joyce8/EMBER2024-capa huggingface dataset:
Function at 0x763c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
push edi
xor ebx, ebx
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x133]
mov byte [ebp - 0x134], bl
mov dl, 0x65
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, 0x20
mov cl, 0x6c
mov byte [ebp - 0x30], al
mov byte [ebp - 0x2d], al
mov byte [ebp - 0x25], al
mov al, 0x72
mov byte [ebp - 0x23], al
mov byte [ebp - 0x22], al
mov byte [ebp - 0x20], al
mov byte [ebp - 7], al
mov byte [ebp - 6], al
mov byte [ebp - 4], al
mov eax, dword [0x82e85c]
mov byte [ebp - 0x34], 0x4c
cmp eax, ebx
mov byte [ebp - 0x33], 0x6f
mov byte [ebp - 0x32], 0x61
mov byte [ebp - 0x31], 0x64
mov byte [ebp - 0x2f], 0x25
mov byte [ebp - 0x2e], 0x73
mov byte [ebp - 0x2c], 0x66
mov byte [ebp - 0x2b], 0x61
mov byte [ebp - 0x2a], 0x69
mov byte [ebp - 0x29], cl
mov byte [ebp - 0x28], dl
mov byte [ebp - 0x27], 0x64
mov byte [ebp - 0x26], 0x2c
mov byte [ebp - 0x24], dl
mov byte [ebp - 0x21], 0x6f
mov byte [ebp - 0x1f], 0x3a
mov byte [ebp - 0x1e], 0x25
mov byte [ebp - 0x1d], 0x64
mov byte [ebp - 0x1c], bl
mov byte [ebp - 8], 0x45
mov byte [ebp - 5], 0x6f
mov byte [ebp - 3], bl
mov byte [ebp - 0x18], 0x42
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], 0x5f
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 0x13], 0x68
mov byte [ebp - 0x12], dl
mov byte [ebp - 0x11], cl
mov byte [ebp - 0x10], cl
mov byte [ebp - 0xf], 0x43
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], cl
mov byte [ebp - 0xc], cl
mov byte [ebp - 0xb], bl
jne 0x763dde
mov eax, dword [0x82e860]
cmp eax, ebx
jne 0x763dbf
push 0x76c29e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x82e860], eax
jne 0x763dbf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x34]
push 0x76c29e
lea ecx, [ebp - 0x134]
push eax
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 8]
lea eax, [ebp - 0x134]
push ebx
push edx
push eax
push ebx
call dword [fcn.0082e498]
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [0x82e85c], eax
jne 0x763dde
pop edi
mov eax, 0xfffffffe
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push ecx
push edx
call eax
add esp, 0x14
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x767d30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x3ff]
mov byte [ebp - 0x400], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x1ff]
mov byte [ebp - 0x200], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x767d81
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x400]
push 0x200
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x400]
push 0x5c
push edx
call fcn.00763840
add esp, 8
test eax, eax
jne 0x767db4
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov byte [eax], 0
lea eax, [ebp - 0x200]
push 0x200
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x200]
push 0x5c
push ecx
call fcn.00763840
mov esi, eax
add esp, 8
test esi, esi
jne 0x767deb
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x200]
push 0x76da54
push edx
mov byte [esi], 0
call fcn.00763930
lea eax, [ebp - 0x400]
lea ecx, [ebp - 0x200]
push eax
push ecx
call fcn.00763970
add esp, 0x10
test eax, eax
jne 0x767e1f
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x200]
push 0x76da48
push edx
mov byte [esi], 0
call fcn.00763930
lea eax, [ebp - 0x400]
lea ecx, [ebp - 0x200]
push eax
push ecx
call fcn.00763970
add esp, 0x10
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4151c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x4151e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4151e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4151d8
mov eax, 1
add ebx, ebx
jne 0x4151fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4151f0
jne 0x41520c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4151f0
xor ecx, ecx
sub eax, 3
jb 0x415220
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x415292
mov ebp, eax
add ebx, ebx
jne 0x41522b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x415238
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41525c
inc ecx
add ebx, ebx
jne 0x415248
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41523d
jne 0x415259
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41523d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41527c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41526d
jmp 0x4151de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41527c
add edi, ecx
jmp 0x4151de
pop esi
mov edi, esi
mov ecx, 0x22b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41529a
cmp byte [edi], 5
jne 0x41529a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41529f
lea edi, [esi + 0x13000]
mov eax, dword [edi]
or eax, eax
je 0x41530e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x199ac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19a20]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4152cc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19a28]
or eax, eax
je 0x415308
mov dword [ebx], eax
add ebx, 4
jmp 0x4152e9
call dword [esi + 0x19a24]
mov ebp, dword [esi + 0x19a2c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x415342
sub esp, 0xffffff80
jmp 0x403008
Function at 0x40493a
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437e2a
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x404a5d
push ecx
lea ecx, [esi + 0x18]
call fcn.0042415a
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x404a74
push ecx
lea ecx, [esi + 0x24]
call fcn.0042406a
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x437f5a
Capabilities:
Encode data using xor

Disassembly:
neg byte [ebx - 0x5a]
test al, 0x48
mov byte [ebx - 0x78], cl
outsd dx, dword [esi]
push ss
je 0x437f93
sal dword [esi], 0x67
and al, byte [edx]
cmc
scasd eax, dword es:[edi]
invalid
ja 0x437f1c
test byte [ecx - 0x7e23c147], bl
invalid
sbb byte [esi + 0x466b9adb], ah
mov cl, 0x52
xor edx, dword [ebx - 0x19]
loop 0x437fbf
dec ebp
pop ebx
lea ebx, [edx - 0x1982445c]
insb byte es:[edi], dx
rcl dword [esi + eax*8], cl
sti
daa
adc al, 0xab
ffreep st(6)
fmul qword [ecx]
out 0x25, al
xor al, 0x7b
mov dl, 0x4c
stosd dword es:[edi], eax
and eax, 0x4c
dec esp
dec ebx
jnp 0x438020
xor al, 0x2d
push ecx
sub bl, 0xd
aaa
insd dword es:[edi], dx
loop 0x437fc3
cmp dword [ebx], ebp
aas
test byte [ebx], cl
ljmp 0x12dd
cwde
xor dh, bl
aas
aaa
lea edi, [ebx - 0x348b54a4]
clc
mov ch, 0x3f
movsd dword es:[edi], dword [esi]
or esp, dword [ebx + ecx*8 + 0xf3be3b9]
xor al, 0x8b
dec ebp
dec dword [ecx]
dec edx
setle byte [ebp - 9]
mov edx, ebp
xchg ebp, eax
mov dword [ebp - 0x29], edx
test ah, 0x2a
lodsb al, byte [esi]
ficom dword [esi + 0x3a830aa6]
sbb ebp, dword [eax]
cli
xchg edi, eax
stosb byte es:[edi], al
mov al, 0x74
mov edi, 0xa746a8f4
dec edx
xor eax, 0xd3aa4be4
or dword [ecx], ebx
arpl word [ebx - 0x2b], ax
invalid
Function at 0x44dc4a
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0048113a
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44dd6d
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d46a
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44dd84
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d37a
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x493570
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
push esi
lea eax, [ebp - 0x198]
push edi
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.0044a210
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 8], 1
call edi
lea ecx, [ebp - 4]
mov esi, eax
push ecx
push 0x2000000
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4935f0
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push 4
push edx
push 0x18
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x4935e6
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4935f0
call edi
jmp 0x4935f0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0xaf46e1
Function at 0x496fca
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca4ba
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4970ed
push ecx
lea ecx, [esi + 0x18]
call fcn.004b67ea
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x497104
push ecx
lea ecx, [esi + 0x24]
call fcn.004b66fa
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x49c92b
Capabilities:
Encode data using xor

Disassembly:
push eax
enter 0x1ac9, 0xffffffffffffffad
lodsd eax, dword [esi]
mov edi, 0x5d2f59b
cmp eax, 0xc8761825
sbb bl, dh
xor eax, 0x6ff8b181
xchg esi, eax
daa
mov ecx, 0x59f504d5
mov al, byte [0x1b71a583]
clc
loope 0x49c907
xchg esp, eax
daa
mov dword [ebx - 0x45], ebx
xor ecx, ecx
and al, 0x8f
jns 0x49c95a
mov edi, 0x80513daf
lea ecx, [eax + 0x7b]
sub byte [ebx], 0x9e
mov byte [edx], 0xe8
mov byte [edx + 0x51], 0x48
int 0xd1
ret
add dword [edi - 0x7e], 0xffffffe1
mov byte [esi + 0x3dd3324e], al
mov eax, dword [0x8fbd43f5]
pop ebp
xor al, 0xa1
lds eax, gs:[edi - 0x42]
add eax, 0x6b0b1a40
loopne 0x49c9bb
pop ss
mov ah, 0x49
mov esp, 0x739d2835
xlatb
mov ebx, 0x787f516
dec edx
invalid
cmp cl, 0x6e
stc
push esi
ret
Function at 0x4e042a
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0051391a
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e054d
push ecx
lea ecx, [esi + 0x18]
call int.004ffc4a
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e0564
push ecx
lea ecx, [esi + 0x24]
call fcn.004ffb5a
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x57316a
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a665a
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x57328d
push ecx
lea ecx, [esi + 0x18]
call fcn.0059298a
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5732a4
push ecx
lea ecx, [esi + 0x24]
call fcn.0059289a
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5a61aa
Capabilities:
Encode data using xor

Disassembly:
inc edi
sub edx, ecx
in al, dx
and eax, dword [esi + ecx + 0x14]
fldcw word [edi + 0xee0c6c8]
ret
stosb byte es:[edi], al
salc
retf 0x7eb4
push 0x35
jmp 0x4d16562b
mov ch, 0x35
jb 0x5a6159
jae 0x5a616c
jno 0x5a6212
lahf
or eax, edx
fcomi st(5)
xor ah, dh
sbb al, 0x8d
push 0x7a8635fb
pop ebp
mov edi, 0xe13dc921
or byte [ebx - 0x63789eb4], bl
stosb byte es:[edi], al
adc ebp, dword [edi]
jg 0x5a6181
xor dh, byte [ecx + 0x58]
xchg edi, eax
cmp byte [ebp + 0x766ebaee], ah
sub esi, eax
int 0xf6
mov byte [ebx + 0x78], al
lea esi, [edi + 0x14]
pop edx
lds ebp, [edx - 0x19]
inc ebx
mov ebx, 0x3d8b77ab
invalid
adc ebp, dword [eax + 0x56]
lodsb al, byte [esi]
stosd dword es:[edi], eax
adc eax, dword [edx - 9]
in eax, 0x29
aad 0x39
sub dword [ebp + 0x4e], edi
mov byte [ebx - 7], cl
adc eax, 0x3f1b291b
ffree st(7)
jb 0x5a6236
xor al, 0xe7
cli
lds ebx, [edx]
adc dword [eax + 0x5aba70e8], edi
pop eax
or dl, bh
mov edx, 0xd70a585a
sbb cl, byte [edi]
in al, dx
add ebp, eax
cmp edi, dword [eax + 0x1c]
pop esp
invalid
Function at 0x5bc75a
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005efc4a
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bc87d
push ecx
lea ecx, [esi + 0x18]
call fcn.005dbf7a
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bc894
push ecx
lea ecx, [esi + 0x24]
call fcn.005dbe8a
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x64cd8d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x654390
cmp edx, dword [eax]
je 0x64cdaf
add eax, 8
inc ecx
cmp eax, 0x654420
jl 0x64cda0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x654390]
jne 0x64cedd
mov eax, dword [0xa57cf0]
cmp eax, 1
je 0x64ceb7
test eax, eax
jne 0x64cde0
cmp dword [0x6542b8], 1
je 0x64ceb7
invalid
cmp edx, 0xfc
je 0x64cedd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64ce17
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064d770
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064dc00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64ce5a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064dc00
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x652534
push edi
call fcn.0064fad0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064d770
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064d780
lea eax, [ebp - 0xa0]
push 0x652514
push eax
call fcn.0064d780
push dword [esi + 0x654394]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064d780
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0064fa44
add esp, 0x2c
pop edi
jmp 0x64cedd
lea eax, [ebp + 8]
lea esi, [esi + 0x654394]
push 0
push eax
push dword [esi]
call fcn.0064dc00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4085d8
Capabilities:
Inspect section memory permissions

Disassembly:
inc eax
add al, 0xeb
test eax, 0xeb0c5d89
push es
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4085ff
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40861d
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40867b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x408662
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40866b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x408675
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x408657
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4085e1
mov dword [ebp + 8], esi