joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f40
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x7fa408]
sub esp, 0x20c
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x4020ed
cmp dword [0x7fa40c], 0
jne 0x4020d9
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.00402450
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x401f90
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41c0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x401fa0
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41c0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x401fd5
push 0x200
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00402450
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402034
sub edx, esi
sar edx, 1
je 0x4020ed
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x402050
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x4020ed
xor eax, eax
push ebx
test edx, edx
je 0x402088
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x402088
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x402071
xor eax, eax
test edx, edx
je 0x4020a2
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x4020a2
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x402090
xor eax, eax
test edx, edx
je 0x4020bf
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x4020bf
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x4020b0
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x7fa408]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret
Function at 0x402340
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x7fb0f4]
sub esp, 0x11c
test eax, eax
jne 0x40243e
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.00402450
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x402390
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41c100]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x4023a0
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x41c104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x4023d5
xor edx, edx
lea ecx, [esp + 0xc]
call fcn.00404040
pop edi
pop esi
pop ebx
test eax, eax
je 0x402439
mov eax, dword [eax + 0x18]
test eax, eax
je 0x402439
mov dword [0x7fb0f4], eax
add esp, 0x11c
ret
mov eax, dword [0x7fb0f4]
add esp, 0x11c
ret
Function at 0x402ed0
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x7fa548
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x402ff9
cmp dword fs:[0xc0], eax
je 0x402efb
mov dword [0x7fa544], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x7fa42c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x7fa430], eax
movzx edx, word [esi + 0xac]
mov dword [0x7fa434], edx
mov eax, dword [esi + 0xb0]
mov dword [0x7fa438], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x402f5b
push 0x7f
push eax
push 0x7fa43c
call fcn.00401770
mov edx, dword [0x7fa434]
add esp, 0xc
jmp 0x402f63
xor eax, eax
mov word [0x7fa43c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x7fa53c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x7fa53e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x7fa540], ax
mov ecx, eax
mov byte [0x7fa542], 0
cmp byte [0x7ffe0268], 0
je 0x402faa
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x7fa542], bl
cmp ebx, 1
pop ebx
jne 0x402fc4
and ecx, 0xffef
mov word [0x7fa540], cx
test edx, edx
jne 0x402ff9
call fcn.00402ed0
cmp dword [0x7fa42c], 6
ja 0x402ff9
jb 0x402fe1
cmp dword [0x7fa430], 4
jae 0x402ff9
call fcn.00402ed0
cmp dword [0x7fa42c], 0xa
jae 0x402ff9
mov dword [0x7fa434], 1
ret
Function at 0x404040
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x40409b
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x404060
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x40407c
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00401770
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x4040bd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x40412f
mov esi, dword [ebx]
cmp esi, ebx
je 0x40412f
test esi, esi
je 0x40412f
cmp word [esi + 0x24], 2
jbe 0x404129
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x404129
cmp dword [esi + 0x18], 0
je 0x404129
test ebp, ebp
je 0x4040e5
cmp ebp, eax
jne 0x404129
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00401770
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x40410a
cmp edx, dword [esi + 0x18]
jne 0x404129
cmp dword [esp + 0x14], eax
je 0x40413c
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00401ee0
add esp, 8
test eax, eax
je 0x40413c
mov esi, dword [esi]
cmp esi, ebx
jne 0x4040c3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret
Function at 0x404150
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x40419b
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x40418b
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x404171
jmp 0x404190
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x4041eb
mov edi, edx
lea ecx, [edi + 2]
jmp 0x4041b0
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4041b0
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x4041cc
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00401770
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x40420d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x404280
mov esi, dword [ebx]
cmp esi, ebx
je 0x404280
test esi, esi
je 0x404280
cmp word [esi + 0x24], 2
jbe 0x40427a
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x40427a
cmp dword [esi + 0x18], 0
je 0x40427a
test ebp, ebp
je 0x404235
cmp ebp, eax
jne 0x40427a
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00401770
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40425a
cmp eax, dword [esi + 0x18]
jne 0x40427a
cmp dword [esp + 0x10], 0
je 0x40428d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00401ee0
add esp, 8
test eax, eax
je 0x40428d
mov esi, dword [esi]
cmp esi, ebx
jne 0x404213
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x4042a0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x4042c8
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x4042d6
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x4042ef
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x4042fd
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x404316
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x404324
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x40433d
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x40434b
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x404392
add dword [esp], 5
retf

Function at 0x41b802
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0x404a04
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437ef4
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x404b27
push ecx
lea ecx, [esi + 0x18]
call int.00424224
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x404b3e
push ecx
lea ecx, [esi + 0x24]
call fcn.00424134
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x437ef4
Capabilities:
Encode data using xor

Disassembly:
and byte [0xcb43523], ch
push ecx
mov word ss:[edi + 0x32], fs
setg bl
movsd dword es:[edi], dword [esi]
and eax, 0x3ae0b5f
push esi
invalid
Function at 0x44dcf4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004811e4
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44de17
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d514
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44de2e
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d424
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x480a64
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x2817312b
pop ss
sbb al, 0xcc
add dword cs:[ecx], esp
test byte [ebp + ebp*2 - 0x59], bh
shr dword [edx], cl
je 0x480ac8
jg 0x480a93
inc ebp
fdivr dword [ebx + 0x744b13dd]
xchg edx, eax
cdq
or cl, byte [ecx]
invalid
stc
sahf
scasb al, byte es:[edi]
sahf
cmc
les esp, [ebx]
fnstenv [edx]
pop ebx
hlt
jle 0x480b39
inc edx
scasd eax, dword es:[edi]
ret
xor al, 0xca
sal ah, 0x74
loop 0x480b01
inc edx
cmc
pop ss
invalid
add byte [ecx - 0x5ba5543f], bh
adc eax, 0x4e6489b
xchg edx, eax
sub esp, dword [0x63f6b321]
mov ch, 0x5e
and dword [ebx + 0x5eb563f6], esi
mov bh, 7
xor ch, byte [ebp - 0x39]
jns 0x480af3
mov ecx, 0xbf3234b1
xor cl, al
xor eax, 0x643b257a
sub ebx, ecx
jmp 0x480b73
adc al, 0xed
inc eax
lds ebx, [ecx - 0x2a3aab48]
cmp al, 0x66
push dword [edx + 0x29]
mov byte [edx + 0x14], 0x4f
cmp edi, dword [eax]
insb byte es:[edi], dx
popal
loop 0x480b13
jbe 0x480ad9
insb byte es:[edi], dx
lodsd eax, dword [esi]
sbb dword [ebx], esi
loop 0x480ba6
adc dword [esi - 0xa36118e], eax
fldcw word [edi - 5]
sbb eax, 0x1bced173
lds ebp, [esi]
mov dword [esp + 0x2e], eax
sub bh, byte [ecx + 0x73]
invalid
invalid
pop ds
xor al, 0x4d
aad 0x51
sbb edx, 0xc895a5d4
add al, 0xfb
invalid
Function at 0x496bb4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x496c1b
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x496c38
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x496ca1
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004dfb84
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x496c74
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x496c64
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x496c9b
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x496cf5
inc edi
cmp edi, ecx
jb 0x496c88
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.004ca524
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004de400
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x496c9b
cmp dword [esi + 0x14], 0x10
jb 0x496d04
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x496d1e
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004dfb84
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x496d54
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x496d44
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x496d92
cmp ecx, edx
je 0x496e09
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x496d7a
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.004b5af4
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004ca654
mov eax, esi
jmp 0x496cda
or ecx, 0xffffffff
jmp 0x496d94
Function at 0x497034
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca524
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x497157
push ecx
lea ecx, [esi + 0x18]
call fcn.004b6854
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x49716e
push ecx
lea ecx, [esi + 0x24]
call fcn.004b6764
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4b8bd4
Capabilities:
Encode data using xor

Disassembly:
paddb mm3, qword [ecx]
enter 0x6d31, 0xffffffffffffffc3
sub dword [ebx + 0x790d2e13], ebp
into
mov bh, 0x13
insd dword es:[edi], dx
bnd jae 0x4b8b6b
out 0x66, al
xor eax, 0x417d2a18
fcmovnbe st(0), st(1)
xchg edx, eax
mov eax, 0xc1374174
leave
dec ebx
mov al, 0xef
and ebp, dword [edi + ebx*4]
xchg edi, eax
sbb eax, 0x5054f215
mov ebx, 0xc9eb0b25
xchg dword [eax + 0x430513b7], edi
mov ebp, 0x71fb2cf9
call 0x7b0d4028
inc eax
ret 0xad3b
jmp 0x4b8b64
loop 0x4b8b99
xor byte [edx], ch
jg 0x4b8c03
popfd
das
inc ebx
aaa
sahf
inc edx
xor esp, ebx
xor ebx, dword [edi + 0xa41c722]
cmp eax, 0xb88dc1e5
and al, bh
inc ecx
or bh, byte [0xb88dc1e5]
mov eax, 0xec8fea0f
or eax, 0xd6620e5e
invalid
inc dword [edi - 0x2a]
fcmovnu st(0), st(7)
xor eax, 0x153c6e44
loope 0x4b8be5
in eax, dx
retf
Function at 0x4ca654
Capabilities:
Encode data using xor

Disassembly:
imul edi, dword [edx], 0x7f
jb 0x4ca66d
jae 0x4ca6a1
dec ebp
sub dword [ebx + ebp - 0x6d], edi
fadd st(7), st(0)
leave
add dword [esi], esi
pop ecx
pop esi
mov al, 0xb1
mov dl, 0x49
mov ecx, 0x5bd19ad
xchg ebp, eax
and dword [eax + 0x77d1bdba], eax
invalid
sbb dword [ebp - 0x7fde6afb], edi
mov edx, 0xc777d1bd
mov dword gs:[eax - 0x5b], edi
rol byte [edi - 9], 1
shr dword [eax + 0x261a09e0], cl
lodsd eax, dword [esi]
adc dword [0x23953197], ebx
pop ecx
aaa
xor ch, dh
stc
scasb al, byte es:[edi]
popfd
in al, 0x4a
push 0xce41ad2a
retf 0x93c9
test edi, ebx
nop
ja 0x4ca710
invalid
salc
xor dword [edi + 0x5c], ecx
test al, 0x4e
push ebx
jb 0x4ca711
mov ecx, 0x8ee6a325
xlatb
mov ss, edi
mov ecx, cs
cmp byte [esi], 0x20
xchg edi, eax
add esp, ebp
inc ebx
mov cl, 0xcd
int 0xd0
jae 0x4ca740
mov ecx, 0x5abbbf35
jae 0x4ca730
mov edi, 0xfb735abb
in eax, dx
push 0x6a067685
mov ecx, 0xf9288545
mov eax, ss
sbb dword [edx - 0x19fdb698], edx
dec ecx
std
fld xword [edi - 0x16]
out dx, al
jns 0x4ca71d
adc al, 0xdc
dec ebp
salc
push 0x1f128ece
mov edx, gs
jl 0x4ca7cd
sbb eax, 0x6ef2f921
invalid
push 0xb0356dbd
or dword [eax + 0x69724cdc], ebx
sbb al, 0x67
pmuludq mm1, qword [ebp + 0x11]
push edx
or dword [ebx + esi*2 - 0x7c81f768], ecx
add bl, 0x4c
mov ebx, 0xf6be7959
xor bh, byte [ebx - 0x4f]
sub al, 0x6d
int1
sbb edi, ecx
fstp dword [esi]
jbe 0x4ca7c8
pop ecx
je 0x4ca7ef
mov word [edi - 0x469f04ab], ss
xchg ebp, eax
jbe 0x4ca874
stc
xor ch, ah
insb byte es:[edi], dx
or bh, byte [ecx + 0x2219c07b]
cmpsb byte [esi], byte es:[edi]
cmp eax, 0xf77af2da
test eax, 0xf6db383f
fdivr dword [eax]
cmp dword [edx - 0x16], ebp
cmp byte [ebx + 0x2952f872], cl
invalid
ljmp 0x706:0xc2f5