joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100383b1
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push 0x10
mov eax, 0x10068458
call fcn.1003a5de
xor esi, esi
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
and dword [ebp - 4], esi
lea ecx, [ebp - 0x14]
call fcn.1000155e
mov edi, dword [ebp - 0x14]
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
test edi, edi
je 0x100383e6
xor eax, eax
cmp dword [edi], eax
sete al
jmp 0x100383e8
mov eax, ebx
test al, al
je 0x100383f3
push 0x100a061a
jmp 0x10038411
test edi, edi
je 0x100383fb
mov eax, dword [edi]
jmp 0x100383fd
xor eax, eax
push eax
call fcn.10038353
pop ecx
test eax, eax
jne 0x1003844c
lea ecx, [ebp - 0x14]
call fcn.10029b00
push eax
call dword [sym.imp.wsock32.dll_gethostbyname]
test eax, eax
je 0x100384b8
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.wsock32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x18]
call fcn.10012712
push eax
lea ecx, [ebp - 0x10]
call fcn.100015bc
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1003845c
call fcn.100016f0
jmp 0x1003845c
cmp eax, ebx
jne 0x100384b8
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.100015bc
lea ecx, [ebp - 0x10]
call fcn.10029b00
push eax
call dword [sym.imp.wsock32.dll_inet_addr]
push 2
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push 4
push eax
call dword [sym.imp.wsock32.dll_gethostbyaddr]
mov esi, eax
test esi, esi
je 0x100384b5
mov ecx, dword [esi]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10038487
sub ecx, edx
push ecx
push dword [esi]
call fcn.1004cb7f
pop ecx
pop ecx
push dword [esi]
lea ecx, [ebp - 0x18]
call fcn.10012712
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x100384b0
call fcn.100016f0
mov esi, dword [ebp - 0x10]
jmp 0x100384ba
mov esi, dword [ebp - 0x10]
xor bl, bl
test edi, edi
je 0x100384c5
mov ecx, edi
call fcn.100016f0
test esi, esi
je 0x100384d0
mov ecx, esi
call fcn.100016f0
mov al, bl
call fcn.1003a5b8
ret
Function at 0x1000cc3e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002d770
call fcn.10016ea3
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000ccbb
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000ccbb
call fcn.10005a09
mov esi, eax
jmp 0x1000cd92
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000ccde
call fcn.10005a09
jmp 0x1000cd85
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000ccd4
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000cd0e
mov esi, 0x8007000e
jmp 0x1000cd87
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1002b0a3
jmp 0x1000cd34
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000cd07
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000ccd4
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.1002b0a3
mov esi, eax
test edi, edi
je 0x1000cd92
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000cdab
lea ecx, [ebp - 0x418]
call fcn.1000c3cf
mov eax, esi
call fcn.10016df0
ret 0x10
Function at 0x10012247
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002dc29
call fcn.10016e01
mov ebx, ecx
mov eax, dword [ebx]
xor edi, edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x100304d0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.1002b0a3
and dword [ebp - 4], edi
lea esi, [ebx + 0x44]
cmp dword [esi], edi
je 0x100122f2
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1002b0a3
mov ecx, dword [esi]
test al, al
je 0x100122d4
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push ecx
push eax
movsd dword es:[edi], dword [esi]
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1002b0a3
add esp, 0x28
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
lea esi, [ebx + 0x44]
jmp 0x100122eb
push 0
push str.Close
push ecx
push 0
push 1
push ebx
call fcn.1002b0a3
add esp, 0x18
mov edi, eax
mov ecx, esi
call fcn.10009b23
cmp dword [ebx + 0x24], 0
je 0x10012312
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1002b0a3
test al, al
je 0x10012312
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, edi
call fcn.10016dca
ret
Function at 0x10013230
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x214
mov eax, 0x1002dcec
call fcn.10016e35
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x21c], eax
cmp dword [ebx + 8], 0
je 0x1001325b
mov eax, reloc.oleaut32.dll_VariantCopyInd
jmp 0x100133e6
mov eax, dword [ebx - 0xc]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x100304d0]
lea ecx, [ebx - 0xc]
call esi
mov ecx, dword [ebx + 0x14]
test ecx, ecx
jne 0x1001327f
mov eax, 0x80004005
jmp 0x100133e6
mov edx, dword [ebp + 0x10]
mov esi, reloc.oleaut32.dll_SysReAllocString
mov eax, edx
and eax, esi
cmp eax, esi
push dword [ebp - 0x21c]
sete al
mov byte [ecx + 0x31], al
lea ecx, [esi + 2]
mov eax, edx
and eax, ecx
cmp eax, ecx
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x32], cl
lea eax, [esi + 6]
and edx, eax
cmp edx, eax
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x33], cl
mov ecx, dword [ebx + 0x14]
add ecx, 0x28
call fcn.1002b0a3
mov edi, dword [ebx + 0x14]
mov eax, dword [edi]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x100304d0]
mov ecx, edi
call esi
push eax
lea ecx, [ebp - 0x220]
call fcn.1002b0a3
xor esi, esi
lea ecx, [ebp - 0x220]
push str.Excel.Application
mov dword [ebp - 4], esi
call fcn.1002b0a3
test al, al
je 0x100133be
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10019ba0
mov edi, dword [ebp - 0x21c]
push 0x5c
push edi
call fcn.1002b0a3
add esp, 0x14
test eax, eax
jne 0x10013338
push 0x2f
push edi
call fcn.1002b0a3
pop ecx
pop ecx
test eax, eax
je 0x10013358
add eax, 2
push 0x2e
push eax
call fcn.1002b0a3
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.1002b0a3
add esp, 0x14
cmp word [ebp - 0x218], si
je 0x100133b7
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.1002b0a3
pop ecx
pop ecx
mov ecx, dword [ebx + 0x14]
add ecx, 0x24
test eax, eax
jne 0x100133a9
lea eax, [ebp - 0x218]
push eax
call fcn.1002b0a3
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x100133af
push edi
call fcn.1002b0a3
mov eax, dword [ebx + 0x14]
add eax, 0x24
jmp 0x100133cf
mov esi, 0x80004005
jmp 0x100133d8
mov ecx, dword [ebx + 0x14]
push dword [ebp - 0x21c]
add ecx, 0x24
call fcn.1002b0a3
push eax
lea ecx, [ebx + 0x10]
call fcn.1002b0a3
push dword [ebp - 0x220]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, esi
call fcn.10016ddf
ret 0xc
Function at 0x10013a90
Capabilities:
Terminate process

Disassembly:
push 0x81c
mov eax, 0x1002ddab
call fcn.10016e35
mov ebx, ecx
xor ecx, ecx
lea edi, [ebx + 0x40]
mov esi, ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], ecx
cmp dword [edi], ecx
je 0x10013bcc
push 0x10
push ecx
lea eax, [ebp - 0x828]
push eax
call fcn.10019ba0
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantClear]
push esi
push str.Caption
push dword [edi]
lea eax, [ebp - 0x828]
mov dword [ebp - 4], esi
push eax
push 2
push ebx
call fcn.1002b0a3
add esp, 0x18
test eax, eax
jne 0x10013b31
push dword [ebp - 0x820]
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.1002b0a3
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push esi
call dword [sym.imp.user32.dll_FindWindowW]
mov dword [ebp - 0x814], eax
mov eax, dword [ebx]
lea ecx, [ebp - 0x818]
push ecx
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100304d0]
mov ecx, ebx
call esi
mov esi, eax
test esi, esi
js 0x10013b70
cmp dword [ebp - 0x818], 0
jne 0x10013b70
push 0
push str.Quit
push dword [edi]
push 0
push 1
push ebx
call fcn.1002b0a3
add esp, 0x18
mov esi, eax
mov ecx, edi
call fcn.10009b23
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x10013bcc
cmp dword [ebp - 0x818], 0
jne 0x10013bcc
test esi, esi
jns 0x10013bcc
and dword [ebp - 0x814], 0
lea ecx, [ebp - 0x814]
push ecx
push eax
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x814]
push 1
push 0x1fffff
call dword [sym.imp.kernel32.dll_OpenProcess]
push 1
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, esi
call fcn.10016ddf
ret
Function at 0x10015057
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002dffa
call fcn.10016e35
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015074
xor eax, eax
jmp 0x10015151
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001514f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x10015125
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000127b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000127b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.1002b0a3
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x1001512f
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x100150a4
jmp 0x10015148
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016ddf
ret

Function at 0x1002b0a3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1002b0b2
pop dword [ebp - 0x24]
mov eax, 0xea1850b7
sub eax, 0xda15a005
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3de6a
push 0
mov eax, 0xbd55f631
add eax, 0x52ad0b2b
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x3e90
xor esi, esi
add esi, eax
mov edi, 0xbfeffa
sub edi, 0xf0bb33fa
add edi, dword [ebp - 0x24]
mov ebx, 0x9631165
sub ebx, 0xc5f77711
sub dword [ebp - 0xc], edx
mov edx, dword [edi]
xor dword [ebp - 4], 0x48f0f3c4
add edx, ebx
add dword [ebp - 8], esi
mov dword [esi], edx
sub dword [ebp - 0x1c], 0x8930ec01
add esi, 0x7fe31b2d
sub esi, 0x7fe31b29
add edi, 0xdf5b92eb
sub edi, 0xdf5b92e7
loop 0x1002b10d
add eax, 0xed13
xor ebx, ebx
add ebx, eax
add eax, 0x9691ab7f
sub eax, 0x9691ab7a
mov ecx, 0x4027d54d
add ecx, 0xcfd82ab3
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x10007b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10007b2f
pop dword [ebp - 0x3c]
mov eax, 0x10007b2f
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xc6bc3a9e
add dword [ebp - 0x4c], 0x87960aad
mov dword [ebp - 0x48], 0x614059f8
add dword [ebp - 0x48], 0xd0f2f24d
mov dword [ebp - 0x44], 0xb88bae6c
add dword [ebp - 0x44], 0x93c095c2
mov dword [ebp - 0x40], 0xf75a86d2
add dword [ebp - 0x40], 0x8a5792e
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x9d63f774
add eax, 0x729d28cc
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x62cbe67
add dword [ebp - 0x4c], 0x6e45aaef
mov dword [ebp - 0x48], 0x29799b50
sub dword [ebp - 0x48], 0xe80d39db
mov dword [ebp - 0x44], 0x1057f44a
sub dword [ebp - 0x44], 0xace887de
mov dword [ebp - 0x40], 0x30329b96
add dword [ebp - 0x40], 0xcfcd646a
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b181
push 0
call eax
mov ecx, 0xb2e10150
add ecx, 0x4d1f4c25
xor esi, esi
add esi, eax
mov edx, 0xf602caf6
sub edx, 0xe6011af6
add edx, dword [ebp - 0x3c]
mov edi, 0xafffb782
sub edi, 0x8eece01b
mov dword [ebp - 0x20], 0xf2b0b695
mov ebx, dword [edx]
add dword [ebp - 0x24], 0xc9021ff2
xor ebx, edi
add dword [ebp - 0x30], eax
mov dword [esi], ebx
sub dword [ebp - 0x34], 0xccfa3773
add esi, 4
add edx, 0x9fcf1bd2
sub edx, 0x9fcf1bce
loop 0x10007c49
add eax, 0x39e9b196
add eax, 0xc6177711
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x4047a9
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437c99
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4048cc
push ecx
lea ecx, [esi + 0x18]
call fcn.00423fc9
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4048e3
push ecx
lea ecx, [esi + 0x24]
call fcn.00423ed9
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44dae9
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00480fd9
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44dc0c
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d309
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44dc23
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d219
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45354d
Capabilities:
Encode data using xor

Disassembly:
daa
sbb dword [esi - 0x30], edi
into
push esi
salc
stosd dword es:[edi], eax
cli
salc
jae 0x4535b6
xchg esi, eax
sbb al, 0xe1
add bh, byte [edx + 0x3ea7590c]
inc ecx
push esi
jno 0x4535c6
fst dword ds:[eax + 0x19]
popal
sub eax, 0xd0f12c00
jb 0x453583
popfd
salc
pop ebp
cmp dword [edx + 0x133e42a3], edi
jp 0x453596
out dx, eax
scasb al, byte es:[edi]
push eax
or ecx, dword [0x7cee7ef7]
sahf
fisub word [ebp + 0x1e]
push edi
push cs
sub dword [edi - 0x3f6320ed], ebp
les ebp, [edi]
out 0x9e, al
shr dword [edx - 0x35], 0xe
push eax
adc al, 0x4f
invalid
pop esp
jg 0x45352f
pop eax
sub eax, 0x46001e28
loopne 0x453600
cdq
mov dword [0xd1fadf17], eax
push ebp
sbb byte [eax + 0x11], 0x8e
pop eax
adc dword [esi + 0x8ab1e63], ecx
cld
arpl word [esi], bx
stosd dword es:[edi], eax
or ah, bh
pop edx
pushfd
inc ebx
popal
out 0xb1, al
nop
jl 0x453574
out dx, al
pushal
mov dl, 0xf0
mov edi, 0xce9899a2
int3
add dword [eax - 9], ebx
xchg esi, eax
in al, 5
xor cl, byte [ecx]
invalid
aam 0x73
cmpsd dword [esi], dword es:[edi]
idiv dword [eax + 0x38de0cc]
xchg ebx, eax
jg 0x4535fd
outsd dx, dword [esi]
outsd dx, dword [esi]
shr dword [ecx - 0x6e], 0xa3
jne 0x453599
les ebp, [ecx + 0x51]
ja 0x453613
cmpsd dword [esi], dword es:[edi]
add dh, cl
adc byte [ecx - 0x6b], dl
push ebp
clc
sbb ebp, dword [ebx + 0x1f]
pop edi
and byte [esi], cl
xor dword [eax], edi
das
invalid
mov edi, 0x561a2935
out 0x4e, eax
sbb dl, byte [esi - 0x19]
dec esi
sal dword [ebx], 1
push cs
jle 0x453656
rcl byte [ecx], 0x21
dec edi
jb 0x453662
cwde
pushal
nop
and al, 0x87
mov eax, 0x4c16e6d0
mov bl, 0x88
mov esi, 0x44820156
sub esp, ebx
jo 0x453678
push ebx
xor ebx, dword [ecx + 0x7e]
rcr byte [esi], cl
test al, 0xa
mov eax, dword [0x705b7bcc]
sub dword [edi + ebp*2 + 0x39933750], ecx
cmp eax, 0x216b2016
cmp dword [edi + edi*4 - 0x30], esi
pop ecx
jo 0x453624
loope 0x45366f
loopne 0x45369b
and byte [ebx], ah
cmp eax, 0x6610029e
and byte [0xa8c160fb], bl
dec edx
invalid
fisttp word [edi]
invalid
insb byte es:[edi], dx
mov dl, 0x5e
pop esi
mov bl, 0x69
sub esi, ebx
pushfd
fiadd word [ecx - 0x13]
and ebx, edi
and dword [edi], ebp
sbb edi, ebx
inc eax
invalid
imul eax, dword [eax], 0x50
jg 0x453707
mov bh, 0xef
jmp 0x693a58ee
cwde
or al, 0x2f
adc al, 0x92
js 0x45368b
pushal
pop edi
inc ebp
rcr byte [ebp + 0x35845b58], 0x3e
dec ebx
add byte [ecx], dh
popal
inc ebp
arpl word [edx + 0x55], cx
jbe 0x4536ec
out dx, al
xchg byte [eax], al
loop 0x45366d
jge 0x4536b7
mov dword [esp + ecx*2 - 0x1b584c7c], ebp
imul ah
pop esp
invalid
test al, 0xd8
jl 0x4536ea
xchg esi, eax
invalid
push 0xc1f9ce2c
xor eax, 0x72b37439
fdivp st(0)
push ecx
hlt
Function at 0x4b59d9
Capabilities:
Encode data using xor

Disassembly:
cmc
inc eax
xor cl, cl
test byte [edi + 0x71082044], dl
std
cld
inc ebp
invalid
mov dword [0xedf0fa6c], eax
or dword [ebp - 0x74c9b9cc], edi
xchg esi, eax
cmp eax, 0x2c319305
mov eax, dword [0x88d0e57d]
xchg ebx, eax
sbb eax, 0xc2dcbcb
sub bh, byte [esi + 0x15]
jecxz 0x4b598b
nop
sub cl, byte [ebp - 0x55]
xchg ebx, eax
ficom dword [edi + 0x6b]
dec eax
std
popal
mov esp, 0xc840a599
mov dh, 0x79
std
mov esi, 0x29e011bc
xchg esp, eax
dec ecx
neg byte [0xb1ac5559]
dec edx
jge 0x4b5a5f
dec ecx
mov ebx, 0xe927fd3e
jb 0x4b5a8a
insd dword es:[edi], dx
mov bh, cl
enter 0xffffffffffffd379, 0x6e
xchg ebp, eax
aam 0x61
mov eax, 0xfd2cfb85
adc eax, 0x5d3875dc
pop esi
push esi
cmc
mov ecx, 0x98d9b399
js 0x4b5a44
jmp dword [edx]
and bl, byte [edi + ecx]
add cl, byte [esp + ebp - 0x7f873bcd]
xor al, 4
stosb byte es:[edi], al
dec ecx
push esp
jecxz 0x4b5a92
adc dword [edi + eax - 0x41b50b05], eax
jl 0x4b59fa
xchg ebx, eax
cmp al, 8
dec edx
jge 0x4b5a36
les eax, [ebp + 0x5bd3a2a5]
int 0xd2
cld
movsb byte es:[edi], byte [esi]
cli
mov ebp, 0x12cf9175
mov ebp, fs
in eax, dx
pop ds
std
push edx
or byte [ecx - 0xc], 0xb2
aas
nop
sub al, 0xad
xchg ebx, eax
mov cl, 0xec
fist word [eax]
jno 0x4b5af4
loopne 0x4b5a52
mov ah, 0x54
xchg esp, eax
div byte [0xf6ed110a]
xor dword [ecx], esi
pop edi
imul ebx, dword [0x2a83ba12], 0x23
fmul st(0), st(0)
push dword [ebp - 0x7e4f4e79]
invalid
adc ebp, ebp
div byte [ecx]
xor dword [edi + 0x6b], ebx
sbb eax, 0x2a83ba12
and ebx, esp
enter 0xffffffffffffb5ff, 0xffffffffffffff87
mov cl, 0xb0
add ebp, 0x28dc7ee1
mov byte [0x23dec003], al
adc al, 0x69
dec esp
push eax
dec edi
cmpsd dword [esi], dword es:[edi]
pop ds
loop 0x4b5aba
and al, 0x7a
add byte [esi - 0x4b], bh
or al, byte [edi - 0x693e5066]
invalid
mov eax, dword [0x9d4cb6c]
xchg esp, eax
cdq
or al, 0x85
outsb dx, byte [esi]
xchg ebx, eax
int3
Function at 0x4e02d9
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005137c9
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e03fc
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffaf9
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e0413
push ecx
lea ecx, [esi + 0x24]
call fcn.004ffa09
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret