ah, al
inc ebp
jne 0x5492a5
jb 0x5492f9
xchg cl, dl
or al, 5
cdq
add ebx, dword [ebx]
and dh, byte [edi]
wait
leave
pop ebx
ret 0x1374
xchg edx, eax
add al, 0xf1
fistp word [esi + 0x7ec2e525]
pop ebx
inc esp
ljmp 0x9a01

Function at 0x54ff36
Capabilities:
Encode data using xor

Disassembly:
invalid
mov edi, 0xa9459ac8
cwde
sbb bl, byte [edi + 0x3a4abc58]
mov ebx, dword [ecx + 0x16]
sti
shr dword [ecx - 0x7d5b8105], cl
and ch, bh
inc esp
and ch, dh
fcmovne st(0), st(0)
loope 0x54feeb
sbb eax, 0xff919e10
and edx, ecx
mov cl, 0xb9
adc dword [eax + 0x55], ecx
pop eax
fsubr qword [ebp + 0x66]
push 0xcb15cb15
hlt
Function at 0x55d036
Capabilities:
Encode data using xor

Disassembly:
cmp ah, byte [edx + ecx*2]
cmc
pop edx
add dword [eax - 0x75fbc1c1], eax
inc ebp
shl byte [eax], 0x29
cli
das
movsb byte es:[edi], byte [esi]
aad 0xd1
bound eax, qword [ebp - 0x55]
mov al, byte [0xb320a4fa]
pop ebp
out dx, al
arpl word [ecx + edi*8 + 0x2e174a54], di
pop es
je 0x55d07d
xor byte [edx - 0x1f7b114c], cl
mov ah, 0x2f
and eax, 0x5db954b
mov esi, 0x5eaf7ff4
test byte [ecx + 0x7240e988], bl
invalid
mov al, byte [0x97e7b0eb]
xor al, byte [edi]
jnp 0x55d0af
outsb dx, byte [esi]
pop ds
jo 0x55d026
or al, 0x5e
xor ch, byte [eax + 0x35]
lahf
and eax, 0xedc476a
sub ecx, ebp
xor byte [edx + edx*8 - 0x73], 0x39
mov eax, dword [0x9523a14a]
insd dword es:[edi], dx
sti
test byte [edx], 0x78
retf
cmc
ror dword [edi - 0x1889360c], 0xa5
mov ch, 0xd6
cdq
inc ebp
mov word [esi - 0x42], es
mov bl, byte [edx + 0x3b]
cmpsd dword [esi], dword es:[edi]
push ebp
dec ebp
sbb dword [eax - 0x42], esp
cmc
invalid

Function at 0x573156
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.005a6646
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x573279
push ecx
lea ecx, [esi + 0x18]
call fcn.00592976
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x573290
push ecx
lea ecx, [esi + 0x24]
call fcn.00592886
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5a6196
Capabilities:
Encode data using xor

Disassembly:
invalid
jl 0x5a6134
imul ebx, dword [ecx], 0x87d29a4
dec edi
sbb al, 0xbf
nop
push 0x75d949af
lodsd eax, dword [esi]
popal
invalid