joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451ae8
Capabilities:
Encode data using xor

Disassembly:
inc ebp
rcl dword [edx]
xchg esi, eax
or ebx, dword [ebx + edx]
and eax, dword [0xdd6318d6]
push esp
push ebp
add edx, edx
push edi
fnstenv [eax + 0x648518b3]
loopne 0x451b7e
xchg ebx, eax
pop es
adc eax, dword [edi + 0x38c6ed51]
movsd dword es:[edi], dword [esi]
mov ebx, 0x454d8733
mov esi, dword [eax + 0x48c072b1]
xchg ebx, eax
nop
mov edi, dword [ebx]
ret
mov esi, 0xddad0f53
push esp
sub eax, 0xf76a98ae
and dh, byte [ebx + 0x5113c240]
xchg ebx, eax
wait
int 0x78
fidivr dword [ebx - 0x29d265ff]
aaa
pop esp
or al, 0x92
or eax, 0xe335a89d
mov dl, 0x5c
invalid
xchg ebp, eax
out dx, al
inc ebx
lodsb al, byte [esi]
xor dword [ebx + 0x447772a2], 0xfffffff1
test dword [ebx - 0x6cbaf10f], 0x34c65a07
and edi, dword [ebp + ecx*8 + 0x51257c87]
lea ebp, [ebx + 0x157a9074]
mov byte [0x1a7aab02], al
pop ss
push edi
pop es
fst dword [ebx]
mov esp, 0x54a2bbf8
jmp 0x451b1c
adc edi, dword [eax + edi*8 - 0x14ab5d45]
xchg esi, eax
shr byte [esi], cl
sahf
add dword [eax - 0x50], ebx
loope 0x451b52
pop edi
cld
bound ebx, qword [edi - 0x7a52256d]
invalid
pop ebp

Function at 0x47f218
Capabilities:
Encode data using xor

Disassembly:
les esp, [esi + 0x57]
hlt
xchg ecx, eax
test eax, 0xb1aba1f2
mov dl, 0xd5
sal dword [ebp - 0x31], 1
cmpsb byte [esi], byte es:[edi]
int1
outsd dx, dword [esi]
cmp dword [edi + 0x3b], ebp
add ecx, esi
enter 0xffffffffffffb5f4, 0x66
out 0xd8, al
in eax, 0xc1
jg 0x47f19c
movsd dword es:[edi], dword [esi]
jns 0x47f1f2
push es
invalid
xor al, byte [edx - 0x51]
test dword gs:[esi], ebp
push edx
salc
pop ebx
cmpsb byte [esi], byte es:[edi]
cwde
mov dl, 0x9e
mov dl, 0x9e
popal
loop 0x47f1d3
iretd
add eax, 0x5013f688
movsd dword es:[edi], dword [esi]
je 0x47f1c2
xor dh, byte [ebx - 0x2b]
movsd dword es:[edi], dword [esi]
imul edx, dword [edx + 0x7651a349], 0x870fecba
push cs
loope 0x47f292
jbe 0x47f1e5
in al, dx
ja 0x94a9d340
xchg esp, eax
stc
inc ebx
rcl dword [ebp - 0x552f6e64]
out dx, al
xchg ebp, eax
and eax, 0x3075846
pop ecx
pushal
jbe 0x47f229
mov byte [eax], dh
test byte cs:[eax - 0x26], dh
wait
jne 0x47f28c
mov al, byte [0xf6cb6d1d]
jmp 0x8a087e52
pushal
sahf
into
cdq
mov ecx, 0x37a0e008
loopne 0x47f234
aaa
sub eax, 0x2c7f83a1
xchg esp, eax
pop ecx
jo 0x47f2a1
pushal
sbb dword [ebx - 0xb4ae049], edx
mov bh, 0x1f
mov ch, 0xf4
invalid
Function at 0x4ba270
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
push ebx
push esi
push edi
lea eax, [ebp - 0x198]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x1a8], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x1ac], eax
lea ecx, [ebp - 0x19c]
push ecx
push 0x2000000
mov edx, dword [ebp - 0x1ac]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4ba314
push 4
lea eax, [ebp - 0x1a8]
push eax
push 0x18
mov ecx, dword [ebp - 0x19c]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4ba307
mov edx, dword [ebp - 0x19c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1ac], 0
je 0x4ba305
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4ba314
mov eax, dword [ebp - 0x19c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x609eff

Function at 0x4bb2f6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3310
cmp edx, dword [eax]
je 0x4bb318
add eax, 8
inc ecx
cmp eax, 0x4c33a0
jl 0x4bb309
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3310]
jne 0x4bb446
mov eax, dword [0x4c79b4]
cmp eax, 1
je 0x4bb420
test eax, eax
jne 0x4bb349
cmp dword [0x4c3250], 1
je 0x4bb420
cmp edx, 0xfc
je 0x4bb446
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb380
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bba10
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbc40
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb3c3
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbc40
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfb00
push edi
call fcn.004bd410
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bba10
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bba20
lea eax, [ebp - 0xa0]
push 0x4bfae0
push eax
call fcn.004bba20
push dword [esi + 0x4c3314]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bba20
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd384
add esp, 0x2c
pop edi
jmp 0x4bb446
lea eax, [ebp + 8]
lea esi, [esi + 0x4c3314]
push 0
push eax
push dword [esi]
call fcn.004bbc40
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x42420c
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
test dword [edx + 0x44], edi
sbb ecx, dword [edx + 0x6b]
fcomp dword [edi - 0x2a0f71fe]
fadd st(4)
jne 0x42425c
int3
ja 0x42428f
invalid
dec esp
insd dword es:[edi], dx
inc edi
adc byte [edi + edi*4 + 0x14], dh
sti
aam 0xa6
push 0x4ad235b
int1
add al, 0xf1
or ch, byte [edx - 0x16]
pop ds
aaa
or eax, dword [edx + 0x1a]
movsb byte es:[edi], byte [esi]
jne 0x42429d
rcr byte [eax], 1
psubusw mm4, qword [ebx]
dec ebp
mov ecx, 0x54d7b0a5
cmp dword [ebx - 0x76cd173c], 0xb340c015
shr dword [ecx - 0x5ac7363d], cl
div dword [ecx]
mov ah, 0x78
insb byte es:[edi], dx
ja 0x4242b7
invalid
inc ebp
invalid

Function at 0x44dc0c
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004810fc
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44dd2f
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d42c
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44dd46
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d33c
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46c53c
Capabilities:
Encode data using xor

Disassembly:
loop 0x46c58a
test dword [eax - 0x50], edx
dec ecx
pop esp
add byte [ecx - 0x49], 0x36
stosb byte es:[edi], al
inc edi
lds ecx, [edi + 0x7e]
test dword [ecx + 6], ebx
shl dword [eax + 0x717ee778], cl
sbb eax, 0x2e6d0428
xor eax, 0x355fe43a
pop es
sti
jmp 0x46c5a2
xor esp, dword [ecx + ebx]
and al, 0x19
lcall 0x72bc, 0x2cd72ab9
push 0x45
or ah, byte [0xf4463b89]
outsd dx, dword [esi]
push ecx
adc al, 0x24
shl esp, cl
sbb esp, dword ss:[esi + 0x41cca72b]
sbb esp, dword [esi + 0x41cca72b]
push 0x86ed6ea5
test eax, 0x333e8fe5
and dword [0x1845e75d], esp
and al, 0x72
dec ebp
imul esi, dword [esi], 0xe41d1c17
mov ah, 0xf0
enter 0xffffffffffffbc3e, 0xffffffffffffff80
loopne 0x46c589
xchg edx, eax
mov dword [0xccf68477], eax
mov cl, 0x72
sar dword [ebx*2 - 0x63abc0d7], 0x36
jge 0x46c5ff
adc eax, 0x553cb157
wait
push edi
adc byte [ebp + eax + 0x72a4a486], 0xb7
in eax, 0xe0
movsb byte es:[edi], byte [esi]
in eax, 0x87
mov eax, dword [ebx + edx*2 - 0x28a93fb8]
hlt
adc edi, dword [ecx + 0x7e]
loop 0x46c66a
and byte [ecx - 0x4f6b2ca3], 0xa1
mov dh, 0xb4
retf
cmp esi, dword [eax - 0x8a893c9]
call 0xd5dc6c22
imul esp, dword [esi - 0x47], 0x6127e342
pushfd
pop esp
pop edi
push esp
xchg ebp, eax
adc al, 0xec
push ebp
pop ss
xchg dl, bl
in al, 0x7e
sub ecx, eax
push 0xfb0ca530
in al, 0xbb
adc dword [edi + 0x7b], esi
fdivp st(6)
in eax, 0x60
pushal
xchg edi, eax
popfd
aad 0xe4
push esp
mov al, 0x31
je 0x46c63b
mov cl, 0x91
hlt

Function at 0x48122c
Capabilities:
Encode data using xor

Disassembly:
and dl, ch
xchg esp, eax
jnp 0x481242
sub byte [edi + esi + 0x28852c52], dl
pop ebx
cmp al, cl
cmpsb byte [esi], byte es:[edi]
pop ebx
mov al, byte [0xa77aa20b]
in al, 0xfa
push 0x25
loopne 0x481288
jmp 0x4812ae
imul esi, dword [edi + 2], 0xffffffd3
mov dh, 0x3e
retf
or eax, 0x37f66373
xlatb
sldt word [ebx + 0x79a92b67]
sub dword [edi - 0x7956593c], esi
add byte [esi], dh
mov byte [0x896bdd28], al
push edi
jno 0x4812c8
adc eax, 0x5d12789e
loop 0x481272
add ah, byte [eax + ecx*8 + 0x7e]
invalid
enter 0xffffffffffffc77e, 0x15
invalid
lea ecx, [ebx - 0x76]
or esp, dword [bx]
cmp al, 0x88
sbb byte [edx - 0x4f], dl
mov bh, 0xa3
mov dh, 0xd8
dec eax
stosd dword es:[edi], eax
test byte [edx + 0x11e3eded], dl
mov dh, 0xeb
fcomp dword [ecx]
pop eax
mov esp, 0xa07770c9
invalid
Function at 0x493570
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
push esi
lea eax, [ebp - 0x198]
push edi
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.0044a210
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 8], 1
call edi
lea ecx, [ebp - 4]
mov esi, eax
push ecx
push 0x2000000
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4935f0
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push 4
push edx
push 0x18
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x4935e6
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4935f0
call edi
jmp 0x4935f0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0xb3e7fb

Function at 0x4b5a4c
Capabilities:
Encode data using xor

Disassembly:
mov ah, 0x87
xchg esp, eax
and eax, 0x3e11d935
mul dl
xor dword [ebx + ebp*2 - 0x7c96ed32], ecx
stc
and ecx, dword [edi]
enter 0xffffffffffffb52c, 0x54
mov cl, 0x63
adc dword [esi], 0xfbdcade1
mov byte [0x230dc0d0], al
invalid

Function at 0x4e03ec
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005138dc
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e050f
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffc0c
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e0526
push ecx
lea ecx, [esi + 0x24]
call fcn.004ffb1c
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x51315c
Capabilities:
Encode data using xor

Disassembly:
xor byte [edx - 0x3612d010], ah
pop ebp
cdq
adc al, 0xe0
lea edx, [eax - 0x57]
sub edi, dword [edx - 0x62ac529b]
lodsd eax, dword gs:[esi]
push ebx
popfd
lodsd eax, dword gs:[esi]
push ebx
popfd
mov dh, 0x5a
mov al, byte [0x5a34ef2a]
sbb eax, eax
jbe 0x51314d
push ecx
add byte [esi + 0x5a], 2
mov word [ebp - 0x6c29efb0], gs
mov esp, 0xbc482380
wait
enter 0x3688, 0xffffffffffffffed
push ss
xchg esi, eax
invalid

Function at 0x52f190
Capabilities:
Encode data using xor

Disassembly:
add eax, 0xeaa59fa7
xor word [0xb9bfdf28], sp
xor dword [0xb9bfdf28], esp
push 0xffffffffffffffa9
insd dword es:[edi], dx
xchg dword [ebx - 0xa0cfdeb], ecx
cld
xchg esp, eax
lds ecx, [edi]
test byte [edx + 0x7d], bl
aam 0xd3
jo 0x52f196
or ch, byte [edx - 0x23]
popal
pop edx
ljmp 0x157c

Function at 0x52f406
Capabilities:
Encode data using xor

Disassembly:
pop ecx
cwde
fisttp dword [ebx - 0xaaac504]
pop esi
push ebx
enter 0x4a39, 0x38
and eax, 0x278e9e3c
dec edi
push ebp
insb byte es:[edi], dx
aam 0xbe
inc edx
invalid

Function at 0x57312c
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a661c
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x57324f
push ecx
lea ecx, [esi + 0x18]
call fcn.0059294c
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x573266
push ecx
lea ecx, [esi + 0x24]
call fcn.0059285c
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5bc6dc
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005efbcc
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bc7ff
push ecx
lea ecx, [esi + 0x18]
call fcn.005dbefc
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bc816
push ecx
lea ecx, [esi + 0x24]
call fcn.005dbe0c
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5c2252
Capabilities:
Encode data using xor

Disassembly:
and cl, dh
jbe 0x5c22ad
salc
mov esp, 0xd8f07761
xor al, 0x40
ficomp dword [eax + 0x7b259f6d]
and ch, bl
xchg esp, eax
test dword [0xb68f438d], 0x99b4d18f
jns 0x5c22d4
or ch, byte [ebp + 0x62]
stc
sbb byte [ecx - 0x4f], ah
inc esp
rcl esp, 0xb1
cmp dword [edi - 0x4bcbe8e0], esp
mov ah, 0x68
xchg edi, eax
sub ebp, edx
ucomiss xmm5, xmm7
xlatb
cwde
adc edx, ebp
xor dword [edx + 0x68], ebp
wait
adc ebx, dword [edi + 0x1e]
mov edi, 0xcb536063
rol dword [0x5ee10c53], 0x90
mov esi, 0xa581f192
sahf
arpl word [eax], bp
stosb byte es:[edi], al
shl dword [ecx], 0xbd
mov esp, dword [edx]
sub ebx, dword gs:[edx + ebx*2 - 0x2b3eeea]
xor al, 0xc1
xchg edi, eax
test eax, 0x1c49471f
and dword [ebp + 0x2b65228b], edi
pushfd
pop edx
push ss
adc dword [ebp + edi*8 + 0x34], ecx
rcl dword [edi + 0x49471fa9], 0x1c
dec ebx
mov eax, dword [0x88acae39]
add ecx, ebx
xlatb
insb byte es:[edi], dx
and eax, 0x5624eaec
cwde
pop ds
xor dword [ecx - 0x4e659dfe], 0x62725d01
add ah, byte [edx - 0x66]
mov cl, 1
pop ebp
jb 0x5c233e
and ebx, dword [ebp - 0x42]
scasb al, byte es:[edi]
mov bl, 0x99
loope 0x5c22d0
inc esi
test dword [eax - 0x5e791d11], ecx
mov edi, 0x1db18b87
dec ecx
adc ebp, ecx
aaa
dec edi
or byte [edx], bh
pop ds
add eax, 0x471a356a
dec edx
mov dword [0x16d5b6be], eax
rcl dword [edi - 0x39]
scasd eax, dword es:[edi]
fisttp word [eax]
rol byte [eax + 0x4ef7c12f], 0x3f
je 0x5c233d
rol dword [edi + 0xd], 0x85
add bl, dh
adc dword [edi + 0x7c], eax
in al, 0x7f
or eax, 0x11f30085
inc edi
jl 0x5c234c
in al, 0x7f
sub al, 0xbc
mov al, byte [0x9ab0d64e]
rol byte [ebp + ebx*2 - 0xad11be], 1
out dx, al
push edx
invalid
call 0x7f7656c2
insd dword es:[edi], dx
adc ch, dl
inc esi
les edx, [ebp - 0x56]
add eax, 0xafa653cf
cmpsb byte [esi], byte es:[edi]
scasd eax, dword es:[edi]
dec esp
test eax, 0xa8e68968
loopne 0x5c22ff
int 0x1e
mov ebx, 0xfcc169cc
in al, 0xd0
xchg ebp, eax
sal byte [esi + esi], cl
and eax, 0x6199f55b
sar esp, 0xe4
rcl byte [ebp + 0x253634d2]
pop ebx
cmc
cdq
popal
bound edi, qword [ebp + 0x22]
insd dword es:[edi], dx
sbb bl, byte [eax + eax - 0x7a]
jmp 0x5c2316
Function at 0x605d6c
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0063925c
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x605e8f
push ecx
lea ecx, [esi + 0x18]
call fcn.0062558c
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x605ea6
push ecx
lea ecx, [esi + 0x24]
call fcn.0062549c
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x64cd4d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x654390
Function at 0x615e75
Capabilities:
Encode data using xor

Disassembly:
sub al, 0xc5
push 0xded9e647
inc esp
pop ds
invalid
Function at 0x402d00
Capabilities:
Check mutex on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0
mov dword [0x41a424], esi
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push str.GS104_Device
call edi
movups xmm0, xmmword [0x41608c]
push 0x41a468
push 1
movups xmmword [0x41a468], xmm0
push 0
movq xmm0, qword [0x41609c]
movq qword [0x41a478], xmm0
movups xmm0, xmmword [0x416074]
movups xmmword [0x41a480], xmm0
movq xmm0, qword [0x416084]
movq qword [0x41a490], xmm0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x402d90
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x402ed3
movups xmm0, xmmword [0x416074]
push str.4695579F_999A_41d4_9FAF_EFFCE93EBE19
movups xmm2, xmmword [0x41608c]
movq xmm1, qword [0x41609c]
movups xmmword [0x41a880], xmm0
movq xmm0, qword [0x416084]
movq qword [0x41a890], xmm0
movups xmm0, xmmword [0x41605c]
movups xmmword [0x41a868], xmm2
movups xmmword [0x41a680], xmm0
movq xmm0, qword [0x41606c]
movq qword [0x41a878], xmm1
movups xmmword [0x41a668], xmm2
movq qword [0x41a678], xmm1
movq qword [0x41a690], xmm0
call edi
mov ecx, esi
mov dword [0x41aa6c], eax
call fcn.00402ef0
push 0
push esi
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x41a868
push 0x41a668
push 0
mov dword [0x41aa68], esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
test edi, edi
je 0x402ed3
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x6d
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
push 0
push eax
call esi
test eax, eax
je 0x402eb8
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x402ea7
lea eax, [ebp - 0x20]
push eax
call edi
lea eax, [ebp - 0x20]
push eax
call ebx
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call esi
test eax, eax
jne 0x402e87
pop ebx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040439d
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0040439d
mov esp, ebp
pop ebp
ret 0x10