joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c4
call fcn.00406630
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], GetProcAddress
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
xor esi, esi
mov edx, eax
mov ecx, esi
shr edx, 7
add esi, 2
and dl, al
shr ecx, 5
xor dl, cl
mov byte [ebp + eax - 0x3a988], dl
inc eax
cmp esi, 0x75300
jb 0x404216
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040597d
mov esp, ebp
pop ebp
ret
Function at 0x404610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa1844
call fcn.00406630
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov dword [ebp - 0xa1820], 0
push eax
push eax
push eax
mov word [ebp - 0xa180c], ax
lea eax, [ebp - 0xa181c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xa1820]
mov dword [ebp - 0xa181c], GetProcAddress
push eax
mov dword [ebp - 0xa1818], 0x5622
mov dword [ebp - 0xa1814], 0x5622
mov dword [ebp - 0xa1810], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0xa17fc
lea eax, [ebp - 0xa1808]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
xor esi, esi
mov edx, eax
mov ecx, esi
shr edx, 7
add esi, 2
or dl, al
shr ecx, 5
xor dl, cl
mov byte [ebp + eax - 0xa1808], dl
inc eax
cmp esi, 0x142ff8
jb 0x404696
lea eax, [ebp - 0xa1808]
mov dword [ebp - 0xa183c], 0xa17fc
mov dword [ebp - 0xa1840], eax
lea eax, [ebp - 0xa1840]
push 0x20
push eax
push dword [ebp - 0xa1820]
mov dword [ebp - 0xa1838], 0
mov dword [ebp - 0xa1834], 0
mov dword [ebp - 0xa1830], 0
mov dword [ebp - 0xa182c], 0
mov dword [ebp - 0xa1828], 0
mov dword [ebp - 0xa1824], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0xa1840]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0xa1840]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040597d
mov esp, ebp
pop ebp
ret
Function at 0x404770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa1840
call fcn.00406630
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xa1820], 0
push eax
push eax
push eax
mov word [ebp - 0xa180c], ax
lea eax, [ebp - 0xa181c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xa1820]
mov dword [ebp - 0xa181c], GetProcAddress
push eax
mov dword [ebp - 0xa1818], 0x5622
mov dword [ebp - 0xa1814], 0x5622
mov dword [ebp - 0xa1810], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0xa17fc
lea eax, [ebp - 0xa1808]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov edx, eax
mov ecx, eax
shr edx, 7
shr ecx, 5
and dl, al
or cl, al
xor dl, cl
mov byte [ebp + eax - 0xa1808], dl
inc eax
cmp eax, 0xa17fc
jb 0x4047f3
lea eax, [ebp - 0xa1808]
mov dword [ebp - 0xa183c], 0xa17fc
mov dword [ebp - 0xa1840], eax
lea eax, [ebp - 0xa1840]
push 0x20
push eax
push dword [ebp - 0xa1820]
mov dword [ebp - 0xa1838], 0
mov dword [ebp - 0xa1834], 0
mov dword [ebp - 0xa1830], 0
mov dword [ebp - 0xa182c], 0
mov dword [ebp - 0xa1828], 0
mov dword [ebp - 0xa1824], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0xa1840]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0xa1840]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040597d
mov esp, ebp
pop ebp
ret
Function at 0x4061ad
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4061ec
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4061ec
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4061ec
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4061ec
cmp dword [ecx + 0x74], 0xe
jbe 0x4061ec
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x404587
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437a77
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4046aa
push ecx
lea ecx, [esi + 0x18]
call fcn.00423da7
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4046c1
push ecx
lea ecx, [esi + 0x24]
call fcn.00423cb7
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44d8a7
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00480d97
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44d9ca
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d0c7
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44d9e1
push ecx
lea ecx, [esi + 0x24]
call fcn.0046cfd7
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x493580
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push str.AnyMediaPlayer
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4935e0
push 0
push str.TAnyMediaPlayerMainForm
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x493600
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x3e8
push 0x3e8
push 0x4c9
push esi
call edi
test eax, eax
jle 0x4935d4
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push 0
push 0x4a
push esi
call edi
pop edi
jmp 0x493600
push str.AnyMediaPlayer
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x493600
push 0x659c5d
call fcn.0044a210
add esp, 4
jmp 0xb5040c

Function at 0x4a53c7
Capabilities:
Encode data using xor

Disassembly:
adc dword [ebx], edx
test al, 0xc5
invalid
lds ebx, [esi - 0x29]
out dx, al
jl 0x4a539a
invalid
Function at 0x5064f7
Capabilities:
Encode data using xor

Disassembly:
in eax, 0x4a
xchg cl, ch
add word [ebp + 0x72322f65], di
mov eax, 0xa05f067d
mov dh, 0x55
mov esp, 0x171b4ab5
and eax, 0x191a5497
sbb bl, byte [ecx]
pop esp
xor dword [ebp + 7], ecx
popfd
mov esp, 0xa78b7565
sbb eax, 0xb6daada1
add byte [edi + 0x6e], dh
mov dh, 0
ja 0x506543
mov bl, 0xa1
jg 0x5064d1
and edi, dword [edi - 0x3cd40092]
in al, dx
jo 0x50650a
xlatb
pop esi
push ss
add ah, byte [ebx - 0x123b7b60]
popfd
movsd dword es:[edi], dword [esi]
adc bh, byte [ebx + 0x29a060c4]
jl 0x5064a7
jle 0x50655f
or dh, cl
or dh, cl
push edx
adc esp, dword [edx - 0x1d]
aaa
and dl, cl
push ebp
xor cl, byte [ecx + 0x2a]
inc ebx
out dx, al
sub dword [ecx - 0x5beb67cf], ecx
cli
and eax, 0xcca85221
das
or eax, 0x6f539be4
jne 0x5064f8
xor dword [eax + 0x25faa414], ebx
and dword [edx - 0x58], edx
int3
pop ss
lodsb al, byte [esi]
push ecx
and edi, dword [eax + edi*2 - 0x5a]
in eax, 0x21
fdivr st(0), st(0)
mov edi, 0x8d3d63fa
pushal
or al, 0x3b
jg 0x5064c1
dec ecx
iretd
int 4
sbb eax, 0x8971c910
pop gs
in eax, 0x56
dec eax
mov ebp, 0xbadd64f6
adc al, 0x16
scasb al, byte es:[edi]
adc eax, 0x476416a2
mov al, byte [0xda02be2c]
add bl, dl
mov eax, dword [0x974ae917]
xchg edx, eax
lds ecx, [edx - 0x264e9170]
stosb byte es:[edi], al
retf
Function at 0x553967
Capabilities:
Encode data using xor

Disassembly:
push ebp
loope 0x553994
add al, byte [ebp + 0x3c2014d2]
xor al, 0xda
and edi, dword [edx + 0x14]
mov dword [ebx + 0x412e987d], 0x13b950a9
sub eax, esi
jl 0x5539a3
inc ebx
jo 0x5539ca
in al, dx
xchg edx, eax
jmp 0x55399e
jno 0x5539cf
add esp, edx
bound ebp, qword [esp + ebx*8 - 0x46]
push esp
test byte [edi], bh
aas
movsb byte es:[edi], byte [esi]
aaa
popal
sal ebx, 1
jno 0x5539ea
jno 0x5539ea
rol byte [edi + 0x4f], 1
stosb byte es:[edi], al
or dword [edx], ebp
mov eax, esp
push cs
shl byte [ebx + 0x1d9060f2], 1
sub dl, byte [eax + 0x3a]
outsd dx, dword [esi]
pop ss
and byte [eax + edi*8], dh
inc edi
add byte [eax + 0x746ef1fd], cl
jo 0x553a18
popal
lodsb al, byte [esi]
dec esp
and al, 0x99
cdq
mov esi, ecx
ficomp dword [ebp + 0x5114297f]
jg 0x5539fa
adc al, 0x51
pop eax
adc al, 0xaf
xor esp, dword [edx]
mov eax, dword [0x71b92e9c]
wait
test dword [esi], ecx
cmc
outsb dx, byte [esi]
mov edi, 0xd1c9a84
jne 0x5539c7
daa
inc esi
xchg ecx, eax
out dx, eax
leave
enter 0x130a, 0xffffffffffffff85
cli
invalid
adc eax, dword [ebp - 0x40400f06]
inc ebx
sar dword [esi], 1
push eax
xchg dword [edi - 0x15], eax
lodsd eax, dword [esi]
pop edi
sti
aad 0x75
salc
outsb dx, byte [esi]
push eax
inc esp
mov dl, 0xbb
xchg ebx, eax
or al, 0x61
xor edx, dword [ebp + edi*2 + 0x75377018]
cmp eax, 0x89c42f27
aad 0x69
mov cl, 0xf6
scasb al, byte es:[edi]
dec edx
daa
out 0xfc, eax
xor eax, 0x83f5b015
jnp 0x553a6b
imul esi, dword [ecx + 0x274aaef6], 0x1535fce7
mov al, 0xf5
cmp dword [ebx + 0x44], 0xffffffa2
cmc
and al, 0xfd
jnp 0x5539ec
mov byte [0x7bfd24f5], al
mov edi, 0x2076c01c
sbb al, 0xc0
jbe 0x553a51
add ah, byte [ecx]
inc eax
push esi
add al, 0x11
pop edi
mov ch, 0xdc
sub ah, dh
cld
test dword [esi - 0x48], ebx
lodsb al, byte [esi]
inc esp
add esp, esi
add edx, dword [edi]
mov esi, 0xc0341b48
call 0x1495646a
in al, 0xc4
sub dword [edx], eax
xchg ebp, eax
sub esp, dword [ecx - 0x3b]
jo 0x5539f0
les ebp, [ecx]
add dl, byte [ebp + 0x70c5612b]
xchg esi, eax
popal
xor ecx, esi
push es
cdq
adc dword [ebp + 0x72a58fae], 0x6a
xlatb
and dword [edx], esp
retf
retf
Function at 0x572e47
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a6337
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x572f6a
push ecx
lea ecx, [esi + 0x18]
call int.00592667
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x572f81
push ecx
lea ecx, [esi + 0x24]
call fcn.00592577
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5bcff7
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005f04e7
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bd11a
push ecx
lea ecx, [esi + 0x18]
call fcn.005dc817
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bd131
push ecx
lea ecx, [esi + 0x24]
call fcn.005dc727
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x606687
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00639b77
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x6067aa
push ecx
lea ecx, [esi + 0x18]
call fcn.00625ea7
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x6067c1
push ecx
lea ecx, [esi + 0x24]
call fcn.00625db7
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x625627
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x703d0f6d
fcmovbe st(0), st(7)
test dword [ecx + 0x130bcf47], esi
enter 0x5ec, 6
mov dl, 0xca
and eax, 0xa720f130
push es
in al, 0x48
fdiv dword [edx + ebp*4]
and eax, 0x148a09a7
sub edx, dword [ebp - 0x6424adb5]
sub eax, esp
les edi, [ebx + 0x60e7f394]
les edi, [ebx + 0x60e7f394]
les ecx, [ebx - 0x38]
cli
lodsd eax, dword [esi]
out dx, eax
leave
xor byte [edi - 0x3c], ch
sbb edx, esi
enter 0xffffffffffffae56, 0x45
dec eax
xor eax, 0x12da5c4a
bound eax, qword [esi]
push esi
rcr dword [edi + ebp*4], 0x7a
test eax, 0x986aa8d5
je 0x6255fd
mov edi, 0xa552d543
cmc
and ecx, dword [ebx + 0x1e16e561]
movsb byte es:[edi], byte [esi]
invalid

Function at 0x64d9ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x656388
cmp edx, dword [eax]
je 0x64da0f
add eax, 8
inc ecx
cmp eax, 0x656418
jl 0x64da00
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x656388]
jne 0x64db3d
mov eax, dword [0xa59ce0]
cmp eax, 1
je 0x64db17
test eax, eax
jne 0x64da40
cmp dword [0x6562b4], 1
je 0x64db17
cmp edx, 0xfc
je 0x64db3d
lea eax, [ebp - 0x1a4]
push 0x104
add al, 1
add byte [eax], al
lea eax, [ebp + 8]
lea esi, [esi + 0x65638c]
push 0
push eax
push dword [esi]
call fcn.0064e860
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x10001430
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10003020]
jne 0x1000143a
repz ret
jmp fcn.100017d0

Function at 0x1000148d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1000149c
pop dword [ebp - 0x30]
mov eax, 0xcd844db4
sub eax, 0xbd843918
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x7085dd4f
sub dword [ebp - 0x40], 0x22339804
mov dword [ebp - 0x3c], 0x9b4f6ecb
sub dword [ebp - 0x3c], 0x691c2286
mov dword [ebp - 0x38], 0x2cb0859a
add dword [ebp - 0x38], 0x1f9bbe94
mov dword [ebp - 0x34], 0xd0f94dfa
sub dword [ebp - 0x34], 0xd0f94dfa
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x5a229f17
add dword [ebp - 0x40], 0x1a4fca3f
mov dword [ebp - 0x3c], 0x20890f3
sub dword [ebp - 0x3c], 0xc09c2f7e
mov dword [ebp - 0x38], 0xfce7b2d3
sub dword [ebp - 0x38], 0x99784667
mov dword [ebp - 0x34], 0x4acfd2d9
sub dword [ebp - 0x34], 0x4acfd2d9
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x33b07
push 0
call eax
mov ecx, 0xe0deb619
add ecx, 0x1f2186be
xor edx, edx
add edx, eax
mov ebx, 0xcb0e403f
add ebx, 0x44f211c1
add ebx, dword [ebp - 0x30]
mov esi, 0xed554aaf
add esi, 0xa0d6c45a
add dword [ebp - 0x1c], edi
mov edi, dword [ebx]
xor edi, esi
xor dword [ebp - 0x24], edx
mov dword [edx], edi
add dword [ebp - 0x18], 0x954bcdad
add edx, 4
add ebx, 4
loop 0x100015b6
add eax, 0xe62f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x3a8d6f7c
sub ecx, 0x2a8d6f7c
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x4164d1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x4164e0
pop dword [ebp - 0x4c]
mov eax, 0x5acd1487
sub eax, 0x5a8bafa7
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x38e84
push 0
mov eax, 0xcfbc172e
sub eax, 0xcf7a251e
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x32b9
xor esi, esi
add esi, eax
mov edi, 0x1f0d7bea
add edi, 0xe1360616
add edi, dword [ebp - 0x4c]
mov edx, 0xeb9dd2f6
add edx, 0xf2d87858
xor dword [ebp - 0x48], 0x8aff25b6
mov ebx, dword [edi]
mov dword [ebp - 4], 0x34ad97a1
sub ebx, edx
add dword [ebp - 0x18], 0xf9c6b238
mov dword [esi], ebx
add dword [ebp - 0x34], 0xdbb6578
add esi, 0xb194063f
sub esi, 0xb194063b
add edi, 4
loop 0x41653b
add eax, 0x7726c320
add eax, 0x88d9fa97
xor ebx, ebx
add ebx, eax
add eax, 0xdc27d5c6
add eax, 0x23d82a3f
mov ecx, 0x3f871991
add ecx, 0xc0b8e66f
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret